@ambushsoftworks/nestjs-auth-graphql 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -27,6 +27,139 @@ for buried obligations. **The marker was introduced in 0.9.0 and has not been
 retro-applied**, so it is reliable from 0.9.0 onward only. Convention adopted
 from `@ambushsoftworks/nestjs-payments-graphql`.
 
+## [0.10.0] - 2026-09-15
+
+Ambush Desk, a new consumer on NestJS 11, asked for routes that need no realm, a
+way to leave the OAuth REST routes unmounted, and CI on NestJS 11. Building those
+turned up defects on the OAuth REST routes that affect every app mounting them
+today. See **Fixed** first.
+
+Behaviour changes, so the minor version moves. See **Migrating to v0.10.0** in
+the README.
+
+### Fixed
+- **The OAuth REST routes answered 500 for four ordinary failures.** On
+  `POST /auth/google/token` and `POST /auth/facebook/token`:
+
+  | Situation | Before | Now |
+  |---|---|---|
+  | Provider not configured | 500 | 404 `OAUTH_PROVIDER_NOT_CONFIGURED`, with `provider` |
+  | Account locked | 500 | 403 `ACCOUNT_LOCKED`, with `remainingLockoutTime` |
+  | Account suspended or deleted | 500 | 403 `ACCOUNT_INACTIVE` |
+  | Client IP over `bruteForce.ipRateLimit` | 500 | 429 `RATE_LIMIT_EXCEEDED` |
+
+  The no-op strategies and the controller's lockout and rate-limit checks threw
+  plain `Error`. `AccountLockedException` and `AccountInactiveException` extend
+  `GraphQLError`, which Nest's HTTP layer does not recognise, so since 0.9.0 a
+  suspended user signing in with Google also got a 500. The bodies now use the
+  root-level shape of the other OAuth errors: `message`, `code`, `statusCode`,
+  plus fields. An internal `RestErrorInterceptor` converts the GraphQL-shaped
+  errors on these routes only; GraphQL responses are unchanged. The lockout
+  message is now the one `login` uses.
+- **`createAuthGuard(['api-key', 'jwt'])` rejected every JWT.** `ApiKeyStrategy`
+  threw for a bearer token that matched no key, and a throw stops Passport's
+  strategy chain, so JWT was never tried. That is the order the README and
+  `createAuthGuard`'s JSDoc showed. An unknown token now fails softly and the next
+  strategy runs, so either order accepts either credential. A key whose account is
+  inactive still fails with 401 `API key is inactive`. Reported by Ambush Desk.
+- **The OAuth routes checked lockout and the IP rate limit, and reset failed
+  attempts, without the realm.** With realms enabled, `isAccountLocked`,
+  `getRemainingLockoutTime`, `checkIpRateLimit` and `resetFailedAttempts` were
+  called with no realm. Depending on how your repository treats a missing realm,
+  a lock could apply to the same email in another realm, and a successful sign-in
+  could clear another realm's failed attempts. They now receive the request's
+  realm, as `login` already did.
+
+### Added
+- **`realm.skip: (path, request) => boolean`.** Requests that have no realm by
+  nature, such as health checks, webhooks and public downloads, pass
+  `RealmMiddleware` without calling the extractor, get no `_realm`, and never
+  answer `400 Realm required`. Requested by Ambush Desk.
+  - `path` is the requested path, including any global prefix and without the
+    query string. Do not match on `request.path` or `request.url`: Express
+    rewrites both to `/` inside middleware.
+  - Only a synchronous `true` skips. A throw or any other return value fails
+    closed and is logged.
+  - It is a predicate rather than route patterns because the same Nest route
+    pattern matches different paths on NestJS 10 and 11: `hooks/*` excludes
+    `/hooks/glitchtip/issue` on 11 but not on 10.
+  - With realms enabled, a `skip` that is not a function fails boot with
+    `InvalidAuthConfigException`. `skip` without `realmExtractorInstance` logs a
+    warning.
+  - This closes the `@SkipRealm()` follow-up for requests with no realm. A
+    decorator cannot work, because middleware runs before Nest resolves the
+    handler.
+- **`oauthController: false`** on `AuthModule.forRootAsync`, beside `useFactory`,
+  leaves `OAuthController` unmounted, so both routes answer 404 like any unknown
+  path. Defaults to `true`. Requested by Ambush Desk.
+- `OAuthProviderNotConfiguredException` (404, `OAUTH_PROVIDER_NOT_CONFIGURED`),
+  thrown by the no-op strategies.
+- `AuthService.realmsEnabled`.
+
+### Changed
+- **Realm-scoped entry points refuse a request without a realm.** With realms
+  enabled, `BaseAuthResolver` flows (through `getRealmFromContext`) and the OAuth
+  routes answer `400 Realm required` when the request has no realm, instead of
+  running with `realm` undefined, which many repositories read as "any realm".
+  Before `realm.skip` the middleware ruled this out over HTTP; now it also
+  contains a `skip` predicate that matches more than intended. Code that calls
+  `perform*` methods without the GraphQL context gets the 400 too when realms are
+  enabled.
+- **The OAuth routes' IP rate-limit keys include the realm**
+  (`auth:ipRate:<realm>:<ipHash>`, as for `login`), so existing counts for those
+  routes start again after upgrading.
+- With `['api-key']` alone, an unknown key's 401 now carries the guard's generic
+  `Unauthorized` message instead of `Invalid API key`. That also stops confirming
+  to the caller that the token was checked as an API key.
+- `JwtAuthGuard` reads the request through `getRequestFromContext`, as
+  `createAuthGuard` does, instead of through `GqlExecutionContext`. There is no
+  behaviour change: the old lookup also returned the HTTP request on HTTP routes,
+  checked on NestJS 10 and 11.
+
+### Documentation
+- README: routes without a realm, `oauthController`, the OAuth routes' error
+  table, guard order for API keys and JWTs, a **Module Options** table, NestJS 10
+  and 11 support, and **Migrating to v0.10.0**. The OAuth section no longer calls
+  the routes callback routes; they exchange tokens.
+- `IRefreshTokenRepository` documents that entities returned by
+  `findByHashedToken` must carry `id`, `userId` and `createdAt`, and that refresh
+  measures expiry from `createdAt`. `create` is not given `createdAt`, so a store
+  with no default for it fails on refresh. Found by the new end-to-end suite.
+
+### Testing
+- **CI runs on NestJS 11.** A `test:nest11` job runs the build, unit tests and
+  end-to-end suite on NestJS 11, `@nestjs/graphql` 13, Apollo Server 5 and
+  Express 5, beside the NestJS 10 job. Run locally before release: 982 unit tests
+  and 29 end-to-end tests pass on NestJS 11.2.5, `@nestjs/graphql` 13.4.5, Apollo
+  Server 5.5.1 and Express 5.2.1, with no source change for NestJS 11. On Express,
+  `@nestjs/apollo` 13 also needs `@as-integrations/express5`. Requested by Ambush
+  Desk.
+- **An end-to-end suite** (`npm run test:e2e`, in `test/e2e`) boots a real HTTP
+  and GraphQL (Apollo) application against the built package, with in-memory
+  repositories. It covers:
+  - realm skipping and rejection
+  - the OAuth routes mounted, unmounted, and failing with each status above
+  - `createAuthGuard` with API keys and JWTs in both orders, on HTTP and in a
+    resolver
+  - `JwtAuthGuard` on HTTP
+  - login and refresh through a `BaseAuthResolver` subclass
+
+  Each fix above was checked by reintroducing the defect and watching a unit or
+  end-to-end test fail.
+
+## [0.9.1] - 2026-09-14
+
+Documentation only — no code changes. npm shows the README of the latest
+published version, so these corrections needed a release to reach the package
+page.
+
+### Documentation
+- **README: account-status enforcement was undocumented.** 0.9.0 made suspension and deletion revoke access — `ACCOUNT_INACTIVE` (HTTP 403) at login, on refresh and on every authenticated request — and added the `isUserActive` option, but the README mentioned none of it, including in **Migrating to v0.9.0**. Adds an **Account Status** section, an `isUserActive` row under **Common Options**, a **Security Features** entry, and a migration item: clients need to handle `ACCOUNT_INACTIVE`, and repositories must stop hiding inactive users.
+- **README: JWT Validation Modes** now says `'full'` rejects inactive accounts on the next request, and that in `'payload-only'` a suspended user keeps working until their access token expires while refresh stays blocked.
+- **README: Utilities** lists the helpers 0.9.0 exported: `isUserActiveByDefault`, `emailForLog`, `ipForLog`, `maskPhoneDigits`, `redactSecurityEventMetadata` and `hashIp`.
+- **README: Migrating to v0.9.0** no longer says code mode is entirely unchanged. With no base URL at all, code-mode emails now carry no page link.
+- **CHANGELOG: the 0.9.0 release note** said the `rc.4` and `rc.5` changes had not been run on an adopter's staging. Lift had deployed `rc.5` to staging; the note is corrected in place.
+
 ## [0.9.0] - 2026-09-14
 
