@ambushsoftworks/nestjs-auth-graphql 0.11.0 → 0.14.0

package/dist/services/biometric-auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"biometric-auth.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kDAAkD,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8CAA8C,CAAC;AACpF,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AAuBjF,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAEvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBARnB,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC,EAE1C,sBAAsB,EAAE,uBAAuB,EAE/C,mBAAmB,EAAE,oBAAoB,EAEzC,cAAc,EAAE,WAAW,EAC3B,UAAU,EAAE,UAAU,EACtB,mBAAmB,EAAE,mBAAmB;IAUrD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkCtF,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgClD,yBAAyB,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAgEnD,kBAAkB,CACtB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAgB1D"}
+{"version":3,"file":"biometric-auth.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,oBAAoB,EACrB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AAEjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAGD,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACjF,CAAC;AA0BF,qBACa,oBAAoB;IAM7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAG/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAX9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;gBAIpD,mBAAmB,EAAE,oBAAoB,EAEzC,cAAc,EAAE,WAAW,EAE5C,SAAS,EAAE,kBAAkB,EAAE,EACd,UAAU,EAAE,yBAAyB,EACrC,WAAW,EAAE,WAAW;IAsBrC,eAAe,CAAC,KAAK,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAgDjC,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAqBxE,yBAAyB,CAC7B,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EACvE,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,cAAc,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAsFnD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAWtF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3E,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,CAAC,SAAS;CASlB"}

