@ambushsoftworks/nestjs-auth-graphql 0.15.1 → 0.16.0-rc.2

package/dist/testing/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SoftwareAuthenticator = exports.PasskeyRepositoryContractError = exports.assertPasskeyRepositoryContract = void 0;
+var passkey_repository_contract_1 = require("./passkey-repository.contract");
+Object.defineProperty(exports, "assertPasskeyRepositoryContract", { enumerable: true, get: function () { return passkey_repository_contract_1.assertPasskeyRepositoryContract; } });
+Object.defineProperty(exports, "PasskeyRepositoryContractError", { enumerable: true, get: function () { return passkey_repository_contract_1.PasskeyRepositoryContractError; } });
+var software_authenticator_1 = require("../test-utils/software-authenticator");
+Object.defineProperty(exports, "SoftwareAuthenticator", { enumerable: true, get: function () { return software_authenticator_1.SoftwareAuthenticator; } });
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":";;;AAMA,6EAGuC;AAFrC,8IAAA,+BAA+B,OAAA;AAC/B,6IAAA,8BAA8B,OAAA;AAEhC,+EAK8C;AAJ5C,+HAAA,qBAAqB,OAAA"}

package/dist/testing/passkey-repository.contract.d.ts

@@ -0,0 +1,8 @@
+import { IPasskeyRepository } from '../interfaces/passkey-repository.interface';
+export declare class PasskeyRepositoryContractError extends Error {
+    constructor(check: string, detail: string);
+}
+type Factory = () => IPasskeyRepository | Promise<IPasskeyRepository>;
+export declare function assertPasskeyRepositoryContract(factory: Factory): Promise<void>;
+export {};
+//# sourceMappingURL=passkey-repository.contract.d.ts.map

package/dist/testing/passkey-repository.contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-repository.contract.d.ts","sourceRoot":"","sources":["../../src/testing/passkey-repository.contract.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAGnB,MAAM,4CAA4C,CAAC;AAGpD,qBAAa,8BAA+B,SAAQ,KAAK;gBAC3C,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI1C;AAED,KAAK,OAAO,GAAG,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAuCtE,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAarF"}

