@awesome-lang-auth/node 1.10.1

package/dist/models/auth-config.model.d.ts

@@ -0,0 +1,387 @@
+import { BaseUser } from './user.model';
+import { ITemplateStore } from '../interfaces/template-store.interface';
+/**
+ * Configuration for the built-in HTTP-based mailer transport.
+ *
+ * The mailer makes a POST request to `endpoint` with a JSON body:
+ * ```
+ * POST {endpoint}
+ * X-API-Key: {apiKey}
+ * Content-Type: application/json
+ *
+ * { "to": "...", "subject": "...", "html": "...", "text": "...", "from": "...", "fromName": "...", "provider": "..." }
+ * ```
+ *
+ * If you prefer to control email sending yourself, omit `mailer` and use
+ * the `sendMagicLink`, `sendPasswordReset`, and `sendWelcome` callbacks instead.
+ */
+export interface MailerConfig {
+    /** Full URL of the HTTP mailer endpoint (receives a POST with JSON body). */
+    endpoint: string;
+    /** API key sent as the `X-API-Key` header. */
+    apiKey: string;
+    /** Sender email address. */
+    from: string;
+    /** Sender display name (optional). */
+    fromName?: string;
+    /** Sender Provider (optional). */
+    provider?: string;
+    /**
+     * Default language for built-in email templates.
+     * Supported: `'en'` (default) | `'it'`.
+     * Can be overridden per-request via `emailLang` in the request body.
+     */
+    defaultLang?: 'en' | 'it';
+}
+/**
+ * Identity Provider (IdP) mode configuration block.
+ *
+ * When `enabled`, this instance acts as a central Identity Provider:
+ * - Generates/loads an RSA-2048 keypair and signs JWTs with RS256
+ * - Exposes a public JWKS endpoint so downstream Resource Servers can
+ *   verify tokens without sharing a secret
+ *
+ * All existing HS256 behaviour is preserved and the two modes can coexist.
+ */
+export interface IdProviderConfig {
+    /**
+     * Enable IdP mode. When true (or when `privateKey` is set), `TokenService.generateIdProviderTokenPair()`
+     * signs with RS256 and a JWKS endpoint is auto-registered.
+     * Presence of `privateKey` is sufficient — `enabled: true` is not required.
+     * @default false
+     */
+    enabled?: boolean;
+    /**
+     * PEM-encoded RSA private key. If omitted a keypair is auto-generated
+     * at startup and stored in memory (ephemeral — for dev only).
+     * In production inject via environment variable.
+     */
+    privateKey?: string;
+    /**
+     * PEM-encoded RSA public key. Auto-derived from `privateKey` if omitted.
+     */
+    publicKey?: string;
+    /**
+     * Path at which the JWKS endpoint is exposed.
+     * @default '/.well-known/jwks.json'
+     */
+    jwksPath?: string;
+    /**
+     * `iss` (issuer) claim embedded in every IdP-issued JWT.
+     * Resource Servers validate this claim.
+     * When omitted, no `iss` claim is embedded in the JWT.
+     * Example: `'https://auth.myplatform.com'`
+     */
+    issuer?: string;
+    /**
+     * Default token expiry for IdP-issued tokens.
+     * Overrides `accessTokenExpiresIn` when IdP mode is enabled.
+     * @default '30d'
+     */
+    tokenExpiry?: string;
+    /**
+     * Refresh token expiry for IdP-issued tokens.
+     * In IdP mode the refresh token is also signed with RS256 using the same private key.
+     * Falls back to `AuthConfig.refreshTokenExpiresIn` when omitted.
+     * @default '90d'
+     */
+    refreshTokenExpiry?: string;
+    /**
+     * CORS origins allowed to fetch the JWKS endpoint.
+     * @default '*'
+     */
+    jwksCorsOrigins?: string | string[];
+}
+/**
+ * Resource Server mode configuration block.
+ *
+ * When `enabled`, this instance validates incoming Bearer tokens against a
+ * remote JWKS endpoint (issued by a central IdP) instead of a local secret.
+ * Login/register routes are not registered.
+ */
+export interface ResourceServerConfig {
+    /**
+     * Enable Resource Server mode. When true, the auth middleware switches to
+     * JWKS-based verification for Bearer tokens.
+     * @default false
+     */
+    enabled: boolean;
+    /**
+     * Full URL of the IdP's JWKS endpoint.
+     * Example: `'https://auth.myplatform.com/.well-known/jwks.json'`
+     */
+    jwksUrl: string;
+    /**
+     * Expected `iss` claim. Tokens with a different issuer are rejected.
+     * When omitted, the `iss` claim on incoming tokens is not validated.
+     */
+    issuer?: string;
+    /**
+     * JWKS public key cache TTL in milliseconds.
+     * The key is re-fetched once per TTL to support key rotation.
+     * @default 3_600_000 (1 hour)
+     */
+    jwksCacheTtl?: number;
+    /**
+     * Timeout in ms for the JWKS fetch request.
+     * @default 5000
+     */
+    jwksFetchTimeout?: number;
+}
+export interface AuthConfig {
+    accessTokenSecret: string;
+    refreshTokenSecret: string;
+    accessTokenExpiresIn?: string;
+    refreshTokenExpiresIn?: string;
+    /**
+     * The global base path where the auth router is mounted in your Express app
+     * (e.g. `'/api/auth'` or `'/auth'`).
