@aranzatech/aranza-auth 0.1.2 → 0.2.0

package/CHANGELOG.md

@@ -6,6 +6,44 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-07-03
+
+Release de hardening y madurez — incluye fixes de seguridad (0.1.3), hardening profesional y features enterprise (sin OAuth/Prisma).
+
+### Added
+
+- **`POST /auth/change-password`**: cambio de contraseña autenticado (invalida refresh tokens).
+- **Hooks con Nest DI**: `useClass` + `ModuleRef.create()` en `forRootAsync`; `hooksProvider` personalizable.
+- **`routePrefix`**: ruta configurable del controller (`forRoot` y `forRootAsync.routePrefix`).
+- **Audit trail Mongo**: `lastLoginAt`, `passwordChangedAt`, `failedLoginAttempts`, `lockedUntil`.
+- **Account lockout** (`features.accountLockout`): bloqueo tras N intentos fallidos.
+- **Refresh theft detection**: refresh reutilizado revoca sesiones (`REFRESH_TOKEN_REUSE`).
+- **Validación al boot**: secrets ≥32 chars, access ≠ refresh, `bcryptRounds` 10–14.
+- **JWT estricto**: algoritmo `HS256` fijado en sign/verify y Passport strategy.
+- **`bcryptRounds`**, **`passwordComplexity`**, **`lockout`** configurables.
+- **`AuthErrorCode`**: códigos exportados (`ACCOUNT_LOCKED`, `REFRESH_TOKEN_REUSE`, etc.).
+- **`AUTH_RATE_LIMIT_PRESETS`**: presets para `@nestjs/throttler`.
+- **SECURITY.md** con tradeoffs y checklist de producción.
+- Índices Mongo en hashes de tokens y fechas de expiración.
+- CI: coverage gate + `npm audit`.
+- **GitHub Releases** automáticos al publicar tags.
+
+### Fixed
+
+- **Login timing attack**: siempre ejecuta `bcrypt.compare` (hash dummy si no hay cuenta).
+- **Register user enumeration**: duplicados responden `{ registered: true }`.
+- **`refreshTokenRotation: false`**: refresh valida solo JWT, sin exigir hash en DB.
+- **`JwtStrategy`**: rechaza tokens de cuentas no verificadas con `emailVerification` activo.
+- **`JwtAuthGuard`**: trata `user === false` de Passport como no autenticado (`401`).
+- **`resolveRegisterIdentifier`**: `BadRequestException` en lugar de `Error` genérico.
+
+### Changed
+
+- **Register/Login DTOs**: `@IsEmail()` cuando el campo email está presente.
+- Password hashing usa `bcryptRounds` configurable (default 10).
+- `DefaultAuthHooks.enrichMe` incluye `lastLoginAt` y `passwordChangedAt`.
+- Login registra éxito/fallo cuando `accountLockout` está activo.
+
 ## [0.1.2] - 2026-07-03
 