package/dist/testing/passkey-repository.contract.js

@@ -0,0 +1,248 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasskeyRepositoryContractError = void 0;
+exports.assertPasskeyRepositoryContract = assertPasskeyRepositoryContract;
+const crypto_1 = require("crypto");
+const passkey_repository_interface_1 = require("../interfaces/passkey-repository.interface");
+class PasskeyRepositoryContractError extends Error {
+    constructor(check, detail) {
+        super(`IPasskeyRepository contract — ${check}: ${detail}`);
+        this.name = 'PasskeyRepositoryContractError';
+    }
+}
+exports.PasskeyRepositoryContractError = PasskeyRepositoryContractError;
+const CONCURRENCY = 8;
+const MAX_COUNTER = 2 ** 32 - 1;
+async function assertPasskeyRepositoryContract(factory) {
+    for (const [name, check] of CHECKS) {
+        const repository = await factory();
+        try {
+            await check(repository);
+        }
+        catch (error) {
+            if (error instanceof PasskeyRepositoryContractError)
+                throw error;
+            throw new PasskeyRepositoryContractError(name, `threw ${error instanceof Error ? `${error.name}: ${error.message}` : String(error)}`);
+        }
+    }
+}
+function fail(check, detail) {
+    throw new PasskeyRepositoryContractError(check, detail);
+}
+function credential(overrides = {}) {
+    return {
+        credentialId: `contract-${(0, crypto_1.randomUUID)()}`,
+        userId: `contract-user-${(0, crypto_1.randomUUID)()}`,
+        realm: 'contract-realm',
+        publicKey: 'pQECAyYgASFYIA',
+        counter: 0,
+        userHandle: `handle-${(0, crypto_1.randomUUID)()}`,
+        transports: ['internal', 'hybrid'],
+        deviceType: 'multiDevice',
+        backedUp: true,
+        aaguid: '00000000-0000-0000-0000-000000000000',
+        name: 'Contract passkey',
+        createdAt: new Date(Math.floor(Date.now() / 1000) * 1000),
+        lastUsedAt: null,
+        isActive: true,
+        ...overrides,
+    };
+}
+const sameTime = (a, b) => a === b || (a instanceof Date && b instanceof Date && Math.abs(a.getTime() - b.getTime()) < 1000);
+const CHECKS = [
+    [
+        'challenges round-trip every field',
+        async (repo) => {
+            const check = 'challenges round-trip every field';
+            const input = {
+                challenge: `challenge-${(0, crypto_1.randomUUID)()}`,
+                purpose: 'registration',
+                userId: `user-${(0, crypto_1.randomUUID)()}`,
+                realm: 'contract-realm',
+                userHandle: `handle-${(0, crypto_1.randomUUID)()}`,
+                expiresAt: new Date(Date.now() + 60_000),
+            };
+            const id = await repo.storeChallenge(input);
+            if (typeof id !== 'string' || id === '')
+                fail(check, `storeChallenge returned ${JSON.stringify(id)}`);
+            const got = await repo.consumeChallenge(id);
+            if (!got)
+                fail(check, 'consumeChallenge returned null for a fresh challenge');
+            for (const key of ['challenge', 'purpose', 'userId', 'realm', 'userHandle']) {
+                if (got[key] !== input[key]) {
+                    fail(check, `${key} came back as ${JSON.stringify(got[key])}, stored ${JSON.stringify(input[key])}`);
+                }
+            }
+            if (got.challengeId !== id)
+                fail(check, `challengeId came back as ${JSON.stringify(got.challengeId)}`);
+            if (!sameTime(got.expiresAt, input.expiresAt))
+                fail(check, 'expiresAt changed');
+        },
+    ],
+    [
+        'a challenge is claimed exactly once, under concurrency',
+        async (repo) => {
+            const check = 'a challenge is claimed exactly once, under concurrency';
+            const id = await repo.storeChallenge({
+                challenge: 'c',
+                purpose: 'authentication',
+                expiresAt: new Date(Date.now() + 60_000),
+            });
+            const claims = await Promise.all(Array.from({ length: CONCURRENCY }, () => repo.consumeChallenge(id)));
