@aranzatech/aranza-auth 0.1.2 → 0.2.1

package/dist/index.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var common = require('@nestjs/common');
+var core = require('@nestjs/core');
 var jwt = require('@nestjs/jwt');
 var passport = require('@nestjs/passport');
 var bcrypt2 = require('bcryptjs');
@@ -39,6 +40,29 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+
+// src/constants/rate-limit.presets.ts
+var AUTH_RATE_LIMIT_PRESETS = {
+  /** General auth routes: 10 requests / minute / IP */
+  default: { name: "auth-default", ttl: 6e4, limit: 10 },
+  /** Login, register, refresh: 5 requests / minute / IP */
+  credentials: { name: "auth-credentials", ttl: 6e4, limit: 5 },
+  /** Forgot password: 3 requests / minute / IP */
+  passwordReset: { name: "auth-password-reset", ttl: 6e4, limit: 3 }
+};
+
+// src/constants/auth-errors.ts
+var AuthErrorCode = {
+  INVALID_CREDENTIALS: "Invalid credentials",
+  INVALID_REFRESH_TOKEN: "Invalid refresh token",
+  REFRESH_TOKEN_REUSE: "REFRESH_TOKEN_REUSE",
+  ACCOUNT_DISABLED: "ACCOUNT_DISABLED",
+  EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED",
+  TOKEN_INVALID_OR_EXPIRED: "TOKEN_INVALID_OR_EXPIRED",
+  ACCOUNT_LOCKED: "ACCOUNT_LOCKED",
+  INVALID_CURRENT_PASSWORD: "INVALID_CURRENT_PASSWORD",
+  PASSWORD_UNCHANGED: "PASSWORD_UNCHANGED"
+};
 var CurrentUser = common.createParamDecorator(
   (_data, ctx) => {
     const request = ctx.switchToHttp().getRequest();
@@ -61,6 +85,9 @@ exports.JwtAuthGuard = __decorateClass([
 var AUTH_MODULE_OPTIONS = "AUTH_MODULE_OPTIONS";
 var AUTH_HOOKS = "AUTH_HOOKS";
 var AUTH_REPOSITORY = "AUTH_REPOSITORY";
+
+// src/constants/password.constants.ts
+var DUMMY_PASSWORD_HASH = "$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy";
 exports.DefaultAuthHooks = class DefaultAuthHooks {
   async buildJwtPayload(account) {
     return {
@@ -75,7 +102,9 @@ exports.DefaultAuthHooks = class DefaultAuthHooks {
       email: account.email,
       username: account.username,
       emailVerified: account.emailVerified,
-      disabled: account.disabled
+      disabled: account.disabled,
+      ...account.lastLoginAt != null ? { lastLoginAt: account.lastLoginAt } : {},
+      ...account.passwordChangedAt != null ? { passwordChangedAt: account.passwordChangedAt } : {}
     };
   }
   async onBeforeRegister(_input) {
@@ -96,15 +125,21 @@ exports.DefaultAuthHooks = __decorateClass([
 function isDuplicateKeyError(error) {
   return !!error && typeof error === "object" && "code" in error && error.code === 11e3;
 }
-
-// src/utils/identifier.util.ts
+var COMPLEXITY_PATTERN = /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).+$/;
+function assertPasswordComplexity(password) {
+  if (!COMPLEXITY_PATTERN.test(password)) {
+    throw new common.BadRequestException(
+      "Password must contain at least one uppercase letter, one lowercase letter, and one digit"
+    );
+  }
+}
 function normalizeIdentifier(value) {
   return value.trim().toLowerCase();
 }
 function resolveRegisterIdentifier(input, field) {
   const value = field === "email" ? input.email : input.username;
   if (value == null || value.trim() === "") {
-    throw new Error(`Register input requires ${field}`);
+    throw new common.BadRequestException(`Register input requires ${field}`);
   }
   return normalizeIdentifier(value);
 }
@@ -123,11 +158,15 @@ function expiresAtFromTtlMs(ttlMs) {
 }
 var DEFAULT_EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_PASSWORD_RESET_TTL_MS = 15 * 60 * 1e3;
+var JWT_ALGORITHM = "HS256";
 exports.TokenService = class TokenService {
