exguard-endpoint 1.0.6 → 1.0.8

package/README.md

@@ -1,6 +1,6 @@
 # ExGuard Endpoint
 
-Simple RBAC permission guard for NestJS with realtime support.
+Simple RBAC permission guard for NestJS with built-in caching.
 
 ## Installation
 
@@ -8,162 +8,68 @@ Simple RBAC permission guard for NestJS with realtime support.
 npm install exguard-endpoint
 ```
 
-## Quick Setup (Recommended)
-
-Run in your NestJS project root:
+## Quick Setup (Auto-Configures Everything)
 
 ```bash
 npx exguard-endpoint setup
 ```
 
-This creates:
-- `src/exguard/exguard.guard.ts` - The permission guard
-- `src/exguard/exguard.module.ts` - The module
-
-Then follow the printed instructions.
+This will:
+1. Create `src/exguard/exguard.guard.ts`
+2. Create `src/exguard/exguard.module.ts`
+3. Update `src/app.module.ts` with ExGuardModule
+4. Create `.env.example` with EXGUARD_BASE_URL
 
-## Manual Setup
-
-### 1. Configure AppModule
+## Usage
 
 ```typescript
-// src/app.module.ts
-import { Module } from '@nestjs/common';
-import { ExGuardModule } from 'exguard-endpoint';
-
-@Module({
-  imports: [
-    ExGuardModule.forRoot({
-      baseUrl: process.env.EXGUARD_BASE_URL,
-      realtime: {
-        enabled: true,
-        url: process.env.EXGUARD_BASE_URL?.replace(/^http/, 'ws') + '/realtime',
-      },
-    }),
-  ],
-})
-export class AppModule {}
-```
+// app.module.ts is auto-configured!
+// Just use in controllers:
 
-### 2. Use in Controllers
-
-```typescript
-// src/items/items.controller.ts
-import { Controller, Get, Post, Patch, Delete, UseGuards } from '@nestjs/common';
-import { ExGuardPermissionGuard, RequirePermissions } from '../exguard/exguard.guard';
+import { ExGuardPermissionGuard, RequirePermissions } from './exguard/exguard.guard';
 
 @Controller('items')
 @UseGuards(ExGuardPermissionGuard)
 export class ItemsController {
   
-  // User needs ANY of these permissions
   @Get()
   @RequirePermissions(['item:read'])
   findAll() { }
 
-  // Multiple permissions - needs ALL
   @Post()
-  @RequirePermissions(['item:create', 'item:admin'], true)
+  @RequirePermissions(['item:create'])
   create() { }
-
-  @Patch(':id')
-  @RequirePermissions(['item:update'])
-  update() { }
-
-  @Delete(':id')
-  @RequirePermissions(['item:delete', 'admin'], true)
-  delete() { }
 }
 ```
 
-## Environment Variables
-
-Add to your `.env` file:
+## Environment
 
 ```env
-EXGUARD_BASE_URL=https://your-guard-api.com
+EXGUARD_BASE_URL=http://localhost:3000
 ```
 
-The package automatically handles:
-- REST API at `/guard/verify-token` and `/guard/me`
-- Realtime WebSocket at `/realtime` namespace
-
-## How It Works
+## Caching
 
-1. Extracts Bearer token from request header
-2. Calls `/guard/verify-token` to validate the Cognito token
-3. Calls `/guard/me` to get user access (roles, permissions, modules)
-4. Connects to realtime WebSocket for live updates
-5. Checks if user has required permissions
-6. Returns user object in `request.user`
+- **TTL**: 5 minutes
+- **Clear cache**: `clearExGuardCache()`
 
-## API Reference
-
-### Decorators
+## Decorators
 
 | Decorator | Description |
 |-----------|-------------|
-| `@RequirePermissions(['item:read'])` | User needs ANY of the listed permissions |
-| `@RequirePermissions(['item:delete', 'admin'], true)` | User needs ALL listed permissions |
-
-### ExGuardModule.forRoot Options
-
-| Option | Type | Required | Default | Description |
-|--------|------|----------|---------|-------------|
-| baseUrl | string | Yes | - | Guard API base URL |
-| cache.enabled | boolean | No | true | Enable caching |
-| cache.ttl | number | No | 300000 | Cache TTL in ms (5 min) |
-| realtime.enabled | boolean | No | false | Enable realtime connection |
-| realtime.url | string | No | - | Realtime WebSocket URL |
+| `@RequirePermissions(['item:read'])` | User needs ANY permission |
+| `@RequirePermissions(['item:delete', 'admin'], true)` | User needs ALL permissions |
 
-### Token Extraction
-
-The guard automatically extracts token from:
-- `Authorization: Bearer <token>` header
-- `x-access-token` header
-
-### Request User
-
-After successful authentication, the user object is available at:
-```typescript
-@Request() req: any
-console.log(req.user); // { id, username, email, roles, modules, groups, fieldOffices }
-```
-
-## User Object Structure
+## User Object
 
 ```typescript
-{
-  user: {
-    id: string,
-    cognitoSubId: string,
-    username: string,
-    email: string,
-    emailVerified: boolean,
-    givenName: string,
-    familyName: string,
-    employeeNumber: string,
-    regionId: string,
-    fieldOffice: { id, code, name }
-  },
-  groups: string[],
+req.user = {
+  user: { id, username, email, ... },
   roles: string[],
-  modules: [
-    { key: 'events', name: 'Events', permissions: ['events:create', 'events:read'] }
-  ],
+  modules: [{ key, name, permissions: [] }],
+  groups: string[],
   fieldOffices: string[]
 }
 ```
 
-## Realtime Events
-
-The guard listens to these events from the WebSocket:
-- `permission:updated` - Permission changes
-- `role:updated` - Role changes  
-- `user:updated` - User changes
-
-When received, the cache is automatically cleared for that user.
