@ambushsoftworks/nestjs-auth-graphql 0.6.7 → 0.8.0

package/README.md

@@ -1,6 +1,6 @@
 # @ambushsoftworks/nestjs-auth-graphql
 
-Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cookie auth, multi-tenancy, OAuth, email verification, and more -- with zero database coupling.
+Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cookie auth, multi-tenancy, realm-based identity isolation, OAuth, email verification, and more -- with zero database coupling.
 
 ## Table of Contents
 
@@ -11,6 +11,7 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
 - [Features](#features)
   - [Cookie Authentication](#cookie-authentication)
   - [Multi-Tenancy](#multi-tenancy)
+  - [Realm-Based Identity Isolation](#realm-based-identity-isolation)
   - [API Key Authentication](#api-key-authentication)
   - [Email System](#email-system)
   - [Verification Modes](#verification-modes)
@@ -206,6 +207,8 @@ TypeScript decorator metadata is not preserved when importing from compiled npm
 
 When cookie auth is enabled, pass the GraphQL `context` so tokens are set as HttpOnly cookies. The response body will contain empty strings for `accessToken`/`refreshToken`.
 
+**Reference template:** `examples/full-resolver-template.ts` ships in the published package and covers every `perform*` method with copy-paste-ready `@Mutation`/`@Query` decorators, `@Throttle` on auth-sensitive endpoints, and `@UseGuards(JwtAuthGuard)` on authenticated routes. It also demonstrates the `changePassword` + `issueAuthSession` keep-alive pattern. Each `perform*` method on `BaseAuthResolver` also has a method-specific JSDoc snippet you can lift directly.
+
 ### Available `perform*()` methods
 
 **Authentication:**
@@ -363,6 +366,8 @@ const extractor = new HeaderTenantExtractor();
 const extractor = new HeaderTenantExtractor('x-org-id');
 ```
 
+`extractTenantId` may also return `Promise<string | null>`. `TenantGuard` awaits the result with no microtask overhead for sync returns. Async throws and rejected Promises are treated identically to a sync `null` return — the request is rejected with `400 Bad Request` and the internal cause is logged via Nest's `Logger` (never leaked to the client).
+
 **Access tenant context** in resolvers:
 
