@ackplus/nest-auth 0.1.51 → 1.1.0

package/src/lib/auth/services/client-config.service.ts

@@ -0,0 +1,157 @@
+import { Injectable } from '@nestjs/common';
+import { AuthConfigService } from '../../core/services/auth-config.service';
+import { TenantService } from '../../tenant/services/tenant.service';
+import { ClientConfigResponseDto } from '../dto/responses/client-config.response.dto';
+
+@Injectable()
+export class ClientConfigService {
+    constructor(
+        private readonly authConfig: AuthConfigService,
+        private readonly tenantService: TenantService,
+    ) { }
+
+    async getClientConfig(): Promise<ClientConfigResponseDto> {
+        const config = this.authConfig.getConfig();
+        const tenants = await this.fetchTenants();
+        const defaultTenantId = await this.resolveDefaultTenantId(config.defaultTenant);
+
+        // Build SSO providers
+        const ssoProviders = [];
+        if (config.google) {
+            const googleAuthUrl = new URL('https://accounts.google.com/o/oauth2/v2/auth');
+            googleAuthUrl.searchParams.set('client_id', config.google.clientId);
+            googleAuthUrl.searchParams.set('redirect_uri', config.google.redirectUri);
+            googleAuthUrl.searchParams.set('response_type', 'code');
+            googleAuthUrl.searchParams.set('scope', 'openid email profile');
+            googleAuthUrl.searchParams.set('access_type', 'offline');
+            googleAuthUrl.searchParams.set('prompt', 'consent');
+
+            ssoProviders.push({
+                id: 'google',
+                name: 'Google',
+                logoUrl: 'https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg',
+                hint: 'Sign in with Google',
+                clientId: config.google.clientId,
+                authorizationUrl: googleAuthUrl.toString(),
+            });
+        }
+        if (config.facebook) {
+            const facebookAuthUrl = new URL('https://www.facebook.com/v18.0/dialog/oauth');
+            facebookAuthUrl.searchParams.set('client_id', config.facebook.appId);
+            facebookAuthUrl.searchParams.set('redirect_uri', config.facebook.redirectUri);
+            facebookAuthUrl.searchParams.set('scope', 'email');
+            facebookAuthUrl.searchParams.set('response_type', 'code');
+
+            ssoProviders.push({
+                id: 'facebook',
+                name: 'Facebook',
+                logoUrl: 'https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/facebook.svg',
+                hint: 'Sign in with Facebook',
+                clientId: config.facebook.appId,
+                authorizationUrl: facebookAuthUrl.toString(),
+            });
+        }
+        if (config.apple) {
+            ssoProviders.push({
+                id: 'apple',
+                name: 'Apple',
+                logoUrl: undefined,
+                hint: 'Sign in with Apple',
+            });
+        }
+        if (config.github) {
+            const githubAuthUrl = new URL('https://github.com/login/oauth/authorize');
+            githubAuthUrl.searchParams.set('client_id', config.github.clientId);
+            githubAuthUrl.searchParams.set('redirect_uri', config.github.redirectUri);
+            githubAuthUrl.searchParams.set('scope', 'user:email');
+            githubAuthUrl.searchParams.set('response_type', 'code');
+
+            ssoProviders.push({
+                id: 'github',
+                name: 'GitHub',
+                logoUrl: 'https://github.githubassets.com/images/modules/logos_page/GitHub-Mark.png',
+                hint: 'Sign in with GitHub',
+                clientId: config.github.clientId,
+                authorizationUrl: githubAuthUrl.toString(),
+            });
+        }
+
+        // Build default config
+        const defaultConfig: ClientConfigResponseDto = {
+            emailAuth: {
