@aranzatech/aranza-auth 0.1.0

package/dist/index.js

@@ -0,0 +1,618 @@
+import { __decorateClass, __decorateParam, AUTH_REPOSITORY, AUTH_MODULE_OPTIONS, AUTH_HOOKS, normalizeIdentifier, resolveRegisterIdentifier, readAccountIdentifier } from './chunk-DKYNHXY2.js';
+export { AUTH_HOOKS, AUTH_MODULE_OPTIONS, AUTH_REPOSITORY } from './chunk-DKYNHXY2.js';
+import { createParamDecorator, Injectable, Post, Body, HttpCode, HttpStatus, UseGuards, Get, Controller, Inject, UnauthorizedException, Module, BadRequestException, NotFoundException } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { AuthGuard, PassportStrategy, PassportModule } from '@nestjs/passport';
+import * as bcrypt from 'bcryptjs';
+import { createHash, randomBytes } from 'crypto';
+import { Strategy, ExtractJwt } from 'passport-jwt';
+import { IsEmail, IsOptional, IsString, Length, IsNotEmpty, Matches } from 'class-validator';
+
+var CurrentUser = createParamDecorator(
+  (_data, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+  }
+);
+var JwtAuthGuard = class extends AuthGuard("jwt") {
+};
+JwtAuthGuard = __decorateClass([
+  Injectable()
+], JwtAuthGuard);
+
+// src/controllers/auth.controller.ts
+var AuthController = class {
+  constructor(authService) {
+    this.authService = authService;
+  }
+  register(dto) {
+    return this.authService.register(dto);
+  }
+  login(dto) {
+    return this.authService.login(dto);
+  }
+  refresh(dto) {
+    return this.authService.refresh(dto.refreshToken);
+  }
+  logout(user) {
+    return this.authService.logout(user.sub);
+  }
+  me(user) {
+    return this.authService.me(user.sub);
+  }
+  verifyEmail(dto) {
+    return this.authService.verifyEmail(dto.token);
+  }
+  forgotPassword(dto) {
+    return this.authService.forgotPassword(dto.email);
+  }
+  resetPassword(dto) {
+    return this.authService.resetPassword(dto.token, dto.newPassword);
+  }
+};
+__decorateClass([
+  Post("register"),
+  __decorateParam(0, Body())
+], AuthController.prototype, "register", 1);
+__decorateClass([
+  Post("login"),
+  __decorateParam(0, Body())
+], AuthController.prototype, "login", 1);
+__decorateClass([
+  Post("refresh"),
+  HttpCode(HttpStatus.OK),
+  __decorateParam(0, Body())
+], AuthController.prototype, "refresh", 1);
+__decorateClass([
+  Post("logout"),
+  UseGuards(JwtAuthGuard),
+  HttpCode(HttpStatus.OK),
+  __decorateParam(0, CurrentUser())
+], AuthController.prototype, "logout", 1);
+__decorateClass([
+  Get("me"),
+  UseGuards(JwtAuthGuard),
+  __decorateParam(0, CurrentUser())
+], AuthController.prototype, "me", 1);
+__decorateClass([
+  Post("verify-email"),
+  HttpCode(HttpStatus.OK),
+  __decorateParam(0, Body())
+], AuthController.prototype, "verifyEmail", 1);
+__decorateClass([
+  Post("forgot-password"),
+  HttpCode(HttpStatus.OK),
+  __decorateParam(0, Body())
+], AuthController.prototype, "forgotPassword", 1);
+__decorateClass([
+  Post("reset-password"),
+  HttpCode(HttpStatus.OK),
+  __decorateParam(0, Body())
+], AuthController.prototype, "resetPassword", 1);
+AuthController = __decorateClass([
+  Controller("auth")
+], AuthController);
+var DefaultAuthHooks = class {
+  async buildJwtPayload(account) {
+    return {
+      sub: account.id,
+      ...account.email != null ? { email: account.email } : {},
+      ...account.username != null ? { username: account.username } : {}
+    };
+  }
+  async enrichMe(account) {
+    return {
+      id: account.id,
+      email: account.email,
+      username: account.username,
+      emailVerified: account.emailVerified,
+      disabled: account.disabled
+    };
+  }
+  async onBeforeRegister(_input) {
+    return;
+  }
+  async onAfterRegister(_account) {
+    return;
+  }
+  async onAfterLogin(_account) {
+    return;
+  }
+};
+DefaultAuthHooks = __decorateClass([
