@ackplus/nest-auth 0.1.51 → 1.1.0

package/src/lib/core/providers/base-auth.provider.ts

@@ -0,0 +1,74 @@
+import { Repository } from 'typeorm';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthIdentity } from '../../user/entities/identity.entity';
+import { AuthConfigService } from '../services/auth-config.service';
+import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
+
+export interface AuthProviderUser {
+    userId: string;
+    email?: string;
+    phone?: string;
+    username?: string;
+    metadata?: Record<string, any>;
+}
+
+export type LinkUserWith = 'email' | 'phone';
+
+
+export abstract class BaseAuthProvider {
+    abstract providerName: string;
+    enabled: boolean;
+    options: AuthModuleOptions;
+
+    constructor(
+        protected readonly userRepository: Repository<NestAuthUser>,
+        protected readonly authIdentityRepository: Repository<NestAuthIdentity>,
+    ) {
+        this.options = AuthConfigService.getOptions();
+    }
+
+    /**
+     * Link a provider identity to a user
+     */
+    async linkToUser(userId: string, providerUserId: string, metadata?: Record<string, any>): Promise<void> {
+        const identity = this.authIdentityRepository.create({
+            userId,
+            provider: this.providerName,
+            providerId: providerUserId,
+            metadata: metadata || {},
+        });
+        await this.authIdentityRepository.save(identity);
+    }
+
+    async findIdentityByUserId(userId: string): Promise<NestAuthIdentity | null> {
+        return this.authIdentityRepository.findOne({
+            where: {
+                userId,
+                provider: this.providerName,
+            },
+            relations: ['user'],
+        });
+    }
+
+    /**
+     * Find an existing identity for a provider
+     */
+    async findIdentity(providerUserId: string): Promise<NestAuthIdentity | null> {
+        return this.authIdentityRepository.findOne({
+            where: {
+                provider: this.providerName,
+                providerId: providerUserId,
+            },
+            relations: ['user'],
+        });
+    }
+
+    abstract validate(credentials: any): Promise<AuthProviderUser | null>;
+
+    abstract getRequiredFields(): string[];
+
+
+    linkUserWith(): LinkUserWith {
+        return 'email';
+    }
+}

package/src/lib/core/providers/email-auth.provider.ts

@@ -0,0 +1,71 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import { BaseAuthProvider } from './base-auth.provider';
+import { EMAIL_AUTH_PROVIDER } from '../../auth.constants';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthIdentity } from '../../user/entities/identity.entity';
+
+@Injectable()
+export class EmailAuthProvider extends BaseAuthProvider {
+    providerName = EMAIL_AUTH_PROVIDER;
+
+    constructor(
+        readonly dataSource: DataSource,
+    ) {
+        const userRepository = dataSource.getRepository(NestAuthUser);
+        const authIdentityRepository = dataSource.getRepository(NestAuthIdentity);
+
+        super(userRepository, authIdentityRepository);
+
+        this.enabled = this.options.emailAuth?.enabled;
+    }
+
+    /**
+     * Normalize email to lowercase for case-insensitive matching
+     */
+    private normalizeEmail(email: string | null | undefined): string | null {
+        if (!email) return null;
+        return email.toLowerCase().trim();
+    }
+
+    /**
+     * Override findIdentity to normalize email before searching
+     */
+    async findIdentity(providerUserId: string): Promise<NestAuthIdentity | null> {
+        const normalizedEmail = this.normalizeEmail(providerUserId);
+        return super.findIdentity(normalizedEmail || providerUserId);
+    }
+
+    /**
+     * Override linkToUser to normalize email before linking
+     */
+    async linkToUser(userId: string, providerUserId: string, metadata?: Record<string, any>): Promise<void> {
+        const normalizedEmail = this.normalizeEmail(providerUserId);
+        return super.linkToUser(userId, normalizedEmail || providerUserId, metadata);
+    }
+
+    async validate(credentials: { email?: string; password?: string }) {
+        // Normalize email to lowercase for case-insensitive matching
+        const normalizedEmail = this.normalizeEmail(credentials.email);
+
+        if (!normalizedEmail) {
+            throw new UnauthorizedException('Email is required');
+        }
+
+        const identity = await this.findIdentity(normalizedEmail);
+
+        if (!identity?.user || !(await identity.user.validatePassword(credentials.password))) {
+            throw new UnauthorizedException('Invalid credentials');
+        }
+
+        return {
+            userId: identity.user?.email,
+            email: identity.user?.email || '',
+            metadata: identity.user,
+        };
+    }
+
+    getRequiredFields(): string[] {
+        return ['email', 'password'];
+    }
+}

