@ambushsoftworks/nestjs-auth-graphql 0.12.0 → 0.15.0

package/dist/services/biometric-auth.service.js

@@ -11,102 +11,156 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var BiometricAuthService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BiometricAuthService = void 0;
 const common_1 = require("@nestjs/common");
-const jwt_1 = require("@nestjs/jwt");
-const refresh_token_service_1 = require("./refresh-token.service");
+const crypto_1 = require("crypto");
 const auth_logger_interface_1 = require("../interfaces/auth-logger.interface");
-let BiometricAuthService = class BiometricAuthService {
-    constructor(userRepository, refreshTokenRepository, biometricRepository, securityLogger, jwtService, refreshTokenService) {
-        this.userRepository = userRepository;
-        this.refreshTokenRepository = refreshTokenRepository;
+const constants_1 = require("../constants");
+const biometric_challenge_service_1 = require("./biometric-challenge.service");
+const auth_service_1 = require("./auth.service");
+let BiometricAuthService = BiometricAuthService_1 = class BiometricAuthService {
+    constructor(biometricRepository, securityLogger, verifiers, challenges, authService, options) {
         this.biometricRepository = biometricRepository;
         this.securityLogger = securityLogger;
-        this.jwtService = jwtService;
-        this.refreshTokenService = refreshTokenService;
+        this.challenges = challenges;
+        this.authService = authService;
+        this.logger = new common_1.Logger(BiometricAuthService_1.name);
+        this.realmsEnabled = Boolean(options.realmExtractorInstance);
+        this.verifiersByAlgorithm = new Map(verifiers.map((v) => [v.algorithm, v]));
     }
-    async enableBiometric(userId, deviceId, publicKey) {
-        if (!deviceId || deviceId.trim().length === 0) {
-            throw new common_1.BadRequestException('Device ID is required');
+    async enrolCredential(input) {
+        this.requireRealm(input.realm);
+        const algorithm = input.algorithm ?? this.defaultAlgorithm;
+        const verifier = this.verifiersByAlgorithm.get(algorithm);
+        if (!verifier) {
+            throw new common_1.UnauthorizedException(`No biometric verifier is configured for algorithm '${algorithm}'.`);
         }
-        const user = await this.userRepository.findById(userId);
-        if (!user) {
-            throw new common_1.UnauthorizedException('User not found');
+        if (!(await verifier.validatePublicKey(input.publicKey))) {
+            throw new common_1.UnauthorizedException(`The public key is not a valid '${algorithm}' key.`);
         }
-        await this.userRepository.enableBiometric(userId, deviceId, publicKey);
+        const record = {
+            credentialId: (0, crypto_1.randomUUID)(),
+            userId: input.userId,
+            publicKey: input.publicKey,
+            algorithm,
+            deviceName: input.deviceName,
+            ...(input.realm !== undefined ? { realm: input.realm } : {}),
+            createdAt: new Date(),
+            lastUsedAt: null,
+            isActive: true,
+            ...(input.metadata ? { metadata: input.metadata } : {}),
+        };
+        await this.biometricRepository.storeCredential(record);
         this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_ENROLLED, {
-            userId,
-            deviceId,
+            userId: input.userId,
+            credentialId: record.credentialId,
+            algorithm,
         });
-        return true;
+        return this.summarise(record);
     }
-    async disableBiometric(userId) {
-        const user = await this.userRepository.findById(userId);
-        if (!user) {
-            throw new common_1.UnauthorizedException('User not found');
-        }
-        await this.userRepository.disableBiometric(userId);
-        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_DISABLED, {
-            userId,
-        });
-        return true;
+    async requestChallenge(credentialId, opts = {}) {
+        return this.challenges.issueChallenge(credentialId, opts);
     }
-    async authenticateWithBiometric(userId, deviceId) {
-        if (!deviceId || deviceId.trim().length === 0) {
-            throw new common_1.UnauthorizedException('Device ID is required');
+    async authenticateWithBiometric(input, opts = {}) {
+        this.requireRealm(opts.realm);
+        const fail = (reason, credentialId) => {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
+                credentialId,
+                ipAddress: opts.ipAddress,
+                realm: opts.realm,
+                reason,
+            });
+            throw new common_1.UnauthorizedException('Biometric authentication failed');
+        };
+        const challenge = await this.challenges.consumeChallenge(input.challengeId);
+        if (!challenge) {
+            return fail('challenge_unavailable', input.credentialId);
+        }
+        if (challenge.credentialId !== input.credentialId) {
+            return fail('challenge_credential_mismatch', input.credentialId);
+        }
+        const credential = await this.biometricRepository.getCredential(input.credentialId);
+        if (!credential) {
+            return fail('credential_unknown', input.credentialId);
         }
-        const user = await this.userRepository.findById(userId);
-        if (!user) {
-            throw new common_1.UnauthorizedException('Invalid biometric credentials');
+        if (!credential.isActive) {
+            return fail('credential_inactive', input.credentialId);