+  Injectable()
+], DefaultAuthHooks);
+
+// src/utils/duplicate-key.util.ts
+function isDuplicateKeyError(error) {
+  return !!error && typeof error === "object" && "code" in error && error.code === 11e3;
+}
+function generateRawToken(byteLength = 32) {
+  return randomBytes(byteLength).toString("hex");
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function expiresAtFromTtlMs(ttlMs) {
+  return new Date(Date.now() + ttlMs);
+}
+var DEFAULT_EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1e3;
+var DEFAULT_PASSWORD_RESET_TTL_MS = 15 * 60 * 1e3;
+
+// src/services/auth.service.ts
+var AuthService = class {
+  constructor(authRepository, options, hooks, tokenService) {
+    this.authRepository = authRepository;
+    this.options = options;
+    this.hooks = hooks;
+    this.tokenService = tokenService;
+  }
+  get identifierField() {
+    return this.options.identifierField ?? "email";
+  }
+  get emailVerificationEnabled() {
+    return this.options.features?.emailVerification === true;
+  }
+  get passwordResetEnabled() {
+    return this.options.features?.passwordReset === true;
+  }
+  get rotateRefreshToken() {
+    return this.options.features?.refreshTokenRotation !== false;
+  }
+  resolveLoginIdentifier(dto) {
+    const value = this.identifierField === "email" ? dto.email : dto.username;
+    if (value == null || value.trim() === "") {
+      throw new BadRequestException(
+        `${this.identifierField} is required for login`
+      );
+    }
+    return normalizeIdentifier(value);
+  }
+  async register(dto) {
+    this.assertEmailHookWhenVerificationEnabled();
+    const input = { password: dto.password };
+    if (dto.email != null) input.email = dto.email;
+    if (dto.username != null) input.username = dto.username;
+    await this.hooks.onBeforeRegister?.(input);
+    resolveRegisterIdentifier(input, this.identifierField);
+    this.assertRegisterEmailWhenVerificationEnabled(input);
+    const passwordHash = await bcrypt.hash(dto.password, 10);
+    try {
+      const account = await this.authRepository.create({
+        ...input,
+        passwordHash,
+        emailVerified: !this.emailVerificationEnabled
+      });
+      await this.hooks.onAfterRegister?.(account);
+      if (this.emailVerificationEnabled) {
+        await this.sendVerificationEmail(account);
+      }
+    } catch (error) {
+      if (isDuplicateKeyError(error)) {
+        throw new UnauthorizedException(`${this.identifierField} already exists`);
+      }
+      throw error;
+    }
+    return { registered: true };
+  }
+  async login(dto) {
+    const identifier = this.resolveLoginIdentifier(dto);
+    const account = await this.authRepository.findByIdentifierWithSecrets(
+      identifier
+    );
+    if (account?.passwordHash == null) {
+      throw new UnauthorizedException("Invalid credentials");
+    }
+    this.assertAccountActive(account);
+    const passwordMatches = await bcrypt.compare(
+      dto.password,
+      account.passwordHash
+    );
+    if (!passwordMatches) {
+      throw new UnauthorizedException("Invalid credentials");
+    }
+    return this.issueTokens(account);
+  }
+  async refresh(refreshToken) {
+    let payload;
+    try {
+      payload = await this.tokenService.verifyRefreshToken(refreshToken);
+    } catch {
+      throw new UnauthorizedException("Invalid refresh token");
+    }
+    const account = await this.authRepository.findByIdWithSecrets(payload.sub);
+    if (account?.refreshTokenHash == null) {
+      throw new UnauthorizedException("Invalid refresh token");
+    }
+    this.assertAccountActive(account);
+    const tokenMatches = await this.tokenService.compareRefreshToken(
+      refreshToken,
+      account.refreshTokenHash
+    );
+    if (!tokenMatches) {