package/dist/services/biometric-auth.service.js

@@ -11,102 +11,143 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var BiometricAuthService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BiometricAuthService = void 0;
 const common_1 = require("@nestjs/common");
-const jwt_1 = require("@nestjs/jwt");
-const refresh_token_service_1 = require("./refresh-token.service");
+const crypto_1 = require("crypto");
 const auth_logger_interface_1 = require("../interfaces/auth-logger.interface");
-let BiometricAuthService = class BiometricAuthService {
-    constructor(userRepository, refreshTokenRepository, biometricRepository, securityLogger, jwtService, refreshTokenService) {
-        this.userRepository = userRepository;
-        this.refreshTokenRepository = refreshTokenRepository;
+const constants_1 = require("../constants");
+const biometric_challenge_service_1 = require("./biometric-challenge.service");
+const auth_service_1 = require("./auth.service");
+let BiometricAuthService = BiometricAuthService_1 = class BiometricAuthService {
+    constructor(biometricRepository, securityLogger, verifiers, challenges, authService) {
         this.biometricRepository = biometricRepository;
         this.securityLogger = securityLogger;
-        this.jwtService = jwtService;
-        this.refreshTokenService = refreshTokenService;
+        this.challenges = challenges;
+        this.authService = authService;
+        this.logger = new common_1.Logger(BiometricAuthService_1.name);
+        this.verifiersByAlgorithm = new Map(verifiers.map((v) => [v.algorithm, v]));
     }
-    async enableBiometric(userId, deviceId, publicKey) {
-        if (!deviceId || deviceId.trim().length === 0) {
-            throw new common_1.BadRequestException('Device ID is required');
+    async enrolCredential(input) {
+        const algorithm = input.algorithm ?? this.defaultAlgorithm;
+        const verifier = this.verifiersByAlgorithm.get(algorithm);
+        if (!verifier) {
+            throw new common_1.UnauthorizedException(`No biometric verifier is configured for algorithm '${algorithm}'.`);
         }
-        const user = await this.userRepository.findById(userId);
-        if (!user) {
-            throw new common_1.UnauthorizedException('User not found');
+        if (!(await verifier.validatePublicKey(input.publicKey))) {
+            throw new common_1.UnauthorizedException(`The public key is not a valid '${algorithm}' key.`);
         }
-        await this.userRepository.enableBiometric(userId, deviceId, publicKey);
+        const record = {
+            credentialId: (0, crypto_1.randomUUID)(),
+            userId: input.userId,
+            publicKey: input.publicKey,
+            algorithm,
+            deviceName: input.deviceName,
+            createdAt: new Date(),
+            lastUsedAt: null,
+            isActive: true,
+            ...(input.metadata ? { metadata: input.metadata } : {}),
+        };
+        await this.biometricRepository.storeCredential(record);
         this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_ENROLLED, {
-            userId,
-            deviceId,
+            userId: input.userId,
+            credentialId: record.credentialId,
+            algorithm,
         });
-        return true;
+        return this.summarise(record);
     }
-    async disableBiometric(userId) {
-        const user = await this.userRepository.findById(userId);
-        if (!user) {
-            throw new common_1.UnauthorizedException('User not found');
-        }
-        await this.userRepository.disableBiometric(userId);
-        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_DISABLED, {
-            userId,
-        });
-        return true;
+    async requestChallenge(credentialId, opts = {}) {
+        return this.challenges.issueChallenge(credentialId, opts);
     }
-    async authenticateWithBiometric(userId, deviceId) {
-        if (!deviceId || deviceId.trim().length === 0) {
-            throw new common_1.UnauthorizedException('Device ID is required');
+    async authenticateWithBiometric(input, opts = {}) {
+        const fail = (reason, credentialId) => {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
+                credentialId,
+                ipAddress: opts.ipAddress,
+                realm: opts.realm,
+                reason,
+            });
+            throw new common_1.UnauthorizedException('Biometric authentication failed');
+        };
+        const challenge = await this.challenges.consumeChallenge(input.challengeId);
+        if (!challenge) {
+            return fail('challenge_unavailable', input.credentialId);
+        }
+        if (challenge.credentialId !== input.credentialId) {
+            return fail('challenge_credential_mismatch', input.credentialId);
         }
-        const user = await this.userRepository.findById(userId);
-        if (!user) {
-            throw new common_1.UnauthorizedException('Invalid biometric credentials');
+        const credential = await this.biometricRepository.getCredential(input.credentialId);
+        if (!credential) {
+            return fail('credential_unknown', input.credentialId);
         }
-        const credentials = await this.biometricRepository.listBiometricCredentials(userId);
-        if (credentials.length === 0) {
-            throw new common_1.UnauthorizedException('Biometric authentication not enabled');
+        if (!credential.isActive) {
+            return fail('credential_inactive', input.credentialId);
         }
-        const isValidDevice = credentials.some((cred) => cred.credentialId === deviceId);
-        if (!isValidDevice) {
-            throw new common_1.UnauthorizedException('Biometric authentication not enabled on this device');
+        const verifier = this.verifiersByAlgorithm.get(credential.algorithm);
+        if (!verifier) {
+            this.logger.error(`Credential ${input.credentialId} is enrolled under algorithm ` +
+                `'${credential.algorithm}', for which no verifier is configured. ` +
+                'Add it to biometric.verifiers, or deactivate the credential.');
+            return fail('verifier_missing', input.credentialId);
         }
-        const accessToken = this.jwtService.sign({
-            userId: user.id,
-            email: user.email,
+        const valid = await verifier.verify({
+            publicKey: credential.publicKey,
+            challenge: challenge.challenge,
+            signature: input.signature,
         });
-        const { token: refreshToken, hash: refreshTokenHash } = this.refreshTokenService.generateToken();
-        await this.refreshTokenRepository.create({
-            userId: user.id,
-            token: refreshToken,
-            hashedToken: refreshTokenHash,
-            expiresAt: this.refreshTokenService.getExpiryDate(),
+        if (!valid) {
+            return fail('signature_invalid', input.credentialId);
+        }
+        const session = await this.authService.issueAuthSession(credential.userId, opts.res, opts.realm);
+        void this.biometricRepository
+            .touchCredentialLastUsed(input.credentialId)
+            .catch((error) => {
+            this.logger.warn(`Recording last use of credential ${input.credentialId} failed: ${error instanceof Error ? error.message : String(error)}`);
         });
-        await this.userRepository.updateLastBiometricLogin(userId);
         this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_SUCCESS, {
-            userId,
+            userId: credential.userId,
+            credentialId: input.credentialId,
+            ipAddress: opts.ipAddress,
+            realm: opts.realm,
         });
-        return { accessToken, refreshToken };
+        return session;
     }
-    async getBiometricStatus(userId) {
-        const user = await this.userRepository.findById(userId);
-        if (!user) {
-            throw new common_1.UnauthorizedException('User not found');
+    async listCredentials(userId, realm) {
+        const credentials = await this.biometricRepository.listCredentials(userId, realm);
+        return credentials.filter((c) => c.isActive).map((c) => this.summarise(c));
+    }
+    async removeCredential(userId, credentialId) {
+        const credential = await this.biometricRepository.getCredential(credentialId);
+        if (!credential || credential.userId !== userId) {
+            throw new common_1.UnauthorizedException('Biometric credential not found');
         }
-        const credentials = await this.biometricRepository.listBiometricCredentials(userId);
-        const enabled = credentials.length > 0;
-        const deviceId = credentials.length > 0 ? credentials[0].credentialId : null;
+        await this.biometricRepository.deactivateCredential(credentialId);
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_DEVICE_REMOVED, {
+            userId,
+            credentialId,
+        });
+    }
+    get defaultAlgorithm() {
+        return this.verifiersByAlgorithm.keys().next().value;
+    }
+    summarise(record) {
         return {
-            enabled,
-            deviceId,
+            credentialId: record.credentialId,
+            deviceName: record.deviceName,
+            algorithm: record.algorithm,
+            createdAt: record.createdAt,
+            lastUsedAt: record.lastUsedAt,
         };
     }
 };
 exports.BiometricAuthService = BiometricAuthService;
-exports.BiometricAuthService = BiometricAuthService = __decorate([
+exports.BiometricAuthService = BiometricAuthService = BiometricAuthService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Inject)('USER_REPOSITORY')),
-    __param(1, (0, common_1.Inject)('REFRESH_TOKEN_REPOSITORY')),
-    __param(2, (0, common_1.Inject)('BIOMETRIC_REPOSITORY')),
-    __param(3, (0, common_1.Inject)('AUTH_LOGGER')),
-    __metadata("design:paramtypes", [Object, Object, Object, Object, jwt_1.JwtService,
-        refresh_token_service_1.RefreshTokenService])
+    __param(0, (0, common_1.Inject)(constants_1.BIOMETRIC_REPOSITORY)),
+    __param(1, (0, common_1.Inject)(constants_1.AUTH_LOGGER)),
+    __param(2, (0, common_1.Inject)(constants_1.BIOMETRIC_VERIFIERS)),
+    __metadata("design:paramtypes", [Object, Object, Array, biometric_challenge_service_1.BiometricChallengeService,
+        auth_service_1.AuthService])
 ], BiometricAuthService);
 //# sourceMappingURL=biometric-auth.service.js.map