 Three independent workstreams land here: a trim of the email interface surface
@@ -43,12 +176,15 @@ phone numbers — see **Security**.
 > Shipped through five release candidates on the `next` dist-tag before
 > reaching `latest`; this release is the content of `0.9.0-rc.5` under its
 > final version. Ariadne verified token and code mode end to end before
-> `rc.1`, and Lift ran its automated staging checks and its real-inbox, phone
-> and Google sign-in checks against `rc.3`. What arrived after that — the
-> `features` flag removal and clean build in `rc.4`, and personal data in logs
-> and the code-mode base URL in `rc.5` — was verified by this package's test
-> suite and against the published candidates, not on an adopter's staging.
-> `rc.2` carried eight stale compiled files; see **Fixed (release tooling)**.
+> `rc.1`. Lift ran its automated staging checks and its real-inbox, phone and
+> Google sign-in checks against `rc.3`, then deployed `rc.5` to staging: 18/18
+> automated auth checks, a clean boot, no code-mode base URL warning, and no
+> raw email, IP address or phone number in the package's log output. `rc.2`
+> carried eight stale compiled files; see **Fixed (release tooling)**.
+>
+> *Corrected in 0.9.1. As published in 0.9.0, this note said the `rc.4` and
+> `rc.5` changes had not been run on an adopter's staging; Lift's `rc.5`
+> staging run had been recorded minutes before the note was written.*
 
 ### ⚠ External configuration required
 - **`verificationMode: 'token'` requires your frontend to serve two routes.**

package/README.md

@@ -19,10 +19,12 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
   - [Brute Force Protection](#brute-force-protection)
   - [Password Policy](#password-policy)
   - [Lifecycle Hooks](#lifecycle-hooks)
+  - [Account Status](#account-status)
   - [JWT Validation Modes](#jwt-validation-modes)
   - [JWT Payload Factory](#jwt-payload-factory)
 - [Configuration Reference](#configuration-reference)
   - [Required Options](#required-options)
+  - [Module Options](#module-options-forrootasync)
   - [Common Options](#common-options)
   - [Feature Flags](#feature-flags-features)
   - [Security Secrets](#security-secrets)
@@ -35,6 +37,7 @@ Production-grade authentication module for NestJS GraphQL + REST APIs. JWT, cook
 - [Guards](#guards)
 - [Utilities](#utilities)
 - [Security Features](#security-features)
+- [Migrating to v0.10.0](#migrating-to-v0100)
 - [Migrating to v0.9.0](#migrating-to-v090)
 - [License](#license)
 
@@ -64,6 +67,8 @@ npm install @nestjs/common @nestjs/core @nestjs/graphql @nestjs/jwt @nestjs/pass
 
 `resend` is an optional peer dependency -- install it only if using the Resend email sender.
 
+Supports NestJS 10 and NestJS 11. CI runs the unit and end-to-end suites on both: NestJS 10 with `@nestjs/graphql` 12, Express 4 and Apollo Server 4, and NestJS 11 with `@nestjs/graphql` 13, Express 5 and Apollo Server 5.
+
 ## Quick Start
 
 Minimal setup: JWT authentication with email/password login.
@@ -468,6 +473,29 @@ AuthModule.forRootAsync({
 
 `RealmMiddleware` is automatically registered by `AuthModule` — no manual middleware registration needed. When a `realmExtractorInstance` is provided, the middleware calls `extractor.extractRealm(request)` on every request before any guards run. If the extractor returns `null`, the request is rejected with `400 Bad Request` (strict mode).
 
+**Routes without a realm.** Health checks, inbound webhooks and public downloads have no realm by nature. Match them with `realm.skip`, and the middleware lets them through without calling the extractor:
+
+```typescript
+AuthModule.forRootAsync({
+  // ...
+  useFactory: (usersRepo, tokenRepo, realmExtractor, config) => ({
+    // ...required options
+    realmExtractorInstance: realmExtractor,
+    realm: {
+      skip: (path) => path === '/health' || path.startsWith('/hooks/'),
+    },
+  }),
+})
+```
+
+- `path` is the path the client requested, including any global prefix and without the query string. Match on it, not on `request.path` or `request.url`: Express rewrites both to `/` inside middleware. The request itself is the second argument.
+- A skipped request has no realm: `request._realm` stays undefined.
+- **Skip only routes that are unauthenticated or authenticate by other means.** A JWT's realm claim cannot match a request with no realm, so `JwtStrategy` answers 401. `BaseAuthResolver` flows and the OAuth routes answer `400 Realm required` rather than run outside a realm, which also contains a predicate that matches more than you meant.
+- `skip` must return a boolean synchronously. If it throws or returns anything else, such as the Promise from an `async` function, the request is not skipped and the error is logged.
+- Without `realmExtractorInstance`, `realm.skip` is ignored and a warning is logged at boot. A `realm.skip` that is not a function fails boot with `InvalidAuthConfigException`.
+
+Why a predicate rather than route patterns: the same Nest route pattern matches different paths on NestJS 10 and NestJS 11 — `hooks/*` excludes `/hooks/glitchtip/issue` on 11 but not on 10 — so a pattern list would behave differently depending on your Nest version. A `@SkipRealm()` decorator cannot work either, because middleware runs before Nest resolves the route handler.
+
 **Use `@CurrentRealm()` in resolvers:**
 
 ```typescript
@@ -524,7 +552,9 @@ Then use a multi-strategy guard:
 { provide: APP_GUARD, useClass: createAuthGuard(['api-key', 'jwt'], { allowPublic: true }) }
 ```
 
-The `ApiKeyStrategy` hashes the bearer token with SHA-256 and calls `findByKeyHash()` on your repository. API keys and JWT tokens use the same `Authorization: Bearer` header -- strategies are tried in the order specified. When no bearer token is present (e.g. cookie auth), the API key strategy gracefully falls through to the next strategy.
+The `ApiKeyStrategy` hashes the bearer token with SHA-256 and calls `findByKeyHash()` on your repository. API keys and JWTs share the `Authorization: Bearer` header, and strategies are tried in the order listed. A request with no bearer token, or with one that matches no key, falls through to the next strategy, so `['api-key', 'jwt']` and `['jwt', 'api-key']` both accept either credential. A key that matches an inactive account is rejected with 401 and no other strategy runs. When every strategy fails, the guard answers 401.
+
+Before 0.10.0 the API key strategy rejected an unknown bearer token itself, which stopped the chain: `['api-key', 'jwt']` rejected every JWT.
 