+      throw new UnauthorizedException("Invalid refresh token");
+    }
+    return this.issueTokens(account);
+  }
+  async logout(authId) {
+    await this.authRepository.updateRefreshTokenHash(authId, null);
+    return { loggedOut: true };
+  }
+  async me(authId) {
+    const account = await this.authRepository.findById(authId);
+    if (account == null) {
+      throw new UnauthorizedException("Account not found");
+    }
+    if (this.hooks.enrichMe != null) {
+      return this.hooks.enrichMe(account);
+    }
+    return new DefaultAuthHooks().enrichMe(account);
+  }
+  async verifyEmail(token) {
+    this.assertEmailVerificationEnabled();
+    const tokenHash = hashToken(token);
+    const account = await this.authRepository.findByEmailVerificationTokenHash(tokenHash);
+    if (account == null) {
+      throw new BadRequestException("TOKEN_INVALID_OR_EXPIRED");
+    }
+    await this.authRepository.markEmailVerified(account.id);
+    return { verified: true };
+  }
+  async forgotPassword(email) {
+    this.assertPasswordResetEnabled();
+    this.assertEmailHookWhenPasswordResetEnabled();
+    const normalizedEmail = normalizeIdentifier(email);
+    const account = await this.authRepository.findByEmail(normalizedEmail);
+    if (account != null) {
+      const rawToken = generateRawToken();
+      const tokenHash = hashToken(rawToken);
+      const expiresAt = expiresAtFromTtlMs(
+        this.options.passwordResetTokenTtlMs ?? DEFAULT_PASSWORD_RESET_TTL_MS
+      );
+      await this.authRepository.setResetToken(account.id, tokenHash, expiresAt);
+      await this.hooks.sendEmail("reset", normalizedEmail, rawToken);
+    }
+    return { sent: true };
+  }
+  async resetPassword(token, newPassword) {
+    this.assertPasswordResetEnabled();
+    const tokenHash = hashToken(token);
+    const account = await this.authRepository.findByResetTokenHash(tokenHash);
+    if (account == null) {
+      throw new BadRequestException("TOKEN_INVALID_OR_EXPIRED");
+    }
+    const passwordHash = await bcrypt.hash(newPassword, 10);
+    await this.authRepository.updatePasswordHash(account.id, passwordHash);
+    await this.authRepository.clearResetToken(account.id);
+    await this.authRepository.updateRefreshTokenHash(account.id, null);
+    return { reset: true };
+  }
+  assertAccountActive(account) {
+    if (account.disabled) {
+      throw new UnauthorizedException("ACCOUNT_DISABLED");
+    }
+    if (this.emailVerificationEnabled && !account.emailVerified) {
+      throw new UnauthorizedException("EMAIL_NOT_VERIFIED");
+    }
+  }
+  async issueTokens(account) {
+    const payload = await this.hooks.buildJwtPayload(account);
+    const tokens = await this.tokenService.signTokens({
+      ...payload,
+      sub: account.id
+    });
+    if (this.rotateRefreshToken) {
+      const refreshTokenHash = await this.tokenService.hashRefreshToken(
+        tokens.refreshToken
+      );
+      await this.authRepository.updateRefreshTokenHash(
+        account.id,
+        refreshTokenHash
+      );
+    }
+    await this.hooks.onAfterLogin?.(account);
+    return tokens;
+  }
+  async sendVerificationEmail(account) {
+    const email = this.resolveAccountEmail(account);
+    if (email == null) return;
+    const rawToken = generateRawToken();
+    const tokenHash = hashToken(rawToken);
+    const expiresAt = expiresAtFromTtlMs(
+      this.options.emailVerificationTokenTtlMs ?? DEFAULT_EMAIL_VERIFICATION_TTL_MS
+    );
+    await this.authRepository.setEmailVerificationToken(
+      account.id,
+      tokenHash,
+      expiresAt
+    );
+    await this.hooks.sendEmail("verify", email, rawToken);
+  }
+  resolveAccountEmail(account) {
+    if (account.email != null && account.email.trim() !== "") {
+      return normalizeIdentifier(account.email);
