@awesome-lang-auth/node 1.10.1

package/dist/stores/memory-template.store.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryTemplateStore = void 0;
+class MemoryTemplateStore {
+    constructor() {
+        this.mailTemplates = new Map();
+        this.uiTranslations = new Map();
+    }
+    async getMailTemplate(id) {
+        return this.mailTemplates.get(id) || null;
+    }
+    async listMailTemplates() {
+        return Array.from(this.mailTemplates.values());
+    }
+    async updateMailTemplate(id, template) {
+        const existing = this.mailTemplates.get(id) || {
+            id,
+            baseHtml: '',
+            baseText: '',
+            translations: {}
+        };
+        this.mailTemplates.set(id, { ...existing, ...template });
+    }
+    async getUiTranslations(page) {
+        return this.uiTranslations.get(page) || null;
+    }
+    async listUiTranslations() {
+        return Array.from(this.uiTranslations.values());
+    }
+    async updateUiTranslations(page, translations) {
+        this.uiTranslations.set(page, { page, translations });
+    }
+}
+exports.MemoryTemplateStore = MemoryTemplateStore;
+//# sourceMappingURL=memory-template.store.js.map

package/dist/stores/memory-template.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-template.store.js","sourceRoot":"","sources":["../../src/stores/memory-template.store.ts"],"names":[],"mappings":";;;AAEA,MAAa,mBAAmB;IAAhC;QACY,kBAAa,GAA8B,IAAI,GAAG,EAAE,CAAC;QACrD,mBAAc,GAA+B,IAAI,GAAG,EAAE,CAAC;IA+BnE,CAAC;IA7BG,KAAK,CAAC,eAAe,CAAC,EAAU;QAC5B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB;QACnB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,QAA+B;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI;YAC3C,EAAE;YACF,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;SACnB,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAChC,OAAO,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,kBAAkB;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAAY,EAAE,YAAoD;QACzF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1D,CAAC;CACJ;AAjCD,kDAiCC"}

package/dist/strategies/api-key/api-key.strategy.d.ts

@@ -0,0 +1,72 @@
+import { IApiKeyStore } from '../../interfaces/api-key-store.interface';
+import { ApiKeyContext } from '../../models/api-key.model';
+/** Options that control how the strategy validates incoming requests. */
+export interface ApiKeyStrategyOptions {
+    /**
+     * When `true`, `req.ip` (set by Express) is compared against the key's
+     * `allowedIps` list.  If the IP is not on the list the request is rejected.
+     *
+     * @default true
+     */
+    enforceIpAllowlist?: boolean;
+    /**
+     * When provided, only keys that include **all** of the listed scopes are
+     * accepted.  Use this to require specific capabilities at the middleware
+     * level.
+     *
+     * @example `['tools:read']`
+     */
+    requiredScopes?: string[];
+    /**
+     * When `true`, a usage entry is appended to the store's audit log after
+     * every authentication attempt (success or failure).
+     *
+     * @default false
+     */
+    auditLog?: boolean;
+}
+/**
+ * Stateless helper that validates API keys from an HTTP request.
+ *
+ * Accepted header formats (checked in order):
+ *  1. `Authorization: ApiKey <key>`
+ *  2. `X-Api-Key: <key>`
+ *
+ * Validation steps:
+ *  1. Extract the key from the header.
+ *  2. Find an active candidate record by prefix.
+ *  3. Verify the bcrypt hash.
+ *  4. Check expiry.
+ *  5. (Optional) Check IP allowlist.
+ *  6. (Optional) Check required scopes.
+ *  7. Update `lastUsedAt` + optional audit log.
+ */
+export declare class ApiKeyStrategy {
+    private readonly store;
+    private readonly options;
+    constructor(store: IApiKeyStore, options?: ApiKeyStrategyOptions);
+    /**
+     * Extract and validate the API key from the provided headers and remote IP.
+     *
+     * @param headers  HTTP request headers (`req.headers`).
+     * @param remoteIp Client IP address (`req.ip`).
+     * @returns        The `ApiKeyContext` on success.
+     * @throws         `AuthError` on any validation failure.
+     */
+    authenticate(headers: Record<string, string | string[] | undefined>, remoteIp?: string): Promise<ApiKeyContext>;
+    /**
+     * Extract the raw API key from the request headers.
+     * Accepts `Authorization: ApiKey <key>` and `X-Api-Key: <key>`.
+     */
+    private extractKey;
+    /**
+     * Check whether `ip` is contained in one of the `allowedIps` entries.
+     * Supports exact IPv4/IPv6 matches and CIDR notation for IPv4.
+     */
+    private isIpAllowed;
+    /** Simple IPv4 CIDR check. Returns false for IPv6 CIDRs (not supported). */
+    private ipInCidr;
+    private ipToNumber;
+    private appendAuditLog;
+}
+//# sourceMappingURL=api-key.strategy.d.ts.map

