@aranzatech/aranza-auth 0.1.2 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (21) hide show
  1. package/CHANGELOG.md +47 -24
  2. package/README.md +106 -10
  3. package/SECURITY.md +58 -0
  4. package/dist/{auth-repository.interface-BMlJc-98.d.cts → auth-repository.interface-9PpDVOs8.d.cts} +32 -2
  5. package/dist/{auth-repository.interface-BMlJc-98.d.ts → auth-repository.interface-9PpDVOs8.d.ts} +32 -2
  6. package/dist/{chunk-JLRBMDLH.js → chunk-QNEFN5ES.js} +5 -5
  7. package/dist/chunk-QNEFN5ES.js.map +1 -0
  8. package/dist/index.cjs +274 -68
  9. package/dist/index.cjs.map +1 -1
  10. package/dist/index.d.cts +65 -3
  11. package/dist/index.d.ts +65 -3
  12. package/dist/index.js +273 -69
  13. package/dist/index.js.map +1 -1
  14. package/dist/mongo/index.cjs +56 -5
  15. package/dist/mongo/index.cjs.map +1 -1
  16. package/dist/mongo/index.d.cts +7 -1
  17. package/dist/mongo/index.d.ts +7 -1
  18. package/dist/mongo/index.js +57 -3
  19. package/dist/mongo/index.js.map +1 -1
  20. package/package.json +3 -2
  21. package/dist/chunk-JLRBMDLH.js.map +0 -1
package/dist/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/decorators/current-user.decorator.ts","../src/guards/jwt-auth.guard.ts","../src/constants/tokens.ts","../src/hooks/default-auth.hooks.ts","../src/utils/duplicate-key.util.ts","../src/utils/identifier.util.ts","../src/utils/token.util.ts","../src/services/token.service.ts","../src/services/auth.service.ts","../src/controllers/auth.controller.ts","../src/strategies/jwt.strategy.ts","../src/auth.module.ts","../src/dto/auth-tokens.dto.ts","../src/dto/forgot-password.dto.ts","../src/dto/login.dto.ts","../src/dto/refresh-token.dto.ts","../src/dto/register-ack.dto.ts","../src/dto/register.dto.ts","../src/dto/reset-password.dto.ts","../src/dto/verify-email.dto.ts"],"names":["createParamDecorator","JwtAuthGuard","AuthGuard","UnauthorizedException","Injectable","DefaultAuthHooks","randomBytes","createHash","TokenService","bcrypt","hash","JwtService","AuthService","BadRequestException","bcrypt2","NotFoundException","Inject","Post","Body","HttpCode","HttpStatus","UseGuards","Get","Controller","PassportStrategy","Strategy","ExtractJwt","PassportModule","JwtModule","AuthModule","Module","IsEmail","IsOptional","IsString","Length","IsNotEmpty","Matches"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIO,IAAM,WAAA,GAAcA,2BAAA;AAAA,EACzB,CAAC,OAAgB,GAAA,KAA0C;AACzD,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,YAAA,EAAa,CAAE,UAAA,EAAqC;AACxE,IAAA,OAAO,OAAA,CAAQ,IAAA;AAAA,EACjB;AACF;ACLaC,oBAAA,GAAN,kBAAA,SAA2BC,kBAAA,CAAU,KAAK,CAAA,CAAE;AAAA,EACjD,aAAA,CACE,GAAA,EACA,IAAA,EACA,KAAA,EACO;AAEP,IAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,CAAC,IAAA,EAAM;AACxB,MAAA,MAAM,GAAA,IAAO,IAAIC,4BAAA,EAAsB;AAAA,IACzC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAZaF,oBAAA,GAAN,eAAA,CAAA;AAAA,EADNG,iBAAA;AAAW,CAAA,EACCH,oBAAA,CAAA;;;ACHN,IAAM,mBAAA,GAAsB;AAC5B,IAAM,UAAA,GAAa;AACnB,IAAM,eAAA,GAAkB;ACMlBI,2BAAN,sBAAA,CAA4C;AAAA,EACjD,MAAM,gBACJ,OAAA,EACkC;AAClC,IAAA,OAAO;AAAA,MACL,KAAK,OAAA,CAAQ,EAAA;AAAA,MACb,GAAI,QAAQ,KAAA,IAAS,IAAA,GAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,MACxD,GAAI,QAAQ,QAAA,IAAY,IAAA,GAAO,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAS,GAAI;AAAC,KACnE;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,OAAA,EAA4D;AACzE,IAAA,OAAO;AAAA,MACL,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,UAAU,OAAA,CAAQ;AAAA,KACpB;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAA,EAAsC;AAC3D,IAAA;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,QAAA,EAA0C;AAC9D,IAAA;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,QAAA,EAA0C;AAC3D,IAAA;AAAA,EACF;AACF;AAhCaA,wBAAA,GAAN,eAAA,CAAA;AAAA,EADND,iBAAAA;AAAW,CAAA,EACCC,wBAAA,CAAA;;;ACTN,SAAS,oBAAoB,KAAA,EAAyB;AAC3D,EAAA,OACE,CAAC,CAAC,KAAA,IACF,OAAO,UAAU,QAAA,IACjB,MAAA,IAAU,KAAA,IACT,KAAA,CAA2B,IAAA,KAAS,IAAA;AAEzC;;;ACJO,SAAS,oBAAoB,KAAA,EAAuB;AACzD,EAAA,OAAO,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAClC;AAEO,SAAS,yBAAA,CACd,OACA,KAAA,EACQ;AACR,EAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,OAAA,GAAU,KAAA,CAAM,QAAQ,KAAA,CAAM,QAAA;AACtD,EAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,KAAK,CAAA,CAAE,CAAA;AAAA,EACpD;AACA,EAAA,OAAO,oBAAoB,KAAK,CAAA;AAClC;AAEO,SAAS,qBAAA,CACd,SACA,KAAA,EACoB;AACpB,EAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,OAAA,GAAU,OAAA,CAAQ,QAAQ,OAAA,CAAQ,QAAA;AAC1D,EAAA,OAAO,KAAA,IAAS,IAAA,GAAO,mBAAA,CAAoB,KAAK,CAAA,GAAI,MAAA;AACtD;ACtBO,SAAS,gBAAA,CAAiB,aAAa,EAAA,EAAY;AACxD,EAAA,OAAOC,kBAAA,CAAY,UAAU,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAC/C;AAEO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,OAAOC,kBAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAEO,SAAS,mBAAmB,KAAA,EAAqB;AACtD,EAAA,OAAO,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,KAAQ,KAAK,CAAA;AACpC;AAGO,IAAM,iCAAA,GAAoC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAGzD,IAAM,6BAAA,GAAgC,KAAK,EAAA,GAAK,GAAA;ACR1CC,uBAAN,kBAAA,CAAmB;AAAA,EACxB,WAAA,CAEmB,YAEA,OAAA,EACjB;AAHiB,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAEA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAAA,EAChB;AAAA,EAEH,MAAM,WAAW,OAAA,EAA8C;AAC7D,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,OAAA,CAAQ,SAAA,IAAa,IAAA;AAClD,IAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,OAAA,CAAQ,gBAAA,IAAoB,IAAA;AAE1D,IAAA,MAAM,CAAC,WAAA,EAAa,YAAY,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,MACpD,KAAK,UAAA,CAAW,SAAA;AAAA,QACd,OAAA;AAAA,QACA;AAAA,UACE,MAAA,EAAQ,KAAK,OAAA,CAAQ,MAAA;AAAA,UACrB,SAAA,EAAW;AAAA;AACb,OACF;AAAA,MACA,KAAK,UAAA,CAAW,SAAA;AAAA,QACd,OAAA;AAAA,QACA;AAAA,UACE,MAAA,EAAQ,KAAK,OAAA,CAAQ,aAAA;AAAA,UACrB,SAAA,EAAW;AAAA;AACb;AACF,KACD,CAAA;AAED,IAAA,OAAO,EAAE,aAAa,YAAA,EAAa;AAAA,EACrC;AAAA,EAEA,MAAM,mBAAmB,YAAA,EAA+C;AACtE,IAAA,OAAO,IAAA,CAAK,UAAA,CAAW,WAAA,CAA4B,YAAA,EAAc;AAAA,MAC/D,MAAA,EAAQ,KAAK,OAAA,CAAQ;AAAA,KACtB,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,iBAAiB,YAAA,EAAuC;AAC5D,IAAA,OAAcC,kBAAA,CAAA,IAAA,CAAK,cAAc,EAAE,CAAA;AAAA,EACrC;AAAA,EAEA,MAAM,mBAAA,CACJ,YAAA,EACAC,KAAAA,EACkB;AAClB,IAAA,OAAcD,kBAAA,CAAA,OAAA,CAAQ,cAAcC,KAAI,CAAA;AAAA,EAC1C;AACF;AAhDaF,oBAAA,GAAN,eAAA,CAAA;AAAA,EADNJ,iBAAAA,EAAW;AAAA,EAGP,iCAAOO,cAAU,CAAA,CAAA;AAAA,EAEjB,iCAAO,mBAAmB,CAAA;AAAA,CAAA,EAJlBH,oBAAA,CAAA;;;AC+BAI,sBAAN,iBAAA,CAAkB;AAAA,EACvB,WAAA,CAEmB,cAAA,EAEA,OAAA,EAEA,KAAA,EAEA,YAAA,EACjB;AAPiB,IAAA,IAAA,CAAA,cAAA,GAAA,cAAA;AAEA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAEA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAEA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AAAA,EAChB;AAAA,EAEH,IAAY,eAAA,GAAkB;AAC5B,IAAA,OAAO,IAAA,CAAK,QAAQ,eAAA,IAAmB,OAAA;AAAA,EACzC;AAAA,EAEA,IAAY,wBAAA,GAA2B;AACrC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,iBAAA,KAAsB,IAAA;AAAA,EACtD;AAAA,EAEA,IAAY,oBAAA,GAAuB;AACjC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,aAAA,KAAkB,IAAA;AAAA,EAClD;AAAA,EAEA,IAAY,kBAAA,GAAqB;AAC/B,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,oBAAA,KAAyB,KAAA;AAAA,EACzD;AAAA,EAEQ,uBAAuB,GAAA,EAAuB;AACpD,IAAA,MAAM,QACJ,IAAA,CAAK,eAAA,KAAoB,OAAA,GAAU,GAAA,CAAI,QAAQ,GAAA,CAAI,QAAA;AACrD,IAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxC,MAAA,MAAM,IAAIC,0BAAA;AAAA,QACR,CAAA,EAAG,KAAK,eAAe,CAAA,sBAAA;AAAA,OACzB;AAAA,IACF;AACA,IAAA,OAAO,oBAAoB,KAAK,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,SAAS,GAAA,EAAiD;AAC9D,IAAA,IAAA,CAAK,sCAAA,EAAuC;AAE5C,IAAA,MAAM,KAAA,GAAuB,EAAE,QAAA,EAAU,GAAA,CAAI,QAAA,EAAS;AACtD,IAAA,IAAI,GAAA,CAAI,KAAA,IAAS,IAAA,EAAM,KAAA,CAAM,QAAQ,GAAA,CAAI,KAAA;AACzC,IAAA,IAAI,GAAA,CAAI,QAAA,IAAY,IAAA,EAAM,KAAA,CAAM,WAAW,GAAA,CAAI,QAAA;AAE/C,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,gBAAA,GAAmB,KAAK,CAAA;AAEzC,IAAA,yBAAA,CAA0B,KAAA,EAAO,KAAK,eAAe,CAAA;AACrD,IAAA,IAAA,CAAK,2CAA2C,KAAK,CAAA;AAErD,IAAA,MAAM,YAAA,GAAe,MAAaC,kBAAA,CAAA,IAAA,CAAK,GAAA,CAAI,UAAU,EAAE,CAAA;AAEvD,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO;AAAA,QAC/C,GAAG,KAAA;AAAA,QACH,YAAA;AAAA,QACA,aAAA,EAAe,CAAC,IAAA,CAAK;AAAA,OACtB,CAAA;AAED,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,eAAA,GAAkB,OAAO,CAAA;AAE1C,MAAA,IAAI,KAAK,wBAAA,EAA0B;AACjC,QAAA,MAAM,IAAA,CAAK,sBAAsB,OAAO,CAAA;AAAA,MAC1C;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAC9B,QAAA,MAAM,IAAIX,4BAAAA,CAAsB,CAAA,EAAG,IAAA,CAAK,eAAe,CAAA,eAAA,CAAiB,CAAA;AAAA,MAC1E;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAO,EAAE,YAAY,IAAA,EAAK;AAAA,EAC5B;AAAA,EAEA,MAAM,MAAM,GAAA,EAAoC;AAC9C,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,sBAAA,CAAuB,GAAG,CAAA;AAClD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,2BAAA;AAAA,MACxC;AAAA,KACF;AAEA,IAAA,IAAI,OAAA,EAAS,gBAAgB,IAAA,EAAM;AACjC,MAAA,MAAM,IAAIA,6BAAsB,qBAAqB,CAAA;AAAA,IACvD;AAEA,IAAA,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAEhC,IAAA,MAAM,kBAAkB,MAAaW,kBAAA,CAAA,OAAA;AAAA,MACnC,GAAA,CAAI,QAAA;AAAA,MACJ,OAAA,CAAQ;AAAA,KACV;AACA,IAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,MAAA,MAAM,IAAIX,6BAAsB,qBAAqB,CAAA;AAAA,IACvD;AAEA,IAAA,OAAO,IAAA,CAAK,YAAY,OAAO,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,YAAA,EAA2C;AACvD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,IAAA,CAAK,YAAA,CAAa,kBAAA,CAAmB,YAAY,CAAA;AAAA,IACnE,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAIA,6BAAsB,uBAAuB,CAAA;AAAA,IACzD;AAEA,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,cAAA,CAAe,mBAAA,CAAoB,QAAQ,GAAG,CAAA;AACzE,IAAA,IAAI,OAAA,EAAS,oBAAoB,IAAA,EAAM;AACrC,MAAA,MAAM,IAAIA,6BAAsB,uBAAuB,CAAA;AAAA,IACzD;AAEA,IAAA,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAEhC,IAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,YAAA,CAAa,mBAAA;AAAA,MAC3C,YAAA;AAAA,MACA,OAAA,CAAQ;AAAA,KACV;AACA,IAAA,IAAI,CAAC,YAAA,EAAc;AACjB,MAAA,MAAM,IAAIA,6BAAsB,uBAAuB,CAAA;AAAA,IACzD;AAEA,IAAA,OAAO,IAAA,CAAK,YAAY,OAAO,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,OAAO,MAAA,EAA8C;AACzD,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,sBAAA,CAAuB,MAAA,EAAQ,IAAI,CAAA;AAC7D,IAAA,OAAO,EAAE,WAAW,IAAA,EAAK;AAAA,EAC3B;AAAA,EAEA,MAAM,GAAG,MAAA,EAAkD;AACzD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,SAAS,MAAM,CAAA;AACzD,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,IAAIA,6BAAsB,mBAAmB,CAAA;AAAA,IACrD;AAEA,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,QAAA,IAAY,IAAA,EAAM;AAC/B,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,IAAIE,wBAAA,EAAiB,CAAE,QAAA,CAAS,OAAO,CAAA;AAAA,EAChD;AAAA,EAEA,MAAM,YAAY,KAAA,EAA4C;AAC5D,IAAA,IAAA,CAAK,8BAAA,EAA+B;AAEpC,IAAA,MAAM,SAAA,GAAY,UAAU,KAAK,CAAA;AACjC,IAAA,MAAM,OAAA,GACJ,MAAM,IAAA,CAAK,cAAA,CAAe,iCAAiC,SAAS,CAAA;AACtE,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,IAAIQ,2BAAoB,0BAA0B,CAAA;AAAA,IAC1D;AAEA,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,iBAAA,CAAkB,OAAA,CAAQ,EAAE,CAAA;AACtD,IAAA,OAAO,EAAE,UAAU,IAAA,EAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,eAAe,KAAA,EAAwC;AAC3D,IAAA,IAAA,CAAK,0BAAA,EAA2B;AAChC,IAAA,IAAA,CAAK,uCAAA,EAAwC;AAE7C,IAAA,MAAM,eAAA,GAAkB,oBAAoB,KAAK,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,YAAY,eAAe,CAAA;AAErE,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,WAAW,gBAAA,EAAiB;AAClC,MAAA,MAAM,SAAA,GAAY,UAAU,QAAQ,CAAA;AACpC,MAAA,MAAM,SAAA,GAAY,kBAAA;AAAA,QAChB,IAAA,CAAK,QAAQ,uBAAA,IAA2B;AAAA,OAC1C;AAEA,MAAA,MAAM,KAAK,cAAA,CAAe,aAAA,CAAc,OAAA,CAAQ,EAAA,EAAI,WAAW,SAAS,CAAA;AACxE,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,SAAA,CAAW,OAAA,EAAS,iBAAiB,QAAQ,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,EACtB;AAAA,EAEA,MAAM,aAAA,CACJ,KAAA,EACA,WAAA,EAC0B;AAC1B,IAAA,IAAA,CAAK,0BAAA,EAA2B;AAEhC,IAAA,MAAM,SAAA,GAAY,UAAU,KAAK,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,qBAAqB,SAAS,CAAA;AACxE,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,IAAIA,2BAAoB,0BAA0B,CAAA;AAAA,IAC1D;AAEA,IAAA,MAAM,YAAA,GAAe,MAAaC,kBAAA,CAAA,IAAA,CAAK,WAAA,EAAa,EAAE,CAAA;AACtD,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,kBAAA,CAAmB,OAAA,CAAQ,IAAI,YAAY,CAAA;AACrE,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,eAAA,CAAgB,OAAA,CAAQ,EAAE,CAAA;AACpD,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,sBAAA,CAAuB,OAAA,CAAQ,IAAI,IAAI,CAAA;AAEjE,IAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AAAA,EACvB;AAAA,EAEQ,oBAAoB,OAAA,EAAgC;AAC1D,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,IAAIX,6BAAsB,kBAAkB,CAAA;AAAA,IACpD;AAEA,IAAA,IAAI,IAAA,CAAK,wBAAA,IAA4B,CAAC,OAAA,CAAQ,aAAA,EAAe;AAC3D,MAAA,MAAM,IAAIA,6BAAsB,oBAAoB,CAAA;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,OAAA,EAA+C;AACvE,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,gBAAgB,OAAO,CAAA;AACxD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAA,CAAW;AAAA,MAChD,GAAG,OAAA;AAAA,MACH,KAAK,OAAA,CAAQ;AAAA,KACd,CAAA;AAED,IAAA,IAAI,KAAK,kBAAA,EAAoB;AAC3B,MAAA,MAAM,gBAAA,GAAmB,MAAM,IAAA,CAAK,YAAA,CAAa,gBAAA;AAAA,QAC/C,MAAA,CAAO;AAAA,OACT;AACA,MAAA,MAAM,KAAK,cAAA,CAAe,sBAAA;AAAA,QACxB,OAAA,CAAQ,EAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,GAAe,OAAO,CAAA;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,sBAAsB,OAAA,EAAyC;AAC3E,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,mBAAA,CAAoB,OAAO,CAAA;AAC9C,IAAA,IAAI,SAAS,IAAA,EAAM;AAEnB,IAAA,MAAM,WAAW,gBAAA,EAAiB;AAClC,IAAA,MAAM,SAAA,GAAY,UAAU,QAAQ,CAAA;AACpC,IAAA,MAAM,SAAA,GAAY,kBAAA;AAAA,MAChB,IAAA,CAAK,QAAQ,2BAAA,IACX;AAAA,KACJ;AAEA,IAAA,MAAM,KAAK,cAAA,CAAe,yBAAA;AAAA,MACxB,OAAA,CAAQ,EAAA;AAAA,MACR,SAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,SAAA,CAAW,QAAA,EAAU,OAAO,QAAQ,CAAA;AAAA,EACvD;AAAA,EAEQ,oBAAoB,OAAA,EAAyC;AACnE,IAAA,IAAI,QAAQ,KAAA,IAAS,IAAA,IAAQ,QAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxD,MAAA,OAAO,mBAAA,CAAoB,QAAQ,KAAK,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,2CAA2C,KAAA,EAA4B;AAC7E,IAAA,IAAI,CAAC,KAAK,wBAAA,EAA0B;AAEpC,IAAA,MAAM,KAAA,GACJ,IAAA,CAAK,eAAA,KAAoB,OAAA,GACrB,0BAA0B,KAAA,EAAO,OAAO,CAAA,GACxC,KAAA,CAAM,KAAA,IAAS,IAAA,GACb,mBAAA,CAAoB,KAAA,CAAM,KAAK,CAAA,GAC/B,IAAA;AAER,IAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxC,MAAA,MAAM,IAAIU,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,sCAAA,GAA+C;AACrD,IAAA,IAAI,IAAA,CAAK,wBAAA,IAA4B,IAAA,CAAK,KAAA,CAAM,aAAa,IAAA,EAAM;AACjE,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,uCAAA,GAAgD;AACtD,IAAA,IAAI,IAAA,CAAK,oBAAA,IAAwB,IAAA,CAAK,KAAA,CAAM,aAAa,IAAA,EAAM;AAC7D,MAAA,MAAM,IAAIA,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,8BAAA,GAAuC;AAC7C,IAAA,IAAI,CAAC,KAAK,wBAAA,EAA0B;AAClC,MAAA,MAAM,IAAIE,wBAAA,EAAkB;AAAA,IAC9B;AAAA,EACF;AAAA,EAEQ,0BAAA,GAAmC;AACzC,IAAA,IAAI,CAAC,KAAK,oBAAA,EAAsB;AAC9B,MAAA,MAAM,IAAIA,wBAAA,EAAkB;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,wBAAwB,OAAA,EAA8C;AACpE,IAAA,OAAO,qBAAA,CAAsB,OAAA,EAAS,IAAA,CAAK,eAAe,CAAA;AAAA,EAC5D;AACF;AA9SaH,mBAAA,GAAN,eAAA,CAAA;AAAA,EADNR,iBAAAA,EAAW;AAAA,EAGP,eAAA,CAAA,CAAA,EAAAY,cAAO,eAAe,CAAA,CAAA;AAAA,EAEtB,eAAA,CAAA,CAAA,EAAAA,cAAO,mBAAmB,CAAA,CAAA;AAAA,EAE1B,eAAA,CAAA,CAAA,EAAAA,cAAO,UAAU,CAAA,CAAA;AAAA,EAEjB,eAAA,CAAA,CAAA,EAAAA,cAAOR,oBAAY,CAAA;AAAA,CAAA,EARXI,mBAAA,CAAA;;;AChBN,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAAkD,WAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EAA2B;AAAA,EAG7E,SAAiB,GAAA,EAA2C;AAC1D,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA;AAAA,EACtC;AAAA,EAGA,MAAc,GAAA,EAAuC;AACnD,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA;AAAA,EACnC;AAAA,EAIA,QAAgB,GAAA,EAA8C;AAC5D,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AAAA,EAClD;AAAA,EAKA,OAAsB,IAAA,EAAoD;AACxE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,EACzC;AAAA,EAIA,GAAkB,IAAA,EAAwD;AACxE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,EAAA,CAAG,IAAA,CAAK,GAAG,CAAA;AAAA,EACrC;AAAA,EAKA,YAAoB,GAAA,EAAkD;AACpE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,GAAA,CAAI,KAAK,CAAA;AAAA,EAC/C;AAAA,EAKA,eAAuB,GAAA,EAAiD;AACtE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA;AAAA,EAClD;AAAA,EAKA,cAAsB,GAAA,EAAiD;AACrE,IAAA,OAAO,KAAK,WAAA,CAAY,aAAA,CAAc,GAAA,CAAI,KAAA,EAAO,IAAI,WAAW,CAAA;AAAA,EAClE;AACF,CAAA;AAhDE,eAAA,CAAA;AAAA,EADCK,YAAK,UAAU,CAAA;AAAA,EACN,eAAA,CAAA,CAAA,EAAAC,WAAA,EAAK;AAAA,CAAA,EAJJ,cAAA,CAIX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EADCD,YAAK,OAAO,CAAA;AAAA,EACN,eAAA,CAAA,CAAA,EAAAC,WAAA,EAAK;AAAA,CAAA,EATD,cAAA,CASX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;AAMA,eAAA,CAAA;AAAA,EAFCD,YAAK,SAAS,CAAA;AAAA,EACdE,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACd,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EAfH,cAAA,CAeX,SAAA,EAAA,SAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAHCD,YAAK,QAAQ,CAAA;AAAA,EACbI,iBAAUpB,oBAAY,CAAA;AAAA,EACtBkB,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACf,eAAA,CAAA,CAAA,EAAA,WAAA,EAAY;AAAA,CAAA,EAtBT,cAAA,CAsBX,SAAA,EAAA,QAAA,EAAA,CAAA,CAAA;AAMA,eAAA,CAAA;AAAA,EAFCE,WAAI,IAAI,CAAA;AAAA,EACRD,iBAAUpB,oBAAY,CAAA;AAAA,EACnB,eAAA,CAAA,CAAA,EAAA,WAAA,EAAY;AAAA,CAAA,EA5BL,cAAA,CA4BX,SAAA,EAAA,IAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAFCgB,YAAK,cAAc,CAAA;AAAA,EACnBE,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACV,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EAnCP,cAAA,CAmCX,SAAA,EAAA,aAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAFCD,YAAK,iBAAiB,CAAA;AAAA,EACtBE,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACP,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EA1CV,cAAA,CA0CX,SAAA,EAAA,gBAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAFCD,YAAK,gBAAgB,CAAA;AAAA,EACrBE,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACR,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EAjDT,cAAA,CAiDX,SAAA,EAAA,eAAA,EAAA,CAAA,CAAA;AAjDW,cAAA,GAAN,eAAA,CAAA;AAAA,EADNK,kBAAW,MAAM,CAAA;AAAA,EAEH,eAAA,CAAA,CAAA,EAAAP,cAAOJ,mBAAW,CAAA;AAAA,CAAA,EADpB,cAAA,CAAA;ACfN,IAAM,WAAA,GAAN,cAA0BY,yBAAA,CAAiBC,oBAAQ,CAAA,CAAE;AAAA,EAC1D,WAAA,CAEE,SAEiB,cAAA,EACjB;AACA,IAAA,KAAA,CAAM;AAAA,MACJ,cAAA,EAAgBC,uBAAW,2BAAA,EAA4B;AAAA,MACvD,gBAAA,EAAkB,KAAA;AAAA,MAClB,aAAa,OAAA,CAAQ;AAAA,KACtB,CAAA;AANgB,IAAA,IAAA,CAAA,cAAA,GAAA,cAAA;AAAA,EAOnB;AAAA,EAEA,MAAM,SAAS,OAAA,EAAkD;AAC/D,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,cAAA,CAAe,QAAA,CAAS,QAAQ,GAAG,CAAA;AAC9D,IAAA,IAAI,OAAA,IAAW,IAAA,IAAQ,OAAA,CAAQ,QAAA,EAAU;AACvC,MAAA,MAAM,IAAIvB,6BAAsB,+BAA+B,CAAA;AAAA,IACjE;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF,CAAA;AArBa,WAAA,GAAN,eAAA,CAAA;AAAA,EADNC,iBAAAA,EAAW;AAAA,EAGP,eAAA,CAAA,CAAA,EAAAY,cAAO,mBAAmB,CAAA,CAAA;AAAA,EAE1B,eAAA,CAAA,CAAA,EAAAA,cAAO,eAAe,CAAA;AAAA,CAAA,EAJd,WAAA,CAAA;;;ACQb,SAAS,oBAAoB,OAAA,EAAwC;AACnE,EAAA,OAAO;AAAA,IACL;AAAA,MACE,OAAA,EAAS,mBAAA;AAAA,MACT,QAAA,EAAU;AAAA,KACZ;AAAA,IACA;AAAA,MACE,OAAA,EAAS,UAAA;AAAA,MACT,MAAA,EAAQ,CAAC,mBAAmB,CAAA;AAAA,MAC5B,UAAA,EAAY,CAAC,IAAA,KAA4B;AACvC,QAAA,MAAM,UAAA,GAAa,KAAK,KAAA,IAASX,wBAAA;AACjC,QAAA,OAAO,IAAI,UAAA,EAAW;AAAA,MACxB;AAAA,KACF;AAAA,IACAO,mBAAA;AAAA,IACAJ,oBAAA;AAAA,IACA,WAAA;AAAA,IACAP;AAAA,GACF;AACF;AAEA,SAAS,iBAAA,GAAmC;AAC1C,EAAA,OAAO;AAAA,IACL0B,uBAAA,CAAe,QAAA,CAAS,EAAE,eAAA,EAAiB,OAAO,CAAA;AAAA,IAClDC,cAAU,aAAA,CAAc;AAAA,MACtB,MAAA,EAAQ,CAAC,mBAAmB,CAAA;AAAA,MAC5B,UAAA,EAAY,CAAC,IAAA,MACV;AAAA,QACC,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,CAAK,aAAa,IAAA;AAAK,OACnD;AAAA,KACH;AAAA,GACH;AACF;AAEA,SAAS,aAAa,WAAA,EAAsC;AAC1D,EAAA,MAAM,MAAA,GAAwB,CAAC,GAAG,iBAAA,EAAmB,CAAA;AACrD,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAA,CAAO,OAAA,CAAQ,GAAI,WAA6B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,MAAA;AACT;AAGaC,qBAAN,gBAAA,CAAiB;AAAA,EACtB,OAAO,QAAQ,OAAA,EAA2C;AACxD,IAAA,OAAO;AAAA,MACL,MAAA,EAAQA,kBAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,SAAS,iBAAA,EAAkB;AAAA,MAC3B,WAAA,EAAa,CAAC,cAAc,CAAA;AAAA,MAC5B,SAAA,EAAW,oBAAoB,OAAO,CAAA;AAAA,MACtC,OAAA,EAAS;AAAA,QACP,mBAAA;AAAA,QACA,UAAA;AAAA,QACAjB,mBAAA;AAAA,QACAJ,oBAAA;AAAA,QACAP,oBAAA;AAAA,QACA2B,aAAA;AAAA,QACAD;AAAA;AACF,KACF;AAAA,EACF;AAAA,EAEA,OAAO,aAAa,OAAA,EAAgD;AAClE,IAAA,OAAO;AAAA,MACL,MAAA,EAAQE,kBAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,OAAA,EAAS,YAAA,CAAa,OAAA,CAAQ,OAAO,CAAA;AAAA,MACrC,WAAA,EAAa,CAAC,cAAc,CAAA;AAAA,MAC5B,SAAA,EAAW;AAAA,QACT;AAAA,UACE,OAAA,EAAS,mBAAA;AAAA,UACT,MAAA,EAAS,OAAA,CAAQ,MAAA,IAAU,EAAC;AAAA,UAC5B,YAAY,OAAA,CAAQ;AAAA,SACtB;AAAA,QACA;AAAA,UACE,OAAA,EAAS,UAAA;AAAA,UACT,MAAA,EAAQ,CAAC,mBAAmB,CAAA;AAAA,UAC5B,UAAA,EAAY,CAAC,IAAA,KAA4B;AACvC,YAAA,MAAM,UAAA,GAAa,KAAK,KAAA,IAASxB,wBAAA;AACjC,YAAA,OAAO,IAAI,UAAA,EAAW;AAAA,UACxB;AAAA,SACF;AAAA,QACAO,mBAAA;AAAA,QACAJ,oBAAA;AAAA,QACA,WAAA;AAAA,QACAP;AAAA,OACF;AAAA,MACA,OAAA,EAAS;AAAA,QACP,mBAAA;AAAA,QACA,UAAA;AAAA,QACAW,mBAAA;AAAA,QACAJ,oBAAA;AAAA,QACAP,oBAAA;AAAA,QACA2B,aAAA;AAAA,QACAD;AAAA;AACF,KACF;AAAA,EACF;AACF;AAxDaE,kBAAA,GAAN,eAAA,CAAA;AAAA,EADNC,aAAA,CAAO,EAAE;AAAA,CAAA,EACGD,kBAAA,CAAA;;;AC9DN,IAAM,gBAAN,MAAoB;AAG3B;ACDO,IAAM,oBAAN,MAAwB;AAG/B;AADE,eAAA,CAAA;AAAA,EADCE,sBAAA;AAAQ,CAAA,EADE,iBAAA,CAEX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;ACFK,IAAM,WAAN,MAAe;AAetB;AAXE,eAAA,CAAA;AAAA,EAHCC,yBAAA,EAAW;AAAA,EACXC,uBAAA,EAAS;AAAA,EACTC,qBAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAHH,QAAA,CAIX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCF,yBAAA,EAAW;AAAA,EACXC,uBAAA,EAAS;AAAA,EACTC,qBAAA,CAAO,GAAG,EAAE;AAAA,CAAA,EARF,QAAA,CASX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCD,uBAAA,EAAS;AAAA,EACTE,yBAAA,EAAW;AAAA,EACXD,qBAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAbH,QAAA,CAcX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;ACdK,IAAM,kBAAN,MAAsB;AAI7B;AADE,eAAA,CAAA;AAAA,EAFCD,uBAAAA,EAAS;AAAA,EACTE,yBAAAA;AAAW,CAAA,EAFD,eAAA,CAGX,SAAA,EAAA,cAAA,EAAA,CAAA,CAAA;;;ACLK,IAAM,iBAAN,MAAqB;AAE5B;ACAO,IAAM,cAAN,MAAkB;AAgBzB;AAZE,eAAA,CAAA;AAAA,EAHCH,yBAAAA,EAAW;AAAA,EACXC,uBAAAA,EAAS;AAAA,EACTC,qBAAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAHH,WAAA,CAIX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;AAMA,eAAA,CAAA;AAAA,EAJCF,yBAAAA,EAAW;AAAA,EACXC,uBAAAA,EAAS;AAAA,EACTC,qBAAAA,CAAO,GAAG,EAAE,CAAA;AAAA,EACZE,uBAAQ,mBAAmB;AAAA,CAAA,EATjB,WAAA,CAUX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCH,uBAAAA,EAAS;AAAA,EACTE,yBAAAA,EAAW;AAAA,EACXD,qBAAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAdH,WAAA,CAeX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;ACfK,IAAM,mBAAN,MAAuB;AAS9B;AANE,eAAA,CAAA;AAAA,EAFCD,uBAAAA,EAAS;AAAA,EACTE,yBAAAA;AAAW,CAAA,EAFD,gBAAA,CAGX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCF,uBAAAA,EAAS;AAAA,EACTE,yBAAAA,EAAW;AAAA,EACXD,qBAAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAPH,gBAAA,CAQX,SAAA,EAAA,aAAA,EAAA,CAAA,CAAA;ACRK,IAAM,iBAAN,MAAqB;AAI5B;AADE,eAAA,CAAA;AAAA,EAFCD,uBAAAA,EAAS;AAAA,EACTE,yBAAAA;AAAW,CAAA,EAFD,cAAA,CAGX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA","file":"index.cjs","sourcesContent":["import { createParamDecorator, type ExecutionContext } from \"@nestjs/common\";\n\nimport type { AuthJwtPayload } from \"../interfaces/jwt-payload.interface\";\n\nexport const CurrentUser = createParamDecorator(\n (_data: unknown, ctx: ExecutionContext): AuthJwtPayload => {\n const request = ctx.switchToHttp().getRequest<{ user: AuthJwtPayload }>();\n return request.user;\n },\n);\n","import { Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { AuthGuard } from \"@nestjs/passport\";\n\n@Injectable()\nexport class JwtAuthGuard extends AuthGuard(\"jwt\") {\n handleRequest<TUser>(\n err: Error | null,\n user: TUser,\n _info: unknown,\n ): TUser {\n // Passport returns `false` (not null) when no/invalid token.\n if (err != null || !user) {\n throw err ?? new UnauthorizedException();\n }\n return user;\n }\n}\n","/** String tokens — stable across tsup entry points (index + mongo). */\nexport const AUTH_MODULE_OPTIONS = \"AUTH_MODULE_OPTIONS\";\nexport const AUTH_HOOKS = \"AUTH_HOOKS\";\nexport const AUTH_REPOSITORY = \"AUTH_REPOSITORY\";\n","import { Injectable } from \"@nestjs/common\";\n\nimport type {\n AuthHooks,\n BaseAuthAccount,\n RegisterInput,\n} from \"../interfaces/auth-hooks.interface\";\n\n@Injectable()\nexport class DefaultAuthHooks implements AuthHooks {\n async buildJwtPayload(\n account: BaseAuthAccount,\n ): Promise<Record<string, unknown>> {\n return {\n sub: account.id,\n ...(account.email != null ? { email: account.email } : {}),\n ...(account.username != null ? { username: account.username } : {}),\n };\n }\n\n async enrichMe(account: BaseAuthAccount): Promise<Record<string, unknown>> {\n return {\n id: account.id,\n email: account.email,\n username: account.username,\n emailVerified: account.emailVerified,\n disabled: account.disabled,\n };\n }\n\n async onBeforeRegister(_input: RegisterInput): Promise<void> {\n return;\n }\n\n async onAfterRegister(_account: BaseAuthAccount): Promise<void> {\n return;\n }\n\n async onAfterLogin(_account: BaseAuthAccount): Promise<void> {\n return;\n }\n}\n","export function isDuplicateKeyError(error: unknown): boolean {\n return (\n !!error &&\n typeof error === \"object\" &&\n \"code\" in error &&\n (error as { code: number }).code === 11000\n );\n}\n","import type { AuthIdentifierField } from \"../interfaces/auth-config.interface\";\nimport type { BaseAuthAccount, RegisterInput } from \"../interfaces/auth-hooks.interface\";\n\nexport function normalizeIdentifier(value: string): string {\n return value.trim().toLowerCase();\n}\n\nexport function resolveRegisterIdentifier(\n input: RegisterInput,\n field: AuthIdentifierField,\n): string {\n const value = field === \"email\" ? input.email : input.username;\n if (value == null || value.trim() === \"\") {\n throw new Error(`Register input requires ${field}`);\n }\n return normalizeIdentifier(value);\n}\n\nexport function readAccountIdentifier(\n account: BaseAuthAccount,\n field: AuthIdentifierField,\n): string | undefined {\n const value = field === \"email\" ? account.email : account.username;\n return value != null ? normalizeIdentifier(value) : undefined;\n}\n","import { createHash, randomBytes } from \"crypto\";\n\nexport function generateRawToken(byteLength = 32): string {\n return randomBytes(byteLength).toString(\"hex\");\n}\n\nexport function hashToken(token: string): string {\n return createHash(\"sha256\").update(token).digest(\"hex\");\n}\n\nexport function expiresAtFromTtlMs(ttlMs: number): Date {\n return new Date(Date.now() + ttlMs);\n}\n\n/** Default: 24 hours */\nexport const DEFAULT_EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1000;\n\n/** Default: 15 minutes */\nexport const DEFAULT_PASSWORD_RESET_TTL_MS = 15 * 60 * 1000;\n","import { Inject, Injectable } from \"@nestjs/common\";\nimport { JwtService, type JwtSignOptions } from \"@nestjs/jwt\";\nimport * as bcrypt from \"bcryptjs\";\n\nimport { AUTH_MODULE_OPTIONS } from \"../constants/tokens\";\nimport type { AuthModuleOptions } from \"../interfaces/auth-config.interface\";\nimport type { AuthTokens } from \"../interfaces/auth-hooks.interface\";\nimport type { AuthJwtPayload } from \"../interfaces/jwt-payload.interface\";\n\n@Injectable()\nexport class TokenService {\n constructor(\n @Inject(JwtService)\n private readonly jwtService: JwtService,\n @Inject(AUTH_MODULE_OPTIONS)\n private readonly options: AuthModuleOptions,\n ) {}\n\n async signTokens(payload: AuthJwtPayload): Promise<AuthTokens> {\n const accessExpiresIn = this.options.expiresIn ?? \"1h\";\n const refreshExpiresIn = this.options.refreshExpiresIn ?? \"7d\";\n\n const [accessToken, refreshToken] = await Promise.all([\n this.jwtService.signAsync(\n payload as Record<string, unknown>,\n {\n secret: this.options.secret,\n expiresIn: accessExpiresIn,\n } as JwtSignOptions,\n ),\n this.jwtService.signAsync(\n payload as Record<string, unknown>,\n {\n secret: this.options.refreshSecret,\n expiresIn: refreshExpiresIn,\n } as JwtSignOptions,\n ),\n ]);\n\n return { accessToken, refreshToken };\n }\n\n async verifyRefreshToken(refreshToken: string): Promise<AuthJwtPayload> {\n return this.jwtService.verifyAsync<AuthJwtPayload>(refreshToken, {\n secret: this.options.refreshSecret,\n });\n }\n\n async hashRefreshToken(refreshToken: string): Promise<string> {\n return bcrypt.hash(refreshToken, 10);\n }\n\n async compareRefreshToken(\n refreshToken: string,\n hash: string,\n ): Promise<boolean> {\n return bcrypt.compare(refreshToken, hash);\n }\n}\n","import {\n BadRequestException,\n Inject,\n Injectable,\n NotFoundException,\n UnauthorizedException,\n} from \"@nestjs/common\";\nimport * as bcrypt from \"bcryptjs\";\n\nimport {\n AUTH_HOOKS,\n AUTH_MODULE_OPTIONS,\n AUTH_REPOSITORY,\n} from \"../constants/tokens\";\nimport type { LoginDto } from \"../dto/login.dto\";\nimport type { RegisterDto } from \"../dto/register.dto\";\nimport { DefaultAuthHooks } from \"../hooks/default-auth.hooks\";\nimport type { AuthModuleOptions } from \"../interfaces/auth-config.interface\";\nimport type {\n AuthHooks,\n AuthTokens,\n BaseAuthAccount,\n RegisterInput,\n} from \"../interfaces/auth-hooks.interface\";\nimport type { IAuthRepository } from \"../interfaces/auth-repository.interface\";\nimport { isDuplicateKeyError } from \"../utils/duplicate-key.util\";\nimport {\n normalizeIdentifier,\n readAccountIdentifier,\n resolveRegisterIdentifier,\n} from \"../utils/identifier.util\";\nimport {\n DEFAULT_EMAIL_VERIFICATION_TTL_MS,\n DEFAULT_PASSWORD_RESET_TTL_MS,\n expiresAtFromTtlMs,\n generateRawToken,\n hashToken,\n} from \"../utils/token.util\";\nimport { TokenService } from \"./token.service\";\n\n@Injectable()\nexport class AuthService {\n constructor(\n @Inject(AUTH_REPOSITORY)\n private readonly authRepository: IAuthRepository,\n @Inject(AUTH_MODULE_OPTIONS)\n private readonly options: AuthModuleOptions,\n @Inject(AUTH_HOOKS)\n private readonly hooks: AuthHooks,\n @Inject(TokenService)\n private readonly tokenService: TokenService,\n ) {}\n\n private get identifierField() {\n return this.options.identifierField ?? \"email\";\n }\n\n private get emailVerificationEnabled() {\n return this.options.features?.emailVerification === true;\n }\n\n private get passwordResetEnabled() {\n return this.options.features?.passwordReset === true;\n }\n\n private get rotateRefreshToken() {\n return this.options.features?.refreshTokenRotation !