@anarchitects/auth-nest 0.4.2 → 0.5.0

package/src/application/services/auth-engine.port.d.ts

@@ -0,0 +1,42 @@
+import { LoginRequestDTO, LoginResponseDTO, LogoutRequestDTO, RefreshTokenRequestDTO } from '@anarchitects/auth-ts/dtos';
+export type AuthEngineFlowName = 'password-sign-in' | 'passkey-sign-in' | 'social-sign-in' | 'sign-out-or-refresh';
+export type AuthEngineFlowSupport = {
+    flow: AuthEngineFlowName;
+    status: 'supported' | 'unsupported' | 'needs-config';
+    notes: string;
+};
+export type AuthEngineCapabilityReport = {
+    engine: 'legacy-jwt' | 'better-auth';
+    flows: AuthEngineFlowSupport[];
+};
+export type AuthPasskeySignInInput = {
+    autoFill?: boolean;
+    headers?: HeadersInit;
+};
+export type AuthSocialSignInInput = {
+    provider: 'github';
+    callbackURL: string;
+    errorCallbackURL?: string;
+    newUserCallbackURL?: string;
+    headers?: HeadersInit;
+};
+export type AuthSignOutOrRefreshInput = {
+    mode: 'refresh';
+    userId: string;
+    dto: RefreshTokenRequestDTO;
+} | {
+    mode: 'sign-out';
+    headers?: HeadersInit;
+};
+export declare abstract class AuthEnginePort {
+    abstract login(dto: LoginRequestDTO): Promise<LoginResponseDTO>;
+    abstract logout(dto: LogoutRequestDTO): Promise<{
+        success: boolean;
+    }>;
+    abstract refreshTokens(userId: string, dto: RefreshTokenRequestDTO): Promise<LoginResponseDTO>;
+    abstract describeCapabilities(): Promise<AuthEngineCapabilityReport>;
+    abstract passwordSignIn(dto: LoginRequestDTO): Promise<LoginResponseDTO>;
+    abstract passkeySignIn(input: AuthPasskeySignInInput): Promise<unknown>;
+    abstract socialSignIn(input: AuthSocialSignInInput): Promise<unknown>;
+    abstract signOutOrRefresh(input: AuthSignOutOrRefreshInput): Promise<unknown>;
+}

package/src/application/services/auth-engine.port.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthEnginePort = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+let AuthEnginePort = class AuthEnginePort {
+};
+exports.AuthEnginePort = AuthEnginePort;
+exports.AuthEnginePort = AuthEnginePort = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], AuthEnginePort);
+//# sourceMappingURL=auth-engine.port.js.map

package/src/application/services/auth-engine.port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-engine.port.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/application/services/auth-engine.port.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AA2CrC,IAAe,cAAc,GAA7B,MAAe,cAAc;CAanC,CAAA;AAbqB,wCAAc;yBAAd,cAAc;IADnC,IAAA,mBAAU,GAAE;GACS,cAAc,CAanC"}