-
-## License
-
 MIT

package/dist/index.cjs

@@ -31,228 +31,28 @@ var src_exports = {};
 __export(src_exports, {
   EXGUARD_PERMISSIONS_KEY: () => EXGUARD_PERMISSIONS_KEY,
   EXGUARD_ROLES_KEY: () => EXGUARD_ROLES_KEY,
-  ExGuardClient: () => ExGuardClient,
   ExGuardModule: () => ExGuardModule,
   ExGuardPermissionGuard: () => ExGuardPermissionGuard,
   RequirePermissions: () => RequirePermissions,
   RequireRoles: () => RequireRoles,
-  cache: () => cache,
-  createExGuardClient: () => createExGuardClient,
-  realtime: () => realtime
+  clearExGuardCache: () => clearExGuardCache
 });
 module.exports = __toCommonJS(src_exports);
 
-// src/client.ts
-var ExGuardCache = class {
-  constructor() {
-    this.cache = /* @__PURE__ */ new Map();
-    this.ttl = 3e5;
-  }
-  get(key) {
-    const entry = this.cache.get(key);
-    if (!entry) return null;
-    if (Date.now() - entry.timestamp > entry.ttl) {
-      this.cache.delete(key);
-      return null;
-    }
-    return entry.data;
-  }
-  set(key, data, ttl) {
-    this.cache.set(key, {
-      data,
-      timestamp: Date.now(),
-      ttl: ttl || this.ttl
-    });
-  }
-  delete(key) {
-    this.cache.delete(key);
-  }
-  clear() {
-    this.cache.clear();
-  }
-  clearUser(userId) {
-    for (const key of this.cache.keys()) {
-      if (key.includes(userId)) {
-        this.cache.delete(key);
-      }
-    }
-  }
-};
-var cache = new ExGuardCache();
-var ExGuardRealtime = class {
-  constructor() {
-    this.socket = null;
-    this.connected = false;
-    this.url = "";
-    this.events = {};
-  }
-  connect(url, token, events = {}) {
-    this.url = url;
-    this.events = events;
-    if (!url) {
-      console.log("[ExGuard] Realtime URL not provided, skipping connection");
-      return;
-    }
-    try {
-      const { io } = require("socket.io-client");
-      let wsUrl = url;
-      if (url.startsWith("http://")) {
-        wsUrl = url.replace("http://", "ws://");
-      } else if (url.startsWith("https://")) {
-        wsUrl = url.replace("https://", "wss://");
-      }
-      if (!wsUrl.includes("/realtime")) {
-        wsUrl = wsUrl.replace(/\/$/, "") + "/realtime";
-      }
-      this.socket = io(wsUrl, {
-        auth: { token },
-        transports: ["websocket", "polling"],
-        reconnection: true,
-        reconnectionAttempts: 5,
-        reconnectionDelay: 1e3
-      });
-      this.socket.on("connect", () => {
-        this.connected = true;
-        console.log("[ExGuard] Realtime connected to", wsUrl);
-        this.events.onConnect?.();
-        this.socket.emit("subscribe:permissions");
-      });
-      this.socket.on("disconnect", () => {
-        this.connected = false;
-        console.log("[ExGuard] Realtime disconnected");
-        this.events.onDisconnect?.();
-      });
-      this.socket.on("permission:updated", (data) => {
-        console.log("[ExGuard] Permission update received:", data);
-        if (data.userId) {
-          cache.clearUser(data.userId);
-        }
-        this.events.onPermissionUpdate?.(data);
-      });
-      this.socket.on("user:updated", (data) => {
-        console.log("[ExGuard] User update received:", data);
-        if (data.userId) {
-          cache.clearUser(data.userId);
-        }
-        this.events.onUserUpdate?.(data);
-      });
-      this.socket.on("role:updated", (data) => {
-        console.log("[ExGuard] Role update received:", data);
-        if (data.userId) {
-          cache.clearUser(data.userId);
-        }
-        this.events.onRoleUpdate?.(data);
-      });
-      this.socket.on("connect_error", (err) => {
-        console.error("[ExGuard] Realtime connection error:", err.message);
-      });
-    } catch (error) {
-      console.error("[ExGuard] Failed to load socket.io-client:", error);
-    }
-  }
-  disconnect() {
-    if (this.socket) {
-      this.socket.disconnect();
-      this.socket = null;
-      this.connected = false;
-    }
-  }
-  isConnected() {
-    return this.connected;
-  }
-  emit(event, data) {
-    if (this.socket && this.connected) {
-      this.socket.emit(event, data);
-    }
-  }
-};
-var realtime = new ExGuardRealtime();
-var ExGuardClient = class {
-  constructor(config) {
-    this.baseUrl = config.baseUrl;
-    this.cache = cache;
-    this.realtime = realtime;
-    if (config.realtime?.enabled && config.realtime?.url) {
-      this.realtime.connect(config.realtime.url);
-    }
-  }
-  async authenticate(context) {
-    const cacheKey = `auth:${context.token}`;
-    const cached = this.cache.get(cacheKey);
-    if (cached) return cached;
-    try {
-      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Authorization": `Bearer ${context.token}`
-        },
-        body: JSON.stringify({ id_token: context.token })
-      });
-      if (!verifyResponse.ok) {
-        const errorData = await verifyResponse.json().catch(() => ({}));
-        return { allowed: false, error: errorData.message || "Invalid token" };
-      }
-      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {
-        method: "GET",
-        headers: {
-          "Authorization": `Bearer ${context.token}`
-        }
-      });
-      if (!meResponse.ok) {