package/dist/strategies/api-key/api-key.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.strategy.d.ts","sourceRoot":"","sources":["../../../src/strategies/api-key/api-key.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAoB,MAAM,0CAA0C,CAAC;AAE1F,OAAO,EAAU,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAGnE,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAYD;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,qBAA0B;IAGtD;;;;;;;OAOG;IACG,YAAY,CAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,CAAC;IAqEzB;;;OAGG;IACH,OAAO,CAAC,UAAU;IAYlB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAYnB,4EAA4E;IAC5E,OAAO,CAAC,QAAQ;IAehB,OAAO,CAAC,UAAU;YAYJ,cAAc;CAwB7B"}

package/dist/strategies/api-key/api-key.strategy.js

@@ -0,0 +1,182 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyStrategy = void 0;
+const api_key_service_1 = require("../../services/api-key.service");
+const errors_1 = require("../../models/errors");
+const apiKeyService = new api_key_service_1.ApiKeyService();
+/**
+ * Dummy bcrypt hash used when no key record is found in the store.
+ * Running `verifyKey` against this hash ensures the bcrypt work factor is
+ * always paid — preventing timing attacks that could reveal whether a given
+ * key prefix exists in the database.
+ */
+const TIMING_MITIGATION_DUMMY_HASH = '$2a$10$invalidhashpaddingtomitigatetiming0000000000000000000';
+/**
+ * Stateless helper that validates API keys from an HTTP request.
+ *
+ * Accepted header formats (checked in order):
+ *  1. `Authorization: ApiKey <key>`
+ *  2. `X-Api-Key: <key>`
+ *
+ * Validation steps:
+ *  1. Extract the key from the header.
+ *  2. Find an active candidate record by prefix.
+ *  3. Verify the bcrypt hash.
+ *  4. Check expiry.
+ *  5. (Optional) Check IP allowlist.
+ *  6. (Optional) Check required scopes.
+ *  7. Update `lastUsedAt` + optional audit log.
+ */
+class ApiKeyStrategy {
+    constructor(store, options = {}) {
+        this.store = store;
+        this.options = options;
+    }
+    /**
+     * Extract and validate the API key from the provided headers and remote IP.
+     *
+     * @param headers  HTTP request headers (`req.headers`).
+     * @param remoteIp Client IP address (`req.ip`).
+     * @returns        The `ApiKeyContext` on success.
+     * @throws         `AuthError` on any validation failure.
+     */
+    async authenticate(headers, remoteIp) {
+        const rawKey = this.extractKey(headers);
+        if (!rawKey) {
+            throw new errors_1.AuthError('API key is required', 'API_KEY_MISSING', 401);
+        }
+        const prefix = apiKeyService.extractPrefix(rawKey);
+        const record = await this.store.findByPrefix(prefix);
+        // Always run bcrypt even when no record is found (timing-attack mitigation).
+        const hashToCompare = record?.keyHash ?? TIMING_MITIGATION_DUMMY_HASH;
+        const valid = await apiKeyService.verifyKey(rawKey, hashToCompare);
+        if (!valid || !record) {
+            await this.appendAuditLog(null, remoteIp, headers, false, 'INVALID_KEY');
+            throw new errors_1.AuthError('Invalid API key', 'API_KEY_INVALID', 401);
+        }
+        // Key must still be active
+        if (!record.isActive) {
+            await this.appendAuditLog(record, remoteIp, headers, false, 'KEY_REVOKED');
+            throw new errors_1.AuthError('API key has been revoked', 'API_KEY_REVOKED', 401);
+        }
+        // Expiry check
+        if (record.expiresAt && new Date() > record.expiresAt) {
+            await this.appendAuditLog(record, remoteIp, headers, false, 'KEY_EXPIRED');
+            throw new errors_1.AuthError('API key has expired', 'API_KEY_EXPIRED', 401);
+        }
+        // IP allowlist check
+        const enforceIp = this.options.enforceIpAllowlist !== false;
+        if (enforceIp && record.allowedIps && record.allowedIps.length > 0) {
+            if (!remoteIp || !this.isIpAllowed(remoteIp, record.allowedIps)) {
+                await this.appendAuditLog(record, remoteIp, headers, false, 'IP_NOT_ALLOWED');
+                throw new errors_1.AuthError('IP address not allowed for this API key', 'API_KEY_IP_BLOCKED', 403);