 ### Fixed
@@ -33,30 +71,15 @@ First public release.
 ### Added
 
 - **`AuthModule.forRoot` / `forRootAsync`** — módulo dinámico global con configuración JWT.
-- **Endpoints REST** bajo `/auth`:
-  - `POST /auth/register` — alta de cuenta
-  - `POST /auth/login` — login con access + refresh token
-  - `POST /auth/refresh` — renovación de tokens
-  - `POST /auth/logout` — invalidar refresh token (Bearer)
-  - `GET /auth/me` — usuario autenticado (Bearer)
-  - `POST /auth/verify-email` — verificación de email (opt-in)
-  - `POST /auth/forgot-password` — solicitar reset (opt-in)
-  - `POST /auth/reset-password` — nueva contraseña con token (opt-in)
-- **`AuthService`**, **`TokenService`**, **`JwtStrategy`**, **`JwtAuthGuard`**, decorador **`@CurrentUser()`**.
-- **Feature flags** (`features`) — todo desactivado por defecto, ideal para POCs:
-  - `emailVerification` — bloquea login hasta verificar email
-  - `passwordReset` — habilita forgot/reset password
-  - `refreshTokenRotation` — rota hash del refresh token en DB (default: `true`)
-- **`AuthHooks`** — extiende JWT payload, `/auth/me`, lifecycle y envío de emails.
-- **`DefaultAuthHooks`** — implementación mínima incluida.
-- **Adapter MongoDB** (`@aranzatech/aranza-auth/mongo`):
-  - `BaseAuthAccountSchema` — schema base extensible
-  - `MongoAuthRepository` — implementación de `IAuthRepository`
-  - `MongoAuthModule.forFeature()` — registro de schema + repository
-- Tokens de verificación/reset hasheados (SHA-256) con TTL configurable.
-- Build dual ESM/CJS con types (`tsup`), tests (`vitest`), CI GitHub Actions.
-
-[Unreleased]: https://github.com/aranzatech/aranza-auth/compare/v0.1.2...HEAD
+- **Endpoints REST** bajo `/auth`: register, login, refresh, logout, me, verify-email, forgot/reset password.
+- **`AuthService`**, **`TokenService`**, **`JwtStrategy`**, **`JwtAuthGuard`**, **`@CurrentUser()`**.
+- **Feature flags** (`features`): `emailVerification`, `passwordReset`, `refreshTokenRotation`.
+- **`AuthHooks`** y **`DefaultAuthHooks`**.
+- **Adapter MongoDB** (`@aranzatech/aranza-auth/mongo`).
+- Build dual ESM/CJS, tests (`vitest`), CI GitHub Actions.
+
+[Unreleased]: https://github.com/aranzatech/aranza-auth/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/aranzatech/aranza-auth/compare/v0.1.2...v0.2.0
 [0.1.2]: https://github.com/aranzatech/aranza-auth/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/aranzatech/aranza-auth/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/aranzatech/aranza-auth/releases/tag/v0.1.0

package/README.md

@@ -15,6 +15,8 @@ Ideal para reutilizar auth en todos tus proyectos AranzaTech: instalas, configur
 - [Feature flags](#feature-flags)
 - [Endpoints](#endpoints)
 - [Proteger rutas propias](#proteger-rutas-propias)
+- [Rate limiting (producción)](#rate-limiting-producción)
+- [Seguridad en producción](#seguridad-en-producción)
 - [Extender con AuthHooks](#extender-con-authhooks)
 - [Extender el schema MongoDB](#extender-el-schema-mongodb)
 - [Flujos opcionales (email y password)](#flujos-opcionales-email-y-password)
@@ -239,6 +241,9 @@ hooks: AppAuthHooks,  // debe implementar sendEmail
 | `POST` | `/auth/verify-email` | — | `emailVerification` | `{ token }` | `{ verified: true }` |
 | `POST` | `/auth/forgot-password` | — | `passwordReset` | `{ email }` | `{ sent: true }` |
 | `POST` | `/auth/reset-password` | — | `passwordReset` | `{ token, newPassword }` | `{ reset: true }` |
+| `POST` | `/auth/change-password` | Bearer | — | `{ currentPassword, newPassword }` | `{ changed: true }` |
+
+> Rutas usan `routePrefix` (default `auth`). Ej: `routePrefix: "v1/auth"` → `/v1/auth/login`.
 
 ### Errores comunes
 
@@ -247,9 +252,13 @@ hooks: AppAuthHooks,  // debe implementar sendEmail
 | `401` | `Invalid credentials` | Email/username o password incorrectos |
 | `401` | `EMAIL_NOT_VERIFIED` | Feature `emailVerification` activa y email sin verificar |
 | `401` | `ACCOUNT_DISABLED` | Cuenta desactivada |
+| `401` | `ACCOUNT_LOCKED` | Demasiados intentos fallidos (`features.accountLockout`) |
+| `401` | `REFRESH_TOKEN_REUSE` | Refresh reutilizado; sesiones revocadas |
+| `401` | `INVALID_CURRENT_PASSWORD` | Contraseña actual incorrecta en change-password |
 | `401` | `Invalid refresh token` | Refresh expirado, revocado o inválido |
 | `404` | — | Feature desactivada (endpoint no disponible) |
 | `400` | `TOKEN_INVALID_OR_EXPIRED` | Token de verify/reset inválido o expirado |
+| `400` | `PASSWORD_UNCHANGED` | Nueva contraseña igual a la actual |
 
 ---
 
@@ -285,6 +294,93 @@ También puedes registrar `JwtAuthGuard` como guard global:
 
