@ambushsoftworks/nestjs-auth-graphql 0.6.7 → 0.8.0

package/dist/strategies/jwt.strategy.d.ts

@@ -1,4 +1,5 @@
 import { Strategy } from 'passport-jwt';
+import type { Request } from 'express';
 import { AuthService } from '../services/auth.service';
 import { JwtPayload } from '../dto/jwt-payload.interface';
 import { IAuthUser } from '../interfaces/auth-user.interface';
@@ -10,8 +11,9 @@ export declare class JwtStrategy extends JwtStrategy_base {
     private authService;
     private readonly jwtValidation;
     private readonly jwtPayloadFactory;
+    private readonly realmsEnabled;
     constructor(options: AuthModuleOptions, authService: AuthService, jwtPayloadFactory?: IJwtPayloadFactory);
-    validate(payload: JwtPayload): Promise<IAuthUser | JwtPayloadUser>;
+    validate(req: Request, payload: JwtPayload): Promise<IAuthUser | JwtPayloadUser>;
 }
 export {};
 //# sourceMappingURL=jwt.strategy.d.ts.map

package/dist/strategies/jwt.strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.d.ts","sourceRoot":"","sources":["../../src/strategies/jwt.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAGjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;;AAelE,qBACa,WAAY,SAAQ,gBAA0B;IAMvD,OAAO,CAAC,WAAW;IALrB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;gBAGxB,OAAO,EAAE,iBAAiB,EAC/C,WAAW,EAAE,WAAW,EAGhC,iBAAiB,CAAC,EAAE,kBAAkB;IA4BlC,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC;CAwBzE"}
+{"version":3,"file":"jwt.strategy.d.ts","sourceRoot":"","sources":["../../src/strategies/jwt.strategy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,QAAQ,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6CAA6C,CAAC;AAGjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;;AAelE,qBACa,WAAY,SAAQ,gBAA0B;IAOvD,OAAO,CAAC,WAAW;IANrB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAU;gBAGT,OAAO,EAAE,iBAAiB,EAC/C,WAAW,EAAE,WAAW,EAGhC,iBAAiB,CAAC,EAAE,kBAAkB;IA8BlC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,CAAC;CAiCvF"}

package/dist/strategies/jwt.strategy.js

@@ -42,12 +42,21 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
             jwtFromRequest: jwtExtractor,
             ignoreExpiration: false,
             secretOrKey: options.jwtSecret,
+            passReqToCallback: true,
         });
         this.authService = authService;
         this.jwtValidation = options.jwtValidation || 'full';
         this.jwtPayloadFactory = jwtPayloadFactory || new default_jwt_payload_factory_1.DefaultJwtPayloadFactory();
+        this.realmsEnabled = !!options.realmExtractorInstance;
     }
-    async validate(payload) {
+    async validate(req, payload) {
+        if (this.realmsEnabled) {
+            const requestRealm = req._realm;
+            const tokenRealm = payload.realm;
+            if (!tokenRealm || tokenRealm !== requestRealm) {
+                throw new common_1.UnauthorizedException('Invalid token');
+            }
+        }
         const userId = this.jwtPayloadFactory.extractUserId(payload);
         if (this.jwtValidation === 'payload-only') {
             return { id: userId, email: payload.email };

