@ambushsoftworks/nestjs-auth-graphql 0.11.0 → 0.12.0

package/dist/strategies/external-jwt.strategy.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_EXTERNAL_JWT_MAX_BYTES = void 0;
+exports.createExternalJwtStrategy = createExternalJwtStrategy;
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const passport_jwt_1 = require("passport-jwt");
+const invalid_auth_config_exception_1 = require("../exceptions/invalid-auth-config.exception");
+const HMAC_ALGORITHMS = ['HS256', 'HS384', 'HS512'];
+const ASYMMETRIC_ALGORITHMS = ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'ES256', 'ES384', 'ES512'];
+const RESERVED_NAMES = ['jwt', 'api-key'];
+exports.DEFAULT_EXTERNAL_JWT_MAX_BYTES = 8192;
+function createExternalJwtStrategy(name, config) {
+    assertName(name);
+    const logger = new common_1.Logger(`ExternalJwtStrategy:${name}`);
+    let factory;
+    if ('useFactory' in config) {
+        factory = config;
+    }
+    else {
+        validateOptions(name, config);
+        factory = { useFactory: () => config };
+    }
+    class ExternalJwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy, name) {
+        constructor(...deps) {
+            const options = factory.useFactory(...deps);
+            validateOptions(name, options);
+            super(passportOptions(options, logger));
+            this.mapClaims = options.mapClaims;
+        }
+        validate(payload) {
+            if (!this.mapClaims) {
+                return payload;
+            }
+            try {
+                return this.mapClaims(payload) ?? null;
+            }
+            catch (err) {
+                logger.error(`mapClaims threw, so the token is rejected: ${err instanceof Error ? err.message : String(err)}`);
+                return null;
+            }
+        }
+    }
+    (0, common_1.Injectable)()(ExternalJwtStrategy);
+    (factory.inject ?? []).forEach((token, index) => {
+        (0, common_1.Inject)(token)(ExternalJwtStrategy, undefined, index);
+    });
+    return ExternalJwtStrategy;
+}
+function passportOptions(options, logger) {
+    const extract = options.jwtFromRequest ?? passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken();
+    const maxBytes = options.maxTokenBytes ?? exports.DEFAULT_EXTERNAL_JWT_MAX_BYTES;
+    return {
+        jwtFromRequest: (request) => {
+            const token = extract(request);
+            return token && Buffer.byteLength(token, 'utf8') <= maxBytes ? token : null;
+        },
+        secretOrKeyProvider: (request, rawJwtToken, done) => {
+            Promise.resolve()
+                .then(() => options.secretProvider(keyIdOf(rawJwtToken), request))
+                .then((key) => (key ? done(null, key) : done(new Error('No verification key for this token'))), (err) => {
+                logger.error(`secretProvider threw, so the token is rejected: ${err instanceof Error ? err.message : String(err)}`);
+                done(err);
+            });
+        },
+        algorithms: options.algorithms,
+        issuer: options.issuer,
+        audience: options.audience,
+        ignoreExpiration: false,
+        jsonWebTokenOptions: { clockTolerance: options.clockToleranceSec ?? 0 },
+    };
+}
+function keyIdOf(token) {
+    try {
+        const header = JSON.parse(Buffer.from(token.split('.')[0], 'base64url').toString('utf8'));
+        return typeof header?.kid === 'string' ? header.kid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function assertName(name) {
+    if (typeof name !== 'string' || name.trim() === '') {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException('[createExternalJwtStrategy] name must be a non-empty string.');
+    }
+    if (RESERVED_NAMES.includes(name)) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[createExternalJwtStrategy('${name}')] '${name}' is the name of the package's own strategy; ` +
+            'Passport would replace it. Choose another name, such as customer-jwt.');
+    }
+}
+function validateOptions(name, options) {
+    const fail = (message) => {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[createExternalJwtStrategy('${name}')] ${message}`);
+    };
+    if (typeof options?.secretProvider !== 'function') {
+        fail('secretProvider must be a function (kid, request) => key.');
+    }
+    const { algorithms } = options;
+    if (!Array.isArray(algorithms) || algorithms.length === 0) {
+        fail("algorithms is required: list the algorithms the issuer signs with, e.g. ['HS256']. " +
+            'Left open, a token would choose how it is verified.');
+    }
+    const unsupported = algorithms.filter((algorithm) => !HMAC_ALGORITHMS.includes(algorithm) && !ASYMMETRIC_ALGORITHMS.includes(algorithm));
+    if (unsupported.length > 0) {
+        const none = unsupported.some((algorithm) => String(algorithm).toLowerCase() === 'none');
+        fail(`algorithms contains ${unsupported.map((algorithm) => JSON.stringify(algorithm)).join(', ')}. ` +
+            (none ? '"none" accepts unsigned tokens. ' : '') +
+            `Supported: ${[...HMAC_ALGORITHMS, ...ASYMMETRIC_ALGORITHMS].join(', ')}.`);
+    }
+    const hmac = algorithms.some((algorithm) => HMAC_ALGORITHMS.includes(algorithm));
+    const asymmetric = algorithms.some((algorithm) => ASYMMETRIC_ALGORITHMS.includes(algorithm));
+    if (hmac && asymmetric) {
+        fail('algorithms mixes HMAC (HS*) with asymmetric algorithms, which lets a public key be used as an ' +
+            'HMAC secret. Register one strategy per algorithm family.');
+    }
+    const { maxTokenBytes, clockToleranceSec } = options;
+    if (maxTokenBytes !== undefined && (!Number.isInteger(maxTokenBytes) || maxTokenBytes <= 0)) {
+        fail(`maxTokenBytes must be a positive integer; received ${String(maxTokenBytes)}.`);
+    }
+    if (clockToleranceSec !== undefined && (!Number.isFinite(clockToleranceSec) || clockToleranceSec < 0)) {
+        fail(`clockToleranceSec must be a non-negative number; received ${String(clockToleranceSec)}.`);
+    }
+}
+//# sourceMappingURL=external-jwt.strategy.js.map