 ---
 
+## Rate limiting (producción)
+
+La librería **no incluye** throttling interno — debes aplicarlo en tu app con `@nestjs/throttler`:
+
+```bash
+npm install @nestjs/throttler
+```
+
+```typescript
+import { ThrottlerModule, ThrottlerGuard } from "@nestjs/throttler";
+import { APP_GUARD } from "@nestjs/core";
+import { AUTH_RATE_LIMIT_PRESETS } from "@aranzatech/aranza-auth";
+
+@Module({
+  imports: [
+    ThrottlerModule.forRoot([
+      AUTH_RATE_LIMIT_PRESETS.default,
+      AUTH_RATE_LIMIT_PRESETS.credentials,
+      AUTH_RATE_LIMIT_PRESETS.passwordReset,
+    ]),
+    // ...
+  ],
+  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
+})
+export class AppModule {}
+```
+
+Presets exportados:
+
+| Preset | Uso recomendado | Límite |
+|--------|-----------------|--------|
+| `default` | Rutas auth generales | 10 req/min |
+| `credentials` | `/auth/login`, `/auth/register`, `/auth/refresh` | 5 req/min |
+| `passwordReset` | `/auth/forgot-password` | 3 req/min |
+
+> Aplica `@Throttle()` por controlador o ruta según tu política de seguridad.
+
+---
+
+## Seguridad en producción
+
+Desde **v0.2.0** la lib valida configuración al arrancar (secrets ≥32 chars, access ≠ refresh).
+
+### Opciones recomendadas
+
+```typescript
+AuthModule.forRootAsync({
+  useFactory: (config: ConfigService) => ({
+    secret: config.getOrThrow("JWT_SECRET"),
+    refreshSecret: config.getOrThrow("JWT_REFRESH_SECRET"),
+    expiresIn: "30m",           // access corto en prod
+    refreshExpiresIn: "7d",
+    bcryptRounds: 12,           // opcional, default 10
+    passwordComplexity: true,   // upper + lower + digit
+    features: {
+      emailVerification: true,
+      passwordReset: true,
+      refreshTokenRotation: true,
+    },
+  }),
+});
+```
+
+### Refresh tokens en cookies (recomendado)
+
+```typescript
+// En login/refresh handler de tu app — no devolver refresh en JSON body
+res.cookie("refreshToken", tokens.refreshToken, {
+  httpOnly: true,
+  secure: true,
+  sameSite: "strict",
+  maxAge: 7 * 24 * 60 * 60 * 1000,
+});
+```
+
+### Códigos de error
+
+```typescript
+import { AuthErrorCode } from "@aranzatech/aranza-auth";
+
+// AuthErrorCode.REFRESH_TOKEN_REUSE → posible robo de token; sesiones revocadas
+```
+
+Ver [SECURITY.md](./SECURITY.md) para tradeoffs (logout vs access JWT) y reporte de vulnerabilidades.
+
+---
+
 ## Extender con AuthHooks
 
 La lib maneja auth genérico. Tu dominio (org, roles, users) va en **hooks**:
@@ -426,7 +522,7 @@ Si usas `identifierField: "username"`, el register **debe incluir `email`** adem
 
 | Import | Contenido |
 |--------|-----------|
-| `@aranzatech/aranza-auth` | `AuthModule`, `AuthService`, guards, DTOs, interfaces, tokens |
+| `@aranzatech/aranza-auth` | `AuthModule`, `AuthService`, guards, DTOs, interfaces, tokens, `AUTH_RATE_LIMIT_PRESETS` |
 | `@aranzatech/aranza-auth/mongo` | `MongoAuthModule`, `MongoAuthRepository`, schemas |
 
 ### Tokens de inyección
@@ -447,27 +543,27 @@ import { AUTH_MODULE_OPTIONS, AUTH_HOOKS, AUTH_REPOSITORY } from "@aranzatech/ar
 - [ ] MongoDB conectado via `@nestjs/mongoose` (**mongoose@8** recomendado)
 - [ ] `MongoAuthModule.forFeature()` importado **dentro** de `AuthModule.forRootAsync({ imports })`
 - [ ] Secrets JWT distintos para access y refresh
+- [ ] **`@nestjs/throttler`** en rutas `/auth/*` (ver [Rate limiting](#rate-limiting-producción))
+- [ ] Access token TTL corto (15–60 min) en producción
 - [ ] Si usas features de email: implementar `AuthHooks.sendEmail`
 
