exguard-endpoint 1.0.1 → 1.0.4

package/README.md

@@ -1,6 +1,6 @@
 # ExGuard Endpoint
 
-Simple RBAC permission guard for NestJS.
+Simple RBAC permission guard for NestJS with realtime support.
 
 ## Installation
 
@@ -8,19 +8,42 @@ Simple RBAC permission guard for NestJS.
 npm install exguard-endpoint
 ```
 
-## Quick Setup
+## Quick Setup (Recommended)
+
+Run in your NestJS project root:
+
+```bash
+npx exguard-endpoint setup
+```
+
+This creates:
+- `src/exguard/exguard.guard.ts` - The permission guard
+- `src/exguard/exguard.module.ts` - The module
+
+Then follow the printed instructions.
+
+## Manual Setup
 
 ### 1. Configure AppModule
 
 ```typescript
+// src/app.module.ts
 import { Module } from '@nestjs/common';
 import { ExGuardModule } from 'exguard-endpoint';
 
 @Module({
   imports: [
     ExGuardModule.forRoot({
-      baseUrl: 'https://api.exguard.com',
+      baseUrl: process.env.EXGUARD_BASE_URL || 'https://api.yourdomain.com',
       apiKey: process.env.EXGUARD_API_KEY,
+      cache: {
+        enabled: true,
+        ttl: 300000, // 5 minutes
+      },
+      realtime: {
+        enabled: true,
+        url: process.env.EXGUARD_REALTIME_URL,
+      },
     }),
   ],
 })
@@ -30,8 +53,9 @@ export class AppModule {}
 ### 2. Use in Controllers
 
 ```typescript
-import { Controller, Get, Post, UseGuards } from '@nestjs/common';
-import { ExGuardPermissionGuard, RequirePermissions } from 'exguard-endpoint';
+// src/items/items.controller.ts
+import { Controller, Get, Post, Patch, Delete, UseGuards } from '@nestjs/common';
+import { ExGuardPermissionGuard, RequirePermissions } from '../exguard/exguard.guard';
 
 @Controller('items')
 @UseGuards(ExGuardPermissionGuard)
@@ -42,30 +66,103 @@ export class ItemsController {
   @RequirePermissions(['item:read'])
   findAll() { }
 
+  // Multiple permissions - needs ALL
   @Post()
-  @RequirePermissions(['item:create'])
+  @RequirePermissions(['item:create', 'item:admin'], true)
   create() { }
 
-  // Multiple permissions - needs ALL
+  @Patch(':id')
+  @RequirePermissions(['item:update'])
+  update() { }
+
   @Delete(':id')
   @RequirePermissions(['item:delete', 'admin'], true)
   delete() { }
 }
 ```
 
-## Decorators
+## Environment Variables
+
+Add to your `.env` file:
+
+```env
+EXGUARD_BASE_URL=https://api.yourdomain.com
+EXGUARD_API_KEY=your_api_key_here
+EXGUARD_REALTIME_URL=wss://realtime.yourdomain.com
+```
+
+## API Reference
+
+### API Endpoints Used
+
+The client connects to these endpoints:
+- `POST /guard/verify-token` - Verifies the user's token
+- `GET /guard/me` - Gets user access information (roles, permissions, modules)
+
+### Decorators
 
 | Decorator | Description |
 |-----------|-------------|
-| `@RequirePermissions(['perm1'])` | User needs ANY of the permissions |
-| `@RequirePermissions(['perm1', 'perm2'], true)` | User needs ALL permissions |
+| `@RequirePermissions(['item:read'])` | User needs ANY of the listed permissions |
+| `@RequirePermissions(['item:delete', 'admin'], true)` | User needs ALL listed permissions |
+
+### ExGuardModule.forRoot Options
 
-## Token
+| Option | Type | Required | Default | Description |
+|--------|------|----------|---------|-------------|
+| baseUrl | string | Yes | - | ExGuard API base URL |
+| apiKey | string | Yes | - | Your API key |
+| cache.enabled | boolean | No | true | Enable caching |
+| cache.ttl | number | No | 300000 | Cache TTL in ms (5 min) |
+| realtime.enabled | boolean | No | false | Enable realtime connection |
+| realtime.url | string | No | - | Realtime WebSocket URL |
 
-The guard extracts token from:
+### Token Extraction
+
+The guard automatically extracts token from:
 - `Authorization: Bearer <token>` header
 - `x-access-token` header
 
+### Request User
+
+After successful authentication, the user object is available at:
+```typescript
+@Request() req: any
+console.log(req.user); // { id, username, email, roles, modules, groups, fieldOffices }
+```
+
+## User Object Structure
+
+```typescript
+{
+  user: {
+    id: string,
+    cognitoSubId: string,
+    username: string,
+    email: string,
+    emailVerified: boolean,
+    givenName: string,
+    familyName: string,
+    employeeNumber: string,
+    regionId: string,
+    fieldOffice: { id, code, name }
+  },
+  groups: string[],
+  roles: string[],
+  modules: [
+    { key: 'events', name: 'Events', permissions: ['events:create', 'events:read'] }
+  ],
+  fieldOffices: string[]
+}
+```
+
+## Realtime Features
+
+When realtime is enabled:
+- Permission changes are detected in real-time
+- Cache is automatically cleared when permissions update
+- Events: `permission:update`, `user:update`
+
 ## License
 
