@ackplus/nest-auth 1.1.17 → 1.1.19

package/src/lib/auth/services/auth.service.js

@@ -64,7 +64,10 @@ let AuthService = class AuthService {
         try {
             const config = this.authConfigService.getConfig();
             if (config.registration?.enabled === false) {
-                throw new common_1.ForbiddenException('Registration is disabled');
+                throw new common_1.ForbiddenException({
+                    message: 'Registration is disabled',
+                    code: auth_constants_1.ERROR_CODES.REGISTRATION_DISABLED,
+                });
             }
             const { email, phone, password } = input;
             let { tenantId = null } = input;
@@ -73,7 +76,10 @@ let AuthService = class AuthService {
             this.debugLogger.logAuthOperation('signup', 'email|phone', undefined, { email, phone, resolvedTenantId: tenantId });
             if (!email && !phone) {
                 this.debugLogger.error('Signup failed: Neither email nor phone provided', 'AuthService');
-                throw new common_1.BadRequestException('Either email or phone must be provided');
+                throw new common_1.BadRequestException({
+                    message: 'Either email or phone must be provided',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_OR_PHONE_REQUIRED,
+                });
             }
             let provider = null;
             let providerUserId = null;
@@ -87,17 +93,26 @@ let AuthService = class AuthService {
             }
             if (!provider) {
                 this.debugLogger.error('Provider not found for signup', 'AuthService', { email: !!email, phone: !!phone });
-                throw new common_1.InternalServerErrorException('Phone or email authentication is not enabled');
+                throw new common_1.InternalServerErrorException({
+                    message: 'Phone or email authentication is not enabled',
+                    code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                });
             }
             this.debugLogger.debug('Checking for existing identity', 'AuthService', { providerUserId });
             const identity = await provider.findIdentity(providerUserId);
             if (identity) {
                 this.debugLogger.warn('Identity already exists', 'AuthService', { email: !!email, phone: !!phone, tenantId });
                 if (email) {
-                    throw new common_1.BadRequestException('Email already exists in this tenant');
+                    throw new common_1.BadRequestException({
+                        message: 'Email already exists in this tenant',
+                        code: auth_constants_1.ERROR_CODES.EMAIL_ALREADY_EXISTS,
+                    });
                 }
                 if (phone) {
-                    throw new common_1.BadRequestException('Phone number already exists in this tenant');
+                    throw new common_1.BadRequestException({
+                        message: 'Phone number already exists in this tenant',
+                        code: auth_constants_1.ERROR_CODES.PHONE_ALREADY_EXISTS,
+                    });
                 }
             }
             this.debugLogger.debug('Creating new user', 'AuthService', { email: !!email, phone: !!phone, tenantId });
@@ -130,11 +145,17 @@ let AuthService = class AuthService {
                 isRequiresMfa
             }));
             this.debugLogger.logFunctionExit('signup', 'AuthService', { userId: user.id, isRequiresMfa });
-            return {
+            // Build default response
+            let response = {
                 accessToken: tokens.accessToken,
                 refreshToken: tokens.refreshToken,
                 isRequiresMfa: isRequiresMfa,
             };
+            // Apply auth.transformResponse hook if configured
+            if (config.auth?.transformResponse) {
+                response = await config.auth.transformResponse(response, user, session);
+            }
+            return response;
         }
         catch (error) {
             this.debugLogger.logError(error, 'signup', { email: input.email, phone: input.phone });
@@ -150,18 +171,27 @@ let AuthService = class AuthService {
         this.debugLogger.logAuthOperation('login', providerName, undefined, { resolvedTenantId: tenantId, createUserIfNotExists });
         const provider = this.authProviderRegistry.getProvider(providerName);
         if (!provider) {
-            throw new common_1.UnauthorizedException('Invalid authentication providerName or provider is not enabled');
+            throw new common_1.UnauthorizedException({
+                message: 'Invalid authentication providerName or provider is not enabled',
+                code: auth_constants_1.ERROR_CODES.INVALID_PROVIDER,
+            });
         }
         const requiredFields = provider.getRequiredFields();
         if (!requiredFields.every(field => credentials[field])) {
