@ackplus/nest-auth 1.1.18 → 1.1.20

package/src/lib/auth/services/mfa.service.d.ts

@@ -11,8 +11,8 @@ export declare class MfaService {
     private otpRepository;
     private trustedDeviceRepository;
     private eventEmitter;
-    mfaConfig: MFAOptions;
     constructor(mfaSecretRepository: Repository<NestAuthMFASecret>, userRepository: Repository<NestAuthUser>, otpRepository: Repository<NestAuthOTP>, trustedDeviceRepository: Repository<NestAuthTrustedDevice>, eventEmitter: EventEmitter2);
+    get mfaConfig(): MFAOptions;
     requireMfaEnabledForApp(throwError?: boolean): boolean;
     private checkIsMfaEnabledForApp;
     getVerifiedMethods(userId: string): Promise<MFAMethodEnum[]>;

package/src/lib/auth/services/mfa.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mfa.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/nest-auth/src/lib/auth/services/mfa.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAY,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAExF,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAK7D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAI1E,qBACa,UAAU;IAMf,OAAO,CAAC,mBAAmB;IAG3B,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,aAAa;IAGrB,OAAO,CAAC,uBAAuB;IAE/B,OAAO,CAAC,YAAY;IAfxB,SAAS,EAAE,UAAU,CAAA;gBAIT,mBAAmB,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAGlD,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,EAGxC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,EAGtC,uBAAuB,EAAE,UAAU,CAAC,qBAAqB,CAAC,EAE1D,YAAY,EAAE,aAAa;IAKvC,uBAAuB,CAAC,UAAU,GAAE,OAAc;IAUlD,OAAO,CAAC,uBAAuB;IAIzB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAiC5D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAmC3D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAiDpE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAwDpF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBjG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BnF,cAAc,CAAC,MAAM,EAAE,MAAM;;;;;;;;IAmB7B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB/C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D,SAAS,CAAC,MAAM,EAAE,MAAM;IAexB,UAAU,CAAC,MAAM,EAAE,MAAM;IASzB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B1E,mBAAmB,IAAI,aAAa,EAAE;IAOhC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAajD,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB1F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB/E"}
+{"version":3,"file":"mfa.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/nest-auth/src/lib/auth/services/mfa.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAY,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,6CAA6C,CAAC;AAKxF,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAK7D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAM1E,qBACa,UAAU;IAIf,OAAO,CAAC,mBAAmB;IAG3B,OAAO,CAAC,cAAc;IAGtB,OAAO,CAAC,aAAa;IAGrB,OAAO,CAAC,uBAAuB;IAE/B,OAAO,CAAC,YAAY;gBAXZ,mBAAmB,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAGlD,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,EAGxC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,EAGtC,uBAAuB,EAAE,UAAU,CAAC,qBAAqB,CAAC,EAE1D,YAAY,EAAE,aAAa;IAGvC,IAAI,SAAS,IAAI,UAAU,CAE1B;IAED,uBAAuB,CAAC,UAAU,GAAE,OAAc;IAalD,OAAO,CAAC,uBAAuB;IAIzB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAiC5D,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAmC3D,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAyDpE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC;IAwDpF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBjG,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BnF,cAAc,CAAC,MAAM,EAAE,MAAM;;;;;;;;IAmB7B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgB/C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9C,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/D,SAAS,CAAC,MAAM,EAAE,MAAM;IAgCxB,UAAU,CAAC,MAAM,EAAE,MAAM;IAsBzB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjD,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B1E,mBAAmB,IAAI,aAAa,EAAE;IAOhC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAajD,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB1F,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB/E"}

package/src/lib/auth/services/mfa.service.js

@@ -17,10 +17,11 @@ const otp_1 = require("../../utils/otp");