package/dist/services/biometric-auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"biometric-auth.service.js","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,qCAAyC;AACzC,mEAA8D;AAK9D,+EAAiF;AAwB1E,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAEmB,cAA0C,EAE1C,sBAA+C,EAE/C,mBAAyC,EAEzC,cAA2B,EAC3B,UAAsB,EACtB,mBAAwC;QARxC,mBAAc,GAAd,cAAc,CAA4B;QAE1C,2BAAsB,GAAtB,sBAAsB,CAAyB;QAE/C,wBAAmB,GAAnB,mBAAmB,CAAsB;QAEzC,mBAAc,GAAd,cAAc,CAAa;QAC3B,eAAU,GAAV,UAAU,CAAY;QACtB,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IASJ,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAiB;QAEvE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAGD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAGD,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEvE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,kBAAkB,EAAE;YACxD,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAaD,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAEnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAGD,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,kBAAkB,EAAE;YACxD,MAAM;SACP,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAiBD,KAAK,CAAC,yBAAyB,CAC7B,MAAc,EACd,QAAgB;QAGhB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAGD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAGD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACpF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;QAC1E,CAAC;QAGD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,QAAQ,CACzC,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAqB,CAC7B,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAGD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAGH,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,GACnD,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,CAAC;QAG3C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE;SACpD,CAAC,CAAC;QAGH,MAAM,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAE3D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;YAC7D,MAAM;SACP,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAUD,KAAK,CAAC,kBAAkB,CACtB,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAGD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAE7E,OAAO;YACL,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAA;AA5KY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;IAEzB,WAAA,IAAA,eAAM,EAAC,0BAA0B,CAAC,CAAA;IAElC,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;IAE9B,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;qEAEO,gBAAU;QACD,2CAAmB;GAXhD,oBAAoB,CA4KhC"}
+{"version":3,"file":"biometric-auth.service.js","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAmF;AACnF,mCAAoC;AAMpC,+EAAiF;AACjF,4CAAsF;AACtF,+EAA0E;AAC1E,iDAA6C;AAyCtC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAI/B,YAEE,mBAA0D,EAE1D,cAA4C,EAE5C,SAA+B,EACd,UAAqC,EACrC,WAAwB;QANxB,wBAAmB,GAAnB,mBAAmB,CAAsB;QAEzC,mBAAc,GAAd,cAAc,CAAa;QAG3B,eAAU,GAAV,UAAU,CAA2B;QACrC,gBAAW,GAAX,WAAW,CAAa;QAX1B,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAe9D,IAAI,CAAC,oBAAoB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAiBD,KAAK,CAAC,eAAe,CAAC,KAMrB;QACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAC7B,sDAAsD,SAAS,IAAI,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,8BAAqB,CAC7B,kCAAkC,SAAS,QAAQ,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA8B;YACxC,YAAY,EAAE,IAAA,mBAAU,GAAE;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS;YACT,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QAEF,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,kBAAkB,EAAE;YACxD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAWD,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,OAA+C,EAAE;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAmBD,KAAK,CAAC,yBAAyB,CAC7B,KAAuE,EACvE,OAAqE,EAAE;QAEvE,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,YAAqB,EAAS,EAAE;YAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;gBAC7D,YAAY;gBACZ,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;aACP,CAAC,CAAC;YAGH,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,+BAA+B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAKd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,cAAc,KAAK,CAAC,YAAY,+BAA+B;gBAC7D,IAAI,UAAU,CAAC,SAAS,0CAA0C;gBAClE,8DAA8D,CACjE,CAAC;YACF,OAAO,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YAClC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QAMD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CACrD,UAAU,CAAC,MAAM,EACjB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,KAAK,CACX,CAAC;QAIF,KAAK,IAAI,CAAC,mBAAmB;aAC1B,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC;aAC3C,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,KAAK,CAAC,YAAY,YACpD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;YAC7D,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAc;QAClD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAQD,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,YAAoB;QACzD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE9E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAEhD,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAElE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,wBAAwB,EAAE;YAC9D,MAAM;YACN,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;IACjE,CAAC;IAEO,SAAS,CAAC,MAAiC;QACjD,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;CACF,CAAA;AAjPY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,uBAAW,CAAC,CAAA;IAEnB,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;4DAEC,uDAAyB;QACxB,0BAAW;GAZhC,oBAAoB,CAiPhC"}