+            const won = claims.filter(Boolean).length;
+            if (won !== 1) {
+                fail(check, `${won} of ${CONCURRENCY} concurrent consumeChallenge calls succeeded. It must be one ` +
+                    'conditional update (UPDATE … WHERE used = false, then check the row count), not a read then a write.');
+            }
+            if (await repo.consumeChallenge(id))
+                fail(check, 'a consumed challenge was returned again');
+        },
+    ],
+    [
+        'expired and unknown challenges answer null',
+        async (repo) => {
+            const check = 'expired and unknown challenges answer null';
+            const id = await repo.storeChallenge({
+                challenge: 'c',
+                purpose: 'authentication',
+                expiresAt: new Date(Date.now() - 1_000),
+            });
+            if (await repo.consumeChallenge(id)) {
+                fail(check, 'an expired challenge was returned; check expiresAt in the claim, do not rely on a TTL');
+            }
+            if (await repo.consumeChallenge((0, crypto_1.randomUUID)()))
+                fail(check, 'an unknown challenge id returned a record');
+        },
+    ],
+    [
+        'credentials round-trip every field, counter up to 2^32-1',
+        async (repo) => {
+            const check = 'credentials round-trip every field';
+            const record = credential({ counter: MAX_COUNTER, metadata: { device: 'contract' } });
+            await repo.createCredential(record);
+            const got = await repo.getCredential(record.credentialId);
+            if (!got)
+                fail(check, 'getCredential returned null for a credential just created');
+            for (const key of [
+                'credentialId', 'userId', 'realm', 'publicKey', 'counter', 'userHandle',
+                'deviceType', 'backedUp', 'aaguid', 'name', 'isActive',
+            ]) {
+                if (got[key] !== record[key]) {
+                    fail(check, `${key} came back as ${JSON.stringify(got[key])}, stored ${JSON.stringify(record[key])}` +
+                        (key === 'counter' ? ' (a uint32: store it in a bigint column)' : ''));
+                }
+            }
+            if (JSON.stringify(got.transports) !== JSON.stringify(record.transports)) {
+                fail(check, `transports came back as ${JSON.stringify(got.transports)}`);
+            }
+            if (!sameTime(got.createdAt, record.createdAt))
+                fail(check, 'createdAt changed');
+            if (got.lastUsedAt !== null)
+                fail(check, `lastUsedAt came back as ${String(got.lastUsedAt)}, stored null`);
+        },
+    ],
+    [
+        'a duplicate credential id throws PasskeyCredentialExistsError and leaves the original',
+        async (repo) => {
+            const check = 'a duplicate credential id is refused';
+            const original = credential();
+            await repo.createCredential(original);
+            try {
+                await repo.createCredential(credential({ credentialId: original.credentialId }));
+            }
+            catch (error) {
+                if (!(error instanceof passkey_repository_interface_1.PasskeyCredentialExistsError)) {
+                    fail(check, `threw ${error instanceof Error ? error.name : String(error)}; map your unique-constraint ` +
+                        'violation (Prisma P2002) to PasskeyCredentialExistsError');
+                }
+                const kept = await repo.getCredential(original.credentialId);
+                if (kept?.userId !== original.userId)
+                    fail(check, "the original credential's owner changed");
+                return;
+            }
+            fail(check, 'a second credential with the same id, for another user, was accepted');
+        },
+    ],
+    [
+        'deactivated credentials are still returned',
+        async (repo) => {
+            const check = 'deactivated credentials are still returned';
+            const record = credential();