package/dist/strategies/external-jwt.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-jwt.strategy.js","sourceRoot":"","sources":["../../src/strategies/external-jwt.strategy.ts"],"names":[],"mappings":";;;AA6FA,8DA4CC;AAzID,2CAAkE;AAClE,+CAAoD;AACpD,+CAAoD;AACpD,+FAAyF;AAEzF,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACpD,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAChH,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAG7B,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAmFnD,SAAgB,yBAAyB,CACvC,IAAY,EACZ,MAA+D;IAE/D,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IAEzD,IAAI,OAAmC,CAAC;IACxC,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;QAC3B,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC;IACzC,CAAC;IAED,MAAM,mBAAoB,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,EAAE,IAAI,CAAC;QAGhE,YAAY,GAAG,IAAe;YAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5C,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC/B,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACrC,CAAC;QAED,QAAQ,CAAC,OAAgC;YACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;YACzC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,CAAC,KAAK,CAAC,8CAA8C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC/G,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF;IAED,IAAA,mBAAU,GAAE,CAAC,mBAAmB,CAAC,CAAC;IAClC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAA,eAAM,EAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,OAAmC,EAAE,MAAc;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,IAAI,yBAAU,CAAC,2BAA2B,EAAE,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,sCAA8B,CAAC;IAEzE,OAAO;QAEL,cAAc,EAAE,CAAC,OAA4B,EAAiB,EAAE;YAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,CAAC;QACD,mBAAmB,EAAE,CACnB,OAA4B,EAC5B,WAAmB,EACnB,IAAkD,EAClD,EAAE;YACF,OAAO,CAAC,OAAO,EAAE;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;iBACjE,IAAI,CACH,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,EACxF,CAAC,GAAY,EAAE,EAAE;gBACf,MAAM,CAAC,KAAK,CAAC,mDAAmD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpH,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,CACF,CAAC;QACN,CAAC;QACD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,gBAAgB,EAAE,KAAK;QACvB,mBAAmB,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,EAAE;KAC3B,CAAC;AACjD,CAAC;AAGD,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1F,OAAO,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,0DAA0B,CAAC,8DAA8D,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,0DAA0B,CAClC,+BAA+B,IAAI,QAAQ,IAAI,+CAA+C;YAC5F,uEAAuE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,OAAmC;IACxE,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;QACtC,MAAM,IAAI,0DAA0B,CAAC,+BAA+B,IAAI,OAAO,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC,CAAC;IAEF,IAAI,OAAO,OAAO,EAAE,cAAc,KAAK,UAAU,EAAE,CAAC;QAClD,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CACF,qFAAqF;YACnF,qDAAqD,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CACnC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAClG,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACzF,IAAI,CACF,uBAAuB,WAAW,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC7F,CAAC,IAAI,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,cAAc,CAAC,GAAG,eAAe,EAAE,GAAG,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7F,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;QACvB,IAAI,CACF,gGAAgG;YAC9F,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;IACrD,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,sDAAsD,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,iBAAiB,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG,CAAC,CAAC,EAAE,CAAC;QACtG,IAAI,CAAC,6DAA6D,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAClG,CAAC;AACH,CAAC"}