 ```typescript
@@ -397,6 +402,100 @@ For resource-scoped permissions, combine with `@ResourceScope()` and provide an
 async updateClient(@Args('clientId') clientId: string) { /* ... */ }
 ```
 
+### Realm-Based Identity Isolation
+
+Realms partition the user identity space so that users in one realm are completely invisible to another. The same email address can exist independently in different realms, each with its own password, tokens, and verification state. This is useful for white-label platforms, multi-brand businesses, and franchise systems.
+
+Realms are opt-in: provide a `realmExtractorInstance` in `AuthModuleOptions`. No separate feature flag is needed. When not provided, everything works exactly as before.
+
+**Implement `IRealmExtractor`:**
+
+```typescript
+import { Injectable } from '@nestjs/common';
+import { IRealmExtractor } from '@ambushsoftworks/nestjs-auth-graphql';
+
+@Injectable()
+export class HostnameRealmExtractor implements IRealmExtractor {
+  extractRealm(request: Record<string, any>): string | null {
+    const host = request.headers?.host;
+    if (!host) return null;
+    // e.g., "acme.example.com" -> "acme"
+    const subdomain = host.split('.')[0];
+    return subdomain || null;
+  }
+}
+```
+
+**Async extractor (DB-backed lookup):** `extractRealm` may also return `Promise<string | null>`. `RealmMiddleware` awaits the result with no microtask overhead for sync returns (`instanceof Promise` gate). Async throws and rejected Promises are treated identically to a sync `null` return — the request is rejected with `400 Bad Request` and the internal cause is logged via Nest's `Logger` (never leaked to the client). The same widening applies to `ITenantExtractor.extractTenantId`.
+
+```typescript
+@Injectable()
+export class DbRealmExtractor implements IRealmExtractor {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async extractRealm(request: Record<string, any>): Promise<string | null> {
+    const host = request.headers?.host;
+    if (!host) return null;
+    const site = await this.prisma.site.findUnique({ where: { hostname: host } });
+    return site ? `site:${site.slug}` : null;
+  }
+}
+```
+
+**Register the module with realm support:**
+
+```typescript
+AuthModule.forRootAsync({
+  imports: [ConfigModule, DatabaseModule],
+  inject: [UsersRepository, RefreshTokenRepository, HostnameRealmExtractor, ConfigService],
+  useFactory: (usersRepo, tokenRepo, realmExtractor, config) => ({
+    userRepositoryInstance: usersRepo,
+    refreshTokenRepositoryInstance: tokenRepo,
+    jwtSecret: config.get('JWT_SECRET'),
+    realmExtractorInstance: realmExtractor,
+  }),
+})
+```
+
+`RealmMiddleware` is automatically registered by `AuthModule` — no manual middleware registration needed. When a `realmExtractorInstance` is provided, the middleware calls `extractor.extractRealm(request)` on every request before any guards run. If the extractor returns `null`, the request is rejected with `400 Bad Request` (strict mode).
+
+**Use `@CurrentRealm()` in resolvers:**
+
+```typescript
+import { CurrentRealm } from '@ambushsoftworks/nestjs-auth-graphql';
+
+@Resolver()
+export class AuthResolver extends BaseAuthResolver<User> {
+  @Mutation(() => AuthResponse)
+  async signup(
+    @Args('input') input: SignupInput,
+    @CurrentRealm() realm: string,
+    @Context() ctx: any,
+  ) {
+    return this.performSignup(input, ctx);
+  }
+}
+```
+
+`BaseAuthResolver` automatically extracts the realm from the GraphQL context via `getRealmFromContext()` and passes it to all service methods. Repository identity-resolution methods (`findByEmail`, `findByPhoneNumber`, `findByOAuthProvider`, `create`) receive the realm as a parameter so your implementation can scope queries accordingly.
+
+**JWT realm validation:** The JWT payload includes a `realm` claim. On subsequent requests, `JwtStrategy` validates that the realm in the token matches the realm resolved from the current request. A mismatch results in `401 Unauthorized`.
+
+**Rate limiter scoping:** When realms are enabled, rate limiter keys are automatically prefixed with the realm to prevent cross-realm interference (e.g., a lockout in realm A does not affect realm B).
+
+**Realms vs. Multi-Tenancy:**
+
+| Concern | Realms | Multi-Tenancy |
+|---------|--------|---------------|
+| Partitions | Identity (who the user _is_) | Authorization (what the user _can access_) |
+| Scope | User signup, login, tokens, verification | Permissions, resources, team membership |
+| Same email in multiple? | Yes -- fully independent users | Yes -- same user, different tenant contexts |
+| Guard layer | Middleware (before guards) | Guard (`TenantGuard`, after auth) |
+
+Realms and multi-tenancy are orthogonal and can be used together. For example, a white-label SaaS platform might use realms to isolate brand identities and tenancy to manage organizations within each brand.
+
+**Note:** Deprecated OAuth controller methods are not realm-aware. Use the current `BaseAuthResolver` OAuth methods for realm-scoped OAuth flows.
+
 ### API Key Authentication
 
 For machine-to-machine auth, provide an `IApiKeyRepository`:
@@ -520,6 +619,104 @@ The `OAuthController` is automatically registered and handles OAuth callback rou
 
 When `features.bruteForceProtection` is enabled and a `bruteForceRepositoryInstance` is provided, the module tracks failed login attempts and temporarily locks accounts. The lockout policy (attempt thresholds, lockout duration) is determined by your `IBruteForceRepository` implementation.
 
+#### IP Rate Limiting
+
+`BruteForceProtectionService.checkIpRateLimit(ipAddress, realm?)` enforces a sliding-window rate limit per IP. Opt in by setting `bruteForce.ipRateLimit`:
+
+```typescript
+import { RedisRateLimiter } from './redis-rate-limiter'; // your implementation
+
+AuthModule.forRootAsync({
+  inject: [RedisRateLimiter],
+  useFactory: (redisRateLimiter) => ({
+    // ...required options
+    rateLimiterInstance: redisRateLimiter,        // REQUIRED with ipRateLimit
+    bruteForce: {
+      ipRateLimit: { maxAttempts: 10, windowMs: 60_000 }, // 10 per minute per IP
+    },
+  }),
+})
+```
+
+When `bruteForce.ipRateLimit` is configured, `AuthModule.forRootAsync` requires an explicit `rateLimiterInstance` and throws `InvalidAuthConfigException` at boot otherwise:
+
+```
+[AuthModule] bruteForce.ipRateLimit is configured but rateLimiterInstance is undefined.
+The default InMemoryRateLimiterService is unsafe for multi-replica deployments
+(per-replica counters do not coordinate) and is not auto-applied for IP rate limiting.
+Provide rateLimiterInstance explicitly: a Redis-backed implementation for production,
+or `new InMemoryRateLimiterService()` for single-replica deployments / dev.
+To disable IP rate limiting, remove the bruteForce.ipRateLimit slot.
+```
+
+`checkIpRateLimit` reuses the same `IRateLimiter` infrastructure as password-reset throttling — implement once, reuse everywhere. For multi-replica production, back it with Redis (the same pattern documented for the `RefreshTokenService` cache applies). For single-replica or dev, `new InMemoryRateLimiterService()` is acceptable.
+
+Threshold is inclusive: with `maxAttempts: 5`, the user is blocked starting on the 5th attempt within the window (record-then-check ordering means `attempts >= maxAttempts` returns `true`). Tune your config accordingly — `maxAttempts: 5` is the first blocked attempt, not the first allowed-over.
+
+When realms are enabled, rate-limit keys are namespaced as `auth:ipRate:<realm>:<ipHash>` so a single shared store serves many realms without collisions. IPs are hashed via `hashIp(ip, salt)` (HMAC-SHA256, 16-char hex prefix) before becoming keys; raw IPs are never written to the store or to logs. The salt is resolved once at service construction with the following priority:
+
+1. `AUTH_IP_HASH_SALT` env var (recommended — dedicated, rotatable secret)
+2. `options.jwtSecret` (fallback; one-time INFO log when `bruteForce.ipRateLimit` is configured)
+3. Throws `InvalidAuthConfigException` if `bruteForce.ipRateLimit` is configured but neither salt source is available
+
+Note: the salt is read from `AuthModuleOptions` (not from `process.env.JWT_SECRET` directly), so consumers wiring their JWT secret via `@nestjs/config` / a secrets manager work correctly without populating `process.env.JWT_SECRET`.
+
+When the limit is exceeded, `SecurityEvent.IP_RATE_LIMIT_EXCEEDED` is logged. The method returns `boolean` and never throws — callers branch and produce their own error envelope (typically HTTP 429).
+
+#### Brute-Force Cleanup
+
+`BruteForceProtectionService.cleanupOldAttempts(olderThan: Date): Promise<number>` deletes failed-attempt records older than the cutoff and returns the deletion count. The package does NOT ship a scheduler — wire one in your application:
+
+```typescript
+import { Injectable, Logger } from '@nestjs/common';
+import { Cron } from '@nestjs/schedule';
+import { BruteForceProtectionService } from '@ambushsoftworks/nestjs-auth-graphql';
+
+@Injectable()
+export class BruteForceCleanupJob {
+  private readonly logger = new Logger(BruteForceCleanupJob.name);
+
+  constructor(private readonly bruteForce: BruteForceProtectionService) {}
+
+  @Cron('0 3 * * *') // daily at 03:00
+  async cleanup() {
+    const ninetyDaysAgo = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
+    const deleted = await this.bruteForce.cleanupOldAttempts(ninetyDaysAgo);
+    this.logger.log(`Cleaned ${deleted} old brute-force-attempt rows`);
+  }
+}
+```
+
+This requires `IBruteForceRepository.deleteOlderThan(beforeDate: Date): Promise<number>` on your repository implementation. Reference Prisma implementation: `return (await this.prisma.bruteForceAttempt.deleteMany({ where: { createdAt: { lt: beforeDate } } })).count;`. Multi-replica deployments should coordinate at the cron layer (advisory lock, leader election) or accept the duplicate-delete cost — `DELETE WHERE createdAt < ?` is idempotent.
+
+#### Stay Logged In After Password Change
+
+`changePassword` revokes every refresh token for the user (logging out all devices). To keep the current device logged in while logging out the others, compose `changePassword` with `issueAuthSession`:
+
+```typescript
+@Mutation(() => ChangePasswordResponse)
+@UseGuards(JwtAuthGuard)
+async changePassword(
+  @CurrentUser() user: User,
+  @Args('input') input: ChangePasswordInput,
+  @Context() ctx: any,
+): Promise<ChangePasswordResponse> {
+  const result = await this.performChangePassword(
+    user.id,
+    input.currentPassword,
+    input.newPassword,
+  );
+  // Mint a fresh session for THIS device. Other devices are already revoked.
+  // Use the inherited `getResponseFromContext` helper so cookies work under
+  // both Apollo (`ctx.res`) and Express/Fastify (`ctx.req.res`).
+  const res = this.getResponseFromContext(ctx);
+  const tokens = await this.authService.issueAuthSession(user.id, res);
+  return { ...result, accessToken: tokens.accessToken, refreshToken: tokens.refreshToken };
+}
+```
+
+`issueAuthSession(userId, res?, realm?)` mints a new access + refresh pair, persists the refresh token, and (when `features.cookieAuth` is enabled and `res` is supplied) sets the auth cookies on the response. The caller is responsible for verifying the user's identity — `issueAuthSession` takes a `userId` and trusts it. Pair it only with flows that have already authenticated the user (`changePassword`, MFA enrollment completion, admin-impersonation reissue, etc.). Emits `SecurityEvent.SESSION_ISSUED`.
+
 ### Password Policy
 
