@aurorajs.dev/catalyst-cli 1.0.0

package/dist/templates/backend/application/src/@aurora/modules/authentication/authentication.module.spec.ts

@@ -0,0 +1,267 @@
+/**
+ * Integration smoke tests for AuthenticationModule via NestJS TestingModule.
+ *
+ * Goals:
+ * - Verify that with OAUTH_STRATEGY=none the module compiles WITHOUT key files present.
+ * - Verify that JWT_SIGNER resolves to JwtSignerAdapter (dormant in none mode).
+ * - Verify that the module's imports: array remains unchanged (leaf — no OAuthModule/IamModule).
+ * - (scaffold scenario) Verify that AuthenticationModule bootstraps with the anonymous
+ *   ACCOUNT_LOADER wiring that the packager injects — no IAM module, no override needed.
+ *
+ * The AuroraHubConsumerAdapter imports jwks-rsa (ESM-only); we mock it before imports run
+ * to avoid the known ts-jest/ESM limitation (catalyst-backend-testing SKILL.md).
+ */
+
+// Mock the ESM-importing adapter BEFORE any module imports run.
+jest.mock(
+  '@aurora/modules/authentication/infrastructure/strategies/aurora-hub/aurora-hub-consumer.adapter',
+  () => ({
+    AuroraHubConsumerAdapter: class AuroraHubConsumerAdapterMock {
+      getPassportOptions() {
+        return {
+          jwtFromRequest: () => null,
+          secretOrKey: 'mock',
+        };
+      }
+      validate(): Promise<Record<string, never>> {
+        return Promise.resolve({});
+      }
+    },
+  }),
+);
+
+import { CacheModule } from '@nestjs/cache-manager';
+import { ConfigModule } from '@nestjs/config';
+import { PassportModule } from '@nestjs/passport';
+import { Test } from '@nestjs/testing';
+import { AuthenticationModule } from './authentication.module';
+import { ACCOUNT_LOADER, HUB_SESSION_MANAGER, JWT_SIGNER } from './domain/ports';
+import { AnonymousAccountLoaderAdapter } from './infrastructure/strategies/local-provider/anonymous-account-loader.adapter';
+import { JwtSignerAdapter } from './infrastructure/strategies/local-provider/jwt-signer.adapter';
+import { LocalProviderAdapter } from './infrastructure/strategies/local-provider/local-provider.adapter';
+
+// ── Source-repo tests (with explicit ACCOUNT_LOADER override) ─────────────────
+// These represent the full-install (with IAM bridge) scenario.
+
+describe('AuthenticationModule — none mode integration', () => {
+  function buildModule(): ReturnType<typeof Test.createTestingModule> {
+    return (
+      Test.createTestingModule({
+        imports: [
+          ConfigModule.forRoot({ isGlobal: true }),
+          // CacheModule provides CACHE_MANAGER which LocalProviderAdapter injects
+          CacheModule.register({ isGlobal: true }),
+          PassportModule.register({ defaultStrategy: 'jwt' }),
+          AuthenticationModule,
+        ],
+      })
+        .overrideProvider(ACCOUNT_LOADER)
+        .useValue({ loadById: jest.fn() })
+        // Override LocalProviderAdapter so it doesn't need CACHE_MANAGER from a non-global module
+        .overrideProvider(LocalProviderAdapter)
+        .useValue({
+          getPassportOptions: () => ({ jwtFromRequest: () => null, secretOrKey: 'mock' }),
+          validate: jest.fn(),
+        })
+    );
+  }
+
+  it('compiles successfully with OAUTH_STRATEGY=none and no key files present', async () => {
+    process.env.OAUTH_STRATEGY = 'none';
+
+    const builder = buildModule();
+    const module = await builder.compile();
+
+    expect(module).toBeDefined();
+
+    delete process.env.OAUTH_STRATEGY;
+  });
+
+  it('JWT_SIGNER resolves to JwtSignerAdapter (dormant signer) when mode is none', async () => {
+    process.env.OAUTH_STRATEGY = 'none';
+
+    const builder = buildModule();
+    const module = await builder.compile();
+
+    const signer = module.get(JWT_SIGNER);
+    expect(signer).toBeInstanceOf(JwtSignerAdapter);
+
+    delete process.env.OAUTH_STRATEGY;
+  });
+
+  it('HUB_SESSION_MANAGER resolves to JwtSignerAdapter (same adapter, separate token)', async () => {
+    process.env.OAUTH_STRATEGY = 'none';
+
+    const builder = buildModule();
+    const module = await builder.compile();
+
+    const hubManager = module.get(HUB_SESSION_MANAGER);
