exguard-endpoint 1.0.3 → 1.0.5

package/README.md

@@ -34,8 +34,7 @@ import { ExGuardModule } from 'exguard-endpoint';
 @Module({
   imports: [
     ExGuardModule.forRoot({
-      baseUrl: process.env.EXGUARD_BASE_URL || 'https://api.exguard.com',
-      apiKey: process.env.EXGUARD_API_KEY,
+      baseUrl: process.env.EXGUARD_BASE_URL,
       cache: {
         enabled: true,
         ttl: 300000, // 5 minutes
@@ -58,7 +57,7 @@ import { Controller, Get, Post, Patch, Delete, UseGuards } from '@nestjs/common'
 import { ExGuardPermissionGuard, RequirePermissions } from '../exguard/exguard.guard';
 
 @Controller('items')
-@UseGuards(ExGuardPermissionGuard)  // Apply to all routes in this controller
+@UseGuards(ExGuardPermissionGuard)
 export class ItemsController {
   
   // User needs ANY of these permissions
@@ -86,11 +85,20 @@ export class ItemsController {
 Add to your `.env` file:
 
 ```env
-EXGUARD_BASE_URL=https://api.exguard.com
-EXGUARD_API_KEY=your_api_key_here
-EXGUARD_REALTIME_URL=wss://realtime.exguard.com
+EXGUARD_BASE_URL=https://your-guard-api.com
+EXGUARD_REALTIME_URL=wss://your-realtime.com
 ```
 
+The `EXGUARD_BASE_URL` should be the URL where your **empowerx-guard-api** is running.
+
+## How It Works
+
+1. Extracts Bearer token from request header
+2. Calls `/guard/verify-token` to validate the Cognito token
+3. Calls `/guard/me` to get user access (roles, permissions, modules)
+4. Checks if user has required permissions
+5. Returns user object in `request.user`
+
 ## API Reference
 
 ### Decorators
@@ -104,8 +112,7 @@ EXGUARD_REALTIME_URL=wss://realtime.exguard.com
 
 | Option | Type | Required | Default | Description |
 |--------|------|----------|---------|-------------|
-| baseUrl | string | Yes | - | ExGuard API base URL |
-| apiKey | string | Yes | - | Your API key |
+| baseUrl | string | Yes | - | Guard API base URL |
 | cache.enabled | boolean | No | true | Enable caching |
 | cache.ttl | number | No | 300000 | Cache TTL in ms (5 min) |
 | realtime.enabled | boolean | No | false | Enable realtime connection |
@@ -122,7 +129,32 @@ The guard automatically extracts token from:
 After successful authentication, the user object is available at:
 ```typescript
 @Request() req: any
-console.log(req.user); // { id, username, email, roles, modules }
+console.log(req.user); // { id, username, email, roles, modules, groups, fieldOffices }
+```
+
+## User Object Structure
+
+```typescript
+{
+  user: {
+    id: string,
+    cognitoSubId: string,
+    username: string,
+    email: string,
+    emailVerified: boolean,
+    givenName: string,
+    familyName: string,
+    employeeNumber: string,
+    regionId: string,
+    fieldOffice: { id, code, name }
+  },
+  groups: string[],
+  roles: string[],
+  modules: [
+    { key: 'events', name: 'Events', permissions: ['events:create', 'events:read'] }
+  ],
+  fieldOffices: string[]
+}
 ```
 
 ## Realtime Features

package/dist/index.cjs

@@ -148,7 +148,6 @@ var realtime = new ExGuardRealtime();
 var ExGuardClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl;
-    this.apiKey = config.apiKey;
     this.cache = cache;
     this.realtime = realtime;
     if (config.realtime?.enabled && config.realtime?.url) {
@@ -160,25 +159,36 @@ var ExGuardClient = class {
     const cached = this.cache.get(cacheKey);
     if (cached) return cached;
     try {
-      const response = await fetch(`${this.baseUrl}/api/v1/auth/validate`, {
+      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "Authorization": `Bearer ${this.apiKey}`
+          "Authorization": `Bearer ${context.token}`
         },
-        body: JSON.stringify({ token: context.token })
+        body: JSON.stringify({ id_token: context.token })
       });
-      if (!response.ok) {
-        return { allowed: false, error: "Invalid token" };
+      if (!verifyResponse.ok) {
+        const errorData = await verifyResponse.json().catch(() => ({}));
+        return { allowed: false, error: errorData.message || "Invalid token" };
       }
-      const data = await response.json();
+      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {
+        method: "GET",
+        headers: {
+          "Authorization": `Bearer ${context.token}`
+        }
+      });
+      if (!meResponse.ok) {
+        return { allowed: false, error: "Failed to get user access" };
+      }
+      const meData = await meResponse.json();
       const result = {
         allowed: true,
-        user: data.user || data.data?.user
+        user: meData.data || meData
       };
       this.cache.set(cacheKey, result);
       return result;
     } catch (error) {
+      console.error("[ExGuard] Authentication error:", error);
       return { allowed: false, error: "Authentication failed" };
     }
   }
@@ -205,7 +215,6 @@ var ExGuardModule = class {
   static forRoot(options) {
     const client = new ExGuardClient({
       baseUrl: options.baseUrl,
-      apiKey: options.apiKey,
       cache: options.cache,
       realtime: options.realtime
     });