+            }
+        }
+        // Scope check
+        const requiredScopes = this.options.requiredScopes ?? [];
+        if (requiredScopes.length > 0) {
+            const keyScopes = record.scopes ?? [];
+            const missing = requiredScopes.filter((s) => !keyScopes.includes(s));
+            if (missing.length > 0) {
+                await this.appendAuditLog(record, remoteIp, headers, false, 'INSUFFICIENT_SCOPE');
+                throw new errors_1.AuthError(`API key missing required scopes: ${missing.join(', ')}`, 'API_KEY_INSUFFICIENT_SCOPE', 403);
+            }
+        }
+        // Success — update last-used timestamp and audit log
+        await this.store.updateLastUsed(record.id, new Date());
+        await this.appendAuditLog(record, remoteIp, headers, true);
+        return {
+            keyId: record.id,
+            keyPrefix: record.keyPrefix,
+            name: record.name,
+            serviceId: record.serviceId,
+            scopes: record.scopes ?? [],
+        };
+    }
+    // ── Private helpers ───────────────────────────────────────────────────────
+    /**
+     * Extract the raw API key from the request headers.
+     * Accepts `Authorization: ApiKey <key>` and `X-Api-Key: <key>`.
+     */
+    extractKey(headers) {
+        const authHeader = headers['authorization'];
+        if (typeof authHeader === 'string' && authHeader.startsWith('ApiKey ')) {
+            return authHeader.slice(7).trim() || null;
+        }
+        const xApiKey = headers['x-api-key'];
+        if (typeof xApiKey === 'string' && xApiKey.trim()) {
+            return xApiKey.trim();
+        }
+        return null;
+    }
+    /**
+     * Check whether `ip` is contained in one of the `allowedIps` entries.
+     * Supports exact IPv4/IPv6 matches and CIDR notation for IPv4.
+     */
+    isIpAllowed(ip, allowedIps) {
+        const normalized = ip.replace(/^::ffff:/, ''); // unwrap IPv4-mapped IPv6
+        for (const entry of allowedIps) {
+            if (entry.includes('/')) {
+                if (this.ipInCidr(normalized, entry))
+                    return true;
+            }
+            else if (normalized === entry || ip === entry) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /** Simple IPv4 CIDR check. Returns false for IPv6 CIDRs (not supported). */
+    ipInCidr(ip, cidr) {
+        try {
+            const [range, bitsStr] = cidr.split('/');
+            const bits = parseInt(bitsStr, 10);
+            if (isNaN(bits))
+                return false;
+            const ipNum = this.ipToNumber(ip);
+            const rangeNum = this.ipToNumber(range);
+            if (ipNum === null || rangeNum === null)
+                return false;
+            const mask = bits === 0 ? 0 : (~0 << (32 - bits)) >>> 0;
+            return (ipNum & mask) === (rangeNum & mask);
+        }
+        catch {
+            return false;
+        }
+    }
+    ipToNumber(ip) {
+        const parts = ip.split('.');
+        if (parts.length !== 4)
+            return null;
+        let num = 0;
+        for (const part of parts) {
+            const n = parseInt(part, 10);
+            if (isNaN(n) || n < 0 || n > 255)
+                return null;
+            num = (num << 8) | n;
+        }
+        return num >>> 0;
+    }
+    async appendAuditLog(record, ip, headers, success, failureReason) {
+        if (!this.options.auditLog || !this.store.logUsage)
+            return;
+        const entry = {
+            // When record is null (unknown key), use '<unknown>' so the attempt is
+            // still audited without blocking and without exposing internal state.
+            keyId: record?.id ?? '<unknown>',
+            timestamp: new Date(),
+            ip,
+            userAgent: typeof headers['user-agent'] === 'string' ? headers['user-agent'] : undefined,
+            success,
+            failureReason,
+        };
+        try {
+            await this.store.logUsage(entry);
+        }
+        catch {
+            // Audit log failures must never block the request
+        }
+    }
+}
+exports.ApiKeyStrategy = ApiKeyStrategy;
+//# sourceMappingURL=api-key.strategy.js.map

