@awesome-lang-auth/node 1.10.1

package/dist/services/notification.service.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * Notification service for awesome-node-auth.
+ *
+ * Provides a thin, transport-agnostic wrapper around the built-in
+ * `MailerService` and `SmsService` so that business-level notifications
+ * (e.g. "your subscription will expire in 3 days") can be sent over the same
+ * transports that are already configured for authentication flows — without
+ * passing the entire `AuthConfig` to `AuthTools`.
+ *
+ * @since 1.8.0
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotificationService = void 0;
+const mailer_service_1 = require("./mailer.service");
+const sms_service_1 = require("./sms.service");
+/**
+ * A thin facade that exposes email and SMS sending without requiring the
+ * entire `AuthConfig`.  Intended for use with `AuthTools.notify()` when
+ * email or SMS channels are requested.
+ *
+ * @example
+ * ```ts
+ * import { NotificationService } from '@awesome-lang-auth/node';
+ *
+ * const notifications = new NotificationService({
+ *   email: { endpoint: process.env.MAILER_ENDPOINT!, apiKey: process.env.MAILER_KEY!, from: 'no-reply@example.com' },
+ *   sms:   { endpoint: process.env.SMS_ENDPOINT!,    apiKey: process.env.SMS_KEY!,    username: '...', password: '...' },
+ * });
+ *
+ * await notifications.sendEmail({
+ *   to: 'alice@example.com',
+ *   subject: 'Subscription expiring',
+ *   html: '<p>Your subscription expires in 3 days.</p>',
+ * });
+ * ```
+ *
+ * @since 1.8.0
+ */
+class NotificationService {
+    constructor(opts = {}) {
+        if (opts.email)
+            this.mailer = new mailer_service_1.MailerService(opts.email);
+        if (opts.sms)
+            this.sms = new sms_service_1.SmsService(opts.sms);
+    }
+    /**
+     * Send a custom email notification.
+     *
+     * Throws if no email transport is configured.
+     *
+     * @since 1.8.0
+     */
+    async sendEmail(opts) {
+        if (!this.mailer) {
+            throw new Error('[NotificationService] No email transport configured. Pass `email` config to the constructor.');
+        }
+        await this.mailer.sendCustom(opts.to, opts.subject, opts.html, opts.text);
+    }
+    /**
+     * Send a custom SMS notification.
+     *
+     * Throws if no SMS transport is configured.
+     *
+     * @since 1.8.0
+     */
+    async sendSms(opts) {
+        if (!this.sms) {
+            throw new Error('[NotificationService] No SMS transport configured. Pass `sms` config to the constructor.');
+        }
+        await this.sms.sendSms(opts.to, opts.message);
+    }
+    /** `true` when an email transport is configured. */
+    get hasEmail() { return !!this.mailer; }
+    /** `true` when an SMS transport is configured. */
+    get hasSms() { return !!this.sms; }
+}
+exports.NotificationService = NotificationService;
+//# sourceMappingURL=notification.service.js.map

package/dist/services/notification.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.service.js","sourceRoot":"","sources":["../../src/services/notification.service.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,qDAAiD;AACjD,+CAA2C;AAsD3C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAa,mBAAmB;IAI9B,YAAY,OAGR,EAAE;QACJ,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,8BAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,GAAG;YAAI,IAAI,CAAC,GAAG,GAAK,IAAI,wBAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,IAAsB;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,oDAAoD;IACpD,IAAI,QAAQ,KAAc,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,kDAAkD;IAClD,IAAI,MAAM,KAAc,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7C;AA5CD,kDA4CC"}

package/dist/services/password.service.d.ts

@@ -0,0 +1,5 @@
+export declare class PasswordService {
+    hash(password: string, saltRounds?: number): Promise<string>;
+    compare(password: string, hash: string): Promise<boolean>;
+}
+//# sourceMappingURL=password.service.d.ts.map

package/dist/services/password.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.service.d.ts","sourceRoot":"","sources":["../../src/services/password.service.ts"],"names":[],"mappings":"AAEA,qBAAa,eAAe;IACpB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAE,MAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAGhE"}

package/dist/services/password.service.js

@@ -0,0 +1,17 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordService = void 0;
+const bcryptjs_1 = __importDefault(require("bcryptjs"));
+class PasswordService {
+    async hash(password, saltRounds = 12) {
+        return bcryptjs_1.default.hash(password, saltRounds);
+    }
+    async compare(password, hash) {
+        return bcryptjs_1.default.compare(password, hash);
+    }
+}
+exports.PasswordService = PasswordService;
+//# sourceMappingURL=password.service.js.map

package/dist/services/password.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.service.js","sourceRoot":"","sources":["../../src/services/password.service.ts"],"names":[],"mappings":";;;;;;AAAA,wDAA8B;AAE9B,MAAa,eAAe;IAC1B,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,aAAqB,EAAE;QAClD,OAAO,kBAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,IAAY;QAC1C,OAAO,kBAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;CACF;AARD,0CAQC"}