package/dist/services/biometric-challenge.service.d.ts

@@ -0,0 +1,27 @@
+import { BiometricChallengeRecord, IBiometricChallengeStore } from '../interfaces/biometric-repository.interface';
+import { IRateLimiter } from '../interfaces/rate-limiter.interface';
+import { IAuthLogger } from '../interfaces/auth-logger.interface';
+import type { AuthModuleOptions } from '../auth.module';
+export declare class BiometricChallengeService {
+    private readonly store;
+    private readonly rateLimiter;
+    private readonly securityLogger;
+    private readonly options;
+    private lastSweepAt;
+    private readonly ipHashSalt;
+    constructor(store: IBiometricChallengeStore, rateLimiter: IRateLimiter, securityLogger: IAuthLogger, options: AuthModuleOptions);
+    private get expirySeconds();
+    private get rateLimit();
+    issueChallenge(credentialId: string, opts?: {
+        ipAddress?: string;
+        realm?: string;
+    }): Promise<{
+        challengeId: string;
+        challenge: string;
+        expiresAt: Date;
+    } | null>;
+    private withinLimit;
+    consumeChallenge(challengeId: string): Promise<BiometricChallengeRecord | null>;
+    private sweep;
+}
+//# sourceMappingURL=biometric-challenge.service.d.ts.map

package/dist/services/biometric-challenge.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biometric-challenge.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-challenge.service.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAyBxD,qBACa,yBAAyB;IAgBlC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IArB1B,OAAO,CAAC,WAAW,CAAK;IAWxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAIjB,KAAK,EAAE,wBAAwB,EAE/B,WAAW,EAAE,YAAY,EAEzB,cAAc,EAAE,WAAW,EAE3B,OAAO,EAAE,iBAAiB;IAK7C,OAAO,KAAK,aAAa,GAExB;IAED,OAAO,KAAK,SAAS,GAEpB;IAgCK,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;YAoDhE,WAAW;IAsBnB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;YAqBvE,KAAK;CAkBpB"}