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export { ExGuardClient, createExGuardClient, cache, realtime } from './client.js';\nexport type { ExGuardConfig, User, ModulePermission, UserAccessResponse, GuardContext, GuardResult, RealtimeEvents } from './client.js';\nexport { ExGuardModule } from './module.js';\nexport type { ExGuardModuleOptions } from './module.js';\nexport { ExGuardPermissionGuard, RequirePermissions, RequireRoles, EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY } from './guard.js';\n","export interface ExGuardConfig {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\nexport interface User {\n  id: string;\n  username: string;\n  email: string;\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  roles: string[];\n  modules: ModulePermission[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nexport interface RealtimeEvents {\n  onConnect?: () => void;\n  onDisconnect?: () => void;\n  onPermissionUpdate?: (data: { userId: string; permissions: string[] }) => void;\n  onUserUpdate?: (data: { userId: string; user: UserAccessResponse }) => void;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n\n  delete(key: string): void {\n    this.cache.delete(key);\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  clearUser(userId: string): void {\n    for (const key of this.cache.keys()) {\n      if (key.includes(userId)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n}\n\nconst cache = new ExGuardCache();\n\nclass ExGuardRealtime {\n  private socket: any = null;\n  private connected = false;\n  private url: string = '';\n  private events: RealtimeEvents = {};\n\n  connect(url: string, events: RealtimeEvents = {}): void {\n    this.url = url;\n    this.events = events;\n    \n    if (!url) {\n      console.log('[ExGuard] Realtime URL not provided, skipping connection');\n      return;\n    }\n\n    try {\n      const { io } = require('socket.io-client');\n      this.socket = io(url, {\n        transports: ['websocket'],\n        reconnection: true,\n        reconnectionAttempts: 5,\n        reconnectionDelay: 1000,\n      });\n\n      this.socket.on('connect', () => {\n        this.connected = true;\n        console.log('[ExGuard] Realtime connected');\n        this.events.onConnect?.();\n      });\n\n      this.socket.on('disconnect', () => {\n        this.connected = false;\n        console.log('[ExGuard] Realtime disconnected');\n        this.events.onDisconnect?.();\n      });\n\n      this.socket.on('permission:update', (data: any) => {\n        console.log('[ExGuard] Permission update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onPermissionUpdate?.(data);\n      });\n\n      this.socket.on('user:update', (data: any) => {\n        console.log('[ExGuard] User update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onUserUpdate?.(data);\n      });\n\n      this.socket.on('connect_error', (err: any) => {\n        console.error('[ExGuard] Realtime connection error:', err.message);\n      });\n    } catch (error) {\n      console.error('[ExGuard] Failed to load socket.io-client:', error);\n    }\n  }\n\n  disconnect(): void {\n    if (this.socket) {\n      this.socket.disconnect();\n      this.socket = null;\n      this.connected = false;\n    }\n  }\n\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  emit(event: string, data: any): void {\n    if (this.socket && this.connected) {\n      this.socket.emit(event, data);\n    }\n  }\n}\n\nconst realtime = new ExGuardRealtime();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private apiKey: string;\n  private cache: ExGuardCache;\n  private realtime: ExGuardRealtime;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.apiKey = config.apiKey;\n    this.cache = cache;\n    this.realtime = realtime;\n\n    if (config.realtime?.enabled && config.realtime?.url) {\n      this.realtime.connect(config.realtime.url);\n    }\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      const response = await fetch(`${this.baseUrl}/api/v1/auth/validate`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${this.apiKey}`,\n        },\n        body: JSON.stringify({ token: context.token }),\n      });\n\n      if (!response.ok) {\n        return { allowed: false, error: 'Invalid token' };\n      }\n\n      const data = await response.json();\n      const result: GuardResult = {\n        allowed: true,\n        user: data.user || data.data?.user,\n      };\n\n      this.cache.set(cacheKey, result);\n      return result;\n    } catch (error) {\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  disconnectRealtime(): void {\n    this.realtime.disconnect();\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache, realtime };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      apiKey: options.apiKey,\n      cache: options.cache,\n      realtime: options.realtime,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      console.warn('[ExGuard] Client not configured. Access denied.');\n      return