@ambushsoftworks/nestjs-auth-graphql 0.14.0 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +47 -0
- package/README.md +4 -0
- package/dist/interfaces/biometric-repository.interface.d.ts +1 -0
- package/dist/interfaces/biometric-repository.interface.d.ts.map +1 -1
- package/dist/services/biometric-auth.service.d.ts +5 -1
- package/dist/services/biometric-auth.service.d.ts.map +1 -1
- package/dist/services/biometric-auth.service.js +15 -2
- package/dist/services/biometric-auth.service.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -27,6 +27,53 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
|
|
|
27
27
|
retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
|
|
28
28
|
from `@ambushsoftworks/nestjs-payments-graphql`.
|
|
29
29
|
|
|
30
|
+
## [0.15.0] - 2026-10-01
|
|
31
|
+
|
|
32
|
+
A biometric credential now signs in only to the realm it was enrolled in.
|
|
33
|
+
|
|
34
|
+
### ⚠ Security
|
|
35
|
+
|
|
36
|
+
- **A credential enrolled in one realm could sign in to another.** The credential
|
|
37
|
+
record carried no realm, and `authenticateWithBiometric` issued the session with
|
|
38
|
+
the realm of the *request*. A credential enrolled in realm `staff`, used on a
|
|
39
|
+
request in realm `customers`, therefore received a token with `realm:
|
|
40
|
+
"customers"` for the staff user — and `JwtStrategy`'s realm check accepted it,
|
|
41
|
+
because the claim and the request agreed. Realms are documented as partitioning
|
|
42
|
+
identity; this crossed them. Only consumers that pass `realm` to
|
|
43
|
+
`authenticateWithBiometric` were exposed. A consumer that omitted it got a token
|
|
44
|
+
carrying the user's own realm instead, which is why the e2e suite did not see
|
|
45
|
+
it. Credentials only exist since 0.14.0 (released the day before).
|
|
46
|
+
|
|
47
|
+
### Changed — breaking
|
|
48
|
+
|
|
49
|
+
- **`BiometricCredentialRecord` has a `realm` field, and adapters must persist
|
|
50
|
+
it.** `getCredential` must return it. A credential whose stored realm differs
|
|
51
|
+
from the request's is refused with the usual `401 Biometric authentication
|
|
52
|
+
failed` (logged reason `credential_realm_mismatch`). A credential stored
|
|
53
|
+
**without** a realm, while realms are enabled, is refused too: it fails closed.
|
|
54
|
+
- **With realms enabled, `enrolCredential` and `authenticateWithBiometric` require
|
|
55
|
+
a realm** and throw `400 Realm required` without one, the same answer as
|
|
56
|
+
`realmForRequest`. Pass the request's realm, e.g.
|
|
57
|
+
`this.getRealmFromContext(context)` in a resolver extending `BaseAuthResolver`:
|
|
58
|
+
|
|
59
|
+
```typescript
|
|
60
|
+
enrolCredential({ userId, publicKey, deviceName, realm })
|
|
61
|
+
authenticateWithBiometric(input, { realm, res, ipAddress })
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
### Migration
|
|
65
|
+
|
|
66
|
+
1. Add a nullable `realm` column to your biometric credential table, write it in
|
|
67
|
+
`storeCredential` and return it from `getCredential`.
|
|
68
|
+
2. Backfill existing rows from their user's realm, e.g.
|
|
69
|
+
`UPDATE "BiometricCredential" c SET realm = u.realm FROM "User" u WHERE u.id = c."userId";`
|
|
70
|
+
Rows left without a realm stop authenticating while realms are enabled; their
|
|
71
|
+
users re-enrol.
|
|
72
|
+
3. Pass `realm` to `enrolCredential` and `authenticateWithBiometric`.
|
|
73
|
+
|
|
74
|
+
Without realms (`realmExtractorInstance` not set) nothing changes: no column
|
|
75
|
+
needed, no argument needed.
|
|
76
|
+
|
|
30
77
|
## [0.14.0] - 2026-09-29
|
|
31
78
|
|
|
32
79
|
Biometric authentication works. It has been exported since v0.1.3 and never did.
|
package/README.md
CHANGED
|
@@ -941,6 +941,7 @@ const { credentialId } = await biometricAuth.enrolCredential({
|
|
|
941
941
|
publicKey, // PEM, SPKI
|
|
942
942
|
deviceName: 'iPhone 15',
|
|
943
943
|
metadata: { yourDeviceString: '...' }, // optional, opaque to the package
|
|
944
|
+
realm, // required with realms enabled; the credential is bound to it
|
|
944
945
|
});
|
|
945
946
|
|
|
946
947
|
// 2. Request a challenge. No user id — the caller is usually signed out.
|
|
@@ -968,6 +969,7 @@ credentialId)` to deactivate one.