package/dist/strategies/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../src/strategies/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAqF;AACrF,+CAAoD;AACpD,+CAAoD;AAEpD,2DAAuD;AAIvD,yFAAmF;AACnF,4CAAwE;AAQxE,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,CAAC,GAAY,EAAiB,EAAE;QACrC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,CAAW,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAGM,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IAIzD,YAC+B,OAA0B,EAC/C,WAAwB,EAGhC,iBAAsC;QAEtC,MAAM,eAAe,GAAG,yBAAU,CAAC,2BAA2B,EAAE,CAAC;QAIjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,KAAK,IAAI,CAAC;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,eAAe,IAAI,cAAc,CAAC;QAGzE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,aAAa;YAC9C,CAAC,CAAC,UAAU,cAAc,EAAE;YAC5B,CAAC,CAAC,cAAc,CAAC;QAEnB,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,yBAAU,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;YACtE,CAAC,CAAC,eAAe,CAAC;QAEpB,KAAK,CAAC;YACJ,cAAc,EAAE,YAAY;YAC5B,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,SAAS;SAC/B,CAAC,CAAC;QAzBK,gBAAW,GAAX,WAAW,CAAa;QA2BhC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,IAAI,IAAI,sDAAwB,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAmB;QAIhC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAI1C,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,CAAC;QAKD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7DY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAE3B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;6CAFP,0BAAW;GANvB,WAAW,CA6DvB"}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../src/strategies/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAqF;AACrF,+CAAoD;AACpD,+CAAoD;AAEpD,2DAAuD;AAIvD,yFAAmF;AACnF,4CAAwE;AAQxE,SAAS,UAAU,CAAC,UAAkB;IACpC,OAAO,CAAC,GAAY,EAAiB,EAAE;QACrC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,CAAW,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAGM,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IAKzD,YAC+B,OAA0B,EAC/C,WAAwB,EAGhC,iBAAsC;QAEtC,MAAM,eAAe,GAAG,yBAAU,CAAC,2BAA2B,EAAE,CAAC;QAIjE,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,KAAK,IAAI,CAAC;QAChE,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,eAAe,IAAI,cAAc,CAAC;QAGzE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,aAAa;YAC9C,CAAC,CAAC,UAAU,cAAc,EAAE;YAC5B,CAAC,CAAC,cAAc,CAAC;QAEnB,MAAM,YAAY,GAAG,iBAAiB;YACpC,CAAC,CAAC,yBAAU,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;YACtE,CAAC,CAAC,eAAe,CAAC;QAEpB,KAAK,CAAC;YACJ,cAAc,EAAE,YAAY;YAC5B,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,SAAS;YAC9B,iBAAiB,EAAE,IAAI;SACxB,CAAC,CAAC;QA1BK,gBAAW,GAAX,WAAW,CAAa;QA4BhC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,IAAI,IAAI,sDAAwB,EAAE,CAAC;QAC7E,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAY,EAAE,OAAmB;QAE9C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,YAAY,GAAI,GAA2B,CAAC,MAAM,CAAC;YACzD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;YACjC,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBAC/C,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAKD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE7D,IAAI,IAAI,CAAC,aAAa,KAAK,cAAc,EAAE,CAAC;YAI1C,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC9C,CAAC;QAKD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAzEY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;IAE3B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,+BAAmB,CAAC,CAAA;6CAFP,0BAAW;GAPvB,WAAW,CAyEvB"}

package/dist/test-utils/mock-repositories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-repositories.d.ts","sourceRoot":"","sources":["../../src/test-utils/mock-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAM/I,wBAAgB,wBAAwB,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAwCvE;AAKD,wBAAgB,gCAAgC,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAYvF;AAKD,wBAAgB,gCAAgC,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAOvF;AAKD,wBAAgB,8BAA8B,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAQnF;AAKD,wBAAgB,6BAA6B,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAUjF"}
+{"version":3,"file":"mock-repositories.d.ts","sourceRoot":"","sources":["../../src/test-utils/mock-repositories.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAM/I,wBAAgB,wBAAwB,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAwCvE;AAKD,wBAAgB,gCAAgC,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAYvF;AAKD,wBAAgB,gCAAgC,IAAI,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAOvF;AAKD,wBAAgB,8BAA8B,IAAI,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CASnF;AAKD,wBAAgB,6BAA6B,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAUjF"}

package/dist/test-utils/mock-repositories.js

@@ -73,6 +73,7 @@ function createMockBruteForceRepository() {
         lockAccount: jest.fn(),
         checkAccountLock: jest.fn(),
         clearFailedAttempts: jest.fn(),
+        deleteOlderThan: jest.fn(),
     };
 }
 function createMockBiometricRepository() {