+    expect(hubManager).toBeInstanceOf(JwtSignerAdapter);
+
+    delete process.env.OAUTH_STRATEGY;
+  });
+
+  it('compiles successfully with OAUTH_STRATEGY=aurora-hub and no key files present', async () => {
+    // Reproduces the production crash: a satellite app sets OAUTH_STRATEGY=aurora-hub and
+    // provides no local RSA key files. The module MUST compile without ENOENT errors.
+    process.env.OAUTH_STRATEGY = 'aurora-hub';
+    // Point the key paths at guaranteed-missing files so this test stays discriminating even
+    // in a dev env where ./.keys/ exists: reverting the dormant guard makes JwtSignerAdapter's
+    // constructor readFileSync the private key → ENOENT, failing module compilation.
+    process.env.OAUTH_PRIVATE_KEY_PATH = '/nonexistent/aurora-hub-test-private.key';
+    process.env.OAUTH_PUBLIC_KEY_PATH = '/nonexistent/aurora-hub-test-public.key';
+
+    const builder = buildModule();
+    const module = await builder.compile();
+
+    expect(module).toBeDefined();
+
+    delete process.env.OAUTH_STRATEGY;
+    delete process.env.OAUTH_PRIVATE_KEY_PATH;
+    delete process.env.OAUTH_PUBLIC_KEY_PATH;
+  });
+
+  it('AuthenticationModule imports: array does not include OAuthModule, IamModule, or any @api/* module', () => {
+    const metadata = Reflect.getMetadata('imports', AuthenticationModule) as unknown[] | undefined;
+    const importNames = (metadata ?? []).map((m: unknown) => {
+      if (typeof m === 'function') return (m as { name: string }).name;
+      if (typeof m === 'object' && m !== null && 'module' in m) {
+        return (m as { module: { name: string } }).module.name;
+      }
+      return null;
+    });
+
+    expect(importNames).not.toContain('OAuthModule');
+    expect(importNames).not.toContain('IamModule');
+  });
+});
+
+// ── Scaffold scenario (mirrors published scaffold after packager step) ─────────
+// Verifies the WIRING that cleanAuthenticationModule() will inject into the scaffold.
+//
+// Why this describe block uses a scaffold-mirror module, not overrideProvider():
+//   `overrideProvider` at the TestingModule root provides a token globally, but NestJS
+//   resolves LocalProviderAdapter's ACCOUNT_LOADER dependency within the AuthenticationModule
+//   context — a child module that has no ACCOUNT_LOADER in its own providers. The only way
+//   to satisfy it without running the actual packager is to declare a test module that
+//   already contains the same providers the packager will inject.
+//
+// NestJS precedence (empirically confirmed in nestjs-provider-precedence.spec.ts):
+//   MODULE-WINS — module-scoped providers take precedence over @Global ones.
+//   The anonymous adapter must therefore be scaffold-only (packager step) and
+//   NEVER registered in the source AuthenticationModule. If it were, it would shadow
+//   the @Global BridgesModule's IAM bridge in a full install → auth stays anonymous.
+
+import { Module } from '@nestjs/common';
+
+/**
+ * Scaffold-mirror module: mirrors the published scaffold's AuthenticationModule after
+ * `cleanAuthenticationModule()` runs (packager step in
+ * `scripts/packager/backend/application.mjs`). Used only in tests; never imported by
+ * production code.
+ *
+ * Intentionally includes `LocalProviderAdapter` — the EXACT provider whose
+ * `@Inject(ACCOUNT_LOADER)` (3rd constructor param) caused the original DI crash when
+ * no ACCOUNT_LOADER binding was present. Without the anonymous binding below, Nest throws:
+ *   "Nest can't resolve dependencies of LocalProviderAdapter (ConfigService, CACHE_MANAGER,
+ *    ?). Please make sure that the argument ACCOUNT_LOADER at index [2] is available."
+ *
+ * The anonymous binding MUST satisfy that injection WITHOUT any `overrideProvider` call,
+ * because in the real scaffold the anonymous provider IS the module's own provider — not
+ * an external override. This validates that the packager step produces a self-sufficient
+ * module.
+ *
+ * Note: We cannot reuse the real AuthenticationModule class here because its @Module
+ * metadata is fixed at class-decoration time. This separate class carries the additional