package/dist/services/sms.service.d.ts

@@ -0,0 +1,14 @@
+export interface SmsConfig {
+    endpoint: string;
+    apiKey: string;
+    username: string;
+    password: string;
+    codeExpiresInMinutes?: number;
+}
+export declare class SmsService {
+    private readonly config;
+    constructor(config: SmsConfig);
+    sendSms(phone: string, message: string): Promise<void>;
+    generateCode(digits?: number): string;
+}
+//# sourceMappingURL=sms.service.d.ts.map

package/dist/services/sms.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sms.service.d.ts","sourceRoot":"","sources":["../../src/services/sms.service.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,SAAS;IAE9C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCtD,YAAY,CAAC,MAAM,GAAE,MAAU,GAAG,MAAM;CAKzC"}

package/dist/services/sms.service.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SmsService = void 0;
+const https_1 = __importDefault(require("https"));
+const http_1 = __importDefault(require("http"));
+const url_1 = require("url");
+class SmsService {
+    constructor(config) {
+        this.config = config;
+    }
+    sendSms(phone, message) {
+        return new Promise((resolve, reject) => {
+            const url = new url_1.URL(this.config.endpoint);
+            url.searchParams.set('username', this.config.username);
+            url.searchParams.set('password', this.config.password);
+            url.searchParams.set('phone', phone);
+            url.searchParams.set('message', message);
+            const options = {
+                hostname: url.hostname,
+                port: url.port || (url.protocol === 'https:' ? 443 : 80),
+                path: `${url.pathname}?${url.searchParams.toString()}`,
+                method: 'GET',
+                headers: {
+                    'X-API-Key': this.config.apiKey,
+                },
+            };
+            const transport = url.protocol === 'https:' ? https_1.default : http_1.default;
+            const req = transport.request(options, (res) => {
+                if (res.statusCode && res.statusCode >= 200 && res.statusCode < 300) {
+                    resolve();
+                }
+                else {
+                    reject(new Error(`SMS send failed with status ${res.statusCode}`));
+                }
+                res.resume();
+            });
+            req.on('error', reject);
+            req.end();
+        });
+    }
+    generateCode(digits = 6) {
+        const max = Math.pow(10, digits);
+        const min = Math.pow(10, digits - 1);
+        return String(Math.floor(min + Math.random() * (max - min)));
+    }
+}
+exports.SmsService = SmsService;
+//# sourceMappingURL=sms.service.js.map

package/dist/services/sms.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sms.service.js","sourceRoot":"","sources":["../../src/services/sms.service.ts"],"names":[],"mappings":";;;;;;AAAA,kDAA0B;AAC1B,gDAAwB;AACxB,6BAA0B;AAU1B,MAAa,UAAU;IACrB,YAA6B,MAAiB;QAAjB,WAAM,GAAN,MAAM,CAAW;IAAG,CAAC;IAElD,OAAO,CAAC,KAAa,EAAE,OAAe;QACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,GAAG,GAAG,IAAI,SAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAEzC,MAAM,OAAO,GAAG;gBACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE;gBACtD,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;iBAChC;aACF,CAAC;YAEF,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAK,CAAC,CAAC,CAAC,cAAI,CAAC;YAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC7C,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;oBACpE,OAAO,EAAE,CAAC;gBACZ,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBACrE,CAAC;gBACD,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,SAAiB,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF;AAxCD,gCAwCC"}