+            await repo.createCredential(record);
+            await repo.deactivateCredential(record.credentialId);
+            const got = await repo.getCredential(record.credentialId);
+            if (!got)
+                fail(check, 'getCredential hid a deactivated credential; the package decides, not the store');
+            if (got.isActive !== false)
+                fail(check, 'deactivateCredential did not set isActive to false');
+            const listed = await repo.listCredentials(record.userId, record.realm);
+            if (!listed.some((c) => c.credentialId === record.credentialId)) {
+                fail(check, 'listCredentials hid a deactivated credential');
+            }
+        },
+    ],
+    [
+        'listing is by user, narrowed by realm',
+        async (repo) => {
+            const check = 'listing is by user, narrowed by realm';
+            const userId = `contract-user-${(0, crypto_1.randomUUID)()}`;
+            const mine = credential({ userId, realm: 'realm-a' });
+            const otherRealm = credential({ userId, realm: 'realm-b' });
+            const otherUser = credential({ realm: 'realm-a' });
+            for (const c of [mine, otherRealm, otherUser])
+                await repo.createCredential(c);
+            const inRealm = (await repo.listCredentials(userId, 'realm-a')).map((c) => c.credentialId);
+            if (inRealm.length !== 1 || inRealm[0] !== mine.credentialId) {
+                fail(check, `listCredentials(user, 'realm-a') returned ${JSON.stringify(inRealm)}`);
+            }
+            const all = (await repo.listCredentials(userId)).map((c) => c.credentialId).sort();
+            const expected = [mine.credentialId, otherRealm.credentialId].sort();
+            if (JSON.stringify(all) !== JSON.stringify(expected)) {
+                fail(check, `listCredentials(user) returned ${JSON.stringify(all)}`);
+            }
+        },
+    ],
+    [
+        'updateCounter is a compare-and-set, under concurrency',
+        async (repo) => {
+            const check = 'updateCounter is a compare-and-set';
+            const record = credential({ counter: 3 });
+            await repo.createCredential(record);
+            const update = (expectedCounter, newCounter) => repo.updateCounter({
+                credentialId: record.credentialId,
+                expectedCounter,
+                newCounter,
+                backedUp: false,
+                lastUsedAt: new Date(),
+            });
+            if (await update(2, 9))
+                fail(check, 'applied with a stale expectedCounter');
+            const results = await Promise.all(Array.from({ length: CONCURRENCY }, (_, i) => update(3, 4 + i)));
+            const applied = results.filter(Boolean).length;
+            if (applied !== 1) {
+                fail(check, `${applied} of ${CONCURRENCY} concurrent updates from the same counter applied. It must be one ` +
+                    'conditional update (UPDATE … WHERE counter = expected), not a read then a write.');
+            }
+            const got = await repo.getCredential(record.credentialId);
+            if (!got || got.counter < 4)
+                fail(check, `the counter is ${String(got?.counter)} after an applied update`);
+            if (got.backedUp !== false)
+                fail(check, 'backedUp was not written');
+            if (!(got.lastUsedAt instanceof Date))
+                fail(check, 'lastUsedAt was not written');
+        },
+    ],
+    [
+        'renameCredential changes the name',
+        async (repo) => {
+            const record = credential();
+            await repo.createCredential(record);
+            await repo.renameCredential(record.credentialId, 'Renamed');
+            const got = await repo.getCredential(record.credentialId);
+            if (got?.name !== 'Renamed') {
+                fail('renameCredential changes the name', `name is ${JSON.stringify(got?.name)}`);
+            }
+        },
+    ],
+];
+//# sourceMappingURL=passkey-repository.contract.js.map