         }
-        const credentials = await this.biometricRepository.listBiometricCredentials(userId);
-        if (credentials.length === 0) {
-            throw new common_1.UnauthorizedException('Biometric authentication not enabled');
+        if ((credential.realm ?? undefined) !== opts.realm) {
+            return fail('credential_realm_mismatch', input.credentialId);
         }
-        const isValidDevice = credentials.some((cred) => cred.credentialId === deviceId);
-        if (!isValidDevice) {
-            throw new common_1.UnauthorizedException('Biometric authentication not enabled on this device');
+        const verifier = this.verifiersByAlgorithm.get(credential.algorithm);
+        if (!verifier) {
+            this.logger.error(`Credential ${input.credentialId} is enrolled under algorithm ` +
+                `'${credential.algorithm}', for which no verifier is configured. ` +
+                'Add it to biometric.verifiers, or deactivate the credential.');
+            return fail('verifier_missing', input.credentialId);
         }
-        const accessToken = this.jwtService.sign({
-            userId: user.id,
-            email: user.email,
+        const valid = await verifier.verify({
+            publicKey: credential.publicKey,
+            challenge: challenge.challenge,
+            signature: input.signature,
         });
-        const { token: refreshToken, hash: refreshTokenHash } = this.refreshTokenService.generateToken();
-        await this.refreshTokenRepository.create({
-            userId: user.id,
-            token: refreshToken,
-            hashedToken: refreshTokenHash,
-            expiresAt: this.refreshTokenService.getExpiryDate(),
+        if (!valid) {
+            return fail('signature_invalid', input.credentialId);
+        }
+        const session = await this.authService.issueAuthSession(credential.userId, opts.res, opts.realm);
+        void this.biometricRepository
+            .touchCredentialLastUsed(input.credentialId)
+            .catch((error) => {
+            this.logger.warn(`Recording last use of credential ${input.credentialId} failed: ${error instanceof Error ? error.message : String(error)}`);
         });
-        await this.userRepository.updateLastBiometricLogin(userId);
         this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_SUCCESS, {
+            userId: credential.userId,
+            credentialId: input.credentialId,
+            ipAddress: opts.ipAddress,
+            realm: opts.realm,
+        });
+        return session;
+    }
+    async listCredentials(userId, realm) {
+        const credentials = await this.biometricRepository.listCredentials(userId, realm);
+        return credentials.filter((c) => c.isActive).map((c) => this.summarise(c));
+    }
+    async removeCredential(userId, credentialId) {
+        const credential = await this.biometricRepository.getCredential(credentialId);
+        if (!credential || credential.userId !== userId) {
+            throw new common_1.UnauthorizedException('Biometric credential not found');
+        }
+        await this.biometricRepository.deactivateCredential(credentialId);
+        this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_DEVICE_REMOVED, {
             userId,
+            credentialId,
         });
-        return { accessToken, refreshToken };
     }
-    async getBiometricStatus(userId) {
-        const user = await this.userRepository.findById(userId);
-        if (!user) {
-            throw new common_1.UnauthorizedException('User not found');
+    requireRealm(realm) {
+        if (this.realmsEnabled && (realm === undefined || realm === null)) {
+            throw new common_1.BadRequestException('Realm required');
         }
-        const credentials = await this.biometricRepository.listBiometricCredentials(userId);
-        const enabled = credentials.length > 0;
-        const deviceId = credentials.length > 0 ? credentials[0].credentialId : null;
+    }
+    get defaultAlgorithm() {
+        return this.verifiersByAlgorithm.keys().next().value;
+    }
+    summarise(record) {
         return {
-            enabled,
-            deviceId,
+            credentialId: record.credentialId,
+            deviceName: record.deviceName,
+            algorithm: record.algorithm,
+            createdAt: record.createdAt,
+            lastUsedAt: record.lastUsedAt,
         };
     }
 };
 exports.BiometricAuthService = BiometricAuthService;
-exports.BiometricAuthService = BiometricAuthService = __decorate([
+exports.BiometricAuthService = BiometricAuthService = BiometricAuthService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Inject)('USER_REPOSITORY')),
-    __param(1, (0, common_1.Inject)('REFRESH_TOKEN_REPOSITORY')),
-    __param(2, (0, common_1.Inject)('BIOMETRIC_REPOSITORY')),
-    __param(3, (0, common_1.Inject)('AUTH_LOGGER')),
-    __metadata("design:paramtypes", [Object, Object, Object, Object, jwt_1.JwtService,
-        refresh_token_service_1.RefreshTokenService])
+    __param(0, (0, common_1.Inject)(constants_1.BIOMETRIC_REPOSITORY)),
+    __param(1, (0, common_1.Inject)(constants_1.AUTH_LOGGER)),
+    __param(2, (0, common_1.Inject)(constants_1.BIOMETRIC_VERIFIERS)),
+    __param(5, (0, common_1.Inject)(constants_1.AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object, Object, Array, biometric_challenge_service_1.BiometricChallengeService,
+        auth_service_1.AuthService, Object])
 ], BiometricAuthService);
 //# sourceMappingURL=biometric-auth.service.js.map