-            throw new common_1.BadRequestException(`Missing ${requiredFields.join(', ')} required fields`);
+            throw new common_1.BadRequestException({
+                message: `Missing ${requiredFields.join(', ')} required fields`,
+                code: auth_constants_1.ERROR_CODES.MISSING_REQUIRED_FIELDS,
+            });
         }
         const authProviderUser = await provider.validate(credentials);
         const identity = await provider.findIdentity(authProviderUser.userId);
         let user = identity?.user || null;
         if (!user) {
             if (!createUserIfNotExists) {
-                throw new common_1.UnauthorizedException('Invalid credentials');
+                throw new common_1.UnauthorizedException({
+                    message: 'Invalid credentials',
+                    code: auth_constants_1.ERROR_CODES.INVALID_CREDENTIALS,
+                });
             }
             // Create new user if not exists and link to provider
             user = await this.handleSocialLogin(provider, authProviderUser, tenantId);
@@ -169,13 +199,13 @@ let AuthService = class AuthService {
         if (user.isActive === false) {
             throw new common_1.UnauthorizedException({
                 message: 'Your account is suspended, please contact support',
-                code: auth_constants_1.USER_NOT_ACTIVE_ERROR,
+                code: auth_constants_1.ERROR_CODES.ACCOUNT_INACTIVE,
             });
         }
-        user = await this.getUserWithRolesAndPermissions(user.id);
-        const session = await this.sessionManager.createSessionFromUser(user);
-        const tokens = await this.generateTokensFromSession(session);
         let isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+        user.isMfaEnabled = isRequiresMfa;
+        user = await this.getUserWithRolesAndPermissions(user.id);
+        let session = await this.sessionManager.createSessionFromUser(user);
         // Check for trusted device cookie or header if MFA is required
         if (isRequiresMfa) {
             const trustCookieName = auth_config_service_1.AuthConfigService.getOptions().mfa?.trustDeviceStorageName || auth_constants_1.NEST_AUTH_TRUST_DEVICE_KEY;
@@ -190,12 +220,13 @@ let AuthService = class AuthService {
                 if (isTrusted) {
                     isRequiresMfa = false;
                     // Update session to indicate MFA is verified by trust
-                    await this.sessionManager.updateSession(session.id, {
+                    session = await this.sessionManager.updateSession(session.id, {
                         data: { ...session.data, isMfaVerified: true }
                     });
                 }
             }
         }
+        const tokens = await this.generateTokensFromSession(session);
         // Emit login event
         await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_IN, new user_logged_in_event_1.UserLoggedInEvent({
             user,
@@ -206,11 +237,18 @@ let AuthService = class AuthService {
             tokens,
             isRequiresMfa
         }));
-        return {
+        // Build default response
+        let response = {
             accessToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
             isRequiresMfa: isRequiresMfa,
         };
+        // Apply auth.transformResponse hook if configured
+        const config = this.authConfigService.getConfig();
+        if (config.auth?.transformResponse) {
+            response = await config.auth.transformResponse(response, user, session);
+        }
+        return response;
     }
     async verify2fa(input) {
         this.debugLogger.logFunctionEntry('verify2fa', 'AuthService', { method: input.method });
@@ -220,7 +258,7 @@ let AuthService = class AuthService {
                 this.debugLogger.error('Session not found for 2FA verification', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'Session not found',
-                    code: auth_constants_1.SESSION_NOT_FOUND_ERROR,
+                    code: auth_constants_1.ERROR_CODES.SESSION_NOT_FOUND,
                 });
             }
             this.debugLogger.debug('Verifying MFA code', 'AuthService', { userId: session.userId, method: input.method });
@@ -229,7 +267,7 @@ let AuthService = class AuthService {
                 this.debugLogger.warn('Invalid MFA code provided', 'AuthService', { userId: session.userId, method: input.method });
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid MFA code',
-                    code: auth_constants_1.INVALID_MFA_EXCEPTION_CODE,
+                    code: auth_constants_1.ERROR_CODES.MFA_CODE_INVALID,
                 });
             }
             this.debugLogger.debug('Updating session with MFA verification', 'AuthService', { sessionId: session.id });
@@ -272,7 +310,10 @@ let AuthService = class AuthService {
     async send2faCode(userId, method) {
