@aranzatech/aranza-auth 0.1.2 → 0.2.0

package/dist/index.js

@@ -1,13 +1,36 @@
-import { __decorateClass, __decorateParam, AUTH_MODULE_OPTIONS, AUTH_REPOSITORY, AUTH_HOOKS, normalizeIdentifier, resolveRegisterIdentifier, readAccountIdentifier } from './chunk-JLRBMDLH.js';
-export { AUTH_HOOKS, AUTH_MODULE_OPTIONS, AUTH_REPOSITORY } from './chunk-JLRBMDLH.js';
+import { __decorateClass, __decorateParam, AUTH_MODULE_OPTIONS, AUTH_REPOSITORY, AUTH_HOOKS, normalizeIdentifier, resolveRegisterIdentifier, readAccountIdentifier } from './chunk-QNEFN5ES.js';
+export { AUTH_HOOKS, AUTH_MODULE_OPTIONS, AUTH_REPOSITORY } from './chunk-QNEFN5ES.js';
 import { createParamDecorator, UnauthorizedException, Injectable, Inject, Post, Body, HttpCode, HttpStatus, UseGuards, Get, Controller, Module, BadRequestException, NotFoundException } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 import { JwtService, JwtModule } from '@nestjs/jwt';
 import { AuthGuard, PassportStrategy, PassportModule } from '@nestjs/passport';
 import * as bcrypt2 from 'bcryptjs';
 import { createHash, randomBytes } from 'crypto';
 import { Strategy, ExtractJwt } from 'passport-jwt';
-import { IsEmail, IsOptional, IsString, Length, IsNotEmpty, Matches } from 'class-validator';
+import { IsString, IsNotEmpty, Length, IsEmail, IsOptional, ValidateIf, Matches } from 'class-validator';
 
+// src/constants/rate-limit.presets.ts
+var AUTH_RATE_LIMIT_PRESETS = {
+  /** General auth routes: 10 requests / minute / IP */
+  default: { name: "auth-default", ttl: 6e4, limit: 10 },
+  /** Login, register, refresh: 5 requests / minute / IP */
+  credentials: { name: "auth-credentials", ttl: 6e4, limit: 5 },
+  /** Forgot password: 3 requests / minute / IP */
+  passwordReset: { name: "auth-password-reset", ttl: 6e4, limit: 3 }
+};
+
+// src/constants/auth-errors.ts
+var AuthErrorCode = {
+  INVALID_CREDENTIALS: "Invalid credentials",
+  INVALID_REFRESH_TOKEN: "Invalid refresh token",
+  REFRESH_TOKEN_REUSE: "REFRESH_TOKEN_REUSE",
+  ACCOUNT_DISABLED: "ACCOUNT_DISABLED",
+  EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED",
+  TOKEN_INVALID_OR_EXPIRED: "TOKEN_INVALID_OR_EXPIRED",
+  ACCOUNT_LOCKED: "ACCOUNT_LOCKED",
+  INVALID_CURRENT_PASSWORD: "INVALID_CURRENT_PASSWORD",
+  PASSWORD_UNCHANGED: "PASSWORD_UNCHANGED"
+};
 var CurrentUser = createParamDecorator(
   (_data, ctx) => {
     const request = ctx.switchToHttp().getRequest();
@@ -25,6 +48,9 @@ var JwtAuthGuard = class extends AuthGuard("jwt") {
 JwtAuthGuard = __decorateClass([
   Injectable()
 ], JwtAuthGuard);
+
+// src/constants/password.constants.ts
+var DUMMY_PASSWORD_HASH = "$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy";
 var DefaultAuthHooks = class {
   async buildJwtPayload(account) {
     return {
@@ -39,7 +65,9 @@ var DefaultAuthHooks = class {
       email: account.email,
       username: account.username,
       emailVerified: account.emailVerified,
-      disabled: account.disabled
+      disabled: account.disabled,
+      ...account.lastLoginAt != null ? { lastLoginAt: account.lastLoginAt } : {},
+      ...account.passwordChangedAt != null ? { passwordChangedAt: account.passwordChangedAt } : {}
     };
   }
   async onBeforeRegister(_input) {
@@ -60,6 +88,14 @@ DefaultAuthHooks = __decorateClass([
 function isDuplicateKeyError(error) {
   return !!error && typeof error === "object" && "code" in error && error.code === 11e3;
 }
+var COMPLEXITY_PATTERN = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).+$/;
+function assertPasswordComplexity(password) {