package/dist/services/biometric-challenge.service.js

@@ -0,0 +1,116 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiometricChallengeService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const auth_logger_interface_1 = require("../interfaces/auth-logger.interface");
+const constants_1 = require("../constants");
+const ip_hash_1 = require("../utils/ip-hash");
+const CHALLENGE_BYTES = 32;
+const DEFAULT_EXPIRY_SECONDS = 60;
+const DEFAULT_RATE_LIMIT = { maxAttempts: 5, windowMs: 60_000 };
+const SWEEP_THROTTLE_MS = 2 * 60_000;
+let BiometricChallengeService = class BiometricChallengeService {
+    constructor(store, rateLimiter, securityLogger, options) {
+        this.store = store;
+        this.rateLimiter = rateLimiter;
+        this.securityLogger = securityLogger;
+        this.options = options;
+        this.lastSweepAt = 0;
+        this.ipHashSalt = process.env.AUTH_IP_HASH_SALT || this.options.jwtSecret || '';
+    }
+    get expirySeconds() {
+        return this.options.biometric?.challengeExpirySeconds ?? DEFAULT_EXPIRY_SECONDS;
+    }
+    get rateLimit() {
+        return this.options.biometric?.challengeRateLimit ?? DEFAULT_RATE_LIMIT;
+    }
+    async issueChallenge(credentialId, opts = {}) {
+        const { ipAddress, realm } = opts;
+        const { maxAttempts, windowMs } = this.rateLimit;
+        const scope = realm ? `${realm}:` : '';
+        const credentialKey = `auth:biometricChallenge:${scope}${credentialId}`;
+        if (!(await this.withinLimit(credentialKey, maxAttempts, windowMs))) {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
+                credentialId,
+                realm,
+                reason: 'challenge_rate_limited',
+            });
+            return null;
+        }
+        if (ipAddress) {
+            const ipKey = `auth:biometricChallengeIp:${scope}${(0, ip_hash_1.hashIp)(ipAddress, this.ipHashSalt)}`;
+            if (!(await this.withinLimit(ipKey, maxAttempts * 10, windowMs))) {
+                this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
+                    ipAddress,
+                    realm,
+                    reason: 'challenge_ip_rate_limited',
+                });
+                return null;
+            }
+        }
+        const challenge = (0, crypto_1.randomBytes)(CHALLENGE_BYTES).toString('base64');
+        const expiresAt = new Date(Date.now() + this.expirySeconds * 1000);
+        const challengeId = await this.store.storeChallenge({
+            credentialId,
+            challenge,
+            expiresAt,
+        });
+        void this.sweep();
+        return { challengeId, challenge, expiresAt };
+    }
+    async withinLimit(key, limit, windowMs) {
+        const { allowed } = await this.rateLimiter.checkRateLimit(key, limit, windowMs);
+        if (!allowed) {
+            return false;
+        }
+        await this.rateLimiter.recordAttempt(key, windowMs);
+        return true;
+    }
+    async consumeChallenge(challengeId) {
+        const record = await this.store.consumeChallenge(challengeId);
+        if (!record) {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
+                challengeId,
+                reason: 'challenge_unavailable',
+            });
+            return null;
+        }
+        return record;
+    }
+    async sweep() {
+        const now = Date.now();
+        if (now - this.lastSweepAt < SWEEP_THROTTLE_MS) {
+            return;
+        }
+        this.lastSweepAt = now;
+        try {
+            await this.store.deleteExpiredChallenges();
+        }
+        catch (error) {
+            this.securityLogger.warn(`Sweeping expired biometric challenges failed: ${error instanceof Error ? error.message : String(error)}. Challenges still expire — consumeChallenge re-checks it.`, 'BiometricChallengeService');
+        }
+    }
+};
+exports.BiometricChallengeService = BiometricChallengeService;
+exports.BiometricChallengeService = BiometricChallengeService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.BIOMETRIC_REPOSITORY)),
+    __param(1, (0, common_1.Inject)(constants_1.RATE_LIMITER)),
+    __param(2, (0, common_1.Inject)(constants_1.AUTH_LOGGER)),
+    __param(3, (0, common_1.Inject)(constants_1.AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object])
+], BiometricChallengeService);
+//# sourceMappingURL=biometric-challenge.service.js.map

package/dist/services/biometric-challenge.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biometric-challenge.service.js","sourceRoot":"","sources":["../../src/services/biometric-challenge.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,mCAAqC;AAMrC,+EAAiF;AACjF,4CAAoG;AACpG,8CAA0C;AAI1C,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,kBAAkB,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAGhE,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAiB9B,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAcpC,YAEE,KAAgD,EAEhD,WAA0C,EAE1C,cAA4C,EAE5C,OAA2C;QAN1B,UAAK,GAAL,KAAK,CAA0B;QAE/B,gBAAW,GAAX,WAAW,CAAc;QAEzB,mBAAc,GAAd,cAAc,CAAa;QAE3B,YAAO,GAAP,OAAO,CAAmB;QArBrC,gBAAW,GAAG,CAAC,CAAC;QAuBtB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAClF,CAAC;IAED,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,IAAI,sBAAsB,CAAC;IAClF,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,IAAI,kBAAkB,CAAC;IAC1E,CAAC;IAgCD,KAAK,CAAC,cAAc,CAClB,YAAoB,EACpB,OAA+C,EAAE;QAEjD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvC,MAAM,aAAa,GAAG,2BAA2B,KAAK,GAAG,YAAY,EAAE,CAAC;QACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;gBAC7D,YAAY;gBACZ,KAAK;gBACL,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,6BAA6B,KAAK,GAAG,IAAA,gBAAM,EAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAIxF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;oBAQ7D,SAAS;oBACT,KAAK;oBACL,MAAM,EAAE,2BAA2B;iBACpC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,oBAAW,EAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAEnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAClD,YAAY;YACZ,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAElB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC/C,CAAC;IAGO,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAeD,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAE9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;gBAC7D,WAAW;gBACX,MAAM,EAAE,uBAAuB;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IASO,KAAK,CAAC,KAAK;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QAEvB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,IAAI,CACtB,iDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,4DAA4D,EAC5D,2BAA2B,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AArLY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAgBR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,wBAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,eAAM,EAAC,uBAAW,CAAC,CAAA;IAEnB,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;;GArBnB,yBAAyB,CAqLrC"}