package/dist/strategies/jwt.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.d.ts","sourceRoot":"","sources":["../../src/strategies/jwt.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAIjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;;AAalE,qBACa,WAAY,SAAQ,gBAA0B;IASvD,OAAO,CAAC,WAAW;IARrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkD;gBAG7C,OAAO,EAAE,iBAAiB,EAC/C,WAAW,EAAE,WAAW,EAGhC,iBAAiB,CAAC,EAAE,kBAAkB;IA+BlC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC;CA6CvF"}
+{"version":3,"file":"jwt.strategy.d.ts","sourceRoot":"","sources":["../../src/strategies/jwt.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAIjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;;AAalE,qBACa,WAAY,SAAQ,gBAA0B;IASvD,OAAO,CAAC,WAAW;IARrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IACvD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkD;gBAG7C,OAAO,EAAE,iBAAiB,EAC/C,WAAW,EAAE,WAAW,EAGhC,iBAAiB,CAAC,EAAE,kBAAkB;IAkClC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC;CA6CvF"}

package/dist/strategies/jwt.strategy.js

@@ -40,6 +40,7 @@ let JwtStrategy = JwtStrategy_1 = class JwtStrategy extends (0, passport_1.Passp
             jwtFromRequest: jwtExtractor,
             ignoreExpiration: false,
             secretOrKey: options.jwtSecret,
+            algorithms: ['HS256'],
             passReqToCallback: true,
         });
         this.authService = authService;