+ * providers the packager injects.
+ */
+@Module({
+  imports: [PassportModule.register({ defaultStrategy: 'jwt' })],
+  providers: [
+    AnonymousAccountLoaderAdapter,
+    { provide: ACCOUNT_LOADER, useExisting: AnonymousAccountLoaderAdapter },
+    // LocalProviderAdapter is the real consumer of ACCOUNT_LOADER. Including it here
+    // is what makes the test meaningful: it proves the anonymous binding resolves the
+    // actual crash scenario, not just an abstract token lookup.
+    LocalProviderAdapter,
+  ],
+})
+class ScaffoldAuthenticationModuleMirror {}
+
+describe('AuthenticationModule — scaffold scenario (anonymous ACCOUNT_LOADER, no IAM)', () => {
+  /**
+   * Builds the TestingModule for scaffold-scenario tests.
+   *
+   * GlobalModule shape:
+   *   - ConfigModule.forRoot (isGlobal: true) — needed by LocalProviderAdapter to read
+   *     OAUTH_STRATEGY via ConfigService.
+   *   - CacheModule.register (isGlobal: true) — provides CACHE_MANAGER, the 2nd param
+   *     injected by LocalProviderAdapter.
+   *
+   * No overrideProvider(ACCOUNT_LOADER) — exactly mirroring the scaffold's own wiring.
+   */
+  async function buildScaffoldModule() {
+    return Test.createTestingModule({
+      imports: [
+        ConfigModule.forRoot({ isGlobal: true }),
+        CacheModule.register({ isGlobal: true }),
+        ScaffoldAuthenticationModuleMirror,
+      ],
+    }).compile();
+  }
+
+  beforeEach(() => {
+    process.env.OAUTH_STRATEGY = 'none';
+  });
+
+  afterEach(() => {
+    delete process.env.OAUTH_STRATEGY;
+  });
+
+  it('scaffold-mirror boots with OAUTH_STRATEGY=none, no ACCOUNT_LOADER override, and LocalProviderAdapter present', async () => {
+    // This is the critical DI-crash scenario: LocalProviderAdapter injects ACCOUNT_LOADER
+    // at constructor param index 2. If the anonymous binding is missing, Nest throws at
+    // compile() time with:
+    //   "Nest can't resolve dependencies of LocalProviderAdapter (..., ?, ...)
+    //    Please make sure that the argument ACCOUNT_LOADER at index [2] is available."
+    // A successful compile() here proves the anonymous binding satisfies that injection.
+    const moduleRef = await buildScaffoldModule();
+
+    expect(moduleRef).toBeDefined();
+  });
+
+  it('LocalProviderAdapter is instantiated — the real consumer of ACCOUNT_LOADER', async () => {
+    // Verifies the ACTUAL crash consumer (LocalProviderAdapter) was resolved by Nest DI,
+    // not just that the ACCOUNT_LOADER token exists. Without the anonymous binding, this
+    // assertion would never be reached because compile() would throw first.
+    const moduleRef = await buildScaffoldModule();
+
+    const localProvider = moduleRef.get(LocalProviderAdapter);
+    expect(localProvider).toBeDefined();
+    expect(localProvider).toBeInstanceOf(LocalProviderAdapter);
+  });
+
+  it('ACCOUNT_LOADER resolves to AnonymousAccountLoaderAdapter — not the LocalProviderAdapter consumer', async () => {
+    // Verifies the anonymous binding wires the token to the right adapter. LocalProviderAdapter
+    // is a CONSUMER of ACCOUNT_LOADER, not its implementation.
+    const moduleRef = await buildScaffoldModule();
+
+    const accountLoader = moduleRef.get(ACCOUNT_LOADER);
+    expect(accountLoader).toBeInstanceOf(AnonymousAccountLoaderAdapter);
+  });
+
+  it('source AuthenticationModule providers array does not contain an ACCOUNT_LOADER binding', () => {
+    // Regression: verify the SOURCE module is unchanged (packager step is scaffold-only).
+    // If the anonymous provider leaked into the source module, it would shadow the @Global
+    // BridgesModule's IAM bridge in a full install — silently keeping auth anonymous.
+    const providers = Reflect.getMetadata('providers', AuthenticationModule) as unknown[];
+    const hasAnonymousBinding = (providers ?? []).some((p: unknown) => {
+      if (typeof p === 'object' && p !== null && 'provide' in p) {
+        return (p as { provide: symbol }).provide === ACCOUNT_LOADER;
+      }
+      return false;
+    });
+
+    expect(hasAnonymousBinding).toBe(false);
+  });
+});