-        return { allowed: false, error: "Failed to get user access" };
-      }
-      const meData = await meResponse.json();
-      const result = {
-        allowed: true,
-        user: meData.data || meData
-      };
-      this.cache.set(cacheKey, result);
-      if (this.realtime && !this.realtime.isConnected()) {
-        const realtimeUrl = this.baseUrl.replace(/^http/, "ws");
-        this.realtime.connect(realtimeUrl, context.token);
-      }
-      return result;
-    } catch (error) {
-      console.error("[ExGuard] Authentication error:", error);
-      return { allowed: false, error: "Authentication failed" };
-    }
-  }
-  async hasPermission(token, permission) {
-    const result = await this.authenticate({ token });
-    if (!result.allowed || !result.user) return false;
-    const userPermissions = result.user.modules?.flatMap((m) => m.permissions) || [];
-    return userPermissions.includes(permission);
-  }
-  clearCache() {
-    this.cache.clear();
-  }
-  disconnectRealtime() {
-    this.realtime.disconnect();
-  }
-};
-function createExGuardClient(config) {
-  return new ExGuardClient(config);
-}
-
 // src/module.ts
 var import_common = require("@nestjs/common");
 var ExGuardModule = class {
-  static forRoot(options) {
-    const client = new ExGuardClient({
-      baseUrl: options.baseUrl,
-      cache: options.cache,
-      realtime: options.realtime
-    });
+  static forRoot(optionsOrUrl) {
+    const baseUrl = typeof optionsOrUrl === "string" ? optionsOrUrl : optionsOrUrl.baseUrl;
     return {
       module: ExGuardModule,
       providers: [
         {
-          provide: "EXGUARD_CLIENT",
-          useValue: client
+          provide: "EXGUARD_BASE_URL",
+          useValue: baseUrl
         }
       ],
-      exports: ["EXGUARD_CLIENT"]
+      exports: ["EXGUARD_BASE_URL"]
     };
   }
 };
@@ -265,9 +65,23 @@ ExGuardModule = __decorateClass([
 var import_common2 = require("@nestjs/common");
 var EXGUARD_PERMISSIONS_KEY = "exguard_permissions";
 var EXGUARD_ROLES_KEY = "exguard_roles";
+var cache = /* @__PURE__ */ new Map();
+var CACHE_TTL = 5 * 60 * 1e3;
+function getCached(key) {
+  const entry = cache.get(key);
+  if (!entry) return null;
+  if (Date.now() - entry.timestamp > CACHE_TTL) {
+    cache.delete(key);
+    return null;
+  }
+  return entry.data;
+}
+function setCache(key, data) {
+  cache.set(key, { data, timestamp: Date.now() });
+}
 var ExGuardPermissionGuard = class {
-  constructor(client, reflector) {
-    this.client = client;
+  constructor(baseUrl, reflector) {
+    this.baseUrl = baseUrl;
     this.reflector = reflector;
   }
   async canActivate(context) {
@@ -276,11 +90,42 @@ var ExGuardPermissionGuard = class {
     if (!token) {
       throw new import_common2.UnauthorizedException("No token provided");
     }
-    if (!this.client) {
-      console.warn("[ExGuard] Client not configured. Access denied.");
+    if (!this.baseUrl) {
+      console.warn("[ExGuard] Base URL not configured. Access denied.");
       return false;
     }
-    const authResult = await this.client.authenticate({ token, request });
+    const cacheKey = `auth:${token}`;
+    let authResult = getCached(cacheKey);
+    if (!authResult) {
+      try {
+        const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            "Authorization": `Bearer ${token}`
+          },
+          body: JSON.stringify({ id_token: token })
+        });
+        if (!verifyResponse.ok) {
+          throw new import_common2.ForbiddenException("Invalid token");
+        }
+        const meResponse = await fetch(`${this.baseUrl}/guard/me`, {
+          method: "GET",
+          headers: {
+            "Authorization": `Bearer ${token}`
+          }
+        });
+        if (!meResponse.ok) {
+          throw new import_common2.ForbiddenException("Failed to get user access");
+        }
+        const meData = await meResponse.json();
+        authResult = { allowed: true, user: meData.data || meData };
+        setCache(cacheKey, authResult);
+      } catch (error) {
+        console.error("[ExGuard] Auth error:", error);
+        throw new import_common2.ForbiddenException("Authentication failed");
+      }
+    }
     if (!authResult.allowed) {
       throw new import_common2.ForbiddenException(authResult.error || "Access denied");
     }
@@ -288,13 +133,10 @@ var ExGuardPermissionGuard = class {
       throw new import_common2.ForbiddenException("User not found");
     }
     const handler = context.getHandler();
-    const permMeta = this.reflector.get(
-      EXGUARD_PERMISSIONS_KEY,
-      handler
-    );
+    const permMeta = this.reflector.get(EXGUARD_PERMISSIONS_KEY, handler);
     if (permMeta) {
       const { permissions, requireAll } = permMeta;
-      const userPermissions = authResult.user.modules?.flatMap((m) => m.permissions) || [];
+      const userPermissions = authResult.user.modules ? authResult.user.modules.flatMap((m) => m.permissions) : [];
       if (requireAll) {
         if (!permissions.every((p) => userPermissions.includes(p))) {
           throw new import_common2.ForbiddenException("Insufficient permissions");
@@ -305,10 +147,7 @@ var ExGuardPermissionGuard = class {
         }
       }
     }
-    const roleMeta = this.reflector.get(