== false;\n }\n\n private resolveLoginIdentifier(dto: LoginDto): string {\n const value =\n this.identifierField === \"email\" ? dto.email : dto.username;\n if (value == null || value.trim() === \"\") {\n throw new BadRequestException(\n `${this.identifierField} is required for login`,\n );\n }\n return normalizeIdentifier(value);\n }\n\n async register(dto: RegisterDto): Promise<{ registered: true }> {\n this.assertEmailHookWhenVerificationEnabled();\n\n const input: RegisterInput = { password: dto.password };\n if (dto.email != null) input.email = dto.email;\n if (dto.username != null) input.username = dto.username;\n\n await this.hooks.onBeforeRegister?.(input);\n\n resolveRegisterIdentifier(input, this.identifierField);\n this.assertRegisterEmailWhenVerificationEnabled(input);\n\n const passwordHash = await bcrypt.hash(dto.password, 10);\n\n try {\n const account = await this.authRepository.create({\n ...input,\n passwordHash,\n emailVerified: !this.emailVerificationEnabled,\n });\n\n await this.hooks.onAfterRegister?.(account);\n\n if (this.emailVerificationEnabled) {\n await this.sendVerificationEmail(account);\n }\n } catch (error) {\n if (isDuplicateKeyError(error)) {\n throw new UnauthorizedException(`${this.identifierField} already exists`);\n }\n throw error;\n }\n\n return { registered: true };\n }\n\n async login(dto: LoginDto): Promise<AuthTokens> {\n const identifier = this.resolveLoginIdentifier(dto);\n const account = await this.authRepository.findByIdentifierWithSecrets(\n identifier,\n );\n\n if (account?.passwordHash == null) {\n throw new UnauthorizedException(\"Invalid credentials\");\n }\n\n this.assertAccountActive(account);\n\n const passwordMatches = await bcrypt.compare(\n dto.password,\n account.passwordHash,\n );\n if (!passwordMatches) {\n throw new UnauthorizedException(\"Invalid credentials\");\n }\n\n return this.issueTokens(account);\n }\n\n async refresh(refreshToken: string): Promise<AuthTokens> {\n let payload;\n try {\n payload = await this.tokenService.verifyRefreshToken(refreshToken);\n } catch {\n throw new UnauthorizedException(\"Invalid refresh token\");\n }\n\n const account = await this.authRepository.findByIdWithSecrets(payload.sub);\n if (account?.refreshTokenHash == null) {\n throw new UnauthorizedException(\"Invalid refresh token\");\n }\n\n this.assertAccountActive(account);\n\n const tokenMatches = await this.tokenService.compareRefreshToken(\n refreshToken,\n account.refreshTokenHash,\n );\n if (!tokenMatches) {\n throw new UnauthorizedException(\"Invalid refresh token\");\n }\n\n return this.issueTokens(account);\n }\n\n async logout(authId: string): Promise<{ loggedOut: true }> {\n await this.authRepository.updateRefreshTokenHash(authId, null);\n return { loggedOut: true };\n }\n\n async me(authId: string): Promise<Record<string, unknown>> {\n const account = await this.authRepository.findById(authId);\n if (account == null) {\n throw new UnauthorizedException(\"Account not found\");\n }\n\n if (this.hooks.enrichMe != null) {\n return this.hooks.enrichMe(account);\n }\n\n return new DefaultAuthHooks().enrichMe(account);\n }\n\n async verifyEmail(token: string): Promise<{ verified: true }> {\n this.assertEmailVerificationEnabled();\n\n const tokenHash = hashToken(token);\n const account =\n await this.authRepository.findByEmailVerificationTokenHash(tokenHash);\n if (account == null) {\n throw new BadRequestException(\"TOKEN_INVALID_OR_EXPIRED\");\n }\n\n await this.authRepository.markEmailVerified(account.id);\n return { verified: true };\n }\n\n async forgotPassword(email: string): Promise<{ sent: true }> {\n this.assertPasswordResetEnabled();\n this.assertEmailHookWhenPasswordResetEnabled();\n\n const normalizedEmail = normalizeIdentifier(email);\n const account = await this.authRepository.findByEmail(normalizedEmail);\n\n if (account != null) {\n const rawToken = generateRawToken();\n const tokenHash = hashToken(rawToken);\n const expiresAt = expiresAtFromTtlMs(\n this.options.passwordResetTokenTtlMs ?? DEFAULT_PASSWORD_RESET_TTL_MS,\n );\n\n await this.authRepository.setResetToken(account.id, tokenHash, expiresAt);\n await this.hooks.sendEmail!(\"reset\", normalizedEmail, rawToken);\n }\n\n return { sent: true };\n }\n\n async resetPassword(\n token: string,\n newPassword: string,\n ): Promise<{ reset: true }> {\n this.assertPasswordResetEnabled();\n\n const tokenHash = hashToken(token);\n const account = await this.authRepository.findByResetTokenHash(tokenHash);\n if (account == null) {\n throw new BadRequestException(\"TOKEN_INVALID_OR_EXPIRED\");\n }\n\n const passwordHash = await bcrypt.hash(newPassword, 10);\n await this.authRepository.updatePasswordHash(account.id, passwordHash);\n await this.authRepository.clearResetToken(account.id);\n await this.authRepository.updateRefreshTokenHash(account.id, null);\n\n return { reset: true };\n }\n\n private assertAccountActive(account: BaseAuthAccount): void {\n if (account.disabled) {\n throw new UnauthorizedException(\"ACCOUNT_DISABLED\");\n }\n\n if (this.emailVerificationEnabled && !account.emailVerified) {\n throw new UnauthorizedException(\"EMAIL_NOT_VERIFIED\");\n }\n }\n\n private async issueTokens(account: BaseAuthAccount): Promise<AuthTokens> {\n const payload = await this.hooks.buildJwtPayload(account);\n const tokens = await this.tokenService.signTokens({\n ...payload,\n sub: account.id,\n });\n\n if (this.rotateRefreshToken) {\n const refreshTokenHash = await this.tokenService.hashRefreshToken(\n tokens.refreshToken,\n );\n await this.authRepository.updateRefreshTokenHash(\n account.id,\n refreshTokenHash,\n );\n }\n\n await this.hooks.onAfterLogin?.(account);\n return tokens;\n }\n\n private async sendVerificationEmail(account: BaseAuthAccount): Promise<void> {\n const email = this.resolveAccountEmail(account);\n if (email == null) return;\n\n const rawToken = generateRawToken();\n const tokenHash = hashToken(rawToken);\n const expiresAt = expiresAtFromTtlMs(\n this.options.emailVerificationTokenTtlMs ??\n DEFAULT_EMAIL_VERIFICATION_TTL_MS,\n );\n\n await this.authRepository.setEmailVerificationToken(\n account.id,\n tokenHash,\n expiresAt,\n );\n await this.hooks.sendEmail!(\"verify\", email, rawToken);\n }\n\n private resolveAccountEmail(account: BaseAuthAccount): string | null {\n if (account.email != null && account.email.trim() !== \"\") {\n return normalizeIdentifier(account.email);\n }\n return null;\n }\n\n private assertRegisterEmailWhenVerificationEnabled(input: RegisterInput): void {\n if (!this.emailVerificationEnabled) return;\n\n const email =\n this.identifierField === \"email\"\n ? resolveRegisterIdentifier(input, \"email\")\n : input.email != null\n ? normalizeIdentifier(input.email)\n : null;\n\n if (email == null || email.trim() === \"\") {\n throw new BadRequestException(\n \"email is required when emailVerification feature is enabled\",\n );\n }\n }\n\n private assertEmailHookWhenVerificationEnabled(): void {\n if (this.emailVerificationEnabled && this.hooks.sendEmail == null) {\n throw new BadRequestException(\n \"emailVerification is enabled but AuthHooks.sendEmail is not implemented\",\n );\n }\n }\n\n private assertEmailHookWhenPasswordResetEnabled(): void {\n if (this.passwordResetEnabled && this.hooks.sendEmail == null) {\n throw new BadRequestException(\n \"passwordReset is enabled but AuthHooks.sendEmail is not implemented\",\n );\n }\n }\n\n private assertEmailVerificationEnabled(): void {\n if (!this.emailVerificationEnabled) {\n throw new NotFoundException();\n }\n }\n\n private assertPasswordResetEnabled(): void {\n if (!this.passwordResetEnabled) {\n throw new NotFoundException();\n }\n }\n\n getIdentifierForAccount(account: BaseAuthAccount): string | undefined {\n return readAccountIdentifier(account, this.identifierField);\n }\n}\n","import {\n Body,\n Controller,\n Get,\n HttpCode,\n HttpStatus,\n Inject,\n Post,\n UseGuards,\n} from \"@nestjs/common\";\n\nimport { AuthTokensDto } from \"../dto/auth-tokens.dto\";\nimport { ForgotPasswordDto } from \"../dto/forgot-password.dto\";\nimport { LoginDto } from \"../dto/login.dto\";\nimport { RefreshTokenDto } from \"../dto/refresh-token.dto\";\nimport { RegisterAckDto } from \"../dto/register-ack.dto\";\nimport { RegisterDto } from \"../dto/register.dto\";\nimport { ResetPasswordDto } from \"../dto/reset-password.dto\";\nimport { VerifyEmailDto } from \"../dto/verify-email.dto\";\nimport { CurrentUser } from \"../decorators/current-user.decorator\";\nimport { JwtAuthGuard } from \"../guards/jwt-auth.guard\";\nimport type { AuthJwtPayload } from \"../interfaces/jwt-payload.interface\";\nimport { AuthService } from \"../services/auth.service\";\n\n@Controller(\"auth\")\nexport class AuthController {\n constructor(@Inject(AuthService) private readonly authService: AuthService) {}\n\n @Post(\"register\")\n register(@Body() dto: RegisterDto): Promise<RegisterAckDto> {\n return this.authService.register(dto);\n }\n\n @Post(\"login\")\n login(@Body() dto: LoginDto): Promise<AuthTokensDto> {\n return this.authService.login(dto);\n }\n\n @Post(\"refresh\")\n @HttpCode(HttpStatus.OK)\n refresh(@Body() dto: RefreshTokenDto): Promise<AuthTokensDto> {\n return this.authService.refresh(dto.refreshToken);\n }\n\n @Post(\"logout\")\n @UseGuards(JwtAuthGuard)\n @HttpCode(HttpStatus.OK)\n logout(@CurrentUser() user: AuthJwtPayload): Promise<{ loggedOut: true }> {\n return this.authService.logout(user.sub);\n }\n\n @Get(\"me\")\n @UseGuards(JwtAuthGuard)\n me(@CurrentUser() user: AuthJwtPayload): Promise<Record<string, unknown>> {\n return this.authService.me(user.sub);\n }\n\n /** Available only when `features.emailVerification` is enabled. */\n @Post(\"verify-email\")\n @HttpCode(HttpStatus.OK)\n verifyEmail(@Body() dto: VerifyEmailDto): Promise<{ verified: true }> {\n return this.authService.verifyEmail(dto.token);\n }\n\n /** Available only when `features.passwordReset` is enabled. */\n @Post(\"forgot-password\")\n @HttpCode(HttpStatus.OK)\n forgotPassword(@Body() dto: ForgotPasswordDto): Promise<{ sent: true }> {\n return this.authService.forgotPassword(dto.email);\n }\n\n /** Available only when `features.passwordReset` is enabled. */\n @Post(\"reset-password\")\n @HttpCode(HttpStatus.OK)\n resetPassword(@Body() dto: ResetPasswordDto): Promise<{ reset: true }> {\n return this.authService.resetPassword(dto.token, dto.newPassword);\n }\n}\n","import { Inject, Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { PassportStrategy } from \"@nestjs/passport\";\nimport { ExtractJwt, Strategy } from \"passport-jwt\";\n\nimport { AUTH_MODULE_OPTIONS, AUTH_REPOSITORY } from \"../constants/tokens\";\nimport type { AuthModuleOptions } from \"../interfaces/auth-config.interface\";\nimport type { IAuthRepository } from \"../interfaces/auth-repository.interface\";\nimport type { AuthJwtPayload } from \"../interfaces/jwt-payload.interface\";\n\n@Injectable()\nexport class JwtStrategy extends PassportStrategy(Strategy) {\n constructor(\n @Inject(AUTH_MODULE_OPTIONS)\n options: AuthModuleOptions,\n @Inject(AUTH_REPOSITORY)\n private readonly authRepository: IAuthRepository,\n ) {\n super({\n jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),\n ignoreExpiration: false,\n secretOrKey: options.secret,\n });\n }\n\n async validate(payload: AuthJwtPayload): Promise<AuthJwtPayload> {\n const account = await this.authRepository.findById(payload.sub);\n if (account == null || account.disabled) {\n throw new UnauthorizedException(\"Account not found or inactive\");\n }\n return payload;\n }\n}\n","import { DynamicModule, Module, Provider } from \"@nestjs/common\";\nimport { JwtModule, type JwtModuleOptions } from \"@nestjs/jwt\";\nimport { PassportModule } from \"@nestjs/passport\";\n\nimport { AuthController } from \"./controllers/auth.controller\";\nimport { AUTH_HOOKS, AUTH_MODULE_OPTIONS } from \"./constants/tokens\";\nimport { DefaultAuthHooks } from \"./hooks/default-auth.hooks\";\nimport type {\n AuthModuleAsyncOptions,\n AuthModuleOptions,\n} from \"./interfaces/auth-config.interface\";\nimport { AuthService } from \"./services/auth.service\";\nimport { TokenService } from \"./services/token.service\";\nimport { JwtAuthGuard } from \"./guards/jwt-auth.guard\";\nimport { JwtStrategy } from \"./strategies/jwt.strategy\";\n\ntype ModuleImports = NonNullable<DynamicModule[\"imports\"]>;\n\nfunction createAuthProviders(options: AuthModuleOptions): Provider[] {\n return [\n {\n provide: AUTH_MODULE_OPTIONS,\n useValue: options,\n },\n {\n provide: AUTH_HOOKS,\n inject: [AUTH_MODULE_OPTIONS],\n useFactory: (opts: AuthModuleOptions) => {\n const HooksClass = opts.hooks ?? DefaultAuthHooks;\n return new HooksClass();\n },\n },\n AuthService,\n TokenService,\n JwtStrategy,\n JwtAuthGuard,\n ];\n}\n\nfunction createAuthImports(): ModuleImports {\n return [\n PassportModule.register({ defaultStrategy: \"jwt\" }),\n JwtModule.registerAsync({\n inject: [AUTH_MODULE_OPTIONS],\n useFactory: (opts: AuthModuleOptions) =>\n ({\n secret: opts.secret,\n signOptions: { expiresIn: opts.expiresIn ?? \"1h\" },\n }) as JwtModuleOptions,\n }),\n ];\n}\n\nfunction mergeImports(userImports?: unknown): ModuleImports {\n const merged: ModuleImports = [...createAuthImports()];\n if (userImports != null) {\n merged.unshift(...(userImports as ModuleImports));\n }\n return merged;\n}\n\n@Module({})\nexport class AuthModule {\n static forRoot(options: AuthModuleOptions): DynamicModule {\n return {\n module: AuthModule,\n global: true,\n imports: createAuthImports(),\n controllers: [AuthController],\n providers: createAuthProviders(options),\n exports: [\n AUTH_MODULE_OPTIONS,\n AUTH_HOOKS,\n AuthService,\n TokenService,\n JwtAuthGuard,\n JwtModule,\n PassportModule,\n ],\n };\n }\n\n static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule {\n return {\n module: AuthModule,\n global: true,\n imports: mergeImports(options.imports),\n controllers: [AuthController],\n providers: [\n {\n provide: AUTH_MODULE_OPTIONS,\n inject: (options.inject ?? []) as never[],\n useFactory: options.useFactory,\n },\n {\n provide: AUTH_HOOKS,\n inject: [AUTH_MODULE_OPTIONS],\n useFactory: (opts: AuthModuleOptions) => {\n const HooksClass = opts.hooks ?? DefaultAuthHooks;\n return new HooksClass();\n },\n },\n AuthService,\n TokenService,\n JwtStrategy,\n JwtAuthGuard,\n ],\n exports: [\n AUTH_MODULE_OPTIONS,\n AUTH_HOOKS,\n AuthService,\n TokenService,\n JwtAuthGuard,\n JwtModule,\n PassportModule,\n ],\n };\n }\n}\n","export class AuthTokensDto {\n accessToken!: string;\n refreshToken!: string;\n}\n","import { IsEmail } from \"class-validator\";\n\nexport class ForgotPasswordDto {\n @IsEmail()\n email!: string;\n}\n","import { IsNotEmpty, IsOptional, IsString, Length } from \"class-validator\";\n\nexport class LoginDto {\n @IsOptional()\n @IsString()\n @Length(3, 255)\n email?: string;\n\n @IsOptional()\n @IsString()\n @Length(3, 50)\n username?: string;\n\n @IsString()\n @IsNotEmpty()\n @Length(8, 128)\n password!: string;\n}\n","import { IsNotEmpty, IsString } from \"class-validator\";\n\nexport class RefreshTokenDto {\n @IsString()\n @IsNotEmpty()\n refreshToken!: string;\n}\n","export class RegisterAckDto {\n registered!: true;\n}\n","import { IsNotEmpty, IsOptional, IsString, Length, Matches } from \"class-validator\";\n\nexport class RegisterDto {\n @IsOptional()\n @IsString()\n @Length(3, 255)\n email?: string;\n\n @IsOptional()\n @IsString()\n @Length(3, 50)\n @Matches(/^[a-zA-Z0-9._-]+$/)\n username?: string;\n\n @IsString()\n @IsNotEmpty()\n @Length(8, 128)\n password!: string;\n}\n","import { IsNotEmpty, IsString, Length } from \"class-validator\";\n\nexport class ResetPasswordDto {\n @IsString()\n @IsNotEmpty()\n token!: string;\n\n @IsString()\n @IsNotEmpty()\n @Length(8, 128)\n newPassword!: string;\n}\n","import { IsNotEmpty, IsString } from \"class-validator\";\n\nexport class VerifyEmailDto {\n @IsString()\n @IsNotEmpty()\n token!: string;\n}\n"]}