package/dist/strategies/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../src/strategies/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,+CAAoD;AACpD,+CAAoD;AAEpD,2DAAuD;AAKvD,yFAAmF;AACnF,4CAAwE;AAGxE,8CAA8C;AAC9C,qEAA8D;AAO9D,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,CAAC,GAAY,EAAiB,EAAE,CAAC,IAAA,oBAAU,EAAC,GAAqC,EAAE,UAAU,CAAC,CAAC;AACxG,CAAC;AAGM,IAAM,WAAW,mBAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IAOzD,YAC+B,OAA0B,EAC/C,WAAwB,EAGhC,iBAAsC;QAEtC,MAAM,eAAe,GAAG,yBAAU,CAAC,2BAA2B,EAAE,CAAC;QAIjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,KAAK,IAAI,CAAC;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,eAAe,IAAI,cAAc,CAAC;QAGzE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,aAAa;YAC9C,CAAC,CAAC,UAAU,cAAc,EAAE;YAC5B,CAAC,CAAC,cAAc,CAAC;QAEnB,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,yBAAU,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;YACtE,CAAC,CAAC,eAAe,CAAC;QAEpB,KAAK,CAAC;YACJ,cAAc,EAAE,YAAY;YAC5B,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,SAAS;YAC9B,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QA1BK,gBAAW,GAAX,WAAW,CAAa;QARjB,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;QAoCrD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,IAAI,IAAI,sDAAwB,EAAE,CAAC;QAC7E,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,OAAmB;QAE9C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAqC,CAAC;YAQtD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAA,+BAAY,EAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;YACpC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;YACjC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAC/C,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAKD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAI1C,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,CAAC;QAKD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAxFY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAE3B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;6CAFP,0BAAW;GATvB,WAAW,CAwFvB"}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../src/strategies/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA6F;AAC7F,+CAAoD;AACpD,+CAAoD;AAEpD,2DAAuD;AAKvD,yFAAmF;AACnF,4CAAwE;AAGxE,8CAA8C;AAC9C,qEAA8D;AAO9D,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,CAAC,GAAY,EAAiB,EAAE,CAAC,IAAA,oBAAU,EAAC,GAAqC,EAAE,UAAU,CAAC,CAAC;AACxG,CAAC;AAGM,IAAM,WAAW,mBAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IAOzD,YAC+B,OAA0B,EAC/C,WAAwB,EAGhC,iBAAsC;QAEtC,MAAM,eAAe,GAAG,yBAAU,CAAC,2BAA2B,EAAE,CAAC;QAIjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,KAAK,IAAI,CAAC;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,eAAe,IAAI,cAAc,CAAC;QAGzE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,aAAa;YAC9C,CAAC,CAAC,UAAU,cAAc,EAAE;YAC5B,CAAC,CAAC,cAAc,CAAC;QAEnB,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,yBAAU,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;YACtE,CAAC,CAAC,eAAe,CAAC;QAEpB,KAAK,CAAC;YACJ,cAAc,EAAE,YAAY;YAC5B,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,SAAS;YAG9B,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QA7BK,gBAAW,GAAX,WAAW,CAAa;QARjB,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;QAuCrD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,IAAI,IAAI,sDAAwB,EAAE,CAAC;QAC7E,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,OAAmB;QAE9C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,GAAqC,CAAC;YAQtD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,MAAM,IAAA,+BAAY,EAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;YACpC,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;YACjC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAC/C,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAKD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAI1C,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,CAAC;QAKD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA3FY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAE3B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;6CAFP,0BAAW;GATvB,WAAW,CA2FvB"}

package/dist/utils/provider-helpers.d.ts

@@ -6,7 +6,13 @@ export interface UserAuthFields {
     facebookId: string | null;
     appleId: string | null;
 }
+export interface SocialIdentityFields {
+    googleId?: string | null;
+    facebookId?: string | null;
+    appleId?: string | null;
+}
 export declare function getProviderField(provider: SocialProvider): ProviderIdField;
 export declare function hasOtherAuthMethods(user: UserAuthFields, excludeProvider: SocialProvider): boolean;
+export declare function hasSocialIdentity(user: SocialIdentityFields): boolean;
 export declare function countAuthMethods(user: UserAuthFields): number;
 //# sourceMappingURL=provider-helpers.d.ts.map

package/dist/utils/provider-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/provider-helpers.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAKpE,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAWD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,eAAe,CAO1E;AAYD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,cAAc,EACpB,eAAe,EAAE,cAAc,GAC9B,OAAO,CAUT;AAQD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAS7D"}
+{"version":3,"file":"provider-helpers.d.ts","sourceRoot":"","sources":["../../src/utils/provider-helpers.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;AAC7D,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAKpE,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AASD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAWD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,eAAe,CAO1E;AAYD,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,cAAc,EACpB,eAAe,EAAE,cAAc,GAC9B,OAAO,CAUT;AAkBD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAIrE;AAQD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAS7D"}

package/dist/utils/provider-helpers.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getProviderField = getProviderField;
 exports.hasOtherAuthMethods = hasOtherAuthMethods;
+exports.hasSocialIdentity = hasSocialIdentity;
 exports.countAuthMethods = countAuthMethods;
 function getProviderField(provider) {
     const mapping = {
@@ -18,6 +19,9 @@ function hasOtherAuthMethods(user, excludeProvider) {
     const hasApple = excludeProvider !== 'apple' && user.appleId != null;
     return hasPassword || hasGoogle || hasFacebook || hasApple;
 }
+function hasSocialIdentity(user) {
+    return (user.googleId != null || user.facebookId != null || user.appleId != null);
+}
 function countAuthMethods(user) {
     let count = 0;
     if (user.passwordHash != null && user.passwordHash.length > 0)