 ---
 
-## Limitaciones conocidas (v0.1.0)
+## Limitaciones conocidas (v0.1.x)
 
 | Limitación | Workaround / versión futura |
 |------------|----------------------------|
-| Hooks se instancian con `new HooksClass()` sin DI de Nest | Registrar servicios manualmente o v0.2.0 con DI |
-| Ruta fija `/auth` (routePrefix en config aún no aplicado) | Usar global prefix de Nest o v0.2.0 |
-| Solo adapter MongoDB | Prisma en v0.3.0 |
-| Sin OAuth (Google, GitHub, etc.) | v0.2.0 |
-| Sin `change-password` autenticado | v0.2.0 |
+| Solo adapter MongoDB | Prisma en v0.4.0 |
+| Sin OAuth (Google, GitHub, etc.) | v0.3.0 |
 
 ---
 
 ## Roadmap
 
-- [ ] **0.2.0** — OAuth (Google, GitHub), `change-password`, hooks con DI
-- [ ] **0.3.0** — Adapter Prisma
-- [ ] **0.4.0** — Migración de AranzaFlow como caso de referencia
+- [x] **0.2.0** — Security hardening, `change-password`, hooks con DI, audit trail, account lockout, `routePrefix`
+- [ ] **0.3.0** — OAuth (Google, GitHub)
+- [ ] **0.4.0** — Adapter Prisma
+- [ ] **0.5.0** — Migración de AranzaFlow como caso de referencia
 
 ---
 

package/SECURITY.md

@@ -0,0 +1,58 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.2.x   | :white_check_mark: |
+| 0.1.x   | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+**Do not open public GitHub issues for security vulnerabilities.**
+
+Email: [security@aranzatech.com](mailto:security@aranzatech.com) (or open a private advisory on GitHub if enabled).
+
+We aim to respond within **72 hours** and publish a fix or mitigation within **14 days** for confirmed issues.
+
+## Security Model
+
+`@aranzatech/aranza-auth` provides authentication primitives. **Your host application** is responsible for:
+
+- HTTPS in production
+- Rate limiting (`AUTH_RATE_LIMIT_PRESETS` + `@nestjs/throttler`)
+- Secure storage of refresh tokens (prefer **httpOnly + Secure cookies** over `localStorage`)
+- JWT secrets in a secrets manager (not committed `.env` files)
+- Global `ValidationPipe({ whitelist: true, forbidNonWhitelisted: true })`
+
+## Known Tradeoffs
+
+| Behavior | Mitigation |
+|----------|------------|
+| **Logout** clears refresh token hash only; access JWT remains valid until expiry | Use short access TTL (15–60 min) |
+| **Register duplicate** returns `{ registered: true }` without revealing existence | By design (anti-enumeration) |
+| **Forgot password** always returns `{ sent: true }` | By design (anti-enumeration) |
+| **Refresh token reuse** revokes all refresh sessions for the account | Monitor `REFRESH_TOKEN_REUSE` errors |
+
+## Hardening Checklist (Production)
+
+- [ ] Secrets ≥ 32 characters; access ≠ refresh (validated at boot since v0.2.0)
+- [ ] `features.refreshTokenRotation: true`
+- [ ] `features.emailVerification: true` when using email login
+- [ ] Access token TTL ≤ 60 minutes
+- [ ] `@nestjs/throttler` on all `/auth/*` routes
+- [ ] `passwordComplexity: true` for user-facing apps
+- [ ] Log and alert on `REFRESH_TOKEN_REUSE` responses
+
+## Error Codes
+
+| Code | Meaning |
+|------|---------|
+| `REFRESH_TOKEN_REUSE` | Stale refresh token used — all refresh sessions revoked |
+| `ACCOUNT_LOCKED` | Too many failed login attempts |
+| `INVALID_CURRENT_PASSWORD` | Wrong password on change-password |
+| `EMAIL_NOT_VERIFIED` | Login or access blocked until email verified |
+| `ACCOUNT_DISABLED` | Account disabled by admin |
+| `TOKEN_INVALID_OR_EXPIRED` | Email verify or password reset token invalid |
+
+Export: `AuthErrorCode` from `@aranzatech/aranza-auth`.