-      EXGUARD_ROLES_KEY,
-      handler
-    );
+    const roleMeta = this.reflector.get(EXGUARD_ROLES_KEY, handler);
     if (roleMeta) {
       const { roles, requireAll } = roleMeta;
       const userRoles = authResult.user.roles || [];
@@ -336,7 +175,7 @@ var ExGuardPermissionGuard = class {
 ExGuardPermissionGuard = __decorateClass([
   (0, import_common2.Injectable)(),
   __decorateParam(0, (0, import_common2.Optional)()),
-  __decorateParam(0, (0, import_common2.Inject)("EXGUARD_CLIENT"))
+  __decorateParam(0, (0, import_common2.Inject)("EXGUARD_BASE_URL"))
 ], ExGuardPermissionGuard);
 function RequirePermissions(permissions, requireAll = false) {
   return function(target, propertyKey, descriptor) {
@@ -350,17 +189,17 @@ function RequireRoles(roles, requireAll = false) {
     return descriptor;
   };
 }
+function clearExGuardCache() {
+  cache.clear();
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   EXGUARD_PERMISSIONS_KEY,
   EXGUARD_ROLES_KEY,
-  ExGuardClient,
   ExGuardModule,
   ExGuardPermissionGuard,
   RequirePermissions,
   RequireRoles,
-  cache,
-  createExGuardClient,
-  realtime
+  clearExGuardCache
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/client.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export { ExGuardClient, createExGuardClient, cache, realtime } from './client.js';\nexport type { ExGuardConfig, User, ModulePermission, UserAccessResponse, GuardContext, GuardResult, RealtimeEvents } from './client.js';\nexport { ExGuardModule } from './module.js';\nexport type { ExGuardModuleOptions } from './module.js';\nexport { ExGuardPermissionGuard, RequirePermissions, RequireRoles, EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY } from './guard.js';\n","export interface ExGuardConfig {\n  baseUrl: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\nexport interface User {\n  id: string;\n  cognitoSubId: string;\n  username: string;\n  email: string;\n  emailVerified: boolean;\n  givenName: string;\n  familyName: string;\n  employeeNumber: string;\n  regionId: string;\n  createdAt: string;\n  updatedAt: string;\n  lastLoginAt: string;\n  fieldOffice: {\n    id: string;\n    code: string;\n    name: string;\n  };\n}\n\nexport interface ModulePermission {\n  key: string;\n  name: string;\n  permissions: string[];\n}\n\nexport interface UserAccessResponse {\n  user: User;\n  groups: string[];\n  roles: string[];\n  modules: ModulePermission[];\n  fieldOffices: string[];\n}\n\nexport interface GuardContext {\n  token: string;\n  request?: any;\n}\n\nexport interface GuardResult {\n  allowed: boolean;\n  user?: UserAccessResponse;\n  error?: string;\n}\n\nexport interface RealtimeEvents {\n  onConnect?: () => void;\n  onDisconnect?: () => void;\n  onPermissionUpdate?: (data: { userId: string; permissions: string[] }) => void;\n  onUserUpdate?: (data: { userId: string; user: UserAccessResponse }) => void;\n  onRoleUpdate?: (data: { userId: string; roles: string[] }) => void;\n}\n\nclass ExGuardCache {\n  private cache = new Map<string, { data: any; timestamp: number; ttl: number }>();\n  private ttl = 300000;\n\n  get(key: string): any {\n    const entry = this.cache.get(key);\n    if (!entry) return null;\n    if (Date.now() - entry.timestamp > entry.ttl) {\n      this.cache.delete(key);\n      return null;\n    }\n    return entry.data;\n  }\n\n  set(key: string, data: any, ttl?: number): void {\n    this.cache.set(key, {\n      data,\n      timestamp: Date.now(),\n      ttl: ttl || this.ttl,\n    });\n  }\n\n  delete(key: string): void {\n    this.cache.delete(key);\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  clearUser(userId: string): void {\n    for (const key of this.cache.keys()) {\n      if (key.includes(userId)) {\n        this.cache.delete(key);\n      }\n    }\n  }\n}\n\nconst cache = new ExGuardCache();\n\nclass ExGuardRealtime {\n  private socket: any = null;\n  private connected = false;\n  private url: string = '';\n  private events: RealtimeEvents = {};\n\n  connect(url: string, token?: string, events: RealtimeEvents = {}): void {\n    this.url = url;\n    this.events = events;\n    \n    if (!url) {\n      console.log('[ExGuard] Realtime URL not provided, skipping connection');\n      return;\n    }\n\n    try {\n      const { io } = require('socket.io-client');\n      \n      // Convert http(s) to ws(s) if needed\n      let wsUrl = url;\n      if (url.startsWith('http://')) {\n        wsUrl = url.replace('http://', 'ws://');\n      } else if (url.startsWith('https://')) {\n        wsUrl = url.replace('https://', 'wss://');\n      }\n      \n      // Add namespace\n      if (!wsUrl.includes('/realtime')) {\n        wsUrl = wsUrl.replace(/\\/$/, '') + '/realtime';\n      }\n\n      this.socket = io(wsUrl, {\n        auth: { token },\n        transports: ['websocket', 'polling'],\n        reconnection: true,\n        reconnectionAttempts: 5,\n        reconnectionDelay: 1000,\n      });\n\n      this.socket.on('connect', () => {\n        this.connected = true;\n        console.log('[ExGuard] Realtime connected to', wsUrl);\n        this.events.onConnect?.