false;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiDA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,KAAmB;AACxB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,UAAU,QAAsB;AAC9B,eAAW,OAAO,KAAK,MAAM,KAAK,GAAG;AACnC,UAAI,IAAI,SAAS,MAAM,GAAG;AACxB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAE/B,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AACE,SAAQ,SAAc;AACtB,SAAQ,YAAY;AACpB,SAAQ,MAAc;AACtB,SAAQ,SAAyB,CAAC;AAAA;AAAA,EAElC,QAAQ,KAAa,SAAyB,CAAC,GAAS;AACtD,SAAK,MAAM;AACX,SAAK,SAAS;AAEd,QAAI,CAAC,KAAK;AACR,cAAQ,IAAI,0DAA0D;AACtE;AAAA,IACF;AAEA,QAAI;AACF,YAAM,EAAE,GAAG,IAAI,QAAQ,kBAAkB;AACzC,WAAK,SAAS,GAAG,KAAK;AAAA,QACpB,YAAY,CAAC,WAAW;AAAA,QACxB,cAAc;AAAA,QACd,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,MACrB,CAAC;AAED,WAAK,OAAO,GAAG,WAAW,MAAM;AAC9B,aAAK,YAAY;AACjB,gBAAQ,IAAI,8BAA8B;AAC1C,aAAK,OAAO,YAAY;AAAA,MAC1B,CAAC;AAED,WAAK,OAAO,GAAG,cAAc,MAAM;AACjC,aAAK,YAAY;AACjB,gBAAQ,IAAI,iCAAiC;AAC7C,aAAK,OAAO,eAAe;AAAA,MAC7B,CAAC;AAED,WAAK,OAAO,GAAG,qBAAqB,CAAC,SAAc;AACjD,gBAAQ,IAAI,yCAAyC,IAAI;AACzD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,qBAAqB,IAAI;AAAA,MACvC,CAAC;AAED,WAAK,OAAO,GAAG,eAAe,CAAC,SAAc;AAC3C,gBAAQ,IAAI,mCAAmC,IAAI;AACnD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,eAAe,IAAI;AAAA,MACjC,CAAC;AAED,WAAK,OAAO,GAAG,iBAAiB,CAAC,QAAa;AAC5C,gBAAQ,MAAM,wCAAwC,IAAI,OAAO;AAAA,MACnE,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,8CAA8C,KAAK;AAAA,IACnE;AAAA,EACF;AAAA,EAEA,aAAmB;AACjB,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,WAAW;AACvB,WAAK,SAAS;AACd,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,cAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,KAAK,OAAe,MAAiB;AACnC,QAAI,KAAK,UAAU,KAAK,WAAW;AACjC,WAAK,OAAO,KAAK,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,IAAM,WAAW,IAAI,gBAAgB;AAE9B,IAAM,gBAAN,MAAoB;AAAA,EAMzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ;AACb,SAAK,WAAW;AAEhB,QAAI,OAAO,UAAU,WAAW,OAAO,UAAU,KAAK;AACpD,WAAK,SAAS,QAAQ,OAAO,SAAS,GAAG;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,yBAAyB;AAAA,QACnE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,KAAK,MAAM;AAAA,QACxC;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,MAC/C,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,eAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,MAClD;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,KAAK,QAAQ,KAAK,MAAM;AAAA,MAChC;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,qBAA2B;AACzB,SAAK,SAAS,WAAW;AAAA,EAC3B;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;AC3OA,oBAA8C;AAkBvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AApBa,gBAAN;AAAA,MAFN,sBAAO;AAAA,MACP,sBAAO,CAAC,CAAC;AAAA,GACG;;;AClBb,IAAAA,iBAAuH;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,qCAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,KAAK,iDAAiD;AAC9D,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,kCAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,kCAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAjFa,yBAAN;AAAA,MADN,2BAAW;AAAA,EAGP,gDAAS;AAAA,EAAG,8CAAO,gBAAgB;AAAA,GAF3B;AAmFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":["import_common"]}
+{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export { ExGuardClient, createExGuardClient, cache, realtime } from './client.js';\nexport type { ExGuardConfig, User, ModulePermission, UserAccessResponse, GuardContext, GuardResult, RealtimeEvents } from './client.js';\nexport { ExGuardModule } from './module.js';\nexport type { ExGuardModuleOptions } from './module.js';\nexport { ExGuardPermissionGuard, RequirePermissions, RequireRoles, EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY } from './guard.js';\n","export interface ExGuardConfig {\n  baseUrl: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\nexport interface User {\n  id: string;\n  cognitoSubId: string;\n  username: string;\n  email: string;\n  emailVerified: boolean;\n  givenName: string;\n  familyName: string;\n  employeeNumber: string;\n  regionId: string;\n  createdAt: string;\n  updatedAt: string;\n  lastLoginAt: string;\n  fieldOffice: {\n    id: string;\n    code: string;\n    name: string;\n  };\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  groups: string[];\n  roles: string[];\n  modules: ModulePermission[];\n  fieldOffices: string[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nexport interface RealtimeEvents {\n  onConnect?: () => void;\n  onDisconnect?: () => void;\n  onPermissionUpdate?: (data: { userId: string; permissions: string[] }) => void;\n  onUserUpdate?: (data: { userId: string; user: UserAccessResponse }) => void;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n\n  delete(key: string): void {\n    this.cache.delete(key);\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  clearUser(userId: string): void {\n    for (const key of this.cache.keys()) {\n      if (key.includes(userId)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n}\n\nconst cache = new ExGuardCache();\n\nclass ExGuardRealtime {\n  private socket: any = null;\n  private connected = false;\n  private url: string = '';\n  private events: RealtimeEvents = {};\n\n  connect(url: string, events: RealtimeEvents = {}): void {\n    this.url = url;\n    this.events = events;\n    \n    if (!url) {\n      console.log('[ExGuard] Realtime URL not provided, skipping connection');\n      return;\n    }\n\n    try {\n      const { io } = require('socket.io-client');\n      this.socket = io(url, {\n        transports: ['websocket'],\n        reconnection: true,\n        reconnectionAttempts: 5,\n        reconnectionDelay: 1000,\n      });\n\n      this.socket.on('connect', () => {\n        this.connected = true;\n        console.log('[ExGuard] Realtime connected');\n        this.events.onConnect?.();\n      });\n\n      this.socket.on('disconnect', () => {\n        this.connected = false;\n        console.log('[ExGuard] Realtime disconnected');\n        this.events.onDisconnect?.();\n      });\n\n      this.socket.on('permission:update', (data: any) => {\n        console.log('[ExGuard] Permission update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onPermissionUpdate?.(data);\n      });\n\n      this.socket.on('user:update', (data: any) => {\n        console.log('[ExGuard] User update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onUserUpdate?.