 ```typescript
@@ -609,6 +806,7 @@ jwtPayloadFactoryInstance: {
 | `nodeEnv` | `string` | `'production'` | Environment identifier |
 | `passwordPolicy` | `PasswordPolicyConfig` | See [Password Policy](#password-policy) | Password strength rules |
 | `encryptionKey` | `string` | -- | 32-byte hex string for AES-256-GCM (OAuth token encryption) |
+| `bruteForce.ipRateLimit` | `{ maxAttempts, windowMs }` | -- | IP rate-limit policy for `checkIpRateLimit`. When set, `rateLimiterInstance` MUST also be provided explicitly (boot fails with `InvalidAuthConfigException` otherwise). See [IP Rate Limiting](#ip-rate-limiting). |
 
 ### Feature Flags (`features`)
 
@@ -694,7 +892,8 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 | `resourcePermissionRepositoryInstance` | `IResourcePermissionRepository` | `null` |
 | `jwtPayloadFactoryInstance` | `IJwtPayloadFactory` | `DefaultJwtPayloadFactory` |
 | `apiKeyRepositoryInstance` | `IApiKeyRepository` | `null` |
-| `rateLimiterInstance` | `IRateLimiter` | `InMemoryRateLimiterService` |
+| `rateLimiterInstance` | `IRateLimiter` | `InMemoryRateLimiterService` (Note: this fallback does NOT apply when `bruteForce.ipRateLimit` is configured — boot fails with `InvalidAuthConfigException` and an explicit `rateLimiterInstance` is required. See [IP Rate Limiting](#ip-rate-limiting) above.) |
+| `realmExtractorInstance` | `IRealmExtractor` | `null` (realms disabled) |
 
 ---
 
@@ -708,6 +907,7 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 | `@RequirePermissions('p1', 'p2')` | Method/Class | Require specific permissions |
 | `@CurrentUser()` | Parameter | Inject authenticated user |
 | `@CurrentTenant()` | Parameter | Inject resolved tenant context |
+| `@CurrentRealm()` | Parameter | Inject resolved realm from request context |
 | `@ResourceScope('resourceType', 'argName')` | Method | Resource-level permission scoping |
 