 MIT

package/dist/index.cjs

@@ -37,7 +37,8 @@ __export(src_exports, {
   RequirePermissions: () => RequirePermissions,
   RequireRoles: () => RequireRoles,
   cache: () => cache,
-  createExGuardClient: () => createExGuardClient
+  createExGuardClient: () => createExGuardClient,
+  realtime: () => realtime
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -63,38 +64,132 @@ var ExGuardCache = class {
       ttl: ttl || this.ttl
     });
   }
+  delete(key) {
+    this.cache.delete(key);
+  }
+  clear() {
+    this.cache.clear();
+  }
+  clearUser(userId) {
+    for (const key of this.cache.keys()) {
+      if (key.includes(userId)) {
+        this.cache.delete(key);
+      }
+    }
+  }
 };
 var cache = new ExGuardCache();
+var ExGuardRealtime = class {
+  constructor() {
+    this.socket = null;
+    this.connected = false;
+    this.url = "";
+    this.events = {};
+  }
+  connect(url, events = {}) {
+    this.url = url;
+    this.events = events;
+    if (!url) {
+      console.log("[ExGuard] Realtime URL not provided, skipping connection");
+      return;
+    }
+    try {
+      const { io } = require("socket.io-client");
+      this.socket = io(url, {
+        transports: ["websocket"],
+        reconnection: true,
+        reconnectionAttempts: 5,
+        reconnectionDelay: 1e3
+      });
+      this.socket.on("connect", () => {
+        this.connected = true;
+        console.log("[ExGuard] Realtime connected");
+        this.events.onConnect?.();
+      });
+      this.socket.on("disconnect", () => {
+        this.connected = false;
+        console.log("[ExGuard] Realtime disconnected");
+        this.events.onDisconnect?.();
+      });
+      this.socket.on("permission:update", (data) => {
+        console.log("[ExGuard] Permission update received:", data);
+        cache.clearUser(data.userId);
+        this.events.onPermissionUpdate?.(data);
+      });
+      this.socket.on("user:update", (data) => {
+        console.log("[ExGuard] User update received:", data);
+        cache.clearUser(data.userId);
+        this.events.onUserUpdate?.(data);
+      });
+      this.socket.on("connect_error", (err) => {
+        console.error("[ExGuard] Realtime connection error:", err.message);
+      });
+    } catch (error) {
+      console.error("[ExGuard] Failed to load socket.io-client:", error);
+    }
+  }
+  disconnect() {
+    if (this.socket) {
+      this.socket.disconnect();
+      this.socket = null;
+      this.connected = false;
+    }
+  }
+  isConnected() {
+    return this.connected;
+  }
+  emit(event, data) {
+    if (this.socket && this.connected) {
+      this.socket.emit(event, data);
+    }
+  }
+};
+var realtime = new ExGuardRealtime();
 var ExGuardClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl;
     this.apiKey = config.apiKey;
     this.cache = cache;
+    this.realtime = realtime;
+    if (config.realtime?.enabled && config.realtime?.url) {
+      this.realtime.connect(config.realtime.url);
+    }
   }
   async authenticate(context) {
     const cacheKey = `auth:${context.token}`;
     const cached = this.cache.get(cacheKey);
     if (cached) return cached;
     try {
-      const response = await fetch(`${this.baseUrl}/api/v1/auth/validate`, {
+      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "Authorization": `Bearer ${this.apiKey}`
+          "Authorization": `Bearer ${context.token}`
         },
-        body: JSON.stringify({ token: context.token })
+        body: JSON.stringify({ id_token: context.token })
       });
-      if (!response.ok) {
+      if (!verifyResponse.ok) {
         return { allowed: false, error: "Invalid token" };
       }
-      const data = await response.json();
+      const verifyData = await verifyResponse.json();
+      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {
+        method: "GET",
+        headers: {
+          "Authorization": `Bearer ${context.token}`
+        }
+      });
+      if (!meResponse.ok) {
+        return { allowed: false, error: "Failed to get user access" };
+      }
+      const meData = await meResponse.json();
       const result = {
         allowed: true,
-        user: data.user || data.data?.user
+        user: meData.data || meData
       };
       this.cache.set(cacheKey, result);
       return result;
     } catch (error) {
+      console.error("[ExGuard] Authentication error:", error);
       return { allowed: false, error: "Authentication failed" };
     }
   }
@@ -104,6 +199,12 @@ var ExGuardClient = class {
     const userPermissions = result.user.modules?.flatMap((m) => m.permissions) || [];
     return userPermissions.includes(permission);
   }
+  clearCache() {
+    this.cache.clear();
+  }
+  disconnectRealtime() {
+    this.realtime.disconnect();
+  }
 };
 function createExGuardClient(config) {
   return new ExGuardClient(config);
@@ -116,7 +217,8 @@ var ExGuardModule = class {
     const client = new ExGuardClient({
       baseUrl: options.baseUrl,
       apiKey: options.apiKey,
-      cache: options.cache
+      cache: options.cache,
+      realtime: options.realtime
     });
     return {
       module: ExGuardModule,
@@ -151,7 +253,8 @@ var ExGuardPermissionGuard = class {
       throw new import_common2.UnauthorizedException("No token provided");
     }
     if (!this.client) {
-      return true;
+      console.warn("[ExGuard] Client not configured. Access denied.");
+      return false;
     }
     const authResult = await this.client.authenticate({ token, request });
     if (!authResult.allowed) {
@@ -233,6 +336,7 @@ function RequireRoles(roles, requireAll = false) {
   RequirePermissions,
   RequireRoles,
   cache,
-  createExGuardClient
+  createExGuardClient,
+  realtime
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export { ExGuardClient, createExGuardClient, cache } from './client.js';\nexport type { ExGuardConfig, User, ModulePermission, UserAccessResponse, GuardContext, GuardResult } from './client.js';\nexport { ExGuardModule } from './module.js';\nexport type { ExGuardModuleOptions } from './module.js';\nexport { ExGuardPermissionGuard, RequirePermissions, RequireRoles, EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY } from './guard.js';\n","export interface ExGuardConfig {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n}\n\nexport interface User {\n  id: string;\n  username: string;\n  email: string;\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  roles: string[];\n  modules: ModulePermission[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n}\n\nconst cache = new ExGuardCache();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private apiKey: string;\n  private cache: ExGuardCache;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.apiKey = config.apiKey;\n    this.cache = cache;\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      const response = await fetch(`${this.baseUrl}/api/v1/auth/validate`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${this.apiKey}`,\n        },\n        body: JSON.stringify({ token: context.token }),\n      });\n\n      if (!response.ok) {\n        return { allowed: false, error: 'Invalid token' };\n      }\n\n      const data = await response.json();\n      const result: GuardResult = {\n        allowed: true,\n        user: data.user || data.data?.user,\n      };\n\n      this.cache.set(cacheKey, result);\n      return result;\n    } catch (error) {\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      apiKey: options.apiKey,\n      cache: options.cache,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      return true;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACsCA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAExB,IAAM,gBAAN,MAAoB;AAAA,EAKzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,yBAAyB;AAAA,QACnE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,KAAK,MAAM;AAAA,QACxC;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,MAC/C,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,eAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,MAClD;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,KAAK,QAAQ,KAAK,MAAM;AAAA,MAChC;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;ACrHA,oBAA8C;AAcvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,IACjB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AAnBa,gBAAN;AAAA,MAFN,sBAAO;AAAA,MACP,sBAAO,CAAC,CAAC;AAAA,GACG;;;ACdb,IAAAA,iBAAuH;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,qCAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,kCAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,kCAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAhFa,yBAAN;AAAA,MADN,2BAAW;AAAA,EAGP,gDAAS;AAAA,EAAG,8CAAO,gBAAgB;AAAA,GAF3B;AAkFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":["import_common"]}