   constructor(jwtService, options) {
     this.jwtService = jwtService;
     this.options = options;
   }
+  get bcryptRounds() {
+    return this.options.bcryptRounds ?? 10;
+  }
   async signTokens(payload) {
     const accessExpiresIn = this.options.expiresIn ?? "1h";
     const refreshExpiresIn = this.options.refreshExpiresIn ?? "7d";
@@ -136,14 +175,16 @@ exports.TokenService = class TokenService {
         payload,
         {
           secret: this.options.secret,
-          expiresIn: accessExpiresIn
+          expiresIn: accessExpiresIn,
+          algorithm: JWT_ALGORITHM
         }
       ),
       this.jwtService.signAsync(
         payload,
         {
           secret: this.options.refreshSecret,
-          expiresIn: refreshExpiresIn
+          expiresIn: refreshExpiresIn,
+          algorithm: JWT_ALGORITHM
         }
       )
     ]);
@@ -151,11 +192,12 @@ exports.TokenService = class TokenService {
   }
   async verifyRefreshToken(refreshToken) {
     return this.jwtService.verifyAsync(refreshToken, {
-      secret: this.options.refreshSecret
+      secret: this.options.refreshSecret,
+      algorithms: [JWT_ALGORITHM]
     });
   }
   async hashRefreshToken(refreshToken) {
-    return bcrypt2__namespace.hash(refreshToken, 10);
+    return bcrypt2__namespace.hash(refreshToken, this.bcryptRounds);
   }
   async compareRefreshToken(refreshToken, hash3) {
     return bcrypt2__namespace.compare(refreshToken, hash3);
@@ -187,6 +229,15 @@ exports.AuthService = class AuthService {
   get rotateRefreshToken() {
     return this.options.features?.refreshTokenRotation !== false;
   }
+  get bcryptRounds() {
+    return this.options.bcryptRounds ?? 10;
+  }
+  get accountLockoutEnabled() {
+    return this.options.features?.accountLockout === true;
+  }
+  get lockoutOptions() {
+    return this.options.lockout;
+  }
   resolveLoginIdentifier(dto) {
     const value = this.identifierField === "email" ? dto.email : dto.username;
     if (value == null || value.trim() === "") {
@@ -204,7 +255,8 @@ exports.AuthService = class AuthService {
     await this.hooks.onBeforeRegister?.(input);
     resolveRegisterIdentifier(input, this.identifierField);
     this.assertRegisterEmailWhenVerificationEnabled(input);
-    const passwordHash = await bcrypt2__namespace.hash(dto.password, 10);
+    this.assertPasswordPolicy(dto.password);
+    const passwordHash = await bcrypt2__namespace.hash(dto.password, this.bcryptRounds);
     try {
       const account = await this.authRepository.create({
         ...input,
@@ -217,7 +269,7 @@ exports.AuthService = class AuthService {
       }
     } catch (error) {
       if (isDuplicateKeyError(error)) {
-        throw new common.UnauthorizedException(`${this.identifierField} already exists`);
+        return { registered: true };
       }
       throw error;
     }
@@ -228,17 +280,22 @@ exports.AuthService = class AuthService {
     const account = await this.authRepository.findByIdentifierWithSecrets(
       identifier
     );
-    if (account?.passwordHash == null) {
-      throw new common.UnauthorizedException("Invalid credentials");
+    if (account != null) {
+      this.assertAccountNotLocked(account);
     }
-    this.assertAccountActive(account);
-    const passwordMatches = await bcrypt2__namespace.compare(
-      dto.password,
-      account.passwordHash
-    );
-    if (!passwordMatches) {
-      throw new common.UnauthorizedException("Invalid credentials");
+    const passwordHash = account?.passwordHash ?? DUMMY_PASSWORD_HASH;
+    const passwordMatches = await bcrypt2__namespace.compare(dto.password, passwordHash);