package/dist/{auth-repository.interface-BMlJc-98.d.cts → auth-repository.interface-9PpDVOs8.d.cts}

@@ -1,9 +1,13 @@
+import * as _nestjs_common from '@nestjs/common';
+
 interface BaseAuthAccount {
     id: string;
     email?: string;
     username?: string;
     emailVerified: boolean;
     disabled: boolean;
+    lastLoginAt?: Date;
+    passwordChangedAt?: Date;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -11,6 +15,8 @@ interface BaseAuthAccount {
 interface AuthAccountWithSecrets extends BaseAuthAccount {
     passwordHash?: string;
     refreshTokenHash?: string | null;
+    failedLoginAttempts?: number;
+    lockedUntil?: Date | null;
 }
 interface RegisterInput {
     email?: string;
@@ -38,6 +44,14 @@ interface AuthFeatures {
     passwordReset?: boolean;
     /** Rotate refresh token hash on login/refresh. Default: `true`. */
     refreshTokenRotation?: boolean;
+    /** Lock account after repeated failed logins. Default: `false`. */
+    accountLockout?: boolean;
+}
+interface AuthLockoutOptions {
+    /** Max failed attempts before lockout. Default: `5`. */
+    maxAttempts?: number;
+    /** Lock duration in ms. Default: `15` minutes. */
+    lockoutDurationMs?: number;
 }
 interface AuthJwtConfig {
     secret: string;
@@ -56,10 +70,24 @@ interface AuthModuleOptions extends AuthJwtConfig {
     passwordResetTokenTtlMs?: number;
     /** Route prefix for auth controller. Default: `auth`. */
     routePrefix?: string;
-    /** Custom hooks class. Defaults to built-in minimal payload. */
+    /** bcrypt cost factor. Default: `10`. Range: 10–14. */
+    bcryptRounds?: number;
+    /** Require uppercase, lowercase, and digit on register/reset. Default: `false`. */
+    passwordComplexity?: boolean;
+    /** Lockout settings when `features.accountLockout` is enabled. */
+    lockout?: AuthLockoutOptions;
+    /** Custom hooks class (`useClass` — supports Nest DI). Defaults to `DefaultAuthHooks`. */
     hooks?: new (...args: any[]) => AuthHooks;
+    /** Full Nest provider for hooks. Takes precedence over `hooks`. */
+    hooksProvider?: _nestjs_common.Provider;
 }
 interface AuthModuleAsyncOptions {
+    /** Route prefix for auth controller. Default: `auth`. */
+    routePrefix?: string;
+    /** Custom hooks class (`useClass` with Nest DI via `ModuleRef`). */
+    hooks?: new (...args: any[]) => AuthHooks;
+    /** Full Nest provider for hooks. Takes precedence over `hooks`. */
+    hooksProvider?: _nestjs_common.Provider;
     imports?: unknown[];
     inject?: unknown[];
     useFactory: (...args: unknown[]) => AuthModuleOptions | Promise<AuthModuleOptions>;
@@ -85,6 +113,8 @@ interface IAuthRepository<TAccount extends BaseAuthAccount = BaseAuthAccount> {
     setResetToken(id: string, tokenHash: string, expiresAt: Date): Promise<void>;
     findByResetTokenHash(tokenHash: string): Promise<AuthAccountWithSecrets | null>;
     clearResetToken(id: string): Promise<void>;
+    recordLoginSuccess(id: string): Promise<void>;
+    recordLoginFailure(id: string, lockout?: AuthLockoutOptions): Promise<void>;
 }
 
-export type { AuthModuleOptions as A, BaseAuthAccount as B, CreateAccountData as C, IAuthRepository as I, RegisterInput as R, AuthModuleAsyncOptions as a, AuthHooks as b, AuthTokens as c, AuthAccountWithSecrets as d, AuthFeatures as e, AuthIdentifierField as f, AuthJwtConfig as g };
+export type { AuthModuleOptions as A, BaseAuthAccount as B, CreateAccountData as C, IAuthRepository as I, RegisterInput as R, AuthModuleAsyncOptions as a, AuthHooks as b, AuthTokens as c, AuthAccountWithSecrets as d, AuthFeatures as e, AuthIdentifierField as f, AuthJwtConfig as g, AuthLockoutOptions as h };

package/dist/{auth-repository.interface-BMlJc-98.d.ts → auth-repository.interface-9PpDVOs8.d.ts}