 ## Guards
@@ -722,6 +922,8 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 
 ### Recommended Guard Chains
 
+When realm support is enabled, `RealmMiddleware` runs before all guards (as NestJS middleware) and attaches the resolved realm to `request._realm`. It is registered automatically by `AuthModule` -- see [Realm-Based Identity Isolation](#realm-based-identity-isolation).
+
 ```typescript
 // JWT only
 { provide: APP_GUARD, useClass: createAuthGuard(['jwt'], { allowPublic: true }) }
@@ -769,6 +971,7 @@ export class CustomGuard implements CanActivate {
 - **Stateless CSRF protection** for OAuth flows via `OAuthStateService`
 - **`__Host-` cookie prefix** support for enhanced cookie security
 - **Separate HMAC secrets** for refresh tokens, verification codes, and OAuth state
+- **Realm-based identity isolation** with JWT realm claim validation and realm-scoped rate limiting
 
 ## License
 

package/dist/auth.module.d.ts

@@ -1,4 +1,4 @@
-import { DynamicModule } from '@nestjs/common';
+import { DynamicModule, MiddlewareConsumer, NestModule } from '@nestjs/common';
 import { ModuleMetadata } from '@nestjs/common/interfaces';
 import { IUserRepository } from './interfaces/user-repository.interface';
 import { IEmailService } from './interfaces/email-service.interface';
@@ -11,6 +11,7 @@ import { IBiometricRepository } from './interfaces/biometric-repository.interfac
 import { IAuthLogger } from './interfaces/auth-logger.interface';
 import { ITenantRepository } from './interfaces/tenant-repository.interface';
 import { ITenantExtractor } from './interfaces/tenant-extractor.interface';
+import { IRealmExtractor } from './interfaces/realm-extractor.interface';
 import { IResourcePermissionRepository } from './interfaces/resource-permission-repository.interface';
 import { IJwtPayloadFactory } from './interfaces/jwt-payload-factory.interface';
 import { IApiKeyRepository } from './interfaces/api-key-repository.interface';
@@ -46,6 +47,7 @@ export interface AuthModuleOptions {
     nodeEnv?: string;
     tenantRepositoryInstance?: ITenantRepository;
     tenantExtractorInstance?: ITenantExtractor;
+    realmExtractorInstance?: IRealmExtractor;
     resourcePermissionRepositoryInstance?: IResourcePermissionRepository;
     jwtPayloadFactoryInstance?: IJwtPayloadFactory;
     apiKeyRepositoryInstance?: IApiKeyRepository;
@@ -98,6 +100,12 @@ export interface AuthModuleOptions {
     encryptionKey?: string;
     passwordPolicy?: PasswordPolicyConfig;
     rateLimiterInstance?: IRateLimiter;
+    bruteForce?: {
+        ipRateLimit?: {
+            maxAttempts: number;
+            windowMs: number;
+        };
+    };
     email?: {
         sender: IEmailSender;
         from: {
@@ -117,8 +125,10 @@ export interface AuthModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'>
     useFactory: (...args: any[]) => Promise<AuthModuleOptions> | AuthModuleOptions;
     inject?: any[];
 }
+export declare function validateAuthModuleOptions(opts: AuthModuleOptions): void;
 export { AUTH_MODULE_OPTIONS, USER_REPOSITORY, REFRESH_TOKEN_REPOSITORY, EMAIL_SERVICE, SMS_SERVICE, AUTH_LIFECYCLE_HOOKS, VERIFICATION_REPOSITORY, BRUTE_FORCE_REPOSITORY, BIOMETRIC_REPOSITORY, AUTH_LOGGER, RATE_LIMITER, TENANT_REPOSITORY, TENANT_EXTRACTOR, RESOURCE_PERMISSION_REPOSITORY, JWT_PAYLOAD_FACTORY, API_KEY_REPOSITORY, } from './constants';
-export declare class AuthModule {
+export declare class AuthModule implements NestModule {
+    configure(consumer: MiddlewareConsumer): void;
     static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule;
 }
 //# sourceMappingURL=auth.module.d.ts.map

package/dist/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAA4B,MAAM,gBAAgB,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAWjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA6B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAInE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IAOjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAO7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAO3C,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAQ7C,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAOxC,YAAY,CAAC,EAAE,MAAM,CAAC;IAKtB,QAAQ,CAAC,EAAE;QACT,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAO/B,YAAY,CAAC,EAAE,OAAO,CAAC;QAQvB,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAiBnC,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAKD,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;CAChB;AAMD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAyCrB,qBACa,UAAU;IA+BrB,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAkXpE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAWjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA8B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAInE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAIxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IAOjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAO7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAY3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAOzC,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAQ7C,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAOxC,YAAY,CAAC,EAAE,MAAM,CAAC;IAKtB,QAAQ,CAAC,EAAE;QACT,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAO/B,YAAY,CAAC,EAAE,OAAO,CAAC;QAQvB,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAuBnC,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAKD,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;CAChB;AAsBD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAmCvE;AAMD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAyCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CAoYpE"}

package/dist/auth.module.js

@@ -8,7 +8,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var AuthModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthModule = exports.API_KEY_REPOSITORY = exports.JWT_PAYLOAD_FACTORY = exports.RESOURCE_PERMISSION_REPOSITORY = exports.TENANT_EXTRACTOR = exports.TENANT_REPOSITORY = exports.RATE_LIMITER = exports.AUTH_LOGGER = exports.BIOMETRIC_REPOSITORY = exports.BRUTE_FORCE_REPOSITORY = exports.VERIFICATION_REPOSITORY = exports.AUTH_LIFECYCLE_HOOKS = exports.SMS_SERVICE = exports.EMAIL_SERVICE = exports.REFRESH_TOKEN_REPOSITORY = exports.USER_REPOSITORY = exports.AUTH_MODULE_OPTIONS = void 0;
+exports.validateAuthModuleOptions = validateAuthModuleOptions;
 const common_1 = require("@nestjs/common");
+const realm_middleware_1 = require("./middleware/realm.middleware");
 const jwt_1 = require("@nestjs/jwt");
 const passport_1 = require("@nestjs/passport");
 const auth_service_1 = require("./services/auth.service");
@@ -38,8 +40,31 @@ const api_key_strategy_1 = require("./strategies/api-key.strategy");
 const default_jwt_payload_factory_1 = require("./services/default-jwt-payload-factory");
 const constants_1 = require("./constants");
 const in_memory_rate_limiter_service_1 = require("./services/in-memory-rate-limiter.service");
+const invalid_auth_config_exception_1 = require("./exceptions/invalid-auth-config.exception");
 const configurable_email_service_1 = require("./services/configurable-email.service");
 const default_email_template_renderer_1 = require("./services/default-email-template-renderer");
+function validateAuthModuleOptions(opts) {
+    const ipRateLimit = opts.bruteForce?.ipRateLimit;
+    if (ipRateLimit && !opts.rateLimiterInstance) {
+        throw new invalid_auth_config_exception_1.InvalidAuthConfigException('[AuthModule] bruteForce.ipRateLimit is configured but rateLimiterInstance ' +
+            'is undefined. The default InMemoryRateLimiterService is unsafe for ' +
+            'multi-replica deployments (per-replica counters do not coordinate) ' +
+            'and is not auto-applied for IP rate limiting. Provide rateLimiterInstance ' +
+            'explicitly: a Redis-backed implementation for production, or ' +
+            '`new InMemoryRateLimiterService()` for single-replica deployments / dev. ' +
+            'To disable IP rate limiting, remove the bruteForce.ipRateLimit slot.');
+    }
+    if (ipRateLimit) {
+        const { maxAttempts, windowMs } = ipRateLimit;
+        if (!Number.isInteger(maxAttempts) || maxAttempts <= 0) {