package/dist/services/biometric-auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"biometric-auth.service.js","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,qCAAyC;AACzC,mEAA8D;AAK9D,+EAAiF;AAwB1E,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAEmB,cAA0C,EAE1C,sBAA+C,EAE/C,mBAAyC,EAEzC,cAA2B,EAC3B,UAAsB,EACtB,mBAAwC;QARxC,mBAAc,GAAd,cAAc,CAA4B;QAE1C,2BAAsB,GAAtB,sBAAsB,CAAyB;QAE/C,wBAAmB,GAAnB,mBAAmB,CAAsB;QAEzC,mBAAc,GAAd,cAAc,CAAa;QAC3B,eAAU,GAAV,UAAU,CAAY;QACtB,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IASJ,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAiB;QAEvE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAGD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAGD,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEvE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,kBAAkB,EAAE;YACxD,MAAM;YACN,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAaD,KAAK,CAAC,gBAAgB,CAAC,MAAc;QAEnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAGD,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,kBAAkB,EAAE;YACxD,MAAM;SACP,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAiBD,KAAK,CAAC,yBAAyB,CAC7B,MAAc,EACd,QAAgB;QAGhB,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAGD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAGD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACpF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;QAC1E,CAAC;QAGD,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CACpC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,QAAQ,CACzC,CAAC;QACF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAqB,CAC7B,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAGD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAGH,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,GACnD,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE,CAAC;QAG3C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,gBAAgB;YAC7B,SAAS,EAAE,IAAI,CAAC,mBAAmB,CAAC,aAAa,EAAE;SACpD,CAAC,CAAC;QAGH,MAAM,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QAE3D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;YAC7D,MAAM;SACP,CAAC,CAAC;QAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAUD,KAAK,CAAC,kBAAkB,CACtB,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAGD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAE7E,OAAO;YACL,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC;CACF,CAAA;AA5KY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;IAEzB,WAAA,IAAA,eAAM,EAAC,0BAA0B,CAAC,CAAA;IAElC,WAAA,IAAA,eAAM,EAAC,sBAAsB,CAAC,CAAA;IAE9B,WAAA,IAAA,eAAM,EAAC,aAAa,CAAC,CAAA;qEAEO,gBAAU;QACD,2CAAmB;GAXhD,oBAAoB,CA4KhC"}
+{"version":3,"file":"biometric-auth.service.js","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,mCAAoC;AAMpC,+EAAiF;AACjF,4CAKsB;AAEtB,+EAA0E;AAC1E,iDAA6C;AAyCtC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAK/B,YAEE,mBAA0D,EAE1D,cAA4C,EAE5C,SAA+B,EACd,UAAqC,EACrC,WAAwB,EAEzC,OAA0B;QART,wBAAmB,GAAnB,mBAAmB,CAAsB;QAEzC,mBAAc,GAAd,cAAc,CAAa;QAG3B,eAAU,GAAV,UAAU,CAA2B;QACrC,gBAAW,GAAX,WAAW,CAAa;QAZ1B,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAgB9D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAG7D,IAAI,CAAC,oBAAoB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAsBD,KAAK,CAAC,eAAe,CAAC,KAOrB;QACC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAC7B,sDAAsD,SAAS,IAAI,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,8BAAqB,CAC7B,kCAAkC,SAAS,QAAQ,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA8B;YACxC,YAAY,EAAE,IAAA,mBAAU,GAAE;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS;YACT,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QAEF,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,kBAAkB,EAAE;YACxD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAWD,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,OAA+C,EAAE;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAmBD,KAAK,CAAC,yBAAyB,CAC7B,KAAuE,EACvE,OAAqE,EAAE;QAEvE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,YAAqB,EAAS,EAAE;YAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;gBAC7D,YAAY;gBACZ,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;aACP,CAAC,CAAC;YAGH,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,+BAA+B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;QAID,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAKd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,cAAc,KAAK,CAAC,YAAY,+BAA+B;gBAC7D,IAAI,UAAU,CAAC,SAAS,0CAA0C;gBAClE,8DAA8D,CACjE,CAAC;YACF,OAAO,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YAClC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QAMD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CACrD,UAAU,CAAC,MAAM,EACjB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,KAAK,CACX,CAAC;QAIF,KAAK,IAAI,CAAC,mBAAmB;aAC1B,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC;aAC3C,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,KAAK,CAAC,YAAY,YACpD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;YAC7D,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAc;QAClD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAQD,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,YAAoB;QACzD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE9E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAEhD,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAElE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,wBAAwB,EAAE;YAC9D,MAAM;YACN,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAOO,YAAY,CAAC,KAAyB;QAC5C,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;IACjE,CAAC;IAEO,SAAS,CAAC,MAAiC;QACjD,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;CACF,CAAA;AAhRY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,uBAAW,CAAC,CAAA;IAEnB,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAI3B,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;4DAFC,uDAAyB;QACxB,0BAAW;GAbhC,oBAAoB,CAgRhC"}