 ### Email System
 
@@ -694,7 +724,33 @@ AuthModule.forRootAsync({
 })
 ```
 
-The `OAuthController` is automatically registered and handles OAuth callback routes. OAuth strategies gracefully degrade to no-ops when credentials are not configured.
+`OAuthController` mounts two token-exchange routes for native mobile sign-in: `POST /auth/google/token` with body `{ "idToken": "..." }`, and `POST /auth/facebook/token` with body `{ "accessToken": "..." }`. Both return `{ accessToken, refreshToken, user }`.
+
+**Not using them?** Leave them unmounted, and they answer 404 like any unknown path:
+
+```typescript
+AuthModule.forRootAsync({
+  oauthController: false, // beside useFactory, not inside it
+  useFactory: () => ({ /* ... */ }),
+})
+```
+
+It sits beside `useFactory` because Nest fixes a module's controllers before async options resolve. GraphQL account linking does not use these routes and keeps working.
+
+**Errors.** The routes answer with an HTTP status and a body carrying `message`, `code` and `statusCode` at the root, plus the fields listed:
+
+| Status | `code` | When | Other fields |
+|--------|--------|------|--------------|
+| 404 | `OAUTH_PROVIDER_NOT_CONFIGURED` | The provider has no credentials in this deployment | `provider` |
+| 401 | `INVALID_OAUTH_TOKEN` | The provider rejected the token | `provider` |
+| 400 | `OAUTH_MISSING_DATA` | The provider returned no email, or an unverified one | `provider`, `missingField`; for a new Facebook user, `fallbackToken` and `providerId` |
+| 409 | `EMAIL_EXISTS_WITH_PASSWORD` | The email belongs to a password account | `email`, `linkingToken` |
+| 409 | `OAUTH_ACCOUNT_ALREADY_LINKED` | The account has a different ID linked for this provider | `provider` |
+| 403 | `ACCOUNT_LOCKED` | Brute-force lockout | `remainingLockoutTime` (seconds) |
+| 403 | `ACCOUNT_INACTIVE` | The account is suspended or deleted | -- |
+| 429 | `RATE_LIMIT_EXCEEDED` | The client IP exceeded `bruteForce.ipRateLimit` | -- |
+
+With realms enabled, a request without a realm gets `400 Realm required` first. Before 0.10.0 the lockout, inactive-account, rate-limit and unconfigured-provider cases answered 500.
 
 ### Brute Force Protection
 
@@ -847,10 +903,33 @@ All hooks are optional. Async hooks are awaited but failures are logged and do n
 
 `onAccountLocked` fires from `BruteForceProtectionService.recordFailedAttempt` on the transition from "not locked" → "locked". Subsequent failed attempts while the account remains locked do **not** re-fire (use `onAuthFailure` for per-attempt signal). Wire it to send the account-locked email yourself — the package no longer ships a `sendAccountLockedEmail` method on `IEmailService`; notification surface area beyond verification, password-reset, and password-changed is consumer-owned via this hook.
 
+### Account Status
+
+Suspending or deleting a user takes effect on their next request. The package checks each user's `status` and `deletedAt` itself:
+
+| Where | Effect |
+|-------|--------|
+| `login` | Rejected after the password is verified, so the check cannot reveal to someone without the password that an address is suspended |
+| Every authenticated request (`jwtValidation: 'full'`) | Rejected on the next request, not at token expiry |
+| `refreshToken` | Rejected, including within the refresh grace period |
+| Any token issuance | Rejected, as a backstop for every flow that mints tokens |
+
+A rejected request throws `AccountInactiveException`: a GraphQL error with `extensions.code` `ACCOUNT_INACTIVE`, `statusCode` `403`, and the message `This account is no longer active.` It does not say whether the account was suspended or deleted. Unlike `AccountLockedException` it does not clear on its own, so clients should sign the user out rather than offer a retry. Each rejection logs `SecurityEvent.ACCOUNT_INACTIVE_BLOCKED` with a `phase` of `login`, `refresh`, `session` or `issue`.
+
+**Which accounts are inactive.** By default (`isUserActiveByDefault`), a user with `deletedAt` set, or whose `status` is `SUSPENDED` or `DELETED`, compared case-insensitively. Any other status — including one the package does not recognise — counts as active, so a status vocabulary that differs from `UserStatus` cannot lock everyone out. If yours differs, supply a predicate:
+
+```typescript
+isUserActive: (user) => user.status !== 'FROZEN' && user.status !== 'CLOSED' && !user.deletedAt,
+```
+
+It must be synchronous and pure: it runs on every authenticated request, against the user already loaded.
+
+**Your repository must return inactive users.** `findById` and `findByEmail` should return suspended and soft-deleted users like any other. A repository that hides them turns `ACCOUNT_INACTIVE` into a "not found" failure, and the package can no longer tell the client why.
+
 ### JWT Validation Modes
 
-- **`'full'`** (default) -- Calls `userRepository.findById()` on every request to verify the user still exists.
-- **`'payload-only'`** -- Returns `{ id, email }` from the JWT payload without a DB lookup. Faster, but does not detect deleted/disabled users until token expiry.
+- **`'full'`** (default) -- Calls `userRepository.findById()` on every request, rejecting the request if the user no longer exists or is no longer active (see [Account Status](#account-status)).
+- **`'payload-only'`** -- Returns `{ id, email }` from the JWT payload without a DB lookup. Faster, but nothing about the account is re-checked per request: a suspended or deleted user keeps working until their access token expires (`jwtExpiresIn`, 15 minutes by default). Refresh is still blocked, so one access-token lifetime is the whole window.
 
 ```typescript
 jwtValidation: 'payload-only',
@@ -883,6 +962,17 @@ jwtPayloadFactoryInstance: {
 | `refreshTokenRepositoryInstance` | `IRefreshTokenRepository` | Token persistence |
 | `jwtSecret` | `string` | JWT signing secret |
 
+### Module Options (`forRootAsync`)
+
+These sit beside `useFactory`, not in the object it returns.
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `useFactory` | `(...deps) => AuthModuleOptions` | -- | Returns the options in the other tables. Required |
+| `inject` | `any[]` | `[]` | Providers passed to `useFactory` |
+| `imports` | `any[]` | `[]` | Modules that export those providers |
+| `oauthController` | `boolean` | `true` | Mount the REST OAuth token routes. See [OAuth](#oauth) |
+
 ### Common Options
 
 | Option | Type | Default | Description |
@@ -890,11 +980,13 @@ jwtPayloadFactoryInstance: {
 | `jwtExpiresIn` | `string` | `'15m'` | Access token TTL |
 | `refreshTokenExpiresIn` | `string` | `'30d'` | Refresh token TTL |
 | `jwtValidation` | `'full' \| 'payload-only'` | `'full'` | JWT validation strategy |
+| `isUserActive` | `(user) => boolean` | `isUserActiveByDefault` | Decides whether an account may authenticate. See [Account Status](#account-status) |
 | `bcryptRounds` | `number` | `12` | Password hashing cost |
 | `nodeEnv` | `string` | `'production'` | Environment identifier |
 | `passwordPolicy` | `PasswordPolicyConfig` | See [Password Policy](#password-policy) | Password strength rules |
 | `encryptionKey` | `string` | -- | 32-byte hex string for AES-256-GCM (OAuth token encryption) |
 | `bruteForce.ipRateLimit` | `{ maxAttempts, windowMs }` | -- | IP rate-limit policy for `checkIpRateLimit`. When set, `rateLimiterInstance` MUST also be provided explicitly (boot fails with `InvalidAuthConfigException` otherwise). See [IP Rate Limiting](#ip-rate-limiting). |
+| `realm.skip` | `(path, request) => boolean` | -- | Requests that need no realm, such as health checks and webhooks. Read only with `realmExtractorInstance`. See [Realm-Based Identity Isolation](#realm-based-identity-isolation) |
 
 ### Feature Flags (`features`)
 
@@ -1012,7 +1104,7 @@ When `email` is provided, it takes precedence over `emailServiceInstance`.
 | `CsrfGuard` | CSRF header validation for cookie auth |
 | `TenantGuard` | Multi-tenant context resolution |
 | `PermissionGuard` | Permission checking against tenant context |
-| `JwtAuthGuard` | Basic JWT guard (prefer `createAuthGuard`) |
+| `JwtAuthGuard` | JWT-only guard for GraphQL and HTTP routes (prefer `createAuthGuard` for several strategies or `@Public()`) |
 
 ### Recommended Guard Chains
 
@@ -1034,12 +1126,17 @@ When realm support is enabled, `RealmMiddleware` runs before all guards (as Nest
 