package/dist/testing/passkey-repository.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-repository.contract.js","sourceRoot":"","sources":["../../src/testing/passkey-repository.contract.ts"],"names":[],"mappings":";;;AAsDA,0EAaC;AAnED,mCAAoC;AACpC,6FAIoD;AAGpD,MAAa,8BAA+B,SAAQ,KAAK;IACvD,YAAY,KAAa,EAAE,MAAc;QACvC,KAAK,CAAC,iCAAiC,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AALD,wEAKC;AAKD,MAAM,WAAW,GAAG,CAAC,CAAC;AAGtB,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAiCzB,KAAK,UAAU,+BAA+B,CAAC,OAAgB;IACpE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,YAAY,8BAA8B;gBAAE,MAAM,KAAK,CAAC;YACjE,MAAM,IAAI,8BAA8B,CACtC,IAAI,EACJ,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc;IACzC,MAAM,IAAI,8BAA8B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,YAA8C,EAAE;IAClE,OAAO;QACL,YAAY,EAAE,YAAY,IAAA,mBAAU,GAAE,EAAE;QACxC,MAAM,EAAE,iBAAiB,IAAA,mBAAU,GAAE,EAAE;QACvC,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,UAAU,IAAA,mBAAU,GAAE,EAAE;QACpC,UAAU,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;QAClC,UAAU,EAAE,aAAa;QACzB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,sCAAsC;QAC9C,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QACzD,UAAU,EAAE,IAAI;QAChB,QAAQ,EAAE,IAAI;QACd,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAA0B,EAAE,CAA0B,EAAE,EAAE,CAC1E,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;AAEpG,MAAM,MAAM,GAAiE;IAC3E;QACE,mCAAmC;QACnC,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,mCAAmC,CAAC;YAClD,MAAM,KAAK,GAAG;gBACZ,SAAS,EAAE,aAAa,IAAA,mBAAU,GAAE,EAAE;gBACtC,OAAO,EAAE,cAAuB;gBAChC,MAAM,EAAE,QAAQ,IAAA,mBAAU,GAAE,EAAE;gBAC9B,KAAK,EAAE,gBAAgB;gBACvB,UAAU,EAAE,UAAU,IAAA,mBAAU,GAAE,EAAE;gBACpC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,sDAAsD,CAAC,CAAC;YAC9E,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAU,EAAE,CAAC;gBACrF,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,KAAK,EAAE,GAAG,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;gBACvG,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,WAAW,KAAK,EAAE;gBAAE,IAAI,CAAC,KAAK,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACvG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAClF,CAAC;KACF;IACD;QACE,wDAAwD;QACxD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,wDAAwD,CAAC;YACvE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACnC,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,gBAAgB;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;aACzC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC1C,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;gBACd,IAAI,CACF,KAAK,EACL,GAAG,GAAG,OAAO,WAAW,+DAA+D;oBACrF,sGAAsG,CACzG,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;QAC9F,CAAC;KACF;IACD;QACE,4CAA4C;QAC5C,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACnC,SAAS,EAAE,GAAG;gBACd,OAAO,EAAE,gBAAgB;gBACzB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;aACxC,CAAC,CAAC;YACH,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,EAAE,uFAAuF,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAA,mBAAU,GAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;QAC1G,CAAC;KACF;IACD;QACE,0DAA0D;QAC1D,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,oCAAoC,CAAC;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,2DAA2D,CAAC,CAAC;YACnF,KAAK,MAAM,GAAG,IAAI;gBAChB,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY;gBACvE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU;aAC9C,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,IAAI,CACF,KAAK,EACL,GAAG,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;wBACtF,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,EAAE,CAAC,CACxE,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACzE,IAAI,CAAC,KAAK,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACjF,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI;gBAAE,IAAI,CAAC,KAAK,EAAE,2BAA2B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC7G,CAAC;KACF;IACD;QACE,uFAAuF;QACvF,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,sCAAsC,CAAC;YACrD,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YACnF,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,KAAK,YAAY,2DAA4B,CAAC,EAAE,CAAC;oBACrD,IAAI,CACF,KAAK,EACL,SAAS,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B;wBACzF,0DAA0D,CAC7D,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC7D,IAAI,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,IAAI,CAAC,KAAK,EAAE,yCAAyC,CAAC,CAAC;gBAC7F,OAAO;YACT,CAAC;YACD,IAAI,CAAC,KAAK,EAAE,sEAAsE,CAAC,CAAC;QACtF,CAAC;KACF;IACD;QACE,4CAA4C;QAC5C,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,4CAA4C,CAAC;YAC3D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,KAAK,EAAE,gFAAgF,CAAC,CAAC;YACxG,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,oDAAoD,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChE,IAAI,CAAC,KAAK,EAAE,8CAA8C,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;KACF;IACD;QACE,uCAAuC;QACvC,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,uCAAuC,CAAC;YACtD,MAAM,MAAM,GAAG,iBAAiB,IAAA,mBAAU,GAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAE9E,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC7D,IAAI,CAAC,KAAK,EAAE,6CAA6C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;YACnF,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,kCAAkC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;KACF;IACD;QACE,uDAAuD;QACvD,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,KAAK,GAAG,oCAAoC,CAAC;YACnD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,CAAC,eAAuB,EAAE,UAAkB,EAAE,EAAE,CAC7D,IAAI,CAAC,aAAa,CAAC;gBACjB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,eAAe;gBACf,UAAU;gBACV,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;YAEL,IAAI,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;YAC5E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnG,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;YAC/C,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,IAAI,CACF,KAAK,EACL,GAAG,OAAO,OAAO,WAAW,oEAAoE;oBAC9F,kFAAkF,CACrF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,kBAAkB,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,0BAA0B,CAAC,CAAC;YAC3G,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,YAAY,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;QACnF,CAAC;KACF;IACD;QACE,mCAAmC;QACnC,KAAK,EAAE,IAAI,EAAE,EAAE;YACb,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC1D,IAAI,GAAG,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,mCAAmC,EAAE,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KACF;CACF,CAAC"}