package/dist/services/token.service.d.ts

@@ -0,0 +1,62 @@
+import { Request, Response } from 'express';
+import { AccessTokenPayload, TokenPair } from '../models/token.model';
+import { AuthConfig } from '../models/auth-config.model';
+import { JwksClient } from './jwks.service';
+/**
+ * Claim that marks a token signed with the access-token secret which is **not**
+ * an application session token.  Session (access) tokens carry no `purpose`.
+ * @internal
+ */
+export declare const TOKEN_PURPOSE_CLAIM = "purpose";
+/** `purpose` of the 2FA step-up token (`tempToken`) issued after a password. @internal */
+export declare const TEMP_TOKEN_PURPOSE = "2fa";
+/** `purpose` of the admin console token issued by `POST <admin>/login`. @internal */
+export declare const ADMIN_TOKEN_PURPOSE = "admin";
+/** Reset ephemeral-warning flag. Exported for testing only. */
+export declare function _resetEphemeralWarning(): void;
+export declare class TokenService {
+    generateTokenPair(payload: AccessTokenPayload, config: AuthConfig): TokenPair;
+    /**
+     * Generate an RS256-signed token pair for IdP mode.
+     *
+     * IdP mode activates when `config.idProvider.privateKey` is present **or**
+     * `config.idProvider.enabled === true`. A keypair is auto-generated at the
+     * first call if no `privateKey` is configured (for dev; emits a warning).
+     */
+    generateIdProviderTokenPair(payload: AccessTokenPayload, config: AuthConfig): TokenPair;
+    /**
+     * Verify a JWT against a remote JWKS endpoint.
+     * The `kid` header claim is used to select the correct public key.
+     */
+    verifyWithJwks(token: string, jwksClient: JwksClient, expectedIssuer?: string): Promise<AccessTokenPayload>;
+    private _verifyRsaToken;
+    /**
+     * Sign the short-lived 2FA step-up token (`tempToken`) handed out after a
+     * correct password when a second factor is required.  It carries
+     * `purpose: '2fa'`, set after the payload claims so a custom claim cannot
+     * remove it: `verifyAccessToken` refuses it, and only `verifyTempToken`
+     * (the 2FA completion endpoints) accepts it.
+     */
+    generateTempToken(payload: AccessTokenPayload, config: AuthConfig): string;
+    /**
+     * Verify a 2FA step-up token.  Only a token minted by `generateTempToken`
+     * passes: an application access token is refused.  Throws the same
+     * `INVALID_ACCESS_TOKEN` error as `verifyAccessToken`.
+     */
+    verifyTempToken(token: string, config: AuthConfig): AccessTokenPayload;
+    /**
+     * Verify an application session (access) token.  A token signed with the
+     * same secret for another purpose is refused: the 2FA step-up token, and
+     * the admin console token (when the admin `jwtSecret` is the access-token
+     * secret, as `buildAllRouters()` sets it by default).
+     */
+    verifyAccessToken(token: string, config: AuthConfig): AccessTokenPayload;
+    verifyRefreshToken(token: string, config: AuthConfig): AccessTokenPayload;
+    private getCookieName;
+    setTokenCookies(res: Response, tokens: TokenPair, config: AuthConfig): void;
+    initCsrfToken(res: Response, config: AuthConfig): void;
+    clearTokenCookies(res: Response, config?: AuthConfig): void;
+    generateSecureToken(bytes?: number): string;
+    extractTokenFromCookie(req: Request, cookieName: string): string | null;
+}
+//# sourceMappingURL=token.service.d.ts.map

package/dist/services/token.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.d.ts","sourceRoot":"","sources":["../../src/services/token.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAe,MAAM,gBAAgB,CAAC;AAIzD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAC7C,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,QAAQ,CAAC;AACxC,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,UAAU,CAAC;AA8B3C,+DAA+D;AAC/D,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,qBAAa,YAAY;IACvB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,GAAG,SAAS;IAmB7E;;;;;;OAMG;IACH,2BAA2B,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,GAAG,SAAS;IA0DvF;;;OAGG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAiCjH,OAAO,CAAC,eAAe;IAQvB;;;;;;OAMG;IACH,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,GAAG,MAAM;IAS1E;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAWtE;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,kBAAkB;IAYxE,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,kBAAkB;IASzE,OAAO,CAAC,aAAa;IAarB,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IA0C3E,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IAoBtD,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,IAAI;IAsC3D,mBAAmB,CAAC,KAAK,GAAE,MAAW,GAAG,MAAM;IAI/C,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CA6BxE"}