|
|
|
968
969
|
| Challenge | 32 random bytes, single use, 60s default |
|
|
969
970
|
| Replay | A challenge is consumed **atomically** before anything is checked, so a retry loses the race — and a failed attempt still burns it |
|
|
970
971
|
| Cross-credential | A challenge issued for one credential cannot be answered with another's key |
|
|
972
|
+
| Realm | A credential signs in only to the realm it was enrolled in (since 0.15.0). With realms enabled, `enrolCredential` and `authenticateWithBiometric` require `realm` |
|
|
971
973
|
| Algorithm | Pinned **per credential**. A credential enrolled as ES256 is only verified as ES256; no verifier for its algorithm means refusal, not a fallback |
|
|
972
974
|
| Account status | The session comes from the same sink as every other login, so a suspended or soft-deleted user is refused **after** a valid signature |
|
|
973
975
|
| Enumeration | Every biometric failure returns the same 401, and a challenge is issued even for a credential that does not exist |
|
|
@@ -994,6 +996,8 @@ which is the replay single use exists to prevent.
|
|
|
994
996
|
|
|
995
997
|
Two more things your schema needs to know:
|
|
996
998
|
|
|
999
|
+
- **Persist `realm` on the credential** and return it from `getCredential`. A
|
|
1000
|
+
credential without its realm, while realms are enabled, never authenticates.
|
|
997
1001
|
- **`credentialId` on a challenge is not a foreign key.** A challenge is stored
|
|
998
1002
|
for credential ids that do not exist, so that the signed-out request cannot be
|
|
999
1003
|
used to discover which credentials are enrolled.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"biometric-repository.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/biometric-repository.interface.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IAWpB,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AASD,MAAM,WAAW,wBAAwB;IAgBvC,cAAc,CAAC,KAAK,EAAE;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC;KACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IA2BpB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAQhF,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAUD,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;IAMlB,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"biometric-repository.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/biometric-repository.interface.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IAWpB,YAAY,EAAE,MAAM,CAAC;IAErB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB;AASD,MAAM,WAAW,wBAAwB;IAgBvC,cAAc,CAAC,KAAK,EAAE;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC;KACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IA2BpB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAC;IAQhF,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAUD,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,MAAM,CAAC;IAMlB,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAOnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IAExB,QAAQ,EAAE,OAAO,CAAC;IAElB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAcD,MAAM,WAAW,oBAAqB,SAAQ,wBAAwB;IAEpE,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAUlE,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IAG/E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IAGtF,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG1D,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
import { IBiometricRepository } from '../interfaces/biometric-repository.interface';
|
|
2
2
|
import { IBiometricVerifier } from '../interfaces/biometric-verifier.interface';
|
|
3
3
|
import { IAuthLogger } from '../interfaces/auth-logger.interface';
|
|
4
|
+
import type { AuthModuleOptions } from '../auth.module';
|
|
4
5
|
import { BiometricChallengeService } from './biometric-challenge.service';
|
|
5
6
|
import { AuthService } from './auth.service';
|
|
6
7
|
export interface BiometricCredentialSummary {
|
|
@@ -20,13 +21,15 @@ export declare class BiometricAuthService {
|
|
|
20
21
|
private readonly authService;
|
|
21
22
|
private readonly logger;
|
|
22
23
|
private readonly verifiersByAlgorithm;
|
|
23
|
-
|
|
24
|
+
private readonly realmsEnabled;
|
|
25
|
+
constructor(biometricRepository: IBiometricRepository, securityLogger: IAuthLogger, verifiers: IBiometricVerifier[], challenges: BiometricChallengeService, authService: AuthService, options: AuthModuleOptions);
|
|
24
26
|
enrolCredential(input: {
|
|
25
27
|
userId: string;
|
|
26
28
|
publicKey: string;
|
|
27
29
|
deviceName: string;
|
|
28
30
|
algorithm?: string;
|
|
29
31
|
metadata?: Record<string, unknown>;
|
|
32
|
+
realm?: string;
|
|
30
33
|
}): Promise<BiometricCredentialSummary>;
|
|
31
34
|
requestChallenge(credentialId: string, opts?: {
|
|
32
35
|
ipAddress?: string;
|
|
@@ -50,6 +53,7 @@ export declare class BiometricAuthService {
|
|
|
50
53
|
}>;
|
|
51
54
|
listCredentials(userId: string, realm?: string): Promise<BiometricCredentialSummary[]>;