1
+ {"version":3,"sources":["../src/constants/rate-limit.presets.ts","../src/constants/auth-errors.ts","../src/decorators/current-user.decorator.ts","../src/guards/jwt-auth.guard.ts","../src/constants/tokens.ts","../src/constants/password.constants.ts","../src/hooks/default-auth.hooks.ts","../src/utils/duplicate-key.util.ts","../src/utils/password.util.ts","../src/utils/identifier.util.ts","../src/utils/token.util.ts","../src/services/token.service.ts","../src/services/auth.service.ts","../src/controllers/auth.controller.ts","../src/controllers/auth.controller.factory.ts","../src/strategies/jwt.strategy.ts","../src/utils/hooks-provider.util.ts","../src/utils/validate-auth-config.util.ts","../src/auth.module.ts","../src/dto/auth-tokens.dto.ts","../src/dto/change-password.dto.ts","../src/dto/forgot-password.dto.ts","../src/dto/login.dto.ts","../src/dto/refresh-token.dto.ts","../src/dto/register-ack.dto.ts","../src/dto/register.dto.ts","../src/dto/reset-password.dto.ts","../src/dto/verify-email.dto.ts"],"names":["createParamDecorator","JwtAuthGuard","AuthGuard","UnauthorizedException","Injectable","DefaultAuthHooks","BadRequestException","randomBytes","createHash","TokenService","bcrypt","hash","JwtService","AuthService","bcrypt2","NotFoundException","Inject","Post","Body","HttpCode","HttpStatus","UseGuards","Get","Controller","PassportStrategy","Strategy","ExtractJwt","ModuleRef","PassportModule","JwtModule","AuthModule","Module","IsString","IsNotEmpty","Length","IsEmail","IsOptional","ValidateIf","Matches"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYO,IAAM,uBAAA,GAA0B;AAAA;AAAA,EAErC,SAAS,EAAE,IAAA,EAAM,gBAAgB,GAAA,EAAK,GAAA,EAAQ,OAAO,EAAA,EAAG;AAAA;AAAA,EAExD,aAAa,EAAE,IAAA,EAAM,oBAAoB,GAAA,EAAK,GAAA,EAAQ,OAAO,CAAA,EAAE;AAAA;AAAA,EAE/D,eAAe,EAAE,IAAA,EAAM,uBAAuB,GAAA,EAAK,GAAA,EAAQ,OAAO,CAAA;AACpE;;;AClBO,IAAM,aAAA,GAAgB;AAAA,EAC3B,mBAAA,EAAqB,qBAAA;AAAA,EACrB,qBAAA,EAAuB,uBAAA;AAAA,EACvB,mBAAA,EAAqB,qBAAA;AAAA,EACrB,gBAAA,EAAkB,kBAAA;AAAA,EAClB,kBAAA,EAAoB,oBAAA;AAAA,EACpB,wBAAA,EAA0B,0BAAA;AAAA,EAC1B,cAAA,EAAgB,gBAAA;AAAA,EAChB,wBAAA,EAA0B,0BAAA;AAAA,EAC1B,kBAAA,EAAoB;AACtB;ACPO,IAAM,WAAA,GAAcA,2BAAA;AAAA,EACzB,CAAC,OAAgB,GAAA,KAA0C;AACzD,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,YAAA,EAAa,CAAE,UAAA,EAAqC;AACxE,IAAA,OAAO,OAAA,CAAQ,IAAA;AAAA,EACjB;AACF;ACLaC,oBAAA,GAAN,kBAAA,SAA2BC,kBAAA,CAAU,KAAK,CAAA,CAAE;AAAA,EACjD,aAAA,CACE,GAAA,EACA,IAAA,EACA,KAAA,EACO;AAEP,IAAA,IAAI,GAAA,IAAO,IAAA,IAAQ,CAAC,IAAA,EAAM;AACxB,MAAA,MAAM,GAAA,IAAO,IAAIC,4BAAA,EAAsB;AAAA,IACzC;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAZaF,oBAAA,GAAN,eAAA,CAAA;AAAA,EADNG,iBAAA;AAAW,CAAA,EACCH,oBAAA,CAAA;;;ACHN,IAAM,mBAAA,GAAsB;AAC5B,IAAM,UAAA,GAAa;AACnB,IAAM,eAAA,GAAkB;;;ACCxB,IAAM,mBAAA,GACX,8DAAA;ACIWI,2BAAN,sBAAA,CAA4C;AAAA,EACjD,MAAM,gBACJ,OAAA,EACkC;AAClC,IAAA,OAAO;AAAA,MACL,KAAK,OAAA,CAAQ,EAAA;AAAA,MACb,GAAI,QAAQ,KAAA,IAAS,IAAA,GAAO,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,MACxD,GAAI,QAAQ,QAAA,IAAY,IAAA,GAAO,EAAE,QAAA,EAAU,OAAA,CAAQ,QAAA,EAAS,GAAI;AAAC,KACnE;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,OAAA,EAA4D;AACzE,IAAA,OAAO;AAAA,MACL,IAAI,OAAA,CAAQ,EAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,GAAI,QAAQ,WAAA,IAAe,IAAA,GACvB,EAAE,WAAA,EAAa,OAAA,CAAQ,WAAA,EAAY,GACnC,EAAC;AAAA,MACL,GAAI,QAAQ,iBAAA,IAAqB,IAAA,GAC7B,EAAE,iBAAA,EAAmB,OAAA,CAAQ,iBAAA,EAAkB,GAC/C;AAAC,KACP;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,MAAA,EAAsC;AAC3D,IAAA;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,QAAA,EAA0C;AAC9D,IAAA;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,QAAA,EAA0C;AAC3D,IAAA;AAAA,EACF;AACF;AAtCaA,wBAAA,GAAN,eAAA,CAAA;AAAA,EADND,iBAAAA;AAAW,CAAA,EACCC,wBAAA,CAAA;;;ACTN,SAAS,oBAAoB,KAAA,EAAyB;AAC3D,EAAA,OACE,CAAC,CAAC,KAAA,IACF,OAAO,UAAU,QAAA,IACjB,MAAA,IAAU,KAAA,IACT,KAAA,CAA2B,IAAA,KAAS,IAAA;AAEzC;ACLA,IAAM,kBAAA,GACJ,oCAAA;AAEK,SAAS,yBAAyB,QAAA,EAAwB;AAC/D,EAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,QAAQ,CAAA,EAAG;AACtC,IAAA,MAAM,IAAIC,0BAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACF;ACNO,SAAS,oBAAoB,KAAA,EAAuB;AACzD,EAAA,OAAO,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAClC;AAEO,SAAS,yBAAA,CACd,OACA,KAAA,EACQ;AACR,EAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,OAAA,GAAU,KAAA,CAAM,QAAQ,KAAA,CAAM,QAAA;AACtD,EAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxC,IAAA,MAAM,IAAIA,0BAAAA,CAAoB,CAAA,wBAAA,EAA2B,KAAK,CAAA,CAAE,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,oBAAoB,KAAK,CAAA;AAClC;AAEO,SAAS,qBAAA,CACd,SACA,KAAA,EACoB;AACpB,EAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,OAAA,GAAU,OAAA,CAAQ,QAAQ,OAAA,CAAQ,QAAA;AAC1D,EAAA,OAAO,KAAA,IAAS,IAAA,GAAO,mBAAA,CAAoB,KAAK,CAAA,GAAI,MAAA;AACtD;ACxBO,SAAS,gBAAA,CAAiB,aAAa,EAAA,EAAY;AACxD,EAAA,OAAOC,kBAAA,CAAY,UAAU,CAAA,CAAE,QAAA,CAAS,KAAK,CAAA;AAC/C;AAEO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,OAAOC,kBAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AACxD;AAEO,SAAS,mBAAmB,KAAA,EAAqB;AACtD,EAAA,OAAO,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,KAAQ,KAAK,CAAA;AACpC;AAGO,IAAM,iCAAA,GAAoC,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAGzD,IAAM,6BAAA,GAAgC,KAAK,EAAA,GAAK,GAAA;ACTvD,IAAM,aAAA,GAAgB,OAAA;AAGTC,uBAAN,kBAAA,CAAmB;AAAA,EACxB,WAAA,CAEmB,YAEA,OAAA,EACjB;AAHiB,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAEA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAAA,EAChB;AAAA,EAEH,IAAY,YAAA,GAAuB;AACjC,IAAA,OAAO,IAAA,CAAK,QAAQ,YAAA,IAAgB,EAAA;AAAA,EACtC;AAAA,EAEA,MAAM,WAAW,OAAA,EAA8C;AAC7D,IAAA,MAAM,eAAA,GAAkB,IAAA,CAAK,OAAA,CAAQ,SAAA,IAAa,IAAA;AAClD,IAAA,MAAM,gBAAA,GAAmB,IAAA,CAAK,OAAA,CAAQ,gBAAA,IAAoB,IAAA;AAE1D,IAAA,MAAM,CAAC,WAAA,EAAa,YAAY,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,MACpD,KAAK,UAAA,CAAW,SAAA;AAAA,QACd,OAAA;AAAA,QACA;AAAA,UACE,MAAA,EAAQ,KAAK,OAAA,CAAQ,MAAA;AAAA,UACrB,SAAA,EAAW,eAAA;AAAA,UACX,SAAA,EAAW;AAAA;AACb,OACF;AAAA,MACA,KAAK,UAAA,CAAW,SAAA;AAAA,QACd,OAAA;AAAA,QACA;AAAA,UACE,MAAA,EAAQ,KAAK,OAAA,CAAQ,aAAA;AAAA,UACrB,SAAA,EAAW,gBAAA;AAAA,UACX,SAAA,EAAW;AAAA;AACb;AACF,KACD,CAAA;AAED,IAAA,OAAO,EAAE,aAAa,YAAA,EAAa;AAAA,EACrC;AAAA,EAEA,MAAM,mBAAmB,YAAA,EAA+C;AACtE,IAAA,OAAO,IAAA,CAAK,UAAA,CAAW,WAAA,CAA4B,YAAA,EAAc;AAAA,MAC/D,MAAA,EAAQ,KAAK,OAAA,CAAQ,aAAA;AAAA,MACrB,UAAA,EAAY,CAAC,aAAa;AAAA,KAC3B,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,iBAAiB,YAAA,EAAuC;AAC5D,IAAA,OAAcC,kBAAA,CAAA,IAAA,CAAK,YAAA,EAAc,IAAA,CAAK,YAAY,CAAA;AAAA,EACpD;AAAA,EAEA,MAAM,mBAAA,CACJ,YAAA,EACAC,KAAAA,EACkB;AAClB,IAAA,OAAcD,kBAAA,CAAA,OAAA,CAAQ,cAAcC,KAAI,CAAA;AAAA,EAC1C;AACF;AAvDaF,oBAAA,GAAN,eAAA,CAAA;AAAA,EADNL,iBAAAA,EAAW;AAAA,EAGP,iCAAOQ,cAAU,CAAA,CAAA;AAAA,EAEjB,iCAAO,mBAAmB,CAAA;AAAA,CAAA,EAJlBH,oBAAA,CAAA;;;ACiCAI,sBAAN,iBAAA,CAAkB;AAAA,EACvB,WAAA,CAEmB,cAAA,EAEA,OAAA,EAEA,KAAA,EAEA,YAAA,EACjB;AAPiB,IAAA,IAAA,CAAA,cAAA,GAAA,cAAA;AAEA,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAEA,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAEA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AAAA,EAChB;AAAA,EAEH,IAAY,eAAA,GAAkB;AAC5B,IAAA,OAAO,IAAA,CAAK,QAAQ,eAAA,IAAmB,OAAA;AAAA,EACzC;AAAA,EAEA,IAAY,wBAAA,GAA2B;AACrC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,iBAAA,KAAsB,IAAA;AAAA,EACtD;AAAA,EAEA,IAAY,oBAAA,GAAuB;AACjC,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,aAAA,KAAkB,IAAA;AAAA,EAClD;AAAA,EAEA,IAAY,kBAAA,GAAqB;AAC/B,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,oBAAA,KAAyB,KAAA;AAAA,EACzD;AAAA,EAEA,IAAY,YAAA,GAAuB;AACjC,IAAA,OAAO,IAAA,CAAK,QAAQ,YAAA,IAAgB,EAAA;AAAA,EACtC;AAAA,EAEA,IAAY,qBAAA,GAAiC;AAC3C,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,QAAA,EAAU,cAAA,KAAmB,IAAA;AAAA,EACnD;AAAA,EAEA,IAAY,cAAA,GAAiB;AAC3B,IAAA,OAAO,KAAK,OAAA,CAAQ,OAAA;AAAA,EACtB;AAAA,EAEQ,uBAAuB,GAAA,EAAuB;AACpD,IAAA,MAAM,QACJ,IAAA,CAAK,eAAA,KAAoB,OAAA,GAAU,GAAA,CAAI,QAAQ,GAAA,CAAI,QAAA;AACrD,IAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxC,MAAA,MAAM,IAAIP,0BAAAA;AAAA,QACR,CAAA,EAAG,KAAK,eAAe,CAAA,sBAAA;AAAA,OACzB;AAAA,IACF;AACA,IAAA,OAAO,oBAAoB,KAAK,CAAA;AAAA,EAClC;AAAA,EAEA,MAAM,SAAS,GAAA,EAAiD;AAC9D,IAAA,IAAA,CAAK,sCAAA,EAAuC;AAE5C,IAAA,MAAM,KAAA,GAAuB,EAAE,QAAA,EAAU,GAAA,CAAI,QAAA,EAAS;AACtD,IAAA,IAAI,GAAA,CAAI,KAAA,IAAS,IAAA,EAAM,KAAA,CAAM,QAAQ,GAAA,CAAI,KAAA;AACzC,IAAA,IAAI,GAAA,CAAI,QAAA,IAAY,IAAA,EAAM,KAAA,CAAM,WAAW,GAAA,CAAI,QAAA;AAE/C,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,gBAAA,GAAmB,KAAK,CAAA;AAEzC,IAAA,yBAAA,CAA0B,KAAA,EAAO,KAAK,eAAe,CAAA;AACrD,IAAA,IAAA,CAAK,2CAA2C,KAAK,CAAA;AACrD,IAAA,IAAA,CAAK,oBAAA,CAAqB,IAAI,QAAQ,CAAA;AAEtC,IAAA,MAAM,eAAe,MAAaQ,kBAAA,CAAA,IAAA,CAAK,GAAA,CAAI,QAAA,EAAU,KAAK,YAAY,CAAA;AAEtE,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,MAAA,CAAO;AAAA,QAC/C,GAAG,KAAA;AAAA,QACH,YAAA;AAAA,QACA,aAAA,EAAe,CAAC,IAAA,CAAK;AAAA,OACtB,CAAA;AAED,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,eAAA,GAAkB,OAAO,CAAA;AAE1C,MAAA,IAAI,KAAK,wBAAA,EAA0B;AACjC,QAAA,MAAM,IAAA,CAAK,sBAAsB,OAAO,CAAA;AAAA,MAC1C;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,mBAAA,CAAoB,KAAK,CAAA,EAAG;AAE9B,QAAA,OAAO,EAAE,YAAY,IAAA,EAAK;AAAA,MAC5B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,OAAO,EAAE,YAAY,IAAA,EAAK;AAAA,EAC5B;AAAA,EAEA,MAAM,MAAM,GAAA,EAAoC;AAC9C,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,sBAAA,CAAuB,GAAG,CAAA;AAClD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,2BAAA;AAAA,MACxC;AAAA,KACF;AAEA,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,IAAA,CAAK,uBAAuB,OAAO,CAAA;AAAA,IACrC;AAEA,IAAA,MAAM,YAAA,GAAe,SAAS,YAAA,IAAgB,mBAAA;AAC9C,IAAA,MAAM,eAAA,GAAkB,MAAaA,kBAAA,CAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,YAAY,CAAA;AAEvE,IAAA,IAAI,OAAA,EAAS,YAAA,IAAgB,IAAA,IAAQ,CAAC,eAAA,EAAiB;AACrD,MAAA,IAAI,OAAA,IAAW,IAAA,IAAQ,IAAA,CAAK,qBAAA,EAAuB;AACjD,QAAA,MAAM,KAAK,cAAA,CAAe,kBAAA;AAAA,UACxB,OAAA,CAAQ,EAAA;AAAA,UACR,IAAA,CAAK;AAAA,SACP;AAAA,MACF;AACA,MAAA,MAAM,IAAIX,4BAAAA,CAAsB,aAAA,CAAc,mBAAmB,CAAA;AAAA,IACnE;AAEA,IAAA,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAEhC,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,kBAAA,CAAmB,OAAA,CAAQ,EAAE,CAAA;AACvD,IAAA,OAAO,IAAA,CAAK,YAAY,OAAO,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,QAAQ,YAAA,EAA2C;AACvD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,IAAA,CAAK,YAAA,CAAa,kBAAA,CAAmB,YAAY,CAAA;AAAA,IACnE,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAIA,4BAAAA,CAAsB,aAAA,CAAc,qBAAqB,CAAA;AAAA,IACrE;AAEA,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,cAAA,CAAe,mBAAA,CAAoB,QAAQ,GAAG,CAAA;AACzE,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,IAAIA,4BAAAA,CAAsB,aAAA,CAAc,qBAAqB,CAAA;AAAA,IACrE;AAEA,IAAA,IAAA,CAAK,oBAAoB,OAAO,CAAA;AAEhC,IAAA,IAAI,KAAK,kBAAA,EAAoB;AAC3B,MAAA,IAAI,OAAA,CAAQ,oBAAoB,IAAA,EAAM;AACpC,QAAA,MAAM,IAAIA,4BAAAA,CAAsB,aAAA,CAAc,qBAAqB,CAAA;AAAA,MACrE;AAEA,MAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,YAAA,CAAa,mBAAA;AAAA,QAC3C,YAAA;AAAA,QACA,OAAA,CAAQ;AAAA,OACV;AACA,MAAA,IAAI,CAAC,YAAA,EAAc;AAEjB,QAAA,MAAM,IAAA,CAAK,cAAA,CAAe,sBAAA,CAAuB,OAAA,CAAQ,IAAI,IAAI,CAAA;AACjE,QAAA,MAAM,IAAIA,4BAAAA,CAAsB,aAAA,CAAc,mBAAmB,CAAA;AAAA,MACnE;AAAA,IACF;AAEA,IAAA,OAAO,IAAA,CAAK,YAAY,OAAO,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,OAAO,MAAA,EAA8C;AACzD,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,sBAAA,CAAuB,MAAA,EAAQ,IAAI,CAAA;AAC7D,IAAA,OAAO,EAAE,WAAW,IAAA,EAAK;AAAA,EAC3B;AAAA,EAEA,MAAM,GAAG,MAAA,EAAkD;AACzD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,SAAS,MAAM,CAAA;AACzD,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,IAAIA,6BAAsB,mBAAmB,CAAA;AAAA,IACrD;AAEA,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,QAAA,IAAY,IAAA,EAAM;AAC/B,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,QAAA,CAAS,OAAO,CAAA;AAAA,IACpC;AAEA,IAAA,OAAO,IAAIE,wBAAA,EAAiB,CAAE,QAAA,CAAS,OAAO,CAAA;AAAA,EAChD;AAAA,EAEA,MAAM,YAAY,KAAA,EAA4C;AAC5D,IAAA,IAAA,CAAK,8BAAA,EAA+B;AAEpC,IAAA,MAAM,SAAA,GAAY,UAAU,KAAK,CAAA;AACjC,IAAA,MAAM,OAAA,GACJ,MAAM,IAAA,CAAK,cAAA,CAAe,iCAAiC,SAAS,CAAA;AACtE,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,IAAIC,0BAAAA,CAAoB,aAAA,CAAc,wBAAwB,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,iBAAA,CAAkB,OAAA,CAAQ,EAAE,CAAA;AACtD,IAAA,OAAO,EAAE,UAAU,IAAA,EAAK;AAAA,EAC1B;AAAA,EAEA,MAAM,eAAe,KAAA,EAAwC;AAC3D,IAAA,IAAA,CAAK,0BAAA,EAA2B;AAChC,IAAA,IAAA,CAAK,uCAAA,EAAwC;AAE7C,IAAA,MAAM,eAAA,GAAkB,oBAAoB,KAAK,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,YAAY,eAAe,CAAA;AAErE,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,WAAW,gBAAA,EAAiB;AAClC,MAAA,MAAM,SAAA,GAAY,UAAU,QAAQ,CAAA;AACpC,MAAA,MAAM,SAAA,GAAY,kBAAA;AAAA,QAChB,IAAA,CAAK,QAAQ,uBAAA,IAA2B;AAAA,OAC1C;AAEA,MAAA,MAAM,KAAK,cAAA,CAAe,aAAA,CAAc,OAAA,CAAQ,EAAA,EAAI,WAAW,SAAS,CAAA;AACxE,MAAA,MAAM,IAAA,CAAK,KAAA,CAAM,SAAA,CAAW,OAAA,EAAS,iBAAiB,QAAQ,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AAAA,EACtB;AAAA,EAEA,MAAM,aAAA,CACJ,KAAA,EACA,WAAA,EAC0B;AAC1B,IAAA,IAAA,CAAK,0BAAA,EAA2B;AAEhC,IAAA,MAAM,SAAA,GAAY,UAAU,KAAK,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,qBAAqB,SAAS,CAAA;AACxE,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,MAAM,IAAIA,0BAAAA,CAAoB,aAAA,CAAc,wBAAwB,CAAA;AAAA,IACtE;AAEA,IAAA,IAAA,CAAK,qBAAqB,WAAW,CAAA;AAErC,IAAA,MAAM,YAAA,GAAe,MAAaQ,kBAAA,CAAA,IAAA,CAAK,WAAA,EAAa,KAAK,YAAY,CAAA;AACrE,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,kBAAA,CAAmB,OAAA,CAAQ,IAAI,YAAY,CAAA;AACrE,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,eAAA,CAAgB,OAAA,CAAQ,EAAE,CAAA;AACpD,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,sBAAA,CAAuB,OAAA,CAAQ,IAAI,IAAI,CAAA;AAEjE,IAAA,OAAO,EAAE,OAAO,IAAA,EAAK;AAAA,EACvB;AAAA,EAEA,MAAM,cAAA,CACJ,MAAA,EACA,eAAA,EACA,WAAA,EAC4B;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,cAAA,CAAe,oBAAoB,MAAM,CAAA;AACpE,IAAA,IAAI,OAAA,EAAS,gBAAgB,IAAA,EAAM;AACjC,MAAA,MAAM,IAAIX,4BAAAA,CAAsB,aAAA,CAAc,wBAAwB,CAAA;AAAA,IACxE;AAEA,IAAA,MAAM,iBAAiB,MAAaW,kBAAA,CAAA,OAAA;AAAA,MAClC,eAAA;AAAA,MACA,OAAA,CAAQ;AAAA,KACV;AACA,IAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,MAAA,MAAM,IAAIX,4BAAAA,CAAsB,aAAA,CAAc,wBAAwB,CAAA;AAAA,IACxE;AAEA,IAAA,IAAI,oBAAoB,WAAA,EAAa;AACnC,MAAA,MAAM,IAAIG,0BAAAA,CAAoB,aAAA,CAAc,kBAAkB,CAAA;AAAA,IAChE;AAEA,IAAA,IAAA,CAAK,qBAAqB,WAAW,CAAA;AAErC,IAAA,MAAM,YAAA,GAAe,MAAaQ,kBAAA,CAAA,IAAA,CAAK,WAAA,EAAa,KAAK,YAAY,CAAA;AACrE,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,kBAAA,CAAmB,OAAA,CAAQ,IAAI,YAAY,CAAA;AACrE,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe,sBAAA,CAAuB,OAAA,CAAQ,IAAI,IAAI,CAAA;AAEjE,IAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AAAA,EACzB;AAAA,EAEQ,uBAAuB,OAAA,EAAuC;AACpE,IAAA,IAAI,CAAC,IAAA,CAAK,qBAAA,IAAyB,OAAA,CAAQ,eAAe,IAAA,EAAM;AAC9D,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAA,CAAQ,WAAA,mBAAc,IAAI,IAAA,EAAK,EAAG;AACpC,MAAA,MAAM,IAAIX,4BAAAA,CAAsB,aAAA,CAAc,cAAc,CAAA;AAAA,IAC9D;AAAA,EACF;AAAA,EAEQ,oBAAoB,OAAA,EAAgC;AAC1D,IAAA,IAAI,QAAQ,QAAA,EAAU;AACpB,MAAA,MAAM,IAAIA,4BAAAA,CAAsB,aAAA,CAAc,gBAAgB,CAAA;AAAA,IAChE;AAEA,IAAA,IAAI,IAAA,CAAK,wBAAA,IAA4B,CAAC,OAAA,CAAQ,aAAA,EAAe;AAC3D,MAAA,MAAM,IAAIA,4BAAAA,CAAsB,aAAA,CAAc,kBAAkB,CAAA;AAAA,IAClE;AAAA,EACF;AAAA,EAEQ,qBAAqB,QAAA,EAAwB;AACnD,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,kBAAA,KAAuB,IAAA,EAAM;AAC5C,MAAA,wBAAA,CAAyB,QAAQ,CAAA;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAc,YAAY,OAAA,EAA+C;AACvE,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,gBAAgB,OAAO,CAAA;AACxD,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,YAAA,CAAa,UAAA,CAAW;AAAA,MAChD,GAAG,OAAA;AAAA,MACH,KAAK,OAAA,CAAQ;AAAA,KACd,CAAA;AAED,IAAA,IAAI,KAAK,kBAAA,EAAoB;AAC3B,MAAA,MAAM,gBAAA,GAAmB,MAAM,IAAA,CAAK,YAAA,CAAa,gBAAA;AAAA,QAC/C,MAAA,CAAO;AAAA,OACT;AACA,MAAA,MAAM,KAAK,cAAA,CAAe,sBAAA;AAAA,QACxB,OAAA,CAAQ,EAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,GAAe,OAAO,CAAA;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,sBAAsB,OAAA,EAAyC;AAC3E,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,mBAAA,CAAoB,OAAO,CAAA;AAC9C,IAAA,IAAI,SAAS,IAAA,EAAM;AAEnB,IAAA,MAAM,WAAW,gBAAA,EAAiB;AAClC,IAAA,MAAM,SAAA,GAAY,UAAU,QAAQ,CAAA;AACpC,IAAA,MAAM,SAAA,GAAY,kBAAA;AAAA,MAChB,IAAA,CAAK,QAAQ,2BAAA,IACX;AAAA,KACJ;AAEA,IAAA,MAAM,KAAK,cAAA,CAAe,yBAAA;AAAA,MACxB,OAAA,CAAQ,EAAA;AAAA,MACR,SAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,SAAA,CAAW,QAAA,EAAU,OAAO,QAAQ,CAAA;AAAA,EACvD;AAAA,EAEQ,oBAAoB,OAAA,EAAyC;AACnE,IAAA,IAAI,QAAQ,KAAA,IAAS,IAAA,IAAQ,QAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxD,MAAA,OAAO,mBAAA,CAAoB,QAAQ,KAAK,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEQ,2CAA2C,KAAA,EAA4B;AAC7E,IAAA,IAAI,CAAC,KAAK,wBAAA,EAA0B;AAEpC,IAAA,MAAM,KAAA,GACJ,IAAA,CAAK,eAAA,KAAoB,OAAA,GACrB,0BAA0B,KAAA,EAAO,OAAO,CAAA,GACxC,KAAA,CAAM,KAAA,IAAS,IAAA,GACb,mBAAA,CAAoB,KAAA,CAAM,KAAK,CAAA,GAC/B,IAAA;AAER,IAAA,IAAI,KAAA,IAAS,IAAA,IAAQ,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACxC,MAAA,MAAM,IAAIG,0BAAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,sCAAA,GAA+C;AACrD,IAAA,IAAI,IAAA,CAAK,wBAAA,IAA4B,IAAA,CAAK,KAAA,CAAM,aAAa,IAAA,EAAM;AACjE,MAAA,MAAM,IAAIA,0BAAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,uCAAA,GAAgD;AACtD,IAAA,IAAI,IAAA,CAAK,oBAAA,IAAwB,IAAA,CAAK,KAAA,CAAM,aAAa,IAAA,EAAM;AAC7D,MAAA,MAAM,IAAIA,0BAAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,8BAAA,GAAuC;AAC7C,IAAA,IAAI,CAAC,KAAK,wBAAA,EAA0B;AAClC,MAAA,MAAM,IAAIS,wBAAA,EAAkB;AAAA,IAC9B;AAAA,EACF;AAAA,EAEQ,0BAAA,GAAmC;AACzC,IAAA,IAAI,CAAC,KAAK,oBAAA,EAAsB;AAC9B,MAAA,MAAM,IAAIA,wBAAA,EAAkB;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,wBAAwB,OAAA,EAA8C;AACpE,IAAA,OAAO,qBAAA,CAAsB,OAAA,EAAS,IAAA,CAAK,eAAe,CAAA;AAAA,EAC5D;AACF;AA3XaF,mBAAA,GAAN,eAAA,CAAA;AAAA,EADNT,iBAAAA,EAAW;AAAA,EAGP,eAAA,CAAA,CAAA,EAAAY,cAAO,eAAe,CAAA,CAAA;AAAA,EAEtB,eAAA,CAAA,CAAA,EAAAA,cAAO,mBAAmB,CAAA,CAAA;AAAA,EAE1B,eAAA,CAAA,CAAA,EAAAA,cAAO,UAAU,CAAA,CAAA;AAAA,EAEjB,eAAA,CAAA,CAAA,EAAAA,cAAOP,oBAAY,CAAA;AAAA,CAAA,EARXI,mBAAA,CAAA;;;ACnBN,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAAkD,WAAA,EAA0B;AAA1B,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EAA2B;AAAA,EAG7E,SAAiB,GAAA,EAA2C;AAC1D,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,QAAA,CAAS,GAAG,CAAA;AAAA,EACtC;AAAA,EAGA,MAAc,GAAA,EAAuC;AACnD,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,KAAA,CAAM,GAAG,CAAA;AAAA,EACnC;AAAA,EAIA,QAAgB,GAAA,EAA8C;AAC5D,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,OAAA,CAAQ,GAAA,CAAI,YAAY,CAAA;AAAA,EAClD;AAAA,EAKA,OAAsB,IAAA,EAAoD;AACxE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA;AAAA,EACzC;AAAA,EAIA,GAAkB,IAAA,EAAwD;AACxE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,EAAA,CAAG,IAAA,CAAK,GAAG,CAAA;AAAA,EACrC;AAAA,EAKA,YAAoB,GAAA,EAAkD;AACpE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,WAAA,CAAY,GAAA,CAAI,KAAK,CAAA;AAAA,EAC/C;AAAA,EAKA,eAAuB,GAAA,EAAiD;AACtE,IAAA,OAAO,IAAA,CAAK,WAAA,CAAY,cAAA,CAAe,GAAA,CAAI,KAAK,CAAA;AAAA,EAClD;AAAA,EAKA,cAAsB,GAAA,EAAiD;AACrE,IAAA,OAAO,KAAK,WAAA,CAAY,aAAA,CAAc,GAAA,CAAI,KAAA,EAAO,IAAI,WAAW,CAAA;AAAA,EAClE;AAAA,EAKA,cAAA,CACiB,MACP,GAAA,EACoB;AAC5B,IAAA,OAAO,KAAK,WAAA,CAAY,cAAA;AAAA,MACtB,IAAA,CAAK,GAAA;AAAA,MACL,GAAA,CAAI,eAAA;AAAA,MACJ,GAAA,CAAI;AAAA,KACN;AAAA,EACF;AACF,CAAA;AA9DE,eAAA,CAAA;AAAA,EADCI,YAAK,UAAU,CAAA;AAAA,EACN,eAAA,CAAA,CAAA,EAAAC,WAAA,EAAK;AAAA,CAAA,EAJJ,cAAA,CAIX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EADCD,YAAK,OAAO,CAAA;AAAA,EACN,eAAA,CAAA,CAAA,EAAAC,WAAA,EAAK;AAAA,CAAA,EATD,cAAA,CASX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;AAMA,eAAA,CAAA;AAAA,EAFCD,YAAK,SAAS,CAAA;AAAA,EACdE,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACd,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EAfH,cAAA,CAeX,SAAA,EAAA,SAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAHCD,YAAK,QAAQ,CAAA;AAAA,EACbI,iBAAUpB,oBAAY,CAAA;AAAA,EACtBkB,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACf,eAAA,CAAA,CAAA,EAAA,WAAA,EAAY;AAAA,CAAA,EAtBT,cAAA,CAsBX,SAAA,EAAA,QAAA,EAAA,CAAA,CAAA;AAMA,eAAA,CAAA;AAAA,EAFCE,WAAI,IAAI,CAAA;AAAA,EACRD,iBAAUpB,oBAAY,CAAA;AAAA,EACnB,eAAA,CAAA,CAAA,EAAA,WAAA,EAAY;AAAA,CAAA,EA5BL,cAAA,CA4BX,SAAA,EAAA,IAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAFCgB,YAAK,cAAc,CAAA;AAAA,EACnBE,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACV,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EAnCP,cAAA,CAmCX,SAAA,EAAA,aAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAFCD,YAAK,iBAAiB,CAAA;AAAA,EACtBE,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACP,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EA1CV,cAAA,CA0CX,SAAA,EAAA,gBAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAFCD,YAAK,gBAAgB,CAAA;AAAA,EACrBE,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EACR,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EAjDT,cAAA,CAiDX,SAAA,EAAA,eAAA,EAAA,CAAA,CAAA;AAOA,eAAA,CAAA;AAAA,EAHCD,YAAK,iBAAiB,CAAA;AAAA,EACtBI,iBAAUpB,oBAAY,CAAA;AAAA,EACtBkB,eAAA,CAASC,kBAAW,EAAE,CAAA;AAAA,EAEpB,eAAA,CAAA,CAAA,EAAA,WAAA,EAAY,CAAA;AAAA,EACZ,eAAA,CAAA,CAAA,EAAAF,WAAA,EAAK;AAAA,CAAA,EA1DG,cAAA,CAwDX,SAAA,EAAA,gBAAA,EAAA,CAAA,CAAA;AAxDW,cAAA,GAAN,eAAA,CAAA;AAAA,EADNK,kBAAW,MAAM,CAAA;AAAA,EAEH,eAAA,CAAA,CAAA,EAAAP,cAAOH,mBAAW,CAAA;AAAA,CAAA,EADpB,cAAA,CAAA;;;ACtBN,SAAS,oBAAA,CAAqB,cAAc,MAAA,EAA+B;AAEhF,EAAA,IAAM,wBAAA,GAAN,cAAuC,cAAA,CAAe;AAAA,GAAC;AAAjD,EAAA,wBAAA,GAAN,eAAA,CAAA;AAAA,IADCU,kBAAW,WAAW;AAAA,GAAA,EACjB,wBAAA,CAAA;AAEN,EAAA,MAAA,CAAO,cAAA,CAAe,0BAA0B,MAAA,EAAQ;AAAA,IACtD,OAAO,CAAA,eAAA,EAAkB,WAAA,CAAY,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAC,CAAA;AAAA,GAC1D,CAAA;AAED,EAAA,OAAO,wBAAA;AACT;ACFO,IAAM,WAAA,GAAN,cAA0BC,yBAAA,CAAiBC,oBAAQ,CAAA,CAAE;AAAA,EAC1D,WAAA,CAEmB,SAEA,cAAA,EACjB;AACA,IAAA,KAAA,CAAM;AAAA,MACJ,cAAA,EAAgBC,uBAAW,2BAAA,EAA4B;AAAA,MACvD,gBAAA,EAAkB,KAAA;AAAA,MAClB,aAAa,OAAA,CAAQ,MAAA;AAAA,MACrB,UAAA,EAAY,CAAC,OAAO;AAAA,KACrB,CAAA;AATgB,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAEA,IAAA,IAAA,CAAA,cAAA,GAAA,cAAA;AAAA,EAQnB;AAAA,EAEA,MAAM,SAAS,OAAA,EAAkD;AAC/D,IAAA,MAAM,UAAU,MAAM,IAAA,CAAK,cAAA,CAAe,QAAA,CAAS,QAAQ,GAAG,CAAA;AAC9D,IAAA,IAAI,OAAA,IAAW,IAAA,IAAQ,OAAA,CAAQ,QAAA,EAAU;AACvC,MAAA,MAAM,IAAIvB,6BAAsB,+BAA+B,CAAA;AAAA,IACjE;AAEA,IAAA,IACE,KAAK,OAAA,CAAQ,QAAA,EAAU,sBAAsB,IAAA,IAC7C,CAAC,QAAQ,aAAA,EACT;AACA,MAAA,MAAM,IAAIA,4BAAAA,CAAsB,aAAA,CAAc,kBAAkB,CAAA;AAAA,IAClE;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF,CAAA;AA9Ba,WAAA,GAAN,eAAA,CAAA;AAAA,EADNC,iBAAAA,EAAW;AAAA,EAGP,eAAA,CAAA,CAAA,EAAAY,cAAO,mBAAmB,CAAA,CAAA;AAAA,EAE1B,eAAA,CAAA,CAAA,EAAAA,cAAO,eAAe,CAAA;AAAA,CAAA,EAJd,WAAA,CAAA;;;ACLN,SAAS,oBAAoB,OAAA,EAAsC;AACxE,EAAA,IAAI,OAAA,CAAQ,iBAAiB,IAAA,EAAM;AACjC,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACjB;AAEA,EAAA,MAAM,UAAA,GAAa,QAAQ,KAAA,IAASX,wBAAA;AACpC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,QAAA,EAAU;AAAA,GACZ;AACF;;;ACdA,IAAM,iBAAA,GAAoB,EAAA;AAC1B,IAAM,iBAAA,GAAoB,EAAA;AAC1B,IAAM,iBAAA,GAAoB,EAAA;AAEnB,SAAS,0BAA0B,OAAA,EAAkC;AAC1E,EAAA,IAAI,OAAA,CAAQ,MAAA,CAAO,MAAA,GAAS,iBAAA,EAAmB;AAC7C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,uCAAuC,iBAAiB,CAAA,WAAA;AAAA,KAC1D;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,CAAQ,aAAA,CAAc,MAAA,GAAS,iBAAA,EAAmB;AACpD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,8CAA8C,iBAAiB,CAAA,WAAA;AAAA,KACjE;AAAA,EACF;AAEA,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,OAAA,CAAQ,aAAA,EAAe;AAC5C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,QAAQ,YAAA,IAAgB,iBAAA;AACvC,EAAA,IAAI,MAAA,GAAS,iBAAA,IAAqB,MAAA,GAAS,iBAAA,EAAmB;AAC5D,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,yCAAA,EAA4C,iBAAiB,CAAA,KAAA,EAAQ,iBAAiB,CAAA;AAAA,KACxF;AAAA,EACF;AAEA,EAAA,IACE,OAAA,CAAQ,2BAAA,IAA+B,IAAA,IACvC,OAAA,CAAQ,8BAA8B,GAAA,EACtC;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IACE,OAAA,CAAQ,uBAAA,IAA2B,IAAA,IACnC,OAAA,CAAQ,0BAA0B,GAAA,EAClC;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACF;;;AC3BA,SAAS,oBAAoB,OAAA,EAAwC;AACnE,EAAA,yBAAA,CAA0B,OAAO,CAAA;AAEjC,EAAA,OAAO;AAAA,IACL;AAAA,MACE,OAAA,EAAS,mBAAA;AAAA,MACT,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,oBAAoB,OAAO,CAAA;AAAA,IAC3BQ,mBAAA;AAAA,IACAJ,oBAAA;AAAA,IACA,WAAA;AAAA,IACAR;AAAA,GACF;AACF;AAEA,SAAS,yBACP,OAAA,EACU;AACV,EAAA,IAAI,OAAA,CAAQ,iBAAiB,IAAA,EAAM;AACjC,IAAA,OAAO,OAAA,CAAQ,aAAA;AAAA,EACjB;AAEA,EAAA,MAAM,UAAA,GAAa,QAAQ,KAAA,IAASI,wBAAA;AAEpC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,MAAA,EAAQ,CAACsB,cAAS,CAAA;AAAA,IAClB,UAAA,EAAY,CAAC,SAAA,KACX,SAAA,CAAU,OAAO,UAA6B;AAAA,GAClD;AACF;AAEA,SAAS,iBAAA,GAAmC;AAC1C,EAAA,OAAO;AAAA,IACLC,uBAAA,CAAe,QAAA,CAAS,EAAE,eAAA,EAAiB,OAAO,CAAA;AAAA,IAClDC,cAAU,aAAA,CAAc;AAAA,MACtB,MAAA,EAAQ,CAAC,mBAAmB,CAAA;AAAA,MAC5B,UAAA,EAAY,CAAC,IAAA,MACV;AAAA,QACC,QAAQ,IAAA,CAAK,MAAA;AAAA,QACb,WAAA,EAAa;AAAA,UACX,SAAA,EAAW,KAAK,SAAA,IAAa,IAAA;AAAA,UAC7B,SAAA,EAAW;AAAA;AACb,OACF;AAAA,KACH;AAAA,GACH;AACF;AAEA,SAAS,aAAa,WAAA,EAAsC;AAC1D,EAAA,MAAM,MAAA,GAAwB,CAAC,GAAG,iBAAA,EAAmB,CAAA;AACrD,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAA,CAAO,OAAA,CAAQ,GAAI,WAA6B,CAAA;AAAA,EAClD;AACA,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,qBAAqB,OAAA,EAA6C;AACzE,EAAA,OAAO;AAAA,IACL;AAAA,MACE,OAAA,EAAS,mBAAA;AAAA,MACT,MAAA,EAAS,OAAA,CAAQ,MAAA,IAAU,EAAC;AAAA,MAC5B,UAAA,EAAY,UAAU,IAAA,KAAoB;AACxC,QAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,GAAG,IAAI,CAAA;AAC/C,QAAA,yBAAA,CAA0B,MAAM,CAAA;AAChC,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,KACF;AAAA,IACA,yBAAyB,OAAO,CAAA;AAAA,IAChChB,mBAAA;AAAA,IACAJ,oBAAA;AAAA,IACA,WAAA;AAAA,IACAR;AAAA,GACF;AACF;AAGa6B,qBAAN,gBAAA,CAAiB;AAAA,EACtB,OAAO,QAAQ,OAAA,EAA2C;AACxD,IAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,MAAA;AAE3C,IAAA,OAAO;AAAA,MACL,MAAA,EAAQA,kBAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,SAAS,iBAAA,EAAkB;AAAA,MAC3B,WAAA,EAAa,CAAC,oBAAA,CAAqB,WAAW,CAAC,CAAA;AAAA,MAC/C,SAAA,EAAW,oBAAoB,OAAO,CAAA;AAAA,MACtC,OAAA,EAAS;AAAA,QACP,mBAAA;AAAA,QACA,UAAA;AAAA,QACAjB,mBAAA;AAAA,QACAJ,oBAAA;AAAA,QACAR,oBAAA;AAAA,QACA4B,aAAA;AAAA,QACAD;AAAA;AACF,KACF;AAAA,EACF;AAAA,EAEA,OAAO,aAAa,OAAA,EAAgD;AAClE,IAAA,MAAM,WAAA,GAAc,QAAQ,WAAA,IAAe,MAAA;AAE3C,IAAA,OAAO;AAAA,MACL,MAAA,EAAQE,kBAAA;AAAA,MACR,MAAA,EAAQ,IAAA;AAAA,MACR,OAAA,EAAS,YAAA,CAAa,OAAA,CAAQ,OAAO,CAAA;AAAA,MACrC,WAAA,EAAa,CAAC,oBAAA,CAAqB,WAAW,CAAC,CAAA;AAAA,MAC/C,SAAA,EAAW,qBAAqB,OAAO,CAAA;AAAA,MACvC,OAAA,EAAS;AAAA,QACP,mBAAA;AAAA,QACA,UAAA;AAAA,QACAjB,mBAAA;AAAA,QACAJ,oBAAA;AAAA,QACAR,oBAAA;AAAA,QACA4B,aAAA;AAAA,QACAD;AAAA;AACF,KACF;AAAA,EACF;AACF;AA1CaE,kBAAA,GAAN,eAAA,CAAA;AAAA,EADNC,aAAA,CAAO,EAAE;AAAA,CAAA,EACGD,kBAAA,CAAA;;;ACpGN,IAAM,gBAAN,MAAoB;AAG3B;ACDO,IAAM,oBAAN,MAAwB;AAS/B;AANE,eAAA,CAAA;AAAA,EAFCE,uBAAA,EAAS;AAAA,EACTC,yBAAA;AAAW,CAAA,EAFD,iBAAA,CAGX,SAAA,EAAA,iBAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCD,uBAAA,EAAS;AAAA,EACTC,yBAAA,EAAW;AAAA,EACXC,qBAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAPH,iBAAA,CAQX,SAAA,EAAA,aAAA,EAAA,CAAA,CAAA;ACRK,IAAM,oBAAN,MAAwB;AAG/B;AADE,eAAA,CAAA;AAAA,EADCC,sBAAA;AAAQ,CAAA,EADE,iBAAA,CAEX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;ACFK,IAAM,WAAN,MAAe;AAgBtB;AAXE,eAAA,CAAA;AAAA,EAJCC,yBAAA,EAAW;AAAA,EACXC,yBAAA,CAAW,CAAC,GAAA,KAAkB,GAAA,CAAI,KAAA,IAAS,QAAQ,GAAA,CAAI,KAAA,CAAM,IAAA,EAAK,KAAM,EAAE,CAAA;AAAA,EAC1EF,sBAAAA,EAAQ;AAAA,EACRD,qBAAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAJH,QAAA,CAKX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCE,yBAAA,EAAW;AAAA,EACXJ,uBAAAA,EAAS;AAAA,EACTE,qBAAAA,CAAO,GAAG,EAAE;AAAA,CAAA,EATF,QAAA,CAUX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCF,uBAAAA,EAAS;AAAA,EACTC,yBAAAA,EAAW;AAAA,EACXC,qBAAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAdH,QAAA,CAeX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;ACfK,IAAM,kBAAN,MAAsB;AAI7B;AADE,eAAA,CAAA;AAAA,EAFCF,uBAAAA,EAAS;AAAA,EACTC,yBAAAA;AAAW,CAAA,EAFD,eAAA,CAGX,SAAA,EAAA,cAAA,EAAA,CAAA,CAAA;;;ACLK,IAAM,iBAAN,MAAqB;AAE5B;ACAO,IAAM,cAAN,MAAkB;AAiBzB;AAZE,eAAA,CAAA;AAAA,EAJCG,yBAAAA,EAAW;AAAA,EACXC,yBAAAA,CAAW,CAAC,GAAA,KAAqB,GAAA,CAAI,KAAA,IAAS,QAAQ,GAAA,CAAI,KAAA,CAAM,IAAA,EAAK,KAAM,EAAE,CAAA;AAAA,EAC7EF,sBAAAA,EAAQ;AAAA,EACRD,qBAAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAJH,WAAA,CAKX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;AAMA,eAAA,CAAA;AAAA,EAJCE,yBAAAA,EAAW;AAAA,EACXJ,uBAAAA,EAAS;AAAA,EACTE,qBAAAA,CAAO,GAAG,EAAE,CAAA;AAAA,EACZI,uBAAQ,mBAAmB;AAAA,CAAA,EAVjB,WAAA,CAWX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCN,uBAAAA,EAAS;AAAA,EACTC,yBAAAA,EAAW;AAAA,EACXC,qBAAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAfH,WAAA,CAgBX,SAAA,EAAA,UAAA,EAAA,CAAA,CAAA;AChBK,IAAM,mBAAN,MAAuB;AAS9B;AANE,eAAA,CAAA;AAAA,EAFCF,uBAAAA,EAAS;AAAA,EACTC,yBAAAA;AAAW,CAAA,EAFD,gBAAA,CAGX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA;AAKA,eAAA,CAAA;AAAA,EAHCD,uBAAAA,EAAS;AAAA,EACTC,yBAAAA,EAAW;AAAA,EACXC,qBAAAA,CAAO,GAAG,GAAG;AAAA,CAAA,EAPH,gBAAA,CAQX,SAAA,EAAA,aAAA,EAAA,CAAA,CAAA;ACRK,IAAM,iBAAN,MAAqB;AAI5B;AADE,eAAA,CAAA;AAAA,EAFCF,uBAAAA,EAAS;AAAA,EACTC,yBAAAA;AAAW,CAAA,EAFD,cAAA,CAGX,SAAA,EAAA,OAAA,EAAA,CAAA,CAAA","file":"index.cjs","sourcesContent":["/**\n * Recommended @nestjs/throttler settings for auth endpoints.