package/src/lib/core/providers/facebook-auth.provider.ts

@@ -0,0 +1,55 @@
+import Facebook from 'fb';
+import { BaseAuthProvider } from './base-auth.provider';
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import { FACEBOOK_AUTH_PROVIDER } from '../../auth.constants';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthIdentity } from '../../user/entities/identity.entity';
+
+@Injectable()
+export class FacebookAuthProvider extends BaseAuthProvider {
+    providerName = FACEBOOK_AUTH_PROVIDER;
+
+    constructor(
+        readonly dataSource: DataSource,
+    ) {
+        const userRepository = dataSource.getRepository(NestAuthUser);
+        const authIdentityRepository = dataSource.getRepository(NestAuthIdentity);
+
+        super(userRepository, authIdentityRepository);
+
+        const facebookConfig = this.options.facebook;
+        this.enabled = Boolean(facebookConfig);
+
+        if (this.enabled) {
+            Facebook.options({
+                appId: facebookConfig.appId,
+                appSecret: facebookConfig.appSecret,
+            });
+        }
+    }
+
+    async validate(credentials: { accessToken: string }) {
+        try {
+            const response = await Facebook.api('me', {
+                fields: ['id', 'email', 'name', 'picture'],
+                access_token: credentials.accessToken,
+            });
+
+            return {
+                userId: response.id,
+                email: response.email || '',
+                metadata: {
+                    name: response.name,
+                    picture: response.picture?.data?.url,
+                },
+            };
+        } catch (error) {
+            throw new UnauthorizedException('Invalid Facebook token');
+        }
+    }
+
+    getRequiredFields(): string[] {
+        return ['accessToken'];
+    }
+}

package/src/lib/core/providers/github-auth.provider.ts

@@ -0,0 +1,79 @@
+import { BaseAuthProvider } from './base-auth.provider';
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import { GITHUB_AUTH_PROVIDER } from '../../auth.constants';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthIdentity } from '../../user/entities/identity.entity';
+import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
+
+@Injectable()
+export class GitHubAuthProvider extends BaseAuthProvider {
+    providerName = GITHUB_AUTH_PROVIDER;
+    private githubConfig: AuthModuleOptions['github'];
+
+    constructor(
+        readonly dataSource: DataSource,
+    ) {
+        const userRepository = dataSource.getRepository(NestAuthUser);
+        const authIdentityRepository = dataSource.getRepository(NestAuthIdentity);
+
+        super(userRepository, authIdentityRepository);
+
+        this.githubConfig = this.options.github;
+        this.enabled = Boolean(this.githubConfig);
+    }
+
+    async validate(credentials: { accessToken: string }) {
+        try {
+            // Fetch user info from GitHub API
+            const userResponse = await fetch('https://api.github.com/user', {
+                headers: {
+                    Authorization: `Bearer ${credentials.accessToken}`,
+                    Accept: 'application/vnd.github.v3+json',
+                },
+            });
+
+            if (!userResponse.ok) {
+                throw new UnauthorizedException('Invalid GitHub token');
+            }
+
+            const userData: any = await userResponse.json();
+
+            // Fetch user emails (in case email is private in profile)
+            let email = userData.email;
+            if (!email) {
+                const emailsResponse = await fetch('https://api.github.com/user/emails', {
+                    headers: {
+                        Authorization: `Bearer ${credentials.accessToken}`,
+                        Accept: 'application/vnd.github.v3+json',
+                    },
+                });
+
+                if (emailsResponse.ok) {
+                    const emails: any = await emailsResponse.json();
+                    const primaryEmail = emails.find((e: any) => e.primary) || emails[0];
+                    email = primaryEmail?.email || '';
+                }
+            }
+
+            return {
+                userId: userData.id.toString(),
+                email: email || '',
+                metadata: {
+                    name: userData.name || userData.login,
+                    login: userData.login,
+                    avatar: userData.avatar_url,
+                    bio: userData.bio,
+                    company: userData.company,
+                    location: userData.location,
+                },
+            };
+        } catch (error) {
+            throw new UnauthorizedException('Invalid GitHub token');
+        }
+    }
+
+    getRequiredFields(): string[] {
+        return ['accessToken'];
+    }
+}