         const user = await this.userRepository.findOne({ where: { id: userId } });
         if (!user) {
-            throw new common_1.UnauthorizedException('User not found');
+            throw new common_1.UnauthorizedException({
+                message: 'User not found',
+                code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+            });
         }
         await this.mfaService.sendMfaCode(user.id, method);
         return true;
@@ -305,7 +346,7 @@ let AuthService = class AuthService {
                 this.debugLogger.error('No refresh token provided', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'No refresh token provided',
-                    code: auth_constants_1.REFRESH_TOKEN_INVALID,
+                    code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
             this.debugLogger.debug('Verifying refresh token', 'AuthService');
@@ -317,20 +358,18 @@ let AuthService = class AuthService {
                 this.debugLogger.warn('Invalid or expired refresh token', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid or expired refresh token',
-                    code: auth_constants_1.REFRESH_TOKEN_EXPIRED,
+                    code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_EXPIRED,
                 });
             }
             const session = await this.sessionManager.getSession(payload.sessionId);
             if (!session) {
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid refresh token',
-                    code: auth_constants_1.REFRESH_TOKEN_INVALID,
+                    code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
-            // Generate new session
-            const newSession = await this.sessionManager.createSessionFromSession(session);
-            // Revoke old session
-            await this.sessionManager.revokeSession(session.id);
+            // Refresh existing session
+            const newSession = await this.sessionManager.refreshSession(session);
             // Generate new tokens
             this.debugLogger.debug('Generating new tokens from refreshed session', 'AuthService', { sessionId: newSession.id });
             const tokens = await this.generateTokensFromSession(newSession);
@@ -354,20 +393,32 @@ let AuthService = class AuthService {
         try {
             const currentUser = request_context_1.RequestContext.currentUser();
             if (!currentUser?.id) {
-                throw new common_1.UnauthorizedException('User not found');
+                throw new common_1.UnauthorizedException({
+                    message: 'User not found',
+                    code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+                });
             }
             const user = await this.userRepository.findOne({
                 where: { id: currentUser.id },
             });
             if (!user) {
-                throw new common_1.UnauthorizedException('User not found');
+                throw new common_1.UnauthorizedException({
+                    message: 'User not found',
+                    code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+                });
             }
             const isValid = await user.validatePassword(input.currentPassword);
             if (!isValid) {
-                throw new common_1.BadRequestException('Current password is incorrect');
+                throw new common_1.BadRequestException({
+                    message: 'Current password is incorrect',
+                    code: auth_constants_1.ERROR_CODES.CURRENT_PASSWORD_INCORRECT,
+                });
             }
             if (input.currentPassword === input.newPassword) {
-                throw new common_1.BadRequestException('New password must be different from the current password');
+                throw new common_1.BadRequestException({
+                    message: 'New password must be different from the current password',
+                    code: auth_constants_1.ERROR_CODES.NEW_PASSWORD_SAME_AS_CURRENT,
+                });
             }
             await user.setPassword(input.newPassword);
             await this.userRepository.save(user);
@@ -403,17 +454,29 @@ let AuthService = class AuthService {
                 provider = this.authProviderRegistry.getProvider(auth_constants_1.EMAIL_AUTH_PROVIDER);
             }
             else {
-                throw new common_1.BadRequestException('Either email or phone must be provided');
+                throw new common_1.BadRequestException({
+                    message: 'Either email or phone must be provided',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_OR_PHONE_REQUIRED,
+                });
             }
             if (!provider) {
-                throw new common_1.BadRequestException('Phone or email authentication is not enabled');
+                throw new common_1.BadRequestException({
+                    message: 'Phone or email authentication is not enabled',