(data);\n      });\n\n      this.socket.on('connect_error', (err: any) => {\n        console.error('[ExGuard] Realtime connection error:', err.message);\n      });\n    } catch (error) {\n      console.error('[ExGuard] Failed to load socket.io-client:', error);\n    }\n  }\n\n  disconnect(): void {\n    if (this.socket) {\n      this.socket.disconnect();\n      this.socket = null;\n      this.connected = false;\n    }\n  }\n\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  emit(event: string, data: any): void {\n    if (this.socket && this.connected) {\n      this.socket.emit(event, data);\n    }\n  }\n}\n\nconst realtime = new ExGuardRealtime();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private cache: ExGuardCache;\n  private realtime: ExGuardRealtime;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.cache = cache;\n    this.realtime = realtime;\n\n    if (config.realtime?.enabled && config.realtime?.url) {\n      this.realtime.connect(config.realtime.url);\n    }\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      // First verify the token\n      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${context.token}`,\n        },\n        body: JSON.stringify({ id_token: context.token }),\n      });\n\n      if (!verifyResponse.ok) {\n        const errorData = await verifyResponse.json().catch(() => ({}));\n        return { allowed: false, error: errorData.message || 'Invalid token' };\n      }\n\n      // Then get user access info\n      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {\n        method: 'GET',\n        headers: {\n          'Authorization': `Bearer ${context.token}`,\n        },\n      });\n\n      if (!meResponse.ok) {\n        return { allowed: false, error: 'Failed to get user access' };\n      }\n\n      const meData = await meResponse.json();\n      \n      const result: GuardResult = {\n        allowed: true,\n        user: meData.data || meData,\n      };\n\n      this.cache.set(cacheKey, result);\n      return result;\n    } catch (error) {\n      console.error('[ExGuard] Authentication error:', error);\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  disconnectRealtime(): void {\n    this.realtime.disconnect();\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache, realtime };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      cache: options.cache,\n      realtime: options.realtime,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      console.warn('[ExGuard] Client not configured. Access denied.');\n      return false;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACgEA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,KAAmB;AACxB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,UAAU,QAAsB;AAC9B,eAAW,OAAO,KAAK,MAAM,KAAK,GAAG;AACnC,UAAI,IAAI,SAAS,MAAM,GAAG;AACxB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAE/B,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AACE,SAAQ,SAAc;AACtB,SAAQ,YAAY;AACpB,SAAQ,MAAc;AACtB,SAAQ,SAAyB,CAAC;AAAA;AAAA,EAElC,QAAQ,KAAa,SAAyB,CAAC,GAAS;AACtD,SAAK,MAAM;AACX,SAAK,SAAS;AAEd,QAAI,CAAC,KAAK;AACR,cAAQ,IAAI,0DAA0D;AACtE;AAAA,IACF;AAEA,QAAI;AACF,YAAM,EAAE,GAAG,IAAI,QAAQ,kBAAkB;AACzC,WAAK,SAAS,GAAG,KAAK;AAAA,QACpB,YAAY,CAAC,WAAW;AAAA,QACxB,cAAc;AAAA,QACd,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,MACrB,CAAC;AAED,WAAK,OAAO,GAAG,WAAW,MAAM;AAC9B,aAAK,YAAY;AACjB,gBAAQ,IAAI,8BAA8B;AAC1C,aAAK,OAAO,YAAY;AAAA,MAC1B,CAAC;AAED,WAAK,OAAO,GAAG,cAAc,MAAM;AACjC,aAAK,YAAY;AACjB,gBAAQ,IAAI,iCAAiC;AAC7C,aAAK,OAAO,eAAe;AAAA,MAC7B,CAAC;AAED,WAAK,OAAO,GAAG,qBAAqB,CAAC,SAAc;AACjD,gBAAQ,IAAI,yCAAyC,IAAI;AACzD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,qBAAqB,IAAI;AAAA,MACvC,CAAC;AAED,WAAK,OAAO,GAAG,eAAe,CAAC,SAAc;AAC3C,gBAAQ,IAAI,mCAAmC,IAAI;AACnD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,eAAe,IAAI;AAAA,MACjC,CAAC;AAED,WAAK,OAAO,GAAG,iBAAiB,CAAC,QAAa;AAC5C,gBAAQ,MAAM,wCAAwC,IAAI,OAAO;AAAA,MACnE,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,8CAA8C,KAAK;AAAA,IACnE;AAAA,EACF;AAAA,EAEA,aAAmB;AACjB,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,WAAW;AACvB,WAAK,SAAS;AACd,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,cAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,KAAK,OAAe,MAAiB;AACnC,QAAI,KAAK,UAAU,KAAK,WAAW;AACjC,WAAK,OAAO,KAAK,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,IAAM,WAAW,IAAI,gBAAgB;AAE9B,IAAM,gBAAN,MAAoB;AAAA,EAKzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,QAAQ;AACb,SAAK,WAAW;AAEhB,QAAI,OAAO,UAAU,WAAW,OAAO,UAAU,KAAK;AACpD,WAAK,SAAS,QAAQ,OAAO,SAAS,GAAG;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AAEF,YAAM,iBAAiB,MAAM,MAAM,GAAG,KAAK,OAAO,uBAAuB;AAAA,QACvE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,UAAU,QAAQ,MAAM,CAAC;AAAA,MAClD,CAAC;AAED,UAAI,CAAC,eAAe,IAAI;AACtB,cAAM,YAAY,MAAM,eAAe,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9D,eAAO,EAAE,SAAS,OAAO,OAAO,UAAU,WAAW,gBAAgB;AAAA,MACvE;AAGA,YAAM,aAAa,MAAM,MAAM,GAAG,KAAK,OAAO,aAAa;AAAA,QACzD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,MACF,CAAC;AAED,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO,EAAE,SAAS,OAAO,OAAO,4BAA4B;AAAA,MAC9D;AAEA,YAAM,SAAS,MAAM,WAAW,KAAK;AAErC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,OAAO,QAAQ;AAAA,MACvB;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,mCAAmC,KAAK;AACtD,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,qBAA2B;AACzB,SAAK,SAAS,WAAW;AAAA,EAC3B;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;ACxQA,oBAA8C;AAiBvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AAnBa,gBAAN;AAAA,MAFN,sBAAO;AAAA,MACP,sBAAO,CAAC,CAAC;AAAA,GACG;;;ACjBb,IAAAA,iBAAuH;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,qCAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,KAAK,iDAAiD;AAC9D,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,kCAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,kCAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAjFa,yBAAN;AAAA,MADN,2BAAW;AAAA,EAGP,gDAAS;AAAA,EAAG,8CAAO,gBAAgB;AAAA,GAF3B;AAmFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":["import_common"]}