package/src/lib/core/providers/google-auth.provider.ts

@@ -0,0 +1,61 @@
+import { OAuth2Client } from 'google-auth-library';
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { BaseAuthProvider } from './base-auth.provider';
+import { AuthModuleOptions } from '../../core';
+import { GOOGLE_AUTH_PROVIDER } from '../../auth.constants';
+import { DataSource } from 'typeorm';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthIdentity } from '../../user/entities/identity.entity';
+
+@Injectable()
+export class GoogleAuthProvider extends BaseAuthProvider {
+    providerName = GOOGLE_AUTH_PROVIDER;
+    private client: OAuth2Client;
+    private googleConfig: AuthModuleOptions['google'];
+
+    constructor(
+        readonly dataSource: DataSource,
+    ) {
+        const userRepository = dataSource.getRepository(NestAuthUser);
+        const authIdentityRepository = dataSource.getRepository(NestAuthIdentity);
+
+        super(userRepository, authIdentityRepository);
+
+        this.googleConfig = this.options.google;
+        this.enabled = Boolean(this.googleConfig);
+        if (this.enabled) {
+            this.client = new OAuth2Client(this.googleConfig.clientId, this.googleConfig.clientSecret);
+        }
+    }
+
+
+    async validate(credentials: { accessToken: string }) {
+        try {
+            const ticket = await this.client.verifyIdToken({
+                idToken: credentials.accessToken,
+                audience: this.googleConfig.clientId,
+            });
+
+            const payload = ticket.getPayload();
+            if (!payload) {
+                throw new UnauthorizedException('Invalid Google token');
+            }
+
+            return {
+                userId: payload.sub,
+                email: payload.email || '',
+                metadata: {
+                    name: payload.name,
+                    picture: payload.picture,
+                    locale: payload.locale,
+                },
+            };
+        } catch (error) {
+            throw new UnauthorizedException('Invalid Google token');
+        }
+    }
+
+    getRequiredFields(): string[] {
+        return ['accessToken'];
+    }
+}

package/src/lib/core/providers/jwt-auth.provider.ts

@@ -0,0 +1,50 @@
+import { BadRequestException } from '@nestjs/common';
+import { BaseAuthProvider } from './base-auth.provider';
+import { DataSource } from 'typeorm';
+import { Injectable } from '@nestjs/common';
+import { AuthModuleOptions } from '../../core';
+import { JWT_AUTH_PROVIDER } from '../../auth.constants';
+import { JwtService } from '../services/jwt.service';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthIdentity } from '../../user/entities/identity.entity';
+
+@Injectable()
+export class JwtAuthProvider extends BaseAuthProvider {
+    providerName = JWT_AUTH_PROVIDER;
+    private jwtConfig: AuthModuleOptions['jwt'];
+
+
+    constructor(
+        readonly dataSource: DataSource,
+        private readonly jwtService: JwtService,
+    ) {
+        const userRepository = dataSource.getRepository(NestAuthUser);
+        const authIdentityRepository = dataSource.getRepository(NestAuthIdentity);
+
+        super(userRepository, authIdentityRepository);
+
+        this.jwtConfig = this.options.jwt;
+        this.enabled = Boolean(this.jwtConfig);
+    }
+
+    async validate(credentials: { accessToken: string }) {
+        try {
+            const payload = await this.jwtService.verifyToken(credentials.accessToken);
+
+            return {
+                userId: payload.sub,
+                email: payload.email,
+                phone: payload.phone,
+                metadata: {
+                    ...payload,
+                },
+            };
+        } catch (error) {
+            throw new BadRequestException('Invalid JWT token');
+        }
+    }
+
+    getRequiredFields(): string[] {
+        return ['accessToken'];
+    }
+}