 const ms_1 = tslib_1.__importDefault(require("ms"));
 const auth_config_service_1 = require("../../core/services/auth-config.service");
 const event_emitter_1 = require("@nestjs/event-emitter");
-const auth_constants_2 = require("../../auth.constants");
 const two_factor_code_sent_event_1 = require("../events/two-factor-code-sent.event");
 const trusted_device_entity_1 = require("../entities/trusted-device.entity");
 const crypto_1 = require("crypto");
+const user_2fa_enabled_event_1 = require("../events/user-2fa-enabled.event");
+const user_2fa_disabled_event_1 = require("../events/user-2fa-disabled.event");
 let MfaService = class MfaService {
     constructor(mfaSecretRepository, userRepository, otpRepository, trustedDeviceRepository, eventEmitter) {
         this.mfaSecretRepository = mfaSecretRepository;
@@ -28,12 +29,17 @@ let MfaService = class MfaService {
         this.otpRepository = otpRepository;
         this.trustedDeviceRepository = trustedDeviceRepository;
         this.eventEmitter = eventEmitter;
-        this.mfaConfig = auth_config_service_1.AuthConfigService.getOptions().mfa;
+    }
+    get mfaConfig() {
+        return auth_config_service_1.AuthConfigService.getOptions().mfa || {};
     }
     requireMfaEnabledForApp(throwError = true) {
         if (!this.mfaConfig.enabled) {
             if (throwError) {
-                throw new common_1.ForbiddenException('MFA is not enabled for the application');
+                throw new common_1.ForbiddenException({
+                    message: 'MFA is not enabled for the application',
+                    code: auth_constants_1.ERROR_CODES.MFA_NOT_ENABLED,
+                });
             }
             return false;
         }
@@ -96,7 +102,15 @@ let MfaService = class MfaService {
     }
     async sendMfaCode(userId, method) {
         this.requireMfaEnabledForApp(true);
-        const code = (0, otp_1.generateOtp)(this.mfaConfig.otpLength);
+        const options = auth_config_service_1.AuthConfigService.getOptions();
+        let code;
+        // Apply otp.generate hook if configured
+        if (options.otp?.generate) {
+            code = await options.otp.generate(this.mfaConfig.otpLength);
+        }
+        else {
+            code = (0, otp_1.generateOtp)(this.mfaConfig.otpLength);
+        }
         let expiresAtMs;
         if (typeof this.mfaConfig.otpExpiresIn === 'string') {
             expiresAtMs = (0, ms_1.default)(this.mfaConfig.otpExpiresIn); // example: '15m', '1h', '1d'
@@ -122,7 +136,7 @@ let MfaService = class MfaService {
         if (method === mfa_options_interface_1.MFAMethodEnum.EMAIL || method === mfa_options_interface_1.MFAMethodEnum.SMS) {
             const user = await this.userRepository.findOne({ where: { id: userId } });
             if (user) {
-                await this.eventEmitter.emitAsync(auth_constants_2.NestAuthEvents.TWO_FACTOR_CODE_SENT, new two_factor_code_sent_event_1.TwoFactorCodeSentEvent({
+                await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.TWO_FACTOR_CODE_SENT, new two_factor_code_sent_event_1.TwoFactorCodeSentEvent({
                     user,
                     tenantId: user.tenantId,
                     method,
@@ -263,20 +277,42 @@ let MfaService = class MfaService {
     async enableMFA(userId) {
         this.requireMfaEnabledForApp(true);
         if (!this.mfaConfig.allowUserToggle) {
-            throw new Error('MFA toggling is not allowed');
+            throw new common_1.ForbiddenException({
+                message: 'MFA toggling is not allowed',
+                code: auth_constants_1.ERROR_CODES.MFA_TOGGLING_NOT_ALLOWED,
+            });
         }
         const verifiedMethods = await this.getVerifiedMethods(userId);
         if (verifiedMethods.length === 0) {
-            throw new common_1.ForbiddenException('Cannot enable MFA without at least one verified method');
+            throw new common_1.ForbiddenException({
+                message: 'Cannot enable MFA without at least one verified method',
+                code: auth_constants_1.ERROR_CODES.MFA_CANNOT_ENABLE_WITHOUT_METHOD,
+            });
         }
         await this.userRepository.update(userId, { isMfaEnabled: true });