 ## Utilities
 
-Helper functions exported for use in custom guards and middleware:
+Helper functions exported for use in custom guards, middleware and loggers:
 
 | Function | Description |
 |----------|-------------|
 | `getRequestFromContext(context)` | Extract request from `ExecutionContext` (handles GraphQL + HTTP) |
 | `extractIpAddress(request)` | Extract client IP (checks `clientIp`, `req.ip`, falls back to `'unknown'`) |
+| `isUserActiveByDefault(user)` | The default account-active predicate (see [Account Status](#account-status)) |
+| `emailForLog(email)`, `ipForLog(ip)` | An email or IP as it may appear in a log line — `emailHash=…` / `ipHash=…`, salted like the package's own logs |
+| `maskPhoneDigits(phone)` | Masks every digit but the last two, keeping formatting |
+| `redactSecurityEventMetadata(metadata)` | Security-event metadata with email, IP and phone fields hashed or masked — what `ConsoleAuthLogger` prints. Call it from a custom `IAuthLogger` for the same treatment |
+| `hashIp(ip, salt)` | HMAC-SHA256 IP hash (16 hex characters) used for rate-limit keys |
 
 ```typescript
 import { getRequestFromContext, extractIpAddress } from '@ambushsoftworks/nestjs-auth-graphql';
@@ -1059,17 +1156,39 @@ export class CustomGuard implements CanActivate {
 
 - **Refresh token rotation** with HMAC-SHA256 hashing and idempotent 10-second grace period
 - **Bcrypt password hashing** with configurable rounds (default: 12)
+- **Account status enforcement** -- suspended and deleted users are rejected at login, on refresh and on every authenticated request (`ACCOUNT_INACTIVE`)
 - **AES-256-GCM encryption** for OAuth tokens at rest
 - **Constant-time comparison** for verification codes
 - **Account enumeration prevention** on signup (optional)
 - **Stateless CSRF protection** for OAuth flows via `OAuthStateService`
 - **`__Host-` cookie prefix** support for enhanced cookie security
 - **Separate HMAC secrets** for refresh tokens, verification codes, and OAuth state
-- **Realm-based identity isolation** with JWT realm claim validation and realm-scoped rate limiting
+- **Realm-based identity isolation** with JWT realm claim validation, realm-scoped rate limiting and lockout, and auth flows that refuse a request without a realm
 - **No raw personal data in package logs** — log lines use the user ID or a salted hash (`emailHash=`, `ipHash=`, under `AUTH_IP_HASH_SALT` or `jwtSecret`), phone numbers keep only their last two digits, and the default `ConsoleAuthLogger` redacts security-event metadata. A custom `authLoggerInstance` receives the raw fields; pass them through `redactSecurityEventMetadata` to store them redacted.
 
+## Migrating to v0.10.0
+
+No code change is required. Check the items that apply to you.
+
+**Clients of the OAuth REST routes.** Four failures that answered 500 now answer 404, 403 or 429 with a `code`; see the table under [OAuth](#oauth). A client that shows a generic error for any failure keeps working. One that branched on 500, or on the old message `Account is locked. Please try again in N minutes.`, should read `code` instead. The lockout message is now the one `login` uses.
+
+**API key guards.** `createAuthGuard(['api-key', 'jwt'])` now accepts JWTs. With `['api-key']` alone, an unknown key still gets 401, now with the guard's generic `Unauthorized` message rather than `Invalid API key`.
+
+**Realms.** With realms enabled, a `BaseAuthResolver` flow or OAuth route reached by a request without a realm answers `400 Realm required`. Before `realm.skip`, `RealmMiddleware` made that impossible, so in practice this affects only code calling `perform*` methods without the GraphQL context, which now counts as having no realm. The OAuth routes also pass the realm to lockout checks, IP rate limiting and the failed-attempt reset. Their IP rate-limit counters move to the realm-prefixed keys `login` already uses (`auth:ipRate:<realm>:<ipHash>`), so existing counts for those routes start again.
+
+**NestJS 11.** The package needs no change to run on it; CI now tests both majors.
+
 ## Migrating to v0.9.0
 
+**Behaviour change — suspended and deleted accounts are rejected.** Before
+0.9.0 the package never checked `status` or `deletedAt`, so suspending a user
+revoked nothing unless your repository happened to hide them. Now those users
+get `ACCOUNT_INACTIVE` (HTTP 403) at login, on refresh and on their next
+request. Handle that error in your clients by signing the user out, check that
+your status values are recognised (supply `isUserActive` if not), and stop
+filtering inactive users out of `findById` / `findByEmail`. See
+[Account Status](#account-status).
+
 **Changed — log output no longer contains raw personal data.** If you parse
 `ConsoleAuthLogger` output or the package's log lines, expect `emailHash` /
 `ipHash` in place of `email` / `ipAddress`, masked phone numbers, and user IDs
@@ -1123,8 +1242,13 @@ Three things to check, in the order they are most likely to bite:
 Token TTL also differs from code TTL: 60 minutes by default
 (`verification.tokenExpiresInMinutes`) versus 15 for codes.
 
-**`verificationMode: 'code'` — the default — is unaffected.** Behaviour is
-identical, including the legacy `FRONTEND_URL` fallback for the reset page URL.
+**`verificationMode: 'code'` — the default — is unaffected by the token-mode
+fix**, including the legacy `FRONTEND_URL` fallback for the page link. One
+change applies to code mode separately: with neither `verification.baseUrl` nor
+`FRONTEND_URL` set, code-mode emails now carry no page link, where they used to
+carry an `https://app.example.com` placeholder that never resolved. The bundled
+email service never showed that link in code mode; only a custom `IEmailService`
+that rendered it notices.
 
 **`bcrypt` 5 → 6.** No code change and no hash migration: existing hashes
 verify unchanged, and hashes written by 0.9.0 still verify if you roll back to

package/dist/auth.module.d.ts

@@ -49,6 +49,9 @@ export interface AuthModuleOptions {
     tenantRepositoryInstance?: ITenantRepository;
     tenantExtractorInstance?: ITenantExtractor;
     realmExtractorInstance?: IRealmExtractor;
+    realm?: {
+        skip?: (path: string, request: Record<string, any>) => boolean;
+    };
     resourcePermissionRepositoryInstance?: IResourcePermissionRepository;
     jwtPayloadFactoryInstance?: IJwtPayloadFactory;
     apiKeyRepositoryInstance?: IApiKeyRepository;
@@ -119,9 +122,11 @@ export interface AuthModuleOptions {
 export interface AuthModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
     useFactory: (...args: any[]) => Promise<AuthModuleOptions> | AuthModuleOptions;
     inject?: any[];
+    oauthController?: boolean;
 }
 export declare function validateAuthModuleOptions(opts: AuthModuleOptions): void;
 export declare function describeIgnoredFeatureFlags(opts: AuthModuleOptions): string[];
+export declare function describeIgnoredOptions(opts: AuthModuleOptions): string[];
 export { AUTH_MODULE_OPTIONS, USER_REPOSITORY, REFRESH_TOKEN_REPOSITORY, EMAIL_SERVICE, SMS_SERVICE, AUTH_LIFECYCLE_HOOKS, VERIFICATION_REPOSITORY, BRUTE_FORCE_REPOSITORY, BIOMETRIC_REPOSITORY, AUTH_LOGGER, RATE_LIMITER, TENANT_REPOSITORY, TENANT_EXTRACTOR, RESOURCE_PERMISSION_REPOSITORY, JWT_PAYLOAD_FACTORY, API_KEY_REPOSITORY, } from './constants';
 export declare class AuthModule implements NestModule {
     configure(consumer: MiddlewareConsumer): void;