package/dist/services/token.service.js

@@ -0,0 +1,354 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenService = exports.ADMIN_TOKEN_PURPOSE = exports.TEMP_TOKEN_PURPOSE = exports.TOKEN_PURPOSE_CLAIM = void 0;
+exports._resetEphemeralWarning = _resetEphemeralWarning;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const crypto_1 = __importDefault(require("crypto"));
+const errors_1 = require("../models/errors");
+const jwks_service_1 = require("./jwks.service");
+let ephemeralWarningEmitted = false;
+/**
+ * Claim that marks a token signed with the access-token secret which is **not**
+ * an application session token.  Session (access) tokens carry no `purpose`.
+ * @internal
+ */
+exports.TOKEN_PURPOSE_CLAIM = 'purpose';
+/** `purpose` of the 2FA step-up token (`tempToken`) issued after a password. @internal */
+exports.TEMP_TOKEN_PURPOSE = '2fa';
+/** `purpose` of the admin console token issued by `POST <admin>/login`. @internal */
+exports.ADMIN_TOKEN_PURPOSE = 'admin';
+/** Lifetime of the 2FA step-up token. */
+const TEMP_TOKEN_EXPIRES_IN = '5m';
+function invalidAccessToken() {
+    return new errors_1.AuthError('Invalid or expired access token', 'INVALID_ACCESS_TOKEN', 401);
+}
+/**
+ * Lifetime of a signed JWT in milliseconds (`exp - iat`), or `undefined` when
+ * the token has no usable `iat`/`exp`.  The tokens are signed with the
+ * configured `accessTokenExpiresIn` / `refreshTokenExpiresIn`, parsed by
+ * jsonwebtoken itself, so this is the configured lifetime in every format
+ * jsonwebtoken accepts.
+ */
+function tokenLifetimeMs(token) {
+    const decoded = jsonwebtoken_1.default.decode(token);
+    if (decoded && typeof decoded === 'object'
+        && typeof decoded.iat === 'number' && typeof decoded.exp === 'number'
+        && decoded.exp > decoded.iat) {
+        return (decoded.exp - decoded.iat) * 1000;
+    }
+    return undefined;
+}
+/** Cookie lifetimes used when a token carries no `iat`/`exp` (the 1.9.0 values). */
+const DEFAULT_ACCESS_COOKIE_MAX_AGE_MS = 15 * 60 * 1000;
+const DEFAULT_REFRESH_COOKIE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+/** Reset ephemeral-warning flag. Exported for testing only. */
+function _resetEphemeralWarning() {
+    ephemeralWarningEmitted = false;
+}
+class TokenService {
+    generateTokenPair(payload, config) {
+        // Exclude jwt-managed fields; spread remaining claims (including any custom ones).
+        // `purpose` is reserved for tokens that are not sessions (the 2FA step-up
+        // token, the admin console token): drop it, so a custom claim from
+        // `buildTokenPayload` can never mark a session token as one of them.
+        const { iat, exp, [exports.TOKEN_PURPOSE_CLAIM]: _purpose, ...claims } = payload;
+        const accessToken = jsonwebtoken_1.default.sign(claims, config.accessTokenSecret, { expiresIn: config.accessTokenExpiresIn ?? '15m' });
+        const refreshToken = jsonwebtoken_1.default.sign(claims, config.refreshTokenSecret, { expiresIn: config.refreshTokenExpiresIn ?? '7d' });
+        return { accessToken, refreshToken };
+    }
+    /**
+     * Generate an RS256-signed token pair for IdP mode.
+     *
+     * IdP mode activates when `config.idProvider.privateKey` is present **or**
+     * `config.idProvider.enabled === true`. A keypair is auto-generated at the
+     * first call if no `privateKey` is configured (for dev; emits a warning).
+     */
+    generateIdProviderTokenPair(payload, config) {
+        const idp = config.idProvider;
+        const isActive = !!idp?.privateKey || idp?.enabled === true;
+        if (!isActive) {
+            throw new errors_1.AuthError('IdP mode is not enabled', 'IDP_NOT_ENABLED', 500);
+        }
+        let privateKeyPem = idp.privateKey;
+        let publicKeyPem = idp.publicKey;
+        if (!privateKeyPem) {
+            if (!ephemeralWarningEmitted) {
+                console.warn('[awesome-node-auth] IdP mode: no privateKey configured — ' +
+                    'auto-generating an ephemeral RSA keypair. ' +
+                    'All tokens will be invalidated on restart. ' +
+                    'Set idProvider.privateKey in production.');
+                ephemeralWarningEmitted = true;
+            }
+            // Auto-generate ephemeral keypair (dev only)
+            const kp = jwks_service_1.JwksService.generateKeypair();
+            privateKeyPem = kp.privateKey;
+            publicKeyPem = kp.publicKey;
+            // Persist into the config object so subsequent calls reuse the same keypair
+            idp.privateKey = privateKeyPem;
+            idp.publicKey = publicKeyPem;
+        }
+        else if (!publicKeyPem) {
+            publicKeyPem = jwks_service_1.JwksService.derivePublicKey(privateKeyPem);
+            idp.publicKey = publicKeyPem;
+        }
+        // `iat`, `exp` and `kid` are managed by jsonwebtoken (header claim, not payload)
+        const { iat, exp, kid: _kid, ...claims } = payload;
+        const idpClaims = {
+            ...claims,
+            ...(idp.issuer ? { iss: idp.issuer } : {}),
+        };
+        const keyId = 'provisioner-key-1';
+        const expiresIn = (idp.tokenExpiry ?? '30d');
+        const accessToken = jsonwebtoken_1.default.sign(idpClaims, privateKeyPem, {
+            algorithm: 'RS256',
+            expiresIn,
+            keyid: keyId,
+        });
+        // Refresh token also RS256-signed, with a longer expiry.