package/dist/utils/passkey-rp.d.ts

@@ -0,0 +1,13 @@
+export interface PasskeyRelyingPartyConfig {
+    id: string | ((realm?: string) => string);
+    name: string | ((realm?: string) => string);
+    origins: string[] | ((realm?: string) => string[]);
+}
+export interface ResolvedRelyingPartyValues {
+    id: string;
+    name: string;
+    origins: string[];
+}
+export declare function resolveRelyingParty(config: PasskeyRelyingPartyConfig, realm?: string): ResolvedRelyingPartyValues;
+export declare function assertUsableRelyingParty(rp: ResolvedRelyingPartyValues, realm?: string): void;
+//# sourceMappingURL=passkey-rp.d.ts.map

package/dist/utils/passkey-rp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-rp.d.ts","sourceRoot":"","sources":["../../src/utils/passkey-rp.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,yBAAyB;IAExC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IAE1C,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IAM5C,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAcD,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,yBAAyB,EACjC,KAAK,CAAC,EAAE,MAAM,GACb,0BAA0B,CAQ5B;AAWD,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,0BAA0B,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CA+B7F"}

package/dist/utils/passkey-rp.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveRelyingParty = resolveRelyingParty;
+exports.assertUsableRelyingParty = assertUsableRelyingParty;
+const net_1 = require("net");
+const invalid_auth_config_exception_1 = require("../exceptions/invalid-auth-config.exception");
+const ANDROID_ORIGIN = /^android:apk-key-hash:[A-Za-z0-9_-]{43}$/;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+function resolveRelyingParty(config, realm) {
+    const resolved = {
+        id: call(config.id, realm, 'passkey.rp.id'),
+        name: call(config.name, realm, 'passkey.rp.name'),
+        origins: call(config.origins, realm, 'passkey.rp.origins'),
+    };
+    assertUsableRelyingParty(resolved, realm);
+    return resolved;
+}
+function assertUsableRelyingParty(rp, realm) {
+    const where = realm === undefined ? '' : ` for realm "${realm}"`;
+    const id = rp.id;
+    if (typeof id !== 'string' || id === '' || id !== id.toLowerCase() || !/^[a-z0-9.-]+$/.test(id)) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.id${where} must be a lowercase domain such as 'example.com', ` +
+            `with no scheme, port or path; received ${JSON.stringify(id)}.`);
+    }
+    if ((0, net_1.isIP)(id) !== 0) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.id${where} must be a domain, not an IP address; received "${id}". ` +
+            "WebAuthn does not allow IP addresses. Use 'localhost' for local development.");
+    }
+    if (typeof rp.name !== 'string' || rp.name.trim() === '') {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.name${where} must be a non-empty string, e.g. your product name.`);
+    }
+    if (!Array.isArray(rp.origins) || rp.origins.length === 0) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.origins${where} must list at least one origin, e.g. ` +
+            `['https://app.${id}'].`);
+    }
+    for (const origin of rp.origins) {
+        assertUsableOrigin(origin, id, where);
+    }
+}
+function assertUsableOrigin(origin, rpId, where) {
+    if (typeof origin !== 'string') {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.origins${where} must contain strings; received ${JSON.stringify(origin)}.`);
+    }
+    if (origin.startsWith('android:')) {
+        if (!ANDROID_ORIGIN.test(origin)) {
+            throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.origins${where} has a malformed Android origin "${origin}". ` +
+                "It must be 'android:apk-key-hash:' followed by the base64url (no padding) SHA-256 of " +
+                'the app signing certificate: 43 characters. A colon-separated hex fingerprint, as ' +
+                'keytool prints it, must be converted first.');
+        }
+        return;
+    }
+    let parsed;
+    try {
+        parsed = new URL(origin);
+    }
+    catch {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.origins${where} has "${origin}", which is not an origin. ` +
+            "Use the scheme and host only, e.g. 'https://app.example.com'.");
+    }
+    if (parsed.origin !== origin) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.origins${where} has "${origin}", which is not exactly an origin ` +
+            `(did you mean "${parsed.origin}"?). Browsers send scheme, host and port only, with no ` +
+            'path and no trailing slash, and the comparison is exact.');
+    }
+    const loopback = LOOPBACK_HOSTS.has(parsed.hostname);
+    if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && loopback)) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.origins${where} has "${origin}". WebAuthn requires https, except ` +
+            'on localhost.');
+    }
+    const host = parsed.hostname;
+    if (host !== rpId && !host.endsWith(`.${rpId}`)) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] passkey.rp.origins${where} has "${origin}", whose host is neither ` +
+            `passkey.rp.id ("${rpId}") nor a subdomain of it. Browsers refuse such a ceremony ` +
+            'before it reaches the server.');
+    }
+}
+function call(value, realm, setting) {
+    if (typeof value !== 'function') {
+        return value;
+    }
+    try {
+        return value(realm);
+    }
+    catch (error) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] ${setting} is a resolver that threw for realm ${JSON.stringify(realm)}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+//# sourceMappingURL=passkey-rp.js.map