package/dist/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAYjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA8B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAInE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAIxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAY3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAQzC,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAmB7C,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAuBnC,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAKD,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;CAChB;AA0BD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAqCvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AAuDD,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CA8YpE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,kBAAkB,EAElB,UAAU,EAGX,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA0B3D,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iDAAiD,CAAC;AAC1F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gDAAgD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAYjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AA8B9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AAGrF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAInE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gDAAgD,CAAC;AAIxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAwBnF,MAAM,WAAW,iBAAiB;IAMhC,sBAAsB,EAAE,eAAe,CAAC;IAOxC,8BAA8B,EAAE,uBAAuB,CAAC;IAOxD,oBAAoB,CAAC,EAAE,aAAa,CAAC;IAOrC,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAMjC,sBAAsB,CAAC,EAAE,mBAAmB,CAAC;IAM7C,8BAA8B,CAAC,EAAE,uBAAuB,CAAC;IAMzD,4BAA4B,CAAC,EAAE,qBAAqB,CAAC;IAMrD,2BAA2B,CAAC,EAAE,oBAAoB,CAAC;IAQnD,kBAAkB,CAAC,EAAE,WAAW,CAAC;IAQjC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAQ5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAQhC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAQ1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAMhC,MAAM,CAAC,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAMF,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IAOF,OAAO,CAAC,EAAE,MAAM,CAAC;IASjB,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAS7C,uBAAuB,CAAC,EAAE,gBAAgB,CAAC;IAa3C,sBAAsB,CAAC,EAAE,eAAe,CAAC;IAKzC,KAAK,CAAC,EAAE;QA4BN,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC;KAChE,CAAC;IAQF,oCAAoC,CAAC,EAAE,6BAA6B,CAAC;IAOrE,yBAAyB,CAAC,EAAE,kBAAkB,CAAC;IAO/C,wBAAwB,CAAC,EAAE,iBAAiB,CAAC;IAmB7C,aAAa,CAAC,EAAE,MAAM,GAAG,cAAc,CAAC;IAyBxC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC;IAO5C,YAAY,CAAC,EAAE,MAAM,CAAC;IAmBtB,QAAQ,CAAC,EAAE;QAOT,0BAA0B,CAAC,EAAE,OAAO,CAAC;QAQrC,UAAU,CAAC,EAAE,OAAO,CAAC;QAOrB,gBAAgB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACrC,CAAC;IAMF,MAAM,CAAC,EAAE;QAEP,QAAQ,CAAC,EAAE,OAAO,CAAC;QAEnB,MAAM,CAAC,EAAE,OAAO,CAAC;QAEjB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAErC,MAAM,CAAC,EAAE,MAAM,CAAC;QAEhB,IAAI,CAAC,EAAE,MAAM,CAAC;QAEd,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAE3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAE5B,eAAe,CAAC,EAAE,MAAM,CAAC;QAEzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAc1B,aAAa,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;IAMF,IAAI,CAAC,EAAE;QAEL,UAAU,CAAC,EAAE,MAAM,CAAC;QAEpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAE9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IAMF,SAAS,EAAE,MAAM,CAAC;IAMlB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAK/B,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,QAAQ,CAAC,EAAE;YACT,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IAOF,aAAa,CAAC,EAAE,MAAM,CAAC;IAsBvB,cAAc,CAAC,EAAE,oBAAoB,CAAC;IAqBtC,mBAAmB,CAAC,EAAE,YAAY,CAAC;IAuBnC,UAAU,CAAC,EAAE;QAeX,WAAW,CAAC,EAAE;YAEZ,WAAW,EAAE,MAAM,CAAC;YAEpB,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;IAiBF,KAAK,CAAC,EAAE;QAEN,MAAM,EAAE,YAAY,CAAC;QAErB,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAEvC,QAAQ,CAAC,EAAE,mBAAmB,CAAC;QAE/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;KAC3C,CAAC;IAKF,YAAY,CAAC,EAAE;QAEb,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAKD,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;IAC7E,UAAU,EAAE,CACV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IAef,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA2BD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAsCvE;AA2ED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAwB7E;AASD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAYxE;AA+ED,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AAuCrB,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAkC7C,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;CA8YpE"}

package/dist/auth.module.js

@@ -10,6 +10,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthModule = exports.API_KEY_REPOSITORY = exports.JWT_PAYLOAD_FACTORY = exports.RESOURCE_PERMISSION_REPOSITORY = exports.TENANT_EXTRACTOR = exports.TENANT_REPOSITORY = exports.RATE_LIMITER = exports.AUTH_LOGGER = exports.BIOMETRIC_REPOSITORY = exports.BRUTE_FORCE_REPOSITORY = exports.VERIFICATION_REPOSITORY = exports.AUTH_LIFECYCLE_HOOKS = exports.SMS_SERVICE = exports.EMAIL_SERVICE = exports.REFRESH_TOKEN_REPOSITORY = exports.USER_REPOSITORY = exports.AUTH_MODULE_OPTIONS = void 0;
 exports.validateAuthModuleOptions = validateAuthModuleOptions;
 exports.describeIgnoredFeatureFlags = describeIgnoredFeatureFlags;
+exports.describeIgnoredOptions = describeIgnoredOptions;
 const common_1 = require("@nestjs/common");
 const realm_middleware_1 = require("./middleware/realm.middleware");
 const jwt_1 = require("@nestjs/jwt");
@@ -47,6 +48,7 @@ const configurable_email_service_1 = require("./services/configurable-email.serv
 const default_email_template_renderer_1 = require("./services/default-email-template-renderer");
 function validateAuthModuleOptions(opts) {
     validateVerificationOptions(opts);
+    validateRealmOptions(opts);
     const ipRateLimit = opts.bruteForce?.ipRateLimit;
     if (ipRateLimit && !opts.rateLimiterInstance) {
         throw new invalid_auth_config_exception_1.InvalidAuthConfigException('[AuthModule] bruteForce.ipRateLimit is configured but rateLimiterInstance ' +
@@ -125,6 +127,24 @@ function describeIgnoredFeatureFlags(opts) {
             `${removed.controlledBy}. In this configuration, ${state}. Remove the key.`);
     });
 }
+function describeIgnoredOptions(opts) {
+    const messages = describeIgnoredFeatureFlags(opts);
+    if (opts.realm?.skip !== undefined && !opts.realmExtractorInstance) {
+        messages.push('[AuthModule] realm.skip is ignored: realms are enabled by `realmExtractorInstance`, ' +
+            'which is not set, so no request is asked for a realm and none needs skipping. ' +
+            'Remove realm.skip, or set realmExtractorInstance.');
+    }
+    return messages;
+}
+function validateRealmOptions(opts) {
+    const skip = opts.realm?.skip;
+    if (!opts.realmExtractorInstance || skip === undefined || typeof skip === 'function') {
+        return;
+    }
+    throw new invalid_auth_config_exception_1.InvalidAuthConfigException(`[AuthModule] realm.skip must be a function (path, request) => boolean; received ${Array.isArray(skip) ? 'an array' : typeof skip}. Route patterns are not accepted because Nest matches them differently on ` +
+        "NestJS 10 and 11. Match the path instead, e.g. skip: (path) => path === '/health' " +
+        "|| path.startsWith('/hooks/').");
+}
 function validateVerificationOptions(opts) {
     if ((opts.features?.verificationMode ?? 'code') !== 'token') {
         return;
@@ -179,7 +199,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
             useFactory: async (...args) => {
                 const opts = await options.useFactory(...args);
                 validateAuthModuleOptions(opts);
-                for (const warning of describeIgnoredFeatureFlags(opts)) {
+                for (const warning of describeIgnoredOptions(opts)) {
                     common_1.Logger.warn(warning, 'AuthModule');
                 }
                 (0, personal_data_1.setPersonalDataLogSalt)(process.env.AUTH_IP_HASH_SALT || opts.jwtSecret);
@@ -217,7 +237,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
                     }),
                 }),
             ],
-            controllers: [oauth_controller_1.OAuthController],
+            controllers: options.oauthController === false ? [] : [oauth_controller_1.OAuthController],