+        const user = await this.userRepository.findOne({ where: { id: userId } });
+        if (user) {
+            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.TWO_FACTOR_ENABLED, new user_2fa_enabled_event_1.User2faEnabledEvent({
+                user,
+                method: verifiedMethods[0] // Default to first verified method
+            }));
+        }
     }
     async disableMFA(userId) {
         this.checkIsMfaEnabledForApp(true);
         if (!this.mfaConfig.allowUserToggle) {
-            throw new Error('MFA toggling is not allowed');
+            throw new common_1.ForbiddenException({
+                message: 'MFA toggling is not allowed',
+                code: auth_constants_1.ERROR_CODES.MFA_TOGGLING_NOT_ALLOWED,
+            });
         }
         await this.userRepository.update(userId, { isMfaEnabled: false });
+        const user = await this.userRepository.findOne({ where: { id: userId } });
+        if (user) {
+            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.TWO_FACTOR_DISABLED, new user_2fa_disabled_event_1.User2faDisabledEvent({
+                user
+            }));
+        }
     }
     async removeTotpDevice(deviceId) {
         this.checkIsMfaEnabledForApp(true);
@@ -296,7 +332,7 @@ let MfaService = class MfaService {
         if (!user) {
             throw new common_1.UnauthorizedException({
                 message: 'User not found',
-                code: auth_constants_1.USER_NOT_FOUND_EXCEPTION_CODE
+                code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND
             });
         }
         if (user.mfaRecoveryCode === code) {
@@ -310,7 +346,7 @@ let MfaService = class MfaService {
         }
         throw new common_1.UnauthorizedException({
             message: 'Invalid recovery code',
-            code: auth_constants_1.INVALID_MFA_EXCEPTION_CODE
+            code: auth_constants_1.ERROR_CODES.MFA_RECOVERY_CODE_INVALID
         });
     }
     getAvailableMethods() {

package/src/lib/auth.constants.d.ts

@@ -7,14 +7,184 @@ export declare const APPLE_AUTH_PROVIDER = "apple";
 export declare const GITHUB_AUTH_PROVIDER = "github";
 export declare const EMAIL_AUTH_PROVIDER = "email";
 export declare const PHONE_AUTH_PROVIDER = "phone";
-export declare const USER_NOT_FOUND_EXCEPTION_CODE = "USER_NOT_FOUND";
-export declare const UNAUTHORIZED_EXCEPTION_CODE = "UNAUTHORIZED";
-export declare const INVALID_MFA_EXCEPTION_CODE = "INVALID_MFA";
-export declare const INVALID_REFRESH_TOKEN_EXCEPTION_CODE = "INVALID_REFRESH_TOKEN";
-export declare const SESSION_NOT_FOUND_ERROR = "SESSION_NOT_FOUND";
-export declare const USER_NOT_ACTIVE_ERROR = "USER_NOT_ACTIVE";
-export declare const REFRESH_TOKEN_INVALID = "REFRESH_TOKEN_INVALID";
-export declare const REFRESH_TOKEN_EXPIRED = "REFRESH_TOKEN_EXPIRED";
+export declare const AUTH_ERROR_CODES: {
+    readonly REGISTRATION_DISABLED: "REGISTRATION_DISABLED";
+    readonly EMAIL_ALREADY_EXISTS: "EMAIL_ALREADY_EXISTS";
+    readonly PHONE_ALREADY_EXISTS: "PHONE_ALREADY_EXISTS";
+    readonly PROVIDER_NOT_FOUND: "PROVIDER_NOT_FOUND";
+    readonly INVALID_CREDENTIALS: "INVALID_CREDENTIALS";
+    readonly INVALID_PROVIDER: "INVALID_PROVIDER";
+    readonly MISSING_REQUIRED_FIELDS: "MISSING_REQUIRED_FIELDS";
+    readonly USER_NOT_FOUND: "USER_NOT_FOUND";
+    readonly ACCOUNT_SUSPENDED: "ACCOUNT_SUSPENDED";
+    readonly ACCOUNT_INACTIVE: "ACCOUNT_INACTIVE";
+    readonly EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED";
+    readonly CURRENT_PASSWORD_INCORRECT: "CURRENT_PASSWORD_INCORRECT";
+    readonly NEW_PASSWORD_SAME_AS_CURRENT: "NEW_PASSWORD_SAME_AS_CURRENT";
+    readonly PASSWORD_RESET_INVALID_REQUEST: "PASSWORD_RESET_INVALID_REQUEST";
+    readonly PASSWORD_RESET_TOKEN_INVALID: "PASSWORD_RESET_TOKEN_INVALID";
+    readonly PASSWORD_RESET_TOKEN_EXPIRED: "PASSWORD_RESET_TOKEN_EXPIRED";
+    readonly REFRESH_TOKEN_INVALID: "REFRESH_TOKEN_INVALID";
+    readonly REFRESH_TOKEN_EXPIRED: "REFRESH_TOKEN_EXPIRED";
+    readonly INVALID_TOKEN: "INVALID_TOKEN";
+    readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
+    readonly EMAIL_ALREADY_VERIFIED: "EMAIL_ALREADY_VERIFIED";
+    readonly VERIFICATION_CODE_INVALID: "VERIFICATION_CODE_INVALID";
