# @loma-portal/em-auth

JWT **verification** (not issuance). The .NET API issues tokens; every Node-side consumer (api-nest, worker-nest, BFFs) verifies them via this module.

## Usage

```ts
import { EmAuthModule, Public } from '@loma-portal/em-auth';

@Module({
  imports: [
    EmAuthModule.forRoot({
      jwt: {
        accessSecret: process.env.JWT_ACCESS_SECRET!,
        issuer: 'loma-portal',
        audience: 'loma-portal',
      },
    }),
  ],
})
export class AppModule {}

// Opt a route out of auth:
@Public()
@Get('public-status')
status() { return { ok: true } }
```

## Surface

| Symbol                 | Purpose                                                 |
| ---------------------- | ------------------------------------------------------- |
| `EmAuthModule.forRoot` | Registers verifier + global `JwtAuthGuard`              |
| `JwtVerifierService`   | `verify(token) → AuthClaims` (jose under the hood)      |
| `JwtAuthGuard`         | Extracts `Authorization: Bearer …`, attaches `req.user` |
| `@Public()`            | Mark a route as not requiring a token                   |
| `AuthClaims` interface | `{ userId, email?, tenantId?, roles, permissions }`     |

Claim names match what `dotnet/src/Infrastructure/Auth/JwtService.cs` issues: `sub`, `email`, `tenant_id`, `role` (one claim per role), `perm` (one claim per permission code).