+            throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] bruteForce.ipRateLimit.maxAttempts must be a positive integer; received ${String(maxAttempts)}. Zero would block every request; negative / fractional values are ` +
+                'invalid. Use a positive integer such as 10 (10 attempts per window).');
+        }
+        if (!Number.isInteger(windowMs) || windowMs <= 0) {
+            throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] bruteForce.ipRateLimit.windowMs must be a positive integer; received ${String(windowMs)}. Use a positive integer in milliseconds such as 60000 (1-minute window).`);
+        }
+    }
+}
 var constants_2 = require("./constants");
 Object.defineProperty(exports, "AUTH_MODULE_OPTIONS", { enumerable: true, get: function () { return constants_2.AUTH_MODULE_OPTIONS; } });
 Object.defineProperty(exports, "USER_REPOSITORY", { enumerable: true, get: function () { return constants_2.USER_REPOSITORY; } });
@@ -58,11 +83,15 @@ Object.defineProperty(exports, "RESOURCE_PERMISSION_REPOSITORY", { enumerable: t
 Object.defineProperty(exports, "JWT_PAYLOAD_FACTORY", { enumerable: true, get: function () { return constants_2.JWT_PAYLOAD_FACTORY; } });
 Object.defineProperty(exports, "API_KEY_REPOSITORY", { enumerable: true, get: function () { return constants_2.API_KEY_REPOSITORY; } });
 let AuthModule = AuthModule_1 = class AuthModule {
+    configure(consumer) {
+        consumer.apply(realm_middleware_1.RealmMiddleware).forRoutes('*');
+    }
     static forRootAsync(options) {
         const optionsProvider = {
             provide: constants_1.AUTH_MODULE_OPTIONS,
             useFactory: async (...args) => {
                 const opts = await options.useFactory(...args);
+                validateAuthModuleOptions(opts);
                 if (opts.cookie?.useHostPrefix) {
                     if (opts.cookie.secure === false) {
                         throw new Error('[AuthModule] cookie.useHostPrefix requires cookie.secure to be true (or unset). ' +
@@ -209,6 +238,13 @@ let AuthModule = AuthModule_1 = class AuthModule {
                         return opts.tenantExtractorInstance || null;
                     },
                 },
+                {
+                    provide: constants_1.REALM_EXTRACTOR,
+                    inject: [constants_1.AUTH_MODULE_OPTIONS],
+                    useFactory: (opts) => {
+                        return opts.realmExtractorInstance || null;
+                    },
+                },
                 {
                     provide: constants_1.RESOURCE_PERMISSION_REPOSITORY,
                     inject: [constants_1.AUTH_MODULE_OPTIONS],
@@ -297,6 +333,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
                         return new api_key_strategy_1.ApiKeyStrategy(options.apiKeyRepositoryInstance);
                     },
                 },
+                realm_middleware_1.RealmMiddleware,
                 tenant_guard_1.TenantGuard,
                 permission_guard_1.PermissionGuard,
             ],
@@ -316,6 +353,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
                 constants_1.REFRESH_TOKEN_REPOSITORY,
                 constants_1.TENANT_REPOSITORY,
                 constants_1.TENANT_EXTRACTOR,
+                constants_1.REALM_EXTRACTOR,
                 constants_1.RESOURCE_PERMISSION_REPOSITORY,
                 constants_1.JWT_PAYLOAD_FACTORY,
                 constants_1.API_KEY_REPOSITORY,

package/dist/auth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,qCAAwC;AACxC,+CAAkD;AAIlD,0DAAsD;AACtD,4EAAuE;AACvE,0EAAsE;AACtE,sEAAkE;AAClE,wEAAmE;AACnE,8FAAwF;AAExF,8EAAyE;AAEzE,8FAAyF;AACzF,wFAAkF;AAGlF,4DAAwD;AACxD,kEAA8D;AAC9D,sEAAkE;AAClE,4EAAuE;AACvE,gFAA2E;AAG3E,mEAA+D;AAc/D,8FAAyF;AACzF,4FAAsF;AACtF,wFAAmF;AACnF,8EAAsE;AACtE,sEAAiE;AACjE,kEAA6D;AAU7D,wDAAoD;AACpD,gEAA4D;AAC5D,oEAA+D;AAC/D,wFAAkF;AAGlF,2CAiBqB;AAOrB,8FAAuF;AAMvF,sFAAiF;AACjF,gGAA0F;AAua1F,yCAiBqB;AAhBnB,gHAAA,mBAAmB,OAAA;AACnB,4GAAA,eAAe,OAAA;AACf,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,wGAAA,WAAW,OAAA;AACX,iHAAA,oBAAoB,OAAA;AACpB,oHAAA,uBAAuB,OAAA;AACvB,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,8GAAA,iBAAiB,OAAA;AACjB,6GAAA,gBAAgB,OAAA;AAChB,2HAAA,8BAA8B,OAAA;AAC9B,gHAAA,mBAAmB,OAAA;AACnB,+GAAA,kBAAkB,OAAA;AA2Cb,IAAM,UAAU,kBAAhB,MAAM,UAAU;IA+BrB,MAAM,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,+BAAmB;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBACnC,MAAM,IAAI,GAAsB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAGlE,IAAI,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;oBAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,kFAAkF;4BAClF,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;wBACjD,MAAM,IAAI,KAAK,CACb,+EAA+E;4BAC/E,qCAAqC,CACtC,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;wBACvB,MAAM,IAAI,KAAK,CACb,wEAAwE;4BACxE,oDAAoD,CACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBACnD,eAAS,CAAC,aAAa,CAAC;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,KAAK,EAAE,aAAgC,EAAE,EAAE,CAAC,CAAC;wBACvD,MAAM,EAAE,aAAa,CAAC,SAAS;wBAC/B,WAAW,EAAE;4BACX,SAAS,EAAE,CAAC,aAAa,CAAC,YAAY,IAAI,KAAK,CAAQ;yBACxD;qBACF,CAAC;iBACH,CAAC;aACH;YACD,WAAW,EAAE,CAAC,kCAAe,CAAC;YAC9B,SAAS,EAAE;gBACT,eAAe;gBAGf;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;4BACjC,MAAM,IAAI,KAAK,CACb,+BAA+B;gCAC/B,iHAAiH,CAClH,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,sBAAsB,CAAC;oBACrC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,oCAAwB;oBACjC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;4BACzC,MAAM,IAAI,KAAK,CACb,wCAAwC;gCACxC,gIAAgI,CACjI,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,8BAA8B,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,mCAAuB;oBAChC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,8BAA8B,IAAI,IAAI,yDAA0B,EAAE,CAAC;oBACjF,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,kCAAsB;oBAC/B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,4BAA4B,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC7E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,2BAA2B,IAAI,IAAI,mDAAuB,EAAE,CAAC;oBAC3E,CAAC;iBACF;gBAMD;oBACE,OAAO,EAAE,yBAAa;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BACf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB;mCACvC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;oCACrB,CAAC,CAAC,IAAI,8DAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oCACvD,CAAC,CAAC,SAAS,CAAC,CAAC;4BAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACd,MAAM,IAAI,KAAK,CACb,oEAAoE;oCACpE,iDAAiD;oCACjD,iFAAiF,CAClF,CAAC;4BACJ,CAAC;4BAED,MAAM,IAAI,GAAG;gCACX,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gCAC5B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO;6BAC3D,CAAC;4BAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC;4BAEnE,OAAO,IAAI,qDAAwB,CACjC,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,MAAM,EACjB,IAAI,EACJ,gBAAgB,CACjB,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,oBAAoB,IAAI,IAAI,qCAAgB,EAAE,CAAC;oBAC7D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,iCAAc,EAAE,CAAC;oBACzD,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC;oBAC3C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,0CAAiB,EAAE,CAAC;oBAC5D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,wBAAY;oBACrB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,mBAAmB,IAAI,IAAI,2DAA0B,EAAE,CAAC;oBACtE,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,6BAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,4BAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC;oBAC9C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0CAA8B;oBACvC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,oCAAoC,IAAI,IAAI,CAAC;oBAC3D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,+BAAmB;oBAC5B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC1E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,8BAAkB;oBAC3B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBAGxB;oBACE,OAAO,EAAE,sCAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,OAAO,IAAI,sCAAiB,CAAC,OAAO,CAAC,CAAC;oBACxC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0BAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,EAAE,0BAAW,EAAE,+BAAmB,CAAC;oBAC/D,UAAU,EAAE,CACV,OAA0B,EAC1B,WAAwB,EACxB,iBAAqC,EACrC,EAAE;wBACF,OAAO,IAAI,0BAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;oBAClE,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,gCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;wBAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,eAAM,CAAC,IAAI,CACT,8HAA8H,EAC9H,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,yCAAkB,EAAE,CAAC;wBAClC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,uEAAuE;gCACvE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,gCAAc,CAAC,OAAO,CAAC,CAAC;oBACrC,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,oCAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;wBACnD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;wBAE3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;4BAC/B,eAAM,CAAC,IAAI,CACT,oJAAoJ,EACpJ,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,6CAAoB,EAAE,CAAC;wBACpC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE;gCACzE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,oCAAgB,CAAC,OAAO,CAAC,CAAC;oBACvC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,iCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;4BAEtC,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,OAAO,IAAI,iCAAc,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;oBAC9D,CAAC;iBACF;gBAGD,0BAAW;gBAGX,kCAAe;aAMhB;YACD,OAAO,EAAE;gBACP,+BAAmB;gBACnB,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,sCAAiB;gBACjB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBACxB,uBAAW;gBACX,2BAAe;gBACf,oCAAwB;gBACxB,6BAAiB;gBACjB,4BAAgB;gBAChB,0CAA8B;gBAC9B,+BAAmB;gBACnB,8BAAkB;gBAClB,0BAAW;gBACX,kCAAe;gBACf,eAAS;gBACT,yBAAc;aACf;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjZY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAiZtB"}
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAwlBA,8DAmCC;AA3nBD,2CAOwB;AACxB,oEAAgE;AAChE,qCAAwC;AACxC,+CAAkD;AAIlD,0DAAsD;AACtD,4EAAuE;AACvE,0EAAsE;AACtE,sEAAkE;AAClE,wEAAmE;AACnE,8FAAwF;AAExF,8EAAyE;AAEzE,8FAAyF;AACzF,wFAAkF;AAGlF,4DAAwD;AACxD,kEAA8D;AAC9D,sEAAkE;AAClE,4EAAuE;AACvE,gFAA2E;AAG3E,mEAA+D;AAc/D,8FAAyF;AACzF,4FAAsF;AACtF,wFAAmF;AACnF,8EAAsE;AACtE,sEAAiE;AACjE,kEAA6D;AAW7D,wDAAoD;AACpD,gEAA4D;AAC5D,oEAA+D;AAC/D,wFAAkF;AAGlF,2CAkBqB;AAOrB,8FAAuF;AAOvF,8FAAwF;AAExF,sFAAiF;AACjF,gGAA0F;AA+e1F,SAAgB,yBAAyB,CAAC,IAAuB;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IAEjD,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,0DAA0B,CAClC,4EAA4E;YAC1E,qEAAqE;YACrE,qEAAqE;YACrE,4EAA4E;YAC5E,+DAA+D;YAC/D,2EAA2E;YAC3E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;QAE9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,0DAA0B,CAClC,wFAAwF,MAAM,CAC5F,WAAW,CACZ,qEAAqE;gBACpE,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,0DAA0B,CAClC,qFAAqF,MAAM,CACzF,QAAQ,CACT,2EAA2E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAMD,yCAiBqB;AAhBnB,gHAAA,mBAAmB,OAAA;AACnB,4GAAA,eAAe,OAAA;AACf,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,wGAAA,WAAW,OAAA;AACX,iHAAA,oBAAoB,OAAA;AACpB,oHAAA,uBAAuB,OAAA;AACvB,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,8GAAA,iBAAiB,OAAA;AACjB,6GAAA,gBAAgB,OAAA;AAChB,2HAAA,8BAA8B,OAAA;AAC9B,gHAAA,mBAAmB,OAAA;AACnB,+GAAA,kBAAkB,OAAA;AA2Cb,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,kCAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAgCD,MAAM,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,+BAAmB;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBACnC,MAAM,IAAI,GAAsB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAKlE,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAGhC,IAAI,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;oBAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,kFAAkF;4BAClF,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;wBACjD,MAAM,IAAI,KAAK,CACb,+EAA+E;4BAC/E,qCAAqC,CACtC,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;wBACvB,MAAM,IAAI,KAAK,CACb,wEAAwE;4BACxE,oDAAoD,CACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBACnD,eAAS,CAAC,aAAa,CAAC;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,KAAK,EAAE,aAAgC,EAAE,EAAE,CAAC,CAAC;wBACvD,MAAM,EAAE,aAAa,CAAC,SAAS;wBAC/B,WAAW,EAAE;4BACX,SAAS,EAAE,CAAC,aAAa,CAAC,YAAY,IAAI,KAAK,CAAQ;yBACxD;qBACF,CAAC;iBACH,CAAC;aACH;YACD,WAAW,EAAE,CAAC,kCAAe,CAAC;YAC9B,SAAS,EAAE;gBACT,eAAe;gBAGf;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;4BACjC,MAAM,IAAI,KAAK,CACb,+BAA+B;gCAC/B,iHAAiH,CAClH,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,sBAAsB,CAAC;oBACrC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,oCAAwB;oBACjC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;4BACzC,MAAM,IAAI,KAAK,CACb,wCAAwC;gCACxC,gIAAgI,CACjI,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,8BAA8B,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,mCAAuB;oBAChC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,8BAA8B,IAAI,IAAI,yDAA0B,EAAE,CAAC;oBACjF,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,kCAAsB;oBAC/B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,4BAA4B,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC7E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,2BAA2B,IAAI,IAAI,mDAAuB,EAAE,CAAC;oBAC3E,CAAC;iBACF;gBAMD;oBACE,OAAO,EAAE,yBAAa;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BACf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB;mCACvC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;oCACrB,CAAC,CAAC,IAAI,8DAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oCACvD,CAAC,CAAC,SAAS,CAAC,CAAC;4BAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACd,MAAM,IAAI,KAAK,CACb,oEAAoE;oCACpE,iDAAiD;oCACjD,iFAAiF,CAClF,CAAC;4BACJ,CAAC;4BAED,MAAM,IAAI,GAAG;gCACX,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gCAC5B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO;6BAC3D,CAAC;4BAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC;4BAEnE,OAAO,IAAI,qDAAwB,CACjC,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,MAAM,EACjB,IAAI,EACJ,gBAAgB,CACjB,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,oBAAoB,IAAI,IAAI,qCAAgB,EAAE,CAAC;oBAC7D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,iCAAc,EAAE,CAAC;oBACzD,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC;oBAC3C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,0CAAiB,EAAE,CAAC;oBAC5D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,wBAAY;oBACrB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,mBAAmB,IAAI,IAAI,2DAA0B,EAAE,CAAC;oBACtE,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,6BAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,4BAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC;oBAC9C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0CAA8B;oBACvC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,oCAAoC,IAAI,IAAI,CAAC;oBAC3D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,+BAAmB;oBAC5B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC1E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,8BAAkB;oBAC3B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBAGxB;oBACE,OAAO,EAAE,sCAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,OAAO,IAAI,sCAAiB,CAAC,OAAO,CAAC,CAAC;oBACxC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0BAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,EAAE,0BAAW,EAAE,+BAAmB,CAAC;oBAC/D,UAAU,EAAE,CACV,OAA0B,EAC1B,WAAwB,EACxB,iBAAqC,EACrC,EAAE;wBACF,OAAO,IAAI,0BAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;oBAClE,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,gCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;wBAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,eAAM,CAAC,IAAI,CACT,8HAA8H,EAC9H,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,yCAAkB,EAAE,CAAC;wBAClC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,uEAAuE;gCACvE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,gCAAc,CAAC,OAAO,CAAC,CAAC;oBACrC,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,oCAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;wBACnD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;wBAE3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;4BAC/B,eAAM,CAAC,IAAI,CACT,oJAAoJ,EACpJ,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,6CAAoB,EAAE,CAAC;wBACpC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE;gCACzE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,oCAAgB,CAAC,OAAO,CAAC,CAAC;oBACvC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,iCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;4BAEtC,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,OAAO,IAAI,iCAAc,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;oBAC9D,CAAC;iBACF;gBAGD,kCAAe;gBAGf,0BAAW;gBAGX,kCAAe;aAMhB;YACD,OAAO,EAAE;gBACP,+BAAmB;gBACnB,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,sCAAiB;gBACjB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBACxB,uBAAW;gBACX,2BAAe;gBACf,oCAAwB;gBACxB,6BAAiB;gBACjB,4BAAgB;gBAChB,2BAAe;gBACf,0CAA8B;gBAC9B,+BAAmB;gBACnB,8BAAkB;gBAClB,0BAAW;gBACX,kCAAe;gBACf,eAAS;gBACT,yBAAc;aACf;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAvaY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAuatB"}

