@aranzatech/aranza-auth 0.1.0

package/dist/index.cjs

@@ -0,0 +1,681 @@
+'use strict';
+
+var common = require('@nestjs/common');
+var jwt = require('@nestjs/jwt');
+var passport = require('@nestjs/passport');
+var bcrypt = require('bcryptjs');
+var crypto = require('crypto');
+var passportJwt = require('passport-jwt');
+var classValidator = require('class-validator');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var bcrypt__namespace = /*#__PURE__*/_interopNamespace(bcrypt);
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var CurrentUser = common.createParamDecorator(
+  (_data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+  }
+);
+exports.JwtAuthGuard = class JwtAuthGuard extends passport.AuthGuard("jwt") {
+};
+exports.JwtAuthGuard = __decorateClass([
+  common.Injectable()
+], exports.JwtAuthGuard);
+
+// src/controllers/auth.controller.ts
+var AuthController = class {
+  constructor(authService) {
+    this.authService = authService;
+  }
+  register(dto) {
+    return this.authService.register(dto);
+  }
+  login(dto) {
+    return this.authService.login(dto);
+  }
+  refresh(dto) {
+    return this.authService.refresh(dto.refreshToken);
+  }
+  logout(user) {
+    return this.authService.logout(user.sub);
+  }
+  me(user) {
+    return this.authService.me(user.sub);
+  }
+  verifyEmail(dto) {
+    return this.authService.verifyEmail(dto.token);
+  }
+  forgotPassword(dto) {
+    return this.authService.forgotPassword(dto.email);
+  }
+  resetPassword(dto) {
+    return this.authService.resetPassword(dto.token, dto.newPassword);
+  }
+};
+__decorateClass([
+  common.Post("register"),
+  __decorateParam(0, common.Body())
+], AuthController.prototype, "register", 1);
+__decorateClass([
+  common.Post("login"),
+  __decorateParam(0, common.Body())
+], AuthController.prototype, "login", 1);
+__decorateClass([
+  common.Post("refresh"),
+  common.HttpCode(common.HttpStatus.OK),
+  __decorateParam(0, common.Body())
+], AuthController.prototype, "refresh", 1);
+__decorateClass([
+  common.Post("logout"),
+  common.UseGuards(exports.JwtAuthGuard),
+  common.HttpCode(common.HttpStatus.OK),
+  __decorateParam(0, CurrentUser())
+], AuthController.prototype, "logout", 1);
+__decorateClass([
+  common.Get("me"),
+  common.UseGuards(exports.JwtAuthGuard),
+  __decorateParam(0, CurrentUser())
+], AuthController.prototype, "me", 1);
+__decorateClass([
+  common.Post("verify-email"),
+  common.HttpCode(common.HttpStatus.OK),
+  __decorateParam(0, common.Body())
+], AuthController.prototype, "verifyEmail", 1);
+__decorateClass([
+  common.Post("forgot-password"),
+  common.HttpCode(common.HttpStatus.OK),
+  __decorateParam(0, common.Body())
+], AuthController.prototype, "forgotPassword", 1);
+__decorateClass([
+  common.Post("reset-password"),
+  common.HttpCode(common.HttpStatus.OK),
+  __decorateParam(0, common.Body())
+], AuthController.prototype, "resetPassword", 1);
+AuthController = __decorateClass([
+  common.Controller("auth")
+], AuthController);
+
+// src/constants/tokens.ts
+var AUTH_MODULE_OPTIONS = /* @__PURE__ */ Symbol("AUTH_MODULE_OPTIONS");
+var AUTH_HOOKS = /* @__PURE__ */ Symbol("AUTH_HOOKS");
+var AUTH_REPOSITORY = /* @__PURE__ */ Symbol("AUTH_REPOSITORY");
+exports.DefaultAuthHooks = class DefaultAuthHooks {
+  async buildJwtPayload(account) {
+    return {
+      sub: account.id,
+      ...account.email != null ? { email: account.email } : {},
+      ...account.username != null ? { username: account.username } : {}