package/dist/index.d.cts

@@ -3,7 +3,6 @@ import { Reflector } from '@nestjs/core';
 
 interface ExGuardConfig {
     baseUrl: string;
-    apiKey: string;
     cache?: {
         enabled?: boolean;
         ttl?: number;
@@ -15,8 +14,22 @@ interface ExGuardConfig {
 }
 interface User {
     id: string;
+    cognitoSubId: string;
     username: string;
     email: string;
+    emailVerified: boolean;
+    givenName: string;
+    familyName: string;
+    employeeNumber: string;
+    regionId: string;
+    createdAt: string;
+    updatedAt: string;
+    lastLoginAt: string;
+    fieldOffice: {
+        id: string;
+        code: string;
+        name: string;
+    };
 }
 interface ModulePermission {
     key: string;
@@ -25,8 +38,10 @@ interface ModulePermission {
 }
 interface UserAccessResponse {
     user: User;
+    groups: string[];
     roles: string[];
     modules: ModulePermission[];
+    fieldOffices: string[];
 }
 interface GuardContext {
     token: string;
@@ -72,7 +87,6 @@ declare class ExGuardRealtime {
 declare const realtime: ExGuardRealtime;
 declare class ExGuardClient {
     private baseUrl;
-    private apiKey;
     private cache;
     private realtime;
     constructor(config: ExGuardConfig);
@@ -85,7 +99,6 @@ declare function createExGuardClient(config: ExGuardConfig): ExGuardClient;
 
 interface ExGuardModuleOptions {
     baseUrl: string;
-    apiKey: string;
     cache?: {
         enabled?: boolean;
         ttl?: number;

package/dist/index.d.ts

@@ -3,7 +3,6 @@ import { Reflector } from '@nestjs/core';
 
 interface ExGuardConfig {
     baseUrl: string;
-    apiKey: string;
     cache?: {
         enabled?: boolean;
         ttl?: number;
@@ -15,8 +14,22 @@ interface ExGuardConfig {
 }
 interface User {
     id: string;
+    cognitoSubId: string;
     username: string;
     email: string;
+    emailVerified: boolean;
+    givenName: string;
+    familyName: string;
+    employeeNumber: string;
+    regionId: string;
+    createdAt: string;
+    updatedAt: string;
+    lastLoginAt: string;
+    fieldOffice: {
+        id: string;
+        code: string;
+        name: string;
+    };
 }
 interface ModulePermission {
     key: string;
@@ -25,8 +38,10 @@ interface ModulePermission {
 }
 interface UserAccessResponse {
     user: User;
+    groups: string[];
     roles: string[];
     modules: ModulePermission[];
+    fieldOffices: string[];
 }
 interface GuardContext {
     token: string;
@@ -72,7 +87,6 @@ declare class ExGuardRealtime {
 declare const realtime: ExGuardRealtime;
 declare class ExGuardClient {
     private baseUrl;
-    private apiKey;
     private cache;
     private realtime;
     constructor(config: ExGuardConfig);
@@ -85,7 +99,6 @@ declare function createExGuardClient(config: ExGuardConfig): ExGuardClient;
 
 interface ExGuardModuleOptions {
     baseUrl: string;
-    apiKey: string;
     cache?: {
         enabled?: boolean;
         ttl?: number;