\n * Apply in the consumer app — this library does not bundle ThrottlerModule.\n *\n * @example\n * ```typescript\n * import { ThrottlerModule } from \"@nestjs/throttler\";\n * import { AUTH_RATE_LIMIT_PRESETS } from \"@aranzatech/aranza-auth\";\n *\n * ThrottlerModule.forRoot([AUTH_RATE_LIMIT_PRESETS.default])\n * ```\n */\nexport const AUTH_RATE_LIMIT_PRESETS = {\n /** General auth routes: 10 requests / minute / IP */\n default: { name: \"auth-default\", ttl: 60_000, limit: 10 },\n /** Login, register, refresh: 5 requests / minute / IP */\n credentials: { name: \"auth-credentials\", ttl: 60_000, limit: 5 },\n /** Forgot password: 3 requests / minute / IP */\n passwordReset: { name: \"auth-password-reset\", ttl: 60_000, limit: 3 },\n} as const;\n\nexport type AuthRateLimitPreset =\n (typeof AUTH_RATE_LIMIT_PRESETS)[keyof typeof AUTH_RATE_LIMIT_PRESETS];\n","/** Machine-readable auth error codes returned in HTTP responses. */\nexport const AuthErrorCode = {\n INVALID_CREDENTIALS: \"Invalid credentials\",\n INVALID_REFRESH_TOKEN: \"Invalid refresh token\",\n REFRESH_TOKEN_REUSE: \"REFRESH_TOKEN_REUSE\",\n ACCOUNT_DISABLED: \"ACCOUNT_DISABLED\",\n EMAIL_NOT_VERIFIED: \"EMAIL_NOT_VERIFIED\",\n TOKEN_INVALID_OR_EXPIRED: \"TOKEN_INVALID_OR_EXPIRED\",\n ACCOUNT_LOCKED: \"ACCOUNT_LOCKED\",\n INVALID_CURRENT_PASSWORD: \"INVALID_CURRENT_PASSWORD\",\n PASSWORD_UNCHANGED: \"PASSWORD_UNCHANGED\",\n} as const;\n\nexport type AuthErrorCodeValue =\n (typeof AuthErrorCode)[keyof typeof AuthErrorCode];\n","import { createParamDecorator, type ExecutionContext } from \"@nestjs/common\";\n\nimport type { AuthJwtPayload } from \"../interfaces/jwt-payload.interface\";\n\nexport const CurrentUser = createParamDecorator(\n (_data: unknown, ctx: ExecutionContext): AuthJwtPayload => {\n const request = ctx.switchToHttp().getRequest<{ user: AuthJwtPayload }>();\n return request.user;\n },\n);\n","import { Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { AuthGuard } from \"@nestjs/passport\";\n\n@Injectable()\nexport class JwtAuthGuard extends AuthGuard(\"jwt\") {\n handleRequest<TUser>(\n err: Error | null,\n user: TUser,\n _info: unknown,\n ): TUser {\n // Passport returns `false` (not null) when no/invalid token.\n if (err != null || !user) {\n throw err ?? new UnauthorizedException();\n }\n return user;\n }\n}\n","/** String tokens — stable across tsup entry points (index + mongo). */\nexport const AUTH_MODULE_OPTIONS = \"AUTH_MODULE_OPTIONS\";\nexport const AUTH_HOOKS = \"AUTH_HOOKS\";\nexport const AUTH_REPOSITORY = \"AUTH_REPOSITORY\";\n","/**\n * Precomputed bcrypt hash for constant-time login when the account is missing.\n * Never store real passwords against this hash — comparison only.\n */\nexport const DUMMY_PASSWORD_HASH =\n \"$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy\";\n","import { Injectable } from \"@nestjs/common\";\n\nimport type {\n AuthHooks,\n BaseAuthAccount,\n RegisterInput,\n} from \"../interfaces/auth-hooks.interface\";\n\n@Injectable()\nexport class DefaultAuthHooks implements AuthHooks {\n async buildJwtPayload(\n account: BaseAuthAccount,\n ): Promise<Record<string, unknown>> {\n return {\n sub: account.id,\n ...(account.email != null ? { email: account.email } : {}),\n ...(account.username != null ? { username: account.username } : {}),\n };\n }\n\n async enrichMe(account: BaseAuthAccount): Promise<Record<string, unknown>> {\n return {\n id: account.id,\n email: account.email,\n username: account.username,\n emailVerified: account.emailVerified,\n disabled: account.disabled,\n ...(account.lastLoginAt != null\n ? { lastLoginAt: account.lastLoginAt }\n : {}),\n ...(account.passwordChangedAt != null\n ? { passwordChangedAt: account.passwordChangedAt }\n : {}),\n };\n }\n\n async onBeforeRegister(_input: RegisterInput): Promise<void> {\n return;\n }\n\n async onAfterRegister(_account: BaseAuthAccount): Promise<void> {\n return;\n }\n\n async onAfterLogin(_account: BaseAuthAccount): Promise<void> {\n return;\n }\n}\n","export function isDuplicateKeyError(error: unknown): boolean {\n return (\n !!error &&\n typeof error === \"object\" &&\n \"code\" in error &&\n (error as { code: number }).code === 11000\n );\n}\n","import { BadRequestException } from \"@nestjs/common\";\n\nconst COMPLEXITY_PATTERN =\n /^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d).+$/;\n\nexport function assertPasswordComplexity(password: string): void {\n if (!COMPLEXITY_PATTERN.test(password)) {\n throw new BadRequestException(\n \"Password must contain at least one uppercase letter, one lowercase letter, and one digit\",\n );\n }\n}\n","import { BadRequestException } from \"@nestjs/common\";\n\nimport type { AuthIdentifierField } from \"../interfaces/auth-config.interface\";\nimport type { BaseAuthAccount, RegisterInput } from \"../interfaces/auth-hooks.interface\";\n\nexport function normalizeIdentifier(value: string): string {\n return value.trim().toLowerCase();\n}\n\nexport function resolveRegisterIdentifier(\n input: RegisterInput,\n field: AuthIdentifierField,\n): string {\n const value = field === \"email\" ? input.email : input.username;\n if (value == null || value.trim() === \"\") {\n throw new BadRequestException(`Register input requires ${field}`);\n }\n return normalizeIdentifier(value);\n}\n\nexport function readAccountIdentifier(\n account: BaseAuthAccount,\n field: AuthIdentifierField,\n): string | undefined {\n const value = field === \"email\" ? account.email : account.username;\n return value != null ? normalizeIdentifier(value) : undefined;\n}\n","import { createHash, randomBytes } from \"crypto\";\n\nexport function generateRawToken(byteLength = 32): string {\n return randomBytes(byteLength).toString(\"hex\");\n}\n\nexport function hashToken(token: string): string {\n return createHash(\"sha256\").update(token).digest(\"hex\");\n}\n\nexport function expiresAtFromTtlMs(ttlMs: number): Date {\n return new Date(Date.now() + ttlMs);\n}\n\n/** Default: 24 hours */\nexport const DEFAULT_EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1000;\n\n/** Default: 15 minutes */\nexport const DEFAULT_PASSWORD_RESET_TTL_MS = 15 * 60 * 1000;\n","import { Inject, Injectable } from \"@nestjs/common\";\nimport { JwtService, type JwtSignOptions } from \"@nestjs/jwt\";\nimport * as bcrypt from \"bcryptjs\";\n\nimport { AUTH_MODULE_OPTIONS } from \"../constants/tokens\";\nimport type { AuthModuleOptions } from \"../interfaces/auth-config.interface\";\nimport type { AuthTokens } from \"../interfaces/auth-hooks.interface\";\nimport type { AuthJwtPayload } from \"../interfaces/jwt-payload.interface\";\n\nconst JWT_ALGORITHM = \"HS256\" as const;\n\n@Injectable()\nexport class TokenService {\n constructor(\n @Inject(JwtService)\n private readonly jwtService: JwtService,\n @Inject(AUTH_MODULE_OPTIONS)\n private readonly options: AuthModuleOptions,\n ) {}\n\n private get bcryptRounds(): number {\n return this.options.bcryptRounds ?? 10;\n }\n\n async signTokens(payload: AuthJwtPayload): Promise<AuthTokens> {\n const accessExpiresIn = this.options.expiresIn ?? \"1h\";\n const refreshExpiresIn = this.options.refreshExpiresIn ?? \"7d\";\n\n const [accessToken, refreshToken] = await Promise.all([\n this.jwtService.signAsync(\n payload as Record<string, unknown>,\n {\n secret: this.options.secret,\n expiresIn: accessExpiresIn,\n algorithm: JWT_ALGORITHM,\n } as JwtSignOptions,\n ),\n this.jwtService.signAsync(\n payload as Record<string, unknown>,\n {\n secret: this.options.refreshSecret,\n expiresIn: refreshExpiresIn,\n algorithm: JWT_ALGORITHM,\n } as JwtSignOptions,\n ),\n ]);\n\n return { accessToken, refreshToken };\n }\n\n async verifyRefreshToken(refreshToken: string): Promise<AuthJwtPayload> {\n return this.jwtService.verifyAsync<AuthJwtPayload>(refreshToken, {\n secret: this.options.refreshSecret,\n algorithms: [JWT_ALGORITHM],\n });\n }\n\n async hashRefreshToken(refreshToken: string): Promise<string> {\n return bcrypt.hash(refreshToken, this.bcryptRounds);\n }\n\n async compareRefreshToken(\n refreshToken: string,\n hash: string,\n ): Promise<boolean> {\n return bcrypt.compare(refreshToken, hash);\n }\n}\n","import {\n BadRequestException,\n Inject,\n Injectable,\n NotFoundException,\n UnauthorizedException,\n} from \"@nestjs/common\";\nimport * as bcrypt from \"bcryptjs\";\n\nimport {\n AUTH_HOOKS,\n AUTH_MODULE_OPTIONS,\n AUTH_REPOSITORY,\n} from \"../constants/tokens\";\nimport { DUMMY_PASSWORD_HASH } from \"../constants/password.constants\";\nimport { AuthErrorCode } from \"../constants/auth-errors\";\nimport type { LoginDto } from \"../dto/login.dto\";\nimport type { RegisterDto } from \"../dto/register.dto\";\nimport { DefaultAuthHooks } from \"../hooks/default-auth.hooks\";\nimport type { AuthModuleOptions } from \"../interfaces/auth-config.interface\";\nimport type {\n AuthHooks,\n AuthTokens,\n AuthAccountWithSecrets,\n BaseAuthAccount,\n RegisterInput,\n} from \"../interfaces/auth-hooks.interface\";\nimport type { IAuthRepository } from \"../interfaces/auth-repository.interface\";\nimport { isDuplicateKeyError } from \"../utils/duplicate-key.util\";\nimport { assertPasswordComplexity } from \"../utils/password.util\";\nimport {\n normalizeIdentifier,\n readAccountIdentifier,\n resolveRegisterIdentifier,\n} from \"../utils/identifier.util\";\nimport {\n DEFAULT_EMAIL_VERIFICATION_TTL_MS,\n DEFAULT_PASSWORD_RESET_TTL_MS,\n expiresAtFromTtlMs,\n generateRawToken,\n hashToken,\n} from \"../utils/token.util\";\nimport { TokenService } from \"./token.service\";\n\n@Injectable()\nexport class AuthService {\n constructor(\n @Inject(AUTH_REPOSITORY)\n private readonly authRepository: IAuthRepository,\n @Inject(AUTH_MODULE_OPTIONS)\n private readonly options: AuthModuleOptions,\n @Inject(AUTH_HOOKS)\n private readonly hooks: AuthHooks,\n @Inject(TokenService)\n private readonly tokenService: TokenService,\n ) {}\n\n private get identifierField() {\n return this.options.identifierField ?? \"email\";\n }\n\n private get emailVerificationEnabled() {\n return this.options.features?.emailVerification === true;\n }\n\n private get passwordResetEnabled() {\n return this.options.features?.passwordReset === true;\n }\n\n private get rotateRefreshToken() {\n return this.options.features?.refreshTokenRotation !== false;\n }\n\n private get bcryptRounds(): number {\n return this.options.bcryptRounds ?? 10;\n }\n\n private get accountLockoutEnabled(): boolean {\n return this.options.features?.accountLockout === true;\n }\n\n private get lockoutOptions() {\n return this.options.lockout;\n }\n\n private resolveLoginIdentifier(dto: LoginDto): string {\n const value =\n this.identifierField === \"email\" ? dto.email : dto.username;\n if (value == null || value.trim() === \"\") {\n throw new BadRequestException(\n `${this.identifierField} is required for login`,\n );\n }\n return normalizeIdentifier(value);\n }\n\n async register(dto: RegisterDto): Promise<{ registered: true }> {\n this.assertEmailHookWhenVerificationEnabled();\n\n const input: RegisterInput = { password: dto.password };\n if (dto.email != null) input.email = dto.email;\n if (dto.username != null) input.username = dto.username;\n\n await this.hooks.onBeforeRegister?.(input);\n\n resolveRegisterIdentifier(input, this.identifierField);\n this.assertRegisterEmailWhenVerificationEnabled(input);\n this.assertPasswordPolicy(dto.password);\n\n const passwordHash = await bcrypt.hash(dto.password, this.bcryptRounds);\n\n try {\n const account = await this.authRepository.create({\n ...input,\n passwordHash,\n emailVerified: !this.emailVerificationEnabled,\n });\n\n await this.hooks.onAfterRegister?.(account);\n\n if (this.emailVerificationEnabled) {\n await this.sendVerificationEmail(account);\n }\n } catch (error) {\n if (isDuplicateKeyError(error)) {\n // Same response as success — do not reveal whether the identifier exists.\n return { registered: true };\n }\n throw error;\n }\n\n return { registered: true };\n }\n\n async login(dto: LoginDto): Promise<AuthTokens> {\n const identifier = this.resolveLoginIdentifier(dto);\n const account = await this.authRepository.findByIdentifierWithSecrets(\n identifier,\n );\n\n if (account != null) {\n this.assertAccountNotLocked(account);\n }\n\n const passwordHash = account?.passwordHash ?? DUMMY_PASSWORD_HASH;\n const passwordMatches = await bcrypt.compare(dto.password, passwordHash);\n\n if (account?.passwordHash == null || !passwordMatches) {\n if (account != null && this.accountLockoutEnabled) {\n await this.authRepository.recordLoginFailure(\n account.id,\n this.lockoutOptions,\n );\n }\n throw new UnauthorizedException(AuthErrorCode.INVALID_CREDENTIALS);\n }\n\n this.assertAccountActive(account);\n\n await this.authRepository.recordLoginSuccess(account.id);\n return this.issueTokens(account);\n }\n\n async refresh(refreshToken: string): Promise<AuthTokens> {\n let payload;\n try {\n payload = await this.tokenService.verifyRefreshToken(refreshToken);\n } catch {\n throw new UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);\n }\n\n const account = await this.authRepository.findByIdWithSecrets(payload.sub);\n if (account == null) {\n throw new UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);\n }\n\n this.assertAccountActive(account);\n\n if (this.rotateRefreshToken) {\n if (account.refreshTokenHash == null) {\n throw new UnauthorizedException(AuthErrorCode.INVALID_REFRESH_TOKEN);\n }\n\n const tokenMatches = await this.tokenService.compareRefreshToken(\n refreshToken,\n account.refreshTokenHash,\n );\n if (!tokenMatches) {\n // Stale/reused refresh token — possible theft; revoke all refresh sessions.\n await this.authRepository.updateRefreshTokenHash(account.id, null);\n throw new UnauthorizedException(AuthErrorCode.REFRESH_TOKEN_REUSE);\n }\n }\n\n return this.issueTokens(account);\n }\n\n async logout(authId: string): Promise<{ loggedOut: true }> {\n await this.authRepository.updateRefreshTokenHash(authId, null);\n return { loggedOut: true };\n }\n\n async me(authId: string): Promise<Record<string, unknown>> {\n const account = await this.authRepository.findById(authId);\n if (account == null) {\n throw new UnauthorizedException(\"Account not found\");\n }\n\n if (this.hooks.enrichMe != null) {\n return this.hooks.enrichMe(account);\n }\n\n return new DefaultAuthHooks().enrichMe(account);\n }\n\n async verifyEmail(token: string): Promise<{ verified: true }> {\n this.assertEmailVerificationEnabled();\n\n const tokenHash = hashToken(token);\n const account =\n await this.authRepository.findByEmailVerificationTokenHash(tokenHash);\n if (account == null) {\n throw new BadRequestException(AuthErrorCode.TOKEN_INVALID_OR_EXPIRED);\n }\n\n await this.authRepository.markEmailVerified(account.id);\n return { verified: true };\n }\n\n async forgotPassword(email: string): Promise<{ sent: true }> {\n this.assertPasswordResetEnabled();\n this.assertEmailHookWhenPasswordResetEnabled();\n\n const normalizedEmail = normalizeIdentifier(email);\n const account = await this.authRepository.findByEmail(normalizedEmail);\n\n if (account != null) {\n const rawToken = generateRawToken();\n const tokenHash = hashToken(rawToken);\n const expiresAt = expiresAtFromTtlMs(\n this.options.passwordResetTokenTtlMs ?? DEFAULT_PASSWORD_RESET_TTL_MS,\n );\n\n await this.authRepository.setResetToken(account.id, tokenHash, expiresAt);\n await this.hooks.sendEmail!