package/src/application/services/auth-orchestration.service.d.ts

@@ -0,0 +1,41 @@
+import { ActivateUserRequestDTO, ChangePasswordRequestDTO, ForgotPasswordRequestDTO, LoginRequestDTO, LoginResponseDTO, LogoutRequestDTO, RefreshTokenRequestDTO, RegisterRequestDTO, RegisterResponseDTO, ResetPasswordRequestDTO, UpdateEmailRequestDTO, VerifyEmailRequestDTO } from '@anarchitects/auth-ts/dtos';
+import { PolicyRule, User } from '@anarchitects/auth-ts/models';
+import { AuthUserRepository } from '../../infrastructure-persistence/repositories/auth-user.repository';
+import { AuthEnginePort } from './auth-engine.port';
+import { AuthService } from './auth.service';
+import { HashService } from './hash.service';
+export declare class AuthOrchestrationService implements AuthService {
+    private readonly hashService;
+    private readonly authUserRepository;
+    private readonly authEnginePort;
+    constructor(hashService: HashService, authUserRepository: AuthUserRepository, authEnginePort: AuthEnginePort);
+    registerUser(dto: RegisterRequestDTO): Promise<RegisterResponseDTO>;
+    activateUser(dto: ActivateUserRequestDTO): Promise<{
+        success: boolean;
+    }>;
+    login(dto: LoginRequestDTO): Promise<LoginResponseDTO>;
+    logout(dto: LogoutRequestDTO): Promise<{
+        success: boolean;
+    }>;
+    changePassword(userId: string, dto: ChangePasswordRequestDTO): Promise<{
+        success: boolean;
+    }>;
+    forgotPassword(dto: ForgotPasswordRequestDTO): Promise<{
+        success: boolean;
+    }>;
+    resetPassword(dto: ResetPasswordRequestDTO): Promise<{
+        success: boolean;
+    }>;
+    verifyEmail(dto: VerifyEmailRequestDTO): Promise<{
+        success: boolean;
+    }>;
+    updateEmail(userId: string, dto: UpdateEmailRequestDTO): Promise<{
+        success: boolean;
+    }>;
+    refreshTokens(userId: string, dto: RefreshTokenRequestDTO): Promise<LoginResponseDTO>;
+    getLoggedInUserInfo(userId: string): Promise<{
+        user: User;
+        rbac: PolicyRule[];
+    }>;
+    private getValidatedPolicyRules;
+}

package/src/application/services/auth-orchestration.service.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthOrchestrationService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const auth_user_repository_1 = require("../../infrastructure-persistence/repositories/auth-user.repository");
+const auth_engine_port_1 = require("./auth-engine.port");
+const hash_service_1 = require("./hash.service");
+const persisted_policy_rule_1 = require("./persisted-policy-rule");
+let AuthOrchestrationService = class AuthOrchestrationService {
+    constructor(hashService, authUserRepository, authEnginePort) {
+        this.hashService = hashService;
+        this.authUserRepository = authUserRepository;
+        this.authEnginePort = authEnginePort;
+    }
+    async registerUser(dto) {
+        if (dto.password !== dto.confirmPassword) {
+            throw new common_1.BadRequestException('Passwords do not match');
+        }
+        const passwordHash = await this.hashService.hash(dto.password);
+        const token = crypto.randomUUID();
+        const { userName, email } = dto;
+        const user = {
+            email,
+            passwordHash,
+            isActive: false,
+            userName,
+            token,
+            roles: [
+                {
+                    name: 'user',
+                },
+            ],
+        };
+        await this.authUserRepository.create(user);
+        return { success: true };
+    }
+    async activateUser(dto) {
+        const { token } = dto;
+        const user = await this.authUserRepository.findOne(token);
+        await this.authUserRepository.update({
+            ...user,
+            isActive: true,
+            token: null,
+        });
+        return { success: true };
+    }
+    async login(dto) {
+        return this.authEnginePort.login(dto);
+    }
+    async logout(dto) {
+        return this.authEnginePort.logout(dto);
+    }
+    async changePassword(userId, dto) {
+        const { currentPassword, newPassword, confirmPassword } = dto;
+        if (newPassword !== confirmPassword) {
+            throw new common_1.BadRequestException('Passwords do not match');
+        }
+        const user = await this.authUserRepository.findOne({
+            where: { id: userId },
+        });
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        const isCurrentPasswordValid = await this.hashService.compare(currentPassword, user.passwordHash);
+        if (!isCurrentPasswordValid) {
+            throw new common_1.BadRequestException('Invalid current password');
+        }
+        user.passwordHash = await this.hashService.hash(newPassword);
+        await this.authUserRepository.update(user);
+        return { success: true };
+    }
+    async forgotPassword(dto) {
+        const { email } = dto;
+        const user = await this.authUserRepository.findOne({ where: { email } });
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        const token = crypto.randomUUID();
+        user.token = token;
+        await this.authUserRepository.update(user);
+        return { success: true };
+    }
+    async resetPassword(dto) {
+        const { token, password, confirmPassword } = dto;
+        if (password !== confirmPassword) {
+            throw new common_1.BadRequestException('Passwords do not match');
+        }
+        const user = await this.authUserRepository.findOne({ where: { token } });
+        if (!user) {
+            throw new common_1.BadRequestException('Invalid token');
+        }
+        user.passwordHash = await this.hashService.hash(password);
+        user.token = null;
+        await this.authUserRepository.update(user);
+        return { success: true };
+    }
+    async verifyEmail(dto) {
+        const { token } = dto;
+        const user = await this.authUserRepository.findOne({ where: { token } });
+        if (!user) {
+            throw new common_1.BadRequestException('Invalid token');
+        }
+        user.isActive = true;
+        user.token = null;
+        await this.authUserRepository.update(user);
+        return { success: true };
+    }
+    async updateEmail(userId, dto) {
+        const { newEmail, password } = dto;
+        const user = await this.authUserRepository.findOne({
+            where: { id: userId },
+        });
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        const isPasswordValid = password && (await this.hashService.compare(password, user.passwordHash));
+        if (!isPasswordValid) {
+            throw new common_1.BadRequestException('Invalid password');
+        }
+        user.email = newEmail;
+        await this.authUserRepository.update(user);
+        return { success: true };
+    }
+    async refreshTokens(userId, dto) {
+        return this.authEnginePort.refreshTokens(userId, dto);
+    }
+    async getLoggedInUserInfo(userId) {
+        const user = await this.authUserRepository.findOne({
+            where: { id: userId },
+            relations: ['roles', 'roles.permissions'],
+        });
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        const rbac = this.getValidatedPolicyRules(user);
+        return { user, rbac };
+    }
+    getValidatedPolicyRules(user) {
+        try {
+            const rbac = [];
+            user.roles?.forEach((role) => {
+                role.permissions?.forEach((permission) => {
+                    rbac.push((0, persisted_policy_rule_1.toValidatedPersistedPolicyRule)(permission));
+                });
+            });
+            return rbac;
+        }
+        catch (error) {
+            throw new common_1.InternalServerErrorException(`Malformed persisted policy rule payload: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+};
+exports.AuthOrchestrationService = AuthOrchestrationService;
+exports.AuthOrchestrationService = AuthOrchestrationService = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [hash_service_1.HashService,
+        auth_user_repository_1.AuthUserRepository,
+        auth_engine_port_1.AuthEnginePort])
+], AuthOrchestrationService);
+//# sourceMappingURL=auth-orchestration.service.js.map