package/dist/test-utils/mock-repositories.js.map

@@ -1 +1 @@
-{"version":3,"file":"mock-repositories.js","sourceRoot":"","sources":["../../src/test-utils/mock-repositories.ts"],"names":[],"mappings":";;AAMA,4DAwCC;AAKD,4EAYC;AAKD,4EAOC;AAKD,wEAQC;AAKD,sEAUC;AAjGD,SAAgB,wBAAwB;IACtC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE;QACnB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,2BAA2B,EAAE,IAAI,CAAC,EAAE,EAAE;QACtC,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE;QACxC,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE;QACrC,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE;QAEjC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,gCAAgC,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3C,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7B,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,4BAA4B,EAAE,IAAI,CAAC,EAAE,EAAE;QACvC,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1B,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7B,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;KACc,CAAC;AACpC,CAAC;AAKD,SAAgB,gCAAgC;IAC9C,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;QACvB,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE;QACrC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7C,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;KACS,CAAC;AAC5C,CAAC;AAKD,SAAgB,gCAAgC;IAC9C,OAAO;QACL,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE;QACxC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;KACO,CAAC;AAC5C,CAAC;AAKD,SAAgB,8BAA8B;IAC5C,OAAO;QACL,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;KACO,CAAC;AAC1C,CAAC;AAKD,SAAgB,6BAA6B;IAC3C,OAAO;QACL,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE;QACjC,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,yBAAyB,EAAE,IAAI,CAAC,EAAE,EAAE;QACpC,uBAAuB,EAAE,IAAI,CAAC,EAAE,EAAE;QAClC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;KACM,CAAC;AACzC,CAAC"}
+{"version":3,"file":"mock-repositories.js","sourceRoot":"","sources":["../../src/test-utils/mock-repositories.ts"],"names":[],"mappings":";;AAMA,4DAwCC;AAKD,4EAYC;AAKD,4EAOC;AAKD,wEASC;AAKD,sEAUC;AAlGD,SAAgB,wBAAwB;IACtC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE;QACnB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,2BAA2B,EAAE,IAAI,CAAC,EAAE,EAAE;QACtC,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE;QACxC,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE;QACrC,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE;QAEjC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,gCAAgC,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3C,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7B,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,4BAA4B,EAAE,IAAI,CAAC,EAAE,EAAE;QACvC,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1B,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,kBAAkB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC7B,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;KACc,CAAC;AACpC,CAAC;AAKD,SAAgB,gCAAgC;IAC9C,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,iBAAiB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC5B,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE;QACvB,0BAA0B,EAAE,IAAI,CAAC,EAAE,EAAE;QACrC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE;QACjB,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;QACzB,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7C,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;KACS,CAAC;AAC5C,CAAC;AAKD,SAAgB,gCAAgC;IAC9C,OAAO;QACL,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,6BAA6B,EAAE,IAAI,CAAC,EAAE,EAAE;QACxC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;KACO,CAAC;AAC5C,CAAC;AAKD,SAAgB,8BAA8B;IAC5C,OAAO;QACL,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;QACtB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC3B,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;QAC9B,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE;KACW,CAAC;AAC1C,CAAC;AAKD,SAAgB,6BAA6B;IAC3C,OAAO;QACL,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE;QACjC,wBAAwB,EAAE,IAAI,CAAC,EAAE,EAAE;QACnC,yBAAyB,EAAE,IAAI,CAAC,EAAE,EAAE;QACpC,uBAAuB,EAAE,IAAI,CAAC,EAAE,EAAE;QAClC,qBAAqB,EAAE,IAAI,CAAC,EAAE,EAAE;QAChC,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE;KACM,CAAC;AACzC,CAAC"}

package/dist/utils/ip-hash.d.ts

@@ -0,0 +1,2 @@
+export declare function hashIp(ipAddress: string, salt: string): string;
+//# sourceMappingURL=ip-hash.d.ts.map

package/dist/utils/ip-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-hash.d.ts","sourceRoot":"","sources":["../../src/utils/ip-hash.ts"],"names":[],"mappings":"AAgCA,wBAAgB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAK9D"}

package/dist/utils/ip-hash.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashIp = hashIp;
+const crypto_1 = require("crypto");
+function hashIp(ipAddress, salt) {
+    return (0, crypto_1.createHmac)('sha256', salt)
+        .update(ipAddress)
+        .digest('hex')
+        .slice(0, 16);
+}
+//# sourceMappingURL=ip-hash.js.map

package/dist/utils/ip-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-hash.js","sourceRoot":"","sources":["../../src/utils/ip-hash.ts"],"names":[],"mappings":";;AAgCA,wBAKC;AArCD,mCAAoC;AAgCpC,SAAgB,MAAM,CAAC,SAAiB,EAAE,IAAY;IACpD,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC;SAC9B,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/examples/full-resolver-template.ts