+    }
+    return null;
+  }
+  assertRegisterEmailWhenVerificationEnabled(input) {
+    if (!this.emailVerificationEnabled) return;
+    const email = this.identifierField === "email" ? resolveRegisterIdentifier(input, "email") : input.email != null ? normalizeIdentifier(input.email) : null;
+    if (email == null || email.trim() === "") {
+      throw new BadRequestException(
+        "email is required when emailVerification feature is enabled"
+      );
+    }
+  }
+  assertEmailHookWhenVerificationEnabled() {
+    if (this.emailVerificationEnabled && this.hooks.sendEmail == null) {
+      throw new BadRequestException(
+        "emailVerification is enabled but AuthHooks.sendEmail is not implemented"
+      );
+    }
+  }
+  assertEmailHookWhenPasswordResetEnabled() {
+    if (this.passwordResetEnabled && this.hooks.sendEmail == null) {
+      throw new BadRequestException(
+        "passwordReset is enabled but AuthHooks.sendEmail is not implemented"
+      );
+    }
+  }
+  assertEmailVerificationEnabled() {
+    if (!this.emailVerificationEnabled) {
+      throw new NotFoundException();
+    }
+  }
+  assertPasswordResetEnabled() {
+    if (!this.passwordResetEnabled) {
+      throw new NotFoundException();
+    }
+  }
+  getIdentifierForAccount(account) {
+    return readAccountIdentifier(account, this.identifierField);
+  }
+};
+AuthService = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(AUTH_REPOSITORY)),
+  __decorateParam(1, Inject(AUTH_MODULE_OPTIONS)),
+  __decorateParam(2, Inject(AUTH_HOOKS))
+], AuthService);
+var TokenService = class {
+  constructor(jwtService, options) {
+    this.jwtService = jwtService;
+    this.options = options;
+  }
+  async signTokens(payload) {
+    const accessExpiresIn = this.options.expiresIn ?? "1h";
+    const refreshExpiresIn = this.options.refreshExpiresIn ?? "7d";
+    const [accessToken, refreshToken] = await Promise.all([
+      this.jwtService.signAsync(
+        payload,
+        {
+          secret: this.options.secret,
+          expiresIn: accessExpiresIn
+        }
+      ),
+      this.jwtService.signAsync(
+        payload,
+        {
+          secret: this.options.refreshSecret,
+          expiresIn: refreshExpiresIn
+        }
+      )
+    ]);
+    return { accessToken, refreshToken };
+  }
+  async verifyRefreshToken(refreshToken) {
+    return this.jwtService.verifyAsync(refreshToken, {
+      secret: this.options.refreshSecret
+    });
+  }
+  async hashRefreshToken(refreshToken) {
+    return bcrypt.hash(refreshToken, 10);
+  }
+  async compareRefreshToken(refreshToken, hash3) {
+    return bcrypt.compare(refreshToken, hash3);
+  }
+};
+TokenService = __decorateClass([
+  Injectable(),
+  __decorateParam(1, Inject(AUTH_MODULE_OPTIONS))
+], TokenService);
+var JwtStrategy = class extends PassportStrategy(Strategy) {
+  constructor(options, authRepository) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: options.secret
+    });
+    this.authRepository = authRepository;
+  }
+  async validate(payload) {
+    const account = await this.authRepository.findById(payload.sub);
+    if (account == null || account.disabled) {
+      throw new UnauthorizedException("Account not found or inactive");
+    }
+    return payload;
+  }
+};
+JwtStrategy = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(AUTH_MODULE_OPTIONS)),
+  __decorateParam(1, Inject(AUTH_REPOSITORY))
+], JwtStrategy);
+
+// src/auth.module.ts
+function createAuthProviders(options) {
+  return [
+    {
+      provide: AUTH_MODULE_OPTIONS,
+      useValue: options
+    },
+    {
+      provide: AUTH_HOOKS,
+      inject: [AUTH_MODULE_OPTIONS],
+      useFactory: (opts) => {
+        const HooksClass = opts.hooks ?? DefaultAuthHooks;
+        return new HooksClass();