package/dist/templates/backend/application/src/@aurora/modules/authentication/authentication.module.ts

@@ -0,0 +1,48 @@
+import { Module } from '@nestjs/common';
+import { PassportModule } from '@nestjs/passport';
+import { HUB_SESSION_MANAGER, JWT_SIGNER, ACCOUNT_LOADER } from './domain/ports';
+import { authenticationStrategyProvider } from './infrastructure/factory/authentication-strategy.factory';
+import { hubSessionManagerProvider } from './infrastructure/providers/hub-session-manager.provider';
+import { jwtSignerProvider } from './infrastructure/providers/jwt-signer.provider';
+import { AuroraHubConsumerAdapter } from './infrastructure/strategies/aurora-hub/aurora-hub-consumer.adapter';
+import { JwtPassportStrategy } from './infrastructure/strategies/jwt-passport.strategy';
+import { JwtSignerAdapter } from './infrastructure/strategies/local-provider/jwt-signer.adapter';
+import { LocalProviderAdapter } from './infrastructure/strategies/local-provider/local-provider.adapter';
+import { AuthenticationBootWarning } from './infrastructure/warnings/authentication-boot-warning';
+import { AnonymousAccountLoaderAdapter } from './infrastructure/strategies/local-provider/anonymous-account-loader.adapter';
+
+/**
+ * Leaf module: depends ONLY on `@nestjs/passport` + the cross-BC port tokens exposed by
+ * the @Global() `BridgesModule`. Must NOT import application-level modules (`OAuthModule`,
+ * `IamModule`, etc.) — doing so creates a circular dependency through `@aurora/decorators`,
+ * which is imported by every `@Auth()`-decorated controller in the app.
+ *
+ * The `TokenRetentionService` (which needs OAuth repositories) lives at
+ * `@app/o-auth/shared/services/token-retention.service` and is registered in `OAuthModule`,
+ * not here, for the same reason.
+ *
+ * `AuthenticationBootWarning` emits a prominent log on `onModuleInit` when
+ * `OAUTH_STRATEGY=none` is active, mitigating the footgun of the new default.
+ *
+ * Two tokens cross the module boundary:
+ *   - `JWT_SIGNER` — consumed by token-issuance services (password/refresh/authorization-code).
+ *   - `HUB_SESSION_MANAGER` — consumed by `OAuthHubSessionService` (cookie sign/verify) and
+ *     indirectly by controllers that read the hub_session cookie.
+ */
+@Module({
+  imports: [PassportModule.register({ defaultStrategy: 'jwt' })],
+  providers: [
+    AuroraHubConsumerAdapter,
+    LocalProviderAdapter,
+    JwtSignerAdapter,
+    jwtSignerProvider,
+    hubSessionManagerProvider,
+    authenticationStrategyProvider,
+    JwtPassportStrategy,
+    AuthenticationBootWarning,
+      AnonymousAccountLoaderAdapter,
+      { provide: ACCOUNT_LOADER, useExisting: AnonymousAccountLoaderAdapter }
+],
+  exports: [JWT_SIGNER, HUB_SESSION_MANAGER],
+})
+export class AuthenticationModule {}