+                enabled: config.emailAuth?.enabled ?? false,
+            },
+            phoneAuth: {
+                enabled: config.phoneAuth?.enabled ?? false,
+            },
+            registration: {
+                enabled: config.registration?.enabled !== false, // Default to true unless explicitly disabled
+                requireInvitation: config.registration?.requireInvitation ?? false,
+                collectProfileFields: config.registration?.collectProfileFields,
+            },
+            mfa: {
+                enabled: config.mfa?.enabled ?? false,
+                methods: config.mfa?.methods?.map((m) => m.toString()) ?? [],
+                allowUserToggle: config.mfa?.allowUserToggle ?? true,
+                allowMethodSelection: config.mfa?.allowMethodSelection ?? true,
+            },
+            tenants: {
+                mode: config.defaultTenant ? 'single' : 'multi',
+                defaultTenantId,
+                options: tenants,
+            },
+            sso: {
+                enabled: Boolean(config.google || config.facebook || config.apple || config.github),
+                providers: ssoProviders,
+            },
+        };
+
+        // Allow customization via factory function
+        if (config.clientConfig?.factory) {
+            const customized = await config.clientConfig.factory(defaultConfig, {
+                configService: this.authConfig,
+                tenantService: this.tenantService,
+            });
+            return customized ?? defaultConfig;
+        }
+
+        return defaultConfig;
+    }
+
+    private async fetchTenants(): Promise<Array<{ id: string; name: string; slug: string; isActive: boolean; metadata?: Record<string, any> }>> {
+        try {
+            const tenants = await this.tenantService.getTenants({
+                select: ['id', 'name', 'slug', 'metadata', 'isActive'],
+                order: { name: 'ASC' },
+            });
+
+            return tenants.map((tenant) => ({
+                id: tenant.id,
+                name: tenant.name,
+                slug: tenant.slug,
+                metadata: tenant.metadata ?? {},
+                isActive: tenant.isActive,
+            }));
+        } catch (error) {
+            // Return empty array if tenant service fails (e.g., in single-tenant mode)
+            return [];
+        }
+    }
+
+    private async resolveDefaultTenantId(
+        options?: { slug?: string; domain?: string },
+    ): Promise<string | null> {
+        if (!options?.slug && !options?.domain) {
+            return null;
+        }
+
+        try {
+            const tenant = options.slug
+                ? await this.tenantService.getTenantBySlug(options.slug)
+                : await this.tenantService.getTenantByDomain(options.domain!);
+            return tenant?.id ?? null;
+        } catch (error) {
+            return null;
+        }
+    }
+}

package/src/lib/auth/services/cookie.service.ts

@@ -0,0 +1,43 @@
+import { Injectable } from '@nestjs/common';
+import { Response } from 'express';
+import { ACCESS_TOKEN_COOKIE_NAME, REFRESH_TOKEN_COOKIE_NAME } from '../../auth.constants';
+import { AuthModuleOptions } from '../../core/interfaces/auth-module-options.interface';
+import ms from 'ms';
+import { AuthConfigService } from '../../core/services/auth-config.service';
+
+@Injectable()
+export class CookieService {
+    private options: AuthModuleOptions;
+
+    constructor() {
+        this.options = AuthConfigService.getOptions();
+    }
+
+    setAccessTokenCookie(response: Response, token: string): void {
+        response.cookie(ACCESS_TOKEN_COOKIE_NAME, token, {
+            httpOnly: true,
+            secure: this.options.cookieOptions.secure,
+            sameSite: this.options.cookieOptions.sameSite,
+            maxAge: ms(this.options.session.sessionExpiry),