+{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export { ExGuardClient, createExGuardClient, cache, realtime } from './client.js';\nexport type { ExGuardConfig, User, ModulePermission, UserAccessResponse, GuardContext, GuardResult, RealtimeEvents } from './client.js';\nexport { ExGuardModule } from './module.js';\nexport type { ExGuardModuleOptions } from './module.js';\nexport { ExGuardPermissionGuard, RequirePermissions, RequireRoles, EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY } from './guard.js';\n","export interface ExGuardConfig {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\nexport interface User {\n  id: string;\n  cognitoSubId: string;\n  username: string;\n  email: string;\n  emailVerified: boolean;\n  givenName: string;\n  familyName: string;\n  employeeNumber: string;\n  regionId: string;\n  createdAt: string;\n  updatedAt: string;\n  lastLoginAt: string;\n  fieldOffice: {\n    id: string;\n    code: string;\n    name: string;\n  };\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  groups: string[];\n  roles: string[];\n  modules: ModulePermission[];\n  fieldOffices: string[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nexport interface RealtimeEvents {\n  onConnect?: () => void;\n  onDisconnect?: () => void;\n  onPermissionUpdate?: (data: { userId: string; permissions: string[] }) => void;\n  onUserUpdate?: (data: { userId: string; user: UserAccessResponse }) => void;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n\n  delete(key: string): void {\n    this.cache.delete(key);\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  clearUser(userId: string): void {\n    for (const key of this.cache.keys()) {\n      if (key.includes(userId)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n}\n\nconst cache = new ExGuardCache();\n\nclass ExGuardRealtime {\n  private socket: any = null;\n  private connected = false;\n  private url: string = '';\n  private events: RealtimeEvents = {};\n\n  connect(url: string, events: RealtimeEvents = {}): void {\n    this.url = url;\n    this.events = events;\n    \n    if (!url) {\n      console.log('[ExGuard] Realtime URL not provided, skipping connection');\n      return;\n    }\n\n    try {\n      const { io } = require('socket.io-client');\n      this.socket = io(url, {\n        transports: ['websocket'],\n        reconnection: true,\n        reconnectionAttempts: 5,\n        reconnectionDelay: 1000,\n      });\n\n      this.socket.on('connect', () => {\n        this.connected = true;\n        console.log('[ExGuard] Realtime connected');\n        this.events.onConnect?.();\n      });\n\n      this.socket.on('disconnect', () => {\n        this.connected = false;\n        console.log('[ExGuard] Realtime disconnected');\n        this.events.onDisconnect?.();\n      });\n\n      this.socket.on('permission:update', (data: any) => {\n        console.log('[ExGuard] Permission update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onPermissionUpdate?.(data);\n      });\n\n      this.socket.on('user:update', (data: any) => {\n        console.log('[ExGuard] User update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onUserUpdate?.(data);\n      });\n\n      this.socket.on('connect_error', (err: any) => {\n        console.error('[ExGuard] Realtime connection error:', err.message);\n      });\n    } catch (error) {\n      console.error('[ExGuard] Failed to load socket.io-client:', error);\n    }\n  }\n\n  disconnect(): void {\n    if (this.socket) {\n      this.socket.disconnect();\n      this.socket = null;\n      this.connected = false;\n    }\n  }\n\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  emit(event: string, data: any): void {\n    if (this.socket && this.connected) {\n      this.socket.emit(event, data);\n    }\n  }\n}\n\nconst realtime = new ExGuardRealtime();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private apiKey: string;\n  private cache: ExGuardCache;\n  private realtime: ExGuardRealtime;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.apiKey = config.apiKey;\n    this.cache = cache;\n    this.realtime = realtime;\n\n    if (config.realtime?.enabled && config.realtime?.url) {\n      this.realtime.connect(config.realtime.url);\n    }\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      // First verify the token\n      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${context.token}`,\n        },\n        body: JSON.stringify({ id_token: context.token }),\n      });\n\n      if (!verifyResponse.ok) {\n        return { allowed: false, error: 'Invalid token' };\n      }\n\n      const verifyData = await verifyResponse.json();\n\n      // Then get user access info\n      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {\n        method: 'GET',\n        headers: {\n          'Authorization': `Bearer ${context.token}`,\n        },\n      });\n\n      if (!meResponse.ok) {\n        return { allowed: false, error: 'Failed to get user access' };\n      }\n\n      const meData = await meResponse.json();\n      \n      const result: GuardResult = {\n        allowed: true,\n        user: meData.data || meData,\n      };\n\n      this.cache.set(cacheKey, result);\n      return result;\n    } catch (error) {\n      console.error('[ExGuard] Authentication error:', error);\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  disconnectRealtime(): void {\n    this.realtime.disconnect();\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache, realtime };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      apiKey: options.apiKey,\n      cache: options.cache,\n      realtime: options.realtime,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      console.warn('[ExGuard] Client not configured. Access denied.');\n      return false;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiEA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,KAAmB;AACxB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,UAAU,QAAsB;AAC9B,eAAW,OAAO,KAAK,MAAM,KAAK,GAAG;AACnC,UAAI,IAAI,SAAS,MAAM,GAAG;AACxB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAE/B,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AACE,SAAQ,SAAc;AACtB,SAAQ,YAAY;AACpB,SAAQ,MAAc;AACtB,SAAQ,SAAyB,CAAC;AAAA;AAAA,EAElC,QAAQ,KAAa,SAAyB,CAAC,GAAS;AACtD,SAAK,MAAM;AACX,SAAK,SAAS;AAEd,QAAI,CAAC,KAAK;AACR,cAAQ,IAAI,0DAA0D;AACtE;AAAA,IACF;AAEA,QAAI;AACF,YAAM,EAAE,GAAG,IAAI,QAAQ,kBAAkB;AACzC,WAAK,SAAS,GAAG,KAAK;AAAA,QACpB,YAAY,CAAC,WAAW;AAAA,QACxB,cAAc;AAAA,QACd,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,MACrB,CAAC;AAED,WAAK,OAAO,GAAG,WAAW,MAAM;AAC9B,aAAK,YAAY;AACjB,gBAAQ,IAAI,8BAA8B;AAC1C,aAAK,OAAO,YAAY;AAAA,MAC1B,CAAC;AAED,WAAK,OAAO,GAAG,cAAc,MAAM;AACjC,aAAK,YAAY;AACjB,gBAAQ,IAAI,iCAAiC;AAC7C,aAAK,OAAO,eAAe;AAAA,MAC7B,CAAC;AAED,WAAK,OAAO,GAAG,qBAAqB,CAAC,SAAc;AACjD,gBAAQ,IAAI,yCAAyC,IAAI;AACzD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,qBAAqB,IAAI;AAAA,MACvC,CAAC;AAED,WAAK,OAAO,GAAG,eAAe,CAAC,SAAc;AAC3C,gBAAQ,IAAI,mCAAmC,IAAI;AACnD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,eAAe,IAAI;AAAA,MACjC,CAAC;AAED,WAAK,OAAO,GAAG,iBAAiB,CAAC,QAAa;AAC5C,gBAAQ,MAAM,wCAAwC,IAAI,OAAO;AAAA,MACnE,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,8CAA8C,KAAK;AAAA,IACnE;AAAA,EACF;AAAA,EAEA,aAAmB;AACjB,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,WAAW;AACvB,WAAK,SAAS;AACd,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,cAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,KAAK,OAAe,MAAiB;AACnC,QAAI,KAAK,UAAU,KAAK,WAAW;AACjC,WAAK,OAAO,KAAK,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,IAAM,WAAW,IAAI,gBAAgB;AAE9B,IAAM,gBAAN,MAAoB;AAAA,EAMzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ;AACb,SAAK,WAAW;AAEhB,QAAI,OAAO,UAAU,WAAW,OAAO,UAAU,KAAK;AACpD,WAAK,SAAS,QAAQ,OAAO,SAAS,GAAG;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AAEF,YAAM,iBAAiB,MAAM,MAAM,GAAG,KAAK,OAAO,uBAAuB;AAAA,QACvE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,UAAU,QAAQ,MAAM,CAAC;AAAA,MAClD,CAAC;AAED,UAAI,CAAC,eAAe,IAAI;AACtB,eAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,MAClD;AAEA,YAAM,aAAa,MAAM,eAAe,KAAK;AAG7C,YAAM,aAAa,MAAM,MAAM,GAAG,KAAK,OAAO,aAAa;AAAA,QACzD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,MACF,CAAC;AAED,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO,EAAE,SAAS,OAAO,OAAO,4BAA4B;AAAA,MAC9D;AAEA,YAAM,SAAS,MAAM,WAAW,KAAK;AAErC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,OAAO,QAAQ;AAAA,MACvB;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,mCAAmC,KAAK;AACtD,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,qBAA2B;AACzB,SAAK,SAAS,WAAW;AAAA,EAC3B;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;AC5QA,oBAA8C;AAkBvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AApBa,gBAAN;AAAA,MAFN,sBAAO;AAAA,MACP,sBAAO,CAAC,CAAC;AAAA,GACG;;;AClBb,IAAAA,iBAAuH;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,qCAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,KAAK,iDAAiD;AAC9D,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,kCAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,kCAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAjFa,yBAAN;AAAA,MADN,2BAAW;AAAA,EAGP,gDAAS;AAAA,EAAG,8CAAO,gBAAgB;AAAA,GAF3B;AAmFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":["import_common"]}