+                    code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                });
             }
             if (!provider.enabled) {
                 if (email) {
-                    throw new common_1.BadRequestException('Email authentication is not enabled');
+                    throw new common_1.BadRequestException({
+                        message: 'Email authentication is not enabled',
+                        code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                    });
                 }
                 else if (phone) {
-                    throw new common_1.BadRequestException('Phone authentication is not enabled');
+                    throw new common_1.BadRequestException({
+                        message: 'Phone authentication is not enabled',
+                        code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                    });
                 }
             }
             const identity = await provider.findIdentity(email || phone);
@@ -456,7 +519,10 @@ let AuthService = class AuthService {
             // Resolve tenant ID - use provided or default
             tenantId = await this.tenantService.resolveTenantId(tenantId);
             if (!email && !phone) {
-                throw new common_1.BadRequestException('Either email or phone must be provided');
+                throw new common_1.BadRequestException({
+                    message: 'Either email or phone must be provided',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_OR_PHONE_REQUIRED,
+                });
             }
             let provider = null;
             if (phone) {
@@ -466,11 +532,17 @@ let AuthService = class AuthService {
                 provider = this.authProviderRegistry.getProvider(auth_constants_1.EMAIL_AUTH_PROVIDER);
             }
             if (!provider) {
-                throw new common_1.BadRequestException('Phone or email authentication is not enabled');
+                throw new common_1.BadRequestException({
+                    message: 'Phone or email authentication is not enabled',
+                    code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                });
             }
             const identity = await provider.findIdentity(email || phone);
             if (!identity) {
-                throw new common_1.BadRequestException('Invalid reset request');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid reset request',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_INVALID_REQUEST,
+                });
             }
             const validOtp = await this.otpRepository.findOne({
                 where: {
@@ -482,10 +554,16 @@ let AuthService = class AuthService {
                 relations: ['user']
             });
             if (!validOtp) {
-                throw new common_1.BadRequestException('Invalid OTP code');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid OTP code',
+                    code: auth_constants_1.ERROR_CODES.OTP_INVALID,
+                });
             }
             if ((0, moment_1.default)(validOtp.expiresAt).isBefore(new Date())) {
-                throw new common_1.BadRequestException('OTP code expired');
+                throw new common_1.BadRequestException({
+                    message: 'OTP code expired',
+                    code: auth_constants_1.ERROR_CODES.OTP_EXPIRED,
+                });
             }
             const user = validOtp.user;
             // Generate JWT-based password reset token
@@ -517,7 +595,10 @@ let AuthService = class AuthService {
             // Resolve tenant ID - use provided or default
             tenantId = await this.tenantService.resolveTenantId(tenantId);
             if (!email && !phone) {
-                throw new common_1.BadRequestException('Either email or phone must be provided');
+                throw new common_1.BadRequestException({
+                    message: 'Either email or phone must be provided',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_OR_PHONE_REQUIRED,
+                });
             }
             // Find user by email or phone
             const user = await this.userRepository.findOne({
@@ -527,7 +608,10 @@ let AuthService = class AuthService {
                 ]
             });
             if (!user) {
-                throw new common_1.BadRequestException('Invalid reset request');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid reset request',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_INVALID_REQUEST,
+                });
             }
             // Find valid OTP
             const validOtp = await this.otpRepository.findOne({
@@ -540,7 +624,10 @@ let AuthService = class AuthService {
                 }
             });
             if (!validOtp) {
-                throw new common_1.BadRequestException('Invalid or expired OTP');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid or expired OTP',