package/dist/strategies/api-key/api-key.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.strategy.js","sourceRoot":"","sources":["../../../src/strategies/api-key/api-key.strategy.ts"],"names":[],"mappings":";;;AACA,oEAA+D;AAE/D,gDAAgD;AA8BhD,MAAM,aAAa,GAAG,IAAI,+BAAa,EAAE,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG,8DAA8D,CAAC;AAEpG;;;;;;;;;;;;;;;GAeG;AACH,MAAa,cAAc;IACzB,YACmB,KAAmB,EACnB,UAAiC,EAAE;QADnC,UAAK,GAAL,KAAK,CAAc;QACnB,YAAO,GAAP,OAAO,CAA4B;IACnD,CAAC;IAEJ;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAChB,OAAsD,EACtD,QAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,kBAAS,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAErD,6EAA6E;QAC7E,MAAM,aAAa,GAAG,MAAM,EAAE,OAAO,IAAI,4BAA4B,CAAC;QACtE,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAEnE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YACzE,MAAM,IAAI,kBAAS,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YAC3E,MAAM,IAAI,kBAAS,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,eAAe;QACf,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YACtD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YAC3E,MAAM,IAAI,kBAAS,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,qBAAqB;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC;QAC5D,IAAI,SAAS,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;gBAC9E,MAAM,IAAI,kBAAS,CAAC,yCAAyC,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QAED,cAAc;QACd,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;QACzD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;gBAClF,MAAM,IAAI,kBAAS,CACjB,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxD,4BAA4B,EAC5B,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAE3D,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,EAAE;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E;;;OAGG;IACK,UAAU,CAAC,OAAsD;QACvE,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,EAAU,EAAE,UAAoB;QAClD,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,0BAA0B;QACzE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;YACpD,CAAC;iBAAM,IAAI,UAAU,KAAK,KAAK,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4EAA4E;IACpE,QAAQ,CAAC,EAAU,EAAE,IAAY;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,EAAU;QAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC;YAC9C,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,GAAG,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAAqB,EACrB,EAAsB,EACtB,OAAsD,EACtD,OAAgB,EAChB,aAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO;QAC3D,MAAM,KAAK,GAAqB;YAC9B,uEAAuE;YACvE,sEAAsE;YACtE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,WAAW;YAChC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,EAAE;YACF,SAAS,EAAE,OAAO,OAAO,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;YACxF,OAAO;YACP,aAAa;SACd,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;CACF;AA1KD,wCA0KC"}