+  if (!COMPLEXITY_PATTERN.test(password)) {
+    throw new BadRequestException(
+      "Password must contain at least one uppercase letter, one lowercase letter, and one digit"
+    );
+  }
+}
 function generateRawToken(byteLength = 32) {
   return randomBytes(byteLength).toString("hex");
 }
@@ -71,11 +107,15 @@ function expiresAtFromTtlMs(ttlMs) {
 }
 var DEFAULT_EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_PASSWORD_RESET_TTL_MS = 15 * 60 * 1e3;
+var JWT_ALGORITHM = "HS256";
 var TokenService = class {
   constructor(jwtService, options) {
     this.jwtService = jwtService;
     this.options = options;
   }
+  get bcryptRounds() {
+    return this.options.bcryptRounds ?? 10;
+  }
   async signTokens(payload) {
     const accessExpiresIn = this.options.expiresIn ?? "1h";
     const refreshExpiresIn = this.options.refreshExpiresIn ?? "7d";
@@ -84,14 +124,16 @@ var TokenService = class {
         payload,
         {
           secret: this.options.secret,
-          expiresIn: accessExpiresIn
+          expiresIn: accessExpiresIn,
+          algorithm: JWT_ALGORITHM
         }
       ),
       this.jwtService.signAsync(
         payload,
         {
           secret: this.options.refreshSecret,
-          expiresIn: refreshExpiresIn
+          expiresIn: refreshExpiresIn,
+          algorithm: JWT_ALGORITHM
         }
       )
     ]);
@@ -99,11 +141,12 @@ var TokenService = class {
   }
   async verifyRefreshToken(refreshToken) {
     return this.jwtService.verifyAsync(refreshToken, {
-      secret: this.options.refreshSecret
+      secret: this.options.refreshSecret,
+      algorithms: [JWT_ALGORITHM]
     });
   }
   async hashRefreshToken(refreshToken) {
-    return bcrypt2.hash(refreshToken, 10);
+    return bcrypt2.hash(refreshToken, this.bcryptRounds);
   }
   async compareRefreshToken(refreshToken, hash3) {
     return bcrypt2.compare(refreshToken, hash3);
@@ -135,6 +178,15 @@ var AuthService = class {
   get rotateRefreshToken() {
     return this.options.features?.refreshTokenRotation !== false;
   }
+  get bcryptRounds() {
+    return this.options.bcryptRounds ?? 10;
+  }
+  get accountLockoutEnabled() {
+    return this.options.features?.accountLockout === true;
+  }
+  get lockoutOptions() {
+    return this.options.lockout;
+  }
   resolveLoginIdentifier(dto) {
     const value = this.identifierField === "email" ? dto.email : dto.username;
     if (value == null || value.trim() === "") {
@@ -152,7 +204,8 @@ var AuthService = class {
     await this.hooks.onBeforeRegister?.(input);
     resolveRegisterIdentifier(input, this.identifierField);
     this.assertRegisterEmailWhenVerificationEnabled(input);
-    const passwordHash = await bcrypt2.hash(dto.password, 10);
+    this.assertPasswordPolicy(dto.password);
+    const passwordHash = await bcrypt2.hash(dto.password, this.bcryptRounds);
     try {
       const account = await this.authRepository.create({
         ...input,
@@ -165,7 +218,7 @@ var AuthService = class {
       }
     } catch (error) {
       if (isDuplicateKeyError(error)) {
-        throw new UnauthorizedException(`${this.identifierField} already exists`);
+        return { registered: true };
       }
       throw error;
     }
@@ -176,17 +229,22 @@ var AuthService = class {
     const account = await this.authRepository.findByIdentifierWithSecrets(
       identifier
     );
-    if (account?.passwordHash == null) {
-      throw new UnauthorizedException("Invalid credentials");
+    if (account != null) {
+      this.assertAccountNotLocked(account);