+    };
+  }
+  async enrichMe(account) {
+    return {
+      id: account.id,
+      email: account.email,
+      username: account.username,
+      emailVerified: account.emailVerified,
+      disabled: account.disabled
+    };
+  }
+  async onBeforeRegister(_input) {
+    return;
+  }
+  async onAfterRegister(_account) {
+    return;
+  }
+  async onAfterLogin(_account) {
+    return;
+  }
+};
+exports.DefaultAuthHooks = __decorateClass([
+  common.Injectable()
+], exports.DefaultAuthHooks);
+
+// src/utils/duplicate-key.util.ts
+function isDuplicateKeyError(error) {
+  return !!error && typeof error === "object" && "code" in error && error.code === 11e3;
+}
+
+// src/utils/identifier.util.ts
+function normalizeIdentifier(value) {
+  return value.trim().toLowerCase();
+}
+function resolveRegisterIdentifier(input, field) {
+  const value = field === "email" ? input.email : input.username;
+  if (value == null || value.trim() === "") {
+    throw new Error(`Register input requires ${field}`);
+  }
+  return normalizeIdentifier(value);
+}
+function readAccountIdentifier(account, field) {
+  const value = field === "email" ? account.email : account.username;
+  return value != null ? normalizeIdentifier(value) : void 0;
+}
+function generateRawToken(byteLength = 32) {
+  return crypto.randomBytes(byteLength).toString("hex");
+}
+function hashToken(token) {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+function expiresAtFromTtlMs(ttlMs) {
+  return new Date(Date.now() + ttlMs);
+}
+var DEFAULT_EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_PASSWORD_RESET_TTL_MS = 15 * 60 * 1e3;
+
+// src/services/auth.service.ts
+exports.AuthService = class AuthService {
+  constructor(authRepository, options, hooks, tokenService) {
+    this.authRepository = authRepository;
+    this.options = options;
+    this.hooks = hooks;
+    this.tokenService = tokenService;
+  }
+  get identifierField() {
+    return this.options.identifierField ?? "email";
+  }
+  get emailVerificationEnabled() {
+    return this.options.features?.emailVerification === true;
+  }
+  get passwordResetEnabled() {
+    return this.options.features?.passwordReset === true;
+  }
+  get rotateRefreshToken() {
+    return this.options.features?.refreshTokenRotation !== false;
+  }
+  resolveLoginIdentifier(dto) {
+    const value = this.identifierField === "email" ? dto.email : dto.username;
+    if (value == null || value.trim() === "") {
+      throw new common.BadRequestException(
+        `${this.identifierField} is required for login`
+      );
+    }
+    return normalizeIdentifier(value);
+  }
+  async register(dto) {
+    this.assertEmailHookWhenVerificationEnabled();
+    const input = { password: dto.password };
+    if (dto.email != null) input.email = dto.email;
+    if (dto.username != null) input.username = dto.username;
+    await this.hooks.onBeforeRegister?.(input);
+    resolveRegisterIdentifier(input, this.identifierField);
+    this.assertRegisterEmailWhenVerificationEnabled(input);
+    const passwordHash = await bcrypt__namespace.hash(dto.password, 10);
+    try {
+      const account = await this.authRepository.create({
+        ...input,
+        passwordHash,
+        emailVerified: !this.emailVerificationEnabled
+      });
+      await this.hooks.onAfterRegister?.(account);
+      if (this.emailVerificationEnabled) {
+        await this.sendVerificationEmail(account);
+      }
+    } catch (error) {
+      if (isDuplicateKeyError(error)) {