package/dist/services/biometric-challenge.service.d.ts

@@ -0,0 +1,27 @@
+import { BiometricChallengeRecord, IBiometricChallengeStore } from '../interfaces/biometric-repository.interface';
+import { IRateLimiter } from '../interfaces/rate-limiter.interface';
+import { IAuthLogger } from '../interfaces/auth-logger.interface';
+import type { AuthModuleOptions } from '../auth.module';
+export declare class BiometricChallengeService {
+    private readonly store;
+    private readonly rateLimiter;
+    private readonly securityLogger;
+    private readonly options;
+    private lastSweepAt;
+    private readonly ipHashSalt;
+    constructor(store: IBiometricChallengeStore, rateLimiter: IRateLimiter, securityLogger: IAuthLogger, options: AuthModuleOptions);
+    private get expirySeconds();
+    private get rateLimit();
+    issueChallenge(credentialId: string, opts?: {
+        ipAddress?: string;
+        realm?: string;
+    }): Promise<{
+        challengeId: string;
+        challenge: string;
+        expiresAt: Date;
+    } | null>;
+    private withinLimit;
+    consumeChallenge(challengeId: string): Promise<BiometricChallengeRecord | null>;
+    private sweep;
+}
+//# sourceMappingURL=biometric-challenge.service.d.ts.map

package/dist/services/biometric-challenge.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"biometric-challenge.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-challenge.service.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AAGjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAyBxD,qBACa,yBAAyB;IAgBlC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IArB1B,OAAO,CAAC,WAAW,CAAK;IAWxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAIjB,KAAK,EAAE,wBAAwB,EAE/B,WAAW,EAAE,YAAY,EAEzB,cAAc,EAAE,WAAW,EAE3B,OAAO,EAAE,iBAAiB;IAK7C,OAAO,KAAK,aAAa,GAExB;IAED,OAAO,KAAK,SAAS,GAEpB;IAgCK,cAAc,CAClB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;YAoDhE,WAAW;IAsBnB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC;YAqBvE,KAAK;CAkBpB"}

package/dist/services/biometric-challenge.service.js

@@ -0,0 +1,116 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BiometricChallengeService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const auth_logger_interface_1 = require("../interfaces/auth-logger.interface");
+const constants_1 = require("../constants");
+const ip_hash_1 = require("../utils/ip-hash");
+const CHALLENGE_BYTES = 32;
+const DEFAULT_EXPIRY_SECONDS = 60;
+const DEFAULT_RATE_LIMIT = { maxAttempts: 5, windowMs: 60_000 };
+const SWEEP_THROTTLE_MS = 2 * 60_000;
+let BiometricChallengeService = class BiometricChallengeService {
+    constructor(store, rateLimiter, securityLogger, options) {
+        this.store = store;
+        this.rateLimiter = rateLimiter;
+        this.securityLogger = securityLogger;
+        this.options = options;
+        this.lastSweepAt = 0;
+        this.ipHashSalt = process.env.AUTH_IP_HASH_SALT || this.options.jwtSecret || '';
+    }
+    get expirySeconds() {
+        return this.options.biometric?.challengeExpirySeconds ?? DEFAULT_EXPIRY_SECONDS;
+    }
+    get rateLimit() {
+        return this.options.biometric?.challengeRateLimit ?? DEFAULT_RATE_LIMIT;
+    }
+    async issueChallenge(credentialId, opts = {}) {
+        const { ipAddress, realm } = opts;
+        const { maxAttempts, windowMs } = this.rateLimit;
+        const scope = realm ? `${realm}:` : '';
+        const credentialKey = `auth:biometricChallenge:${scope}${credentialId}`;
+        if (!(await this.withinLimit(credentialKey, maxAttempts, windowMs))) {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
+                credentialId,
+                realm,
+                reason: 'challenge_rate_limited',
+            });
+            return null;
+        }
+        if (ipAddress) {
+            const ipKey = `auth:biometricChallengeIp:${scope}${(0, ip_hash_1.hashIp)(ipAddress, this.ipHashSalt)}`;
+            if (!(await this.withinLimit(ipKey, maxAttempts * 10, windowMs))) {
+                this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
+                    ipAddress,
+                    realm,
+                    reason: 'challenge_ip_rate_limited',
+                });
+                return null;
+            }
+        }
+        const challenge = (0, crypto_1.randomBytes)(CHALLENGE_BYTES).toString('base64');
+        const expiresAt = new Date(Date.now() + this.expirySeconds * 1000);
+        const challengeId = await this.store.storeChallenge({
+            credentialId,
+            challenge,
+            expiresAt,
+        });
+        void this.sweep();
+        return { challengeId, challenge, expiresAt };
+    }
+    async withinLimit(key, limit, windowMs) {
+        const { allowed } = await this.rateLimiter.checkRateLimit(key, limit, windowMs);
+        if (!allowed) {
+            return false;
+        }
+        await this.rateLimiter.recordAttempt(key, windowMs);
+        return true;
+    }
+    async consumeChallenge(challengeId) {
+        const record = await this.store.consumeChallenge(challengeId);
+        if (!record) {
+            this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
+                challengeId,
+                reason: 'challenge_unavailable',
+            });
+            return null;
+        }
+        return record;
+    }
+    async sweep() {
+        const now = Date.now();
+        if (now - this.lastSweepAt < SWEEP_THROTTLE_MS) {
+            return;
+        }
+        this.lastSweepAt = now;
+        try {
+            await this.store.deleteExpiredChallenges();
+        }
+        catch (error) {
+            this.securityLogger.warn(`Sweeping expired biometric challenges failed: ${error instanceof Error ? error.message : String(error)}. Challenges still expire — consumeChallenge re-checks it.`, 'BiometricChallengeService');
+        }
+    }
+};
+exports.BiometricChallengeService = BiometricChallengeService;
+exports.BiometricChallengeService = BiometricChallengeService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.BIOMETRIC_REPOSITORY)),
+    __param(1, (0, common_1.Inject)(constants_1.RATE_LIMITER)),
+    __param(2, (0, common_1.Inject)(constants_1.AUTH_LOGGER)),
+    __param(3, (0, common_1.Inject)(constants_1.AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object, Object, Object, Object])
+], BiometricChallengeService);
+//# sourceMappingURL=biometric-challenge.service.js.map