package/dist/strategies/local/local.strategy.d.ts

@@ -0,0 +1,19 @@
+import { BaseAuthStrategy } from '../../abstract/base-auth-strategy.abstract';
+import { AuthConfig } from '../../models/auth-config.model';
+import { BaseUser } from '../../models/user.model';
+import { IUserStore } from '../../interfaces/user-store.interface';
+import { PasswordService } from '../../services/password.service';
+export declare class LocalStrategy extends BaseAuthStrategy<{
+    email: string;
+    password: string;
+}, BaseUser> {
+    private readonly userStore;
+    private readonly passwordService;
+    name: string;
+    constructor(userStore: IUserStore, passwordService: PasswordService);
+    authenticate(input: {
+        email: string;
+        password: string;
+    }, config: AuthConfig): Promise<BaseUser>;
+}
+//# sourceMappingURL=local.strategy.d.ts.map

package/dist/strategies/local/local.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.strategy.d.ts","sourceRoot":"","sources":["../../../src/strategies/local/local.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4CAA4C,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,qBAAa,aAAc,SAAQ,gBAAgB,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,QAAQ,CAAC;IAI9F,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAJlC,IAAI,SAAW;gBAGI,SAAS,EAAE,UAAU,EACrB,eAAe,EAAE,eAAe;IAK7C,YAAY,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;CAiCtG"}

package/dist/strategies/local/local.strategy.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalStrategy = void 0;
+const base_auth_strategy_abstract_1 = require("../../abstract/base-auth-strategy.abstract");
+const errors_1 = require("../../models/errors");
+class LocalStrategy extends base_auth_strategy_abstract_1.BaseAuthStrategy {
+    constructor(userStore, passwordService) {
+        super();
+        this.userStore = userStore;
+        this.passwordService = passwordService;
+        this.name = 'local';
+    }
+    async authenticate(input, config) {
+        const user = await this.userStore.findByEmail(input.email);
+        if (!user) {
+            throw new errors_1.AuthError('Invalid credentials', 'INVALID_CREDENTIALS', 401);
+        }
+        if (!user.password) {
+            throw new errors_1.AuthError('Invalid credentials', 'INVALID_CREDENTIALS', 401);
+        }
+        const valid = await this.passwordService.compare(input.password, user.password);
+        if (!valid) {
+            throw new errors_1.AuthError('Invalid credentials', 'INVALID_CREDENTIALS', 401);
+        }
+        // Determine effective email-verification mode.
+        // `emailVerificationMode` takes precedence; fall back to the legacy boolean.
+        const verificationMode = config.emailVerificationMode ??
+            (config.requireEmailVerification ? 'strict' : 'none');
+        if (!user.isEmailVerified) {
+            if (verificationMode === 'strict') {
+                throw new errors_1.AuthError('Email address is not verified', 'EMAIL_NOT_VERIFIED', 403);
+            }
+            else if (verificationMode === 'lazy') {
+                // Block only after the grace-period deadline has passed.
+                if (user.emailVerificationDeadline && new Date() > user.emailVerificationDeadline) {
+                    throw new errors_1.AuthError('Email verification required', 'EMAIL_VERIFICATION_REQUIRED', 403);
+                }
+            }
+            // 'none' → fall through, allow login
+        }
+        return user;
+    }
+}
+exports.LocalStrategy = LocalStrategy;
+//# sourceMappingURL=local.strategy.js.map