+        throw new common.UnauthorizedException(`${this.identifierField} already exists`);
+      }
+      throw error;
+    }
+    return { registered: true };
+  }
+  async login(dto) {
+    const identifier = this.resolveLoginIdentifier(dto);
+    const account = await this.authRepository.findByIdentifierWithSecrets(
+      identifier
+    );
+    if (account?.passwordHash == null) {
+      throw new common.UnauthorizedException("Invalid credentials");
+    }
+    this.assertAccountActive(account);
+    const passwordMatches = await bcrypt__namespace.compare(
+      dto.password,
+      account.passwordHash
+    );
+    if (!passwordMatches) {
+      throw new common.UnauthorizedException("Invalid credentials");
+    }
+    return this.issueTokens(account);
+  }
+  async refresh(refreshToken) {
+    let payload;
+    try {
+      payload = await this.tokenService.verifyRefreshToken(refreshToken);
+    } catch {
+      throw new common.UnauthorizedException("Invalid refresh token");
+    }
+    const account = await this.authRepository.findByIdWithSecrets(payload.sub);
+    if (account?.refreshTokenHash == null) {
+      throw new common.UnauthorizedException("Invalid refresh token");
+    }
+    this.assertAccountActive(account);
+    const tokenMatches = await this.tokenService.compareRefreshToken(
+      refreshToken,
+      account.refreshTokenHash
+    );
+    if (!tokenMatches) {
+      throw new common.UnauthorizedException("Invalid refresh token");
+    }
+    return this.issueTokens(account);
+  }
+  async logout(authId) {
+    await this.authRepository.updateRefreshTokenHash(authId, null);
+    return { loggedOut: true };
+  }
+  async me(authId) {
+    const account = await this.authRepository.findById(authId);
+    if (account == null) {
+      throw new common.UnauthorizedException("Account not found");
+    }
+    if (this.hooks.enrichMe != null) {
+      return this.hooks.enrichMe(account);
+    }
+    return new exports.DefaultAuthHooks().enrichMe(account);
+  }
+  async verifyEmail(token) {
+    this.assertEmailVerificationEnabled();
+    const tokenHash = hashToken(token);
+    const account = await this.authRepository.findByEmailVerificationTokenHash(tokenHash);
+    if (account == null) {
+      throw new common.BadRequestException("TOKEN_INVALID_OR_EXPIRED");
+    }
+    await this.authRepository.markEmailVerified(account.id);
+    return { verified: true };
+  }
+  async forgotPassword(email) {
+    this.assertPasswordResetEnabled();
+    this.assertEmailHookWhenPasswordResetEnabled();
+    const normalizedEmail = normalizeIdentifier(email);
+    const account = await this.authRepository.findByEmail(normalizedEmail);
+    if (account != null) {
+      const rawToken = generateRawToken();
+      const tokenHash = hashToken(rawToken);
+      const expiresAt = expiresAtFromTtlMs(
+        this.options.passwordResetTokenTtlMs ?? DEFAULT_PASSWORD_RESET_TTL_MS
+      );
+      await this.authRepository.setResetToken(account.id, tokenHash, expiresAt);
+      await this.hooks.sendEmail("reset", normalizedEmail, rawToken);
+    }
+    return { sent: true };
+  }
+  async resetPassword(token, newPassword) {
+    this.assertPasswordResetEnabled();
+    const tokenHash = hashToken(token);
+    const account = await this.authRepository.findByResetTokenHash(tokenHash);
+    if (account == null) {
+      throw new common.BadRequestException("TOKEN_INVALID_OR_EXPIRED");
+    }
+    const passwordHash = await bcrypt__namespace.hash(newPassword, 10);