package/dist/index.d.cts

@@ -8,11 +8,29 @@ interface ExGuardConfig {
         enabled?: boolean;
         ttl?: number;
     };
+    realtime?: {
+        enabled?: boolean;
+        url?: string;
+    };
 }
 interface User {
     id: string;
+    cognitoSubId: string;
     username: string;
     email: string;
+    emailVerified: boolean;
+    givenName: string;
+    familyName: string;
+    employeeNumber: string;
+    regionId: string;
+    createdAt: string;
+    updatedAt: string;
+    lastLoginAt: string;
+    fieldOffice: {
+        id: string;
+        code: string;
+        name: string;
+    };
 }
 interface ModulePermission {
     key: string;
@@ -21,8 +39,10 @@ interface ModulePermission {
 }
 interface UserAccessResponse {
     user: User;
+    groups: string[];
     roles: string[];
     modules: ModulePermission[];
+    fieldOffices: string[];
 }
 interface GuardContext {
     token: string;
@@ -33,20 +53,49 @@ interface GuardResult {
     user?: UserAccessResponse;
     error?: string;
 }
+interface RealtimeEvents {
+    onConnect?: () => void;
+    onDisconnect?: () => void;
+    onPermissionUpdate?: (data: {
+        userId: string;
+        permissions: string[];
+    }) => void;
+    onUserUpdate?: (data: {
+        userId: string;
+        user: UserAccessResponse;
+    }) => void;
+}
 declare class ExGuardCache {
     private cache;
     private ttl;
     get(key: string): any;
     set(key: string, data: any, ttl?: number): void;
+    delete(key: string): void;
+    clear(): void;
+    clearUser(userId: string): void;
 }
 declare const cache: ExGuardCache;
+declare class ExGuardRealtime {
+    private socket;
+    private connected;
+    private url;
+    private events;
+    connect(url: string, events?: RealtimeEvents): void;
+    disconnect(): void;
+    isConnected(): boolean;
+    emit(event: string, data: any): void;
+}
+declare const realtime: ExGuardRealtime;
 declare class ExGuardClient {
     private baseUrl;
     private apiKey;
     private cache;
+    private realtime;
     constructor(config: ExGuardConfig);
     authenticate(context: GuardContext): Promise<GuardResult>;
     hasPermission(token: string, permission: string): Promise<boolean>;
+    clearCache(): void;
+    disconnectRealtime(): void;
 }
 declare function createExGuardClient(config: ExGuardConfig): ExGuardClient;
 
@@ -57,6 +106,10 @@ interface ExGuardModuleOptions {
         enabled?: boolean;
         ttl?: number;
     };
+    realtime?: {
+        enabled?: boolean;
+        url?: string;
+    };
 }
 declare class ExGuardModule {
     static forRoot(options: ExGuardModuleOptions): DynamicModule;
@@ -74,4 +127,4 @@ declare class ExGuardPermissionGuard implements CanActivate {
 declare function RequirePermissions(permissions: string[], requireAll?: boolean): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;
 declare function RequireRoles(roles: string[], requireAll?: boolean): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;
 
-export { EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY, ExGuardClient, type ExGuardConfig, ExGuardModule, type ExGuardModuleOptions, ExGuardPermissionGuard, type GuardContext, type GuardResult, type ModulePermission, RequirePermissions, RequireRoles, type User, type UserAccessResponse, cache, createExGuardClient };
+export { EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY, ExGuardClient, type ExGuardConfig, ExGuardModule, type ExGuardModuleOptions, ExGuardPermissionGuard, type GuardContext, type GuardResult, type ModulePermission, type RealtimeEvents, RequirePermissions, RequireRoles, type User, type UserAccessResponse, cache, createExGuardClient, realtime };