+        // Priority: idProvider.refreshTokenExpiry → config.refreshTokenExpiresIn → '90d'
+        const refreshToken = jsonwebtoken_1.default.sign(idpClaims, privateKeyPem, {
+            algorithm: 'RS256',
+            expiresIn: (idp.refreshTokenExpiry ?? config.refreshTokenExpiresIn ?? '90d'),
+            keyid: keyId,
+        });
+        return { accessToken, refreshToken };
+    }
+    /**
+     * Verify a JWT against a remote JWKS endpoint.
+     * The `kid` header claim is used to select the correct public key.
+     */
+    async verifyWithJwks(token, jwksClient, expectedIssuer) {
+        try {
+            // Decode without verifying to extract `kid`
+            const decoded = jsonwebtoken_1.default.decode(token, { complete: true });
+            if (!decoded || typeof decoded === 'string') {
+                throw new errors_1.AuthError('Invalid token format', 'INVALID_TOKEN', 401);
+            }
+            const kid = decoded.header.kid;
+            if (!kid) {
+                throw new errors_1.AuthError('Token missing kid header', 'INVALID_TOKEN', 401);
+            }
+            const jwk = await jwksClient.getKey(kid);
+            if (!jwk) {
+                // Key not found — try once more after cache invalidation (supports key rotation)
+                jwksClient.invalidateCache();
+                const retried = await jwksClient.getKey(kid);
+                if (!retried) {
+                    throw new errors_1.AuthError('Unknown signing key', 'INVALID_TOKEN', 401);
+                }
+                const publicKey = jwks_service_1.JwksService.jwkToPublicKey(retried);
+                return this._verifyRsaToken(token, publicKey, expectedIssuer);
+            }
+            const publicKey = jwks_service_1.JwksService.jwkToPublicKey(jwk);
+            return this._verifyRsaToken(token, publicKey, expectedIssuer);
+        }
+        catch (err) {
+            if (err instanceof errors_1.AuthError)
+                throw err;
+            throw new errors_1.AuthError('Invalid or expired token', 'INVALID_TOKEN', 401);
+        }
+    }
+    _verifyRsaToken(token, publicKeyPem, expectedIssuer) {
+        const payload = jsonwebtoken_1.default.verify(token, publicKeyPem, { algorithms: ['RS256'] });
+        if (expectedIssuer && payload.iss !== expectedIssuer) {
+            throw new errors_1.AuthError('Token issuer mismatch', 'INVALID_TOKEN', 401);
+        }
+        return payload;
+    }
+    /**
+     * Sign the short-lived 2FA step-up token (`tempToken`) handed out after a
+     * correct password when a second factor is required.  It carries
+     * `purpose: '2fa'`, set after the payload claims so a custom claim cannot
+     * remove it: `verifyAccessToken` refuses it, and only `verifyTempToken`
+     * (the 2FA completion endpoints) accepts it.
+     */
+    generateTempToken(payload, config) {
+        const { iat, exp, ...claims } = payload;
+        return jsonwebtoken_1.default.sign({ ...claims, [exports.TOKEN_PURPOSE_CLAIM]: exports.TEMP_TOKEN_PURPOSE }, config.accessTokenSecret, { expiresIn: TEMP_TOKEN_EXPIRES_IN });
+    }
+    /**
+     * Verify a 2FA step-up token.  Only a token minted by `generateTempToken`
+     * passes: an application access token is refused.  Throws the same
+     * `INVALID_ACCESS_TOKEN` error as `verifyAccessToken`.
+     */
+    verifyTempToken(token, config) {
+        let payload;
+        try {
+            payload = jsonwebtoken_1.default.verify(token, config.accessTokenSecret);
+        }
+        catch {
+            throw invalidAccessToken();
+        }
+        if (payload?.[exports.TOKEN_PURPOSE_CLAIM] !== exports.TEMP_TOKEN_PURPOSE)
+            throw invalidAccessToken();
+        return payload;
+    }
+    /**
+     * Verify an application session (access) token.  A token signed with the
+     * same secret for another purpose is refused: the 2FA step-up token, and
+     * the admin console token (when the admin `jwtSecret` is the access-token
+     * secret, as `buildAllRouters()` sets it by default).
+     */
+    verifyAccessToken(token, config) {
+        let payload;
+        try {
+            payload = jsonwebtoken_1.default.verify(token, config.accessTokenSecret);
+        }
+        catch {
+            throw invalidAccessToken();
+        }
+        const purpose = payload?.[exports.TOKEN_PURPOSE_CLAIM];
+        if (purpose === exports.TEMP_TOKEN_PURPOSE || purpose === exports.ADMIN_TOKEN_PURPOSE)
+            throw invalidAccessToken();
+        return payload;
+    }
+    verifyRefreshToken(token, config) {
+        try {
+            const payload = jsonwebtoken_1.default.verify(token, config.refreshTokenSecret);
+            return payload;
+        }
+        catch {
+            throw new errors_1.AuthError('Invalid or expired refresh token', 'INVALID_REFRESH_TOKEN', 401);
+        }
+    }
+    getCookieName(name, config) {
+        if (!config.cookieOptions?.secure)
+            return name;
+        // __Host- needs Secure, Path=/, and NO Domain.
+        // We use it if path is '/' (default) and domain is not set.
+        const isPathRoot = !config.cookieOptions?.path || config.cookieOptions.path === '/';
+        if (isPathRoot && !config.cookieOptions?.domain) {
+            return `__Host-${name}`;
+        }
+        return `__Secure-${name}`;
+    }