package/dist/services/biometric-verification.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"biometric-verification.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-verification.service.ts"],"names":[],"mappings":"AA6BA,qBACa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;IACxE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;IAiB3C,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IA4Cb,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2C/D,OAAO,CAAC,cAAc;IAkDtB,sBAAsB,IAAI,MAAM,EAAE;CAGnC"}
+{"version":3,"file":"biometric-verification.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-verification.service.ts"],"names":[],"mappings":"AA6BA,qBACa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;IACxE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;IAiB3C,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IA4Cb,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2C/D,OAAO,CAAC,cAAc;IA6DtB,sBAAsB,IAAI,MAAM,EAAE;CAGnC"}

package/dist/services/biometric-verification.service.js

@@ -61,6 +61,10 @@ let BiometricVerificationService = BiometricVerificationService_1 = class Biomet
             if (publicKey.asymmetricKeyType !== 'ec') {
                 throw new Error(`Invalid key type: expected 'ec', got '${publicKey.asymmetricKeyType}'`);
             }
+            const namedCurve = publicKey.asymmetricKeyDetails?.namedCurve;
+            if (namedCurve !== 'prime256v1') {
+                throw new Error(`Invalid curve: expected 'prime256v1' (P-256), got '${namedCurve ?? 'unknown'}'`);
+            }
             return publicKey;
         }
         catch (error) {

package/dist/services/biometric-verification.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"biometric-verification.service.js","sourceRoot":"","sources":["../../src/services/biometric-verification.service.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,mCAAkE;AA6B3D,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IAAlC;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;QACvD,wBAAmB,GAAG,CAAC,OAAO,CAAC,CAAC;IAiKnD,CAAC;IAhJC,KAAK,CAAC,eAAe,CACnB,YAAoB,EACpB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAGpD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAGzD,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,EAAE,CAAC;YAGb,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,0CAA0C,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAC1E,CAAC;YAEF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gDAAgD,YAAY,EAAE,CAC/D,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAeD,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,IAAI,CAAC;YAGH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAWrD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,gDAAgD,CACjD,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8CAA8C,YAAY,EAAE,CAC7D,CAAC;YACF,MAAM,IAAI,4BAAmB,CAC3B,8BAA8B,YAAY,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAcO,cAAc,CAAC,YAAoB;QACzC,IAAI,CAAC;YAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YAGD,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC;gBAChC,GAAG,EAAE,YAAY;gBACjB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAGH,IAAI,SAAS,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,yCAAyC,SAAS,CAAC,iBAAiB,GAAG,CACxE,CAAC;YACJ,CAAC;YAOD,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,YAAY,EAAE,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAcD,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;CACF,CAAA;AAnKY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;GACA,4BAA4B,CAmKxC"}
+{"version":3,"file":"biometric-verification.service.js","sourceRoot":"","sources":["../../src/services/biometric-verification.service.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,mCAAkE;AA6B3D,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IAAlC;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;QACvD,wBAAmB,GAAG,CAAC,OAAO,CAAC,CAAC;IA4KnD,CAAC;IA3JC,KAAK,CAAC,eAAe,CACnB,YAAoB,EACpB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAGpD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAGzD,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,EAAE,CAAC;YAGb,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,0CAA0C,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAC1E,CAAC;YAEF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gDAAgD,YAAY,EAAE,CAC/D,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAeD,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,IAAI,CAAC;YAGH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAWrD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,gDAAgD,CACjD,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8CAA8C,YAAY,EAAE,CAC7D,CAAC;YACF,MAAM,IAAI,4BAAmB,CAC3B,8BAA8B,YAAY,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAcO,cAAc,CAAC,YAAoB;QACzC,IAAI,CAAC;YAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YAGD,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC;gBAChC,GAAG,EAAE,YAAY;gBACjB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAGH,IAAI,SAAS,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,yCAAyC,SAAS,CAAC,iBAAiB,GAAG,CACxE,CAAC;YACJ,CAAC;YAWD,MAAM,UAAU,GAAG,SAAS,CAAC,oBAAoB,EAAE,UAAU,CAAC;YAC9D,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,IAAI,SAAS,GAAG,CACjF,CAAC;YACJ,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,YAAY,EAAE,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAcD,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;CACF,CAAA;AA9KY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;GACA,4BAA4B,CA8KxC"}