package/src/application/services/auth-orchestration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-orchestration.service.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/application/services/auth-orchestration.service.ts"],"names":[],"mappings":";;;;AAeA,2CAIwB;AACxB,6GAAwG;AACxG,yDAAoD;AAEpD,iDAA6C;AAC7C,mEAAyE;AAGlE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,WAAwB,EACxB,kBAAsC,EACtC,cAA8B;QAF9B,gBAAW,GAAX,WAAW,CAAa;QACxB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,GAAuB;QACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAkB;YAC1B,KAAK;YACL,YAAY;YACZ,QAAQ,EAAE,KAAK;YACf,QAAQ;YACR,KAAK;YACL,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,MAAM;iBACL;aACV;SACF,CAAC;QACF,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAA2B;QAE3B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YACnC,GAAG,IAAI;YACP,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAoB;QAC9B,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,GAA6B;QAE7B,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC;QAC9D,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAC3D,eAAe,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,GAA6B;QAE7B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,GAA4B;QAE5B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC;QACjD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAA0B;QAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,GAA0B;QAE1B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,eAAe,GACnB,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;QACtB,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,GAA2B;QAE3B,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,SAAS,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAEO,uBAAuB,CAAC,IAAU;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,GAAiB,EAAE,CAAC;YAC9B,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC3B,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;oBACvC,IAAI,CAAC,IAAI,CAAC,IAAA,sDAA8B,EAAC,UAAU,CAAC,CAAC,CAAC;gBACxD,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qCAA4B,CACpC,4CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AArLY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;6CAGqB,0BAAW;QACJ,yCAAkB;QACtB,iCAAc;GAJtC,wBAAwB,CAqLpC"}