package/dist/services/biometric-challenge.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"biometric-challenge.service.js","sourceRoot":"","sources":["../../src/services/biometric-challenge.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,mCAAqC;AAMrC,+EAAiF;AACjF,4CAAoG;AACpG,8CAA0C;AAI1C,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,kBAAkB,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAGhE,MAAM,iBAAiB,GAAG,CAAC,GAAG,MAAM,CAAC;AAiB9B,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAcpC,YAEE,KAAgD,EAEhD,WAA0C,EAE1C,cAA4C,EAE5C,OAA2C;QAN1B,UAAK,GAAL,KAAK,CAA0B;QAE/B,gBAAW,GAAX,WAAW,CAAc;QAEzB,mBAAc,GAAd,cAAc,CAAa;QAE3B,YAAO,GAAP,OAAO,CAAmB;QArBrC,gBAAW,GAAG,CAAC,CAAC;QAuBtB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAClF,CAAC;IAED,IAAY,aAAa;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,IAAI,sBAAsB,CAAC;IAClF,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,IAAI,kBAAkB,CAAC;IAC1E,CAAC;IAgCD,KAAK,CAAC,cAAc,CAClB,YAAoB,EACpB,OAA+C,EAAE;QAEjD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAClC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvC,MAAM,aAAa,GAAG,2BAA2B,KAAK,GAAG,YAAY,EAAE,CAAC;QACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;gBAC7D,YAAY;gBACZ,KAAK;gBACL,MAAM,EAAE,wBAAwB;aACjC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,6BAA6B,KAAK,GAAG,IAAA,gBAAM,EAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAIxF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;oBAQ7D,SAAS;oBACT,KAAK;oBACL,MAAM,EAAE,2BAA2B;iBACpC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAA,oBAAW,EAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;QAEnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;YAClD,YAAY;YACZ,SAAS;YACT,SAAS;SACV,CAAC,CAAC;QAEH,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAElB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC/C,CAAC;IAGO,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAeD,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAE9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;gBAC7D,WAAW;gBACX,MAAM,EAAE,uBAAuB;aAChC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IASO,KAAK,CAAC,KAAK;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,GAAG,iBAAiB,EAAE,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QAEvB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CAAC,IAAI,CACtB,iDACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,4DAA4D,EAC5D,2BAA2B,CAC5B,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AArLY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAgBR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,wBAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,eAAM,EAAC,uBAAW,CAAC,CAAA;IAEnB,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;;GArBnB,yBAAyB,CAqLrC"}

package/dist/services/biometric-verification.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"biometric-verification.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-verification.service.ts"],"names":[],"mappings":"AA6BA,qBACa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;IACxE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;IAiB3C,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IA4Cb,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2C/D,OAAO,CAAC,cAAc;IAkDtB,sBAAsB,IAAI,MAAM,EAAE;CAGnC"}
+{"version":3,"file":"biometric-verification.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-verification.service.ts"],"names":[],"mappings":"AA6BA,qBACa,4BAA4B;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiD;IACxE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAa;IAiB3C,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;IA4Cb,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2C/D,OAAO,CAAC,cAAc;IA6DtB,sBAAsB,IAAI,MAAM,EAAE;CAGnC"}