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/anonymous-account.spec.ts

@@ -0,0 +1,69 @@
+import { createAnonymousAccount } from './anonymous-account';
+
+describe('createAnonymousAccount', () => {
+  it('returns an object with username "anonymous"', () => {
+    const account = createAnonymousAccount();
+    expect(account.username).toBe('anonymous');
+  });
+
+  it('returns an object with isActive true', () => {
+    const account = createAnonymousAccount();
+    expect(account.isActive).toBe(true);
+  });
+
+  it('returns dPermissions.all as an empty array', () => {
+    const account = createAnonymousAccount();
+    expect(account.dPermissions.all).toEqual([]);
+  });
+
+  it('returns empty arrays for scopes, dApplicationCodes, dTenants, roles, tenants', () => {
+    const account = createAnonymousAccount();
+    expect(account.scopes).toEqual([]);
+    expect(account.dApplicationCodes).toEqual([]);
+    expect(account.dTenants).toEqual([]);
+    expect(account.roles).toEqual([]);
+    expect(account.tenants).toEqual([]);
+  });
+
+  it('returns sentinel string "anonymous" for id and null for other nullable fields', () => {
+    const account = createAnonymousAccount();
+    expect(account.id).toBe('anonymous');
+    expect(account.clientId).toBeNull();
+    expect(account.email).toBeNull();
+    expect(account.meta).toBeNull();
+    expect(account.user).toBeNull();
+    expect(account.createdAt).toBeNull();
+    expect(account.updatedAt).toBeNull();
+    expect(account.deletedAt).toBeNull();
+  });
+
+  it('returns a fresh object on every call (not a shared reference)', () => {
+    const a = createAnonymousAccount();
+    const b = createAnonymousAccount();
+    expect(a).not.toBe(b);
+    // Mutating one should not affect the other
+    a.dPermissions.all.push('some.permission');
+    expect(b.dPermissions.all).toEqual([]);
+  });
+
+  it('conforms to the AuthenticatedAccount interface shape', () => {
+    const account = createAnonymousAccount();
+    // Verify all required fields are present
+    expect(account).toHaveProperty('id');
+    expect(account).toHaveProperty('clientId');
+    expect(account).toHaveProperty('email');
+    expect(account).toHaveProperty('username');
+    expect(account).toHaveProperty('isActive');
+    expect(account).toHaveProperty('scopes');
+    expect(account).toHaveProperty('dApplicationCodes');
+    expect(account).toHaveProperty('dPermissions');
+    expect(account).toHaveProperty('dTenants');
+    expect(account).toHaveProperty('meta');
+    expect(account).toHaveProperty('roles');
+    expect(account).toHaveProperty('tenants');
+    expect(account).toHaveProperty('user');
+    expect(account).toHaveProperty('createdAt');
+    expect(account).toHaveProperty('updatedAt');
+    expect(account).toHaveProperty('deletedAt');
+  });
+});

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/anonymous-account.ts

@@ -0,0 +1,36 @@
+import type { AuthenticatedAccount } from './ports/account-loader.port';
+
+/**
+ * Factory that returns a fresh anonymous `AuthenticatedAccount` per request.
+ *
+ * Used by `AuthenticationJwtGuard` when `OAUTH_STRATEGY=none` to short-circuit
+ * passport: the guard injects this account into `request.user` and returns `true`
+ * without invoking passport.
+ *
+ * Key invariants:
+ * - `dPermissions.all = []`  → `AuthorizationPermissionsGuard` lets through endpoints
+ *   with no declared permissions and rejects `@Auth('<permission>')` endpoints with 403.
+ *   "No authentication → no identity → no authority."
+ * - Returns a **fresh object per call** (not a frozen shared constant) to prevent
+ *   request-scoped interceptors from accidentally mutating shared state across requests.
+ */
+export function createAnonymousAccount(): AuthenticatedAccount {
+  return {
+    id: 'anonymous',
+    clientId: null,
+    email: null,
+    username: 'anonymous',
+    isActive: true,
+    scopes: [],
+    dApplicationCodes: [],
+    dPermissions: { all: [] },
+    dTenants: [],
+    meta: null,
+    roles: [],
+    tenants: [],
+    user: null,
+    createdAt: null,
+    updatedAt: null,
+    deletedAt: null,
+  };
+}