(\"reset\", normalizedEmail, rawToken);\n }\n\n return { sent: true };\n }\n\n async resetPassword(\n token: string,\n newPassword: string,\n ): Promise<{ reset: true }> {\n this.assertPasswordResetEnabled();\n\n const tokenHash = hashToken(token);\n const account = await this.authRepository.findByResetTokenHash(tokenHash);\n if (account == null) {\n throw new BadRequestException(AuthErrorCode.TOKEN_INVALID_OR_EXPIRED);\n }\n\n this.assertPasswordPolicy(newPassword);\n\n const passwordHash = await bcrypt.hash(newPassword, this.bcryptRounds);\n await this.authRepository.updatePasswordHash(account.id, passwordHash);\n await this.authRepository.clearResetToken(account.id);\n await this.authRepository.updateRefreshTokenHash(account.id, null);\n\n return { reset: true };\n }\n\n async changePassword(\n authId: string,\n currentPassword: string,\n newPassword: string,\n ): Promise<{ changed: true }> {\n const account = await this.authRepository.findByIdWithSecrets(authId);\n if (account?.passwordHash == null) {\n throw new UnauthorizedException(AuthErrorCode.INVALID_CURRENT_PASSWORD);\n }\n\n const currentMatches = await bcrypt.compare(\n currentPassword,\n account.passwordHash,\n );\n if (!currentMatches) {\n throw new UnauthorizedException(AuthErrorCode.INVALID_CURRENT_PASSWORD);\n }\n\n if (currentPassword === newPassword) {\n throw new BadRequestException(AuthErrorCode.PASSWORD_UNCHANGED);\n }\n\n this.assertPasswordPolicy(newPassword);\n\n const passwordHash = await bcrypt.hash(newPassword, this.bcryptRounds);\n await this.authRepository.updatePasswordHash(account.id, passwordHash);\n await this.authRepository.updateRefreshTokenHash(account.id, null);\n\n return { changed: true };\n }\n\n private assertAccountNotLocked(account: AuthAccountWithSecrets): void {\n if (!this.accountLockoutEnabled || account.lockedUntil == null) {\n return;\n }\n\n if (account.lockedUntil > new Date()) {\n throw new UnauthorizedException(AuthErrorCode.ACCOUNT_LOCKED);\n }\n }\n\n private assertAccountActive(account: BaseAuthAccount): void {\n if (account.disabled) {\n throw new UnauthorizedException(AuthErrorCode.ACCOUNT_DISABLED);\n }\n\n if (this.emailVerificationEnabled && !account.emailVerified) {\n throw new UnauthorizedException(AuthErrorCode.EMAIL_NOT_VERIFIED);\n }\n }\n\n private assertPasswordPolicy(password: string): void {\n if (this.options.passwordComplexity === true) {\n assertPasswordComplexity(password);\n }\n }\n\n private async issueTokens(account: BaseAuthAccount): Promise<AuthTokens> {\n const payload = await this.hooks.buildJwtPayload(account);\n const tokens = await this.tokenService.signTokens({\n ...payload,\n sub: account.id,\n });\n\n if (this.rotateRefreshToken) {\n const refreshTokenHash = await this.tokenService.hashRefreshToken(\n tokens.refreshToken,\n );\n await this.authRepository.updateRefreshTokenHash(\n account.id,\n refreshTokenHash,\n );\n }\n\n await this.hooks.onAfterLogin?.(account);\n return tokens;\n }\n\n private async sendVerificationEmail(account: BaseAuthAccount): Promise<void> {\n const email = this.resolveAccountEmail(account);\n if (email == null) return;\n\n const rawToken = generateRawToken();\n const tokenHash = hashToken(rawToken);\n const expiresAt = expiresAtFromTtlMs(\n this.options.emailVerificationTokenTtlMs ??\n DEFAULT_EMAIL_VERIFICATION_TTL_MS,\n );\n\n await this.authRepository.setEmailVerificationToken(\n account.id,\n tokenHash,\n expiresAt,\n );\n await this.hooks.sendEmail!(\"verify\", email, rawToken);\n }\n\n private resolveAccountEmail(account: BaseAuthAccount): string | null {\n if (account.email != null && account.email.trim() !== \"\") {\n return normalizeIdentifier(account.email);\n }\n return null;\n }\n\n private assertRegisterEmailWhenVerificationEnabled(input: RegisterInput): void {\n if (!this.emailVerificationEnabled) return;\n\n const email =\n this.identifierField === \"email\"\n ? resolveRegisterIdentifier(input, \"email\")\n : input.email != null\n ? normalizeIdentifier(input.email)\n : null;\n\n if (email == null || email.trim() === \"\") {\n throw new BadRequestException(\n \"email is required when emailVerification feature is enabled\",\n );\n }\n }\n\n private assertEmailHookWhenVerificationEnabled(): void {\n if (this.emailVerificationEnabled && this.hooks.sendEmail == null) {\n throw new BadRequestException(\n \"emailVerification is enabled but AuthHooks.sendEmail is not implemented\",\n );\n }\n }\n\n private assertEmailHookWhenPasswordResetEnabled(): void {\n if (this.passwordResetEnabled && this.hooks.sendEmail == null) {\n throw new BadRequestException(\n \"passwordReset is enabled but AuthHooks.sendEmail is not implemented\",\n );\n }\n }\n\n private assertEmailVerificationEnabled(): void {\n if (!this.emailVerificationEnabled) {\n throw new NotFoundException();\n }\n }\n\n private assertPasswordResetEnabled(): void {\n if (!this.passwordResetEnabled) {\n throw new NotFoundException();\n }\n }\n\n getIdentifierForAccount(account: BaseAuthAccount): string | undefined {\n return readAccountIdentifier(account, this.identifierField);\n }\n}\n","import {\n Body,\n Controller,\n Get,\n HttpCode,\n HttpStatus,\n Inject,\n Post,\n UseGuards,\n} from \"@nestjs/common\";\n\nimport { AuthTokensDto } from \"../dto/auth-tokens.dto\";\nimport { ChangePasswordDto } from \"../dto/change-password.dto\";\nimport { ForgotPasswordDto } from \"../dto/forgot-password.dto\";\nimport { LoginDto } from \"../dto/login.dto\";\nimport { RefreshTokenDto } from \"../dto/refresh-token.dto\";\nimport { RegisterAckDto } from \"../dto/register-ack.dto\";\nimport { RegisterDto } from \"../dto/register.dto\";\nimport { ResetPasswordDto } from \"../dto/reset-password.dto\";\nimport { VerifyEmailDto } from \"../dto/verify-email.dto\";\nimport { CurrentUser } from \"../decorators/current-user.decorator\";\nimport { JwtAuthGuard } from \"../guards/jwt-auth.guard\";\nimport type { AuthJwtPayload } from \"../interfaces/jwt-payload.interface\";\nimport { AuthService } from \"../services/auth.service\";\n\n@Controller(\"auth\")\nexport class AuthController {\n constructor(@Inject(AuthService) private readonly authService: AuthService) {}\n\n @Post(\"register\")\n register(@Body() dto: RegisterDto): Promise<RegisterAckDto> {\n return this.authService.register(dto);\n }\n\n @Post(\"login\")\n login(@Body() dto: LoginDto): Promise<AuthTokensDto> {\n return this.authService.login(dto);\n }\n\n @Post(\"refresh\")\n @HttpCode(HttpStatus.OK)\n refresh(@Body() dto: RefreshTokenDto): Promise<AuthTokensDto> {\n return this.authService.refresh(dto.refreshToken);\n }\n\n @Post(\"logout\")\n @UseGuards(JwtAuthGuard)\n @HttpCode(HttpStatus.OK)\n logout(@CurrentUser() user: AuthJwtPayload): Promise<{ loggedOut: true }> {\n return this.authService.logout(user.sub);\n }\n\n @Get(\"me\")\n @UseGuards(JwtAuthGuard)\n me(@CurrentUser() user: AuthJwtPayload): Promise<Record<string, unknown>> {\n return this.authService.me(user.sub);\n }\n\n /** Available only when `features.emailVerification` is enabled. */\n @Post(\"verify-email\")\n @HttpCode(HttpStatus.OK)\n verifyEmail(@Body() dto: VerifyEmailDto): Promise<{ verified: true }> {\n return this.authService.verifyEmail(dto.token);\n }\n\n /** Available only when `features.passwordReset` is enabled. */\n @Post(\"forgot-password\")\n @HttpCode(HttpStatus.OK)\n forgotPassword(@Body() dto: ForgotPasswordDto): Promise<{ sent: true }> {\n return this.authService.forgotPassword(dto.email);\n }\n\n /** Available only when `features.passwordReset` is enabled. */\n @Post(\"reset-password\")\n @HttpCode(HttpStatus.OK)\n resetPassword(@Body() dto: ResetPasswordDto): Promise<{ reset: true }> {\n return this.authService.resetPassword(dto.token, dto.newPassword);\n }\n\n @Post(\"change-password\")\n @UseGuards(JwtAuthGuard)\n @HttpCode(HttpStatus.OK)\n changePassword(\n @CurrentUser() user: AuthJwtPayload,\n @Body() dto: ChangePasswordDto,\n ): Promise<{ changed: true }> {\n return this.authService.changePassword(\n user.sub,\n dto.currentPassword,\n dto.newPassword,\n );\n }\n}\n","import { Controller } from \"@nestjs/common\";\n\nimport { AuthController } from \"./auth.controller\";\n\nexport function createAuthController(routePrefix = \"auth\"): typeof AuthController {\n @Controller(routePrefix)\n class ConfiguredAuthController extends AuthController {}\n\n Object.defineProperty(ConfiguredAuthController, \"name\", {\n value: `AuthController_${routePrefix.replace(/\\W+/g, \"_\")}`,\n });\n\n return ConfiguredAuthController;\n}\n","import { Inject, Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { PassportStrategy } from \"@nestjs/passport\";\nimport { ExtractJwt, Strategy } from \"passport-jwt\";\n\nimport { AUTH_MODULE_OPTIONS, AUTH_REPOSITORY } from \"../constants/tokens\";\nimport { AuthErrorCode } from \"../constants/auth-errors\";\nimport type { AuthModuleOptions } from \"../interfaces/auth-config.interface\";\nimport type { IAuthRepository } from \"../interfaces/auth-repository.interface\";\nimport type { AuthJwtPayload } from \"../interfaces/jwt-payload.interface\";\n\n@Injectable()\nexport class JwtStrategy extends PassportStrategy(Strategy) {\n constructor(\n @Inject(AUTH_MODULE_OPTIONS)\n private readonly options: AuthModuleOptions,\n @Inject(AUTH_REPOSITORY)\n private readonly authRepository: IAuthRepository,\n ) {\n super({\n jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),\n ignoreExpiration: false,\n secretOrKey: options.secret,\n algorithms: [\"HS256\"],\n });\n }\n\n async validate(payload: AuthJwtPayload): Promise<AuthJwtPayload> {\n const account = await this.authRepository.findById(payload.sub);\n if (account == null || account.disabled) {\n throw new UnauthorizedException(\"Account not found or inactive\");\n }\n\n if (\n this.options.features?.emailVerification === true &&\n !account.emailVerified\n ) {\n throw new UnauthorizedException(AuthErrorCode.EMAIL_NOT_VERIFIED);\n }\n\n return payload;\n }\n}\n","import type { Provider } from \"@nestjs/common\";\n\nimport { AUTH_HOOKS } from \"../constants/tokens\";\nimport { DefaultAuthHooks } from \"../hooks/default-auth.hooks\";\nimport type { AuthModuleOptions } from \"../interfaces/auth-config.interface\";\n\nexport function createHooksProvider(options: AuthModuleOptions): Provider {\n if (options.hooksProvider != null) {\n return options.hooksProvider;\n }\n\n const HooksClass = options.hooks ?? DefaultAuthHooks;\n return {\n provide: AUTH_HOOKS,\n useClass: HooksClass,\n };\n}\n","import type { AuthModuleOptions } from \"../interfaces/auth-config.interface\";\n\nconst MIN_SECRET_LENGTH = 32;\nconst MIN_BCRYPT_ROUNDS = 10;\nconst MAX_BCRYPT_ROUNDS = 14;\n\nexport function validateAuthModuleOptions(options: AuthModuleOptions): void {\n if (options.secret.length < MIN_SECRET_LENGTH) {\n throw new Error(\n `AuthModule: secret must be at least ${MIN_SECRET_LENGTH} characters`,\n );\n }\n\n if (options.refreshSecret.length < MIN_SECRET_LENGTH) {\n throw new Error(\n `AuthModule: refreshSecret must be at least ${MIN_SECRET_LENGTH} characters`,\n );\n }\n\n if (options.secret === options.refreshSecret) {\n throw new Error(\n \"AuthModule: secret and refreshSecret must be different\",\n );\n }\n\n const rounds = options.bcryptRounds ?? MIN_BCRYPT_ROUNDS;\n if (rounds < MIN_BCRYPT_ROUNDS || rounds > MAX_BCRYPT_ROUNDS) {\n throw new Error(\n `AuthModule: bcryptRounds must be between ${MIN_BCRYPT_ROUNDS} and ${MAX_BCRYPT_ROUNDS}`,\n );\n }\n\n if (\n options.emailVerificationTokenTtlMs != null &&\n options.emailVerificationTokenTtlMs < 60_000\n ) {\n throw new Error(\n \"AuthModule: emailVerificationTokenTtlMs must be at least 60000 (1 minute)\",\n );\n }\n\n if (\n options.passwordResetTokenTtlMs != null &&\n options.passwordResetTokenTtlMs < 60_000\n ) {\n throw new Error(\n \"AuthModule: passwordResetTokenTtlMs must be at least 60000 (1 minute)\",\n );\n }\n}\n","import { DynamicModule, Module, Provider, Type } from \"@nestjs/common\";\nimport { ModuleRef } from \"@nestjs/core\";\nimport { JwtModule, type JwtModuleOptions } from \"@nestjs/jwt\";\nimport { PassportModule } from \"@nestjs/passport\";\n\nimport { createAuthController } from \"./controllers/auth.controller.factory\";\nimport { AUTH_HOOKS, AUTH_MODULE_OPTIONS } from \"./constants/tokens\";\nimport { DefaultAuthHooks } from \"./hooks/default-auth.hooks\";\nimport type {\n AuthModuleAsyncOptions,\n AuthModuleOptions,\n} from \"./interfaces/auth-config.interface\";\nimport type { AuthHooks } from \"./interfaces/auth-hooks.interface\";\nimport { AuthService } from \"./services/auth.service\";\nimport { TokenService } from \"./services/token.service\";\nimport { JwtAuthGuard } from \"./guards/jwt-auth.guard\";\nimport { JwtStrategy } from \"./strategies/jwt.strategy\";\nimport { createHooksProvider } from \"./utils/hooks-provider.util\";\nimport { validateAuthModuleOptions } from \"./utils/validate-auth-config.util\";\n\ntype ModuleImports = NonNullable<DynamicModule[\"imports\"]>;\n\nfunction createCoreProviders(options: AuthModuleOptions): Provider[] {\n validateAuthModuleOptions(options);\n\n return [\n {\n provide: AUTH_MODULE_OPTIONS,\n useValue: options,\n },\n createHooksProvider(options),\n AuthService,\n TokenService,\n JwtStrategy,\n JwtAuthGuard,\n ];\n}\n\nfunction createAsyncHooksProvider(\n options: AuthModuleAsyncOptions,\n): Provider {\n if (options.hooksProvider != null) {\n return options.hooksProvider;\n }\n\n const HooksClass = options.hooks ?? DefaultAuthHooks;\n\n return {\n provide: AUTH_HOOKS,\n inject: [ModuleRef],\n useFactory: (moduleRef: ModuleRef) =>\n moduleRef.create(HooksClass as Type<AuthHooks>),\n };\n}\n\nfunction createAuthImports(): ModuleImports {\n return [\n PassportModule.register({ defaultStrategy: \"jwt\" }),\n JwtModule.registerAsync({\n inject: [AUTH_MODULE_OPTIONS],\n useFactory: (opts: AuthModuleOptions) =>\n ({\n secret: opts.secret,\n signOptions: {\n expiresIn: opts.expiresIn ?? \"1h\",\n algorithm: \"HS256\",\n },\n }) as JwtModuleOptions,\n }),\n ];\n}\n\nfunction mergeImports(userImports?: unknown): ModuleImports {\n const merged: ModuleImports = [...createAuthImports()];\n if (userImports != null) {\n merged.unshift(...