+        });
+    }
+
+    setRefreshTokenCookie(response: Response, token: string): void {
+        response.cookie(REFRESH_TOKEN_COOKIE_NAME, token, {
+            httpOnly: true,
+            secure: this.options.cookieOptions.secure,
+            sameSite: this.options.cookieOptions.sameSite,
+            maxAge: ms(this.options.session.refreshTokenExpiry),
+        });
+    }
+
+    clearCookies(response: Response): void {
+        response.clearCookie(ACCESS_TOKEN_COOKIE_NAME);
+        response.clearCookie(REFRESH_TOKEN_COOKIE_NAME);
+    }
+
+    setTokens(response: Response, accessToken: string, refreshToken: string): void {
+        this.setAccessTokenCookie(response, accessToken);
+        this.setRefreshTokenCookie(response, refreshToken);
+    }
+}

package/src/lib/auth/services/mfa.service.ts

@@ -0,0 +1,391 @@
+import { ForbiddenException, Injectable, UnauthorizedException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { MoreThan, Repository } from 'typeorm';
+import { NestAuthMFASecret } from '../../auth/entities/mfa-secret.entity';
+import speakeasy from 'speakeasy';
+import qrcode from 'qrcode';
+import { MFAMethodEnum, MFAOptions } from '../../core/interfaces/mfa-options.interface';
+import { INVALID_MFA_EXCEPTION_CODE, USER_NOT_FOUND_EXCEPTION_CODE } from '../../auth.constants';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthOTP } from '../../auth/entities/otp.entity';
+import { OTPTypeEnum } from '../../core/interfaces/otp.interface';
+import { generateOtp } from '../../utils/otp';
+import ms from 'ms';
+import { AuthConfigService } from '../../core/services/auth-config.service';
+
+
+@Injectable()
+export class MfaService {
+
+    mfaConfig: MFAOptions
+
+    constructor(
+        @InjectRepository(NestAuthMFASecret)
+        private mfaSecretRepository: Repository<NestAuthMFASecret>,
+
+        @InjectRepository(NestAuthUser)
+        private userRepository: Repository<NestAuthUser>,
+
+        @InjectRepository(NestAuthOTP)
+        private otpRepository: Repository<NestAuthOTP>,
+    ) {
+        this.mfaConfig = AuthConfigService.getOptions().mfa;
+    }
+
+    requireMfaEnabledForApp(throwError: boolean = true) {
+        if (!this.mfaConfig.enabled) {
+            if (throwError) {
+                throw new ForbiddenException('MFA is not enabled for the application');
+            }
+            return false;
+        }
+        return true;
+    }
+
+    private checkIsMfaEnabledForApp(throwError: boolean = true) {
+        return this.requireMfaEnabledForApp(throwError);
+    }
+
+    async getVerifiedMethods(userId: string): Promise<MFAMethodEnum[]> {
+        if (!this.requireMfaEnabledForApp(false)) {
+            return [];
+        }
+
+        const verifiedMethods: MFAMethodEnum[] = []
+
+        // Check for verified TOTP devices
+        const verifiedTotpDevice = await this.mfaSecretRepository.findOne({
+            where: {
+                userId,
+                verified: true,
+            },
+        });
+
+        if (verifiedTotpDevice && this.mfaConfig.methods?.includes(MFAMethodEnum.TOTP)) {
+            verifiedMethods.push(MFAMethodEnum.TOTP)
+        }
+
+        // Note: EMAIL and SMS methods are always available if configured
+        // They don't require pre-verification like TOTP does
+        // But we only include them if they're in the config
+        if (this.mfaConfig.methods?.includes(MFAMethodEnum.EMAIL)) {
+            verifiedMethods.push(MFAMethodEnum.EMAIL)
+        }
+
+        if (this.mfaConfig.methods?.includes(MFAMethodEnum.SMS)) {
+            verifiedMethods.push(MFAMethodEnum.SMS)
+        }
+
+        return verifiedMethods;
+    }
+
+    async getEnabledMethods(userId: string): Promise<MFAMethodEnum[]> {
+        if (!this.requireMfaEnabledForApp(false)) {
+            return [];
+        }
+