package/dist/index.js

@@ -122,7 +122,6 @@ var realtime = new ExGuardRealtime();
 var ExGuardClient = class {
   constructor(config) {
     this.baseUrl = config.baseUrl;
-    this.apiKey = config.apiKey;
     this.cache = cache;
     this.realtime = realtime;
     if (config.realtime?.enabled && config.realtime?.url) {
@@ -134,25 +133,36 @@ var ExGuardClient = class {
     const cached = this.cache.get(cacheKey);
     if (cached) return cached;
     try {
-      const response = await fetch(`${this.baseUrl}/api/v1/auth/validate`, {
+      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
-          "Authorization": `Bearer ${this.apiKey}`
+          "Authorization": `Bearer ${context.token}`
         },
-        body: JSON.stringify({ token: context.token })
+        body: JSON.stringify({ id_token: context.token })
       });
-      if (!response.ok) {
-        return { allowed: false, error: "Invalid token" };
+      if (!verifyResponse.ok) {
+        const errorData = await verifyResponse.json().catch(() => ({}));
+        return { allowed: false, error: errorData.message || "Invalid token" };
       }
-      const data = await response.json();
+      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {
+        method: "GET",
+        headers: {
+          "Authorization": `Bearer ${context.token}`
+        }
+      });
+      if (!meResponse.ok) {
+        return { allowed: false, error: "Failed to get user access" };
+      }
+      const meData = await meResponse.json();
       const result = {
         allowed: true,
-        user: data.user || data.data?.user
+        user: meData.data || meData
       };
       this.cache.set(cacheKey, result);
       return result;
     } catch (error) {
+      console.error("[ExGuard] Authentication error:", error);
       return { allowed: false, error: "Authentication failed" };
     }
   }
@@ -179,7 +189,6 @@ var ExGuardModule = class {
   static forRoot(options) {
     const client = new ExGuardClient({
       baseUrl: options.baseUrl,
-      apiKey: options.apiKey,
       cache: options.cache,
       realtime: options.realtime
     });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export interface ExGuardConfig {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\nexport interface User {\n  id: string;\n  username: string;\n  email: string;\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  roles: string[];\n  modules: ModulePermission[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nexport interface RealtimeEvents {\n  onConnect?: () => void;\n  onDisconnect?: () => void;\n  onPermissionUpdate?: (data: { userId: string; permissions: string[] }) => void;\n  onUserUpdate?: (data: { userId: string; user: UserAccessResponse }) => void;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n\n  delete(key: string): void {\n    this.cache.delete(key);\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  clearUser(userId: string): void {\n    for (const key of this.cache.keys()) {\n      if (key.includes(userId)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n}\n\nconst cache = new ExGuardCache();\n\nclass ExGuardRealtime {\n  private socket: any = null;\n  private connected = false;\n  private url: string = '';\n  private events: RealtimeEvents = {};\n\n  connect(url: string, events: RealtimeEvents = {}): void {\n    this.url = url;\n    this.events = events;\n    \n    if (!url) {\n      console.log('[ExGuard] Realtime URL not provided, skipping connection');\n      return;\n    }\n\n    try {\n      const { io } = require('socket.io-client');\n      this.socket = io(url, {\n        transports: ['websocket'],\n        reconnection: true,\n        reconnectionAttempts: 5,\n        reconnectionDelay: 1000,\n      });\n\n      this.socket.on('connect', () => {\n        this.connected = true;\n        console.log('[ExGuard] Realtime connected');\n        this.events.onConnect?.();\n      });\n\n      this.socket.on('disconnect', () => {\n        this.connected = false;\n        console.log('[ExGuard] Realtime disconnected');\n        this.events.onDisconnect?.();\n      });\n\n      this.socket.on('permission:update', (data: any) => {\n        console.log('[ExGuard] Permission update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onPermissionUpdate?.(data);\n      });\n\n      this.socket.on('user:update', (data: any) => {\n        console.log('[ExGuard] User update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onUserUpdate?.(data);\n      });\n\n      this.socket.on('connect_error', (err: any) => {\n        console.error('[ExGuard] Realtime connection error:', err.message);\n      });\n    } catch (error) {\n      console.error('[ExGuard] Failed to load socket.io-client:', error);\n    }\n  }\n\n  disconnect(): void {\n    if (this.socket) {\n      this.socket.disconnect();\n      this.socket = null;\n      this.connected = false;\n    }\n  }\n\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  emit(event: string, data: any): void {\n    if (this.socket && this.connected) {\n      this.socket.emit(event, data);\n    }\n  }\n}\n\nconst realtime = new ExGuardRealtime();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private apiKey: string;\n  private cache: ExGuardCache;\n  private realtime: ExGuardRealtime;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.apiKey = config.apiKey;\n    this.cache = cache;\n    this.realtime = realtime;\n\n    if (config.realtime?.enabled && config.realtime?.url) {\n      this.realtime.connect(config.realtime.url);\n    }\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      const response = await fetch(`${this.baseUrl}/api/v1/auth/validate`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${this.apiKey}`,\n        },\n        body: JSON.stringify({ token: context.token }),\n      });\n\n      if (!response.ok) {\n        return { allowed: false, error: 'Invalid token' };\n      }\n\n      const data = await response.json();\n      const result: GuardResult = {\n        allowed: true,\n        user: data.user || data.data?.user,\n      };\n\n      this.cache.set(cacheKey, result);\n      return result;\n    } catch (error) {\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  disconnectRealtime(): void {\n    this.realtime.disconnect();\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache, realtime };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  apiKey: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      apiKey: options.apiKey,\n      cache: options.cache,\n      realtime: options.realtime,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      console.warn('[ExGuard] Client not configured. Access denied.');\n      return