+    if (account?.passwordHash == null || !passwordMatches) {
+      if (account != null && this.accountLockoutEnabled) {
+        await this.authRepository.recordLoginFailure(
+          account.id,
+          this.lockoutOptions
+        );
+      }
+      throw new common.UnauthorizedException(AuthErrorCode.INVALID_CREDENTIALS);
     }
+    this.assertAccountActive(account);
+    await this.authRepository.recordLoginSuccess(account.id);
     return this.issueTokens(account);
   }
   async refresh(refreshToken) {
@@ -246,19 +303,25 @@ exports.AuthService = class AuthService {
     try {
       payload = await this.tokenService.verifyRefreshToken(refreshToken);
     } catch {
-      throw new common.UnauthorizedException("Invalid refresh token");
+      throw new common.UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);
     }
     const account = await this.authRepository.findByIdWithSecrets(payload.sub);
-    if (account?.refreshTokenHash == null) {
-      throw new common.UnauthorizedException("Invalid refresh token");
+    if (account == null) {
+      throw new common.UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);
     }
     this.assertAccountActive(account);
-    const tokenMatches = await this.tokenService.compareRefreshToken(
-      refreshToken,
-      account.refreshTokenHash
-    );
-    if (!tokenMatches) {
-      throw new common.UnauthorizedException("Invalid refresh token");
+    if (this.rotateRefreshToken) {
+      if (account.refreshTokenHash == null) {
+        throw new common.UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);
+      }
+      const tokenMatches = await this.tokenService.compareRefreshToken(
+        refreshToken,
+        account.refreshTokenHash
+      );
+      if (!tokenMatches) {
+        await this.authRepository.updateRefreshTokenHash(account.id, null);
+        throw new common.UnauthorizedException(AuthErrorCode.REFRESH_TOKEN_REUSE);
+      }
     }
     return this.issueTokens(account);
   }
@@ -281,7 +344,7 @@ exports.AuthService = class AuthService {
     const tokenHash = hashToken(token);
     const account = await this.authRepository.findByEmailVerificationTokenHash(tokenHash);
     if (account == null) {
-      throw new common.BadRequestException("TOKEN_INVALID_OR_EXPIRED");
+      throw new common.BadRequestException(AuthErrorCode.TOKEN_INVALID_OR_EXPIRED);
     }
     await this.authRepository.markEmailVerified(account.id);
     return { verified: true };
@@ -307,20 +370,55 @@ exports.AuthService = class AuthService {
     const tokenHash = hashToken(token);
     const account = await this.authRepository.findByResetTokenHash(tokenHash);
     if (account == null) {
-      throw new common.BadRequestException("TOKEN_INVALID_OR_EXPIRED");
+      throw new common.BadRequestException(AuthErrorCode.TOKEN_INVALID_OR_EXPIRED);
     }
-    const passwordHash = await bcrypt2__namespace.hash(newPassword, 10);
+    this.assertPasswordPolicy(newPassword);
+    const passwordHash = await bcrypt2__namespace.hash(newPassword, this.bcryptRounds);
     await this.authRepository.updatePasswordHash(account.id, passwordHash);
     await this.authRepository.clearResetToken(account.id);
     await this.authRepository.updateRefreshTokenHash(account.id, null);
     return { reset: true };
   }
+  async changePassword(authId, currentPassword, newPassword) {
+    const account = await this.authRepository.findByIdWithSecrets(authId);
+    if (account?.passwordHash == null) {
+      throw new common.UnauthorizedException(AuthErrorCode.INVALID_CURRENT_PASSWORD);
+    }