+        const isEnabled = await this.isMfaEnabled(userId)
+        if (!isEnabled) {
+            return [];
+        }
+
+        const enableMethod = []
+
+        if (this.mfaConfig.methods?.includes(MFAMethodEnum.EMAIL)) {
+            enableMethod.push(MFAMethodEnum.EMAIL)
+        }
+
+        if (this.mfaConfig.methods?.includes(MFAMethodEnum.SMS)) {
+            enableMethod.push(MFAMethodEnum.SMS)
+        }
+
+        const verifiedTotpDevice = await this.mfaSecretRepository.findOne({
+            where: {
+                userId,
+                verified: true,
+            },
+        });
+
+        if (verifiedTotpDevice) {
+            enableMethod.push(MFAMethodEnum.TOTP)
+        }
+
+        return enableMethod;
+    }
+
+
+    async sendMfaCode(userId: string, method: MFAMethodEnum): Promise<boolean> {
+
+        this.requireMfaEnabledForApp(true)
+
+        const code = generateOtp(this.mfaConfig.otpLength);
+
+        const expiresAt = ms(this.mfaConfig.otpExpiresIn)
+
+        const otp = await this.otpRepository.create({
+            userId,
+            type: OTPTypeEnum.MFA,
+            expiresAt: new Date(Date.now() + expiresAt),
+            code,
+        })
+        await this.otpRepository.save(otp);
+
+        if (method === MFAMethodEnum.EMAIL) {
+            // TODO: Send email
+        } else if (method === MFAMethodEnum.SMS) {
+            // TODO: Send SMS
+        }
+
+        return true;
+    }
+
+    async verifyMfa(userId: string, inputOtp: string, method: MFAMethodEnum): Promise<boolean> {
+
+        this.requireMfaEnabledForApp(true)
+
+        if (method === MFAMethodEnum.TOTP) {
+            const devices = await this.mfaSecretRepository.find({
+                where: { userId, verified: true }
+            });
+
+            for (const device of devices) {
+                const isValid = speakeasy.totp.verify({
+                    secret: device.secret,
+                    encoding: 'base32',
+                    token: inputOtp,
+                    window: 1
+                });
+
+                if (isValid) {
+                    // Update last used timestamp
+                    await this.mfaSecretRepository.update(
+                        { id: device.id },
+                        { lastUsedAt: new Date() }
+                    );
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        if (method === MFAMethodEnum.EMAIL || method === MFAMethodEnum.SMS) {
+            const otp = await this.otpRepository.findOne({
+                where: {
+                    userId,
+                    type: OTPTypeEnum.MFA,
+                    used: false,
+                    expiresAt: MoreThan(new Date()),
+                    code: inputOtp
+                }
+            });
+
+            if (!otp) {
+                return false;
+            }
+            await this.otpRepository.delete(otp.id);
+            return true;
+        }
+
+        return false;
+    }
+
+
+    async setupTotpDevice(userId: string, deviceName?: string): Promise<{ secret: string; qrCode: string }> {
+        this.requireMfaEnabledForApp(true)
+
+        const user = await this.userRepository.findOne({ where: { id: userId } });
+        if (!user) {
+            throw new Error('User not found');
+        }
+
+        const secret = speakeasy.generateSecret();
+
+        await this.mfaSecretRepository.save({
+            userId,
+            secret: secret.base32,
+            deviceName: deviceName || 'Authenticator',
+            verified: false
+        });
+
+        const qrCode = await qrcode.toDataURL(secret.otpauth_url);
+        return { secret: secret.base32, qrCode };
+    }
+
+    async verifyTotpSetup(userId: string, secret: string, inputOtp: string): Promise<boolean> {
+
+        this.requireMfaEnabledForApp(true)
+
+        const device = await this.mfaSecretRepository.findOne({