@@ -1,9 +1,13 @@
+import * as _nestjs_common from '@nestjs/common';
+
 interface BaseAuthAccount {
     id: string;
     email?: string;
     username?: string;
     emailVerified: boolean;
     disabled: boolean;
+    lastLoginAt?: Date;
+    passwordChangedAt?: Date;
     createdAt?: Date;
     updatedAt?: Date;
 }
@@ -11,6 +15,8 @@ interface BaseAuthAccount {
 interface AuthAccountWithSecrets extends BaseAuthAccount {
     passwordHash?: string;
     refreshTokenHash?: string | null;
+    failedLoginAttempts?: number;
+    lockedUntil?: Date | null;
 }
 interface RegisterInput {
     email?: string;
@@ -38,6 +44,14 @@ interface AuthFeatures {
     passwordReset?: boolean;
     /** Rotate refresh token hash on login/refresh. Default: `true`. */
     refreshTokenRotation?: boolean;
+    /** Lock account after repeated failed logins. Default: `false`. */
+    accountLockout?: boolean;
+}
+interface AuthLockoutOptions {
+    /** Max failed attempts before lockout. Default: `5`. */
+    maxAttempts?: number;
+    /** Lock duration in ms. Default: `15` minutes. */
+    lockoutDurationMs?: number;
 }
 interface AuthJwtConfig {
     secret: string;
@@ -56,10 +70,24 @@ interface AuthModuleOptions extends AuthJwtConfig {
     passwordResetTokenTtlMs?: number;
     /** Route prefix for auth controller. Default: `auth`. */
     routePrefix?: string;
-    /** Custom hooks class. Defaults to built-in minimal payload. */
+    /** bcrypt cost factor. Default: `10`. Range: 10–14. */
+    bcryptRounds?: number;
+    /** Require uppercase, lowercase, and digit on register/reset. Default: `false`. */
+    passwordComplexity?: boolean;
+    /** Lockout settings when `features.accountLockout` is enabled. */
+    lockout?: AuthLockoutOptions;
+    /** Custom hooks class (`useClass` — supports Nest DI). Defaults to `DefaultAuthHooks`. */
     hooks?: new (...args: any[]) => AuthHooks;
+    /** Full Nest provider for hooks. Takes precedence over `hooks`. */
+    hooksProvider?: _nestjs_common.Provider;
 }
 interface AuthModuleAsyncOptions {
+    /** Route prefix for auth controller. Default: `auth`. */
+    routePrefix?: string;
+    /** Custom hooks class (`useClass` with Nest DI via `ModuleRef`). */
+    hooks?: new (...args: any[]) => AuthHooks;
+    /** Full Nest provider for hooks. Takes precedence over `hooks`. */
+    hooksProvider?: _nestjs_common.Provider;
     imports?: unknown[];
     inject?: unknown[];
     useFactory: (...args: unknown[]) => AuthModuleOptions | Promise<AuthModuleOptions>;
@@ -85,6 +113,8 @@ interface IAuthRepository<TAccount extends BaseAuthAccount = BaseAuthAccount> {
     setResetToken(id: string, tokenHash: string, expiresAt: Date): Promise<void>;
     findByResetTokenHash(tokenHash: string): Promise<AuthAccountWithSecrets | null>;
     clearResetToken(id: string): Promise<void>;
+    recordLoginSuccess(id: string): Promise<void>;
+    recordLoginFailure(id: string, lockout?: AuthLockoutOptions): Promise<void>;
 }
 
-export type { AuthModuleOptions as A, BaseAuthAccount as B, CreateAccountData as C, IAuthRepository as I, RegisterInput as R, AuthModuleAsyncOptions as a, AuthHooks as b, AuthTokens as c, AuthAccountWithSecrets as d, AuthFeatures as e, AuthIdentifierField as f, AuthJwtConfig as g };
+export type { AuthModuleOptions as A, BaseAuthAccount as B, CreateAccountData as C, IAuthRepository as I, RegisterInput as R, AuthModuleAsyncOptions as a, AuthHooks as b, AuthTokens as c, AuthAccountWithSecrets as d, AuthFeatures as e, AuthIdentifierField as f, AuthJwtConfig as g, AuthLockoutOptions as h };