+                    code: auth_constants_1.ERROR_CODES.OTP_INVALID,
+                });
             }
             // Update password
             await user.setPassword(newPassword);
@@ -572,23 +659,35 @@ let AuthService = class AuthService {
                 decoded = await this.jwtService.verifyPasswordResetToken(token);
             }
             catch (error) {
-                throw new common_1.BadRequestException('Invalid or expired reset token');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid or expired reset token',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_TOKEN_INVALID,
+                });
             }
             if (decoded.type !== 'password-reset') {
-                throw new common_1.BadRequestException('Invalid token type');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid token type',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_TOKEN_INVALID,
+                });
             }
             // Get user
             const user = await this.userRepository.findOne({
                 where: { id: decoded.userId }
             });
             if (!user) {
-                throw new common_1.BadRequestException('User not found');
+                throw new common_1.BadRequestException({
+                    message: 'User not found',
+                    code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+                });
             }
             // Verify password hasn't changed since token was issued
             // This makes the token single-use in practice
             const currentPasswordHashPrefix = user.passwordHash ? user.passwordHash.substring(0, 10) : '';
             if (decoded.passwordHashPrefix !== currentPasswordHashPrefix) {
-                throw new common_1.BadRequestException('Reset token is no longer valid');
+                throw new common_1.BadRequestException({
+                    message: 'Reset token is no longer valid',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_TOKEN_INVALID,
+                });
             }
             // Update password
             await user.setPassword(newPassword);
@@ -626,7 +725,10 @@ let AuthService = class AuthService {
     async logoutAll(userId, logoutType = 'user', reason) {
         const session = request_context_1.RequestContext.currentSession();
         if (!session) {
-            throw new common_1.UnauthorizedException('Session not found');
+            throw new common_1.UnauthorizedException({
+                message: 'Session not found',
+                code: auth_constants_1.ERROR_CODES.SESSION_NOT_FOUND,
+            });
         }
         const sessions = await this.sessionManager.getUserSessions(userId);
         await this.sessionManager.revokeAllUserSessions(userId);
@@ -647,14 +749,23 @@ let AuthService = class AuthService {
         try {
             const user = request_context_1.RequestContext.currentUser();
             if (!user) {
-                throw new common_1.UnauthorizedException('User not authenticated');
+                throw new common_1.UnauthorizedException({
+                    message: 'User not authenticated',
+                    code: auth_constants_1.ERROR_CODES.UNAUTHORIZED,
+                });
             }
             const fullUser = await this.getUserWithRolesAndPermissions(user.id);
             if (!fullUser.email) {
-                throw new common_1.BadRequestException('User does not have an email address');
+                throw new common_1.BadRequestException({
+                    message: 'User does not have an email address',
+                    code: auth_constants_1.ERROR_CODES.NO_EMAIL_ADDRESS,
+                });
             }
             if (fullUser.emailVerifiedAt) {
-                throw new common_1.BadRequestException('Email is already verified');
+                throw new common_1.BadRequestException({
+                    message: 'Email is already verified',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_ALREADY_VERIFIED,
+                });
             }
             // Generate OTP
             const otp = (0, otp_1.generateOtp)();
@@ -686,14 +797,23 @@ let AuthService = class AuthService {
         try {
             const user = request_context_1.RequestContext.currentUser();
             if (!user) {
-                throw new common_1.UnauthorizedException('User not authenticated');
+                throw new common_1.UnauthorizedException({
+                    message: 'User not authenticated',
+                    code: auth_constants_1.ERROR_CODES.UNAUTHORIZED,
+                });
             }
             const fullUser = await this.getUserWithRolesAndPermissions(user.id);
             if (!fullUser.email) {
-                throw new common_1.BadRequestException('User does not have an email address');
+                throw new common_1.BadRequestException({