package/src/lib/core/providers/phone-auth.provider.ts

@@ -0,0 +1,45 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { DataSource } from 'typeorm';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthIdentity } from '../../user/entities/identity.entity';
+import { BaseAuthProvider, LinkUserWith } from './base-auth.provider';
+import { PHONE_AUTH_PROVIDER } from '../../auth.constants';
+
+@Injectable()
+export class PhoneAuthProvider extends BaseAuthProvider {
+    providerName = PHONE_AUTH_PROVIDER;
+
+    constructor(
+        readonly dataSource: DataSource,
+    ) {
+        const userRepository = dataSource.getRepository(NestAuthUser);
+        const authIdentityRepository = dataSource.getRepository(NestAuthIdentity);
+
+        super(userRepository, authIdentityRepository);
+
+        this.enabled = this.options.phoneAuth?.enabled;
+    }
+
+    async validate(credentials: { phone: string; password: string }) {
+
+        const identity = await this.findIdentity(credentials.phone);
+
+        if (!identity?.user || !(await identity.user.validatePassword(credentials.password))) {
+            throw new UnauthorizedException('Invalid credentials');
+        }
+
+        return {
+            userId: identity.user?.phone,
+            phone: identity.user?.phone || '',
+            metadata: identity.user,
+        };
+    }
+
+    getRequiredFields(): string[] {
+        return ['phone', 'password'];
+    }
+
+    override linkUserWith(): LinkUserWith {
+        return 'phone';
+    }
+}