(userImports as ModuleImports));\n }\n return merged;\n}\n\nfunction createAsyncProviders(options: AuthModuleAsyncOptions): Provider[] {\n return [\n {\n provide: AUTH_MODULE_OPTIONS,\n inject: (options.inject ?? []) as never[],\n useFactory: async (...args: unknown[]) => {\n const config = await options.useFactory(...args);\n validateAuthModuleOptions(config);\n return config;\n },\n },\n createAsyncHooksProvider(options),\n AuthService,\n TokenService,\n JwtStrategy,\n JwtAuthGuard,\n ];\n}\n\n@Module({})\nexport class AuthModule {\n static forRoot(options: AuthModuleOptions): DynamicModule {\n const routePrefix = options.routePrefix ?? \"auth\";\n\n return {\n module: AuthModule,\n global: true,\n imports: createAuthImports(),\n controllers: [createAuthController(routePrefix)],\n providers: createCoreProviders(options),\n exports: [\n AUTH_MODULE_OPTIONS,\n AUTH_HOOKS,\n AuthService,\n TokenService,\n JwtAuthGuard,\n JwtModule,\n PassportModule,\n ],\n };\n }\n\n static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule {\n const routePrefix = options.routePrefix ?? \"auth\";\n\n return {\n module: AuthModule,\n global: true,\n imports: mergeImports(options.imports),\n controllers: [createAuthController(routePrefix)],\n providers: createAsyncProviders(options),\n exports: [\n AUTH_MODULE_OPTIONS,\n AUTH_HOOKS,\n AuthService,\n TokenService,\n JwtAuthGuard,\n JwtModule,\n PassportModule,\n ],\n };\n }\n}\n","export class AuthTokensDto {\n accessToken!: string;\n refreshToken!: string;\n}\n","import { IsNotEmpty, IsString, Length } from \"class-validator\";\n\nexport class ChangePasswordDto {\n @IsString()\n @IsNotEmpty()\n currentPassword!: string;\n\n @IsString()\n @IsNotEmpty()\n @Length(8, 128)\n newPassword!: string;\n}\n","import { IsEmail } from \"class-validator\";\n\nexport class ForgotPasswordDto {\n @IsEmail()\n email!: string;\n}\n","import { IsEmail, IsNotEmpty, IsOptional, IsString, Length, ValidateIf } from \"class-validator\";\n\nexport class LoginDto {\n @IsOptional()\n @ValidateIf((dto: LoginDto) => dto.email != null && dto.email.trim() !== \"\")\n @IsEmail()\n @Length(3, 255)\n email?: string;\n\n @IsOptional()\n @IsString()\n @Length(3, 50)\n username?: string;\n\n @IsString()\n @IsNotEmpty()\n @Length(8, 128)\n password!: string;\n}\n","import { IsNotEmpty, IsString } from \"class-validator\";\n\nexport class RefreshTokenDto {\n @IsString()\n @IsNotEmpty()\n refreshToken!: string;\n}\n","export class RegisterAckDto {\n registered!: true;\n}\n","import { IsEmail, IsNotEmpty, IsOptional, IsString, Length, Matches, ValidateIf } from \"class-validator\";\n\nexport class RegisterDto {\n @IsOptional()\n @ValidateIf((dto: RegisterDto) => dto.email != null && dto.email.trim() !== \"\")\n @IsEmail()\n @Length(3, 255)\n email?: string;\n\n @IsOptional()\n @IsString()\n @Length(3, 50)\n @Matches(/^[a-zA-Z0-9._-]+$/)\n username?: string;\n\n @IsString()\n @IsNotEmpty()\n @Length(8, 128)\n password!: string;\n}\n","import { IsNotEmpty, IsString, Length } from \"class-validator\";\n\nexport class ResetPasswordDto {\n @IsString()\n @IsNotEmpty()\n token!: string;\n\n @IsString()\n @IsNotEmpty()\n @Length(8, 128)\n newPassword!: string;\n}\n","import { IsNotEmpty, IsString } from \"class-validator\";\n\nexport class VerifyEmailDto {\n @IsString()\n @IsNotEmpty()\n token!: string;\n}\n"]}
package/dist/index.d.cts CHANGED
@@ -1,9 +1,57 @@
1
1
  import { DynamicModule } from '@nestjs/common';
2
- import { A as AuthModuleOptions, a as AuthModuleAsyncOptions, b as AuthHooks, B as BaseAuthAccount, R as RegisterInput, c as AuthTokens, I as IAuthRepository } from './auth-repository.interface-BMlJc-98.cjs';
3
- export { d as AuthAccountWithSecrets, e as AuthFeatures, f as AuthIdentifierField, g as AuthJwtConfig, C as CreateAccountData } from './auth-repository.interface-BMlJc-98.cjs';
2
+ import { A as AuthModuleOptions, a as AuthModuleAsyncOptions, b as AuthHooks, B as BaseAuthAccount, R as RegisterInput, c as AuthTokens, I as IAuthRepository } from './auth-repository.interface-9PpDVOs8.cjs';
3
+ export { d as AuthAccountWithSecrets, e as AuthFeatures, f as AuthIdentifierField, g as AuthJwtConfig, C as CreateAccountData } from './auth-repository.interface-9PpDVOs8.cjs';
4
4
  import * as _nestjs_passport from '@nestjs/passport';
5
5
  import { JwtService } from '@nestjs/jwt';
6
6
 
7
+ /**
8
+ * Recommended @nestjs/throttler settings for auth endpoints.
9
+ * Apply in the consumer app — this library does not bundle ThrottlerModule.
10
+ *
11
+ * @example
12
+ * ```typescript
13
+ * import { ThrottlerModule } from "@nestjs/throttler";
14
+ * import { AUTH_RATE_LIMIT_PRESETS } from "@aranzatech/aranza-auth";
15
+ *
16
+ * ThrottlerModule.forRoot([AUTH_RATE_LIMIT_PRESETS.default])
17
+ * ```
18
+ */
19
+ declare const AUTH_RATE_LIMIT_PRESETS: {
20
+ /** General auth routes: 10 requests / minute / IP */
21
+ readonly default: {
22
+ readonly name: "auth-default";
23
+ readonly ttl: 60000;
24
+ readonly limit: 10;
25
+ };
26
+ /** Login, register, refresh: 5 requests / minute / IP */
27
+ readonly credentials: {
28
+ readonly name: "auth-credentials";
29
+ readonly ttl: 60000;
30
+ readonly limit: 5;
31
+ };
32
+ /** Forgot password: 3 requests / minute / IP */
33
+ readonly passwordReset: {
34
+ readonly name: "auth-password-reset";
35
+ readonly ttl: 60000;
36
+ readonly limit: 3;
37
+ };
38
+ };
39
+ type AuthRateLimitPreset = (typeof AUTH_RATE_LIMIT_PRESETS)[keyof typeof AUTH_RATE_LIMIT_PRESETS];
40
+
41
+ /** Machine-readable auth error codes returned in HTTP responses. */
42
+ declare const AuthErrorCode: {
43
+ readonly INVALID_CREDENTIALS: "Invalid credentials";
44
+ readonly INVALID_REFRESH_TOKEN: "Invalid refresh token";
45
+ readonly REFRESH_TOKEN_REUSE: "REFRESH_TOKEN_REUSE";
46
+ readonly ACCOUNT_DISABLED: "ACCOUNT_DISABLED";
47
+ readonly EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED";
48
+ readonly TOKEN_INVALID_OR_EXPIRED: "TOKEN_INVALID_OR_EXPIRED";
49
+ readonly ACCOUNT_LOCKED: "ACCOUNT_LOCKED";
50
+ readonly INVALID_CURRENT_PASSWORD: "INVALID_CURRENT_PASSWORD";
51
+ readonly PASSWORD_UNCHANGED: "PASSWORD_UNCHANGED";
52
+ };
53
+ type AuthErrorCodeValue = (typeof AuthErrorCode)[keyof typeof AuthErrorCode];
54
+
7
55
  declare class AuthModule {
8
56
  static forRoot(options: AuthModuleOptions): DynamicModule;
9
57
  static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule;
@@ -21,6 +69,11 @@ declare class AuthTokensDto {
21
69
  refreshToken: string;
22
70
  }
23
71
 
72
+ declare class ChangePasswordDto {
73
+ currentPassword: string;
74
+ newPassword: string;
75
+ }
76
+
24
77
  declare class ForgotPasswordDto {
25
78
  email: string;
26
79
  }
@@ -79,6 +132,7 @@ declare class TokenService {
79
132
  private readonly jwtService;
80
133
  private readonly options;
81
134
  constructor(jwtService: JwtService, options: AuthModuleOptions);
135
+ private get bcryptRounds();
82
136
  signTokens(payload: AuthJwtPayload): Promise<AuthTokens>;
83
137
  verifyRefreshToken(refreshToken: string): Promise<AuthJwtPayload>;
84
138
  hashRefreshToken(refreshToken: string): Promise<string>;
@@ -95,6 +149,9 @@ declare class AuthService {
95
149
  private get emailVerificationEnabled();
96
150
  private get passwordResetEnabled();
97
151
  private get rotateRefreshToken();
152
+ private get bcryptRounds();
153
+ private get accountLockoutEnabled();
154
+ private get lockoutOptions();
98
155
  private resolveLoginIdentifier;
99
156
  register(dto: RegisterDto): Promise<{
100
157
  registered: true;
@@ -114,7 +171,12 @@ declare class AuthService {
114
171
  resetPassword(token: string, newPassword: string): Promise<{
115
172
  reset: true;
116
173
  }>;
174
+ changePassword(authId: string, currentPassword: string, newPassword: string): Promise<{
175
+ changed: true;
176
+ }>;
177
+ private assertAccountNotLocked;
117
178
  private assertAccountActive;
179
+ private assertPasswordPolicy;
118
180
  private issueTokens;
119
181
  private sendVerificationEmail;
120
182
  private resolveAccountEmail;
@@ -126,4 +188,4 @@ declare class AuthService {
126
188
  getIdentifierForAccount(account: BaseAuthAccount): string | undefined;
127
189
  }
128
190
 
129
- export { AUTH_HOOKS, AUTH_MODULE_OPTIONS, AUTH_REPOSITORY, AuthHooks, type AuthJwtPayload, AuthModule, AuthModuleAsyncOptions, AuthModuleOptions, AuthService, AuthTokens, AuthTokensDto, BaseAuthAccount, CurrentUser, DefaultAuthHooks, ForgotPasswordDto, IAuthRepository, JwtAuthGuard, type JwtPayload, LoginDto, RefreshTokenDto, RegisterAckDto, RegisterDto, RegisterInput, ResetPasswordDto, TokenService, VerifyEmailDto };
191
+ export { AUTH_HOOKS, AUTH_MODULE_OPTIONS, AUTH_RATE_LIMIT_PRESETS, AUTH_REPOSITORY, AuthErrorCode, type AuthErrorCodeValue, AuthHooks, type AuthJwtPayload, AuthModule, AuthModuleAsyncOptions, AuthModuleOptions, type AuthRateLimitPreset, AuthService, AuthTokens, AuthTokensDto, BaseAuthAccount, ChangePasswordDto, CurrentUser, DefaultAuthHooks, ForgotPasswordDto, IAuthRepository, JwtAuthGuard, type JwtPayload, LoginDto, RefreshTokenDto, RegisterAckDto, RegisterDto, RegisterInput, ResetPasswordDto, TokenService, VerifyEmailDto };
package/dist/index.d.ts CHANGED
@@ -1,9 +1,57 @@
1
1
  import { DynamicModule } from '@nestjs/common';
2
- import { A as AuthModuleOptions, a as AuthModuleAsyncOptions, b as AuthHooks, B as BaseAuthAccount, R as RegisterInput, c as AuthTokens, I as IAuthRepository } from './auth-repository.interface-BMlJc-98.js';
3
- export { d as AuthAccountWithSecrets, e as AuthFeatures, f as AuthIdentifierField, g as AuthJwtConfig, C as CreateAccountData } from './auth-repository.interface-BMlJc-98.js';
2
+ import { A as AuthModuleOptions, a as AuthModuleAsyncOptions, b as AuthHooks, B as BaseAuthAccount, R as RegisterInput, c as AuthTokens, I as IAuthRepository } from './auth-repository.interface-9PpDVOs8.js';
3
+ export { d as AuthAccountWithSecrets, e as AuthFeatures, f as AuthIdentifierField, g as AuthJwtConfig, C as CreateAccountData } from './auth-repository.interface-9PpDVOs8.js';
4
4
  import * as _nestjs_passport from '@nestjs/passport';
5
5
  import { JwtService } from '@nestjs/jwt';
6
6
 
7
+ /**
8
+ * Recommended @nestjs/throttler settings for auth endpoints.
9
+ * Apply in the consumer app — this library does not bundle ThrottlerModule.
10
+ *
11
+ * @example
12
+ * ```typescript
13
+ * import { ThrottlerModule } from "@nestjs/throttler";
14
+ * import { AUTH_RATE_LIMIT_PRESETS } from "@aranzatech/aranza-auth";
15
+ *
16
+ * ThrottlerModule.forRoot([AUTH_RATE_LIMIT_PRESETS.default])
17
+ * ```
18
+ */
19
+ declare const AUTH_RATE_LIMIT_PRESETS: {
20
+ /** General auth routes: 10 requests / minute / IP */
21
+ readonly default: {
22
+ readonly name: "auth-default";
23
+ readonly ttl: 60000;
24
+ readonly limit: 10;
25
+ };
26
+ /** Login, register, refresh: 5 requests / minute / IP */
27
+ readonly credentials: {
28
+ readonly name: "auth-credentials";
29
+ readonly ttl: 60000;
30
+ readonly limit: 5;
31
+ };
32
+ /** Forgot password: 3 requests / minute / IP */
33
+ readonly passwordReset: {
34
+ readonly name: "auth-password-reset";
35
+ readonly ttl: 60000;
36
+ readonly limit: 3;
37
+ };
38
+ };
39
+ type AuthRateLimitPreset = (typeof AUTH_RATE_LIMIT_PRESETS)[keyof typeof AUTH_RATE_LIMIT_PRESETS];
40
+
41
+ /** Machine-readable auth error codes returned in HTTP responses. */
42
+ declare const AuthErrorCode: {
43
+ readonly INVALID_CREDENTIALS: "Invalid credentials";
44
+ readonly INVALID_REFRESH_TOKEN: "Invalid refresh token";
45
+ readonly REFRESH_TOKEN_REUSE: "REFRESH_TOKEN_REUSE";
46
+ readonly ACCOUNT_DISABLED: "ACCOUNT_DISABLED";
47
+ readonly EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED";
48
+ readonly TOKEN_INVALID_OR_EXPIRED: "TOKEN_INVALID_OR_EXPIRED";
49
+ readonly ACCOUNT_LOCKED: "ACCOUNT_LOCKED";
50
+ readonly INVALID_CURRENT_PASSWORD: "INVALID_CURRENT_PASSWORD";
51
+ readonly PASSWORD_UNCHANGED: "PASSWORD_UNCHANGED";
52
+ };
53
+ type AuthErrorCodeValue = (typeof AuthErrorCode)[keyof typeof AuthErrorCode];
54
+
7
55
  declare class AuthModule {
8
56
  static forRoot(options: AuthModuleOptions): DynamicModule;
9
57
  static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule;
@@ -21,6 +69,11 @@ declare class AuthTokensDto {
21
69
  refreshToken: string;
22
70
  }
23
71
 
72
+ declare class ChangePasswordDto {
73
+ currentPassword: string;
74
+ newPassword: string;
75
+ }
76
+
24
77
  declare class ForgotPasswordDto {
25
78
  email: string;
26
79
  }
@@ -79,6 +132,7 @@ declare class TokenService {
79
132
  private readonly jwtService;
80
133
  private readonly options;
81
134
  constructor(jwtService: JwtService, options: AuthModuleOptions);
135
+ private get bcryptRounds();
82
136
  signTokens(payload: AuthJwtPayload): Promise<AuthTokens>;
83
137
  verifyRefreshToken(refreshToken: string): Promise<AuthJwtPayload>;
84
138
  hashRefreshToken(refreshToken: string): Promise<string>;
@@ -95,6 +149,9 @@ declare class AuthService {
95
149
  private get emailVerificationEnabled();
96
150
  private get passwordResetEnabled();
97
151
  private get rotateRefreshToken();
152
+ private get bcryptRounds();
153
+ private get accountLockoutEnabled();
154
+ private get lockoutOptions();
98
155
  private resolveLoginIdentifier;
99
156
  register(dto: RegisterDto): Promise<{
100
157
  registered: true;
@@ -114,7 +171,12 @@ declare class AuthService {
114
171
  resetPassword(token: string, newPassword: string): Promise<{
115
172
  reset: true;
116
173
  }>;
174
+ changePassword(authId: string, currentPassword: string, newPassword: string): Promise<{
175
+ changed: true;
176
+ }>;
177
+ private assertAccountNotLocked;
117
178
  private assertAccountActive;
179
+ private assertPasswordPolicy;
118
180
  private issueTokens;
119
181
  private sendVerificationEmail;
120
182
  private resolveAccountEmail;
@@ -126,4 +188,4 @@ declare class AuthService {
126
188
  getIdentifierForAccount(account: BaseAuthAccount): string | undefined;
127
189
  }
128
190
 
129
- export { AUTH_HOOKS, AUTH_MODULE_OPTIONS, AUTH_REPOSITORY, AuthHooks, type AuthJwtPayload, AuthModule, AuthModuleAsyncOptions, AuthModuleOptions, AuthService, AuthTokens, AuthTokensDto, BaseAuthAccount, CurrentUser, DefaultAuthHooks, ForgotPasswordDto, IAuthRepository, JwtAuthGuard, type JwtPayload, LoginDto, RefreshTokenDto, RegisterAckDto, RegisterDto, RegisterInput, ResetPasswordDto, TokenService, VerifyEmailDto };
191
+ export { AUTH_HOOKS, AUTH_MODULE_OPTIONS, AUTH_RATE_LIMIT_PRESETS, AUTH_REPOSITORY, AuthErrorCode, type AuthErrorCodeValue, AuthHooks, type AuthJwtPayload, AuthModule, AuthModuleAsyncOptions, AuthModuleOptions, type AuthRateLimitPreset, AuthService, AuthTokens, AuthTokensDto, BaseAuthAccount, ChangePasswordDto, CurrentUser, DefaultAuthHooks, ForgotPasswordDto, IAuthRepository, JwtAuthGuard, type JwtPayload, LoginDto, RefreshTokenDto, RegisterAckDto, RegisterDto, RegisterInput, ResetPasswordDto, TokenService, VerifyEmailDto };