     }
-    this.assertAccountActive(account);
-    const passwordMatches = await bcrypt2.compare(
-      dto.password,
-      account.passwordHash
-    );
-    if (!passwordMatches) {
-      throw new UnauthorizedException("Invalid credentials");
+    const passwordHash = account?.passwordHash ?? DUMMY_PASSWORD_HASH;
+    const passwordMatches = await bcrypt2.compare(dto.password, passwordHash);
+    if (account?.passwordHash == null || !passwordMatches) {
+      if (account != null && this.accountLockoutEnabled) {
+        await this.authRepository.recordLoginFailure(
+          account.id,
+          this.lockoutOptions
+        );
+      }
+      throw new UnauthorizedException(AuthErrorCode.INVALID_CREDENTIALS);
     }
+    this.assertAccountActive(account);
+    await this.authRepository.recordLoginSuccess(account.id);
     return this.issueTokens(account);
   }
   async refresh(refreshToken) {
@@ -194,19 +252,25 @@ var AuthService = class {
     try {
       payload = await this.tokenService.verifyRefreshToken(refreshToken);
     } catch {
-      throw new UnauthorizedException("Invalid refresh token");
+      throw new UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);
     }
     const account = await this.authRepository.findByIdWithSecrets(payload.sub);
-    if (account?.refreshTokenHash == null) {
-      throw new UnauthorizedException("Invalid refresh token");
+    if (account == null) {
+      throw new UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);
     }
     this.assertAccountActive(account);
-    const tokenMatches = await this.tokenService.compareRefreshToken(
-      refreshToken,
-      account.refreshTokenHash
-    );
-    if (!tokenMatches) {
-      throw new UnauthorizedException("Invalid refresh token");
+    if (this.rotateRefreshToken) {
+      if (account.refreshTokenHash == null) {
+        throw new UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);
+      }
+      const tokenMatches = await this.tokenService.compareRefreshToken(
+        refreshToken,
+        account.refreshTokenHash
+      );
+      if (!tokenMatches) {
+        await this.authRepository.updateRefreshTokenHash(account.id, null);
+        throw new UnauthorizedException(AuthErrorCode.REFRESH_TOKEN_REUSE);
+      }
     }
     return this.issueTokens(account);
   }
@@ -229,7 +293,7 @@ var AuthService = class {
     const tokenHash = hashToken(token);
     const account = await this.authRepository.findByEmailVerificationTokenHash(tokenHash);
     if (account == null) {
-      throw new BadRequestException("TOKEN_INVALID_OR_EXPIRED");
+      throw new BadRequestException(AuthErrorCode.TOKEN_INVALID_OR_EXPIRED);
     }
     await this.authRepository.markEmailVerified(account.id);
     return { verified: true };
@@ -255,20 +319,55 @@ var AuthService = class {
     const tokenHash = hashToken(token);
     const account = await this.authRepository.findByResetTokenHash(tokenHash);
     if (account == null) {
-      throw new BadRequestException("TOKEN_INVALID_OR_EXPIRED");
+      throw new BadRequestException(AuthErrorCode.TOKEN_INVALID_OR_EXPIRED);
     }
-    const passwordHash = await bcrypt2.hash(newPassword, 10);
+    this.assertPasswordPolicy(newPassword);
+    const passwordHash = await bcrypt2.hash(newPassword, this.bcryptRounds);
     await this.authRepository.updatePasswordHash(account.id, passwordHash);
     await this.authRepository.clearResetToken(account.id);
     await this.authRepository.updateRefreshTokenHash(account.id, null);