|
|
52
55
|
removeCredential(userId: string, credentialId: string): Promise<void>;
|
|
56
|
+
private requireRealm;
|
|
53
57
|
private get defaultAlgorithm();
|
|
54
58
|
private summarise;
|
|
55
59
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"biometric-auth.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"biometric-auth.service.d.ts","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,oBAAoB,EACrB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAiB,MAAM,qCAAqC,CAAC;AAOjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAGD,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACjF,CAAC;AA0BF,qBACa,oBAAoB;IAO7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAG/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAZ9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAChE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAkC;IACvE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;gBAIrB,mBAAmB,EAAE,oBAAoB,EAEzC,cAAc,EAAE,WAAW,EAE5C,SAAS,EAAE,kBAAkB,EAAE,EACd,UAAU,EAAE,yBAAyB,EACrC,WAAW,EAAE,WAAW,EAEzC,OAAO,EAAE,iBAAiB;IA4BtB,eAAe,CAAC,KAAK,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAkDjC,gBAAgB,CACpB,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAChD,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAqBxE,yBAAyB,CAC7B,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EACvE,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,cAAc,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IA8FnD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC;IAWtF,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqB3E,OAAO,CAAC,YAAY;IAMpB,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,CAAC,SAAS;CASlB"}
|
|
@@ -21,15 +21,17 @@ const constants_1 = require("../constants");
|
|
|
21
21
|
const biometric_challenge_service_1 = require("./biometric-challenge.service");
|
|
22
22
|
const auth_service_1 = require("./auth.service");
|
|
23
23
|
let BiometricAuthService = BiometricAuthService_1 = class BiometricAuthService {
|
|
24
|
-
constructor(biometricRepository, securityLogger, verifiers, challenges, authService) {
|
|
24
|
+
constructor(biometricRepository, securityLogger, verifiers, challenges, authService, options) {
|
|
25
25
|
this.biometricRepository = biometricRepository;
|
|
26
26
|
this.securityLogger = securityLogger;
|
|
27
27
|
this.challenges = challenges;
|
|
28
28
|
this.authService = authService;
|
|
29
29
|
this.logger = new common_1.Logger(BiometricAuthService_1.name);
|
|
30
|
+
this.realmsEnabled = Boolean(options.realmExtractorInstance);
|
|
30
31
|
this.verifiersByAlgorithm = new Map(verifiers.map((v) => [v.algorithm, v]));
|
|
31
32
|
}
|
|
32
33
|
async enrolCredential(input) {
|
|
34
|
+
this.requireRealm(input.realm);
|
|
33
35
|
const algorithm = input.algorithm ?? this.defaultAlgorithm;
|
|
34
36
|
const verifier = this.verifiersByAlgorithm.get(algorithm);
|
|
35
37
|
if (!verifier) {
|
|
@@ -44,6 +46,7 @@ let BiometricAuthService = BiometricAuthService_1 = class BiometricAuthService {
|
|
|
44
46
|
publicKey: input.publicKey,
|
|
45
47
|
algorithm,
|
|
46
48
|
deviceName: input.deviceName,
|
|
49
|
+
...(input.realm !== undefined ? { realm: input.realm } : {}),
|
|
47
50
|
createdAt: new Date(),
|
|
48
51
|
lastUsedAt: null,
|
|
49
52
|
isActive: true,
|
|
@@ -61,6 +64,7 @@ let BiometricAuthService = BiometricAuthService_1 = class BiometricAuthService {
|
|
|
61
64
|
return this.challenges.issueChallenge(credentialId, opts);
|
|
62
65
|
}
|
|
63
66
|
async authenticateWithBiometric(input, opts = {}) {
|
|
67
|
+
this.requireRealm(opts.realm);
|
|
64
68
|
const fail = (reason, credentialId) => {
|
|
65
69
|
this.securityLogger.log(auth_logger_interface_1.SecurityEvent.BIOMETRIC_LOGIN_FAILURE, {
|
|
66
70
|
credentialId,
|
|
@@ -84,6 +88,9 @@ let BiometricAuthService = BiometricAuthService_1 = class BiometricAuthService {
|
|
|
84
88
|
if (!credential.isActive) {
|
|
85
89
|
return fail('credential_inactive', input.credentialId);
|
|
86
90
|
}
|
|
91
|
+
if ((credential.realm ?? undefined) !== opts.realm) {
|
|
92
|
+
return fail('credential_realm_mismatch', input.credentialId);
|
|
93
|
+
}
|
|
87
94
|
const verifier = this.verifiersByAlgorithm.get(credential.algorithm);
|
|
88
95
|
if (!verifier) {
|
|
89
96
|
this.logger.error(`Credential ${input.credentialId} is enrolled under algorithm ` +
|
|
@@ -128,6 +135,11 @@ let BiometricAuthService = BiometricAuthService_1 = class BiometricAuthService {
|
|
|
128
135
|
credentialId,
|
|
129
136
|
});
|
|
130
137
|
}
|
|
138
|
+
requireRealm(realm) {
|
|
139
|
+
if (this.realmsEnabled && (realm === undefined || realm === null)) {
|
|
140
|
+
throw new common_1.BadRequestException('Realm required');
|
|
141
|
+
}
|
|
142
|
+
}
|
|
131
143
|
get defaultAlgorithm() {
|
|
132
144
|
return this.verifiersByAlgorithm.keys().next().value;
|
|
133
145
|
}
|
|