package/dist/index.d.ts

@@ -8,11 +8,29 @@ interface ExGuardConfig {
         enabled?: boolean;
         ttl?: number;
     };
+    realtime?: {
+        enabled?: boolean;
+        url?: string;
+    };
 }
 interface User {
     id: string;
+    cognitoSubId: string;
     username: string;
     email: string;
+    emailVerified: boolean;
+    givenName: string;
+    familyName: string;
+    employeeNumber: string;
+    regionId: string;
+    createdAt: string;
+    updatedAt: string;
+    lastLoginAt: string;
+    fieldOffice: {
+        id: string;
+        code: string;
+        name: string;
+    };
 }
 interface ModulePermission {
     key: string;
@@ -21,8 +39,10 @@ interface ModulePermission {
 }
 interface UserAccessResponse {
     user: User;
+    groups: string[];
     roles: string[];
     modules: ModulePermission[];
+    fieldOffices: string[];
 }
 interface GuardContext {
     token: string;
@@ -33,20 +53,49 @@ interface GuardResult {
     user?: UserAccessResponse;
     error?: string;
 }
+interface RealtimeEvents {
+    onConnect?: () => void;
+    onDisconnect?: () => void;
+    onPermissionUpdate?: (data: {
+        userId: string;
+        permissions: string[];
+    }) => void;
+    onUserUpdate?: (data: {
+        userId: string;
+        user: UserAccessResponse;
+    }) => void;
+}
 declare class ExGuardCache {
     private cache;
     private ttl;
     get(key: string): any;
     set(key: string, data: any, ttl?: number): void;
+    delete(key: string): void;
+    clear(): void;
+    clearUser(userId: string): void;
 }
 declare const cache: ExGuardCache;
+declare class ExGuardRealtime {
+    private socket;
+    private connected;
+    private url;
+    private events;
+    connect(url: string, events?: RealtimeEvents): void;
+    disconnect(): void;
+    isConnected(): boolean;
+    emit(event: string, data: any): void;
+}
+declare const realtime: ExGuardRealtime;
 declare class ExGuardClient {
     private baseUrl;
     private apiKey;
     private cache;
+    private realtime;
     constructor(config: ExGuardConfig);
     authenticate(context: GuardContext): Promise<GuardResult>;
     hasPermission(token: string, permission: string): Promise<boolean>;
+    clearCache(): void;
+    disconnectRealtime(): void;
 }
 declare function createExGuardClient(config: ExGuardConfig): ExGuardClient;
 
@@ -57,6 +106,10 @@ interface ExGuardModuleOptions {
         enabled?: boolean;
         ttl?: number;
     };
+    realtime?: {
+        enabled?: boolean;
+        url?: string;
+    };
 }
 declare class ExGuardModule {
     static forRoot(options: ExGuardModuleOptions): DynamicModule;
@@ -74,4 +127,4 @@ declare class ExGuardPermissionGuard implements CanActivate {
 declare function RequirePermissions(permissions: string[], requireAll?: boolean): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;
 declare function RequireRoles(roles: string[], requireAll?: boolean): (target: any, propertyKey: string, descriptor: PropertyDescriptor) => PropertyDescriptor;
 
-export { EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY, ExGuardClient, type ExGuardConfig, ExGuardModule, type ExGuardModuleOptions, ExGuardPermissionGuard, type GuardContext, type GuardResult, type ModulePermission, RequirePermissions, RequireRoles, type User, type UserAccessResponse, cache, createExGuardClient };
+export { EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY, ExGuardClient, type ExGuardConfig, ExGuardModule, type ExGuardModuleOptions, ExGuardPermissionGuard, type GuardContext, type GuardResult, type ModulePermission, type RealtimeEvents, RequirePermissions, RequireRoles, type User, type UserAccessResponse, cache, createExGuardClient, realtime };