package/dist/constants.d.ts

@@ -15,6 +15,7 @@ export declare const RESOURCE_PERMISSION_REPOSITORY = "RESOURCE_PERMISSION_REPOS
 export declare const JWT_PAYLOAD_FACTORY = "JWT_PAYLOAD_FACTORY";
 export declare const API_KEY_REPOSITORY = "API_KEY_REPOSITORY";
 export declare const TENANT_HEADER_NAME = "TENANT_HEADER_NAME";
+export declare const REALM_EXTRACTOR = "REALM_EXTRACTOR";
 export declare const PERMISSIONS_KEY = "permissions";
 export declare const SKIP_TENANT_KEY = "skipTenant";
 export declare const PUBLIC_ENDPOINT_KEY = "isPublicEndpoint";

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAMzD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAMjD,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAMnE,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAM7C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAMzC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAM3D,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAMjE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAM/D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAO3D,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAOzC,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAU3C,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAMrD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAMnD,eAAO,MAAM,8BAA8B,mCAAmC,CAAC;AAM/E,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAMzD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAMvD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAOvD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAG7C,eAAO,MAAM,eAAe,eAAe,CAAC;AAG5C,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAUlD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAM7D,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAMrE,eAAO,MAAM,qBAAqB,0BAA0B,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAMzD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAMjD,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAMnE,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAM7C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAMzC,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAM3D,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAMjE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAM/D,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAO3D,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAOzC,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAU3C,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAMrD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAMnD,eAAO,MAAM,8BAA8B,mCAAmC,CAAC;AAM/E,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAMzD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAMvD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAWvD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAOjD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAG7C,eAAO,MAAM,eAAe,eAAe,CAAC;AAG5C,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAUlD,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAM7D,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAMrE,eAAO,MAAM,qBAAqB,0BAA0B,CAAC"}

package/dist/constants.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.USER_REPOSITORY_PHONE = exports.USER_REPOSITORY_BIOMETRIC = exports.USER_REPOSITORY_OAUTH = exports.RESOURCE_SCOPE_KEY = exports.PUBLIC_ENDPOINT_KEY = exports.SKIP_TENANT_KEY = exports.PERMISSIONS_KEY = exports.TENANT_HEADER_NAME = exports.API_KEY_REPOSITORY = exports.JWT_PAYLOAD_FACTORY = exports.RESOURCE_PERMISSION_REPOSITORY = exports.TENANT_EXTRACTOR = exports.TENANT_REPOSITORY = exports.RATE_LIMITER = exports.AUTH_LOGGER = exports.BIOMETRIC_REPOSITORY = exports.BRUTE_FORCE_REPOSITORY = exports.VERIFICATION_REPOSITORY = exports.AUTH_LIFECYCLE_HOOKS = exports.SMS_SERVICE = exports.EMAIL_SERVICE = exports.REFRESH_TOKEN_REPOSITORY = exports.USER_REPOSITORY = exports.AUTH_MODULE_OPTIONS = void 0;
+exports.USER_REPOSITORY_PHONE = exports.USER_REPOSITORY_BIOMETRIC = exports.USER_REPOSITORY_OAUTH = exports.RESOURCE_SCOPE_KEY = exports.PUBLIC_ENDPOINT_KEY = exports.SKIP_TENANT_KEY = exports.PERMISSIONS_KEY = exports.REALM_EXTRACTOR = exports.TENANT_HEADER_NAME = exports.API_KEY_REPOSITORY = exports.JWT_PAYLOAD_FACTORY = exports.RESOURCE_PERMISSION_REPOSITORY = exports.TENANT_EXTRACTOR = exports.TENANT_REPOSITORY = exports.RATE_LIMITER = exports.AUTH_LOGGER = exports.BIOMETRIC_REPOSITORY = exports.BRUTE_FORCE_REPOSITORY = exports.VERIFICATION_REPOSITORY = exports.AUTH_LIFECYCLE_HOOKS = exports.SMS_SERVICE = exports.EMAIL_SERVICE = exports.REFRESH_TOKEN_REPOSITORY = exports.USER_REPOSITORY = exports.AUTH_MODULE_OPTIONS = void 0;
 exports.AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
 exports.USER_REPOSITORY = 'USER_REPOSITORY';
 exports.REFRESH_TOKEN_REPOSITORY = 'REFRESH_TOKEN_REPOSITORY';
@@ -18,6 +18,7 @@ exports.RESOURCE_PERMISSION_REPOSITORY = 'RESOURCE_PERMISSION_REPOSITORY';
 exports.JWT_PAYLOAD_FACTORY = 'JWT_PAYLOAD_FACTORY';
 exports.API_KEY_REPOSITORY = 'API_KEY_REPOSITORY';
 exports.TENANT_HEADER_NAME = 'TENANT_HEADER_NAME';
+exports.REALM_EXTRACTOR = 'REALM_EXTRACTOR';
 exports.PERMISSIONS_KEY = 'permissions';
 exports.SKIP_TENANT_KEY = 'skipTenant';
 exports.PUBLIC_ENDPOINT_KEY = 'isPublicEndpoint';

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AAgBa,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAM5C,QAAA,eAAe,GAAG,iBAAiB,CAAC;AAMpC,QAAA,wBAAwB,GAAG,0BAA0B,CAAC;AAMtD,QAAA,aAAa,GAAG,eAAe,CAAC;AAMhC,QAAA,WAAW,GAAG,aAAa,CAAC;AAM5B,QAAA,oBAAoB,GAAG,sBAAsB,CAAC;AAM9C,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAMpD,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAMlD,QAAA,oBAAoB,GAAG,sBAAsB,CAAC;AAO9C,QAAA,WAAW,GAAG,aAAa,CAAC;AAO5B,QAAA,YAAY,GAAG,cAAc,CAAC;AAU9B,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAMxC,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AAMtC,QAAA,8BAA8B,GAAG,gCAAgC,CAAC;AAMlE,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAM5C,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAM1C,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAO1C,QAAA,eAAe,GAAG,aAAa,CAAC;AAGhC,QAAA,eAAe,GAAG,YAAY,CAAC;AAG/B,QAAA,mBAAmB,GAAG,kBAAkB,CAAC;AAGzC,QAAA,kBAAkB,GAAG,eAAe,CAAC;AAUrC,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAMhD,QAAA,yBAAyB,GAAG,2BAA2B,CAAC;AAMxD,QAAA,qBAAqB,GAAG,uBAAuB,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AAgBa,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAM5C,QAAA,eAAe,GAAG,iBAAiB,CAAC;AAMpC,QAAA,wBAAwB,GAAG,0BAA0B,CAAC;AAMtD,QAAA,aAAa,GAAG,eAAe,CAAC;AAMhC,QAAA,WAAW,GAAG,aAAa,CAAC;AAM5B,QAAA,oBAAoB,GAAG,sBAAsB,CAAC;AAM9C,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAMpD,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAMlD,QAAA,oBAAoB,GAAG,sBAAsB,CAAC;AAO9C,QAAA,WAAW,GAAG,aAAa,CAAC;AAO5B,QAAA,YAAY,GAAG,cAAc,CAAC;AAU9B,QAAA,iBAAiB,GAAG,mBAAmB,CAAC;AAMxC,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AAMtC,QAAA,8BAA8B,GAAG,gCAAgC,CAAC;AAMlE,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAM5C,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAM1C,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAW1C,QAAA,eAAe,GAAG,iBAAiB,CAAC;AAOpC,QAAA,eAAe,GAAG,aAAa,CAAC;AAGhC,QAAA,eAAe,GAAG,YAAY,CAAC;AAG/B,QAAA,mBAAmB,GAAG,kBAAkB,CAAC;AAGzC,QAAA,kBAAkB,GAAG,eAAe,CAAC;AAUrC,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AAMhD,QAAA,yBAAyB,GAAG,2BAA2B,CAAC;AAMxD,QAAA,qBAAqB,GAAG,uBAAuB,CAAC"}

package/dist/decorators/current-realm.decorator.d.ts

@@ -0,0 +1,2 @@
+export declare const CurrentRealm: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=current-realm.decorator.d.ts.map

package/dist/decorators/current-realm.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-realm.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/current-realm.decorator.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,YAAY,mDAKxB,CAAC"}

package/dist/decorators/current-realm.decorator.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentRealm = void 0;