     return { reset: true };
   }
+  async changePassword(authId, currentPassword, newPassword) {
+    const account = await this.authRepository.findByIdWithSecrets(authId);
+    if (account?.passwordHash == null) {
+      throw new UnauthorizedException(AuthErrorCode.INVALID_CURRENT_PASSWORD);
+    }
+    const currentMatches = await bcrypt2.compare(
+      currentPassword,
+      account.passwordHash
+    );
+    if (!currentMatches) {
+      throw new UnauthorizedException(AuthErrorCode.INVALID_CURRENT_PASSWORD);
+    }
+    if (currentPassword === newPassword) {
+      throw new BadRequestException(AuthErrorCode.PASSWORD_UNCHANGED);
+    }
+    this.assertPasswordPolicy(newPassword);
+    const passwordHash = await bcrypt2.hash(newPassword, this.bcryptRounds);
+    await this.authRepository.updatePasswordHash(account.id, passwordHash);
+    await this.authRepository.updateRefreshTokenHash(account.id, null);
+    return { changed: true };
+  }
+  assertAccountNotLocked(account) {
+    if (!this.accountLockoutEnabled || account.lockedUntil == null) {
+      return;
+    }
+    if (account.lockedUntil > /* @__PURE__ */ new Date()) {
+      throw new UnauthorizedException(AuthErrorCode.ACCOUNT_LOCKED);
+    }
+  }
   assertAccountActive(account) {
     if (account.disabled) {
-      throw new UnauthorizedException("ACCOUNT_DISABLED");
+      throw new UnauthorizedException(AuthErrorCode.ACCOUNT_DISABLED);
     }
     if (this.emailVerificationEnabled && !account.emailVerified) {
-      throw new UnauthorizedException("EMAIL_NOT_VERIFIED");
+      throw new UnauthorizedException(AuthErrorCode.EMAIL_NOT_VERIFIED);
+    }
+  }
+  assertPasswordPolicy(password) {
+    if (this.options.passwordComplexity === true) {
+      assertPasswordComplexity(password);
     }
   }
   async issueTokens(account) {
@@ -384,6 +483,13 @@ var AuthController = class {
   resetPassword(dto) {
     return this.authService.resetPassword(dto.token, dto.newPassword);
   }
+  changePassword(user, dto) {
+    return this.authService.changePassword(
+      user.sub,
+      dto.currentPassword,
+      dto.newPassword
+    );
+  }
 };
 __decorateClass([
   Post("register"),
@@ -424,17 +530,39 @@ __decorateClass([
   HttpCode(HttpStatus.OK),
   __decorateParam(0, Body())
 ], AuthController.prototype, "resetPassword", 1);
+__decorateClass([
+  Post("change-password"),
+  UseGuards(JwtAuthGuard),
+  HttpCode(HttpStatus.OK),
+  __decorateParam(0, CurrentUser()),
+  __decorateParam(1, Body())
+], AuthController.prototype, "changePassword", 1);
 AuthController = __decorateClass([
   Controller("auth"),
   __decorateParam(0, Inject(AuthService))
 ], AuthController);
+
+// src/controllers/auth.controller.factory.ts
+function createAuthController(routePrefix = "auth") {
+  let ConfiguredAuthController = class extends AuthController {
+  };
+  ConfiguredAuthController = __decorateClass([
+    Controller(routePrefix)
+  ], ConfiguredAuthController);
+  Object.defineProperty(ConfiguredAuthController, "name", {
+    value: `AuthController_${routePrefix.replace(/\W+/g, "_")}`
+  });
+  return ConfiguredAuthController;
+}
 var JwtStrategy = class extends PassportStrategy(Strategy) {
   constructor(options, authRepository) {
     super({
       jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
       ignoreExpiration: false,
-      secretOrKey: options.secret
+      secretOrKey: options.secret,
+      algorithms: ["HS256"]
     });
+    this.options = options;
     this.authRepository = authRepository;
   }
   async validate(payload) {