package/dist/index.js

@@ -1,5 +1,11 @@
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -32,38 +38,132 @@ var ExGuardCache = class {
       ttl: ttl || this.ttl
     });
   }
+  delete(key) {
+    this.cache.delete(key);
+  }
+  clear() {
+    this.cache.clear();
+  }
+  clearUser(userId) {
+    for (const key of this.cache.keys()) {
+      if (key.includes(userId)) {
+        this.cache.delete(key);
+      }
+    }
+  }
 };
 var cache = new ExGuardCache();
+var ExGuardRealtime = class {
+  constructor() {
+    this.socket = null;
+    this.connected = false;
+    this.url = "";
+    this.events = {};
+  }
+  connect(url, events = {}) {
+    this.url = url;
+    this.events = events;
+    if (!url) {
+      console.log("[ExGuard] Realtime URL not provided, skipping connection");
+      return;
+    }
+    try {
+      const { io } = __require("socket.io-client");
+      this.socket = io(url, {
+        transports: ["websocket"],
+        reconnection: true,
+        reconnectionAttempts: 5,
+        reconnectionDelay: 1e3
+      });
+      this.socket.on("connect", () => {
+        this.connected = true;
+        console.log("[ExGuard] Realtime connected");
+        this.events.onConnect?.();
+      });
+      this.socket.on("disconnect", () => {
+        this.connected = false;
+        console.log("[ExGuard] Realtime disconnected");
+        this.events.onDisconnect?.();
+      });
+      this.socket.on("permission:update", (data) => {
+        console.log("[ExGuard] Permission update received:", data);
+        cache.clearUser(data.userId);
+        this.events.onPermissionUpdate?.(data);
+      });
+      this.socket.on("user:update", (data) => {
+        console.log("[ExGuard] User update received:", data);
+        cache.clearUser(data.userId);
+        this.events.onUserUpdate?.(data);
+      });
+      this.socket.on("connect_error", (err) => {
+        console.error("[ExGuard] Realtime connection error:", err.message);
+      });
+    } catch (error) {
+      console.error("[ExGuard] Failed to load socket.io-client:", error);
+    }
+  }
+  disconnect() {
+    if (this.socket) {
+      this.socket.disconnect();
+      this.socket = null;
+      this.connected = false;
+    }
+  }
+  isConnected() {
+    return this.connected;
+  }
+  emit(event, data) {
+    if (this.socket && this.connected) {
+      this.socket.emit(event, data);
+    }
+  }
+};
+var realtime = new ExGuardRealtime();
 var ExGuardClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl;
     this.apiKey = config.apiKey;
     this.cache = cache;
+    this.realtime = realtime;
+    if (config.realtime?.enabled && config.realtime?.url) {
+      this.realtime.connect(config.realtime.url);
+    }
   }
   async authenticate(context) {
     const cacheKey = `auth:${context.token}`;
     const cached = this.cache.get(cacheKey);
     if (cached) return cached;
     try {
-      const response = await fetch(`${this.baseUrl}/api/v1/auth/validate`, {
+      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "Authorization": `Bearer ${this.apiKey}`
+          "Authorization": `Bearer ${context.token}`
         },
-        body: JSON.stringify({ token: context.token })
+        body: JSON.stringify({ id_token: context.token })
       });
-      if (!response.ok) {
+      if (!verifyResponse.ok) {
         return { allowed: false, error: "Invalid token" };
       }
-      const data = await response.json();
+      const verifyData = await verifyResponse.json();
+      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {
+        method: "GET",
+        headers: {
+          "Authorization": `Bearer ${context.token}`
+        }
+      });
+      if (!meResponse.ok) {
+        return { allowed: false, error: "Failed to get user access" };
+      }
+      const meData = await meResponse.json();
       const result = {
         allowed: true,
-        user: data.user || data.data?.user
+        user: meData.data || meData
       };
       this.cache.set(cacheKey, result);
       return result;
     } catch (error) {
+      console.error("[ExGuard] Authentication error:", error);
       return { allowed: false, error: "Authentication failed" };
     }
   }
@@ -73,6 +173,12 @@ var ExGuardClient = class {
     const userPermissions = result.user.modules?.flatMap((m) => m.permissions) || [];
     return userPermissions.includes(permission);
   }
+  clearCache() {
+    this.cache.clear();
+  }
+  disconnectRealtime() {
+    this.realtime.disconnect();
+  }
 };
 function createExGuardClient(config) {
   return new ExGuardClient(config);
@@ -85,7 +191,8 @@ var ExGuardModule = class {
     const client = new ExGuardClient({
       baseUrl: options.baseUrl,
       apiKey: options.apiKey,
-      cache: options.cache
+      cache: options.cache,
+      realtime: options.realtime
     });
     return {
       module: ExGuardModule,
@@ -120,7 +227,8 @@ var ExGuardPermissionGuard = class {
       throw new UnauthorizedException("No token provided");
     }
     if (!this.client) {
-      return true;
+      console.warn("[ExGuard] Client not configured. Access denied.");
+      return false;
     }
     const authResult = await this.client.authenticate({ token, request });
     if (!authResult.allowed) {
@@ -201,6 +309,7 @@ export {
   RequirePermissions,
   RequireRoles,
   cache,
-  createExGuardClient
+  createExGuardClient,
+  realtime
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export interface ExGuardConfig {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n}\n\nexport interface User {\n  id: string;\n  username: string;\n  email: string;\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  roles: string[];\n  modules: ModulePermission[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n}\n\nconst cache = new ExGuardCache();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private apiKey: string;\n  private cache: ExGuardCache;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.apiKey = config.apiKey;\n    this.cache = cache;\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      const response = await fetch(`${this.baseUrl}/api/v1/auth/validate`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${this.apiKey}`,\n        },\n        body: JSON.stringify({ token: context.token }),\n      });\n\n      if (!response.ok) {\n        return { allowed: false, error: 'Invalid token' };\n      }\n\n      const data = await response.json();\n      const result: GuardResult = {\n        allowed: true,\n        user: data.user || data.data?.user,\n      };\n\n      this.cache.set(cacheKey, result);\n      return result;\n    } catch (error) {\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      apiKey: options.apiKey,\n      cache: options.cache,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      return true;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;AAsCA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAExB,IAAM,gBAAN,MAAoB;AAAA,EAKzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,yBAAyB;AAAA,QACnE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,KAAK,MAAM;AAAA,QACxC;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,MAC/C,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,eAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,MAClD;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,KAAK,QAAQ,KAAK,MAAM;AAAA,MAChC;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;ACrHA,SAAS,QAAQ,cAA6B;AAcvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,IACjB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AAnBa,gBAAN;AAAA,EAFN,OAAO;AAAA,EACP,OAAO,CAAC,CAAC;AAAA,GACG;;;ACdb,SAAS,YAA2C,uBAAuB,oBAAoB,QAAQ,gBAAgB;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,sBAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,mBAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,mBAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,mBAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,mBAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,mBAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,mBAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAhFa,yBAAN;AAAA,EADN,WAAW;AAAA,EAGP,4BAAS;AAAA,EAAG,0BAAO,gBAAgB;AAAA,GAF3B;AAkFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export interface ExGuardConfig {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\nexport interface User {\n  id: string;\n  cognitoSubId: string;\n  username: string;\n  email: string;\n  emailVerified: boolean;\n  givenName: string;\n  familyName: string;\n  employeeNumber: string;\n  regionId: string;\n  createdAt: string;\n  updatedAt: string;\n  lastLoginAt: string;\n  fieldOffice: {\n    id: string;\n    code: string;\n    name: string;\n  };\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  groups: string[];\n  roles: string[];\n  modules: ModulePermission[];\n  fieldOffices: string[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nexport interface RealtimeEvents {\n  onConnect?: () => void;\n  onDisconnect?: () => void;\n  onPermissionUpdate?: (data: { userId: string; permissions: string[] }) => void;\n  onUserUpdate?: (data: { userId: string; user: UserAccessResponse }) => void;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n\n  delete(key: string): void {\n    this.cache.delete(key);\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  clearUser(userId: string): void {\n    for (const key of this.cache.keys()) {\n      if (key.includes(userId)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n}\n\nconst cache = new ExGuardCache();\n\nclass ExGuardRealtime {\n  private socket: any = null;\n  private connected = false;\n  private url: string = '';\n  private events: RealtimeEvents = {};\n\n  connect(url: string, events: RealtimeEvents = {}): void {\n    this.url = url;\n    this.events = events;\n    \n    if (!url) {\n      console.log('[ExGuard] Realtime URL not provided, skipping connection');\n      return;\n    }\n\n    try {\n      const { io } = require('socket.io-client');\n      this.socket = io(url, {\n        transports: ['websocket'],\n        reconnection: true,\n        reconnectionAttempts: 5,\n        reconnectionDelay: 1000,\n      });\n\n      this.socket.on('connect', () => {\n        this.connected = true;\n        console.log('[ExGuard] Realtime connected');\n        this.events.onConnect?.();\n      });\n\n      this.socket.on('disconnect', () => {\n        this.connected = false;\n        console.log('[ExGuard] Realtime disconnected');\n        this.events.onDisconnect?.();\n      });\n\n      this.socket.on('permission:update', (data: any) => {\n        console.log('[ExGuard] Permission update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onPermissionUpdate?.(data);\n      });\n\n      this.socket.on('user:update', (data: any) => {\n        console.log('[ExGuard] User update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onUserUpdate?.(data);\n      });\n\n      this.socket.on('connect_error', (err: any) => {\n        console.error('[ExGuard] Realtime connection error:', err.message);\n      });\n    } catch (error) {\n      console.error('[ExGuard] Failed to load socket.io-client:', error);\n    }\n  }\n\n  disconnect(): void {\n    if (this.socket) {\n      this.socket.disconnect();\n      this.socket = null;\n      this.connected = false;\n    }\n  }\n\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  emit(event: string, data: any): void {\n    if (this.socket && this.connected) {\n      this.socket.emit(event, data);\n    }\n  }\n}\n\nconst realtime = new ExGuardRealtime();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private apiKey: string;\n  private cache: ExGuardCache;\n  private realtime: ExGuardRealtime;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.apiKey = config.apiKey;\n    this.cache = cache;\n    this.realtime = realtime;\n\n    if (config.realtime?.enabled && config.realtime?.url) {\n      this.realtime.connect(config.realtime.url);\n    }\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      // First verify the token\n      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${context.token}`,\n        },\n        body: JSON.stringify({ id_token: context.token }),\n      });\n\n      if (!verifyResponse.ok) {\n        return { allowed: false, error: 'Invalid token' };\n      }\n\n      const verifyData = await verifyResponse.json();\n\n      // Then get user access info\n      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {\n        method: 'GET',\n        headers: {\n          'Authorization': `Bearer ${context.token}`,\n        },\n      });\n\n      if (!meResponse.ok) {\n        return { allowed: false, error: 'Failed to get user access' };\n      }\n\n      const meData = await meResponse.json();\n      \n      const result: GuardResult = {\n        allowed: true,\n        user: meData.data || meData,\n      };\n\n      this.cache.set(cacheKey, result);\n      return result;\n    } catch (error) {\n      console.error('[ExGuard] Authentication error:', error);\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  disconnectRealtime(): void {\n    this.realtime.disconnect();\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache, realtime };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      apiKey: options.apiKey,\n      cache: options.cache,\n      realtime: options.realtime,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      console.warn('[ExGuard] Client not configured. Access denied.');\n      return false;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiEA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,KAAmB;AACxB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,UAAU,QAAsB;AAC9B,eAAW,OAAO,KAAK,MAAM,KAAK,GAAG;AACnC,UAAI,IAAI,SAAS,MAAM,GAAG;AACxB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAE/B,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AACE,SAAQ,SAAc;AACtB,SAAQ,YAAY;AACpB,SAAQ,MAAc;AACtB,SAAQ,SAAyB,CAAC;AAAA;AAAA,EAElC,QAAQ,KAAa,SAAyB,CAAC,GAAS;AACtD,SAAK,MAAM;AACX,SAAK,SAAS;AAEd,QAAI,CAAC,KAAK;AACR,cAAQ,IAAI,0DAA0D;AACtE;AAAA,IACF;AAEA,QAAI;AACF,YAAM,EAAE,GAAG,IAAI,UAAQ,kBAAkB;AACzC,WAAK,SAAS,GAAG,KAAK;AAAA,QACpB,YAAY,CAAC,WAAW;AAAA,QACxB,cAAc;AAAA,QACd,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,MACrB,CAAC;AAED,WAAK,OAAO,GAAG,WAAW,MAAM;AAC9B,aAAK,YAAY;AACjB,gBAAQ,IAAI,8BAA8B;AAC1C,aAAK,OAAO,YAAY;AAAA,MAC1B,CAAC;AAED,WAAK,OAAO,GAAG,cAAc,MAAM;AACjC,aAAK,YAAY;AACjB,gBAAQ,IAAI,iCAAiC;AAC7C,aAAK,OAAO,eAAe;AAAA,MAC7B,CAAC;AAED,WAAK,OAAO,GAAG,qBAAqB,CAAC,SAAc;AACjD,gBAAQ,IAAI,yCAAyC,IAAI;AACzD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,qBAAqB,IAAI;AAAA,MACvC,CAAC;AAED,WAAK,OAAO,GAAG,eAAe,CAAC,SAAc;AAC3C,gBAAQ,IAAI,mCAAmC,IAAI;AACnD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,eAAe,IAAI;AAAA,MACjC,CAAC;AAED,WAAK,OAAO,GAAG,iBAAiB,CAAC,QAAa;AAC5C,gBAAQ,MAAM,wCAAwC,IAAI,OAAO;AAAA,MACnE,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,8CAA8C,KAAK;AAAA,IACnE;AAAA,EACF;AAAA,EAEA,aAAmB;AACjB,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,WAAW;AACvB,WAAK,SAAS;AACd,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,cAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,KAAK,OAAe,MAAiB;AACnC,QAAI,KAAK,UAAU,KAAK,WAAW;AACjC,WAAK,OAAO,KAAK,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,IAAM,WAAW,IAAI,gBAAgB;AAE9B,IAAM,gBAAN,MAAoB;AAAA,EAMzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ;AACb,SAAK,WAAW;AAEhB,QAAI,OAAO,UAAU,WAAW,OAAO,UAAU,KAAK;AACpD,WAAK,SAAS,QAAQ,OAAO,SAAS,GAAG;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AAEF,YAAM,iBAAiB,MAAM,MAAM,GAAG,KAAK,OAAO,uBAAuB;AAAA,QACvE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,UAAU,QAAQ,MAAM,CAAC;AAAA,MAClD,CAAC;AAED,UAAI,CAAC,eAAe,IAAI;AACtB,eAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,MAClD;AAEA,YAAM,aAAa,MAAM,eAAe,KAAK;AAG7C,YAAM,aAAa,MAAM,MAAM,GAAG,KAAK,OAAO,aAAa;AAAA,QACzD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,MACF,CAAC;AAED,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO,EAAE,SAAS,OAAO,OAAO,4BAA4B;AAAA,MAC9D;AAEA,YAAM,SAAS,MAAM,WAAW,KAAK;AAErC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,OAAO,QAAQ;AAAA,MACvB;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,mCAAmC,KAAK;AACtD,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,qBAA2B;AACzB,SAAK,SAAS,WAAW;AAAA,EAC3B;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;AC5QA,SAAS,QAAQ,cAA6B;AAkBvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AApBa,gBAAN;AAAA,EAFN,OAAO;AAAA,EACP,OAAO,CAAC,CAAC;AAAA,GACG;;;AClBb,SAAS,YAA2C,uBAAuB,oBAAoB,QAAQ,gBAAgB;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,sBAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,KAAK,iDAAiD;AAC9D,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,mBAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,mBAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,mBAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,mBAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,mBAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,mBAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAjFa,yBAAN;AAAA,EADN,WAAW;AAAA,EAGP,4BAAS;AAAA,EAAG,0BAAO,gBAAgB;AAAA,GAF3B;AAmFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/setup.cjs