+    readonly VERIFICATION_CODE_EXPIRED: "VERIFICATION_CODE_EXPIRED";
+    readonly NO_EMAIL_ADDRESS: "NO_EMAIL_ADDRESS";
+    readonly NO_PHONE_NUMBER: "NO_PHONE_NUMBER";
+};
+export declare const MFA_ERROR_CODES: {
+    readonly MFA_NOT_ENABLED: "MFA_NOT_ENABLED";
+    readonly MFA_REQUIRED: "MFA_REQUIRED";
+    readonly MFA_CODE_INVALID: "MFA_CODE_INVALID";
+    readonly MFA_CODE_EXPIRED: "MFA_CODE_EXPIRED";
+    readonly MFA_METHOD_NOT_AVAILABLE: "MFA_METHOD_NOT_AVAILABLE";
+    readonly MFA_TOGGLING_NOT_ALLOWED: "MFA_TOGGLING_NOT_ALLOWED";
+    readonly MFA_CANNOT_ENABLE_WITHOUT_METHOD: "MFA_CANNOT_ENABLE_WITHOUT_METHOD";
+    readonly MFA_RECOVERY_CODE_INVALID: "MFA_RECOVERY_CODE_INVALID";
+    readonly TOTP_SETUP_FAILED: "TOTP_SETUP_FAILED";
+    readonly TOTP_VERIFICATION_FAILED: "TOTP_VERIFICATION_FAILED";
+};
+export declare const SESSION_ERROR_CODES: {
+    readonly SESSION_NOT_FOUND: "SESSION_NOT_FOUND";
+    readonly SESSION_EXPIRED: "SESSION_EXPIRED";
+    readonly SESSION_INVALID: "SESSION_INVALID";
+    readonly MAX_SESSIONS_REACHED: "MAX_SESSIONS_REACHED";
+};
+export declare const GUARD_ERROR_CODES: {
+    readonly NO_AUTH_PROVIDED: "NO_AUTH_PROVIDED";
+    readonly INVALID_AUTH_FORMAT: "INVALID_AUTH_FORMAT";
+    readonly INVALID_AUTH_TYPE: "INVALID_AUTH_TYPE";
+    readonly UNAUTHORIZED: "UNAUTHORIZED";
+    readonly ACCESS_DENIED: "ACCESS_DENIED";
+    readonly FORBIDDEN: "FORBIDDEN";
+    readonly NO_ROLES_ASSIGNED: "NO_ROLES_ASSIGNED";
+    readonly MISSING_REQUIRED_ROLES: "MISSING_REQUIRED_ROLES";
+    readonly MISSING_REQUIRED_PERMISSIONS: "MISSING_REQUIRED_PERMISSIONS";
+};
+export declare const API_KEY_ERROR_CODES: {
+    readonly INVALID_API_KEY_FORMAT: "INVALID_API_KEY_FORMAT";
+    readonly INVALID_API_KEY: "INVALID_API_KEY";
+    readonly API_KEY_EXPIRED: "API_KEY_EXPIRED";
+    readonly API_KEY_DEACTIVATED: "API_KEY_DEACTIVATED";
+    readonly API_KEY_NOT_FOUND: "API_KEY_NOT_FOUND";
+};
+export declare const VALIDATION_ERROR_CODES: {
+    readonly EMAIL_OR_PHONE_REQUIRED: "EMAIL_OR_PHONE_REQUIRED";
+    readonly TENANT_ID_REQUIRED: "TENANT_ID_REQUIRED";
+    readonly INVALID_INPUT: "INVALID_INPUT";
+    readonly MISSING_REQUIRED_FIELD: "MISSING_REQUIRED_FIELD";
+    readonly INVALID_EMAIL_FORMAT: "INVALID_EMAIL_FORMAT";
+    readonly INVALID_PHONE_FORMAT: "INVALID_PHONE_FORMAT";
+};
+export declare const OTP_ERROR_CODES: {
+    readonly OTP_INVALID: "OTP_INVALID";
+    readonly OTP_EXPIRED: "OTP_EXPIRED";
+    readonly OTP_ALREADY_USED: "OTP_ALREADY_USED";
+    readonly OTP_NOT_FOUND: "OTP_NOT_FOUND";
+};
+export declare const USER_ERROR_CODES: {
+    readonly USER_NOT_FOUND: "USER_NOT_FOUND";
+    readonly USER_ALREADY_EXISTS: "USER_ALREADY_EXISTS";
+    readonly USER_CREATION_FAILED: "USER_CREATION_FAILED";
+    readonly USER_UPDATE_FAILED: "USER_UPDATE_FAILED";
+    readonly USER_DELETION_FAILED: "USER_DELETION_FAILED";
+};
+export declare const TENANT_ERROR_CODES: {
+    readonly TENANT_NOT_FOUND: "TENANT_NOT_FOUND";
+    readonly TENANT_ALREADY_EXISTS: "TENANT_ALREADY_EXISTS";
+    readonly INVALID_TENANT: "INVALID_TENANT";
+};
+export declare const ERROR_CODES: {
+    readonly TENANT_NOT_FOUND: "TENANT_NOT_FOUND";
+    readonly TENANT_ALREADY_EXISTS: "TENANT_ALREADY_EXISTS";
+    readonly INVALID_TENANT: "INVALID_TENANT";
+    readonly USER_NOT_FOUND: "USER_NOT_FOUND";
+    readonly USER_ALREADY_EXISTS: "USER_ALREADY_EXISTS";
+    readonly USER_CREATION_FAILED: "USER_CREATION_FAILED";
+    readonly USER_UPDATE_FAILED: "USER_UPDATE_FAILED";
+    readonly USER_DELETION_FAILED: "USER_DELETION_FAILED";
+    readonly OTP_INVALID: "OTP_INVALID";
+    readonly OTP_EXPIRED: "OTP_EXPIRED";
+    readonly OTP_ALREADY_USED: "OTP_ALREADY_USED";
+    readonly OTP_NOT_FOUND: "OTP_NOT_FOUND";
+    readonly EMAIL_OR_PHONE_REQUIRED: "EMAIL_OR_PHONE_REQUIRED";
+    readonly TENANT_ID_REQUIRED: "TENANT_ID_REQUIRED";
+    readonly INVALID_INPUT: "INVALID_INPUT";
+    readonly MISSING_REQUIRED_FIELD: "MISSING_REQUIRED_FIELD";
+    readonly INVALID_EMAIL_FORMAT: "INVALID_EMAIL_FORMAT";
+    readonly INVALID_PHONE_FORMAT: "INVALID_PHONE_FORMAT";
+    readonly INVALID_API_KEY_FORMAT: "INVALID_API_KEY_FORMAT";
+    readonly INVALID_API_KEY: "INVALID_API_KEY";