package/dist/services/biometric-verification.service.js

@@ -61,6 +61,10 @@ let BiometricVerificationService = BiometricVerificationService_1 = class Biomet
             if (publicKey.asymmetricKeyType !== 'ec') {
                 throw new Error(`Invalid key type: expected 'ec', got '${publicKey.asymmetricKeyType}'`);
             }
+            const namedCurve = publicKey.asymmetricKeyDetails?.namedCurve;
+            if (namedCurve !== 'prime256v1') {
+                throw new Error(`Invalid curve: expected 'prime256v1' (P-256), got '${namedCurve ?? 'unknown'}'`);
+            }
             return publicKey;
         }
         catch (error) {

package/dist/services/biometric-verification.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"biometric-verification.service.js","sourceRoot":"","sources":["../../src/services/biometric-verification.service.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,mCAAkE;AA6B3D,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IAAlC;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;QACvD,wBAAmB,GAAG,CAAC,OAAO,CAAC,CAAC;IAiKnD,CAAC;IAhJC,KAAK,CAAC,eAAe,CACnB,YAAoB,EACpB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAGpD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAGzD,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,EAAE,CAAC;YAGb,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,0CAA0C,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAC1E,CAAC;YAEF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gDAAgD,YAAY,EAAE,CAC/D,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAeD,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,IAAI,CAAC;YAGH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAWrD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,gDAAgD,CACjD,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8CAA8C,YAAY,EAAE,CAC7D,CAAC;YACF,MAAM,IAAI,4BAAmB,CAC3B,8BAA8B,YAAY,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAcO,cAAc,CAAC,YAAoB;QACzC,IAAI,CAAC;YAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YAGD,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC;gBAChC,GAAG,EAAE,YAAY;gBACjB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAGH,IAAI,SAAS,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,yCAAyC,SAAS,CAAC,iBAAiB,GAAG,CACxE,CAAC;YACJ,CAAC;YAOD,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,YAAY,EAAE,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAcD,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;CACF,CAAA;AAnKY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;GACA,4BAA4B,CAmKxC"}
+{"version":3,"file":"biometric-verification.service.js","sourceRoot":"","sources":["../../src/services/biometric-verification.service.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,mCAAkE;AA6B3D,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IAAlC;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;QACvD,wBAAmB,GAAG,CAAC,OAAO,CAAC,CAAC;IA4KnD,CAAC;IA3JC,KAAK,CAAC,eAAe,CACnB,YAAoB,EACpB,SAAiB,EACjB,SAAiB;QAEjB,IAAI,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAGpD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAGzD,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/B,MAAM,CAAC,GAAG,EAAE,CAAC;YAGb,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YAE1D,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,0CAA0C,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAC1E,CAAC;YAEF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gDAAgD,YAAY,EAAE,CAC/D,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAeD,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QAC1C,IAAI,CAAC;YAGH,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAWrD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,gDAAgD,CACjD,CAAC;YAEF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,8CAA8C,YAAY,EAAE,CAC7D,CAAC;YACF,MAAM,IAAI,4BAAmB,CAC3B,8BAA8B,YAAY,EAAE,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAcO,cAAc,CAAC,YAAoB;QACzC,IAAI,CAAC;YAEH,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YAGD,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC;gBAChC,GAAG,EAAE,YAAY;gBACjB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAGH,IAAI,SAAS,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;gBACzC,MAAM,IAAI,KAAK,CACb,yCAAyC,SAAS,CAAC,iBAAiB,GAAG,CACxE,CAAC;YACJ,CAAC;YAWD,MAAM,UAAU,GAAG,SAAS,CAAC,oBAAoB,EAAE,UAAU,CAAC;YAC9D,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,IAAI,SAAS,GAAG,CACjF,CAAC;YACJ,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,YAAY,EAAE,CAAC,CAAC;YACzE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAcD,sBAAsB;QACpB,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;CACF,CAAA;AA9KY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;GACA,4BAA4B,CA8KxC"}

package/dist/test-utils/mock-repositories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-repositories.d.ts","sourceRoot":"","sources":["../../src/test-utils/mock-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAM/I,wBAAgB,wBAAwB,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAwCvE;AAKD,wBAAgB,gCAAgC,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAYvF;AAKD,wBAAgB,gCAAgC,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAOvF;AAKD,wBAAgB,8BAA8B,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CASnF;AAKD,wBAAgB,6BAA6B,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAUjF"}
+{"version":3,"file":"mock-repositories.d.ts","sourceRoot":"","sources":["../../src/test-utils/mock-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAM/I,wBAAgB,wBAAwB,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAwCvE;AAKD,wBAAgB,gCAAgC,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAYvF;AAKD,wBAAgB,gCAAgC,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAOvF;AAKD,wBAAgB,8BAA8B,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CASnF;AAKD,wBAAgB,6BAA6B,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAWjF"}