package/dist/services/verification.service.d.ts

@@ -43,7 +43,8 @@ export declare class VerificationService {
     verifyCredential(identifier: string, type: 'email' | 'password-reset', submitted: string, realm?: string): Promise<boolean>;
     generateToken(identifier: string, type: 'email' | 'password-reset', realm?: string): Promise<string>;
     verifyToken(identifier: string, type: 'email' | 'password-reset', token: string, realm?: string): Promise<boolean>;
-    buildVerificationUrl(token: string, type: 'email' | 'password-reset', email: string): string;
+    buildVerificationUrl(token: string, type: 'email' | 'password-reset', email: string, realm?: string): string;
+    private resolveBaseUrl;
     private verificationPath;
     private buildPageUrl;
     private hashToken;

package/dist/services/verification.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification.service.d.ts","sourceRoot":"","sources":["../../src/services/verification.service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAW9D,MAAM,WAAW,4BAA4B;IAM3C,UAAU,EAAE,MAAM,CAAC;IAYnB,GAAG,CAAC,EAAE,MAAM,CAAC;IAMb,gBAAgB,EAAE,MAAM,CAAC;IAGzB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgCD,qBACa,mBAAmB;IASC,OAAO,CAAC,OAAO;IAE5C,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAEvC,OAAO,CAAC,cAAc;IAdxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAM;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAK;IAGjC,OAAO,CAAC,mBAAmB,CAAS;gBAGG,OAAO,EAAE,iBAAiB,EAE9C,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC,EAE1C,sBAAsB,EAAE,uBAAuB,EAExD,cAAc,EAAE,WAAW;IAW/B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuB3G,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EACxC,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAgBb,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3G,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B7G,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB7E,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GAAG,KAAK,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IAmBb,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;YA2BvE,qBAAqB;YAwCrB,qBAAqB;IAyHnC,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,QAAQ;IAYV,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EACxC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAsC1E,IAAI,gBAAgB,IAAI,MAAM,GAAG,OAAO,CAEvC;IAKD,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAKD,IAAI,qBAAqB,IAAI,MAAM,CAElC;IASD,IAAI,0BAA0B,IAAI,MAAM,CAIvC;IAuBK,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,4BAA4B,CAAC;IA0ClC,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAgBb,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC;IAkDZ,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAsFnB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IAsB5F,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,YAAY;IAuCpB,OAAO,CAAC,SAAS;YAUH,WAAW;IAUzB,OAAO,CAAC,mBAAmB;CAO5B"}
+{"version":3,"file":"verification.service.d.ts","sourceRoot":"","sources":["../../src/services/verification.service.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAY9D,MAAM,WAAW,4BAA4B;IAM3C,UAAU,EAAE,MAAM,CAAC;IAYnB,GAAG,CAAC,EAAE,MAAM,CAAC;IAMb,gBAAgB,EAAE,MAAM,CAAC;IAGzB,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAgCD,qBACa,mBAAmB;IASC,OAAO,CAAC,OAAO;IAE5C,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IAEvC,OAAO,CAAC,cAAc;IAdxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAK;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAM;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAK;IAGjC,OAAO,CAAC,mBAAmB,CAAS;gBAGG,OAAO,EAAE,iBAAiB,EAE9C,cAAc,EAAE,eAAe,CAAC,SAAS,CAAC,EAE1C,sBAAsB,EAAE,uBAAuB,EAExD,cAAc,EAAE,WAAW;IAW/B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuB3G,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EACxC,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAgBb,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3G,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA0B7G,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB7E,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GAAG,KAAK,EACrB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC;IAmBb,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC;YA2BvE,qBAAqB;YAwCrB,qBAAqB;IAyHnC,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,QAAQ;IAYV,YAAY,CAChB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,gBAAgB,EACxC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAsC1E,IAAI,gBAAgB,IAAI,MAAM,GAAG,OAAO,CAEvC;IAKD,IAAI,oBAAoB,IAAI,MAAM,CAEjC;IAKD,IAAI,qBAAqB,IAAI,MAAM,CAElC;IASD,IAAI,0BAA0B,IAAI,MAAM,CAIvC;IAuBK,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,4BAA4B,CAAC;IA0ClC,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,SAAS,EAAE,MAAM,EACjB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAgBb,aAAa,CACjB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC;IAkDZ,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAsFnB,oBAAoB,CAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,OAAO,GAAG,gBAAgB,EAChC,KAAK,EAAE,MAAM,EACb,KAAK,CAAC,EAAE,MAAM,GACb,MAAM;IA+CT,OAAO,CAAC,cAAc;IAiBtB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,YAAY;IA0DpB,OAAO,CAAC,SAAS;YAUH,WAAW;IAUzB,OAAO,CAAC,mBAAmB;CAO5B"}

