@ackplus/nest-auth 1.1.24 → 1.1.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ackplus/nest-auth",
-  "version": "1.1.24",
+  "version": "1.1.25",
   "type": "commonjs",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",

package/src/lib/core/providers/google-auth.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-auth.provider.d.ts","sourceRoot":"","sources":["../../../../../../../packages/nest-auth/src/lib/core/providers/google-auth.provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAIrC,qBACa,kBAAmB,SAAQ,gBAAgB;IAMhD,QAAQ,CAAC,UAAU,EAAE,UAAU;IALnC,YAAY,SAAwB;IACpC,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,YAAY,CAA8B;gBAGrC,UAAU,EAAE,UAAU;IAenC;;;;;;OAMG;IACG,QAAQ,CAAC,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAA;KAAE;;;;;;;;;IA+DpE,iBAAiB,IAAI,MAAM,EAAE;CAGhC"}
+{"version":3,"file":"google-auth.provider.d.ts","sourceRoot":"","sources":["../../../../../../../packages/nest-auth/src/lib/core/providers/google-auth.provider.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAIrC,qBACa,kBAAmB,SAAQ,gBAAgB;IAMhD,QAAQ,CAAC,UAAU,EAAE,UAAU;IALnC,YAAY,SAAwB;IACpC,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,YAAY,CAA8B;gBAGrC,UAAU,EAAE,UAAU;IAenC;;;;;;OAMG;IACG,QAAQ,CAAC,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAA;KAAE;;;;;;;;;IA6EpE,iBAAiB,IAAI,MAAM,EAAE;CAGhC"}

package/src/lib/core/providers/google-auth.provider.js

@@ -46,48 +46,56 @@ let GoogleAuthProvider = class GoogleAuthProvider extends base_auth_provider_1.B
                 console.error('Google ID Token validation failed:', error);
                 throw new common_1.UnauthorizedException('Invalid Google ID token');
             }
+            // CASE 2: ACCESS TOKEN
         }
         else if (type === 'access') {
-            // CASE 2: Validation via Access Token
-            // Useful when the client only has an access token (implicit flow or mobile SDKs).
             try {
-                // Step 1: Verify the token info to ensure it's valid and for the correct app
+                // 1) Basic validation
                 const tokenInfo = await this.client.getTokenInfo(token);
-                // Optional: Verify audience if needed, though getTokenInfo validates validity
-                // if (tokenInfo.aud !== this.googleConfig.clientId) { ... }
-                if (!tokenInfo.email_verified) {
-                    throw new common_1.UnauthorizedException('Google email not verified');
-                }
-                // Step 2: Fetch user profile to get standard fields (sub, name, email, picture)
-                const response = await this.client.request({
-                    url: 'https://www.googleapis.com/oauth2/v3/userinfo',
+                // Optional / depends on scopes; don’t *assume* email_verified exists
+                // if ((tokenInfo as any).email_verified === false) {
+                //   throw new UnauthorizedException('Google email not verified');
+                // }
+                // 2) Fetch profile from userinfo endpoint (use plain fetch/axios)
+                const res = await fetch('https://www.googleapis.com/oauth2/v3/userinfo', {
                     headers: {
                         Authorization: `Bearer ${token}`,
                     },
                 });
-                payload = response.data;
+                if (!res.ok) {
+                    console.error('userinfo error status:', res.status, await res.text());
+                    throw new common_1.UnauthorizedException('Failed to fetch Google user info');
+                }
+                const userInfo = (await res.json());
+                payload = {
+                    ...userInfo,
+                    sub: tokenInfo.sub ?? userInfo.sub,
+                    email: userInfo.email ?? tokenInfo.email,
+                    name: userInfo.name,
+                    picture: userInfo.picture,
+                    locale: userInfo.locale,
+                };
             }
             catch (error) {
                 console.error('Google Access Token validation failed:', error);
                 throw new common_1.UnauthorizedException('Invalid Google Access token');
             }
-            if (!payload) {
-                throw new common_1.UnauthorizedException(`Invalid Google ${type} token`);
-            }
-            return {
-                userId: payload.sub,
-                email: payload.email || '',
-                metadata: {
-                    name: payload.name,
-                    picture: payload.picture,
-                    locale: payload.locale,
-                },
-            };
         }
         else {
-            // CASE 3: No valid credentials provided
-            throw new common_1.UnauthorizedException('Missing required Google credentials (idToken or accessToken)');
+            throw new common_1.UnauthorizedException('Missing or invalid Google token type (id | access) in credentials');
+        }
+        if (!payload || !payload.sub) {
+            throw new common_1.UnauthorizedException(`Invalid Google ${type} token`);
         }
+        return {
+            userId: payload.sub,
+            email: payload.email || '',
+            metadata: {
+                name: payload.name,
+                picture: payload.picture,
+                locale: payload.locale,
+            },
+        };
     }
     getRequiredFields() {
         return ['token'];