+    await this.authRepository.updatePasswordHash(account.id, passwordHash);
+    await this.authRepository.clearResetToken(account.id);
+    await this.authRepository.updateRefreshTokenHash(account.id, null);
+    return { reset: true };
+  }
+  assertAccountActive(account) {
+    if (account.disabled) {
+      throw new common.UnauthorizedException("ACCOUNT_DISABLED");
+    }
+    if (this.emailVerificationEnabled && !account.emailVerified) {
+      throw new common.UnauthorizedException("EMAIL_NOT_VERIFIED");
+    }
+  }
+  async issueTokens(account) {
+    const payload = await this.hooks.buildJwtPayload(account);
+    const tokens = await this.tokenService.signTokens({
+      ...payload,
+      sub: account.id
+    });
+    if (this.rotateRefreshToken) {
+      const refreshTokenHash = await this.tokenService.hashRefreshToken(
+        tokens.refreshToken
+      );
+      await this.authRepository.updateRefreshTokenHash(
+        account.id,
+        refreshTokenHash
+      );
+    }
+    await this.hooks.onAfterLogin?.(account);
+    return tokens;
+  }
+  async sendVerificationEmail(account) {
+    const email = this.resolveAccountEmail(account);
+    if (email == null) return;
+    const rawToken = generateRawToken();
+    const tokenHash = hashToken(rawToken);
+    const expiresAt = expiresAtFromTtlMs(
+      this.options.emailVerificationTokenTtlMs ?? DEFAULT_EMAIL_VERIFICATION_TTL_MS
+    );
+    await this.authRepository.setEmailVerificationToken(
+      account.id,
+      tokenHash,
+      expiresAt
+    );
+    await this.hooks.sendEmail("verify", email, rawToken);
+  }
+  resolveAccountEmail(account) {
+    if (account.email != null && account.email.trim() !== "") {
+      return normalizeIdentifier(account.email);
+    }
+    return null;
+  }
+  assertRegisterEmailWhenVerificationEnabled(input) {
+    if (!this.emailVerificationEnabled) return;
+    const email = this.identifierField === "email" ? resolveRegisterIdentifier(input, "email") : input.email != null ? normalizeIdentifier(input.email) : null;
+    if (email == null || email.trim() === "") {
+      throw new common.BadRequestException(
+        "email is required when emailVerification feature is enabled"
+      );
+    }
+  }
+  assertEmailHookWhenVerificationEnabled() {
+    if (this.emailVerificationEnabled && this.hooks.sendEmail == null) {
+      throw new common.BadRequestException(
+        "emailVerification is enabled but AuthHooks.sendEmail is not implemented"
+      );
+    }
+  }
+  assertEmailHookWhenPasswordResetEnabled() {
+    if (this.passwordResetEnabled && this.hooks.sendEmail == null) {
+      throw new common.BadRequestException(
+        "passwordReset is enabled but AuthHooks.sendEmail is not implemented"
+      );
+    }
+  }
+  assertEmailVerificationEnabled() {
+    if (!this.emailVerificationEnabled) {
+      throw new common.NotFoundException();
+    }
+  }
+  assertPasswordResetEnabled() {
+    if (!this.passwordResetEnabled) {
+      throw new common.NotFoundException();
+    }
+  }
+  getIdentifierForAccount(account) {
+    return readAccountIdentifier(account, this.identifierField);
+  }
+};
+exports.AuthService = __decorateClass([
+  common.Injectable(),
+  __decorateParam(0, common.Inject(AUTH_REPOSITORY)),
+  __decorateParam(1, common.Inject(AUTH_MODULE_OPTIONS)),
+  __decorateParam(2, common.Inject(AUTH_HOOKS))
+], exports.AuthService);
+exports.TokenService = class TokenService {
+  constructor(jwtService, options) {