             providers: [
                 optionsProvider,
                 {

package/dist/auth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAuoBA,8DAqCC;AA2ED,kEAwBC;AA/wBD,2CAOwB;AACxB,oEAAgE;AAChE,qCAAwC;AACxC,+CAAkD;AAIlD,0DAAsD;AACtD,4EAAuE;AACvE,0EAAsE;AACtE,sEAAkE;AAClE,wEAAmE;AACnE,8FAAwF;AAExF,8EAAyE;AAEzE,8FAAyF;AACzF,wFAAkF;AAGlF,4DAAwD;AACxD,kEAA8D;AAC9D,sEAAkE;AAClE,4EAAuE;AACvE,gFAA2E;AAG3E,mEAA+D;AAe/D,8FAAyF;AACzF,4FAAsF;AACtF,wFAAmF;AACnF,8EAAsE;AACtE,yDAA+D;AAC/D,sEAAiE;AACjE,kEAA6D;AAW7D,wDAAoD;AACpD,gEAA4D;AAC5D,oEAA+D;AAC/D,wFAAkF;AAGlF,2CAkBqB;AAOrB,8FAAuF;AAOvF,8FAAwF;AAExF,sFAAiF;AACjF,gGAA0F;AA4hB1F,SAAgB,yBAAyB,CAAC,IAAuB;IAC/D,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IAEjD,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,0DAA0B,CAClC,4EAA4E;YAC1E,qEAAqE;YACrE,qEAAqE;YACrE,4EAA4E;YAC5E,+DAA+D;YAC/D,2EAA2E;YAC3E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;QAE9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,0DAA0B,CAClC,wFAAwF,MAAM,CAC5F,WAAW,CACZ,qEAAqE;gBACpE,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,0DAA0B,CAClC,qFAAqF,MAAM,CACzF,QAAQ,CACT,2EAA2E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAKD,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,4BAA4B,EAAE,kBAAkB,CAAU,CAAC;AASrG,MAAM,qBAAqB,GAMvB;IACF,iBAAiB,EAAE;QACjB,YAAY,EACV,qHAAqH;QACvH,MAAM,EAAE;YACN,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACxF,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;SACvF;KACF;IACD,eAAe,EAAE;QACf,YAAY,EACV,sGAAsG;QACxG,MAAM,EAAE;YACN,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAC9D,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;SACvF;KACF;IACD,WAAW,EAAE;QACX,YAAY,EAAE,6CAA6C;QAC3D,MAAM,EAAE,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;KACjF;IACD,aAAa,EAAE;QACb,YAAY,EAAE,iDAAiD;QAC/D,MAAM,EAAE;YACN,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACnF;KACF;IACD,aAAa,EAAE;QACb,YAAY,EAAE,sEAAsE;QACpF,MAAM,EAAE,CAAC,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;KAC3F;IACD,oBAAoB,EAAE;QACpB,YAAY,EACV,oGAAoG;QACtG,MAAM,EAAE,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;KAC7F;IACD,YAAY,EAAE;QACZ,YAAY,EACV,gHAAgH;QAClH,MAAM,EAAE,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;KACrF;CACF,CAAC;AAaF,SAAgB,2BAA2B,CAAC,IAAuB;IACjE,MAAM,SAAS,GAAsB,kBAAkB,CAAC;IAExD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CACL,yBAAyB,GAAG,yCAAyC;gBACrE,oCAAoC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM;aACzB,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;aACvF,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CACL,yBAAyB,GAAG,qEAAqE;YACjG,GAAG,OAAO,CAAC,YAAY,4BAA4B,KAAK,mBAAmB,CAC5E,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAcD,SAAS,2BAA2B,CAAC,IAAuB;IAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,0DAA0B,CAClC,6EAA6E;YAC3E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0DAA0B,CAClC,wEAAwE,OAAO,KAAK;YAClF,8DAA8D,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,0DAA0B,CAClC,uEAAuE,OAAO,KAAK;YACjF,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,yCAiBqB;AAhBnB,gHAAA,mBAAmB,OAAA;AACnB,4GAAA,eAAe,OAAA;AACf,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,wGAAA,WAAW,OAAA;AACX,iHAAA,oBAAoB,OAAA;AACpB,oHAAA,uBAAuB,OAAA;AACvB,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,8GAAA,iBAAiB,OAAA;AACjB,6GAAA,gBAAgB,OAAA;AAChB,2HAAA,8BAA8B,OAAA;AAC9B,gHAAA,mBAAmB,OAAA;AACnB,+GAAA,kBAAkB,OAAA;AAyCb,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,kCAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAgCD,MAAM,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,+BAAmB;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBACnC,MAAM,IAAI,GAAsB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAIlE,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIhC,KAAK,MAAM,OAAO,IAAI,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,eAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACrC,CAAC;gBAKD,IAAA,sCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;gBAGxE,IAAI,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;oBAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,kFAAkF;4BAClF,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;wBACjD,MAAM,IAAI,KAAK,CACb,+EAA+E;4BAC/E,qCAAqC,CACtC,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;wBACvB,MAAM,IAAI,KAAK,CACb,wEAAwE;4BACxE,oDAAoD,CACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBACnD,eAAS,CAAC,aAAa,CAAC;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,KAAK,EAAE,aAAgC,EAAE,EAAE,CAAC,CAAC;wBACvD,MAAM,EAAE,aAAa,CAAC,SAAS;wBAC/B,WAAW,EAAE;4BACX,SAAS,EAAE,CAAC,aAAa,CAAC,YAAY,IAAI,KAAK,CAAQ;yBACxD;qBACF,CAAC;iBACH,CAAC;aACH;YACD,WAAW,EAAE,CAAC,kCAAe,CAAC;YAC9B,SAAS,EAAE;gBACT,eAAe;gBAGf;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;4BACjC,MAAM,IAAI,KAAK,CACb,+BAA+B;gCAC/B,iHAAiH,CAClH,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,sBAAsB,CAAC;oBACrC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,oCAAwB;oBACjC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;4BACzC,MAAM,IAAI,KAAK,CACb,wCAAwC;gCACxC,gIAAgI,CACjI,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,8BAA8B,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,mCAAuB;oBAChC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,8BAA8B,IAAI,IAAI,yDAA0B,EAAE,CAAC;oBACjF,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,kCAAsB;oBAC/B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,4BAA4B,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC7E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,2BAA2B,IAAI,IAAI,mDAAuB,EAAE,CAAC;oBAC3E,CAAC;iBACF;gBAMD;oBACE,OAAO,EAAE,yBAAa;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BACf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB;mCACvC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;oCACrB,CAAC,CAAC,IAAI,8DAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oCACvD,CAAC,CAAC,SAAS,CAAC,CAAC;4BAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACd,MAAM,IAAI,KAAK,CACb,oEAAoE;oCACpE,iDAAiD;oCACjD,iFAAiF,CAClF,CAAC;4BACJ,CAAC;4BAED,MAAM,IAAI,GAAG;gCACX,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gCAC5B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO;6BAC3D,CAAC;4BAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC;4BAEnE,OAAO,IAAI,qDAAwB,CACjC,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,MAAM,EACjB,IAAI,EACJ,gBAAgB,CACjB,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,oBAAoB,IAAI,IAAI,qCAAgB,EAAE,CAAC;oBAC7D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,iCAAc,EAAE,CAAC;oBACzD,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC;oBAC3C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,0CAAiB,EAAE,CAAC;oBAC5D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,wBAAY;oBACrB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,mBAAmB,IAAI,IAAI,2DAA0B,EAAE,CAAC;oBACtE,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,6BAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,4BAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC;oBAC9C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0CAA8B;oBACvC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,oCAAoC,IAAI,IAAI,CAAC;oBAC3D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,+BAAmB;oBAC5B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC1E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,8BAAkB;oBAC3B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBAGxB;oBACE,OAAO,EAAE,sCAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,OAAO,IAAI,sCAAiB,CAAC,OAAO,CAAC,CAAC;oBACxC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0BAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,EAAE,0BAAW,EAAE,+BAAmB,CAAC;oBAC/D,UAAU,EAAE,CACV,OAA0B,EAC1B,WAAwB,EACxB,iBAAqC,EACrC,EAAE;wBACF,OAAO,IAAI,0BAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;oBAClE,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,gCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;wBAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