@@ -0,0 +1,305 @@
+// @ts-nocheck
+//
+// =============================================================================
+// DO NOT IMPORT THIS FILE.
+// =============================================================================
+//
+// This file is a REFERENCE TEMPLATE shipped with @ambushsoftworks/nestjs-auth-graphql.
+// It is intentionally NOT exported from `src/index.ts` and is NOT importable by
+// consumers from the package's barrel.
+//
+// WHY YOU CAN'T JUST IMPORT IT:
+// TypeScript decorator metadata (the type information `@Mutation(() => Foo)`
+// emits via `emitDecoratorMetadata`) is NOT preserved across compiled package
+// boundaries. If this file's `@Mutation`/`@Query` decorators ran inside the
+// package and the consumer imported the result, NestJS's GraphQL schema builder
+// would throw "Cannot determine GraphQL output type" at runtime. The decorators
+// MUST execute inside YOUR project's compilation unit. See the class-level
+// docblock in `BaseAuthResolver` (`src/resolvers/base-auth.resolver.ts`) for
+// the full explanation — this is the same constraint that prevents Item 5 of
+// the Jobsites feature requests from being implementable inside the package.
+//
+// HOW TO USE THIS FILE:
+//   1. Copy it into your own `src/resolvers/` directory and rename it to
+//      something like `auth.resolver.ts`.
+//   2. Replace every `MyAuthUser`, `MyAuthResponse`, `MyLoginInput`, etc.
+//      placeholder with your project's actual GraphQL types (the placeholders
+//      are tagged with `// REPLACE:` comments).
+//   3. Remove the `@ts-nocheck` directive at the top once you've wired in
+//      real types — it is only present so the template doesn't fail
+//      typechecking when the placeholders are undefined.
+//   4. Register the resolver in your auth module's `providers` array.
+//
+// WHAT THIS TEMPLATE COVERS:
+// Every `perform*` method on `BaseAuthResolver` is wrapped with the
+// appropriate `@Mutation` or `@Query` decorator, plus the recommended
+// `@Throttle` configuration on auth-sensitive endpoints (signup, login,
+// password reset/change). Guards (`@UseGuards(JwtAuthGuard)`) are applied to
+// methods that require an authenticated user.
+//
+// `@ts-nocheck` is used because the placeholder DTO/entity types intentionally
+// don't exist in the package. Copy this file and replace placeholders before
+// use; once your real types are wired in, remove the directive and the file
+// will typecheck normally.
+//
+// =============================================================================
+
+import { Resolver, Mutation, Query, Args, Context } from '@nestjs/graphql';
+import { UseGuards } from '@nestjs/common';
+import { Throttle } from '@nestjs/throttler';
+import {
+  BaseAuthResolver,
+  JwtAuthGuard,
+  CurrentUser,
+} from '@ambushsoftworks/nestjs-auth-graphql';
+
+// REPLACE: import your project's User entity (must implement IAuthUser).
+import { MyAuthUser } from '../entities/my-auth-user.entity';
+
+// REPLACE: import your project's GraphQL ObjectType DTOs.
+import { MyAuthResponse } from '../dto/my-auth-response.dto';
+import { MyLogoutResponse } from '../dto/my-logout-response.dto';
+import { MyLogoutAllResponse } from '../dto/my-logout-all-response.dto';
+import { MyAccountLockStatus } from '../dto/my-account-lock-status.dto';
+import { MyVerifyEmailResponse } from '../dto/my-verify-email-response.dto';
+import { MyPhoneVerificationResponse } from '../dto/my-phone-verification-response.dto';
+import { MyVerifyPhoneResponse } from '../dto/my-verify-phone-response.dto';
+import { MyRemovePhoneResponse } from '../dto/my-remove-phone-response.dto';
+import { MyPhoneVerificationStatus } from '../dto/my-phone-verification-status.dto';
+import { MyPasswordResetResponse } from '../dto/my-password-reset-response.dto';
+import { MyChangePasswordResponse } from '../dto/my-change-password-response.dto';
+
+// REPLACE: import your project's GraphQL InputType DTOs.
+import { MySignupInput } from '../dto/my-signup.input';
+import { MyLoginInput } from '../dto/my-login.input';
+import { MyRefreshTokenInput } from '../dto/my-refresh-token.input';
+import { MyLogoutInput } from '../dto/my-logout.input';
+import { MyVerifyEmailInput } from '../dto/my-verify-email.input';
+import { MySendPhoneVerificationInput } from '../dto/my-send-phone-verification.input';