+    setTokenCookies(res, tokens, config) {
+        const commonOpts = {
+            httpOnly: true,
+            secure: config.cookieOptions?.secure ?? false,
+            sameSite: (config.cookieOptions?.sameSite ?? 'lax'),
+            path: config.cookieOptions?.path ?? '/',
+        };
+        const setCookie = (name, value, extraOpts = {}) => {
+            const finalName = this.getCookieName(name, config);
+            const opts = { ...commonOpts, ...extraOpts };
+            if (finalName.startsWith('__Host-')) {
+                delete opts.domain;
+                opts.path = '/'; // __Host- requires path=/
+                opts.secure = true; // __Host- requires Secure
+            }
+            else {
+                opts.domain = config.cookieOptions?.domain;
+            }
+            res.cookie(finalName, value, opts);
+        };
+        // Each cookie lives as long as the token it carries, i.e. the configured
+        // accessTokenExpiresIn / refreshTokenExpiresIn.
+        setCookie('accessToken', tokens.accessToken, {
+            maxAge: tokenLifetimeMs(tokens.accessToken) ?? DEFAULT_ACCESS_COOKIE_MAX_AGE_MS,
+        });
+        const refreshPath = config.cookieOptions?.refreshTokenPath
+            ?? (config.apiPrefix ? `${config.apiPrefix}/refresh` : '/auth/refresh');
+        setCookie('refreshToken', tokens.refreshToken, {
+            maxAge: tokenLifetimeMs(tokens.refreshToken) ?? DEFAULT_REFRESH_COOKIE_MAX_AGE_MS,
+            path: refreshPath
+        });
+        if (config.csrf?.enabled) {
+            setCookie('csrf-token', this.generateSecureToken(16), {
+                httpOnly: false,
+                maxAge: 15 * 60 * 1000
+            });
+        }
+    }
+    initCsrfToken(res, config) {
+        if (!config.csrf?.enabled)
+            return;
+        const name = this.getCookieName('csrf-token', config);
+        const opts = {
+            httpOnly: false,
+            secure: config.cookieOptions?.secure ?? false,
+            sameSite: (config.cookieOptions?.sameSite ?? 'lax'),
+            path: config.cookieOptions?.path ?? '/',
+            maxAge: 15 * 60 * 1000,
+        };
+        if (name.startsWith('__Host-')) {
+            delete opts.domain;
+            opts.path = '/'; // __Host- requires path=/
+            opts.secure = true; // __Host- requires Secure
+        }
+        else {
+            opts.domain = config.cookieOptions?.domain;
+        }
+        res.cookie(name, this.generateSecureToken(16), opts);
+    }
+    clearTokenCookies(res, config) {
+        const commonOpts = {
+            secure: config?.cookieOptions?.secure ?? false,
+            sameSite: (config?.cookieOptions?.sameSite ?? 'lax'),
+            path: config?.cookieOptions?.path ?? '/',
+        };
+        const clearCookie = (name, extraOpts = {}) => {
+            // For maximum robustness, we try to clear the primary name AND prefixed variants.
+            // Cookies are only cleared if BOTH name, path, and domain match exactly.
+            const primaryName = this.getCookieName(name, config || {});
+            const possibleNames = new Set([primaryName, `__Host-${name}`, `__Secure-${name}`, name]);
+            for (const finalName of possibleNames) {
+                const opts = { ...commonOpts, ...extraOpts };
+                if (finalName.startsWith('__Host-')) {
+                    delete opts.domain;
+                    opts.path = '/'; // __Host- requires path=/
+                    opts.secure = true;
+                }
+                else {
+                    opts.domain = config?.cookieOptions?.domain;
+                }
+                res.clearCookie(finalName, opts);
+            }
+        };
+        clearCookie('accessToken');
+        // Mirror the path logic from setTokenCookies so the cookie is found and deleted.
+        const refreshPath = config?.cookieOptions?.refreshTokenPath
+            ?? (config?.apiPrefix ? `${config?.apiPrefix}/refresh` : '/auth/refresh');
+        clearCookie('refreshToken', { path: refreshPath });
+        if (config?.csrf?.enabled) {
+            clearCookie('csrf-token');
+        }
+    }
+    generateSecureToken(bytes = 32) {
+        return crypto_1.default.randomBytes(bytes).toString('hex');
+    }
+    extractTokenFromCookie(req, cookieName) {
+        // List of possible prefixed names in order of preference
+        const possibleNames = [
+            `__Host-${cookieName}`,
+            `__Secure-${cookieName}`,
+            cookieName
+        ];
+        for (const name of possibleNames) {
+            // First try cookie-parser parsed cookies
+            if (req.cookies && req.cookies[name]) {
+                return req.cookies[name];
+            }
+        }
+        // Fallback: parse raw Cookie header
+        const cookieHeader = req.headers?.cookie;
+        if (!cookieHeader)
+            return null;
+        const cookies = cookieHeader.split(';').reduce((acc, part) => {
+            const [key, ...val] = part.trim().split('=');
+            if (key)
+                acc[key.trim()] = decodeURIComponent(val.join('='));
+            return acc;
+        }, {});
+        for (const name of possibleNames) {
+            if (cookies[name])
+                return cookies[name];
+        }
+        return null;
+    }
+}
+exports.TokenService = TokenService;
+//# sourceMappingURL=token.service.js.map