package/dist/test-utils/mock-repositories.js

@@ -78,13 +78,14 @@ function createMockBruteForceRepository() {
 }
 function createMockBiometricRepository() {
     return {
-        storeBiometricCredential: jest.fn(),
-        getBiometricCredential: jest.fn(),
-        listBiometricCredentials: jest.fn(),
-        removeBiometricCredential: jest.fn(),
-        storeBiometricChallenge: jest.fn(),
-        getBiometricChallenge: jest.fn(),
-        markChallengeAsUsed: jest.fn(),
+        storeCredential: jest.fn(),
+        getCredential: jest.fn(),
+        listCredentials: jest.fn(),
+        deactivateCredential: jest.fn(),
+        touchCredentialLastUsed: jest.fn(),
+        storeChallenge: jest.fn(),
+        consumeChallenge: jest.fn(),
+        deleteExpiredChallenges: jest.fn(),
     };
 }
 //# sourceMappingURL=mock-repositories.js.map

package/dist/test-utils/mock-repositories.js.map

@@ -1 +1 @@
-{"version":3,"file":"mock-repositories.js","sourceRoot":"","sources":["../../src/test-utils/mock-repositories.ts"],"names":[],"mappings":";;AAMA,4DAwCC;AAKD,4EAYC;AAKD,4EAOC;AAKD,wEASC;AAKD,sEAUC;AAlGD,SAAgB,wBAAwB;IACtC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE;QACnB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,2BAA2B,EAAE,IAAI,CAAC,EAAE,EAAE;QACtC,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE;QACxC,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE;QACrC,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE;QAEjC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,gCAAgC,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3C,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7B,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,4BAA4B,EAAE,IAAI,CAAC,EAAE,EAAE;QACvC,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1B,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7B,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;KACc,CAAC;AACpC,CAAC;AAKD,SAAgB,gCAAgC;IAC9C,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;QACvB,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE;QACrC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7C,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;KACS,CAAC;AAC5C,CAAC;AAKD,SAAgB,gCAAgC;IAC9C,OAAO;QACL,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE;QACxC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;KACO,CAAC;AAC5C,CAAC;AAKD,SAAgB,8BAA8B;IAC5C,OAAO;QACL,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;KACW,CAAC;AAC1C,CAAC;AAKD,SAAgB,6BAA6B;IAC3C,OAAO;QACL,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE;QACjC,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,yBAAyB,EAAE,IAAI,CAAC,EAAE,EAAE;QACpC,uBAAuB,EAAE,IAAI,CAAC,EAAE,EAAE;QAClC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;KACM,CAAC;AACzC,CAAC"}
+{"version":3,"file":"mock-repositories.js","sourceRoot":"","sources":["../../src/test-utils/mock-repositories.ts"],"names":[],"mappings":";;AAMA,4DAwCC;AAKD,4EAYC;AAKD,4EAOC;AAKD,wEASC;AAKD,sEAWC;AAnGD,SAAgB,wBAAwB;IACtC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE;QACnB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,2BAA2B,EAAE,IAAI,CAAC,EAAE,EAAE;QACtC,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE;QACxC,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE;QACrC,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE;QAEjC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,gCAAgC,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3C,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7B,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,4BAA4B,EAAE,IAAI,CAAC,EAAE,EAAE;QACvC,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1B,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7B,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;KACc,CAAC;AACpC,CAAC;AAKD,SAAgB,gCAAgC;IAC9C,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;QACvB,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE;QACrC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7C,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;KACS,CAAC;AAC5C,CAAC;AAKD,SAAgB,gCAAgC;IAC9C,OAAO;QACL,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE;QACxC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;KACO,CAAC;AAC5C,CAAC;AAKD,SAAgB,8BAA8B;IAC5C,OAAO;QACL,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;KACW,CAAC;AAC1C,CAAC;AAKD,SAAgB,6BAA6B;IAC3C,OAAO;QACL,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1B,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1B,oBAAoB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC/B,uBAAuB,EAAE,IAAI,CAAC,EAAE,EAAE;QAClC,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,uBAAuB,EAAE,IAAI,CAAC,EAAE,EAAE;KACE,CAAC;AACzC,CAAC"}

package/dist/verifiers/es256-device-key.verifier.d.ts

@@ -0,0 +1,14 @@
+import { IBiometricVerifier } from '../interfaces/biometric-verifier.interface';
+import { BiometricVerificationService } from '../services/biometric-verification.service';
+export declare class Es256DeviceKeyVerifier implements IBiometricVerifier {
+    private readonly verification;
+    readonly algorithm = "ES256";
+    constructor(verification?: BiometricVerificationService);
+    verify(input: {
+        publicKey: string;
+        challenge: string;
+        signature: string;
+    }): Promise<boolean>;
+    validatePublicKey(publicKey: string): Promise<boolean>;
+}
+//# sourceMappingURL=es256-device-key.verifier.d.ts.map

