@ambushsoftworks/nestjs-auth-graphql 0.17.0 → 0.18.0

package/examples/email-challenge/prisma-email-challenge.repository.ts

@@ -0,0 +1,85 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
+import {
+  EmailChallengeRecord,
+  IEmailChallengeRepository,
+} from '@ambushsoftworks/nestjs-auth-graphql';
+
+/**
+ * IEmailChallengeRepository on Prisma, for the model in ./schema.prisma.
+ *
+ * Verified against PostgreSQL 16 with `assertEmailChallengeRepositoryContract`
+ * from `@ambushsoftworks/nestjs-auth-graphql/testing`. Run that contract
+ * against your copy, too, on your real database:
+ *
+ *   await assertEmailChallengeRepositoryContract(() => new PrismaEmailChallengeRepository(prisma), {
+ *     cleanup: async ({ challengeIds }) => {
+ *       await prisma.emailChallenge.deleteMany({ where: { id: { in: challengeIds } } });
+ *     },
+ *   });
+ *
+ * Inject your own PrismaService in place of PrismaClient if you have one.
+ */
+@Injectable()
+export class PrismaEmailChallengeRepository implements IEmailChallengeRepository {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async createChallenge(record: EmailChallengeRecord): Promise<void> {
+    await this.prisma.emailChallenge.create({
+      data: {
+        id: record.id,
+        emailHash: record.emailHash,
+        purposeHash: record.purposeHash,
+        codeHash: record.codeHash,
+        attempts: record.attempts,
+        consumedAt: record.consumedAt,
+        expiresAt: record.expiresAt,
+        createdAt: record.createdAt,
+      },
+    });
+  }
+
+  /** Whatever its state: the package decides what expired, consumed and exhausted mean. */
+  async findChallenge(id: string): Promise<EmailChallengeRecord | null> {
+    return this.prisma.emailChallenge.findUnique({ where: { id } });
+  }
+
+  /** One conditional update: never a read followed by a write. */
+  async registerAttempt(id: string, maxAttempts: number): Promise<boolean> {
+    const { count } = await this.prisma.emailChallenge.updateMany({
+      where: { id, consumedAt: null, attempts: { lt: maxAttempts } },
+      data: { attempts: { increment: 1 } },
+    });
+    return count === 1;
+  }
+
+  /** One conditional update: never a read followed by a write. */
+  async consumeChallenge(id: string): Promise<boolean> {
+    const { count } = await this.prisma.emailChallenge.updateMany({
+      where: { id, consumedAt: null },
+      data: { consumedAt: new Date() },
+    });
+    return count === 1;
+  }
+
+  async invalidateChallenges(filter: { purposeHash: string; emailHash?: string }): Promise<number> {
+    const { count } = await this.prisma.emailChallenge.updateMany({
+      where: {
+        purposeHash: filter.purposeHash,
+        // Only when given. `emailHash: undefined` would mean the same to Prisma,
+        // but spelling it out keeps the intent from depending on that.
+        ...(filter.emailHash !== undefined ? { emailHash: filter.emailHash } : {}),
+        consumedAt: null,
+      },
+      data: { consumedAt: new Date() },
+    });
+    return count;
+  }
+
+  async deleteExpiredChallenges(): Promise<number> {
+    const { count } = await this.prisma.emailChallenge.deleteMany({
+      where: { expiresAt: { lt: new Date() } },
+    });
+    return count;
+  }
+}

package/examples/email-challenge/schema.prisma

@@ -0,0 +1,24 @@
+// Reference schema for IEmailChallengeRepository, as in the README ("Email
+// Challenges"). Verified against PostgreSQL 16 with
+// `assertEmailChallengeRepositoryContract`.
+//
+// Merge this model into your schema. It has no relation to your User model, on
+// purpose: these codes go to people who are not users.
+//
+// Nothing in a row is readable. The address, the purpose and the code are
+// keyed hashes computed by the package (64 hex characters each), and the id is
+// 43 random base64url characters.
+
+model EmailChallenge {
+  id          String    @id               // generated by the package, not by the database
+  emailHash   String
+  purposeHash String
+  codeHash    String
+  attempts    Int       @default(0)
+  consumedAt  DateTime?                   // null while the code can still be used
+  expiresAt   DateTime
+  createdAt   DateTime
+
+  @@index([purposeHash, emailHash])
+  @@index([expiresAt])
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",