+    readonly API_KEY_EXPIRED: "API_KEY_EXPIRED";
+    readonly API_KEY_DEACTIVATED: "API_KEY_DEACTIVATED";
+    readonly API_KEY_NOT_FOUND: "API_KEY_NOT_FOUND";
+    readonly NO_AUTH_PROVIDED: "NO_AUTH_PROVIDED";
+    readonly INVALID_AUTH_FORMAT: "INVALID_AUTH_FORMAT";
+    readonly INVALID_AUTH_TYPE: "INVALID_AUTH_TYPE";
+    readonly UNAUTHORIZED: "UNAUTHORIZED";
+    readonly ACCESS_DENIED: "ACCESS_DENIED";
+    readonly FORBIDDEN: "FORBIDDEN";
+    readonly NO_ROLES_ASSIGNED: "NO_ROLES_ASSIGNED";
+    readonly MISSING_REQUIRED_ROLES: "MISSING_REQUIRED_ROLES";
+    readonly MISSING_REQUIRED_PERMISSIONS: "MISSING_REQUIRED_PERMISSIONS";
+    readonly SESSION_NOT_FOUND: "SESSION_NOT_FOUND";
+    readonly SESSION_EXPIRED: "SESSION_EXPIRED";
+    readonly SESSION_INVALID: "SESSION_INVALID";
+    readonly MAX_SESSIONS_REACHED: "MAX_SESSIONS_REACHED";
+    readonly MFA_NOT_ENABLED: "MFA_NOT_ENABLED";
+    readonly MFA_REQUIRED: "MFA_REQUIRED";
+    readonly MFA_CODE_INVALID: "MFA_CODE_INVALID";
+    readonly MFA_CODE_EXPIRED: "MFA_CODE_EXPIRED";
+    readonly MFA_METHOD_NOT_AVAILABLE: "MFA_METHOD_NOT_AVAILABLE";
+    readonly MFA_TOGGLING_NOT_ALLOWED: "MFA_TOGGLING_NOT_ALLOWED";
+    readonly MFA_CANNOT_ENABLE_WITHOUT_METHOD: "MFA_CANNOT_ENABLE_WITHOUT_METHOD";
+    readonly MFA_RECOVERY_CODE_INVALID: "MFA_RECOVERY_CODE_INVALID";
+    readonly TOTP_SETUP_FAILED: "TOTP_SETUP_FAILED";
+    readonly TOTP_VERIFICATION_FAILED: "TOTP_VERIFICATION_FAILED";
+    readonly REGISTRATION_DISABLED: "REGISTRATION_DISABLED";
+    readonly EMAIL_ALREADY_EXISTS: "EMAIL_ALREADY_EXISTS";
+    readonly PHONE_ALREADY_EXISTS: "PHONE_ALREADY_EXISTS";
+    readonly PROVIDER_NOT_FOUND: "PROVIDER_NOT_FOUND";
+    readonly INVALID_CREDENTIALS: "INVALID_CREDENTIALS";
+    readonly INVALID_PROVIDER: "INVALID_PROVIDER";
+    readonly MISSING_REQUIRED_FIELDS: "MISSING_REQUIRED_FIELDS";
+    readonly ACCOUNT_SUSPENDED: "ACCOUNT_SUSPENDED";
+    readonly ACCOUNT_INACTIVE: "ACCOUNT_INACTIVE";
+    readonly EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED";
+    readonly CURRENT_PASSWORD_INCORRECT: "CURRENT_PASSWORD_INCORRECT";
+    readonly NEW_PASSWORD_SAME_AS_CURRENT: "NEW_PASSWORD_SAME_AS_CURRENT";
+    readonly PASSWORD_RESET_INVALID_REQUEST: "PASSWORD_RESET_INVALID_REQUEST";
+    readonly PASSWORD_RESET_TOKEN_INVALID: "PASSWORD_RESET_TOKEN_INVALID";
+    readonly PASSWORD_RESET_TOKEN_EXPIRED: "PASSWORD_RESET_TOKEN_EXPIRED";
+    readonly REFRESH_TOKEN_INVALID: "REFRESH_TOKEN_INVALID";
+    readonly REFRESH_TOKEN_EXPIRED: "REFRESH_TOKEN_EXPIRED";
+    readonly INVALID_TOKEN: "INVALID_TOKEN";
+    readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
+    readonly EMAIL_ALREADY_VERIFIED: "EMAIL_ALREADY_VERIFIED";
+    readonly VERIFICATION_CODE_INVALID: "VERIFICATION_CODE_INVALID";
+    readonly VERIFICATION_CODE_EXPIRED: "VERIFICATION_CODE_EXPIRED";
+    readonly NO_EMAIL_ADDRESS: "NO_EMAIL_ADDRESS";
+    readonly NO_PHONE_NUMBER: "NO_PHONE_NUMBER";
+};
+export type ErrorCode = typeof ERROR_CODES[keyof typeof ERROR_CODES];
+/** @deprecated Use ERROR_CODES.USER_NOT_FOUND instead */
+export declare const USER_NOT_FOUND_EXCEPTION_CODE: "USER_NOT_FOUND";
+/** @deprecated Use ERROR_CODES.UNAUTHORIZED instead */
+export declare const UNAUTHORIZED_EXCEPTION_CODE: "UNAUTHORIZED";
+/** @deprecated Use ERROR_CODES.MFA_CODE_INVALID instead */
+export declare const INVALID_MFA_EXCEPTION_CODE: "MFA_CODE_INVALID";
+/** @deprecated Use ERROR_CODES.REFRESH_TOKEN_INVALID instead */
+export declare const INVALID_REFRESH_TOKEN_EXCEPTION_CODE: "REFRESH_TOKEN_INVALID";
+/** @deprecated Use ERROR_CODES.SESSION_NOT_FOUND instead */
+export declare const SESSION_NOT_FOUND_ERROR: "SESSION_NOT_FOUND";
+/** @deprecated Use ERROR_CODES.ACCOUNT_INACTIVE instead */
+export declare const USER_NOT_ACTIVE_ERROR: "ACCOUNT_INACTIVE";
+/** @deprecated Use ERROR_CODES.REFRESH_TOKEN_INVALID instead */
+export declare const REFRESH_TOKEN_INVALID: "REFRESH_TOKEN_INVALID";
+/** @deprecated Use ERROR_CODES.REFRESH_TOKEN_EXPIRED instead */
+export declare const REFRESH_TOKEN_EXPIRED: "REFRESH_TOKEN_EXPIRED";
 export declare const ACCESS_TOKEN_COOKIE_NAME = "accessToken";
 export declare const REFRESH_TOKEN_COOKIE_NAME = "refreshToken";