+    this.jwtService = jwtService;
+    this.options = options;
+  }
+  async signTokens(payload) {
+    const accessExpiresIn = this.options.expiresIn ?? "1h";
+    const refreshExpiresIn = this.options.refreshExpiresIn ?? "7d";
+    const [accessToken, refreshToken] = await Promise.all([
+      this.jwtService.signAsync(
+        payload,
+        {
+          secret: this.options.secret,
+          expiresIn: accessExpiresIn
+        }
+      ),
+      this.jwtService.signAsync(
+        payload,
+        {
+          secret: this.options.refreshSecret,
+          expiresIn: refreshExpiresIn
+        }
+      )
+    ]);
+    return { accessToken, refreshToken };
+  }
+  async verifyRefreshToken(refreshToken) {
+    return this.jwtService.verifyAsync(refreshToken, {
+      secret: this.options.refreshSecret
+    });
+  }
+  async hashRefreshToken(refreshToken) {
+    return bcrypt__namespace.hash(refreshToken, 10);
+  }
+  async compareRefreshToken(refreshToken, hash3) {
+    return bcrypt__namespace.compare(refreshToken, hash3);
+  }
+};
+exports.TokenService = __decorateClass([
+  common.Injectable(),
+  __decorateParam(1, common.Inject(AUTH_MODULE_OPTIONS))
+], exports.TokenService);
+var JwtStrategy = class extends passport.PassportStrategy(passportJwt.Strategy) {
+  constructor(options, authRepository) {
+    super({
+      jwtFromRequest: passportJwt.ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: options.secret
+    });
+    this.authRepository = authRepository;
+  }
+  async validate(payload) {
+    const account = await this.authRepository.findById(payload.sub);
+    if (account == null || account.disabled) {
+      throw new common.UnauthorizedException("Account not found or inactive");
+    }
+    return payload;
+  }
+};
+JwtStrategy = __decorateClass([
+  common.Injectable(),
+  __decorateParam(0, common.Inject(AUTH_MODULE_OPTIONS)),
+  __decorateParam(1, common.Inject(AUTH_REPOSITORY))
+], JwtStrategy);
+
+// src/auth.module.ts
+function createAuthProviders(options) {
+  return [
+    {
+      provide: AUTH_MODULE_OPTIONS,
+      useValue: options
+    },
+    {
+      provide: AUTH_HOOKS,
+      inject: [AUTH_MODULE_OPTIONS],
+      useFactory: (opts) => {
+        const HooksClass = opts.hooks ?? exports.DefaultAuthHooks;
+        return new HooksClass();
+      }
+    },
+    exports.AuthService,
+    exports.TokenService,
+    JwtStrategy,
+    exports.JwtAuthGuard
+  ];
+}
+function createAuthImports() {
+  return [
+    passport.PassportModule.register({ defaultStrategy: "jwt" }),
+    jwt.JwtModule.registerAsync({
+      inject: [AUTH_MODULE_OPTIONS],
+      useFactory: (opts) => ({
+        secret: opts.secret,
+        signOptions: { expiresIn: opts.expiresIn ?? "1h" }
+      })
+    })
+  ];
+}
+function mergeImports(userImports) {
+  const merged = [...createAuthImports()];
+  if (userImports != null) {
+    merged.unshift(...userImports);
+  }
+  return merged;
+}
+exports.AuthModule = class AuthModule {
+  static forRoot(options) {
+    return {
+      module: exports.AuthModule,
+      global: true,
+      imports: createAuthImports(),
+      controllers: [AuthController],
+      providers: createAuthProviders(options),
+      exports: [
+        AUTH_MODULE_OPTIONS,
+        AUTH_HOOKS,
+        exports.AuthService,
+        exports.TokenService,
+        exports.JwtAuthGuard,
+        jwt.JwtModule,
+        passport.PassportModule
+      ]
+    };
+  }
+  static forRootAsync(options) {
+    return {