();\n        \n        // Subscribe to permission updates\n        this.socket.emit('subscribe:permissions');\n      });\n\n      this.socket.on('disconnect', () => {\n        this.connected = false;\n        console.log('[ExGuard] Realtime disconnected');\n        this.events.onDisconnect?.();\n      });\n\n      // Listen for permission updates\n      this.socket.on('permission:updated', (data: any) => {\n        console.log('[ExGuard] Permission update received:', data);\n        if (data.userId) {\n          cache.clearUser(data.userId);\n        }\n        this.events.onPermissionUpdate?.(data);\n      });\n\n      this.socket.on('user:updated', (data: any) => {\n        console.log('[ExGuard] User update received:', data);\n        if (data.userId) {\n          cache.clearUser(data.userId);\n        }\n        this.events.onUserUpdate?.(data);\n      });\n\n      this.socket.on('role:updated', (data: any) => {\n        console.log('[ExGuard] Role update received:', data);\n        if (data.userId) {\n          cache.clearUser(data.userId);\n        }\n        this.events.onRoleUpdate?.(data);\n      });\n\n      this.socket.on('connect_error', (err: any) => {\n        console.error('[ExGuard] Realtime connection error:', err.message);\n      });\n    } catch (error) {\n      console.error('[ExGuard] Failed to load socket.io-client:', error);\n    }\n  }\n\n  disconnect(): void {\n    if (this.socket) {\n      this.socket.disconnect();\n      this.socket = null;\n      this.connected = false;\n    }\n  }\n\n  isConnected(): boolean {\n    return this.connected;\n  }\n\n  emit(event: string, data: any): void {\n    if (this.socket && this.connected) {\n      this.socket.emit(event, data);\n    }\n  }\n}\n\nconst realtime = new ExGuardRealtime();\n\nexport class ExGuardClient {\n  private baseUrl: string;\n  private cache: ExGuardCache;\n  private realtime: ExGuardRealtime;\n\n  constructor(config: ExGuardConfig) {\n    this.baseUrl = config.baseUrl;\n    this.cache = cache;\n    this.realtime = realtime;\n\n    if (config.realtime?.enabled && config.realtime?.url) {\n      this.realtime.connect(config.realtime.url);\n    }\n  }\n\n  async authenticate(context: GuardContext): Promise<GuardResult> {\n    const cacheKey = `auth:${context.token}`;\n    const cached = this.cache.get(cacheKey);\n    if (cached) return cached;\n\n    try {\n      // First verify the token\n      const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n          'Authorization': `Bearer ${context.token}`,\n        },\n        body: JSON.stringify({ id_token: context.token }),\n      });\n\n      if (!verifyResponse.ok) {\n        const errorData = await verifyResponse.json().catch(() => ({}));\n        return { allowed: false, error: errorData.message || 'Invalid token' };\n      }\n\n      // Then get user access info\n      const meResponse = await fetch(`${this.baseUrl}/guard/me`, {\n        method: 'GET',\n        headers: {\n          'Authorization': `Bearer ${context.token}`,\n        },\n      });\n\n      if (!meResponse.ok) {\n        return { allowed: false, error: 'Failed to get user access' };\n      }\n\n      const meData = await meResponse.json();\n      \n      const result: GuardResult = {\n        allowed: true,\n        user: meData.data || meData,\n      };\n\n      this.cache.set(cacheKey, result);\n      \n      // Connect to realtime with token\n      if (this.realtime && !this.realtime.isConnected()) {\n        const realtimeUrl = this.baseUrl.replace(/^http/, 'ws');\n        this.realtime.connect(realtimeUrl, context.token);\n      }\n      \n      return result;\n    } catch (error) {\n      console.error('[ExGuard] Authentication error:', error);\n      return { allowed: false, error: 'Authentication failed' };\n    }\n  }\n\n  async hasPermission(token: string, permission: string): Promise<boolean> {\n    const result = await this.authenticate({ token });\n    if (!result.allowed || !result.user) return false;\n\n    const userPermissions = result.user.modules?.flatMap(m => m.permissions) || [];\n    return userPermissions.includes(permission);\n  }\n\n  clearCache(): void {\n    this.cache.clear();\n  }\n\n  disconnectRealtime(): void {\n    this.realtime.disconnect();\n  }\n}\n\nexport function createExGuardClient(config: ExGuardConfig): ExGuardClient {\n  return new ExGuardClient(config);\n}\n\nexport { cache, realtime };\n","import { Module, Global, DynamicModule } from '@nestjs/common';\nimport { ExGuardClient } from './client.js';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n  cache?: {\n    enabled?: boolean;\n    ttl?: number;\n  };\n  realtime?: {\n    enabled?: boolean;\n    url?: string;\n  };\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule {\n    const client = new ExGuardClient({\n      baseUrl: options.baseUrl,\n      cache: options.cache,\n      realtime: options.realtime,\n    });\n\n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_CLIENT',\n          useValue: client,\n        },\n      ],\n      exports: ['EXGUARD_CLIENT'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport { ExGuardClient } from './client.js';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_CLIENT') private client: ExGuardClient,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.client) {\n      console.warn('[ExGuard] Client