 export declare const NEST_AUTH_TRUST_DEVICE_KEY = "nest_auth_device_trust";
@@ -31,6 +201,9 @@ export declare const NestAuthEvents: {
     readonly PASSWORD_RESET: "nest_auth.password_reset";
     readonly LOGGED_OUT: "nest_auth.logged_out";
     readonly LOGGED_OUT_ALL: "nest_auth.logged_out_all";
+    readonly PASSWORD_CHANGED: "nest_auth.password_changed";
+    readonly TWO_FACTOR_ENABLED: "nest_auth.two_factor_enabled";
+    readonly TWO_FACTOR_DISABLED: "nest_auth.two_factor_disabled";
     readonly USER_CREATED: "nest_auth.user.created";
     readonly USER_UPDATED: "nest_auth.user.updated";
     readonly USER_DELETED: "nest_auth.user.deleted";

package/src/lib/auth.constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.constants.d.ts","sourceRoot":"","sources":["../../../../../packages/nest-auth/src/lib/auth.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,kCAAkC,CAAC;AACnE,eAAO,MAAM,gCAAgC,qCAAqC,CAAC;AAInF,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AACvC,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C,eAAO,MAAM,sBAAsB,aAAa,CAAC;AACjD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAI3C,eAAO,MAAM,6BAA6B,mBAAmB,CAAC;AAC9D,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAC1D,eAAO,MAAM,0BAA0B,gBAAgB,CAAC;AACxD,eAAO,MAAM,oCAAoC,0BAA0B,CAAC;AAC5E,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAC3D,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAEvD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAI7D,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AACtD,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAExD,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAGnE,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAGxC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;CA6BjB,CAAC"}
+{"version":3,"file":"auth.constants.d.ts","sourceRoot":"","sources":["../../../../../packages/nest-auth/src/lib/auth.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,kCAAkC,CAAC;AACnE,eAAO,MAAM,gCAAgC,qCAAqC,CAAC;AAInF,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AACvC,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C,eAAO,MAAM,sBAAsB,aAAa,CAAC;AACjD,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAC7C,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAQ3C,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCnB,CAAC;AAGX,eAAO,MAAM,eAAe;;;;;;;;;;;CAWlB,CAAC;AAGX,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAGX,eAAO,MAAM,iBAAiB;;;;;;;;;;CAUpB,CAAC;AAGX,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAGX,eAAO,MAAM,sBAAsB;;;;;;;CAOzB,CAAC;AAGX,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAGX,eAAO,MAAM,gBAAgB;;;;;;CAMnB,CAAC;AAGX,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAGX,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUd,CAAC;AAGX,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAKrE,yDAAyD;AACzD,eAAO,MAAM,6BAA6B,kBAAkC,CAAC;AAC7E,uDAAuD;AACvD,eAAO,MAAM,2BAA2B,gBAAiC,CAAC;AAC1E,2DAA2D;AAC3D,eAAO,MAAM,0BAA0B,oBAAmC,CAAC;AAC3E,gEAAgE;AAChE,eAAO,MAAM,oCAAoC,yBAAyC,CAAC;AAC3F,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,qBAAwC,CAAC;AAC7E,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,oBAAoC,CAAC;AACvE,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,yBAAyC,CAAC;AAC5E,gEAAgE;AAChE,eAAO,MAAM,qBAAqB,yBAAyC,CAAC;AAI5E,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AACtD,eAAO,MAAM,yBAAyB,iBAAiB,CAAC;AAExD,eAAO,MAAM,0BAA0B,2BAA2B,CAAC;AAGnE,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AAGxC,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;CAgCjB,CAAC"}

package/src/lib/auth.constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NestAuthEvents = exports.DEFAULT_GUARD_NAME = exports.NEST_AUTH_TRUST_DEVICE_KEY = exports.REFRESH_TOKEN_COOKIE_NAME = exports.ACCESS_TOKEN_COOKIE_NAME = exports.REFRESH_TOKEN_EXPIRED = exports.REFRESH_TOKEN_INVALID = exports.USER_NOT_ACTIVE_ERROR = exports.SESSION_NOT_FOUND_ERROR = exports.INVALID_REFRESH_TOKEN_EXCEPTION_CODE = exports.INVALID_MFA_EXCEPTION_CODE = exports.UNAUTHORIZED_EXCEPTION_CODE = exports.USER_NOT_FOUND_EXCEPTION_CODE = exports.PHONE_AUTH_PROVIDER = exports.EMAIL_AUTH_PROVIDER = exports.GITHUB_AUTH_PROVIDER = exports.APPLE_AUTH_PROVIDER = exports.FACEBOOK_AUTH_PROVIDER = exports.GOOGLE_AUTH_PROVIDER = exports.JWT_AUTH_PROVIDER = exports.NEST_AUTH_ASYNC_OPTIONS_PROVIDER = exports.AUTH_MODULE_OPTIONS = void 0;