package/dist/strategies/local/local.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.strategy.js","sourceRoot":"","sources":["../../../src/strategies/local/local.strategy.ts"],"names":[],"mappings":";;;AAAA,4FAA8E;AAK9E,gDAAgD;AAEhD,MAAa,aAAc,SAAQ,8CAA+D;IAGhG,YACmB,SAAqB,EACrB,eAAgC;QAEjD,KAAK,EAAE,CAAC;QAHS,cAAS,GAAT,SAAS,CAAY;QACrB,oBAAe,GAAf,eAAe,CAAiB;QAJnD,SAAI,GAAG,OAAO,CAAC;IAOf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA0C,EAAE,MAAkB;QAC/E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,kBAAS,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,kBAAS,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,kBAAS,CAAC,qBAAqB,EAAE,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,+CAA+C;QAC/C,6EAA6E;QAC7E,MAAM,gBAAgB,GACpB,MAAM,CAAC,qBAAqB;YAC5B,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAExD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,IAAI,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,kBAAS,CAAC,+BAA+B,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAClF,CAAC;iBAAM,IAAI,gBAAgB,KAAK,MAAM,EAAE,CAAC;gBACvC,yDAAyD;gBACzD,IAAI,IAAI,CAAC,yBAAyB,IAAI,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAClF,MAAM,IAAI,kBAAS,CAAC,6BAA6B,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YACD,qCAAqC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA3CD,sCA2CC"}

package/dist/strategies/magic-link/magic-link.strategy.d.ts

@@ -0,0 +1,8 @@
+import { IUserStore } from '../../interfaces/user-store.interface';
+import { AuthConfig } from '../../models/auth-config.model';
+import { BaseUser } from '../../models/user.model';
+export declare class MagicLinkStrategy {
+    sendMagicLink(email: string, userStore: IUserStore, config: AuthConfig, lang?: string, siteUrlOverride?: string): Promise<void>;
+    verify(token: string, userStore: IUserStore): Promise<BaseUser>;
+}
+//# sourceMappingURL=magic-link.strategy.d.ts.map

package/dist/strategies/magic-link/magic-link.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.strategy.d.ts","sourceRoot":"","sources":["../../../src/strategies/magic-link/magic-link.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAOnD,qBAAa,iBAAiB;IACtB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB/H,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;CAiBtE"}

package/dist/strategies/magic-link/magic-link.strategy.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MagicLinkStrategy = void 0;
+const token_service_1 = require("../../services/token.service");
+const mailer_service_1 = require("../../services/mailer.service");
+const errors_1 = require("../../models/errors");
+const tokenService = new token_service_1.TokenService();
+class MagicLinkStrategy {
+    async sendMagicLink(email, userStore, config, lang, siteUrlOverride) {
+        if (!config.email?.sendMagicLink && !config.email?.mailer) {
+            throw new errors_1.AuthError('Email not configured', 'EMAIL_NOT_CONFIGURED', 500);
+        }
+        const user = await userStore.findByEmail(email);
+        if (!user) {
+            // Don't reveal whether email exists
+            return;
+        }
+        const token = tokenService.generateSecureToken();
+        const expiry = new Date(Date.now() + 15 * 60 * 1000); // 15 min
+        await userStore.updateMagicLinkToken(user.id, token, expiry);
+        const siteUrlCfg = config.email?.siteUrl;
+        const defaultSiteUrl = Array.isArray(siteUrlCfg) ? (siteUrlCfg[0] ?? '') : (siteUrlCfg ?? '');
+        const basePath = siteUrlOverride || `${defaultSiteUrl}/auth`;
+        const cleanBasePath = basePath.endsWith('/') ? basePath.slice(0, -1) : basePath;
+        const link = `${cleanBasePath}/magic-link/verify?token=${token}`;
+        if (config.email?.sendMagicLink) {
+            await config.email.sendMagicLink(email, token, link, lang);
+        }
+        else if (config.email?.mailer) {
+            const mailer = new mailer_service_1.MailerService(config.email.mailer, config.templateStore);
+            await mailer.sendMagicLink(email, token, link, lang);
+        }
+    }
+    async verify(token, userStore) {
+        if (!userStore.findByMagicLinkToken) {
+            throw new errors_1.AuthError('UserStore does not implement findByMagicLinkToken', 'NOT_IMPLEMENTED', 500);
+        }
+        const user = await userStore.findByMagicLinkToken(token);
+        if (!user) {
+            throw new errors_1.AuthError('Invalid magic link token', 'INVALID_MAGIC_LINK', 401);
+        }
+        if (!user.magicLinkToken || user.magicLinkToken !== token) {
+            throw new errors_1.AuthError('Invalid magic link token', 'INVALID_MAGIC_LINK', 401);
+        }
+        if (user.magicLinkTokenExpiry && new Date() > user.magicLinkTokenExpiry) {
+            throw new errors_1.AuthError('Magic link token has expired', 'MAGIC_LINK_EXPIRED', 401);
+        }
+        await userStore.updateMagicLinkToken(user.id, null, null);
+        return user;
+    }
+}
+exports.MagicLinkStrategy = MagicLinkStrategy;
+//# sourceMappingURL=magic-link.strategy.js.map