@@ -442,6 +570,9 @@ var JwtStrategy = class extends PassportStrategy(Strategy) {
     if (account == null || account.disabled) {
       throw new UnauthorizedException("Account not found or inactive");
     }
+    if (this.options.features?.emailVerification === true && !account.emailVerified) {
+      throw new UnauthorizedException(AuthErrorCode.EMAIL_NOT_VERIFIED);
+    }
     return payload;
   }
 };
@@ -451,27 +582,82 @@ JwtStrategy = __decorateClass([
   __decorateParam(1, Inject(AUTH_REPOSITORY))
 ], JwtStrategy);
 
+// src/utils/hooks-provider.util.ts
+function createHooksProvider(options) {
+  if (options.hooksProvider != null) {
+    return options.hooksProvider;
+  }
+  const HooksClass = options.hooks ?? DefaultAuthHooks;
+  return {
+    provide: AUTH_HOOKS,
+    useClass: HooksClass
+  };
+}
+
+// src/utils/validate-auth-config.util.ts
+var MIN_SECRET_LENGTH = 32;
+var MIN_BCRYPT_ROUNDS = 10;
+var MAX_BCRYPT_ROUNDS = 14;
+function validateAuthModuleOptions(options) {
+  if (options.secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(
+      `AuthModule: secret must be at least ${MIN_SECRET_LENGTH} characters`
+    );
+  }
+  if (options.refreshSecret.length < MIN_SECRET_LENGTH) {
+    throw new Error(
+      `AuthModule: refreshSecret must be at least ${MIN_SECRET_LENGTH} characters`
+    );
+  }
+  if (options.secret === options.refreshSecret) {
+    throw new Error(
+      "AuthModule: secret and refreshSecret must be different"
+    );
+  }
+  const rounds = options.bcryptRounds ?? MIN_BCRYPT_ROUNDS;
+  if (rounds < MIN_BCRYPT_ROUNDS || rounds > MAX_BCRYPT_ROUNDS) {
+    throw new Error(
+      `AuthModule: bcryptRounds must be between ${MIN_BCRYPT_ROUNDS} and ${MAX_BCRYPT_ROUNDS}`
+    );
+  }
+  if (options.emailVerificationTokenTtlMs != null && options.emailVerificationTokenTtlMs < 6e4) {
+    throw new Error(
+      "AuthModule: emailVerificationTokenTtlMs must be at least 60000 (1 minute)"
+    );
+  }
+  if (options.passwordResetTokenTtlMs != null && options.passwordResetTokenTtlMs < 6e4) {
+    throw new Error(
+      "AuthModule: passwordResetTokenTtlMs must be at least 60000 (1 minute)"
+    );
+  }
+}
+
 // src/auth.module.ts
-function createAuthProviders(options) {
+function createCoreProviders(options) {
+  validateAuthModuleOptions(options);
   return [
     {
       provide: AUTH_MODULE_OPTIONS,
       useValue: options
     },
-    {
-      provide: AUTH_HOOKS,
-      inject: [AUTH_MODULE_OPTIONS],
-      useFactory: (opts) => {
-        const HooksClass = opts.hooks ?? DefaultAuthHooks;
-        return new HooksClass();
-      }
-    },
+    createHooksProvider(options),
     AuthService,
     TokenService,
     JwtStrategy,
     JwtAuthGuard
   ];
 }
+function createAsyncHooksProvider(options) {
+  if (options.hooksProvider != null) {
+    return options.hooksProvider;
+  }
+  const HooksClass = options.hooks ?? DefaultAuthHooks;
+  return {
+    provide: AUTH_HOOKS,
+    inject: [ModuleRef],
+    useFactory: (moduleRef) => moduleRef.create(HooksClass)
+  };
+}
 function createAuthImports() {
   return [
     PassportModule.register({ defaultStrategy: "jwt" }),
@@ -479,7 +665,10 @@ function createAuthImports() {
       inject: [AUTH_MODULE_OPTIONS],
       useFactory: (opts) => ({
         secret: opts.secret,
-        signOptions: { expiresIn: opts.expiresIn ?? "1h" }
+        signOptions: {
+          expiresIn: opts.expiresIn ?? "1h",
+          algorithm: "HS256"
+        }
       })
     })
   ];
@@ -491,14 +680,33 @@ function mergeImports(userImports) {