package/dist/utils/provider-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-helpers.js","sourceRoot":"","sources":["../../src/utils/provider-helpers.ts"],"names":[],"mappings":";;AA0BA,4CAOC;AAYD,kDAaC;AAQD,4CASC;AAjDD,SAAgB,gBAAgB,CAAC,QAAwB;IACvD,MAAM,OAAO,GAA4C;QACvD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,SAAS;KACjB,CAAC;IACF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAYD,SAAgB,mBAAmB,CACjC,IAAoB,EACpB,eAA+B;IAG/B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAG9E,MAAM,SAAS,GAAG,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACxE,MAAM,WAAW,GAAG,eAAe,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9E,MAAM,QAAQ,GAAG,eAAe,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IAErE,OAAO,WAAW,IAAI,SAAS,IAAI,WAAW,IAAI,QAAQ,CAAC;AAC7D,CAAC;AAQD,SAAgB,gBAAgB,CAAC,IAAoB;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,EAAE,CAAC;IACvE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;QAAE,KAAK,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;QAAE,KAAK,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI;QAAE,KAAK,EAAE,CAAC;IAElC,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"provider-helpers.js","sourceRoot":"","sources":["../../src/utils/provider-helpers.ts"],"names":[],"mappings":";;AAuCA,4CAOC;AAYD,kDAaC;AAkBD,8CAIC;AAQD,4CASC;AAvED,SAAgB,gBAAgB,CAAC,QAAwB;IACvD,MAAM,OAAO,GAA4C;QACvD,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,YAAY;QACtB,KAAK,EAAE,SAAS;KACjB,CAAC;IACF,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC3B,CAAC;AAYD,SAAgB,mBAAmB,CACjC,IAAoB,EACpB,eAA+B;IAG/B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IAG9E,MAAM,SAAS,GAAG,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACxE,MAAM,WAAW,GAAG,eAAe,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9E,MAAM,QAAQ,GAAG,eAAe,KAAK,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IAErE,OAAO,WAAW,IAAI,SAAS,IAAI,WAAW,IAAI,QAAQ,CAAC;AAC7D,CAAC;AAkBD,SAAgB,iBAAiB,CAAC,IAA0B;IAC1D,OAAO,CACL,IAAI,CAAC,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CACzE,CAAC;AACJ,CAAC;AAQD,SAAgB,gBAAgB,CAAC,IAAoB;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,EAAE,CAAC;IACvE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;QAAE,KAAK,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;QAAE,KAAK,EAAE,CAAC;IACrC,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI;QAAE,KAAK,EAAE,CAAC;IAElC,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/utils/verification-base-url.d.ts

@@ -0,0 +1,2 @@
+export declare function assertUsableBaseUrl(baseUrl: string, source: string): void;
+//# sourceMappingURL=verification-base-url.d.ts.map

package/dist/utils/verification-base-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-base-url.d.ts","sourceRoot":"","sources":["../../src/utils/verification-base-url.ts"],"names":[],"mappings":"AAqBA,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBzE"}

package/dist/utils/verification-base-url.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertUsableBaseUrl = assertUsableBaseUrl;
+const invalid_auth_config_exception_1 = require("../exceptions/invalid-auth-config.exception");
+function assertUsableBaseUrl(baseUrl, source) {
+    let parsed;
+    try {
+        parsed = new URL(baseUrl);
+    }
+    catch {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] ${source} must be an absolute URL; received "${baseUrl}". ` +
+            "Include the scheme and host, e.g. 'https://app.example.com'.");
+    }
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] ${source} must use http or https; received "${baseUrl}". ` +
+            'Verification links are opened in a browser from an email client.');
+    }
+}
+//# sourceMappingURL=verification-base-url.js.map

package/dist/utils/verification-base-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-base-url.js","sourceRoot":"","sources":["../../src/utils/verification-base-url.ts"],"names":[],"mappings":";;AAqBA,kDAiBC;AAtCD,+FAAyF;AAqBzF,SAAgB,mBAAmB,CAAC,OAAe,EAAE,MAAc;IACjE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0DAA0B,CAClC,gBAAgB,MAAM,uCAAuC,OAAO,KAAK;YACvE,8DAA8D,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,0DAA0B,CAClC,gBAAgB,MAAM,sCAAsC,OAAO,KAAK;YACtE,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",