+import { MyVerifyPhoneInput } from '../dto/my-verify-phone.input';
+import { MyRequestPasswordResetInput } from '../dto/my-request-password-reset.input';
+import { MyResetPasswordInput } from '../dto/my-reset-password.input';
+import { MyChangePasswordInput } from '../dto/my-change-password.input';
+import { MyCompleteFacebookSignUpInput } from '../dto/my-complete-facebook-signup.input';
+
+/**
+ * Full reference auth resolver. Wraps every `perform*` method on
+ * `BaseAuthResolver` with the matching GraphQL decorator. Copy and
+ * customize — DO NOT import this file from the package.
+ */
+@Resolver()
+export class AuthResolver extends BaseAuthResolver<MyAuthUser> {
+  // ===========================================================================
+  // Core Auth Mutations
+  // ===========================================================================
+
+  @Mutation(() => MyAuthResponse)
+  @Throttle({ default: { limit: 5, ttl: 60000 } }) // 5 signups / minute / IP
+  async signup(
+    @Args('input') input: MySignupInput,
+    @Context() ctx: any,
+  ): Promise<MyAuthResponse> {
+    return this.performSignup(input, ctx) as Promise<MyAuthResponse>;
+  }
+
+  @Mutation(() => MyAuthResponse)
+  @Throttle({ default: { limit: 5, ttl: 60000 } }) // 5 logins / minute / IP
+  async login(
+    @Args('input') input: MyLoginInput,
+    @Context() ctx: any,
+  ): Promise<MyAuthResponse> {
+    return this.performLogin(input, ctx) as Promise<MyAuthResponse>;
+  }
+
+  @Mutation(() => MyAuthResponse)
+  async refreshToken(
+    @Args('input') input: MyRefreshTokenInput,
+    @Context() ctx: any,
+  ): Promise<MyAuthResponse> {
+    return this.performRefreshToken(input, ctx) as Promise<MyAuthResponse>;
+  }
+
+  @Mutation(() => MyLogoutResponse)
+  @UseGuards(JwtAuthGuard)
+  async logout(
+    @Args('input') input: MyLogoutInput,
+    @CurrentUser() user: MyAuthUser,
+    @Context() ctx: any,
+  ): Promise<MyLogoutResponse> {
+    return this.performLogout(input, user, ctx);
+  }
+
+  @Mutation(() => MyLogoutAllResponse)
+  @UseGuards(JwtAuthGuard)
+  async logoutAll(
+    @CurrentUser() user: MyAuthUser,
+    @Context() ctx: any,
+  ): Promise<MyLogoutAllResponse> {
+    return this.performLogoutAll(user, ctx);
+  }
+
+  // ===========================================================================
+  // Account Lock Status
+  // ===========================================================================
+
+  @Query(() => MyAccountLockStatus)
+  async checkAccountLockStatus(
+    @Args('email') email: string,
+  ): Promise<MyAccountLockStatus> {
+    return this.performCheckAccountLockStatus(email);
+  }
+
+  // ===========================================================================
+  // Email Verification
+  // ===========================================================================
+
+  @Mutation(() => MyVerifyEmailResponse)
+  async verifyEmail(
+    @Args('input') input: MyVerifyEmailInput,
+    @Context() ctx: any,
+  ): Promise<MyVerifyEmailResponse> {
+    return this.performVerifyEmail(input, ctx);
+  }
+
+  @Mutation(() => MyVerifyEmailResponse)
+  async resendVerificationEmail(
+    @Args('email') email: string,
+    @Context() ctx: any,
+  ): Promise<MyVerifyEmailResponse> {
+    return this.performResendVerificationEmail(email, ctx);
+  }
+
+  // ===========================================================================
+  // Phone Verification
+  // ===========================================================================
+
+  @Mutation(() => MyPhoneVerificationResponse)
+  @UseGuards(JwtAuthGuard)
+  async sendPhoneVerification(
+    @Args('input') input: MySendPhoneVerificationInput,
+    @CurrentUser() user: MyAuthUser,
+    @Context() ctx: any,
+  ): Promise<MyPhoneVerificationResponse> {
+    return this.performSendPhoneVerification(input, user, ctx);
+  }
+
+  @Mutation(() => MyVerifyPhoneResponse)
+  @UseGuards(JwtAuthGuard)
+  async verifyPhone(
+    @Args('input') input: MyVerifyPhoneInput,
+    @CurrentUser() user: MyAuthUser,
+  ): Promise<MyVerifyPhoneResponse> {
+    return this.performVerifyPhone(input, user);
+  }
+
+  @Mutation(() => MyPhoneVerificationResponse)
+  @UseGuards(JwtAuthGuard)
+  async resendPhoneVerification(
+    @Args('phoneNumber') phoneNumber: string,
+    @CurrentUser() user: MyAuthUser,
+  ): Promise<MyPhoneVerificationResponse> {