package/src/application/services/jwt-auth.service.d.ts

@@ -1,41 +1,11 @@
-import { ActivateUserRequestDTO, ChangePasswordRequestDTO, ForgotPasswordRequestDTO, LoginRequestDTO, LoginResponseDTO, LogoutRequestDTO, RefreshTokenRequestDTO, RegisterRequestDTO, RegisterResponseDTO, ResetPasswordRequestDTO, UpdateEmailRequestDTO, VerifyEmailRequestDTO } from '@anarchitects/auth-ts/dtos';
-import { PolicyRule, User } from '@anarchitects/auth-ts/models';
 import { JwtService } from '@nestjs/jwt';
 import { AuthUserRepository } from '../../infrastructure-persistence/repositories/auth-user.repository';
-import { AuthService } from './auth.service';
+import { AuthOrchestrationService } from './auth-orchestration.service';
 import { HashService } from './hash.service';
-export declare class JwtAuthService implements AuthService {
-    private readonly hashService;
-    private readonly authUserRepository;
-    private readonly jwtService;
+/**
+ * @deprecated Use `AuthService` for controller-facing auth operations.
+ * JWT engine access is now an internal wiring concern behind `AuthEnginePort`.
+ */
+export declare class JwtAuthService extends AuthOrchestrationService {
     constructor(hashService: HashService, authUserRepository: AuthUserRepository, jwtService: JwtService);
-    registerUser(dto: RegisterRequestDTO): Promise<RegisterResponseDTO>;
-    activateUser(dto: ActivateUserRequestDTO): Promise<{
-        success: boolean;
-    }>;
-    login(dto: LoginRequestDTO): Promise<LoginResponseDTO>;
-    logout(dto: LogoutRequestDTO): Promise<{
-        success: boolean;
-    }>;
-    changePassword(userId: string, dto: ChangePasswordRequestDTO): Promise<{
-        success: boolean;
-    }>;
-    forgotPassword(dto: ForgotPasswordRequestDTO): Promise<{
-        success: boolean;
-    }>;
-    resetPassword(dto: ResetPasswordRequestDTO): Promise<{
-        success: boolean;
-    }>;
-    verifyEmail(dto: VerifyEmailRequestDTO): Promise<{
-        success: boolean;
-    }>;
-    updateEmail(userId: string, dto: UpdateEmailRequestDTO): Promise<{
-        success: boolean;
-    }>;
-    refreshTokens(userId: string, dto: RefreshTokenRequestDTO): Promise<LoginResponseDTO>;
-    getLoggedInUserInfo(userId: string): Promise<{
-        user: User;
-        rbac: PolicyRule[];
-    }>;
-    private generateTokens;
 }