@@ -147,7 +159,8 @@ exports.BiometricAuthService = BiometricAuthService = BiometricAuthService_1 = _
|
|
|
147
159
|
__param(0, (0, common_1.Inject)(constants_1.BIOMETRIC_REPOSITORY)),
|
|
148
160
|
__param(1, (0, common_1.Inject)(constants_1.AUTH_LOGGER)),
|
|
149
161
|
__param(2, (0, common_1.Inject)(constants_1.BIOMETRIC_VERIFIERS)),
|
|
162
|
+
__param(5, (0, common_1.Inject)(constants_1.AUTH_MODULE_OPTIONS)),
|
|
150
163
|
__metadata("design:paramtypes", [Object, Object, Array, biometric_challenge_service_1.BiometricChallengeService,
|
|
151
|
-
auth_service_1.AuthService])
|
|
164
|
+
auth_service_1.AuthService, Object])
|
|
152
165
|
], BiometricAuthService);
|
|
153
166
|
//# sourceMappingURL=biometric-auth.service.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"biometric-auth.service.js","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,
|
|
1
|
+
{"version":3,"file":"biometric-auth.service.js","sourceRoot":"","sources":["../../src/services/biometric-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,mCAAoC;AAMpC,+EAAiF;AACjF,4CAKsB;AAEtB,+EAA0E;AAC1E,iDAA6C;AAyCtC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAK/B,YAEE,mBAA0D,EAE1D,cAA4C,EAE5C,SAA+B,EACd,UAAqC,EACrC,WAAwB,EAEzC,OAA0B;QART,wBAAmB,GAAnB,mBAAmB,CAAsB;QAEzC,mBAAc,GAAd,cAAc,CAAa;QAG3B,eAAU,GAAV,UAAU,CAA2B;QACrC,gBAAW,GAAX,WAAW,CAAa;QAZ1B,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAgB9D,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAG7D,IAAI,CAAC,oBAAoB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,CAAC;IAsBD,KAAK,CAAC,eAAe,CAAC,KAOrB;QACC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAC7B,sDAAsD,SAAS,IAAI,CACpE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,8BAAqB,CAC7B,kCAAkC,SAAS,QAAQ,CACpD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA8B;YACxC,YAAY,EAAE,IAAA,mBAAU,GAAE;YAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS;YACT,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC;QAEF,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAEvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,kBAAkB,EAAE;YACxD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAWD,KAAK,CAAC,gBAAgB,CACpB,YAAoB,EACpB,OAA+C,EAAE;QAEjD,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAmBD,KAAK,CAAC,yBAAyB,CAC7B,KAAuE,EACvE,OAAqE,EAAE;QAEvE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,YAAqB,EAAS,EAAE;YAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;gBAC7D,YAAY;gBACZ,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM;aACP,CAAC,CAAC;YAGH,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,SAAS,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,+BAA+B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACpF,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC,qBAAqB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;QAID,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACnD,OAAO,IAAI,CAAC,2BAA2B,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAKd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,cAAc,KAAK,CAAC,YAAY,+BAA+B;gBAC7D,IAAI,UAAU,CAAC,SAAS,0CAA0C;gBAClE,8DAA8D,CACjE,CAAC;YACF,OAAO,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YAClC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,mBAAmB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;QAMD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CACrD,UAAU,CAAC,MAAM,EACjB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,KAAK,CACX,CAAC;QAIF,KAAK,IAAI,CAAC,mBAAmB;aAC1B,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC;aAC3C,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,oCAAoC,KAAK,CAAC,YAAY,YACpD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,uBAAuB,EAAE;YAC7D,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC;IACjB,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAc;QAClD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAClF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAQD,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,YAAoB;QACzD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAE9E,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAEhD,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAElE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,qCAAa,CAAC,wBAAwB,EAAE;YAC9D,MAAM;YACN,YAAY;SACb,CAAC,CAAC;IACL,CAAC;IAOO,YAAY,CAAC,KAAyB;QAC5C,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;IACjE,CAAC;IAEO,SAAS,CAAC,MAAiC;QACjD,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;CACF,CAAA;AAhRY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,gCAAoB,CAAC,CAAA;IAE5B,WAAA,IAAA,eAAM,EAAC,uBAAW,CAAC,CAAA;IAEnB,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAI3B,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;4DAFC,uDAAyB;QACxB,0BAAW;GAbhC,oBAAoB,CAgRhC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ambushsoftworks/nestjs-auth-graphql",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.15.0",
|
|
4
4
|
"description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|