+    const currentMatches = await bcrypt2__namespace.compare(
+      currentPassword,
+      account.passwordHash
+    );
+    if (!currentMatches) {
+      throw new common.UnauthorizedException(AuthErrorCode.INVALID_CURRENT_PASSWORD);
+    }
+    if (currentPassword === newPassword) {
+      throw new common.BadRequestException(AuthErrorCode.PASSWORD_UNCHANGED);
+    }
+    this.assertPasswordPolicy(newPassword);
+    const passwordHash = await bcrypt2__namespace.hash(newPassword, this.bcryptRounds);
+    await this.authRepository.updatePasswordHash(account.id, passwordHash);
+    await this.authRepository.updateRefreshTokenHash(account.id, null);
+    return { changed: true };
+  }
+  assertAccountNotLocked(account) {
+    if (!this.accountLockoutEnabled || account.lockedUntil == null) {
+      return;
+    }
+    if (account.lockedUntil > /* @__PURE__ */ new Date()) {
+      throw new common.UnauthorizedException(AuthErrorCode.ACCOUNT_LOCKED);
+    }
+  }
   assertAccountActive(account) {
     if (account.disabled) {
-      throw new common.UnauthorizedException("ACCOUNT_DISABLED");
+      throw new common.UnauthorizedException(AuthErrorCode.ACCOUNT_DISABLED);
     }
     if (this.emailVerificationEnabled && !account.emailVerified) {
-      throw new common.UnauthorizedException("EMAIL_NOT_VERIFIED");
+      throw new common.UnauthorizedException(AuthErrorCode.EMAIL_NOT_VERIFIED);
+    }
+  }
+  assertPasswordPolicy(password) {
+    if (this.options.passwordComplexity === true) {
+      assertPasswordComplexity(password);
     }
   }
   async issueTokens(account) {
@@ -436,6 +534,13 @@ var AuthController = class {
   resetPassword(dto) {
     return this.authService.resetPassword(dto.token, dto.newPassword);
   }
+  changePassword(user, dto) {
+    return this.authService.changePassword(
+      user.sub,
+      dto.currentPassword,
+      dto.newPassword
+    );
+  }
 };
 __decorateClass([
   common.Post("register"),
@@ -476,17 +581,39 @@ __decorateClass([
   common.HttpCode(common.HttpStatus.OK),
   __decorateParam(0, common.Body())
 ], AuthController.prototype, "resetPassword", 1);
+__decorateClass([
+  common.Post("change-password"),
+  common.UseGuards(exports.JwtAuthGuard),
+  common.HttpCode(common.HttpStatus.OK),
+  __decorateParam(0, CurrentUser()),
+  __decorateParam(1, common.Body())
+], AuthController.prototype, "changePassword", 1);
 AuthController = __decorateClass([
   common.Controller("auth"),
   __decorateParam(0, common.Inject(exports.AuthService))
 ], AuthController);
+
+// src/controllers/auth.controller.factory.ts
+function createAuthController(routePrefix = "auth") {
+  let ConfiguredAuthController = class extends AuthController {
+  };
+  ConfiguredAuthController = __decorateClass([
+    common.Controller(routePrefix)
+  ], ConfiguredAuthController);
+  Object.defineProperty(ConfiguredAuthController, "name", {
+    value: `AuthController_${routePrefix.replace(/\W+/g, "_")}`
+  });
+  return ConfiguredAuthController;
+}
 var JwtStrategy = class extends passport.PassportStrategy(passportJwt.Strategy) {
   constructor(options, authRepository) {
     super({
       jwtFromRequest: passportJwt.ExtractJwt.fromAuthHeaderAsBearerToken(),
       ignoreExpiration: false,
-      secretOrKey: options.secret
+      secretOrKey: options.secret,
+      algorithms: ["HS256"]
     });
+    this.options = options;
     this.authRepository = authRepository;
   }
   async validate(payload) {
@@ -494,6 +621,9 @@ var JwtStrategy = class extends passport.PassportStrategy(passportJwt.Strategy)
     if (account == null || account.disabled) {