package/src/application/services/jwt-auth.service.js

@@ -4,210 +4,17 @@ exports.JwtAuthService = void 0;
 const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const jwt_1 = require("@nestjs/jwt");
+const legacy_jwt_auth_engine_adapter_1 = require("../../infrastructure-engine/legacy-jwt-auth-engine.adapter");
 const auth_user_repository_1 = require("../../infrastructure-persistence/repositories/auth-user.repository");
+const auth_orchestration_service_1 = require("./auth-orchestration.service");
 const hash_service_1 = require("./hash.service");
-let JwtAuthService = class JwtAuthService {
+/**
+ * @deprecated Use `AuthService` for controller-facing auth operations.
+ * JWT engine access is now an internal wiring concern behind `AuthEnginePort`.
+ */
+let JwtAuthService = class JwtAuthService extends auth_orchestration_service_1.AuthOrchestrationService {
     constructor(hashService, authUserRepository, jwtService) {
-        this.hashService = hashService;
-        this.authUserRepository = authUserRepository;
-        this.jwtService = jwtService;
-    }
-    async registerUser(dto) {
-        if (dto.password !== dto.confirmPassword) {
-            throw new common_1.BadRequestException('Passwords do not match');
-        }
-        const passwordHash = await this.hashService.hash(dto.password);
-        const token = crypto.randomUUID();
-        const { userName, email } = dto;
-        const user = {
-            email,
-            passwordHash,
-            isActive: false,
-            userName,
-            token,
-            roles: [
-                {
-                    name: 'user',
-                },
-            ],
-        };
-        await this.authUserRepository.create(user);
-        return { success: true };
-    }
-    async activateUser(dto) {
-        const { token } = dto;
-        const user = await this.authUserRepository.findOne(token);
-        await this.authUserRepository.update({
-            ...user,
-            isActive: true,
-            token: null,
-        });
-        return { success: true };
-    }
-    async login(dto) {
-        const { credential, password } = dto;
-        const user = await this.authUserRepository.findOne({
-            where: [{ email: credential }, { userName: credential }],
-        });
-        if (!user) {
-            throw new common_1.BadRequestException('Invalid credentials');
-        }
-        const isPasswordValid = await this.hashService.compare(password, user.passwordHash);
-        if (!isPasswordValid) {
-            throw new common_1.BadRequestException('Invalid credentials');
-        }
-        return this.generateTokens(user);
-    }
-    async logout(dto) {
-        const { accessToken, refreshToken } = dto;
-        if (!refreshToken) {
-            throw new common_1.BadRequestException('Refresh token is required');
-        }
-        const payload = await this.jwtService
-            .verifyAsync(refreshToken)
-            .catch(() => {
-            throw new common_1.BadRequestException('Invalid refresh token');
-        });
-        if (!payload?.sub) {
-            throw new common_1.BadRequestException('Invalid refresh token');
-        }
-        const user = await this.authUserRepository.findOne({
-            where: { id: payload.sub },
-        });
-        if (!user?.id) {
-            throw new common_1.BadRequestException('Invalid refresh token');
-        }
-        const tokenHashes = await Promise.all([accessToken, refreshToken]
-            .filter((token) => Boolean(token))
-            .map((token) => this.hashService.hash(token)));
-        await this.authUserRepository.invalidateTokens(tokenHashes, user.id);
-        return { success: true };
-    }
-    async changePassword(userId, dto) {
-        const { currentPassword, newPassword, confirmPassword } = dto;
-        if (newPassword !== confirmPassword) {
-            throw new common_1.BadRequestException('Passwords do not match');
-        }
-        const user = await this.authUserRepository.findOne({
-            where: { id: userId },
-        });
-        if (!user) {
-            throw new common_1.BadRequestException('User not found');
-        }
-        const isCurrentPasswordValid = await this.hashService.compare(currentPassword, user.passwordHash);
-        if (!isCurrentPasswordValid) {
-            throw new common_1.BadRequestException('Invalid current password');
-        }
-        user.passwordHash = await this.hashService.hash(newPassword);
-        await this.authUserRepository.update(user);
-        return { success: true };
-    }
-    async forgotPassword(dto) {
-        const { email } = dto;
-        const user = await this.authUserRepository.findOne({ where: { email } });
-        if (!user) {
-            throw new common_1.BadRequestException('User not found');
-        }
-        const token = crypto.randomUUID();
-        user.token = token;
-        await this.authUserRepository.update(user);
-        // Here you would typically send the token to the user's email
-        return { success: true };
-    }
-    async resetPassword(dto) {
-        const { token, password, confirmPassword } = dto;
-        if (password !== confirmPassword) {
-            throw new common_1.BadRequestException('Passwords do not match');
-        }
-        const user = await this.authUserRepository.findOne({ where: { token } });
-        if (!user) {
-            throw new common_1.BadRequestException('Invalid token');
-        }
-        user.passwordHash = await this.hashService.hash(password);
-        user.token = null;
-        await this.authUserRepository.update(user);
-        return { success: true };
-    }
-    async verifyEmail(dto) {
-        const { token } = dto;
-        const user = await this.authUserRepository.findOne({ where: { token } });
-        if (!user) {
-            throw new common_1.BadRequestException('Invalid token');
-        }
-        user.isActive = true;
-        user.token = null;
-        await this.authUserRepository.update(user);
-        return { success: true };
-    }
-    async updateEmail(userId, dto) {
-        const { newEmail, password } = dto;
-        const user = await this.authUserRepository.findOne({
-            where: { id: userId },
-        });
-        if (!user) {
-            throw new common_1.BadRequestException('User not found');
-        }
-        const isPasswordValid = password && (await this.hashService.compare(password, user.passwordHash));
-        if (!isPasswordValid) {
-            throw new common_1.BadRequestException('Invalid password');
-        }
-        user.email = newEmail;
-        await this.authUserRepository.update(user);
-        return { success: true };
-    }
-    async refreshTokens(userId, dto) {
-        const { refreshToken } = dto;
-        const payload = await this.jwtService
-            .verifyAsync(refreshToken)
-            .catch(() => {
-            throw new common_1.BadRequestException('Invalid refresh token');
-        });
-        if (!payload?.sub || payload.sub !== userId) {
-            throw new common_1.BadRequestException('Invalid refresh token');
-        }
-        const user = await this.authUserRepository.findOne({
-            where: { id: userId },
-        });
-        if (!user) {
-            throw new common_1.BadRequestException('User not found');
-        }
-        const isTokenInvalidated = await this.authUserRepository.isTokenInvalidated(await this.hashService.hash(refreshToken));
-        if (isTokenInvalidated) {
-            throw new common_1.BadRequestException('Refresh token has been invalidated');
-        }
-        return this.generateTokens(user);
-    }
-    async getLoggedInUserInfo(userId) {
-        const user = await this.authUserRepository.findOne({
-            where: { id: userId },
-            relations: ['roles', 'permissions'],
-        });
-        if (!user) {
-            throw new common_1.BadRequestException('User not found');
-        }
-        const rbac = [];
-        user.roles?.forEach((role) => {
-            role.permissions?.forEach((permission) => {
-                rbac.push({
-                    action: permission.action,
-                    subject: permission.subject,
-                    conditions: permission.conditions ?? undefined,
-                    fields: permission.fields ?? undefined,
-                    reason: permission.reason ?? undefined,
-                    inverted: permission.inverted ?? false,
-                });
-            });
-        });
-        return { user, rbac };
-    }
-    async generateTokens(user) {
-        const payload = {
-            sub: user.id,
-            roles: user.roles?.map((role) => role.name),
-        };
-        const accessToken = await this.jwtService.signAsync(payload);
-        const refreshToken = await this.jwtService.signAsync(payload);
-        return { accessToken, refreshToken };
+        super(hashService, authUserRepository, new legacy_jwt_auth_engine_adapter_1.LegacyJwtAuthEngineAdapter(hashService, authUserRepository, jwtService));
     }
 };
 exports.JwtAuthService = JwtAuthService;