+            where: { userId, secret }
+        });
+
+        if (device) {
+            if (device.verified) {
+                return true;
+            }
+
+            const isValid = speakeasy.totp.verify({
+                secret: device.secret,
+                encoding: 'base32',
+                token: inputOtp,
+                window: 1
+            });
+
+            if (isValid) {
+                await this.mfaSecretRepository.update({ id: device.id }, { verified: true });
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    async getTotpDevices(userId: string) {
+        this.requireMfaEnabledForApp(true)
+
+        const devices = await this.mfaSecretRepository.find({
+            select: ['id', 'deviceName', 'lastUsedAt', 'verified', 'createdAt'],
+            where: { userId },
+            order: { lastUsedAt: 'DESC', createdAt: 'DESC' }
+        });
+
+        return devices.map(device => ({
+            id: device.id,
+            deviceName: device.deviceName,
+            method: MFAMethodEnum.TOTP,
+            lastUsedAt: device.lastUsedAt,
+            createdAt: device.createdAt,
+            verified: device.verified,
+        }));
+    }
+
+    async removeDevice(deviceId: string): Promise<void> {
+        this.requireMfaEnabledForApp(true)
+
+        await this.mfaSecretRepository.delete({ id: deviceId });
+    }
+
+    async isRequiresMfa(userId: string): Promise<boolean> {
+        if (!this.mfaConfig.enabled) {
+            return false;
+        }
+
+        if (this.mfaConfig.required) {
+            return true;
+        }
+
+        const user = await this.userRepository.findOne({
+            select: ['id', 'isMfaEnabled'],
+            where: { id: userId },
+        });
+        return !!user?.isMfaEnabled;
+    }
+
+    async isMfaEnabled(userId: string): Promise<boolean> {
+        if (this.mfaConfig.enabled) {
+            const user = await this.userRepository.findOne({
+                select: ['id', 'isMfaEnabled'],
+                where: { id: userId },
+            });
+            return !!user?.isMfaEnabled;
+        }
+        return false;
+    }
+
+    async markAsVerified(userId: string, deviceId: string): Promise<void> {
+        this.requireMfaEnabledForApp(true)
+        await this.mfaSecretRepository.update(
+            { id: deviceId, userId },
+            { verified: true }
+        );
+    }
+
+    async enableMFA(userId: string) {
+        this.requireMfaEnabledForApp(true)
+
+        if (!this.mfaConfig.allowUserToggle) {
+            throw new Error('MFA toggling is not allowed');
+        }
+
+        const verifiedMethods = await this.getVerifiedMethods(userId);
+        if (verifiedMethods.length === 0) {
+            throw new ForbiddenException('Cannot enable MFA without at least one verified method');
+        }
+
+        await this.userRepository.update(userId, { isMfaEnabled: true });
+    }
+
+    async disableMFA(userId: string) {
+        this.checkIsMfaEnabledForApp(true);
+
+        if (!this.mfaConfig.allowUserToggle) {
+            throw new Error('MFA toggling is not allowed');
+        }
+        await this.userRepository.update(userId, { isMfaEnabled: false });
+    }
+
+    async removeTotpDevice(deviceId: string): Promise<void> {
+        this.checkIsMfaEnabledForApp(true)
+
+        await this.mfaSecretRepository.delete({ id: deviceId });
+    }
+
+    async generateRecoveryCode(userId: string): Promise<string> {
+        this.checkIsMfaEnabledForApp(true)
+
+        const secret = speakeasy.generateSecret({
+            name: `NestAuth:${userId}`,
+        });
+        await this.userRepository.update(userId, { mfaRecoveryCode: secret.base32 });
+        return secret.base32;
+    }
+
+    async resetMfa(userId: string, code: string): Promise<{ message: string }> {
+