       throw new common.UnauthorizedException("Account not found or inactive");
     }
+    if (this.options.features?.emailVerification === true && !account.emailVerified) {
+      throw new common.UnauthorizedException(AuthErrorCode.EMAIL_NOT_VERIFIED);
+    }
     return payload;
   }
 };
@@ -503,27 +633,82 @@ JwtStrategy = __decorateClass([
   __decorateParam(1, common.Inject(AUTH_REPOSITORY))
 ], JwtStrategy);
 
+// src/utils/hooks-provider.util.ts
+function createHooksProvider(options) {
+  if (options.hooksProvider != null) {
+    return options.hooksProvider;
+  }
+  const HooksClass = options.hooks ?? exports.DefaultAuthHooks;
+  return {
+    provide: AUTH_HOOKS,
+    useClass: HooksClass
+  };
+}
+
+// src/utils/validate-auth-config.util.ts
+var MIN_SECRET_LENGTH = 32;
+var MIN_BCRYPT_ROUNDS = 10;
+var MAX_BCRYPT_ROUNDS = 14;
+function validateAuthModuleOptions(options) {
+  if (options.secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(
+      `AuthModule: secret must be at least ${MIN_SECRET_LENGTH} characters`
+    );
+  }
+  if (options.refreshSecret.length < MIN_SECRET_LENGTH) {
+    throw new Error(
+      `AuthModule: refreshSecret must be at least ${MIN_SECRET_LENGTH} characters`
+    );
+  }
+  if (options.secret === options.refreshSecret) {
+    throw new Error(
+      "AuthModule: secret and refreshSecret must be different"
+    );
+  }
+  const rounds = options.bcryptRounds ?? MIN_BCRYPT_ROUNDS;
+  if (rounds < MIN_BCRYPT_ROUNDS || rounds > MAX_BCRYPT_ROUNDS) {
+    throw new Error(
+      `AuthModule: bcryptRounds must be between ${MIN_BCRYPT_ROUNDS} and ${MAX_BCRYPT_ROUNDS}`
+    );
+  }
+  if (options.emailVerificationTokenTtlMs != null && options.emailVerificationTokenTtlMs < 6e4) {
+    throw new Error(
+      "AuthModule: emailVerificationTokenTtlMs must be at least 60000 (1 minute)"
+    );
+  }
+  if (options.passwordResetTokenTtlMs != null && options.passwordResetTokenTtlMs < 6e4) {
+    throw new Error(
+      "AuthModule: passwordResetTokenTtlMs must be at least 60000 (1 minute)"
+    );
+  }
+}
+
 // src/auth.module.ts
-function createAuthProviders(options) {
+function createCoreProviders(options) {
+  validateAuthModuleOptions(options);
   return [
     {
       provide: AUTH_MODULE_OPTIONS,
       useValue: options
     },
-    {
-      provide: AUTH_HOOKS,
-      inject: [AUTH_MODULE_OPTIONS],
-      useFactory: (opts) => {
-        const HooksClass = opts.hooks ?? exports.DefaultAuthHooks;
-        return new HooksClass();
-      }
-    },
+    createHooksProvider(options),
     exports.AuthService,
     exports.TokenService,
     JwtStrategy,
     exports.JwtAuthGuard
   ];
 }
+function createAsyncHooksProvider(options) {
+  if (options.hooksProvider != null) {
+    return options.hooksProvider;
+  }
+  const HooksClass = options.hooks ?? exports.DefaultAuthHooks;
+  return {
+    provide: AUTH_HOOKS,
+    inject: [core.ModuleRef],
+    useFactory: (moduleRef) => moduleRef.create(HooksClass)
+  };
+}
 function createAuthImports() {
   return [
     passport.PassportModule.register({ defaultStrategy: "jwt" }),
@@ -531,7 +716,10 @@ function createAuthImports() {
       inject: [AUTH_MODULE_OPTIONS],
       useFactory: (opts) => ({
         secret: opts.secret,
-        signOptions: { expiresIn: opts.expiresIn ?? "1h" }
+        signOptions: {
+          expiresIn: opts.expiresIn ?? "1h",
+          algorithm: "HS256"
+        }
       })
     })
   ];
@@ -543,14 +731,33 @@ function mergeImports(userImports) {
   }
   return merged;
 }
+function createAsyncProviders(options) {
+  return [