package/dist/services/verification.service.js

@@ -18,6 +18,7 @@ const crypto_1 = require("crypto");
 const constants_1 = require("../constants");
 const auth_logger_interface_1 = require("../interfaces/auth-logger.interface");
 const verification_type_enum_1 = require("../enums/verification-type.enum");
+const verification_base_url_1 = require("../utils/verification-base-url");
 let VerificationService = class VerificationService {
     constructor(options, userRepository, verificationRepository, securityLogger) {
         this.options = options;
@@ -202,7 +203,7 @@ let VerificationService = class VerificationService {
             const token = await this.generateToken(identifier, type, realm);
             return {
                 credential: token,
-                url: this.buildVerificationUrl(token, type, identifier),
+                url: this.buildVerificationUrl(token, type, identifier, realm),
                 expiresInMinutes: this.tokenExpiresInMinutes,
                 mode,
             };
@@ -210,7 +211,7 @@ let VerificationService = class VerificationService {
         const code = await this.generateCode(identifier, type, realm);
         return {
             credential: code,
-            url: this.buildPageUrl(type),
+            url: this.buildPageUrl(type, realm),
             expiresInMinutes: this.codeExpiresInMinutes,
             mode,
         };
@@ -281,22 +282,51 @@ let VerificationService = class VerificationService {
         });
         return true;
     }
-    buildVerificationUrl(token, type, email) {
-        const baseUrl = this.options.verification?.baseUrl;
+    buildVerificationUrl(token, type, email, realm) {
+        const where = realm ? `realm "${realm}"` : 'a request with no realm';
+        let baseUrl;
+        try {
+            baseUrl = this.resolveBaseUrl(realm);
+        }
+        catch (error) {
+            throw new Error(`verification.baseUrl resolver threw for ${where}: ` +
+                `${error instanceof Error ? error.message : String(error)}. ` +
+                'In token mode the link is the credential, so there is no usable email ' +
+                'to send without it.');
+        }
         if (!baseUrl) {
-            throw new Error('verification.baseUrl is required to build verification URLs. ' +
-                'Configure it in AuthModuleOptions.verification.baseUrl.');
+            throw new Error(`verification.baseUrl produced no URL for ${where}. ` +
+                'Configure it in AuthModuleOptions.verification.baseUrl, and if it is a ' +
+                'resolver, make sure it returns a URL for every realm.');
         }
+        (0, verification_base_url_1.assertUsableBaseUrl)(baseUrl, `verification.baseUrl for ${where}`);
         const url = new URL(this.verificationPath(type), baseUrl);
         url.searchParams.set('token', token);
         url.searchParams.set('email', email);
         return url.toString();
     }
+    resolveBaseUrl(realm) {
+        const configured = this.options.verification?.baseUrl;
+        if (typeof configured === 'function') {
+            return configured(realm);
+        }
+        return configured;
+    }
     verificationPath(type) {
         return type === 'email' ? '/verify-email' : '/reset-password';
     }
-    buildPageUrl(type) {
-        const configured = this.options.verification?.baseUrl;
+    buildPageUrl(type, realm) {
+        let configured;
+        try {
+            configured = this.resolveBaseUrl(realm);
+        }
+        catch (error) {
+            this.securityLogger.warn('verification.baseUrl resolver threw for ' +
+                `${realm ? `realm "${realm}"` : 'a request with no realm'}: ` +
+                `${error instanceof Error ? error.message : String(error)}. ` +
+                'Sending the email without a link; the 6-digit code is unaffected.', 'VerificationService');
+            configured = undefined;
+        }
         const legacy = process.env.FRONTEND_URL;
         if (!configured && legacy && !this.warnedLegacyBaseUrl) {
             this.warnedLegacyBaseUrl = true;