package/src/application/services/jwt-auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth.service.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/application/services/jwt-auth.service.ts"],"names":[],"mappings":";;;;AAeA,2CAAiE;AACjE,qCAAyC;AACzC,6GAAwG;AAExG,iDAA6C;AAGtC,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,WAAwB,EACxB,kBAAsC,EACtC,UAAsB;QAFtB,gBAAW,GAAX,WAAW,CAAa;QACxB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,GAAuB;QACxC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,eAAe,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAkB;YAC1B,KAAK;YACL,YAAY;YACZ,QAAQ,EAAE,KAAK;YACf,QAAQ;YACR,KAAK;YACL,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,MAAM;iBACL;aACV;SACF,CAAC;QACF,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,GAA2B;QAE3B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC;YACnC,GAAG,IAAI;YACP,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAoB;QAC9B,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CACpD,QAAQ,EACR,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAqB;QAChC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;QAE1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU;aAClC,WAAW,CAAC,YAAY,CAAC;aACzB,KAAK,CAAC,GAAG,EAAE;YACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,CAAC,WAAW,EAAE,YAAY,CAAC;aACxB,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;aAClD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAChD,CAAC;QAEF,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAErE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,GAA6B;QAE7B,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC;QAC9D,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,sBAAsB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAC3D,eAAe,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,cAAc,CAClB,GAA6B;QAE7B,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,8DAA8D;QAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,aAAa,CACjB,GAA4B;QAE5B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC;QACjD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;YACjC,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,GAA0B;QAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,WAAW,CACf,MAAc,EACd,GAA0B;QAE1B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,eAAe,GACnB,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;QACtB,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,GAA2B;QAE3B,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU;aAClC,WAAW,CAAC,YAAY,CAAC;aACzB,KAAK,CAAC,GAAG,EAAE;YACV,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,4BAAmB,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,CACzE,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1C,CAAC;QAEF,IAAI,kBAAkB,EAAE,CAAC;YACvB,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,SAAS,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAiB,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE;gBACvC,IAAI,CAAC,IAAI,CAAC;oBACR,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,UAAU,EAAE,UAAU,CAAC,UAAU,IAAI,SAAS;oBAC9C,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;oBACtC,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;oBACtC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,KAAK;iBACvC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAU;QACrC,MAAM,OAAO,GAAG;YACd,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SAC5C,CAAC;QACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;CACF,CAAA;AA9PY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;6CAGqB,0BAAW;QACJ,yCAAkB;QAC1B,gBAAU;GAJ9B,cAAc,CA8P1B"}
+{"version":3,"file":"jwt-auth.service.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/application/services/jwt-auth.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA4C;AAC5C,qCAAyC;AACzC,+GAAwG;AACxG,6GAAwG;AACxG,6EAAwE;AACxE,iDAA6C;AAE7C;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,qDAAwB;IAC1D,YACE,WAAwB,EACxB,kBAAsC,EACtC,UAAsB;QAEtB,KAAK,CACH,WAAW,EACX,kBAAkB,EAClB,IAAI,2DAA0B,CAC5B,WAAW,EACX,kBAAkB,EAClB,UAAU,CACX,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AAhBY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;6CAGI,0BAAW;QACJ,yCAAkB;QAC1B,gBAAU;GAJb,cAAc,CAgB1B"}