package/dist/strategies/magic-link/magic-link.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.strategy.js","sourceRoot":"","sources":["../../../src/strategies/magic-link/magic-link.strategy.ts"],"names":[],"mappings":";;;AAGA,gEAA4D;AAC5D,kEAA8D;AAC9D,gDAAgD;AAEhD,MAAM,YAAY,GAAG,IAAI,4BAAY,EAAE,CAAC;AAExC,MAAa,iBAAiB;IAC5B,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,SAAqB,EAAE,MAAkB,EAAE,IAAa,EAAE,eAAwB;QACnH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1D,MAAM,IAAI,kBAAS,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,oCAAoC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,mBAAmB,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;QAC/D,MAAM,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC;QACzC,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,eAAe,IAAI,GAAG,cAAc,OAAO,CAAC;QAC7D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChF,MAAM,IAAI,GAAG,GAAG,aAAa,4BAA4B,KAAK,EAAE,CAAC;QACjE,IAAI,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,8BAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAC5E,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,SAAqB;QAC/C,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;YACpC,MAAM,IAAI,kBAAS,CAAC,mDAAmD,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,kBAAS,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;YAC1D,MAAM,IAAI,kBAAS,CAAC,0BAA0B,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACxE,MAAM,IAAI,kBAAS,CAAC,8BAA8B,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA3CD,8CA2CC"}