+exports.NestAuthEvents = exports.DEFAULT_GUARD_NAME = exports.NEST_AUTH_TRUST_DEVICE_KEY = exports.REFRESH_TOKEN_COOKIE_NAME = exports.ACCESS_TOKEN_COOKIE_NAME = exports.REFRESH_TOKEN_EXPIRED = exports.REFRESH_TOKEN_INVALID = exports.USER_NOT_ACTIVE_ERROR = exports.SESSION_NOT_FOUND_ERROR = exports.INVALID_REFRESH_TOKEN_EXCEPTION_CODE = exports.INVALID_MFA_EXCEPTION_CODE = exports.UNAUTHORIZED_EXCEPTION_CODE = exports.USER_NOT_FOUND_EXCEPTION_CODE = exports.ERROR_CODES = exports.TENANT_ERROR_CODES = exports.USER_ERROR_CODES = exports.OTP_ERROR_CODES = exports.VALIDATION_ERROR_CODES = exports.API_KEY_ERROR_CODES = exports.GUARD_ERROR_CODES = exports.SESSION_ERROR_CODES = exports.MFA_ERROR_CODES = exports.AUTH_ERROR_CODES = exports.PHONE_AUTH_PROVIDER = exports.EMAIL_AUTH_PROVIDER = exports.GITHUB_AUTH_PROVIDER = exports.APPLE_AUTH_PROVIDER = exports.FACEBOOK_AUTH_PROVIDER = exports.GOOGLE_AUTH_PROVIDER = exports.JWT_AUTH_PROVIDER = exports.NEST_AUTH_ASYNC_OPTIONS_PROVIDER = exports.AUTH_MODULE_OPTIONS = void 0;
 exports.AUTH_MODULE_OPTIONS = 'NEST_AUTH_AUTH_MODULE_OPTIONS';
 exports.NEST_AUTH_ASYNC_OPTIONS_PROVIDER = 'NEST_AUTH_ASYNC_OPTIONS_PROVIDER';
 // Provider tokens
@@ -11,15 +11,144 @@ exports.APPLE_AUTH_PROVIDER = 'apple';
 exports.GITHUB_AUTH_PROVIDER = 'github';
 exports.EMAIL_AUTH_PROVIDER = 'email';
 exports.PHONE_AUTH_PROVIDER = 'phone';
-// Exception codes
-exports.USER_NOT_FOUND_EXCEPTION_CODE = 'USER_NOT_FOUND';
-exports.UNAUTHORIZED_EXCEPTION_CODE = 'UNAUTHORIZED';
-exports.INVALID_MFA_EXCEPTION_CODE = 'INVALID_MFA';
-exports.INVALID_REFRESH_TOKEN_EXCEPTION_CODE = 'INVALID_REFRESH_TOKEN';
-exports.SESSION_NOT_FOUND_ERROR = 'SESSION_NOT_FOUND';
-exports.USER_NOT_ACTIVE_ERROR = 'USER_NOT_ACTIVE';
-exports.REFRESH_TOKEN_INVALID = 'REFRESH_TOKEN_INVALID';
-exports.REFRESH_TOKEN_EXPIRED = 'REFRESH_TOKEN_EXPIRED';
+// ==========================================
+// ERROR CODES - Categorized for better organization
+// ==========================================
+// Authentication Error Codes
+exports.AUTH_ERROR_CODES = {
+    // Signup/Registration
+    REGISTRATION_DISABLED: 'REGISTRATION_DISABLED',
+    EMAIL_ALREADY_EXISTS: 'EMAIL_ALREADY_EXISTS',
+    PHONE_ALREADY_EXISTS: 'PHONE_ALREADY_EXISTS',
+    PROVIDER_NOT_FOUND: 'PROVIDER_NOT_FOUND',
+    // Login
+    INVALID_CREDENTIALS: 'INVALID_CREDENTIALS',
+    INVALID_PROVIDER: 'INVALID_PROVIDER',
+    MISSING_REQUIRED_FIELDS: 'MISSING_REQUIRED_FIELDS',
+    // Account Status
+    USER_NOT_FOUND: 'USER_NOT_FOUND',
+    ACCOUNT_SUSPENDED: 'ACCOUNT_SUSPENDED',
+    ACCOUNT_INACTIVE: 'ACCOUNT_INACTIVE',
+    EMAIL_NOT_VERIFIED: 'EMAIL_NOT_VERIFIED',
+    // Password
+    CURRENT_PASSWORD_INCORRECT: 'CURRENT_PASSWORD_INCORRECT',
+    NEW_PASSWORD_SAME_AS_CURRENT: 'NEW_PASSWORD_SAME_AS_CURRENT',
+    PASSWORD_RESET_INVALID_REQUEST: 'PASSWORD_RESET_INVALID_REQUEST',
+    PASSWORD_RESET_TOKEN_INVALID: 'PASSWORD_RESET_TOKEN_INVALID',
+    PASSWORD_RESET_TOKEN_EXPIRED: 'PASSWORD_RESET_TOKEN_EXPIRED',
+    // Tokens
+    REFRESH_TOKEN_INVALID: 'REFRESH_TOKEN_INVALID',
+    REFRESH_TOKEN_EXPIRED: 'REFRESH_TOKEN_EXPIRED',
+    INVALID_TOKEN: 'INVALID_TOKEN',
+    TOKEN_EXPIRED: 'TOKEN_EXPIRED',
+    // Email Verification
+    EMAIL_ALREADY_VERIFIED: 'EMAIL_ALREADY_VERIFIED',
+    VERIFICATION_CODE_INVALID: 'VERIFICATION_CODE_INVALID',
+    VERIFICATION_CODE_EXPIRED: 'VERIFICATION_CODE_EXPIRED',
+    NO_EMAIL_ADDRESS: 'NO_EMAIL_ADDRESS',
+    NO_PHONE_NUMBER: 'NO_PHONE_NUMBER',
+};
+// MFA Error Codes
+exports.MFA_ERROR_CODES = {
+    MFA_NOT_ENABLED: 'MFA_NOT_ENABLED',
+    MFA_REQUIRED: 'MFA_REQUIRED',
+    MFA_CODE_INVALID: 'MFA_CODE_INVALID',
+    MFA_CODE_EXPIRED: 'MFA_CODE_EXPIRED',
+    MFA_METHOD_NOT_AVAILABLE: 'MFA_METHOD_NOT_AVAILABLE',
+    MFA_TOGGLING_NOT_ALLOWED: 'MFA_TOGGLING_NOT_ALLOWED',
+    MFA_CANNOT_ENABLE_WITHOUT_METHOD: 'MFA_CANNOT_ENABLE_WITHOUT_METHOD',
+    MFA_RECOVERY_CODE_INVALID: 'MFA_RECOVERY_CODE_INVALID',
+    TOTP_SETUP_FAILED: 'TOTP_SETUP_FAILED',
+    TOTP_VERIFICATION_FAILED: 'TOTP_VERIFICATION_FAILED',
+};
+// Session Error Codes
+exports.SESSION_ERROR_CODES = {
+    SESSION_NOT_FOUND: 'SESSION_NOT_FOUND',