package/dist/utils/passkey-rp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-rp.js","sourceRoot":"","sources":["../../src/utils/passkey-rp.ts"],"names":[],"mappings":";;AA0CA,kDAWC;AAWD,4DA+BC;AA/FD,6BAA2B;AAC3B,+FAAyF;AA6BzF,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAWpE,SAAgB,mBAAmB,CACjC,MAAiC,EACjC,KAAc;IAEd,MAAM,QAAQ,GAAG;QACf,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC;QAC3C,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,iBAAiB,CAAC;QACjD,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC;KAC3D,CAAC;IACF,wBAAwB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD,SAAgB,wBAAwB,CAAC,EAA8B,EAAE,KAAc;IACrF,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,KAAK,GAAG,CAAC;IACjE,MAAM,EAAE,GAAY,EAAE,CAAC,EAAE,CAAC;IAE1B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,0DAA0B,CAClC,6BAA6B,KAAK,qDAAqD;YACrF,0CAA0C,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,IAAA,UAAI,EAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,0DAA0B,CAClC,6BAA6B,KAAK,mDAAmD,EAAE,KAAK;YAC1F,8EAA8E,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,0DAA0B,CAClC,+BAA+B,KAAK,sDAAsD,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,0DAA0B,CAClC,kCAAkC,KAAK,uCAAuC;YAC5E,iBAAiB,EAAE,KAAK,CAC3B,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAChC,kBAAkB,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAe,EAAE,IAAY,EAAE,KAAa;IACtE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,0DAA0B,CAClC,kCAAkC,KAAK,mCAAmC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,0DAA0B,CAClC,kCAAkC,KAAK,oCAAoC,MAAM,KAAK;gBACpF,uFAAuF;gBACvF,oFAAoF;gBACpF,6CAA6C,CAChD,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0DAA0B,CAClC,kCAAkC,KAAK,SAAS,MAAM,6BAA6B;YACjF,+DAA+D,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,0DAA0B,CAClC,kCAAkC,KAAK,SAAS,MAAM,oCAAoC;YACxF,kBAAkB,MAAM,CAAC,MAAM,yDAAyD;YACxF,0DAA0D,CAC7D,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,0DAA0B,CAClC,kCAAkC,KAAK,SAAS,MAAM,qCAAqC;YACzF,eAAe,CAClB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,0DAA0B,CAClC,kCAAkC,KAAK,SAAS,MAAM,2BAA2B;YAC/E,mBAAmB,IAAI,4DAA4D;YACnF,+BAA+B,CAClC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAI,KAAkC,EAAE,KAAyB,EAAE,OAAe;IAC7F,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAQ,KAA+B,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,0DAA0B,CAClC,gBAAgB,OAAO,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KACjF,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.15.1",
+  "version": "0.16.0-rc.2",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "dist",
+    "testing",
     "examples",
     "CHANGELOG.md",
     "README.md",
@@ -59,6 +60,7 @@
     "@nestjs/jwt": "^10.0.0 || ^11.0.0",
     "@nestjs/passport": "^10.0.0 || ^11.0.0",
     "@nestjs/throttler": "^6.0.0",
+    "@simplewebauthn/server": "^14.0.0",
     "graphql": "^16.0.0",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.0",
@@ -67,6 +69,9 @@
     "rxjs": "^7.0.0"
   },
   "peerDependenciesMeta": {
+    "@simplewebauthn/server": {
+      "optional": true
+    },
     "resend": {
       "optional": true
     }
@@ -90,6 +95,7 @@
     "@nestjs/platform-express": "^10.4.22",
     "@nestjs/testing": "^10.3.1",
     "@nestjs/throttler": "^6.4.0",
+    "@simplewebauthn/server": "^14.0.3",
     "@types/bcrypt": "^6.0.0",
     "@types/jest": "^29.5.11",
     "@types/node": "^20.11.5",

package/testing/package.json

@@ -0,0 +1,5 @@
+{
+  "//": "Resolves @ambushsoftworks/nestjs-auth-graphql/testing without an `exports` map, which would break existing deep imports into dist/.",
+  "main": "../dist/testing/index.js",
+  "types": "../dist/testing/index.d.ts"
+}