,eAAM,CAAC,IAAI,CACT,8HAA8H,EAC9H,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,yCAAkB,EAAE,CAAC;wBAClC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,uEAAuE;gCACvE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,gCAAc,CAAC,OAAO,CAAC,CAAC;oBACrC,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,oCAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;wBACnD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;wBAE3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;4BAC/B,eAAM,CAAC,IAAI,CACT,oJAAoJ,EACpJ,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,6CAAoB,EAAE,CAAC;wBACpC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE;gCACzE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,oCAAgB,CAAC,OAAO,CAAC,CAAC;oBACvC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,iCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;4BAEtC,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,OAAO,IAAI,iCAAc,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;oBAC9D,CAAC;iBACF;gBAGD,kCAAe;gBAGf,0BAAW;gBAGX,kCAAe;aAMhB;YACD,OAAO,EAAE;gBACP,+BAAmB;gBACnB,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,sCAAiB;gBACjB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBACxB,uBAAW;gBACX,2BAAe;gBACf,oCAAwB;gBACxB,6BAAiB;gBACjB,4BAAgB;gBAChB,2BAAe;gBACf,0CAA8B;gBAC9B,+BAAmB;gBACnB,8BAAkB;gBAClB,0BAAW;gBACX,kCAAe;gBACf,eAAS;gBACT,yBAAc;aACf;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjbY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAibtB"}
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AA0rBA,8DAsCC;AA2ED,kEAwBC;AASD,wDAYC;AAx1BD,2CAOwB;AACxB,oEAAgE;AAChE,qCAAwC;AACxC,+CAAkD;AAIlD,0DAAsD;AACtD,4EAAuE;AACvE,0EAAsE;AACtE,sEAAkE;AAClE,wEAAmE;AACnE,8FAAwF;AAExF,8EAAyE;AAEzE,8FAAyF;AACzF,wFAAkF;AAGlF,4DAAwD;AACxD,kEAA8D;AAC9D,sEAAkE;AAClE,4EAAuE;AACvE,gFAA2E;AAG3E,mEAA+D;AAe/D,8FAAyF;AACzF,4FAAsF;AACtF,wFAAmF;AACnF,8EAAsE;AACtE,yDAA+D;AAC/D,sEAAiE;AACjE,kEAA6D;AAW7D,wDAAoD;AACpD,gEAA4D;AAC5D,oEAA+D;AAC/D,wFAAkF;AAGlF,2CAkBqB;AAOrB,8FAAuF;AAOvF,8FAAwF;AAExF,sFAAiF;AACjF,gGAA0F;AA+kB1F,SAAgB,yBAAyB,CAAC,IAAuB;IAC/D,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAClC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAE3B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IAEjD,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7C,MAAM,IAAI,0DAA0B,CAClC,4EAA4E;YAC1E,qEAAqE;YACrE,qEAAqE;YACrE,4EAA4E;YAC5E,+DAA+D;YAC/D,2EAA2E;YAC3E,sEAAsE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC;QAE9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,0DAA0B,CAClC,wFAAwF,MAAM,CAC5F,WAAW,CACZ,qEAAqE;gBACpE,sEAAsE,CACzE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,0DAA0B,CAClC,qFAAqF,MAAM,CACzF,QAAQ,CACT,2EAA2E,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAKD,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,4BAA4B,EAAE,kBAAkB,CAAU,CAAC;AASrG,MAAM,qBAAqB,GAMvB;IACF,iBAAiB,EAAE;QACjB,YAAY,EACV,qHAAqH;QACvH,MAAM,EAAE;YACN,CAAC,mCAAmC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACxF,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;SACvF;KACF;IACD,eAAe,EAAE;QACf,YAAY,EACV,sGAAsG;QACxG,MAAM,EAAE;YACN,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;YAC9D,CAAC,kCAAkC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;SACvF;KACF;IACD,WAAW,EAAE;QACX,YAAY,EAAE,6CAA6C;QAC3D,MAAM,EAAE,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;KACjF;IACD,aAAa,EAAE;QACb,YAAY,EAAE,iDAAiD;QAC/D,MAAM,EAAE;YACN,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;SACnF;KACF;IACD,aAAa,EAAE;QACb,YAAY,EAAE,sEAAsE;QACpF,MAAM,EAAE,CAAC,CAAC,+BAA+B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;KAC3F;IACD,oBAAoB,EAAE;QACpB,YAAY,EACV,oGAAoG;QACtG,MAAM,EAAE,CAAC,CAAC,gCAAgC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;KAC7F;IACD,YAAY,EAAE;QACZ,YAAY,EACV,gHAAgH;QAClH,MAAM,EAAE,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;KACrF;CACF,CAAC;AAaF,SAAgB,2BAA2B,CAAC,IAAuB;IACjE,MAAM,SAAS,GAAsB,kBAAkB,CAAC;IAExD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CACL,yBAAyB,GAAG,yCAAyC;gBACrE,oCAAoC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM;aACzB,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;aACvF,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,OAAO,CACL,yBAAyB,GAAG,qEAAqE;YACjG,GAAG,OAAO,CAAC,YAAY,4BAA4B,KAAK,mBAAmB,CAC5E,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AASD,SAAgB,sBAAsB,CAAC,IAAuB;IAC5D,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAEnD,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACnE,QAAQ,CAAC,IAAI,CACX,sFAAsF;YACpF,gFAAgF;YAChF,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD,SAAS,oBAAoB,CAAC,IAAuB;IACnD,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;IAEvC,IAAI,CAAC,IAAI,CAAC,sBAAsB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QACrF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,0DAA0B,CAClC,mFACE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAC5C,6EAA6E;QAC3E,oFAAoF;QACpF,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAcD,SAAS,2BAA2B,CAAC,IAAuB;IAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,0DAA0B,CAClC,6EAA6E;YAC3E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,0DAA0B,CAClC,wEAAwE,OAAO,KAAK;YAClF,8DAA8D,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,0DAA0B,CAClC,uEAAuE,OAAO,KAAK;YACjF,kEAAkE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,yCAiBqB;AAhBnB,gHAAA,mBAAmB,OAAA;AACnB,4GAAA,eAAe,OAAA;AACf,qHAAA,wBAAwB,OAAA;AACxB,0GAAA,aAAa,OAAA;AACb,wGAAA,WAAW,OAAA;AACX,iHAAA,oBAAoB,OAAA;AACpB,oHAAA,uBAAuB,OAAA;AACvB,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,8GAAA,iBAAiB,OAAA;AACjB,6GAAA,gBAAgB,OAAA;AAChB,2HAAA,8BAA8B,OAAA;AAC9B,gHAAA,mBAAmB,OAAA;AACnB,+GAAA,kBAAkB,OAAA;AAyCb,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,kCAAe,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;IAgCD,MAAM,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,+BAAmB;YAC5B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBACnC,MAAM,IAAI,GAAsB,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAIlE,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBAIhC,KAAK,MAAM,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnD,eAAM,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACrC,CAAC;gBAKD,IAAA,sCAAsB,EAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;gBAGxE,IAAI,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;oBAC/B,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;wBACjC,MAAM,IAAI,KAAK,CACb,kFAAkF;4BAClF,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;wBACjD,MAAM,IAAI,KAAK,CACb,+EAA+E;4BAC/E,qCAAqC,CACtC,CAAC;oBACJ,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;wBACvB,MAAM,IAAI,KAAK,CACb,wEAAwE;4BACxE,oDAAoD,CACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1B,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBACnD,eAAS,CAAC,aAAa,CAAC;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,KAAK,EAAE,aAAgC,EAAE,EAAE,CAAC,CAAC;wBACvD,MAAM,EAAE,aAAa,CAAC,SAAS;wBAC/B,WAAW,EAAE;4BACX,SAAS,EAAE,CAAC,aAAa,CAAC,YAAY,IAAI,KAAK,CAAQ;yBACxD;qBACF,CAAC;iBACH,CAAC;aACH;YACD,WAAW,EAAE,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kCAAe,CAAC;YACvE,SAAS,EAAE;gBACT,eAAe;gBAGf;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;4BACjC,MAAM,IAAI,KAAK,CACb,+BAA+B;gCAC/B,iHAAiH,CAClH,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,sBAAsB,CAAC;oBACrC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,oCAAwB;oBACjC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,CAAC,IAAI,CAAC,8BAA8B,EAAE,CAAC;4BACzC,MAAM,IAAI,KAAK,CACb,wCAAwC;gCACxC,gIAAgI,CACjI,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,8BAA8B,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,mCAAuB;oBAChC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,8BAA8B,IAAI,IAAI,yDAA0B,EAAE,CAAC;oBACjF,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,kCAAsB;oBAC/B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,4BAA4B,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC7E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,2BAA2B,IAAI,IAAI,mDAAuB,EAAE,CAAC;oBAC3E,CAAC;iBACF;gBAMD;oBACE,OAAO,EAAE,yBAAa;oBACtB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;4BACf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB;mCACvC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;oCACrB,CAAC,CAAC,IAAI,8DAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oCACvD,CAAC,CAAC,SAAS,CAAC,CAAC;4BAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;gCACd,MAAM,IAAI,KAAK,CACb,oEAAoE;oCACpE,iDAAiD;oCACjD,iFAAiF,CAClF,CAAC;4BACJ,CAAC;4BAED,MAAM,IAAI,GAAG;gCACX,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;gCAC5B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO;6BAC3D,CAAC;4BAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,gBAAgB,IAAI,MAAM,CAAC;4BAEnE,OAAO,IAAI,qDAAwB,CACjC,QAAQ,EACR,IAAI,CAAC,KAAK,CAAC,MAAM,EACjB,IAAI,EACJ,gBAAgB,CACjB,CAAC;wBACJ,CAAC;wBACD,OAAO,IAAI,CAAC,oBAAoB,IAAI,IAAI,qCAAgB,EAAE,CAAC;oBAC7D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,iCAAc,EAAE,CAAC;oBACzD,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,gCAAoB;oBAC7B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,EAAE,CAAC;oBAC3C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,uBAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,kBAAkB,IAAI,IAAI,0CAAiB,EAAE,CAAC;oBAC5D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,wBAAY;oBACrB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,mBAAmB,IAAI,IAAI,2DAA0B,EAAE,CAAC;oBACtE,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,6BAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,4BAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,uBAAuB,IAAI,IAAI,CAAC;oBAC9C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,2BAAe;oBACxB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC;oBAC7C,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0CAA8B;oBACvC,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,oCAAoC,IAAI,IAAI,CAAC;oBAC3D,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,+BAAmB;oBAC5B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,yBAAyB,IAAI,IAAI,sDAAwB,EAAE,CAAC;oBAC1E,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,8BAAkB;oBAC3B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,IAAuB,EAAE,EAAE;wBACtC,OAAO,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC;oBAC/C,CAAC;iBACF;gBAGD,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBAGxB;oBACE,OAAO,EAAE,sCAAiB;oBAC1B,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,OAAO,IAAI,sCAAiB,CAAC,OAAO,CAAC,CAAC;oBACxC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,0BAAW;oBACpB,MAAM,EAAE,CAAC,+BAAmB,EAAE,0BAAW,EAAE,+BAAmB,CAAC;oBAC/D,UAAU,EAAE,CACV,OAA0B,EAC1B,WAAwB,EACxB,iBAAqC,EACrC,EAAE;wBACF,OAAO,IAAI,0BAAW,CAAC,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;oBAClE,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,gCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;wBAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACd,eAAM,CAAC,IAAI,CACT,8HAA8H,EAC9H,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,yCAAkB,EAAE,CAAC;wBAClC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,uEAAuE;gCACvE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,gCAAc,CAAC,OAAO,CAAC,CAAC;oBACrC,CAAC;iBACF;gBACD;oBACE,OAAO,EAAE,oCAAgB;oBACzB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;wBACnD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;wBAE3D,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;4BAC/B,eAAM,CAAC,IAAI,CACT,oJAAoJ,EACpJ,YAAY,CACb,CAAC;4BACF,OAAO,IAAI,6CAAoB,EAAE,CAAC;wBACpC,CAAC;wBAGD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;4BAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE;gCACzE,mEAAmE;gCACnE,0FAA0F,CAC3F,CAAC;wBACJ,CAAC;wBAED,OAAO,IAAI,oCAAgB,CAAC,OAAO,CAAC,CAAC;oBACvC,CAAC;iBACF;gBAGD;oBACE,OAAO,EAAE,iCAAc;oBACvB,MAAM,EAAE,CAAC,+BAAmB,CAAC;oBAC7B,UAAU,EAAE,CAAC,OAA0B,EAAE,EAAE;wBACzC,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC;4BAEtC,OAAO,IAAI,CAAC;wBACd,CAAC;wBACD,OAAO,IAAI,iCAAc,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;oBAC9D,CAAC;iBACF;gBAGD,kCAAe;gBAGf,0BAAW;gBAGX,kCAAe;aAMhB;YACD,OAAO,EAAE;gBACP,+BAAmB;gBACnB,0BAAW;gBACX,2CAAmB;gBACnB,0CAAmB;gBACnB,sCAAiB;gBACjB,uCAAiB;gBACjB,4DAA2B;gBAE3B,6CAAoB;gBAEpB,6DAA4B;gBAC5B,sDAAwB;gBACxB,uBAAW;gBACX,2BAAe;gBACf,oCAAwB;gBACxB,6BAAiB;gBACjB,4BAAgB;gBAChB,2BAAe;gBACf,0CAA8B;gBAC9B,+BAAmB;gBACnB,8BAAkB;gBAClB,0BAAW;gBACX,kCAAe;gBACf,eAAS;gBACT,yBAAc;aACf;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjbY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAibtB"}

package/dist/exceptions/oauth.exceptions.d.ts

@@ -1,4 +1,7 @@
-import { UnauthorizedException, BadRequestException, ConflictException } from '@nestjs/common';
+import { UnauthorizedException, BadRequestException, ConflictException, NotFoundException } from '@nestjs/common';
+export declare class OAuthProviderNotConfiguredException extends NotFoundException {
+    constructor(provider: 'google' | 'facebook');
+}
 export declare class OAuthStateMismatchException extends UnauthorizedException {
     constructor();
 }

package/dist/exceptions/oauth.exceptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/oauth.exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EAElB,MAAM,gBAAgB,CAAC;AAMxB,qBAAa,2BAA4B,SAAQ,qBAAqB;;CAQrE;AAMD,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAQ5C;AAMD,qBAAa,2BAA4B,SAAQ,iBAAiB;gBACpD,QAAQ,EAAE,MAAM;CAQ7B;AAMD,qBAAa,2BAA4B,SAAQ,iBAAiB;gBACpD,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CAUhD;AASD,qBAAa,yBAA0B,SAAQ,mBAAmB;gBAE9D,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,EACtB,UAAU,CAAC,EAAE,MAAM;CAYtB;AAMD,qBAAa,0BAA2B,SAAQ,qBAAqB;gBACvD,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAQ9C;AAOD,qBAAa,mCAAoC,SAAQ,qBAAqB;;CAQ7E"}
+{"version":3,"file":"oauth.exceptions.d.ts","sourceRoot":"","sources":["../../src/exceptions/oauth.exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAElB,MAAM,gBAAgB,CAAC;AAQxB,qBAAa,mCAAoC,SAAQ,iBAAiB;gBAC5D,QAAQ,EAAE,QAAQ,GAAG,UAAU;CAQ5C;AAMD,qBAAa,2BAA4B,SAAQ,qBAAqB;;CAQrE;AAMD,qBAAa,sBAAuB,SAAQ,mBAAmB;gBACjD,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAQ5C;AAMD,qBAAa,2BAA4B,SAAQ,iBAAiB;gBACpD,QAAQ,EAAE,MAAM;CAQ7B;AAMD,qBAAa,2BAA4B,SAAQ,iBAAiB;gBACpD,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM;CAUhD;AASD,qBAAa,yBAA0B,SAAQ,mBAAmB;gBAE9D,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,aAAa,CAAC,EAAE,MAAM,EACtB,UAAU,CAAC,EAAE,MAAM;CAYtB;AAMD,qBAAa,0BAA2B,SAAQ,qBAAqB;gBACvD,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAQ9C;AAOD,qBAAa,mCAAoC,SAAQ,qBAAqB;;CAQ7E"}

package/dist/exceptions/oauth.exceptions.js

@@ -1,7 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CannotUnlinkLastAuthMethodException = exports.InvalidOAuthTokenException = exports.OAuthMissingDataException = exports.EmailAlreadyExistsException = exports.OAuthAccountLinkedException = exports.OAuthProviderException = exports.OAuthStateMismatchException = void 0;
+exports.CannotUnlinkLastAuthMethodException = exports.InvalidOAuthTokenException = exports.OAuthMissingDataException = exports.EmailAlreadyExistsException = exports.OAuthAccountLinkedException = exports.OAuthProviderException = exports.OAuthStateMismatchException = exports.OAuthProviderNotConfiguredException = void 0;
 const common_1 = require("@nestjs/common");
+class OAuthProviderNotConfiguredException extends common_1.NotFoundException {
+    constructor(provider) {
+        super({
+            message: `${provider === 'google' ? 'Google' : 'Facebook'} sign-in is not configured.`,
+            code: 'OAUTH_PROVIDER_NOT_CONFIGURED',
+            provider,
+            statusCode: common_1.HttpStatus.NOT_FOUND,
+        });
+    }
+}
+exports.OAuthProviderNotConfiguredException = OAuthProviderNotConfiguredException;
 class OAuthStateMismatchException extends common_1.UnauthorizedException {
     constructor() {
         super({