package/src/application/services/persisted-policy-rule.d.ts

@@ -0,0 +1,2 @@
+import { Permission, PolicyRule } from '@anarchitects/auth-ts/models';
+export declare const toValidatedPersistedPolicyRule: (permission: Pick<Permission, "action" | "subject" | "conditions" | "fields" | "inverted" | "reason">) => PolicyRule;

package/src/application/services/persisted-policy-rule.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toValidatedPersistedPolicyRule = void 0;
+const dtos_1 = require("@anarchitects/auth-ts/dtos");
+const cloneConditions = (conditions) => {
+    if (!conditions) {
+        return undefined;
+    }
+    return JSON.parse(JSON.stringify(conditions));
+};
+const toValidatedPersistedPolicyRule = (permission) => (0, dtos_1.parsePolicyRuleDTO)({
+    action: permission.action,
+    subject: permission.subject,
+    conditions: cloneConditions(permission.conditions),
+    fields: permission.fields ?? undefined,
+    inverted: permission.inverted ?? false,
+    reason: permission.reason ?? undefined,
+});
+exports.toValidatedPersistedPolicyRule = toValidatedPersistedPolicyRule;
+//# sourceMappingURL=persisted-policy-rule.js.map

package/src/application/services/persisted-policy-rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persisted-policy-rule.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/application/services/persisted-policy-rule.ts"],"names":[],"mappings":";;;AAAA,qDAAgE;AAGhE,MAAM,eAAe,GAAG,CACtB,UAAsD,EACjB,EAAE;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAA4B,CAAC;AAC3E,CAAC,CAAC;AAEK,MAAM,8BAA8B,GAAG,CAC5C,UAGC,EACW,EAAE,CACd,IAAA,yBAAkB,EAAC;IACjB,MAAM,EAAE,UAAU,CAAC,MAAM;IACzB,OAAO,EAAE,UAAU,CAAC,OAAO;IAC3B,UAAU,EAAE,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC;IAClD,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;IACtC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,KAAK;IACtC,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;CACvC,CAAC,CAAC;AAbQ,QAAA,8BAA8B,kCAatC"}