+      }
+    },
+    AuthService,
+    TokenService,
+    JwtStrategy,
+    JwtAuthGuard
+  ];
+}
+function createAuthImports() {
+  return [
+    PassportModule.register({ defaultStrategy: "jwt" }),
+    JwtModule.registerAsync({
+      inject: [AUTH_MODULE_OPTIONS],
+      useFactory: (opts) => ({
+        secret: opts.secret,
+        signOptions: { expiresIn: opts.expiresIn ?? "1h" }
+      })
+    })
+  ];
+}
+function mergeImports(userImports) {
+  const merged = [...createAuthImports()];
+  if (userImports != null) {
+    merged.unshift(...userImports);
+  }
+  return merged;
+}
+var AuthModule = class {
+  static forRoot(options) {
+    return {
+      module: AuthModule,
+      global: true,
+      imports: createAuthImports(),
+      controllers: [AuthController],
+      providers: createAuthProviders(options),
+      exports: [
+        AUTH_MODULE_OPTIONS,
+        AUTH_HOOKS,
+        AuthService,
+        TokenService,
+        JwtAuthGuard,
+        JwtModule,
+        PassportModule
+      ]
+    };
+  }
+  static forRootAsync(options) {
+    return {
+      module: AuthModule,
+      global: true,
+      imports: mergeImports(options.imports),
+      controllers: [AuthController],
+      providers: [
+        {
+          provide: AUTH_MODULE_OPTIONS,
+          inject: options.inject ?? [],
+          useFactory: options.useFactory
+        },
+        {
+          provide: AUTH_HOOKS,
+          inject: [AUTH_MODULE_OPTIONS],
+          useFactory: (opts) => {
+            const HooksClass = opts.hooks ?? DefaultAuthHooks;
+            return new HooksClass();
+          }
+        },
+        AuthService,
+        TokenService,
+        JwtStrategy,
+        JwtAuthGuard
+      ],
+      exports: [
+        AUTH_MODULE_OPTIONS,
+        AUTH_HOOKS,
+        AuthService,
+        TokenService,
+        JwtAuthGuard,
+        JwtModule,
+        PassportModule
+      ]
+    };
+  }
+};
+AuthModule = __decorateClass([
+  Module({})
+], AuthModule);
+
+// src/dto/auth-tokens.dto.ts
+var AuthTokensDto = class {
+};
+var ForgotPasswordDto = class {
+};
+__decorateClass([
+  IsEmail()
+], ForgotPasswordDto.prototype, "email", 2);
+var LoginDto = class {
+};
+__decorateClass([
+  IsOptional(),
+  IsString(),
+  Length(3, 255)
+], LoginDto.prototype, "email", 2);
+__decorateClass([
+  IsOptional(),
+  IsString(),
+  Length(3, 50)
+], LoginDto.prototype, "username", 2);
+__decorateClass([
+  IsString(),
+  IsNotEmpty(),
+  Length(8, 128)
+], LoginDto.prototype, "password", 2);
+var RefreshTokenDto = class {
+};
+__decorateClass([
+  IsString(),
+  IsNotEmpty()
+], RefreshTokenDto.prototype, "refreshToken", 2);
+
+// src/dto/register-ack.dto.ts
+var RegisterAckDto = class {
+};
+var RegisterDto = class {
+};
+__decorateClass([
+  IsOptional(),
+  IsString(),
+  Length(3, 255)
+], RegisterDto.prototype, "email", 2);
+__decorateClass([
+  IsOptional(),
+  IsString(),
+  Length(3, 50),
+  Matches(/^[a-zA-Z0-9._-]+$/)
+], RegisterDto.prototype, "username", 2);
+__decorateClass([
+  IsString(),
+  IsNotEmpty(),
+  Length(8, 128)
+], RegisterDto.prototype, "password", 2);
+var ResetPasswordDto = class {
+};
+__decorateClass([
+  IsString(),
+  IsNotEmpty()
+], ResetPasswordDto.prototype, "token", 2);
+__decorateClass([
+  IsString(),
+  IsNotEmpty(),
+  Length(8, 128)
+], ResetPasswordDto.prototype, "newPassword", 2);
+var VerifyEmailDto = class {
+};
+__decorateClass([
+  IsString(),
+  IsNotEmpty()
+], VerifyEmailDto.prototype, "token", 2);
+
+export { AuthModule, AuthService, AuthTokensDto, CurrentUser, DefaultAuthHooks, ForgotPasswordDto, JwtAuthGuard, LoginDto, RefreshTokenDto, RegisterAckDto, RegisterDto, ResetPasswordDto, TokenService, VerifyEmailDto };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map