+      module: exports.AuthModule,
+      global: true,
+      imports: mergeImports(options.imports),
+      controllers: [AuthController],
+      providers: [
+        {
+          provide: AUTH_MODULE_OPTIONS,
+          inject: options.inject ?? [],
+          useFactory: options.useFactory
+        },
+        {
+          provide: AUTH_HOOKS,
+          inject: [AUTH_MODULE_OPTIONS],
+          useFactory: (opts) => {
+            const HooksClass = opts.hooks ?? exports.DefaultAuthHooks;
+            return new HooksClass();
+          }
+        },
+        exports.AuthService,
+        exports.TokenService,
+        JwtStrategy,
+        exports.JwtAuthGuard
+      ],
+      exports: [
+        AUTH_MODULE_OPTIONS,
+        AUTH_HOOKS,
+        exports.AuthService,
+        exports.TokenService,
+        exports.JwtAuthGuard,
+        jwt.JwtModule,
+        passport.PassportModule
+      ]
+    };
+  }
+};
+exports.AuthModule = __decorateClass([
+  common.Module({})
+], exports.AuthModule);
+
+// src/dto/auth-tokens.dto.ts
+var AuthTokensDto = class {
+};
+var ForgotPasswordDto = class {
+};
+__decorateClass([
+  classValidator.IsEmail()
+], ForgotPasswordDto.prototype, "email", 2);
+var LoginDto = class {
+};
+__decorateClass([
+  classValidator.IsOptional(),
+  classValidator.IsString(),
+  classValidator.Length(3, 255)
+], LoginDto.prototype, "email", 2);
+__decorateClass([
+  classValidator.IsOptional(),
+  classValidator.IsString(),
+  classValidator.Length(3, 50)
+], LoginDto.prototype, "username", 2);
+__decorateClass([
+  classValidator.IsString(),
+  classValidator.IsNotEmpty(),
+  classValidator.Length(8, 128)
+], LoginDto.prototype, "password", 2);
+var RefreshTokenDto = class {
+};
+__decorateClass([
+  classValidator.IsString(),
+  classValidator.IsNotEmpty()
+], RefreshTokenDto.prototype, "refreshToken", 2);
+
+// src/dto/register-ack.dto.ts
+var RegisterAckDto = class {
+};
+var RegisterDto = class {
+};
+__decorateClass([
+  classValidator.IsOptional(),
+  classValidator.IsString(),
+  classValidator.Length(3, 255)
+], RegisterDto.prototype, "email", 2);
+__decorateClass([
+  classValidator.IsOptional(),
+  classValidator.IsString(),
+  classValidator.Length(3, 50),
+  classValidator.Matches(/^[a-zA-Z0-9._-]+$/)
+], RegisterDto.prototype, "username", 2);
+__decorateClass([
+  classValidator.IsString(),
+  classValidator.IsNotEmpty(),
+  classValidator.Length(8, 128)
+], RegisterDto.prototype, "password", 2);
+var ResetPasswordDto = class {
+};
+__decorateClass([
+  classValidator.IsString(),
+  classValidator.IsNotEmpty()
+], ResetPasswordDto.prototype, "token", 2);
+__decorateClass([
+  classValidator.IsString(),
+  classValidator.IsNotEmpty(),
+  classValidator.Length(8, 128)
+], ResetPasswordDto.prototype, "newPassword", 2);
+var VerifyEmailDto = class {
+};
+__decorateClass([
+  classValidator.IsString(),
+  classValidator.IsNotEmpty()
+], VerifyEmailDto.prototype, "token", 2);
+
+exports.AUTH_HOOKS = AUTH_HOOKS;
+exports.AUTH_MODULE_OPTIONS = AUTH_MODULE_OPTIONS;
+exports.AUTH_REPOSITORY = AUTH_REPOSITORY;
+exports.AuthTokensDto = AuthTokensDto;
+exports.CurrentUser = CurrentUser;
+exports.ForgotPasswordDto = ForgotPasswordDto;
+exports.LoginDto = LoginDto;
+exports.RefreshTokenDto = RefreshTokenDto;
+exports.RegisterAckDto = RegisterAckDto;
+exports.RegisterDto = RegisterDto;
+exports.ResetPasswordDto = ResetPasswordDto;
+exports.VerifyEmailDto = VerifyEmailDto;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map