package/dist/verifiers/es256-device-key.verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256-device-key.verifier.d.ts","sourceRoot":"","sources":["../../src/verifiers/es256-device-key.verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAwB1F,qBACa,sBAAuB,YAAW,kBAAkB;IAI7D,OAAO,CAAC,QAAQ,CAAC,YAAY;IAH/B,QAAQ,CAAC,SAAS,WAAW;gBAGV,YAAY,GAAE,4BAAiE;IAG5F,MAAM,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBd,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAO7D"}

package/dist/verifiers/es256-device-key.verifier.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Es256DeviceKeyVerifier = void 0;
+const common_1 = require("@nestjs/common");
+const biometric_verification_service_1 = require("../services/biometric-verification.service");
+let Es256DeviceKeyVerifier = class Es256DeviceKeyVerifier {
+    constructor(verification = new biometric_verification_service_1.BiometricVerificationService()) {
+        this.verification = verification;
+        this.algorithm = 'ES256';
+    }
+    async verify(input) {
+        try {
+            return await this.verification.verifySignature(input.publicKey, input.challenge, input.signature);
+        }
+        catch {
+            return false;
+        }
+    }
+    async validatePublicKey(publicKey) {
+        try {
+            return await this.verification.validatePublicKey(publicKey);
+        }
+        catch {
+            return false;
+        }
+    }
+};
+exports.Es256DeviceKeyVerifier = Es256DeviceKeyVerifier;
+exports.Es256DeviceKeyVerifier = Es256DeviceKeyVerifier = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [biometric_verification_service_1.BiometricVerificationService])
+], Es256DeviceKeyVerifier);
+//# sourceMappingURL=es256-device-key.verifier.js.map

package/dist/verifiers/es256-device-key.verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"es256-device-key.verifier.js","sourceRoot":"","sources":["../../src/verifiers/es256-device-key.verifier.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAE5C,+FAA0F;AAyBnF,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAGjC,YACmB,eAA6C,IAAI,6DAA4B,EAAE;QAA/E,iBAAY,GAAZ,YAAY,CAAmE;QAHzF,cAAS,GAAG,OAAO,CAAC;IAI1B,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,KAIZ;QACC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAC5C,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,CAChB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YAMP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AAnCY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;qCAKsB,6DAA4B;GAJlD,sBAAsB,CAmClC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.12.0",
+  "version": "0.15.0",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -23,7 +23,9 @@
     "lint": "eslint \"{src,test}/**/*.ts\"",
     "format": "prettier --write \"src/**/*.ts\" \"tests/**/*.ts\"",
     "prepublishOnly": "npm run build",
-    "lint:fix": "eslint \"{src,test}/**/*.ts\" --fix"
+    "lint:fix": "eslint \"{src,test}/**/*.ts\" --fix",
+    "release": "node scripts/release.js",
+    "release:verify": "node scripts/verify-release.js"
   },
   "keywords": [
     "nestjs",
@@ -46,6 +48,10 @@
     "type": "git",
     "url": "https://gitlab.com/ambushworks/nestjs-auth-graphql.git"
   },
+  "homepage": "https://gitlab.com/ambushworks/nestjs-auth-graphql#readme",
+  "bugs": {
+    "url": "https://gitlab.com/ambushworks/nestjs-auth-graphql/-/issues"
+  },
   "peerDependencies": {
     "@nestjs/common": "^10.0.0 || ^11.0.0",
     "@nestjs/core": "^10.0.0 || ^11.0.0",

package/dist/interfaces/magic-link-repository.interface.d.ts

@@ -1,6 +0,0 @@
-export interface IMagicLinkRepository {
-    storeMagicLink(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
-    validateMagicLink(userId: string, tokenHash: string): Promise<boolean>;
-    deleteMagicLink(userId: string): Promise<void>;
-}
-//# sourceMappingURL=magic-link-repository.interface.d.ts.map

package/dist/interfaces/magic-link-repository.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"magic-link-repository.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/magic-link-repository.interface.ts"],"names":[],"mappings":"AAoDA,MAAM,WAAW,oBAAoB;IAkBnC,cAAc,CACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,IAAI,GACd,OAAO,CAAC,IAAI,CAAC,CAAC;IAyBjB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAiBvE,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD"}

package/dist/interfaces/magic-link-repository.interface.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"magic-link-repository.interface.js","sourceRoot":"","sources":["../../src/interfaces/magic-link-repository.interface.ts"],"names":[],"mappings":""}

package/dist/interfaces/password-reset-strategy.interface.d.ts

@@ -1,7 +0,0 @@
-export interface IPasswordResetStrategy {
-    generateResetToken(userId: string): Promise<string>;
-    validateResetToken(userId: string, token: string): Promise<boolean>;
-    getExpiryDuration(): number;
-    deleteResetToken(userId: string): Promise<void>;
-}
-//# sourceMappingURL=password-reset-strategy.interface.d.ts.map