package/dist/{chunk-JLRBMDLH.js → chunk-QNEFN5ES.js}

@@ -1,3 +1,5 @@
+import { BadRequestException } from '@nestjs/common';
+
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __decorateClass = (decorators, target, key, kind) => {
@@ -14,15 +16,13 @@ var __decorateParam = (index, decorator) => (target, key) => decorator(target, k
 var AUTH_MODULE_OPTIONS = "AUTH_MODULE_OPTIONS";
 var AUTH_HOOKS = "AUTH_HOOKS";
 var AUTH_REPOSITORY = "AUTH_REPOSITORY";
-
-// src/utils/identifier.util.ts
 function normalizeIdentifier(value) {
   return value.trim().toLowerCase();
 }
 function resolveRegisterIdentifier(input, field) {
   const value = field === "email" ? input.email : input.username;
   if (value == null || value.trim() === "") {
-    throw new Error(`Register input requires ${field}`);
+    throw new BadRequestException(`Register input requires ${field}`);
   }
   return normalizeIdentifier(value);
 }
@@ -32,5 +32,5 @@ function readAccountIdentifier(account, field) {
 }
 
 export { AUTH_HOOKS, AUTH_MODULE_OPTIONS, AUTH_REPOSITORY, __decorateClass, __decorateParam, normalizeIdentifier, readAccountIdentifier, resolveRegisterIdentifier };
-//# sourceMappingURL=chunk-JLRBMDLH.js.map
-//# sourceMappingURL=chunk-JLRBMDLH.js.map
+//# sourceMappingURL=chunk-QNEFN5ES.js.map
+//# sourceMappingURL=chunk-QNEFN5ES.js.map

package/dist/chunk-QNEFN5ES.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/constants/tokens.ts","../src/utils/identifier.util.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACO,IAAM,mBAAA,GAAsB;AAC5B,IAAM,UAAA,GAAa;AACnB,IAAM,eAAA,GAAkB;ACExB,SAAS,oBAAoB,KAAA,EAAuB;AACzD,EAAA,OAAO,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAClC;AAEO,SAAS,yBAAA,CACd,OACA,KAAA,EACQ;AACR,EAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,OAAA,GAAU,KAAA,CAAM,QAAQ,KAAA,CAAM,QAAA;AACtD,EAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxC,IAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,wBAAA,EAA2B,KAAK,CAAA,CAAE,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,oBAAoB,KAAK,CAAA;AAClC;AAEO,SAAS,qBAAA,CACd,SACA,KAAA,EACoB;AACpB,EAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,OAAA,GAAU,OAAA,CAAQ,QAAQ,OAAA,CAAQ,QAAA;AAC1D,EAAA,OAAO,KAAA,IAAS,IAAA,GAAO,mBAAA,CAAoB,KAAK,CAAA,GAAI,MAAA;AACtD","file":"chunk-QNEFN5ES.js","sourcesContent":["/** String tokens — stable across tsup entry points (index + mongo). */\nexport const AUTH_MODULE_OPTIONS = \"AUTH_MODULE_OPTIONS\";\nexport const AUTH_HOOKS = \"AUTH_HOOKS\";\nexport const AUTH_REPOSITORY = \"AUTH_REPOSITORY\";\n","import { BadRequestException } from \"@nestjs/common\";\n\nimport type { AuthIdentifierField } from \"../interfaces/auth-config.interface\";\nimport type { BaseAuthAccount, RegisterInput } from \"../interfaces/auth-hooks.interface\";\n\nexport function normalizeIdentifier(value: string): string {\n  return value.trim().toLowerCase();\n}\n\nexport function resolveRegisterIdentifier(\n  input: RegisterInput,\n  field: AuthIdentifierField,\n): string {\n  const value = field === \"email\" ? input.email : input.username;\n  if (value == null || value.trim() === \"\") {\n    throw new BadRequestException(`Register input requires ${field}`);\n  }\n  return normalizeIdentifier(value);\n}\n\nexport function readAccountIdentifier(\n  account: BaseAuthAccount,\n  field: AuthIdentifierField,\n): string | undefined {\n  const value = field === \"email\" ? account.email : account.username;\n  return value != null ? normalizeIdentifier(value) : undefined;\n}\n"]}