package/src/lib/core/services/auth-config.service.ts

@@ -0,0 +1,184 @@
+import { Injectable } from '@nestjs/common';
+import { randomBytes } from 'crypto';
+import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
+import { SessionStorageType } from '../interfaces/session-options.interface';
+import { MFAMethodEnum } from '../interfaces/mfa-options.interface';
+
+@Injectable()
+export class AuthConfigService {
+    private static instance: AuthConfigService;
+    private static options: AuthModuleOptions;
+
+    /**
+     * Default configuration options for NestAuth module
+     * This is the single source of truth for default values
+     */
+    private static defaultOptions: AuthModuleOptions = {
+        isGlobal: true,
+        appName: 'Nest Auth',
+        passwordResetOtpExpiresIn: '15m',
+        passwordResetTokenExpiresIn: '1h',
+        session: {
+            storageType: SessionStorageType.DATABASE,
+            sessionExpiry: '1h',
+            refreshTokenExpiry: '30d',
+        },
+        jwt: {
+            secret: 'secret',
+        },
+        accessTokenType: 'header',
+        cookieOptions: {
+            httpOnly: true,
+            secure: false,
+        },
+        emailAuth: {
+            enabled: true,
+        },
+        mfa: {
+            enabled: false,
+            methods: [MFAMethodEnum.EMAIL, MFAMethodEnum.TOTP],
+            allowUserToggle: true,
+            allowMethodSelection: true,
+            otpLength: 6,
+            otpExpiresIn: '15m',
+        },
+        defaultTenant: undefined, // No default tenant by default
+        adminConsole: {
+            enabled: true,
+            basePath: '/api/auth/admin',
+            sessionCookieName: 'nest_auth_admin',
+            sessionDuration: '2h',
+            allowAdminManagement: true,
+            cookie: {
+                httpOnly: true,
+                secure: false,
+                sameSite: 'lax' as const,
+            },
+        },
+        debug: {
+            enabled: false,
+            level: 'verbose' as any,
+            prefix: '[NestAuth]',
+            includeTimestamp: true,
+            includeContext: true
+        }
+    };
+
+    constructor() {
+        if (!AuthConfigService.instance) {
+            AuthConfigService.instance = this;
+        }
+        return AuthConfigService.instance;
+    }
+
+    static getInstance(): AuthConfigService {
+        if (!AuthConfigService.instance) {
+            AuthConfigService.instance = new AuthConfigService();
+        }
+        return AuthConfigService.instance;
+    }
+
+    /**
+     * Generates a secure random key using cryptographically strong random bytes.
+     * Used as fallback when no key is explicitly configured.
+     */
+    private static generateRandomKey(length: number = 32): string {
+        return randomBytes(length).toString('base64');
+    }
+
+    /**
+     * Resolves the Nest Auth Admin Console Secret Key from configuration.
+     * This key is used for:
+     * - Signing admin dashboard sessions
+     * - Admin console security operations (admin creation, password reset, etc.)
+     *
+     * Priority:
+     * 1. Explicitly configured key (adminConsole.secretKey)
+     * 2. Auto-generated random key (for development only, with warning)
+     * 3. undefined (if generation is disabled)
+     */
+    private static resolveSecretKey(options: AuthModuleOptions): string | undefined {
+        // Check explicit configuration first
+        const adminConsoleKey = options.adminConsole?.secretKey;
+        if (adminConsoleKey) {
+            return adminConsoleKey;
+        }
+
+        // Auto-generate for development (only if NODE_ENV is not production)
+        if (process.env.NODE_ENV !== 'production') {
+            const generatedKey = this.generateRandomKey(32);
+            console.warn(
+                '[NestAuth] Warning: adminConsole.secretKey not configured. ' +
+                `Auto-generated key for development: ${generatedKey.slice(0, 20)}...\n` +
+                '⚠️  This key will change on each restart. Configure adminConsole.secretKey in your AuthModuleOptions!'
+            );
+            return generatedKey;
+        }
+
+        return undefined;
+    }
+
+    static setOptions(options: AuthModuleOptions): void {
+        const deepmerge = require('deepmerge');
+        const mergedOptions = deepmerge(this.defaultOptions, options);
+
+        // Ensure adminConsole exists
+        if (!mergedOptions.adminConsole) {
+            mergedOptions.adminConsole = {};
+        }
+
+        // Resolve and set secret key from configuration
+        // This key is used for both session signing and security operations
+        // After this, all code should use the config object
+        if (!mergedOptions.adminConsole.secretKey) {
+            const secretKey = this.resolveSecretKey(mergedOptions);
+            if (secretKey) {
+                mergedOptions.adminConsole.secretKey = secretKey;
+            }
+        }
+
+        this.options = mergedOptions;
+
+        // Validate admin console configuration
+        this.validateAdminConsoleOptions(this.options);
+    }
+
+    /**
+     * Validates admin console configuration options
+     */
+    private static validateAdminConsoleOptions(options: AuthModuleOptions): void {
+        if (options.adminConsole?.enabled !== false && options.adminConsole?.secretKey) {
+            const secretKey = options.adminConsole.secretKey;
+            const weakSecrets = ['change-me-admin-secret', 'default', 'secret', ''];
+
+            // Only validate if it's not auto-generated (auto-generated keys are base64, typically 44 chars)
+            if (weakSecrets.includes(secretKey)) {
+                throw new Error(
+                    'Admin console requires a secure secretKey. ' +
+                    'Please set adminConsole.secretKey in your AuthModuleOptions (e.g., secretKey: process.env.ADMIN_CONSOLE_SESSION_SECRET) ' +
+                    'with a 32+ byte random value. Store it securely in environment variables or a secrets manager. ' +
+                    'Weak or default values are not allowed for security reasons. Rotate keys regularly.'
+                );
+            }
+        }
+    }
+
+    static getOptions(): AuthModuleOptions {
+        if (!this.options) {
+            this.options = { ...this.defaultOptions };
+        }
+        return this.options;
+    }
+
+    static getDefaultOptions(): AuthModuleOptions {
+        return { ...this.defaultOptions };
+    }
+
+    getConfig(): AuthModuleOptions {
+        return AuthConfigService.getOptions();
+    }
+
+    setConfig(options: AuthModuleOptions): void {
+        AuthConfigService.setOptions(options);
+    }
+}