package/dist/strategies/oauth/generic-oauth.strategy.d.ts

@@ -0,0 +1,120 @@
+import { BaseOAuthStrategy } from '../../abstract/base-oauth-strategy.abstract';
+import { BaseUser } from '../../models/user.model';
+/**
+ * Configuration for a generic OAuth 2.0 provider.
+ *
+ * Use this to implement OAuth login for any provider that follows the
+ * standard OAuth 2.0 Authorization Code flow with a JSON user-info endpoint.
+ *
+ * @example
+ * ```typescript
+ * import { GenericOAuthStrategy, GenericOAuthProviderConfig } from '@awesome-lang-auth/node';
+ *
+ * const microsoftConfig: GenericOAuthProviderConfig = {
+ *   name: 'microsoft',
+ *   clientId: process.env.MS_CLIENT_ID!,
+ *   clientSecret: process.env.MS_CLIENT_SECRET!,
+ *   callbackUrl: 'https://yourapp.com/auth/oauth/microsoft/callback',
+ *   authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
+ *   tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+ *   userInfoUrl: 'https://graph.microsoft.com/v1.0/me',
+ *   scope: 'openid email profile',
+ *   mapProfile: (data) => ({
+ *     id: data.id,
+ *     email: data.mail ?? data.userPrincipalName,
+ *     name: data.displayName,
+ *   }),
+ * };
+ *
+ * class MicrosoftStrategy extends GenericOAuthStrategy {
+ *   async findOrCreateUser(profile) {
+ *     return userStore.findOrCreate({ provider: 'microsoft', ...profile });
+ *   }
+ * }
+ * const msStrategy = new MicrosoftStrategy(microsoftConfig);
+ * ```
+ */
+export interface GenericOAuthProviderConfig {
+    /** Provider identifier, e.g. `'microsoft'`, `'facebook'`, `'discord'`. */
+    name: string;
+    /** OAuth application client ID. */
+    clientId: string;
+    /** OAuth application client secret. */
+    clientSecret: string;
+    /** Full URL where the provider redirects back after authorization. */
+    callbackUrl: string;
+    /** Provider's OAuth authorization endpoint URL. */
+    authorizationUrl: string;
+    /** Provider's token exchange endpoint URL. */
+    tokenUrl: string;
+    /** Provider's user-info (profile) endpoint URL. */
+    userInfoUrl: string;
+    /**
+     * Space-separated scope string (e.g. `'openid email profile'`) or an
+     * array of scope strings (joined with a space).
+     */
+    scope: string | string[];
+    /**
+     * Optional additional query parameters to append to the authorization URL.
+     * Useful for provider-specific parameters such as `access_type`, `prompt`, etc.
+     */
+    additionalAuthParams?: Record<string, string>;
+    /**
+     * Map the raw JSON profile returned by `userInfoUrl` to the normalized
+     * profile shape expected by `findOrCreateUser`.
+     *
+     * When omitted, the library assumes the profile already contains `id` and
+     * `email` fields at the top level.
+     */
+    mapProfile?: (raw: Record<string, unknown>) => {
+        id: string;
+        email: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+    };
+}
+/**
+ * Generic OAuth 2.0 strategy.
+ *
+ * Extend this class to add OAuth login support for any provider that
+ * follows the standard Authorization Code flow with a JSON user-info
+ * endpoint.  Only `findOrCreateUser` needs to be implemented.
+ *
+ * @example
+ * ```typescript
+ * class MicrosoftStrategy extends GenericOAuthStrategy<MyUser> {
+ *   async findOrCreateUser(profile) {
+ *     let user = await userStore.findByProviderAccount('microsoft', profile.id);
+ *     if (!user) user = await userStore.create({ email: profile.email, loginProvider: 'microsoft' });
+ *     return user as MyUser;
+ *   }
+ * }
+ * ```
+ */
+export declare abstract class GenericOAuthStrategy<TUser extends BaseUser = BaseUser> extends BaseOAuthStrategy<TUser> {
+    readonly name: string;
+    private readonly config;
+    constructor(config: GenericOAuthProviderConfig);
+    getAuthorizationUrl(state?: string): string;
+    protected exchangeCodeForTokens(code: string): Promise<{
+        accessToken: string;
+        idToken?: string;
+    }>;
+    protected getUserProfile(accessToken: string): Promise<{
+        id: string;
+        email: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+    }>;
+    handleCallback(code: string, state?: string): Promise<TUser>;
+    abstract findOrCreateUser(profile: {
+        id: string;
+        email: string;
+        emailVerified?: boolean;
+        name?: string;
+        picture?: string;
+    }, state?: string): Promise<TUser>;
+}
+//# sourceMappingURL=generic-oauth.strategy.d.ts.map

package/dist/strategies/oauth/generic-oauth.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-oauth.strategy.d.ts","sourceRoot":"","sources":["../../../src/strategies/oauth/generic-oauth.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,gBAAgB,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK;QAC7C,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,8BAAsB,oBAAoB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,CAAE,SAAQ,iBAAiB,CAAC,KAAK,CAAC;IAC5G,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAExC,MAAM,EAAE,0BAA0B;IAM9C,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;cAe3B,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;cAmBvF,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAoB/I,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAMlE,QAAQ,CAAC,gBAAgB,CACvB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAChG,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC;CAClB"}