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/account-loader.port.ts

@@ -0,0 +1,42 @@
+export interface AuthenticatedAccountRole {
+  id: string;
+  name: string;
+  defaultRedirection: string | null;
+  hasHiddenVerticalNavigation: boolean | null;
+}
+
+export interface AuthenticatedAccountTenant {
+  id: string;
+  name: string;
+}
+
+export interface AuthenticatedAccountUser {
+  id: string;
+  name: string;
+  surname: string | null;
+  langId: string | null;
+  meta: Record<string, unknown> | null;
+}
+
+export interface AuthenticatedAccount {
+  id: string;
+  clientId: string | null;
+  email: string | null;
+  username: string;
+  isActive: boolean;
+  scopes: string[];
+  dApplicationCodes: string[];
+  dPermissions: { all: string[] } & Record<string, string[]>;
+  dTenants: string[];
+  meta: Record<string, unknown> | null;
+  roles: AuthenticatedAccountRole[];
+  tenants: AuthenticatedAccountTenant[];
+  user: AuthenticatedAccountUser | null;
+  createdAt: string | null;
+  updatedAt: string | null;
+  deletedAt: string | null;
+}
+
+export interface IAccountLoader {
+  loadById(accountId: string): Promise<AuthenticatedAccount | null>;
+}

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/account-loader.token.ts

@@ -0,0 +1 @@
+export const ACCOUNT_LOADER = Symbol('ACCOUNT_LOADER');

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/authentication-strategy.port.ts

@@ -0,0 +1,7 @@
+import type { Request } from 'express';
+import type { StrategyOptionsWithRequest } from 'passport-jwt';
+
+export interface IAuthenticationStrategy {
+  getPassportOptions(): StrategyOptionsWithRequest;
+  validate(req: Request, payload: Record<string, unknown>): Promise<object>;
+}

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/authentication-strategy.token.ts

@@ -0,0 +1 @@
+export const AUTHENTICATION_STRATEGY = Symbol('AUTHENTICATION_STRATEGY');

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/credential-verifier.port.ts

@@ -0,0 +1,3 @@
+export interface ICredentialVerifier {
+  verify(username: string, password: string): Promise<{ accountId: string } | null>;
+}

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/credential-verifier.token.ts

@@ -0,0 +1 @@
+export const CREDENTIAL_VERIFIER = Symbol('CREDENTIAL_VERIFIER');

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/hub-session-manager.port.ts

@@ -0,0 +1,31 @@
+/**
+ * Hub session lifecycle: sign + verify the hub_session cookie JWT and verify
+ * the access token posted to the session-establishment endpoint.
+ *
+ * Grouped in a dedicated port because these three operations belong to the same
+ * concern — managing the authenticated session on the hub side — and are injected
+ * by the same consumers (OAuthHubSessionService, OAuthAuthorizeController,
+ * OAuthSessionController).
+ *
+ * Separated from IJwtSigner, which is purely about issuing OAuth access/refresh
+ * tokens, to keep each port's surface area minimal and its responsibility singular.
+ */
+export interface IHubSessionManager {
+  /**
+   * Signs the hub_session JWT (RS256). The token carries { sub: accountId, type: 'hub_session' }.
+   * TTL is configurable via OAUTH_SESSION_COOKIE_TTL env (default 28800 s = 8 h).
+   */
+  signHubSession(accountId: string): string;
+
+  /**
+   * Verifies a hub_session JWT and returns the accountId (sub claim) on success,
+   * or null when invalid, expired, or wrong type.
+   */
+  verifyHubSession(token: string): string | null;
+
+  /**
+   * Verifies an access JWT and returns the aci (accountId) claim, or null on failure.
+   * Used by the session-establishment endpoint to validate the posted access token.
+   */
+  verifyAccessToken(token: string): string | null;
+}

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/hub-session-manager.token.ts

@@ -0,0 +1 @@
+export const HUB_SESSION_MANAGER = Symbol('HUB_SESSION_MANAGER');

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/index.ts

@@ -0,0 +1,10 @@
+export * from './account-loader.port';
+export * from './account-loader.token';
+export * from './authentication-strategy.port';
+export * from './authentication-strategy.token';
+export * from './credential-verifier.port';
+export * from './credential-verifier.token';
+export * from './hub-session-manager.port';
+export * from './hub-session-manager.token';
+export * from './jwt-signer.port';
+export * from './jwt-signer.token';