   }
   return merged;
 }
+function createAsyncProviders(options) {
+  return [
+    {
+      provide: AUTH_MODULE_OPTIONS,
+      inject: options.inject ?? [],
+      useFactory: async (...args) => {
+        const config = await options.useFactory(...args);
+        validateAuthModuleOptions(config);
+        return config;
+      }
+    },
+    createAsyncHooksProvider(options),
+    AuthService,
+    TokenService,
+    JwtStrategy,
+    JwtAuthGuard
+  ];
+}
 var AuthModule = class {
   static forRoot(options) {
+    const routePrefix = options.routePrefix ?? "auth";
     return {
       module: AuthModule,
       global: true,
       imports: createAuthImports(),
-      controllers: [AuthController],
-      providers: createAuthProviders(options),
+      controllers: [createAuthController(routePrefix)],
+      providers: createCoreProviders(options),
       exports: [
         AUTH_MODULE_OPTIONS,
         AUTH_HOOKS,
@@ -511,30 +719,13 @@ var AuthModule = class {
     };
   }
   static forRootAsync(options) {
+    const routePrefix = options.routePrefix ?? "auth";
     return {
       module: AuthModule,
       global: true,
       imports: mergeImports(options.imports),
-      controllers: [AuthController],
-      providers: [
-        {
-          provide: AUTH_MODULE_OPTIONS,
-          inject: options.inject ?? [],
-          useFactory: options.useFactory
-        },
-        {
-          provide: AUTH_HOOKS,
-          inject: [AUTH_MODULE_OPTIONS],
-          useFactory: (opts) => {
-            const HooksClass = opts.hooks ?? DefaultAuthHooks;
-            return new HooksClass();
-          }
-        },
-        AuthService,
-        TokenService,
-        JwtStrategy,
-        JwtAuthGuard
-      ],
+      controllers: [createAuthController(routePrefix)],
+      providers: createAsyncProviders(options),
       exports: [
         AUTH_MODULE_OPTIONS,
         AUTH_HOOKS,
@@ -554,6 +745,17 @@ AuthModule = __decorateClass([
 // src/dto/auth-tokens.dto.ts
 var AuthTokensDto = class {
 };
+var ChangePasswordDto = class {
+};
+__decorateClass([
+  IsString(),
+  IsNotEmpty()
+], ChangePasswordDto.prototype, "currentPassword", 2);
+__decorateClass([
+  IsString(),
+  IsNotEmpty(),
+  Length(8, 128)
+], ChangePasswordDto.prototype, "newPassword", 2);
 var ForgotPasswordDto = class {
 };
 __decorateClass([
@@ -563,7 +765,8 @@ var LoginDto = class {
 };
 __decorateClass([
   IsOptional(),
-  IsString(),
+  ValidateIf((dto) => dto.email != null && dto.email.trim() !== ""),
+  IsEmail(),
   Length(3, 255)
 ], LoginDto.prototype, "email", 2);
 __decorateClass([
@@ -590,7 +793,8 @@ var RegisterDto = class {
 };
 __decorateClass([
   IsOptional(),
-  IsString(),
+  ValidateIf((dto) => dto.email != null && dto.email.trim() !== ""),
+  IsEmail(),
   Length(3, 255)
 ], RegisterDto.prototype, "email", 2);
 __decorateClass([
@@ -622,6 +826,6 @@ __decorateClass([
   IsNotEmpty()
 ], VerifyEmailDto.prototype, "token", 2);
 
-export { AuthModule, AuthService, AuthTokensDto, CurrentUser, DefaultAuthHooks, ForgotPasswordDto, JwtAuthGuard, LoginDto, RefreshTokenDto, RegisterAckDto, RegisterDto, ResetPasswordDto, TokenService, VerifyEmailDto };
+export { AUTH_RATE_LIMIT_PRESETS, AuthErrorCode, AuthModule, AuthService, AuthTokensDto, ChangePasswordDto, CurrentUser, DefaultAuthHooks, ForgotPasswordDto, JwtAuthGuard, LoginDto, RefreshTokenDto, RegisterAckDto, RegisterDto, ResetPasswordDto, TokenService, VerifyEmailDto };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map