false;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAiDA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,KAAmB;AACxB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,UAAU,QAAsB;AAC9B,eAAW,OAAO,KAAK,MAAM,KAAK,GAAG;AACnC,UAAI,IAAI,SAAS,MAAM,GAAG;AACxB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAE/B,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AACE,SAAQ,SAAc;AACtB,SAAQ,YAAY;AACpB,SAAQ,MAAc;AACtB,SAAQ,SAAyB,CAAC;AAAA;AAAA,EAElC,QAAQ,KAAa,SAAyB,CAAC,GAAS;AACtD,SAAK,MAAM;AACX,SAAK,SAAS;AAEd,QAAI,CAAC,KAAK;AACR,cAAQ,IAAI,0DAA0D;AACtE;AAAA,IACF;AAEA,QAAI;AACF,YAAM,EAAE,GAAG,IAAI,UAAQ,kBAAkB;AACzC,WAAK,SAAS,GAAG,KAAK;AAAA,QACpB,YAAY,CAAC,WAAW;AAAA,QACxB,cAAc;AAAA,QACd,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,MACrB,CAAC;AAED,WAAK,OAAO,GAAG,WAAW,MAAM;AAC9B,aAAK,YAAY;AACjB,gBAAQ,IAAI,8BAA8B;AAC1C,aAAK,OAAO,YAAY;AAAA,MAC1B,CAAC;AAED,WAAK,OAAO,GAAG,cAAc,MAAM;AACjC,aAAK,YAAY;AACjB,gBAAQ,IAAI,iCAAiC;AAC7C,aAAK,OAAO,eAAe;AAAA,MAC7B,CAAC;AAED,WAAK,OAAO,GAAG,qBAAqB,CAAC,SAAc;AACjD,gBAAQ,IAAI,yCAAyC,IAAI;AACzD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,qBAAqB,IAAI;AAAA,MACvC,CAAC;AAED,WAAK,OAAO,GAAG,eAAe,CAAC,SAAc;AAC3C,gBAAQ,IAAI,mCAAmC,IAAI;AACnD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,eAAe,IAAI;AAAA,MACjC,CAAC;AAED,WAAK,OAAO,GAAG,iBAAiB,CAAC,QAAa;AAC5C,gBAAQ,MAAM,wCAAwC,IAAI,OAAO;AAAA,MACnE,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,8CAA8C,KAAK;AAAA,IACnE;AAAA,EACF;AAAA,EAEA,aAAmB;AACjB,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,WAAW;AACvB,WAAK,SAAS;AACd,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,cAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,KAAK,OAAe,MAAiB;AACnC,QAAI,KAAK,UAAU,KAAK,WAAW;AACjC,WAAK,OAAO,KAAK,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,IAAM,WAAW,IAAI,gBAAgB;AAE9B,IAAM,gBAAN,MAAoB;AAAA,EAMzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,SAAS,OAAO;AACrB,SAAK,QAAQ;AACb,SAAK,WAAW;AAEhB,QAAI,OAAO,UAAU,WAAW,OAAO,UAAU,KAAK;AACpD,WAAK,SAAS,QAAQ,OAAO,SAAS,GAAG;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,yBAAyB;AAAA,QACnE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,KAAK,MAAM;AAAA,QACxC;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,MAAM,CAAC;AAAA,MAC/C,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,eAAO,EAAE,SAAS,OAAO,OAAO,gBAAgB;AAAA,MAClD;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,KAAK,QAAQ,KAAK,MAAM;AAAA,MAChC;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,qBAA2B;AACzB,SAAK,SAAS,WAAW;AAAA,EAC3B;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;AC3OA,SAAS,QAAQ,cAA6B;AAkBvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ;AAAA,MACf,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AApBa,gBAAN;AAAA,EAFN,OAAO;AAAA,EACP,OAAO,CAAC,CAAC;AAAA,GACG;;;AClBb,SAAS,YAA2C,uBAAuB,oBAAoB,QAAQ,gBAAgB;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,sBAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,KAAK,iDAAiD;AAC9D,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,mBAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,mBAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,mBAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,mBAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,mBAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,mBAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAjFa,yBAAN;AAAA,EADN,WAAW;AAAA,EAGP,4BAAS;AAAA,EAAG,0BAAO,gBAAgB;AAAA,GAF3B;AAmFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export interface ExGuardConfig {\n  baseUrl: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\nexport interface User {\n  id: string;\n  cognitoSubId: string;\n  username: string;\n  email: string;\n  emailVerified: boolean;\n  givenName: string;\n  familyName: string;\n  employeeNumber: string;\n  regionId: string;\n  createdAt: string;\n  updatedAt: string;\n  lastLoginAt: string;\n  fieldOffice: {\n    id: string;\n    code: string;\n    name: string;\n  };\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  groups: string[];\n  roles: string[];\n  modules: ModulePermission[];\n  fieldOffices: string[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nexport interface RealtimeEvents {\n  onConnect?: () => void;\n  onDisconnect?: () => void;\n  onPermissionUpdate?: (data: { userId: string; permissions: string[] }) => void;\n  onUserUpdate?: (data: { userId: string; user: UserAccessResponse }) => void;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n\n  delete(key: string): void {\n    this.cache.delete(key);\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  clearUser(userId: string): void {\n    for (const key of this.cache.keys()) {\n      if (key.includes(userId)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n}\n\nconst cache = new ExGuardCache();\n\nclass ExGuardRealtime {\n  private socket: any = null;\n  private connected = false;\n  private url: string = '';\n  private events: RealtimeEvents = {};\n\n  connect(url: string, events: RealtimeEvents = {}): void {\n    this.url = url;\n    this.events = events;\n    \n    if (!url) {\n      console.log('[ExGuard] Realtime URL not provided, skipping connection');\n      return;\n    }\n\n    try {\n      const { io } = require('socket.io-client');\n      this.socket = io(url, {\n        transports: ['websocket'],\n        reconnection: true,\n        reconnectionAttempts: 5,\n        reconnectionDelay: 1000,\n      });\n\n      this.socket.on('connect', () => {\n        this.connected = true;\n        console.log('[ExGuard] Realtime connected');\n        this.events.onConnect?.();\n      });\n\n      this.socket.on('disconnect', () => {\n        this.connected = false;\n        console.log('[ExGuard] Realtime disconnected');\n        this.events.onDisconnect?.();\n      });\n\n      this.socket.on('permission:update', (data: any) => {\n        console.log('[ExGuard] Permission update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onPermissionUpdate?.(data);\n      });\n\n      this.socket.on('user:update', (data: any) => {\n        console.log('[ExGuard] User update received:', data);\n        cache.clearUser(data.userId);\n        this.events.onUserUpdate?.