not configured. Access denied.');\n      return false;\n    }\n\n    const authResult = await this.client.authenticate({ token, request });\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(\n      EXGUARD_PERMISSIONS_KEY,\n      handler,\n    );\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];\n\n      if (requireAll) {\n        if (!permissions.every(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some(p => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(\n      EXGUARD_ROLES_KEY,\n      handler,\n    );\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some(r => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiEA,IAAM,eAAN,MAAmB;AAAA,EAAnB;AACE,SAAQ,QAAQ,oBAAI,IAA2D;AAC/E,SAAQ,MAAM;AAAA;AAAA,EAEd,IAAI,KAAkB;AACpB,UAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;AAChC,QAAI,CAAC,MAAO,QAAO;AACnB,QAAI,KAAK,IAAI,IAAI,MAAM,YAAY,MAAM,KAAK;AAC5C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,KAAa,MAAW,KAAoB;AAC9C,SAAK,MAAM,IAAI,KAAK;AAAA,MAClB;AAAA,MACA,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,OAAO,KAAK;AAAA,IACnB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,KAAmB;AACxB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,UAAU,QAAsB;AAC9B,eAAW,OAAO,KAAK,MAAM,KAAK,GAAG;AACnC,UAAI,IAAI,SAAS,MAAM,GAAG;AACxB,aAAK,MAAM,OAAO,GAAG;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,QAAQ,IAAI,aAAa;AAE/B,IAAM,kBAAN,MAAsB;AAAA,EAAtB;AACE,SAAQ,SAAc;AACtB,SAAQ,YAAY;AACpB,SAAQ,MAAc;AACtB,SAAQ,SAAyB,CAAC;AAAA;AAAA,EAElC,QAAQ,KAAa,OAAgB,SAAyB,CAAC,GAAS;AACtE,SAAK,MAAM;AACX,SAAK,SAAS;AAEd,QAAI,CAAC,KAAK;AACR,cAAQ,IAAI,0DAA0D;AACtE;AAAA,IACF;AAEA,QAAI;AACF,YAAM,EAAE,GAAG,IAAI,QAAQ,kBAAkB;AAGzC,UAAI,QAAQ;AACZ,UAAI,IAAI,WAAW,SAAS,GAAG;AAC7B,gBAAQ,IAAI,QAAQ,WAAW,OAAO;AAAA,MACxC,WAAW,IAAI,WAAW,UAAU,GAAG;AACrC,gBAAQ,IAAI,QAAQ,YAAY,QAAQ;AAAA,MAC1C;AAGA,UAAI,CAAC,MAAM,SAAS,WAAW,GAAG;AAChC,gBAAQ,MAAM,QAAQ,OAAO,EAAE,IAAI;AAAA,MACrC;AAEA,WAAK,SAAS,GAAG,OAAO;AAAA,QACtB,MAAM,EAAE,MAAM;AAAA,QACd,YAAY,CAAC,aAAa,SAAS;AAAA,QACnC,cAAc;AAAA,QACd,sBAAsB;AAAA,QACtB,mBAAmB;AAAA,MACrB,CAAC;AAED,WAAK,OAAO,GAAG,WAAW,MAAM;AAC9B,aAAK,YAAY;AACjB,gBAAQ,IAAI,mCAAmC,KAAK;AACpD,aAAK,OAAO,YAAY;AAGxB,aAAK,OAAO,KAAK,uBAAuB;AAAA,MAC1C,CAAC;AAED,WAAK,OAAO,GAAG,cAAc,MAAM;AACjC,aAAK,YAAY;AACjB,gBAAQ,IAAI,iCAAiC;AAC7C,aAAK,OAAO,eAAe;AAAA,MAC7B,CAAC;AAGD,WAAK,OAAO,GAAG,sBAAsB,CAAC,SAAc;AAClD,gBAAQ,IAAI,yCAAyC,IAAI;AACzD,YAAI,KAAK,QAAQ;AACf,gBAAM,UAAU,KAAK,MAAM;AAAA,QAC7B;AACA,aAAK,OAAO,qBAAqB,IAAI;AAAA,MACvC,CAAC;AAED,WAAK,OAAO,GAAG,gBAAgB,CAAC,SAAc;AAC5C,gBAAQ,IAAI,mCAAmC,IAAI;AACnD,YAAI,KAAK,QAAQ;AACf,gBAAM,UAAU,KAAK,MAAM;AAAA,QAC7B;AACA,aAAK,OAAO,eAAe,IAAI;AAAA,MACjC,CAAC;AAED,WAAK,OAAO,GAAG,gBAAgB,CAAC,SAAc;AAC5C,gBAAQ,IAAI,mCAAmC,IAAI;AACnD,YAAI,KAAK,QAAQ;AACf,gBAAM,UAAU,KAAK,MAAM;AAAA,QAC7B;AACA,aAAK,OAAO,eAAe,IAAI;AAAA,MACjC,CAAC;AAED,WAAK,OAAO,GAAG,iBAAiB,CAAC,QAAa;AAC5C,gBAAQ,MAAM,wCAAwC,IAAI,OAAO;AAAA,MACnE,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,8CAA8C,KAAK;AAAA,IACnE;AAAA,EACF;AAAA,EAEA,aAAmB;AACjB,QAAI,KAAK,QAAQ;AACf,WAAK,OAAO,WAAW;AACvB,WAAK,SAAS;AACd,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,cAAuB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,KAAK,OAAe,MAAiB;AACnC,QAAI,KAAK,UAAU,KAAK,WAAW;AACjC,WAAK,OAAO,KAAK,OAAO,IAAI;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,IAAM,WAAW,IAAI,gBAAgB;AAE9B,IAAM,gBAAN,MAAoB;AAAA,EAKzB,YAAY,QAAuB;AACjC,SAAK,UAAU,OAAO;AACtB,SAAK,QAAQ;AACb,SAAK,WAAW;AAEhB,QAAI,OAAO,UAAU,WAAW,OAAO,UAAU,KAAK;AACpD,WAAK,SAAS,QAAQ,OAAO,SAAS,GAAG;AAAA,IAC3C;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,SAA6C;AAC9D,UAAM,WAAW,QAAQ,QAAQ,KAAK;AACtC,UAAM,SAAS,KAAK,MAAM,IAAI,QAAQ;AACtC,QAAI,OAAQ,QAAO;AAEnB,QAAI;AAEF,YAAM,iBAAiB,MAAM,MAAM,GAAG,KAAK,OAAO,uBAAuB;AAAA,QACvE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,QACA,MAAM,KAAK,UAAU,EAAE,UAAU,QAAQ,MAAM,CAAC;AAAA,MAClD,CAAC;AAED,UAAI,CAAC,eAAe,IAAI;AACtB,cAAM,YAAY,MAAM,eAAe,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9D,eAAO,EAAE,SAAS,OAAO,OAAO,UAAU,WAAW,gBAAgB;AAAA,MACvE;AAGA,YAAM,aAAa,MAAM,MAAM,GAAG,KAAK,OAAO,aAAa;AAAA,QACzD,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,iBAAiB,UAAU,QAAQ,KAAK;AAAA,QAC1C;AAAA,MACF,CAAC;AAED,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO,EAAE,SAAS,OAAO,OAAO,4BAA4B;AAAA,MAC9D;AAEA,YAAM,SAAS,MAAM,WAAW,KAAK;AAErC,YAAM,SAAsB;AAAA,QAC1B,SAAS;AAAA,QACT,MAAM,OAAO,QAAQ;AAAA,MACvB;AAEA,WAAK,MAAM,IAAI,UAAU,MAAM;AAG/B,UAAI,KAAK,YAAY,CAAC,KAAK,SAAS,YAAY,GAAG;AACjD,cAAM,cAAc,KAAK,QAAQ,QAAQ,SAAS,IAAI;AACtD,aAAK,SAAS,QAAQ,aAAa,QAAQ,KAAK;AAAA,MAClD;AAEA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,mCAAmC,KAAK;AACtD,aAAO,EAAE,SAAS,OAAO,OAAO,wBAAwB;AAAA,IAC1D;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,OAAe,YAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,aAAa,EAAE,MAAM,CAAC;AAChD,QAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAM,QAAO;AAE5C,UAAM,kBAAkB,OAAO,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAC7E,WAAO,gBAAgB,SAAS,UAAU;AAAA,EAC5C;AAAA,EAEA,aAAmB;AACjB,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,qBAA2B;AACzB,SAAK,SAAS,WAAW;AAAA,EAC3B;AACF;AAEO,SAAS,oBAAoB,QAAsC;AACxE,SAAO,IAAI,cAAc,MAAM;AACjC;;;AC/SA,oBAA8C;AAiBvC,IAAM,gBAAN,MAAoB;AAAA,EACzB,OAAO,QAAQ,SAA8C;AAC3D,UAAM,SAAS,IAAI,cAAc;AAAA,MAC/B,SAAS,QAAQ;AAAA,MACjB,OAAO,QAAQ;AAAA,MACf,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,gBAAgB;AAAA,IAC5B;AAAA,EACF;AACF;AAnBa,gBAAN;AAAA,MAFN,sBAAO;AAAA,MACP,sBAAO,CAAC,CAAC;AAAA,GACG;;;ACjBb,IAAAA,iBAAuH;AAIhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAG1B,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACgD,QACtC,WACR;AAF8C;AACtC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,qCAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,cAAQ,KAAK,iDAAiD;AAC9D,aAAO;AAAA,IACT;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO,aAAa,EAAE,OAAO,QAAQ,CAAC;AAEpE,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,kCAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,kCAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,SAAS,QAAQ,OAAK,EAAE,WAAW,KAAK,CAAC;AAEjF,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACxD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,OAAK,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACvD,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU;AAAA,MAC9B;AAAA,MACA;AAAA,IACF;AAEA,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC5C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,OAAK,UAAU,SAAS,CAAC,CAAC,GAAG;AAC3C,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AAjFa,yBAAN;AAAA,MADN,2BAAW;AAAA,EAGP,gDAAS;AAAA,EAAG,8CAAO,gBAAgB;AAAA,GAF3B;AAmFN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;","names":["import_common"]}
+{"version":3,"sources":["../src/index.ts","../src/module.ts","../src/guard.ts"],"sourcesContent":["export { ExGuardModule } from './module.js';\nexport { ExGuardPermissionGuard, RequirePermissions, RequireRoles, clearExGuardCache, EXGUARD_PERMISSIONS_KEY, EXGUARD_ROLES_KEY } from './guard.js';\n","import { Module, Global, DynamicModule } from '@nestjs/common';\n\nexport interface ExGuardModuleOptions {\n  baseUrl: string;\n}\n\n@Global()\n@Module({})\nexport class ExGuardModule {\n  static forRoot(options: ExGuardModuleOptions): DynamicModule;\n  static forRoot(baseUrl: string): DynamicModule;\n  static forRoot(optionsOrUrl: ExGuardModuleOptions | string): DynamicModule {\n    const baseUrl = typeof optionsOrUrl === 'string' ? optionsOrUrl : optionsOrUrl.baseUrl;\n    \n    return {\n      module: ExGuardModule,\n      providers: [\n        {\n          provide: 'EXGUARD_BASE_URL',\n          useValue: baseUrl,\n        },\n      ],\n      exports: ['EXGUARD_BASE_URL'],\n    };\n  }\n}\n","import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\n\nexport const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';\nexport const EXGUARD_ROLES_KEY = 'exguard_roles';\n\nconst cache = new Map<string, { data: any; timestamp: number }>();\nconst CACHE_TTL = 5 * 60 * 1000; // 5 minutes\n\nfunction getCached(key: string): any {\n  const entry = cache.get(key);\n  if (!entry) return null;\n  if (Date.now() - entry.timestamp > CACHE_TTL) {\n    cache.delete(key);\n    return null;\n  }\n  return entry.data;\n}\n\nfunction setCache(key: string, data: any): void {\n  cache.set(key, { data, timestamp: Date.now() });\n}\n\n@Injectable()\nexport class ExGuardPermissionGuard implements CanActivate {\n  constructor(\n    @Optional() @Inject('EXGUARD_BASE_URL') private baseUrl: string,\n    private reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n    const token = this.extractToken(request);\n\n    if (!token) {\n      throw new UnauthorizedException('No token provided');\n    }\n\n    if (!this.baseUrl) {\n      console.warn('[ExGuard] Base URL not configured. Access denied.');\n      return false;\n    }\n\n    // Check cache first\n    const cacheKey = `auth:${token}`;\n    let authResult = getCached(cacheKey);\n\n    if (!authResult) {\n      try {\n        // Verify token\n        const verifyResponse = await fetch(`${this.baseUrl}/guard/verify-token`, {\n          method: 'POST',\n          headers: {\n            'Content-Type': 'application/json',\n            'Authorization': `Bearer ${token}`,\n          },\n          body: JSON.stringify({ id_token: token }),\n        });\n\n        if (!verifyResponse.ok) {\n          throw new ForbiddenException('Invalid token');\n        }\n\n        // Get user access\n        const meResponse = await fetch(`${this.baseUrl}/guard/me`, {\n          method: 'GET',\n          headers: {\n            'Authorization': `Bearer ${token}`,\n          },\n        });\n\n        if (!meResponse.ok) {\n          throw new ForbiddenException('Failed to get user access');\n        }\n\n        const meData = await meResponse.json();\n        authResult = { allowed: true, user: meData.data || meData };\n        \n        // Cache the result\n        setCache(cacheKey, authResult);\n      } catch (error) {\n        console.error('[ExGuard] Auth error:', error);\n        throw new ForbiddenException('Authentication failed');\n      }\n    }\n\n    if (!authResult.allowed) {\n      throw new ForbiddenException(authResult.error || 'Access denied');\n    }\n\n    if (!authResult.user) {\n      throw new ForbiddenException('User not found');\n    }\n\n    const handler = context.getHandler();\n    const permMeta = this.reflector.get(EXGUARD_PERMISSIONS_KEY, handler);\n\n    if (permMeta) {\n      const { permissions, requireAll } = permMeta;\n      const userPermissions = authResult.user.modules ? authResult.user.modules.flatMap((m: any) => m.permissions) : [];\n\n      if (requireAll) {\n        if (!permissions.every((p: string) => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      } else {\n        if (!permissions.some((p: string) => userPermissions.includes(p))) {\n          throw new ForbiddenException('Insufficient permissions');\n        }\n      }\n    }\n\n    const roleMeta = this.reflector.get(EXGUARD_ROLES_KEY, handler);\n\n    if (roleMeta) {\n      const { roles, requireAll } = roleMeta;\n      const userRoles = authResult.user.roles || [];\n\n      if (requireAll) {\n        if (!roles.every((r: string) => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      } else {\n        if (!roles.some((r: string) => userRoles.includes(r))) {\n          throw new ForbiddenException('Insufficient roles');\n        }\n      }\n    }\n\n    request.user = authResult.user;\n    return true;\n  }\n\n  private extractToken(request: any): string | null {\n    const auth = request.headers?.authorization;\n    if (auth?.startsWith('Bearer ')) {\n      return auth.substring(7);\n    }\n    return request.headers?.['x-access-token'] || null;\n  }\n}\n\nexport function RequirePermissions(permissions: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function RequireRoles(roles: string[], requireAll = false) {\n  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {\n    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);\n    return descriptor;\n  };\n}\n\nexport function clearExGuardCache(): void {\n  cache.clear();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,oBAA8C;AAQvC,IAAM,gBAAN,MAAoB;AAAA,EAGzB,OAAO,QAAQ,cAA4D;AACzE,UAAM,UAAU,OAAO,iBAAiB,WAAW,eAAe,aAAa;AAE/E,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW;AAAA,QACT;AAAA,UACE,SAAS;AAAA,UACT,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,MACA,SAAS,CAAC,kBAAkB;AAAA,IAC9B;AAAA,EACF;AACF;AAjBa,gBAAN;AAAA,MAFN,sBAAO;AAAA,MACP,sBAAO,CAAC,CAAC;AAAA,GACG;;;ACRb,IAAAA,iBAAuH;AAGhH,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAEjC,IAAM,QAAQ,oBAAI,IAA8C;AAChE,IAAM,YAAY,IAAI,KAAK;AAE3B,SAAS,UAAU,KAAkB;AACnC,QAAM,QAAQ,MAAM,IAAI,GAAG;AAC3B,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,KAAK,IAAI,IAAI,MAAM,YAAY,WAAW;AAC5C,UAAM,OAAO,GAAG;AAChB,WAAO;AAAA,EACT;AACA,SAAO,MAAM;AACf;AAEA,SAAS,SAAS,KAAa,MAAiB;AAC9C,QAAM,IAAI,KAAK,EAAE,MAAM,WAAW,KAAK,IAAI,EAAE,CAAC;AAChD;AAGO,IAAM,yBAAN,MAAoD;AAAA,EACzD,YACkD,SACxC,WACR;AAFgD;AACxC;AAAA,EACP;AAAA,EAEH,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAa,EAAE,WAAW;AAClD,UAAM,QAAQ,KAAK,aAAa,OAAO;AAEvC,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,qCAAsB,mBAAmB;AAAA,IACrD;AAEA,QAAI,CAAC,KAAK,SAAS;AACjB,cAAQ,KAAK,mDAAmD;AAChE,aAAO;AAAA,IACT;AAGA,UAAM,WAAW,QAAQ,KAAK;AAC9B,QAAI,aAAa,UAAU,QAAQ;AAEnC,QAAI,CAAC,YAAY;AACf,UAAI;AAEF,cAAM,iBAAiB,MAAM,MAAM,GAAG,KAAK,OAAO,uBAAuB;AAAA,UACvE,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,gBAAgB;AAAA,YAChB,iBAAiB,UAAU,KAAK;AAAA,UAClC;AAAA,UACA,MAAM,KAAK,UAAU,EAAE,UAAU,MAAM,CAAC;AAAA,QAC1C,CAAC;AAED,YAAI,CAAC,eAAe,IAAI;AACtB,gBAAM,IAAI,kCAAmB,eAAe;AAAA,QAC9C;AAGA,cAAM,aAAa,MAAM,MAAM,GAAG,KAAK,OAAO,aAAa;AAAA,UACzD,QAAQ;AAAA,UACR,SAAS;AAAA,YACP,iBAAiB,UAAU,KAAK;AAAA,UAClC;AAAA,QACF,CAAC;AAED,YAAI,CAAC,WAAW,IAAI;AAClB,gBAAM,IAAI,kCAAmB,2BAA2B;AAAA,QAC1D;AAEA,cAAM,SAAS,MAAM,WAAW,KAAK;AACrC,qBAAa,EAAE,SAAS,MAAM,MAAM,OAAO,QAAQ,OAAO;AAG1D,iBAAS,UAAU,UAAU;AAAA,MAC/B,SAAS,OAAO;AACd,gBAAQ,MAAM,yBAAyB,KAAK;AAC5C,cAAM,IAAI,kCAAmB,uBAAuB;AAAA,MACtD;AAAA,IACF;AAEA,QAAI,CAAC,WAAW,SAAS;AACvB,YAAM,IAAI,kCAAmB,WAAW,SAAS,eAAe;AAAA,IAClE;AAEA,QAAI,CAAC,WAAW,MAAM;AACpB,YAAM,IAAI,kCAAmB,gBAAgB;AAAA,IAC/C;AAEA,UAAM,UAAU,QAAQ,WAAW;AACnC,UAAM,WAAW,KAAK,UAAU,IAAI,yBAAyB,OAAO;AAEpE,QAAI,UAAU;AACZ,YAAM,EAAE,aAAa,WAAW,IAAI;AACpC,YAAM,kBAAkB,WAAW,KAAK,UAAU,WAAW,KAAK,QAAQ,QAAQ,CAAC,MAAW,EAAE,WAAW,IAAI,CAAC;AAEhH,UAAI,YAAY;AACd,YAAI,CAAC,YAAY,MAAM,CAAC,MAAc,gBAAgB,SAAS,CAAC,CAAC,GAAG;AAClE,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,YAAY,KAAK,CAAC,MAAc,gBAAgB,SAAS,CAAC,CAAC,GAAG;AACjE,gBAAM,IAAI,kCAAmB,0BAA0B;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,KAAK,UAAU,IAAI,mBAAmB,OAAO;AAE9D,QAAI,UAAU;AACZ,YAAM,EAAE,OAAO,WAAW,IAAI;AAC9B,YAAM,YAAY,WAAW,KAAK,SAAS,CAAC;AAE5C,UAAI,YAAY;AACd,YAAI,CAAC,MAAM,MAAM,CAAC,MAAc,UAAU,SAAS,CAAC,CAAC,GAAG;AACtD,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF,OAAO;AACL,YAAI,CAAC,MAAM,KAAK,CAAC,MAAc,UAAU,SAAS,CAAC,CAAC,GAAG;AACrD,gBAAM,IAAI,kCAAmB,oBAAoB;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,OAAO,WAAW;AAC1B,WAAO;AAAA,EACT;AAAA,EAEQ,aAAa,SAA6B;AAChD,UAAM,OAAO,QAAQ,SAAS;AAC9B,QAAI,MAAM,WAAW,SAAS,GAAG;AAC/B,aAAO,KAAK,UAAU,CAAC;AAAA,IACzB;AACA,WAAO,QAAQ,UAAU,gBAAgB,KAAK;AAAA,EAChD;AACF;AApHa,yBAAN;AAAA,MADN,2BAAW;AAAA,EAGP,gDAAS;AAAA,EAAG,8CAAO,kBAAkB;AAAA,GAF7B;AAsHN,SAAS,mBAAmB,aAAuB,aAAa,OAAO;AAC5E,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,yBAAyB,EAAE,aAAa,WAAW,GAAG,WAAW,KAAK;AAC7F,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,OAAiB,aAAa,OAAO;AAChE,SAAO,SAAU,QAAa,aAAqB,YAAgC;AACjF,YAAQ,eAAe,mBAAmB,EAAE,OAAO,WAAW,GAAG,WAAW,KAAK;AACjF,WAAO;AAAA,EACT;AACF;AAEO,SAAS,oBAA0B;AACxC,QAAM,MAAM;AACd;","names":["import_common"]}