+                    message: 'User does not have an email address',
+                    code: auth_constants_1.ERROR_CODES.NO_EMAIL_ADDRESS,
+                });
             }
             if (fullUser.emailVerifiedAt) {
-                throw new common_1.BadRequestException('Email is already verified');
+                throw new common_1.BadRequestException({
+                    message: 'Email is already verified',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_ALREADY_VERIFIED,
+                });
             }
             // Find valid OTP
             const validOtp = await this.otpRepository.findOne({
@@ -705,10 +825,16 @@ let AuthService = class AuthService {
                 }
             });
             if (!validOtp) {
-                throw new common_1.BadRequestException('Invalid verification code');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid verification code',
+                    code: auth_constants_1.ERROR_CODES.VERIFICATION_CODE_INVALID,
+                });
             }
             if ((0, moment_1.default)(validOtp.expiresAt).isBefore(new Date())) {
-                throw new common_1.BadRequestException('Verification code has expired');
+                throw new common_1.BadRequestException({
+                    message: 'Verification code has expired',
+                    code: auth_constants_1.ERROR_CODES.VERIFICATION_CODE_EXPIRED,
+                });
             }
             // Mark OTP as used
             validOtp.used = true;
@@ -730,8 +856,8 @@ let AuthService = class AuthService {
             throw error;
         }
     }
-    generateTokensPayload(session, otherPayload = {}) {
-        const payload = {
+    async generateTokensPayload(session, otherPayload = {}) {
+        let payload = {
             id: session.userId,
             sub: session.userId,
             sessionId: session.id,
@@ -744,10 +870,15 @@ let AuthService = class AuthService {
             isMfaVerified: session.data?.isMfaVerified,
             ...otherPayload,
         };
+        // Apply custom token payload hook if configured
+        const config = this.authConfigService.getConfig();
+        if (config.session?.customizeTokenPayload) {
+            payload = await config.session.customizeTokenPayload(payload, session);
+        }
         return payload;
     }
     async generateTokensFromSession(session) {
-        const payload = this.generateTokensPayload(session);
+        const payload = await this.generateTokensPayload(session);
         const tokens = await this.jwtService.generateTokens(payload);
         return tokens;
     }

package/src/lib/auth/services/mfa.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/nest-auth/src/lib/auth/services/mfa.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAY,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAK7D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,qBACa,UAAU;IAMf,OAAO,CAAC,mBAAmB;IAG3B,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,aAAa;IAGrB,OAAO,CAAC,uBAAuB;IAE/B,OAAO,CAAC,YAAY;IAfxB,SAAS,EAAE,UAAU,CAAA;gBAIT,mBAAmB,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAGlD,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,EAGxC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,EAGtC,uBAAuB,EAAE,UAAU,CAAC,qBAAqB,CAAC,EAE1D,YAAY,EAAE,aAAa;IAKvC,uBAAuB,CAAC,UAAU,GAAE,OAAc;IAUlD,OAAO,CAAC,uBAAuB;IAIzB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAiC5D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAmC3D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAiDpE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAwDpF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBjG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BnF,cAAc,CAAC,MAAM,EAAE,MAAM;;;;;;;;IAmB7B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB/C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D,SAAS,CAAC,MAAM,EAAE,MAAM;IAexB,UAAU,CAAC,MAAM,EAAE,MAAM;IASzB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B1E,mBAAmB,IAAI,aAAa,EAAE;IAOhC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAajD,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB1F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB/E"}
+{"version":3,"file":"mfa.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/nest-auth/src/lib/auth/services/mfa.