+        this.checkIsMfaEnabledForApp(true)
+
+        const user = await this.userRepository.findOne({ where: { id: userId } });
+        if (!user) {
+            throw new UnauthorizedException({
+                message: 'User not found',
+                code: USER_NOT_FOUND_EXCEPTION_CODE
+            });
+        }
+        if (user.mfaRecoveryCode === code) {
+            // Delete recovery code
+            await this.userRepository.update(userId, { mfaRecoveryCode: null });
+
+            // Delete all mfa secrets
+            await this.mfaSecretRepository.delete({ userId });
+
+            return {
+                message: 'Recovery code verified',
+            };
+        }
+
+        throw new UnauthorizedException({
+            message: 'Invalid recovery code',
+            code: INVALID_MFA_EXCEPTION_CODE
+        });
+    }
+
+    getAvailableMethods(): MFAMethodEnum[] {
+        if (!this.requireMfaEnabledForApp(false)) {
+            return [];
+        }
+        return this.mfaConfig.methods ?? [];
+    }
+
+    async hasRecoveryCode(userId: string): Promise<boolean> {
+        if (!this.checkIsMfaEnabledForApp(false)) {
+            return false;
+        }
+
+        const user = await this.userRepository.findOne({
+            select: ['id', 'mfaRecoveryCode'],
+            where: { id: userId },
+        });
+
+        return Boolean(user?.mfaRecoveryCode);
+    }
+}

package/src/lib/auth.constants.ts

@@ -0,0 +1,63 @@
+export const AUTH_MODULE_OPTIONS = 'NEST_AUTH_AUTH_MODULE_OPTIONS';
+export const NEST_AUTH_ASYNC_OPTIONS_PROVIDER = 'NEST_AUTH_ASYNC_OPTIONS_PROVIDER';
+
+
+// Provider tokens
+export const JWT_AUTH_PROVIDER = 'jwt';
+export const GOOGLE_AUTH_PROVIDER = 'google';
+export const FACEBOOK_AUTH_PROVIDER = 'facebook';
+export const APPLE_AUTH_PROVIDER = 'apple';
+export const GITHUB_AUTH_PROVIDER = 'github';
+export const EMAIL_AUTH_PROVIDER = 'email';
+export const PHONE_AUTH_PROVIDER = 'phone';
+
+
+// Exception codes
+export const USER_NOT_FOUND_EXCEPTION_CODE = 'USER_NOT_FOUND';
+export const UNAUTHORIZED_EXCEPTION_CODE = 'UNAUTHORIZED';
+export const INVALID_MFA_EXCEPTION_CODE = 'INVALID_MFA';
+export const INVALID_REFRESH_TOKEN_EXCEPTION_CODE = 'INVALID_REFRESH_TOKEN';
+export const SESSION_NOT_FOUND_ERROR = 'SESSION_NOT_FOUND';
+export const USER_NOT_ACTIVE_ERROR = 'USER_NOT_ACTIVE';
+
+export const REFRESH_TOKEN_INVALID = 'REFRESH_TOKEN_INVALID';
+export const REFRESH_TOKEN_EXPIRED = 'REFRESH_TOKEN_EXPIRED';
+
+
+// Auth Cookie Names
+export const ACCESS_TOKEN_COOKIE_NAME = 'accessToken';
+export const REFRESH_TOKEN_COOKIE_NAME = 'refreshToken';
+
+// Default values
+export const DEFAULT_GUARD_NAME = 'web';
+
+// Events Const
+export const NestAuthEvents = {
+    EMAIL_VERIFICATION_REQUESTED: 'email.verification.requested',
+    EMAIL_VERIFIED: 'email.verified',
+    // Auth events
+    LOGGED_IN: 'nest_auth.logged_in',
+    REGISTERED: 'nest_auth.registered',
+    TWO_FACTOR_VERIFIED: 'nest_auth.two_factor_verified',
+    REFRESH_TOKEN: 'nest_auth.refresh_token',
+    PASSWORD_RESET_REQUESTED: 'nest_auth.password_reset_requested',
+    PASSWORD_RESET: 'nest_auth.password_reset',
+    LOGGED_OUT: 'nest_auth.logged_out',
+    LOGGED_OUT_ALL: 'nest_auth.logged_out_all',
+
+    // User events
+    USER_CREATED: 'nest_auth.user.created',
+    USER_UPDATED: 'nest_auth.user.updated',
+    USER_DELETED: 'nest_auth.user.deleted',
+
+    // Tenant events
+    TENANT_CREATED: 'nest_auth.tenant.created',
+    TENANT_UPDATED: 'nest_auth.tenant.updated',
+    TENANT_DELETED: 'nest_auth.tenant.deleted',
+
+    // Access key events
+    ACCESS_KEY_CREATED: 'nest_auth.access_key.created',
+    ACCESS_KEY_DELETED: 'nest_auth.access_key.deleted',
+    ACCESS_KEY_UPDATED: 'nest_auth.access_key.updated',
+    ACCESS_KEY_DEACTIVATED: 'nest_auth.access_key.deactivated',
+} as const;