package/dist/services/token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../src/services/token.service.ts"],"names":[],"mappings":";;;;;;AAkDA,wDAEC;AApDD,gEAA+B;AAC/B,oDAA4B;AAI5B,6CAA6C;AAC7C,iDAAyD;AAEzD,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC;;;;GAIG;AACU,QAAA,mBAAmB,GAAG,SAAS,CAAC;AAC7C,0FAA0F;AAC7E,QAAA,kBAAkB,GAAG,KAAK,CAAC;AACxC,qFAAqF;AACxE,QAAA,mBAAmB,GAAG,OAAO,CAAC;AAE3C,yCAAyC;AACzC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,SAAS,kBAAkB;IACzB,OAAO,IAAI,kBAAS,CAAC,iCAAiC,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;WACrC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;WAClE,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oFAAoF;AACpF,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD,MAAM,iCAAiC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE,+DAA+D;AAC/D,SAAgB,sBAAsB;IACpC,uBAAuB,GAAG,KAAK,CAAC;AAClC,CAAC;AAED,MAAa,YAAY;IACvB,iBAAiB,CAAC,OAA2B,EAAE,MAAkB;QAC/D,mFAAmF;QACnF,0EAA0E;QAC1E,mEAAmE;QACnE,qEAAqE;QACrE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,2BAAmB,CAAC,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QACzE,MAAM,WAAW,GAAG,sBAAG,CAAC,IAAI,CAC1B,MAAM,EACN,MAAM,CAAC,iBAAiB,EACxB,EAAE,SAAS,EAAE,MAAM,CAAC,oBAAoB,IAAI,KAAK,EAAqB,CACvE,CAAC;QACF,MAAM,YAAY,GAAG,sBAAG,CAAC,IAAI,CAC3B,MAAM,EACN,MAAM,CAAC,kBAAkB,EACzB,EAAE,SAAS,EAAE,MAAM,CAAC,qBAAqB,IAAI,IAAI,EAAqB,CACvE,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,2BAA2B,CAAC,OAA2B,EAAE,MAAkB;QACzE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,EAAE,UAAU,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;QAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,kBAAS,CAAC,yBAAyB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,aAAa,GAAG,GAAI,CAAC,UAAU,CAAC;QACpC,IAAI,YAAY,GAAG,GAAI,CAAC,SAAS,CAAC;QAElC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,uBAAuB,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CACV,2DAA2D;oBAC3D,4CAA4C;oBAC5C,6CAA6C;oBAC7C,0CAA0C,CAC3C,CAAC;gBACF,uBAAuB,GAAG,IAAI,CAAC;YACjC,CAAC;YACD,6CAA6C;YAC7C,MAAM,EAAE,GAAG,0BAAW,CAAC,eAAe,EAAE,CAAC;YACzC,aAAa,GAAG,EAAE,CAAC,UAAU,CAAC;YAC9B,YAAY,GAAG,EAAE,CAAC,SAAS,CAAC;YAC5B,4EAA4E;YAC5E,GAAI,CAAC,UAAU,GAAG,aAAa,CAAC;YAChC,GAAI,CAAC,SAAS,GAAG,YAAY,CAAC;QAChC,CAAC;aAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACzB,YAAY,GAAG,0BAAW,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;YAC1D,GAAI,CAAC,SAAS,GAAG,YAAY,CAAC;QAChC,CAAC;QAED,iFAAiF;QACjF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QACnD,MAAM,SAAS,GAAG;YAChB,GAAG,MAAM;YACT,GAAG,CAAC,GAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC;QACF,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAElC,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,KAAK,CAAiC,CAAC;QAC7E,MAAM,WAAW,GAAG,sBAAG,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE;YACrD,SAAS,EAAE,OAAO;YAClB,SAAS;YACT,KAAK,EAAE,KAAK;SACM,CAAC,CAAC;QAEtB,yDAAyD;QACzD,iFAAiF;QACjF,MAAM,YAAY,GAAG,sBAAG,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE;YACtD,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,CAAC,GAAG,CAAC,kBAAkB,IAAI,MAAM,CAAC,qBAAqB,IAAI,KAAK,CAAiC;YAC5G,KAAK,EAAE,KAAK;SACM,CAAC,CAAC;QAEtB,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,UAAsB,EAAE,cAAuB;QACjF,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC5C,MAAM,IAAI,kBAAS,CAAC,sBAAsB,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,GAAG,GAAI,OAAO,CAAC,MAA2B,CAAC,GAAG,CAAC;YACrD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,kBAAS,CAAC,0BAA0B,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,iFAAiF;gBACjF,UAAU,CAAC,eAAe,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,kBAAS,CAAC,qBAAqB,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,SAAS,GAAG,0BAAW,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;gBACtD,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,SAAS,GAAG,0BAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAS;gBAAE,MAAM,GAAG,CAAC;YACxC,MAAM,IAAI,kBAAS,CAAC,0BAA0B,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,KAAa,EAAE,YAAoB,EAAE,cAAuB;QAClF,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAuB,CAAC;QACjG,IAAI,cAAc,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc,EAAE,CAAC;YACrD,MAAM,IAAI,kBAAS,CAAC,uBAAuB,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,OAA2B,EAAE,MAAkB;QAC/D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;QACxC,OAAO,sBAAG,CAAC,IAAI,CACb,EAAE,GAAG,MAAM,EAAE,CAAC,2BAAmB,CAAC,EAAE,0BAAkB,EAAE,EACxD,MAAM,CAAC,iBAAiB,EACxB,EAAE,SAAS,EAAE,qBAAqB,EAAqB,CACxD,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,KAAa,EAAE,MAAkB;QAC/C,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAuB,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,kBAAkB,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,OAAO,EAAE,CAAC,2BAAmB,CAAC,KAAK,0BAAkB;YAAE,MAAM,kBAAkB,EAAE,CAAC;QACtF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,iBAAiB,CAAC,KAAa,EAAE,MAAkB;QACjD,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAuB,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,kBAAkB,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,2BAAmB,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,0BAAkB,IAAI,OAAO,KAAK,2BAAmB;YAAE,MAAM,kBAAkB,EAAE,CAAC;QAClG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kBAAkB,CAAC,KAAa,EAAE,MAAkB;QAClD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAuB,CAAC;YACnF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,kBAAS,CAAC,kCAAkC,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAY,EAAE,MAAkB;QACpD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC;QAE/C,+CAA+C;QAC/C,4DAA4D;QAC5D,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,KAAK,GAAG,CAAC;QACpF,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC;YAChD,OAAO,UAAU,IAAI,EAAE,CAAC;QAC1B,CAAC;QAED,OAAO,YAAY,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,eAAe,CAAC,GAAa,EAAE,MAAiB,EAAE,MAAkB;QAClE,MAAM,UAAU,GAAG;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,IAAI,KAAK;YAC7C,QAAQ,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,IAAI,KAAK,CAA8B;YAChF,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,IAAI,GAAG;SACxC,CAAC;QAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,YAAiB,EAAE,EAAE,EAAE;YACrE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;YAC7C,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC,MAAM,CAAC;gBACnB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,0BAA0B;gBAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,0BAA0B;YAChD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;YAC7C,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC,CAAC;QAEF,yEAAyE;QACzE,gDAAgD;QAChD,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,EAAE;YAC3C,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,gCAAgC;SAChF,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,gBAAgB;eACrD,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC1E,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;YAC7C,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,iCAAiC;YACjF,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YACzB,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE;gBACpD,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,aAAa,CAAC,GAAa,EAAE,MAAkB;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO;YAAE,OAAO;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,IAAI,GAAQ;YAChB,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,IAAI,KAAK;YAC7C,QAAQ,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,IAAI,KAAK,CAA8B;YAChF,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,IAAI,IAAI,GAAG;YACvC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;SACvB,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,MAAM,CAAC;YACnB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,0BAA0B;YAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,0BAA0B;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;QAC7C,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,iBAAiB,CAAC,GAAa,EAAE,MAAmB;QAClD,MAAM,UAAU,GAAQ;YACtB,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,KAAK;YAC9C,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,IAAI,KAAK,CAA8B;YACjF,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,IAAI,GAAG;SACzC,CAAC;QAEF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,YAAiB,EAAE,EAAE,EAAE;YACxD,kFAAkF;YAClF,yEAAyE;YACzE,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,IAAI,EAAgB,CAAC,CAAC;YACzE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,IAAI,EAAE,EAAE,YAAY,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;YAEzF,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;gBACtC,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;gBAC7C,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC,MAAM,CAAC;oBACnB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,0BAA0B;oBAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACrB,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;gBAC9C,CAAC;gBACD,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;QAEF,WAAW,CAAC,aAAa,CAAC,CAAC;QAE3B,iFAAiF;QACjF,MAAM,WAAW,GAAG,MAAM,EAAE,aAAa,EAAE,gBAAgB;eACtD,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,SAAS,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC5E,WAAW,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAEnD,IAAI,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC1B,WAAW,CAAC,YAAY,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,mBAAmB,CAAC,QAAgB,EAAE;QACpC,OAAO,gBAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,sBAAsB,CAAC,GAAY,EAAE,UAAkB;QACrD,yDAAyD;QACzD,MAAM,aAAa,GAAG;YACpB,UAAU,UAAU,EAAE;YACtB,YAAY,UAAU,EAAE;YACxB,UAAU;SACX,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,yCAAyC;YACzC,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,CAAW,CAAC;YACrC,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC;QACzC,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAyB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YACnF,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,OAAO,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA/UD,oCA+UC"}