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAY,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAKxF,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAK7D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,qBACa,UAAU;IAMf,OAAO,CAAC,mBAAmB;IAG3B,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,aAAa;IAGrB,OAAO,CAAC,uBAAuB;IAE/B,OAAO,CAAC,YAAY;IAfxB,SAAS,EAAE,UAAU,CAAA;gBAIT,mBAAmB,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAGlD,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,EAGxC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,EAGtC,uBAAuB,EAAE,UAAU,CAAC,qBAAqB,CAAC,EAE1D,YAAY,EAAE,aAAa;IAKvC,uBAAuB,CAAC,UAAU,GAAE,OAAc;IAalD,OAAO,CAAC,uBAAuB;IAIzB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAiC5D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAmC3D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAiDpE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAwDpF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBjG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BnF,cAAc,CAAC,MAAM,EAAE,MAAM;;;;;;;;IAmB7B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB/C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D,SAAS,CAAC,MAAM,EAAE,MAAM;IAqBxB,UAAU,CAAC,MAAM,EAAE,MAAM;IAYzB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B1E,mBAAmB,IAAI,aAAa,EAAE;IAOhC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAajD,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB1F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB/E"}

package/src/lib/auth/services/mfa.service.js

@@ -17,7 +17,6 @@ const otp_1 = require("../../utils/otp");
 const ms_1 = tslib_1.__importDefault(require("ms"));
 const auth_config_service_1 = require("../../core/services/auth-config.service");
 const event_emitter_1 = require("@nestjs/event-emitter");
-const auth_constants_2 = require("../../auth.constants");
 const two_factor_code_sent_event_1 = require("../events/two-factor-code-sent.event");
 const trusted_device_entity_1 = require("../entities/trusted-device.entity");
 const crypto_1 = require("crypto");
@@ -33,7 +32,10 @@ let MfaService = class MfaService {
     requireMfaEnabledForApp(throwError = true) {
         if (!this.mfaConfig.enabled) {
             if (throwError) {
-                throw new common_1.ForbiddenException('MFA is not enabled for the application');
+                throw new common_1.ForbiddenException({
+                    message: 'MFA is not enabled for the application',
+                    code: auth_constants_1.ERROR_CODES.MFA_NOT_ENABLED,
+                });
             }
             return false;
         }
@@ -122,7 +124,7 @@ let MfaService = class MfaService {
         if (method === mfa_options_interface_1.MFAMethodEnum.EMAIL || method === mfa_options_interface_1.MFAMethodEnum.SMS) {
             const user = await this.userRepository.findOne({ where: { id: userId } });
             if (user) {
-                await this.eventEmitter.emitAsync(auth_constants_2.NestAuthEvents.TWO_FACTOR_CODE_SENT, new two_factor_code_sent_event_1.TwoFactorCodeSentEvent({
+                await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.TWO_FACTOR_CODE_SENT, new two_factor_code_sent_event_1.TwoFactorCodeSentEvent({
                     user,
                     tenantId: user.tenantId,
                     method,
@@ -263,18 +265,27 @@ let MfaService = class MfaService {
     async enableMFA(userId) {
         this.requireMfaEnabledForApp(true);
         if (!this.mfaConfig.allowUserToggle) {
-            throw new Error('MFA toggling is not allowed');
+            throw new common_1.ForbiddenException({
+                message: 'MFA toggling is not allowed',
+                code: auth_constants_1.ERROR_CODES.MFA_TOGGLING_NOT_ALLOWED,
+            });
         }
         const verifiedMethods = await this.getVerifiedMethods(userId);
         if (verifiedMethods.length === 0) {
-            throw new common_1.ForbiddenException('Cannot enable MFA without at least one verified method');
+            throw new common_1.ForbiddenException({
+                message: 'Cannot enable MFA without at least one verified method',
+                code: auth_constants_1.ERROR_CODES.MFA_CANNOT_ENABLE_WITHOUT_METHOD,
+            });
         }
         await this.userRepository.update(userId, { isMfaEnabled: true });
     }
     async disableMFA(userId) {
         this.checkIsMfaEnabledForApp(true);
         if (!this.mfaConfig.allowUserToggle) {
-            throw new Error('MFA toggling is not allowed');
+            throw new common_1.ForbiddenException({
+                message: 'MFA toggling is not allowed',
+                code: auth_constants_1.ERROR_CODES.MFA_TOGGLING_NOT_ALLOWED,
+            });
         }
         await this.userRepository.update(userId, { isMfaEnabled: false });
     }
@@ -296,7 +307,7 @@ let MfaService = class MfaService {
         if (!user) {
             throw new common_1.UnauthorizedException({
                 message: 'User not found',
-                code: auth_constants_1.USER_NOT_FOUND_EXCEPTION_CODE
+                code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND
             });
         }
         if (user.mfaRecoveryCode === code) {
@@ -310,7 +321,7 @@ let MfaService = class MfaService {
         }
         throw new common_1.UnauthorizedException({
             message: 'Invalid recovery code',
-            code: auth_constants_1.INVALID_MFA_EXCEPTION_CODE
+            code: auth_constants_1.ERROR_CODES.MFA_RECOVERY_CODE_INVALID
         });
     }
     getAvailableMethods() {