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/jwt-signer.port.ts

@@ -0,0 +1,15 @@
+export interface SignedToken {
+  token: string;
+  expiresAt: Date;
+}
+
+/**
+ * OAuth token issuance: signs access and refresh tokens using the RS256 key pair.
+ *
+ * Hub session management (signHubSession / verifyHubSession / verifyAccessToken)
+ * has been moved to IHubSessionManager to keep each port's surface area minimal.
+ */
+export interface IJwtSigner {
+  signAccess(payload: { aci: string }): Promise<SignedToken>;
+  signRefresh(): Promise<SignedToken>;
+}

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/ports/jwt-signer.token.ts

@@ -0,0 +1 @@
+export const JWT_SIGNER = Symbol('JWT_SIGNER');

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/resolve-authentication-mode.spec.ts

@@ -0,0 +1,41 @@
+import { resolveAuthenticationMode } from './resolve-authentication-mode';
+
+describe('resolveAuthenticationMode', () => {
+  it('defaults to "none" when the value is undefined', () => {
+    expect(resolveAuthenticationMode(undefined)).toBe('none');
+  });
+
+  it('defaults to "none" when the value is an empty string', () => {
+    expect(resolveAuthenticationMode('')).toBe('none');
+  });
+
+  it('defaults to "none" when the value is blank whitespace', () => {
+    expect(resolveAuthenticationMode('   ')).toBe('none');
+  });
+
+  it('accepts "none" and returns "none"', () => {
+    expect(resolveAuthenticationMode('none')).toBe('none');
+  });
+
+  it('accepts "aurora-hub" and returns "aurora-hub"', () => {
+    expect(resolveAuthenticationMode('aurora-hub')).toBe('aurora-hub');
+  });
+
+  it('accepts "local-provider" and returns "local-provider"', () => {
+    expect(resolveAuthenticationMode('local-provider')).toBe('local-provider');
+  });
+
+  it('throws an error for an invalid value listing the three valid values', () => {
+    expect(() => resolveAuthenticationMode('does-not-exist')).toThrow(
+      /none.*aurora-hub.*local-provider|aurora-hub.*none|local-provider.*none/i,
+    );
+  });
+
+  it('throws a descriptive error that names the invalid value', () => {
+    expect(() => resolveAuthenticationMode('invalid-mode')).toThrow('invalid-mode');
+  });
+
+  it('trims whitespace before resolving', () => {
+    expect(resolveAuthenticationMode('  aurora-hub  ')).toBe('aurora-hub');
+  });
+});

package/dist/templates/backend/application/src/@aurora/modules/authentication/domain/resolve-authentication-mode.ts

@@ -0,0 +1,35 @@
+const AUTHENTICATION_MODE = {
+  NONE: 'none',
+  AURORA_HUB: 'aurora-hub',
+  LOCAL_PROVIDER: 'local-provider',
+} as const;
+
+export type AuthenticationMode = (typeof AUTHENTICATION_MODE)[keyof typeof AUTHENTICATION_MODE];
+
+const VALID_MODES: AuthenticationMode[] = [
+  AUTHENTICATION_MODE.NONE,
+  AUTHENTICATION_MODE.AURORA_HUB,
+  AUTHENTICATION_MODE.LOCAL_PROVIDER,
+];
+
+/**
+ * Resolves the authentication mode from the raw value of `OAUTH_STRATEGY`.
+ *
+ * - Defaults to `'none'` when the raw value is absent or empty (clean install).
+ * - Throws a clear bootstrap-time error listing all valid values when the raw value is unrecognized.
+ * - MUST be called at runtime (inside a `useFactory` or constructor), NOT at module-eval time,
+ *   to respect `.env` load order via `ConfigModule.forRoot({ isGlobal: true })`.
+ */
+export function resolveAuthenticationMode(raw: string | undefined): AuthenticationMode {
+  const trimmed = raw?.trim() ?? '';
+
+  if (trimmed === '') {
+    return AUTHENTICATION_MODE.NONE;
+  }
+
+  if ((VALID_MODES as string[]).includes(trimmed)) {
+    return trimmed as AuthenticationMode;
+  }
+
+  throw new Error(`Invalid OAUTH_STRATEGY="${trimmed}". Valid values: ${VALID_MODES.join(', ')}.`);
+}

package/dist/templates/backend/application/src/@aurora/modules/authentication/index.ts

@@ -0,0 +1,4 @@
+export * from './authentication.module';
+export * from './domain/ports';
+export * from './domain/resolve-authentication-mode';
+export * from './infrastructure/guards';