package/src/application/services/policies.service.js

@@ -2,10 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PoliciesService = void 0;
 const tslib_1 = require("tslib");
-/* eslint-disable @typescript-eslint/no-explicit-any */
 const common_1 = require("@nestjs/common");
 const auth_user_repository_1 = require("../../infrastructure-persistence/repositories/auth-user.repository");
 const ability_factory_1 = require("../factories/ability.factory");
+const persisted_policy_rule_1 = require("./persisted-policy-rule");
 let PoliciesService = class PoliciesService {
     constructor(authUserRepository, abilityFactory) {
         this.authUserRepository = authUserRepository;
@@ -16,18 +16,15 @@ let PoliciesService = class PoliciesService {
             where: { id: authUser.id },
             relations: ['roles', 'roles.permissions'],
         });
-        const inject = (c) => !c ? undefined : JSON.parse(JSON.stringify(c));
         if (!user) {
             return [];
         }
-        return (user.roles ?? []).flatMap((role) => (role.permissions ?? []).map((permission) => ({
-            action: permission.action,
-            subject: permission.subject,
-            conditions: inject(permission.conditions),
-            fields: permission.fields ?? undefined,
-            inverted: permission.inverted ?? false,
-            reason: permission.reason ?? undefined,
-        })));
+        try {
+            return (user.roles ?? []).flatMap((role) => (role.permissions ?? []).map((permission) => (0, persisted_policy_rule_1.toValidatedPersistedPolicyRule)(permission)));
+        }
+        catch (error) {
+            throw new common_1.InternalServerErrorException(`Malformed persisted policy rule payload: ${error instanceof Error ? error.message : String(error)}`);
+        }
     }
     async buildAbilityForUser(authUser) {
         return this.abilityFactory.buildAbility(await this.rulesForUser(authUser));

package/src/application/services/policies.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.service.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/application/services/policies.service.ts"],"names":[],"mappings":";;;;AAAA,uDAAuD;AACvD,2CAA4C;AAC5C,6GAAwG;AAExG,kEAA0E;AAGnE,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,kBAAsC,EACtC,cAA8B;QAD9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,QAAc;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC1B,SAAS,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAO,EAAE,EAAE,CACzB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAa,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YACzC,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;YACtC,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI,KAAK;YACtC,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,SAAS;SACvC,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAc;QACtC,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF,CAAA;AA/BY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;6CAG4B,yCAAkB;QACtB,gCAAc;GAHtC,eAAe,CA+B3B"}
+{"version":3,"file":"policies.service.js","sourceRoot":"","sources":["../../../../../../../libs/auth/nest/src/application/services/policies.service.ts"],"names":[],"mappings":";;;;AAAA,2CAA0E;AAC1E,6GAAwG;AAExG,kEAA0E;AAC1E,mEAAyE;AAGlE,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,kBAAsC,EACtC,cAA8B;QAD9B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,QAAc;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC1B,SAAS,EAAE,CAAC,OAAO,EAAE,mBAAmB,CAAC;SAC1C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CACzC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,IAAA,sDAA8B,EAAC,UAAU,CAAC,CAC3C,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qCAA4B,CACpC,4CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,QAAc;QACtC,OAAO,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF,CAAA;AAjCY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;6CAG4B,yCAAkB;QACtB,gCAAc;GAHtC,eAAe,CAiC3B"}

package/src/application/services/resource-authorization.d.ts

@@ -0,0 +1,5 @@
+import { Action, Subject } from '@anarchitects/auth-ts/models';
+import { AppAbility } from '../factories/ability.factory';
+import { AuthorizableResource } from '../resource-authorization.types';
+export declare const toPolicySubject: <T extends AuthorizableResource>(subjectType: Subject, resource: T) => T & import("@casl/ability").ForcedSubject<Subject>;
+export declare const assertCanAccessResource: <T extends AuthorizableResource>(ability: AppAbility, action: Action, subjectType: Subject, resource: T, field?: string) => void;