package/dist/stores/memory-template.store.d.ts

@@ -0,0 +1,12 @@
+import { ITemplateStore, MailTemplate, UiTranslation } from '../interfaces/template-store.interface';
+export declare class MemoryTemplateStore implements ITemplateStore {
+    private mailTemplates;
+    private uiTranslations;
+    getMailTemplate(id: string): Promise<MailTemplate | null>;
+    listMailTemplates(): Promise<MailTemplate[]>;
+    updateMailTemplate(id: string, template: Partial<MailTemplate>): Promise<void>;
+    getUiTranslations(page: string): Promise<UiTranslation | null>;
+    listUiTranslations(): Promise<UiTranslation[]>;
+    updateUiTranslations(page: string, translations: Record<string, Record<string, string>>): Promise<void>;
+}
+//# sourceMappingURL=memory-template.store.d.ts.map

package/dist/stores/memory-template.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-template.store.d.ts","sourceRoot":"","sources":["../../src/stores/memory-template.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAErG,qBAAa,mBAAoB,YAAW,cAAc;IACtD,OAAO,CAAC,aAAa,CAAwC;IAC7D,OAAO,CAAC,cAAc,CAAyC;IAEzD,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAIzD,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAI5C,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAI9D,kBAAkB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAI9C,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhH"}