@@ -0,0 +1,204 @@
+const fs = require('fs');
+const path = require('path');
+
+const GUARD_CONTENT = `import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { ExGuardClient } from 'exguard-endpoint';
+
+export const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';
+export const EXGUARD_ROLES_KEY = 'exguard_roles';
+
+@Injectable()
+export class ExGuardPermissionGuard implements CanActivate {
+  constructor(
+    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,
+    private reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest();
+    const token = this.extractToken(request);
+
+    if (!token) {
+      throw new UnauthorizedException('No token provided');
+    }
+
+    if (!this.client) {
+      console.warn('[ExGuard] Client not configured. Access denied.');
+      return false;
+    }
+
+    const authResult = await this.client.authenticate({ token, request });
+
+    if (!authResult.allowed) {
+      throw new ForbiddenException(authResult.error || 'Access denied');
+    }
+
+    if (!authResult.user) {
+      throw new ForbiddenException('User not found');
+    }
+
+    const handler = context.getHandler();
+    const permMeta = this.reflector.get(EXGUARD_PERMISSIONS_KEY, handler);
+
+    if (permMeta) {
+      const { permissions, requireAll } = permMeta;
+      const userPermissions = authResult.user.modules ? authResult.user.modules.flatMap(m => m.permissions) : [];
+
+      if (requireAll) {
+        if (!permissions.every(p => userPermissions.includes(p))) {
+          throw new ForbiddenException('Insufficient permissions');
+        }
+      } else {
+        if (!permissions.some(p => userPermissions.includes(p))) {
+          throw new ForbiddenException('Insufficient permissions');
+        }
+      }
+    }
+
+    const roleMeta = this.reflector.get(EXGUARD_ROLES_KEY, handler);
+
+    if (roleMeta) {
+      const { roles, requireAll } = roleMeta;
+      const userRoles = authResult.user.roles || [];
+
+      if (requireAll) {
+        if (!roles.every(r => userRoles.includes(r))) {
+          throw new ForbiddenException('Insufficient roles');
+        }
+      } else {
+        if (!roles.some(r => userRoles.includes(r))) {
+          throw new ForbiddenException('Insufficient roles');
+        }
+      }
+    }
+
+    request.user = authResult.user;
+    return true;
+  }
+
+  private extractToken(request) {
+    const auth = request.headers ? request.headers.authorization : null;
+    if (auth && auth.startsWith('Bearer ')) {
+      return auth.substring(7);
+    }
+    return request.headers ? request.headers['x-access-token'] : null;
+  }
+}
+
+export function RequirePermissions(permissions, requireAll = false) {
+  return function (target, propertyKey, descriptor) {
+    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);
+    return descriptor;
+  };
+}
+
+export function RequireRoles(roles, requireAll = false) {
+  return function (target, propertyKey, descriptor) {
+    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);
+    return descriptor;
+  };
+}
+`;
+
+const MODULE_CONTENT = `import { Module, Global, DynamicModule } from '@nestjs/common';
+import { ExGuardModule } from 'exguard-endpoint';
+
+@Global()
+@Module({})
+export class ExGuardModuleSetup {
+  static forRoot(options) {
+    return ExGuardModule.forRoot(options);
+  }
+}
+`;
+
+function ensureDir(dirPath) {
+  if (!fs.existsSync(dirPath)) {
+    fs.mkdirSync(dirPath, { recursive: true });
+  }
+}
+
+function writeFile(filePath, content) {
+  const dir = path.dirname(filePath);
+  ensureDir(dir);
+  fs.writeFileSync(filePath, content);
+  console.log('Created: ' + filePath);
+}
+
+function setup() {
+  const srcDir = path.join(process.cwd(), 'src');
+  const exguardDir = path.join(srcDir, 'exguard');
+
+  if (!fs.existsSync(srcDir)) {
+    console.error('Error: Run this command in your NestJS project root');
+    process.exit(1);
+  }
+
+  ensureDir(exguardDir);
+
+  writeFile(path.join(exguardDir, 'exguard.guard.ts'), GUARD_CONTENT);
+  writeFile(path.join(exguardDir, 'exguard.module.ts'), MODULE_CONTENT);
+
+  console.log('');
+  console.log('===========================================');
+  console.log('✅ ExGuard Setup Complete!');
+  console.log('===========================================');
+  console.log('');
+  console.log('Next steps:');
+  console.log('');
+  console.log('1. Add to app.module.ts:');
+  console.log('');
+  console.log('   import { ExGuardModule } from "./exguard/exguard.module";');
+  console.log('');
+  console.log('   @Module({');
+  console.log('     imports: [');
+  console.log('       ExGuardModule.forRoot({');
+  console.log('         baseUrl: process.env.EXGUARD_BASE_URL,');
+  console.log('         apiKey: process.env.EXGUARD_API_KEY,');
+  console.log('         realtime: {');
+  console.log('           enabled: true,');
+  console.log('           url: process.env.EXGUARD_REALTIME_URL,');
+  console.log('         },');
+  console.log('       }),');
+  console.log('     ],');
+  console.log('   })');
+  console.log('   export class AppModule {}');
+  console.log('');
+  console.log('2. Add environment variables:');
+  console.log('');
+  console.log('   EXGUARD_BASE_URL=https://api.exguard.com');
+  console.log('   EXGUARD_API_KEY=your_api_key');
+  console.log('   EXGUARD_REALTIME_URL=wss://realtime.exguard.com');
+  console.log('');
+  console.log('3. Use in controllers:');
+  console.log('');
+  console.log('   import { ExGuardPermissionGuard, RequirePermissions } from "./exguard/exguard.guard";');
+  console.log('');
+  console.log('   @Controller("items")');
+  console.log('   @UseGuards(ExGuardPermissionGuard)');
+  console.log('   export class ItemsController {');
+  console.log('     @Get() @RequirePermissions(["item:read"]) findAll() {}');
+  console.log('     @Post() @RequirePermissions(["item:create"]) create() {}');
+  console.log('   }');
+  console.log('');
+  console.log('===========================================');
+}
+
+const args = process.argv.slice(2);
+
+if (args[0] === 'setup') {
+  setup();
+} else {
+  console.log('===========================================');
+  console.log('ExGuard Endpoint - NestJS RBAC Guard');
+  console.log('===========================================');
+  console.log('');
+  console.log('To setup in your NestJS project:');
+  console.log('  npx exguard-endpoint setup');
+  console.log('');
+  console.log('Or add manually:');
+  console.log('  1. Import ExGuardModule in app.module.ts');
+  console.log('  2. Use ExGuardPermissionGuard in controllers');
+  console.log('');
+}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "exguard-endpoint",
-  "version": "1.0.1",
+  "version": "1.0.4",
   "private": false,
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
-  "description": "Simple RBAC permission guard for NestJS",
+  "description": "Simple RBAC permission guard for NestJS with realtime support",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -17,25 +17,31 @@
       "require": "./dist/index.cjs"
     }
   },
+  "bin": {
+    "exguard-endpoint": "./dist/setup.cjs"
+  },
   "files": [
     "dist"
   ],
   "scripts": {
     "build": "tsup",
     "clean": "node -e \"fs.rmSync('dist', { recursive: true, force: true })\"",
-    "prebuild": "npm run clean"
+    "prebuild": "npm run clean",
+    "setup": "node dist/setup.cjs"
   },
   "keywords": [
     "exguard",
     "rbac",
     "nestjs",
     "permissions",
-    "guards"
+    "guards",
+    "realtime"
   ],
   "author": "EmpowerX",
   "license": "MIT",
   "dependencies": {
-    "axios": "^1.0.0"
+    "axios": "^1.0.0",
+    "socket.io-client": "^4.8.3"
   },
   "devDependencies": {
     "@nestjs/common": "^10.0.0",