+    SESSION_EXPIRED: 'SESSION_EXPIRED',
+    SESSION_INVALID: 'SESSION_INVALID',
+    MAX_SESSIONS_REACHED: 'MAX_SESSIONS_REACHED',
+};
+// Guard Error Codes
+exports.GUARD_ERROR_CODES = {
+    NO_AUTH_PROVIDED: 'NO_AUTH_PROVIDED',
+    INVALID_AUTH_FORMAT: 'INVALID_AUTH_FORMAT',
+    INVALID_AUTH_TYPE: 'INVALID_AUTH_TYPE',
+    UNAUTHORIZED: 'UNAUTHORIZED',
+    ACCESS_DENIED: 'ACCESS_DENIED',
+    FORBIDDEN: 'FORBIDDEN',
+    NO_ROLES_ASSIGNED: 'NO_ROLES_ASSIGNED',
+    MISSING_REQUIRED_ROLES: 'MISSING_REQUIRED_ROLES',
+    MISSING_REQUIRED_PERMISSIONS: 'MISSING_REQUIRED_PERMISSIONS',
+};
+// API Key Error Codes
+exports.API_KEY_ERROR_CODES = {
+    INVALID_API_KEY_FORMAT: 'INVALID_API_KEY_FORMAT',
+    INVALID_API_KEY: 'INVALID_API_KEY',
+    API_KEY_EXPIRED: 'API_KEY_EXPIRED',
+    API_KEY_DEACTIVATED: 'API_KEY_DEACTIVATED',
+    API_KEY_NOT_FOUND: 'API_KEY_NOT_FOUND',
+};
+// Validation Error Codes
+exports.VALIDATION_ERROR_CODES = {
+    EMAIL_OR_PHONE_REQUIRED: 'EMAIL_OR_PHONE_REQUIRED',
+    TENANT_ID_REQUIRED: 'TENANT_ID_REQUIRED',
+    INVALID_INPUT: 'INVALID_INPUT',
+    MISSING_REQUIRED_FIELD: 'MISSING_REQUIRED_FIELD',
+    INVALID_EMAIL_FORMAT: 'INVALID_EMAIL_FORMAT',
+    INVALID_PHONE_FORMAT: 'INVALID_PHONE_FORMAT',
+};
+// OTP Error Codes
+exports.OTP_ERROR_CODES = {
+    OTP_INVALID: 'OTP_INVALID',
+    OTP_EXPIRED: 'OTP_EXPIRED',
+    OTP_ALREADY_USED: 'OTP_ALREADY_USED',
+    OTP_NOT_FOUND: 'OTP_NOT_FOUND',
+};
+// User Management Error Codes
+exports.USER_ERROR_CODES = {
+    USER_NOT_FOUND: 'USER_NOT_FOUND',
+    USER_ALREADY_EXISTS: 'USER_ALREADY_EXISTS',
+    USER_CREATION_FAILED: 'USER_CREATION_FAILED',
+    USER_UPDATE_FAILED: 'USER_UPDATE_FAILED',
+    USER_DELETION_FAILED: 'USER_DELETION_FAILED',
+};
+// Tenant Error Codes
+exports.TENANT_ERROR_CODES = {
+    TENANT_NOT_FOUND: 'TENANT_NOT_FOUND',
+    TENANT_ALREADY_EXISTS: 'TENANT_ALREADY_EXISTS',
+    INVALID_TENANT: 'INVALID_TENANT',
+};
+// Consolidated Error Codes (for easy access)
+exports.ERROR_CODES = {
+    ...exports.AUTH_ERROR_CODES,
+    ...exports.MFA_ERROR_CODES,
+    ...exports.SESSION_ERROR_CODES,
+    ...exports.GUARD_ERROR_CODES,
+    ...exports.API_KEY_ERROR_CODES,
+    ...exports.VALIDATION_ERROR_CODES,
+    ...exports.OTP_ERROR_CODES,
+    ...exports.USER_ERROR_CODES,
+    ...exports.TENANT_ERROR_CODES,
+};
+// ==========================================
+// LEGACY ERROR CODES (For backward compatibility)
+// ==========================================
+/** @deprecated Use ERROR_CODES.USER_NOT_FOUND instead */
+exports.USER_NOT_FOUND_EXCEPTION_CODE = exports.AUTH_ERROR_CODES.USER_NOT_FOUND;
+/** @deprecated Use ERROR_CODES.UNAUTHORIZED instead */
+exports.UNAUTHORIZED_EXCEPTION_CODE = exports.GUARD_ERROR_CODES.UNAUTHORIZED;
+/** @deprecated Use ERROR_CODES.MFA_CODE_INVALID instead */
+exports.INVALID_MFA_EXCEPTION_CODE = exports.MFA_ERROR_CODES.MFA_CODE_INVALID;
+/** @deprecated Use ERROR_CODES.REFRESH_TOKEN_INVALID instead */
+exports.INVALID_REFRESH_TOKEN_EXCEPTION_CODE = exports.AUTH_ERROR_CODES.REFRESH_TOKEN_INVALID;
+/** @deprecated Use ERROR_CODES.SESSION_NOT_FOUND instead */
+exports.SESSION_NOT_FOUND_ERROR = exports.SESSION_ERROR_CODES.SESSION_NOT_FOUND;
+/** @deprecated Use ERROR_CODES.ACCOUNT_INACTIVE instead */
+exports.USER_NOT_ACTIVE_ERROR = exports.AUTH_ERROR_CODES.ACCOUNT_INACTIVE;
+/** @deprecated Use ERROR_CODES.REFRESH_TOKEN_INVALID instead */
+exports.REFRESH_TOKEN_INVALID = exports.AUTH_ERROR_CODES.REFRESH_TOKEN_INVALID;
+/** @deprecated Use ERROR_CODES.REFRESH_TOKEN_EXPIRED instead */
+exports.REFRESH_TOKEN_EXPIRED = exports.AUTH_ERROR_CODES.REFRESH_TOKEN_EXPIRED;
 // Auth Cookie Names
 exports.ACCESS_TOKEN_COOKIE_NAME = 'accessToken';
 exports.REFRESH_TOKEN_COOKIE_NAME = 'refreshToken';
@@ -40,6 +169,9 @@ exports.NestAuthEvents = {
     PASSWORD_RESET: 'nest_auth.password_reset',
     LOGGED_OUT: 'nest_auth.logged_out',
     LOGGED_OUT_ALL: 'nest_auth.logged_out_all',
+    PASSWORD_CHANGED: 'nest_auth.password_changed',
+    TWO_FACTOR_ENABLED: 'nest_auth.two_factor_enabled',
+    TWO_FACTOR_DISABLED: 'nest_auth.two_factor_disabled',
     // User events
     USER_CREATED: 'nest_auth.user.created',
     USER_UPDATED: 'nest_auth.user.updated',