+const common_1 = require("@nestjs/common");
+const graphql_1 = require("@nestjs/graphql");
+exports.CurrentRealm = (0, common_1.createParamDecorator)((_data, context) => {
+    const ctx = graphql_1.GqlExecutionContext.create(context);
+    return ctx.getContext().req._realm;
+});
+//# sourceMappingURL=current-realm.decorator.js.map

package/dist/decorators/current-realm.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-realm.decorator.js","sourceRoot":"","sources":["../../src/decorators/current-realm.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AACxE,6CAAsD;AAiBzC,QAAA,YAAY,GAAG,IAAA,6BAAoB,EAC9C,CAAC,KAAc,EAAE,OAAyB,EAAsB,EAAE;IAChE,MAAM,GAAG,GAAG,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;AACrC,CAAC,CACF,CAAC"}

package/dist/dto/jwt-payload.interface.d.ts

@@ -1,5 +1,6 @@
 export interface JwtPayload {
     sub: string;
     email: string;
+    realm?: string;
 }
 //# sourceMappingURL=jwt-payload.interface.d.ts.map

package/dist/dto/jwt-payload.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-payload.interface.d.ts","sourceRoot":"","sources":["../../src/dto/jwt-payload.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"jwt-payload.interface.d.ts","sourceRoot":"","sources":["../../src/dto/jwt-payload.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/exceptions/invalid-auth-config.exception.d.ts

@@ -0,0 +1,4 @@
+export declare class InvalidAuthConfigException extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=invalid-auth-config.exception.d.ts.map

package/dist/exceptions/invalid-auth-config.exception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-auth-config.exception.d.ts","sourceRoot":"","sources":["../../src/exceptions/invalid-auth-config.exception.ts"],"names":[],"mappings":"AAkBA,qBAAa,0BAA2B,SAAQ,KAAK;gBAKvC,OAAO,EAAE,MAAM;CAO5B"}

package/dist/exceptions/invalid-auth-config.exception.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidAuthConfigException = void 0;
+class InvalidAuthConfigException extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidAuthConfigException';
+        Object.setPrototypeOf(this, InvalidAuthConfigException.prototype);
+    }
+}
+exports.InvalidAuthConfigException = InvalidAuthConfigException;
+//# sourceMappingURL=invalid-auth-config.exception.js.map

package/dist/exceptions/invalid-auth-config.exception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-auth-config.exception.js","sourceRoot":"","sources":["../../src/exceptions/invalid-auth-config.exception.ts"],"names":[],"mappings":";;;AAkBA,MAAa,0BAA2B,SAAQ,KAAK;IAKnD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QAGzC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;CACF;AAZD,gEAYC"}

package/dist/guards/tenant.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.guard.d.ts","sourceRoot":"","sources":["../../src/guards/tenant.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAQjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAc9E,qBACa,WAAY,YAAW,WAAW;IAI3C,OAAO,CAAC,QAAQ,CAAC,SAAS;IACY,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAL3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,SAAS,EAAE,SAAS,EACkB,eAAe,CAAC,EAAE,gBAAgB,YAAA,EACjC,gBAAgB,CAAC,EAAE,iBAAiB,YAAA;IAGxF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAiE/D"}
+{"version":3,"file":"tenant.guard.d.ts","sourceRoot":"","sources":["../../src/guards/tenant.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAQjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAc9E,qBACa,WAAY,YAAW,WAAW;IAI3C,OAAO,CAAC,QAAQ,CAAC,SAAS;IACY,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAL3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,SAAS,EAAE,SAAS,EACkB,eAAe,CAAC,EAAE,gBAAgB,YAAA,EACjC,gBAAgB,CAAC,EAAE,iBAAiB,YAAA;IAGxF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAmF/D"}

package/dist/guards/tenant.guard.js

@@ -45,7 +45,15 @@ let TenantGuard = TenantGuard_1 = class TenantGuard {
         if (!this.tenantExtractor) {
             throw new common_1.BadRequestException('Tenant ID required');
         }
-        const tenantId = this.tenantExtractor.extractTenantId(request);
+        let tenantId;
+        try {
+            const result = this.tenantExtractor.extractTenantId(request);
+            tenantId = result instanceof Promise ? await result : result;
+        }
+        catch (err) {
+            this.logger.error(`Tenant extractor failed: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err.stack : undefined);
+            throw new common_1.BadRequestException('Tenant ID required');
+        }
         if (!tenantId) {
             throw new common_1.BadRequestException('Tenant ID required');
         }

package/dist/guards/tenant.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.guard.js","sourceRoot":"","sources":["../../src/guards/tenant.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,uCAAyC;AACzC,qEAA+D;AAC/D,4CAAoF;AACpF,kEAAmE;AAiB5D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACmB,SAAoB,EACC,eAAmD,EAClD,gBAAqD;QAF3E,cAAS,GAAT,SAAS,CAAW;QACkB,oBAAe,GAAf,eAAe,CAAmB;QACjC,qBAAgB,GAAhB,gBAAgB,CAAoB;QAL7E,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAMpD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QAEzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAG1B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,2BAAe,EAAE;YAC5E,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QAG5B,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,OAAO,GAAG,IAAA,yCAAqB,EAAC,OAAO,CAAC,CAAC;QAG/C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAGD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAGD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEnF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,2BAAkB,CAAC,8BAA8B,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,CAAC,cAAc,GAAG,aAAa,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YAExB,IACE,KAAK,YAAY,2BAAkB;gBACnC,KAAK,YAAY,4BAAmB;gBACpC,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,oCAA2B,EAC5C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAGD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC7F,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACjD,CAAC;YACF,MAAM,IAAI,oCAA2B,CAAC,kCAAkC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF,CAAA;AA1EY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,4BAAgB,CAAC,CAAA;IACpC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,6BAAiB,CAAC,CAAA;qCAFV,gBAAS;GAJ5B,WAAW,CA0EvB"}
+{"version":3,"file":"tenant.guard.js","sourceRoot":"","sources":["../../src/guards/tenant.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,uCAAyC;AACzC,qEAA+D;AAC/D,4CAAoF;AACpF,kEAAmE;AAiB5D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACmB,SAAoB,EACC,eAAmD,EAClD,gBAAqD;QAF3E,cAAS,GAAT,SAAS,CAAW;QACkB,oBAAe,GAAf,eAAe,CAAmB;QACjC,qBAAgB,GAAhB,gBAAgB,CAAoB;QAL7E,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAMpD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QAEzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAG1B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,2BAAe,EAAE;YAC5E,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QAG5B,IAAI,CAAC,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,OAAO,GAAG,IAAA,yCAAqB,EAAC,OAAO,CAAC,CAAC;QAG/C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QASD,IAAI,QAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAC7D,QAAQ,GAAG,MAAM,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC9E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC7C,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAGD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAGD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEnF,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,2BAAkB,CAAC,8BAA8B,CAAC,CAAC;YAC/D,CAAC;YAED,OAAO,CAAC,cAAc,GAAG,aAAa,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YAExB,IACE,KAAK,YAAY,2BAAkB;gBACnC,KAAK,YAAY,4BAAmB;gBACpC,KAAK,YAAY,8BAAqB;gBACtC,KAAK,YAAY,oCAA2B,EAC5C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YAGD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC7F,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CACjD,CAAC;YACF,MAAM,IAAI,oCAA2B,CAAC,kCAAkC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF,CAAA;AA5FY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,4BAAgB,CAAC,CAAA;IACpC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,6BAAiB,CAAC,CAAA;qCAFV,gBAAS;GAJ5B,WAAW,CA4FvB"}