+    return this.performResendPhoneVerification(phoneNumber, user);
+  }
+
+  @Mutation(() => MyRemovePhoneResponse)
+  @UseGuards(JwtAuthGuard)
+  async removePhoneNumber(
+    @CurrentUser() user: MyAuthUser,
+  ): Promise<MyRemovePhoneResponse> {
+    return this.performRemovePhoneNumber(user);
+  }
+
+  @Query(() => MyPhoneVerificationStatus)
+  @UseGuards(JwtAuthGuard)
+  async phoneVerificationStatus(
+    @CurrentUser() user: MyAuthUser,
+  ): Promise<MyPhoneVerificationStatus> {
+    return this.performPhoneVerificationStatus(user);
+  }
+
+  // ===========================================================================
+  // Password Reset
+  // ===========================================================================
+
+  @Mutation(() => MyPasswordResetResponse)
+  @Throttle({ default: { limit: 3, ttl: 3600000 } }) // 3 requests / hour / IP
+  async requestPasswordReset(
+    @Args('input') input: MyRequestPasswordResetInput,
+    @Context() ctx: any,
+  ): Promise<MyPasswordResetResponse> {
+    return this.performRequestPasswordReset(input, ctx);
+  }
+
+  @Mutation(() => MyPasswordResetResponse)
+  @Throttle({ default: { limit: 5, ttl: 900000 } }) // 5 attempts / 15 min / IP
+  async resetPassword(
+    @Args('input') input: MyResetPasswordInput,
+    @Context() ctx: any,
+  ): Promise<MyPasswordResetResponse> {
+    return this.performResetPassword(input, ctx);
+  }
+
+  // ===========================================================================
+  // Password Change (authenticated)
+  // ===========================================================================
+
+  /**
+   * Change password for the authenticated user.
+   *
+   * `AuthService.changePassword` revokes ALL refresh tokens for the user
+   * (logging them out of every device including the current one). Calling
+   * `authService.issueAuthSession(user.id, ctx.res)` after the change keeps
+   * the current device logged in by minting a fresh token pair (and writing
+   * cookies if cookie auth is enabled).
+   */
+  @Mutation(() => MyChangePasswordResponse)
+  @UseGuards(JwtAuthGuard)
+  @Throttle({ default: { limit: 5, ttl: 900000 } }) // 5 attempts / 15 min / IP
+  async changePassword(
+    @CurrentUser() user: MyAuthUser,
+    @Args('input') input: MyChangePasswordInput,
+    @Context() ctx: any,
+  ): Promise<MyChangePasswordResponse> {
+    const result = await this.performChangePassword(
+      user.id,
+      input.currentPassword,
+      input.newPassword,
+    );
+    // Keep the current device logged in (other devices are revoked above).
+    // Use `getResponseFromContext` so cookies work under both Apollo
+    // (`ctx.res`) and Express/Fastify (`ctx.req.res`).
+    const res = this.getResponseFromContext(ctx);
+    const tokens = await this.authService.issueAuthSession(user.id, res);
+    return {
+      ...result,
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+    };
+  }
+
+  // ===========================================================================
+  // Current User
+  // ===========================================================================
+
+  @Query(() => MyAuthUser)
+  @UseGuards(JwtAuthGuard)
+  async me(@CurrentUser() user: MyAuthUser): Promise<MyAuthUser> {
+    return this.performGetCurrentUser(user.id);
+  }
+
+  // ===========================================================================
+  // Facebook OAuth Email Fallback
+  // ===========================================================================
+
+  @Mutation(() => MyAuthResponse, {
+    name: 'completeFacebookSignUp',
+    description: 'Complete Facebook sign-up when email not provided by Facebook',
+  })
+  @Throttle({ default: { limit: 5, ttl: 60000 } })
+  async completeFacebookSignUp(
+    @Args('input') input: MyCompleteFacebookSignUpInput,
+    @Context() ctx: any,
+  ): Promise<MyAuthResponse> {
+    return this.performCompleteFacebookSignUp(input, ctx) as Promise<MyAuthResponse>;
+  }
+}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@ambushsoftworks/nestjs-auth-graphql",
-  "version": "0.6.7",
+  "version": "0.8.0",
   "description": "Production-grade authentication package for NestJS with GraphQL, supporting JWT, OAuth, email/SMS verification, and biometric auth",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "dist",
+    "examples",
     "README.md",
     "LICENSE"
   ],