+    {
+      provide: AUTH_MODULE_OPTIONS,
+      inject: options.inject ?? [],
+      useFactory: async (...args) => {
+        const config = await options.useFactory(...args);
+        validateAuthModuleOptions(config);
+        return config;
+      }
+    },
+    createAsyncHooksProvider(options),
+    exports.AuthService,
+    exports.TokenService,
+    JwtStrategy,
+    exports.JwtAuthGuard
+  ];
+}
 exports.AuthModule = class AuthModule {
   static forRoot(options) {
+    const routePrefix = options.routePrefix ?? "auth";
     return {
       module: exports.AuthModule,
       global: true,
       imports: createAuthImports(),
-      controllers: [AuthController],
-      providers: createAuthProviders(options),
+      controllers: [createAuthController(routePrefix)],
+      providers: createCoreProviders(options),
       exports: [
         AUTH_MODULE_OPTIONS,
         AUTH_HOOKS,
@@ -563,30 +770,13 @@ exports.AuthModule = class AuthModule {
     };
   }
   static forRootAsync(options) {
+    const routePrefix = options.routePrefix ?? "auth";
     return {
       module: exports.AuthModule,
       global: true,
       imports: mergeImports(options.imports),
-      controllers: [AuthController],
-      providers: [
-        {
-          provide: AUTH_MODULE_OPTIONS,
-          inject: options.inject ?? [],
-          useFactory: options.useFactory
-        },
-        {
-          provide: AUTH_HOOKS,
-          inject: [AUTH_MODULE_OPTIONS],
-          useFactory: (opts) => {
-            const HooksClass = opts.hooks ?? exports.DefaultAuthHooks;
-            return new HooksClass();
-          }
-        },
-        exports.AuthService,
-        exports.TokenService,
-        JwtStrategy,
-        exports.JwtAuthGuard
-      ],
+      controllers: [createAuthController(routePrefix)],
+      providers: createAsyncProviders(options),
       exports: [
         AUTH_MODULE_OPTIONS,
         AUTH_HOOKS,
@@ -606,6 +796,17 @@ exports.AuthModule = __decorateClass([
 // src/dto/auth-tokens.dto.ts
 var AuthTokensDto = class {
 };
+var ChangePasswordDto = class {
+};
+__decorateClass([
+  classValidator.IsString(),
+  classValidator.IsNotEmpty()
+], ChangePasswordDto.prototype, "currentPassword", 2);
+__decorateClass([
+  classValidator.IsString(),
+  classValidator.IsNotEmpty(),
+  classValidator.Length(8, 128)
+], ChangePasswordDto.prototype, "newPassword", 2);
 var ForgotPasswordDto = class {
 };
 __decorateClass([
@@ -615,7 +816,8 @@ var LoginDto = class {
 };
 __decorateClass([
   classValidator.IsOptional(),
-  classValidator.IsString(),
+  classValidator.ValidateIf((dto) => dto.email != null && dto.email.trim() !== ""),
+  classValidator.IsEmail(),
   classValidator.Length(3, 255)
 ], LoginDto.prototype, "email", 2);
 __decorateClass([
@@ -642,7 +844,8 @@ var RegisterDto = class {
 };
 __decorateClass([
   classValidator.IsOptional(),
-  classValidator.IsString(),
+  classValidator.ValidateIf((dto) => dto.email != null && dto.email.trim() !== ""),
+  classValidator.IsEmail(),
   classValidator.Length(3, 255)
 ], RegisterDto.prototype, "email", 2);
 __decorateClass([
@@ -676,8 +879,11 @@ __decorateClass([
 
 exports.AUTH_HOOKS = AUTH_HOOKS;
 exports.AUTH_MODULE_OPTIONS = AUTH_MODULE_OPTIONS;
+exports.AUTH_RATE_LIMIT_PRESETS = AUTH_RATE_LIMIT_PRESETS;
 exports.AUTH_REPOSITORY = AUTH_REPOSITORY;
+exports.AuthErrorCode = AuthErrorCode;
 exports.AuthTokensDto = AuthTokensDto;
+exports.ChangePasswordDto = ChangePasswordDto;
 exports.CurrentUser = CurrentUser;
 exports.ForgotPasswordDto = ForgotPasswordDto;
 exports.LoginDto = LoginDto;