(data);\n      });\n\n      this.socket.on('connect_error', (err: any) => {\n        console.error('[ExGuard] Realtime connection error:', err.message);\n      });\n    } catch (error) {\n      console.error('[ExGuard] Failed to load socket.io-client:', error);\n    }\n  }\n\n  disconnect(): void {\n    if (this.socket) {\n      this.socket.disconnect();\n      this.socket = null;\n      this.connected = false;\n    }\n  }\n\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  emit(event: string, data: any): void {\n    if (this.socket && this.connected) {\n      this.socket.emit(event, data);\n    }\n  }\n}\n\nconst realtime = new ExGuardRealtime();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private cache: ExGuardCache;\n  private realtime: ExGuardRealtime;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.cache = cache;\n    this.realtime = realtime;\n\n    if (config.realtime?.enabled && config.realtime?.url) {\n      this.realtime.connect(config.realtime.url);\n    }\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      // First verify the token\n      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${context.token}`,\n        },\n        body: JSON.stringify({ id_token: context.token }),\n      });\n\n      if (!verifyResponse.ok) {\n        const errorData = await verifyResponse.json().catch(() => ({}));\n        return { allowed: false, error: errorData.message || 'Invalid token' };\n      }\n\n      // Then get user access info\n      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {\n        method: 'GET',\n        headers: {\n          'Authorization': `Bearer ${context.token}`,\n        },\n      });\n\n      if (!meResponse.ok) {\n        return { allowed: false, error: 'Failed to get user access' };\n      }\n\n      const meData = await meResponse.json();\n      \n      const result: GuardResult = {\n        allowed: true,\n        user: meData.data || meData,\n      };\n\n      this.cache.set(cacheKey, result);\n      return result;\n    } catch (error) {\n      console.error('[ExGuard] Authentication error:', error);\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  disconnectRealtime(): void {\n    this.realtime.disconnect();\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache, realtime };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      cache: options.cache,\n      realtime: options.realtime,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      console.warn('[ExGuard] Client not configured. Access denied.');\n      return false;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgEA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,KAAmB;AACxB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,UAAU,QAAsB;AAC9B,eAAW,OAAO,KAAK,MAAM,KAAK,GAAG;AACnC,UAAI,IAAI,SAAS,MAAM,GAAG;AACxB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAE/B,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AACE,SAAQ,SAAc;AACtB,SAAQ,YAAY;AACpB,SAAQ,MAAc;AACtB,SAAQ,SAAyB,CAAC;AAAA;AAAA,EAElC,QAAQ,KAAa,SAAyB,CAAC,GAAS;AACtD,SAAK,MAAM;AACX,SAAK,SAAS;AAEd,QAAI,CAAC,KAAK;AACR,cAAQ,IAAI,0DAA0D;AACtE;AAAA,IACF;AAEA,QAAI;AACF,YAAM,EAAE,GAAG,IAAI,UAAQ,kBAAkB;AACzC,WAAK,SAAS,GAAG,KAAK;AAAA,QACpB,YAAY,CAAC,WAAW;AAAA,QACxB,cAAc;AAAA,QACd,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,MACrB,CAAC;AAED,WAAK,OAAO,GAAG,WAAW,MAAM;AAC9B,aAAK,YAAY;AACjB,gBAAQ,IAAI,8BAA8B;AAC1C,aAAK,OAAO,YAAY;AAAA,MAC1B,CAAC;AAED,WAAK,OAAO,GAAG,cAAc,MAAM;AACjC,aAAK,YAAY;AACjB,gBAAQ,IAAI,iCAAiC;AAC7C,aAAK,OAAO,eAAe;AAAA,MAC7B,CAAC;AAED,WAAK,OAAO,GAAG,qBAAqB,CAAC,SAAc;AACjD,gBAAQ,IAAI,yCAAyC,IAAI;AACzD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,qBAAqB,IAAI;AAAA,MACvC,CAAC;AAED,WAAK,OAAO,GAAG,eAAe,CAAC,SAAc;AAC3C,gBAAQ,IAAI,mCAAmC,IAAI;AACnD,cAAM,UAAU,KAAK,MAAM;AAC3B,aAAK,OAAO,eAAe,IAAI;AAAA,MACjC,CAAC;AAED,WAAK,OAAO,GAAG,iBAAiB,CAAC,QAAa;AAC5C,gBAAQ,MAAM,wCAAwC,IAAI,OAAO;AAAA,MACnE,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,8CAA8C,KAAK;AAAA,IACnE;AAAA,EACF;AAAA,EAEA,aAAmB;AACjB,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,WAAW;AACvB,WAAK,SAAS;AACd,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,cAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,KAAK,OAAe,MAAiB;AACnC,QAAI,KAAK,UAAU,KAAK,WAAW;AACjC,WAAK,OAAO,KAAK,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,IAAM,WAAW,IAAI,gBAAgB;AAE9B,IAAM,gBAAN,MAAoB;AAAA,EAKzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,QAAQ;AACb,SAAK,WAAW;AAEhB,QAAI,OAAO,UAAU,WAAW,OAAO,UAAU,KAAK;AACpD,WAAK,SAAS,QAAQ,OAAO,SAAS,GAAG;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AAEF,YAAM,iBAAiB,MAAM,MAAM,GAAG,KAAK,OAAO,uBAAuB;AAAA,QACvE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,UAAU,QAAQ,MAAM,CAAC;AAAA,MAClD,CAAC;AAED,UAAI,CAAC,eAAe,IAAI;AACtB,cAAM,YAAY,MAAM,eAAe,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9D,eAAO,EAAE,SAAS,OAAO,OAAO,UAAU,WAAW,gBAAgB;AAAA,MACvE;AAGA,YAAM,aAAa,MAAM,MAAM,GAAG,KAAK,OAAO,aAAa;AAAA,QACzD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,MACF,CAAC;AAED,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO,EAAE,SAAS,OAAO,OAAO,4BAA4B;AAAA,MAC9D;AAEA,YAAM,SAAS,MAAM,WAAW,KAAK;AAErC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,OAAO,QAAQ;AAAA,MACvB;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAC/B,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,mCAAmC,KAAK;AACtD,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,qBAA2B;AACzB,SAAK,SAAS,WAAW;AAAA,EAC3B;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;ACxQA,SAAS,QAAQ,cAA6B;AAiBvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AAnBa,gBAAN;AAAA,EAFN,OAAO;AAAA,EACP,OAAO,CAAC,CAAC;AAAA,GACG;;;ACjBb,SAAS,YAA2C,uBAAuB,oBAAoB,QAAQ,gBAAgB;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,sBAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,KAAK,iDAAiD;AAC9D,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,mBAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,mBAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,mBAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,mBAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,mBAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,mBAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAjFa,yBAAN;AAAA,EADN,WAAW;AAAA,EAGP,4BAAS;AAAA,EAAG,0BAAO,gBAAgB;AAAA,GAF3B;AAmFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/setup.cjs

@@ -155,7 +155,6 @@ function setup() {
   console.log('     imports: [');
   console.log('       ExGuardModule.forRoot({');
   console.log('         baseUrl: process.env.EXGUARD_BASE_URL,');
-  console.log('         apiKey: process.env.EXGUARD_API_KEY,');
   console.log('         realtime: {');
   console.log('           enabled: true,');
   console.log('           url: process.env.EXGUARD_REALTIME_URL,');
@@ -165,11 +164,10 @@ function setup() {
   console.log('   })');
   console.log('   export class AppModule {}');
   console.log('');
-  console.log('2. Add environment variables:');
+  console.log('2. Add environment variable:');
   console.log('');
-  console.log('   EXGUARD_BASE_URL=https://api.exguard.com');
-  console.log('   EXGUARD_API_KEY=your_api_key');
-  console.log('   EXGUARD_REALTIME_URL=wss://realtime.exguard.com');
+  console.log('   EXGUARD_BASE_URL=https://your-guard-api.com');
+  console.log('   EXGUARD_REALTIME_URL=wss://your-realtime.com');
   console.log('');
   console.log('3. Use in controllers:');
   console.log('');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "exguard-endpoint",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "private": false,
   "publishConfig": {
     "access": "public"