+     *
+     * This acts as the single source of truth for email links, cookie paths, and
+     * redirects. It can be overridden per-router instance by passing a local
+     * `apiPrefix` via the `RouterOptions`.
+     */
+    apiPrefix?: string;
+    cookieOptions?: {
+        secure?: boolean;
+        sameSite?: 'strict' | 'lax' | 'none';
+        domain?: string;
+        path?: string;
+        /**
+         * Path for the refresh-token cookie.
+         * Defaults to `'/'` so the cookie is sent on every request and the
+         * router can be mounted at any prefix.
+         * For extra security you can restrict it to your refresh endpoint path
+         * (e.g. `'/auth/refresh'`).
+         */
+        refreshTokenPath?: string;
+    };
+    /**
+     * Anti-CSRF protection using the double-submit cookie pattern.
+     *
+     * When enabled the library sets a non-HttpOnly `csrf-token` cookie alongside
+     * the JWT cookies.  Client-side JavaScript must read this cookie and include
+     * its value in the `X-CSRF-Token` header on every authenticated request.
+     * The `createAuthMiddleware` middleware will then verify the header matches
+     * the cookie.
+     *
+     * Recommended when `cookieOptions.sameSite` is `'none'` or when you need
+     * defence-in-depth beyond `sameSite: 'lax'`.
+     */
+    csrf?: {
+        /** @default false */
+        enabled?: boolean;
+    };
+    bcryptSaltRounds?: number;
+    sms?: {
+        endpoint: string;
+        apiKey: string;
+        username: string;
+        password: string;
+        codeExpiresInMinutes?: number;
+    };
+    email?: {
+        /**
+         * Base URL of your site, used to build reset / magic-link URLs and as the
+         * post-OAuth login redirect destination.
+         *
+         * - **Single string** (`'https://yourapp.com'`): used as-is for all email
+         *   links and OAuth redirects.
+         * - **Array of strings** (`['https://app.example.com', 'https://admin.example.com']`):
+         *   the router dynamically picks the entry that matches the `Origin` (or
+         *   `Referer`) header of the incoming request.  For email links the first
+         *   entry in the array is used as the default.  Any picked URL is also
+         *   validated against this allowlist before being used in a redirect, so
+         *   only pre-approved origins can receive tokens.
+         *
+         * When used with OAuth, the resolved URL is encoded into the OAuth `state`
+         * parameter during the initiation request, so the callback can redirect the
+         * browser back to the exact origin that started the flow.
+         *
+         * Example: `'https://yourapp.com'`
+         */
+        siteUrl?: string | string[];
+        /**
+         * Concrete HTTP mailer transport configuration.
+         * When set, the library sends emails automatically using the built-in
+         * templates (password reset, magic link, welcome) via HTTP POST.
+         * Callback overrides below always take precedence over the mailer transport.
+         */
+        mailer?: MailerConfig;
+        /**
+         * Override: custom magic-link email sender.
+         * When provided, this callback is used instead of `mailer`.
+         */
+        sendMagicLink?: (to: string, token: string, link: string, lang?: string) => Promise<void>;
+        /**
+         * Override: custom password-reset email sender.
+         * When provided, this callback is used instead of `mailer`.
+         */
+        sendPasswordReset?: (to: string, token: string, link: string, lang?: string) => Promise<void>;
+        /**
+         * Override: custom welcome email sender.
+         * When provided, this callback is used instead of `mailer`.
+         */
+        sendWelcome?: (to: string, data: Record<string, unknown>, lang?: string) => Promise<void>;
+        /**
+         * Override: custom email-verification sender.
+         * When provided, this callback is used instead of `mailer`.
+         */
+        sendVerificationEmail?: (to: string, token: string, link: string, lang?: string) => Promise<void>;
+        /**
+         * Override: custom email-changed notification sender.
+         * Called after the change-email flow completes.
+         * When provided, this callback is used instead of `mailer`.
+         */
+        sendEmailChanged?: (to: string, newEmail: string, lang?: string) => Promise<void>;
+    };
+    oauth?: {
+        google?: {
+            clientId: string;
+            clientSecret: string;
+            callbackUrl: string;
+            projectId?: string;
+        };
+        github?: {
+            clientId: string;
+            clientSecret: string;
+            callbackUrl: string;
+        };
+    };
+    twoFactor?: {
+        appName?: string;
+    };
+    /**
+     * Controls how strictly the server enforces email verification on login.
+     *
+     * - `'none'`   — email verification is never required (default).
+     * - `'lazy'`   — the user may log in while their email is unverified, but
+     *                only until `BaseUser.emailVerificationDeadline` is reached.
+     *                After the deadline the login is blocked until the email is
+     *                confirmed.  Set the deadline field when creating the user
+     *                (e.g. `createdAt + lazyGracePeriodDays`).
+     * - `'strict'` — the login is blocked immediately if the email is not
+     *                verified (`isEmailVerified !== true`).
+     *
+     * When not set, falls back to the legacy `requireEmailVerification` boolean:
+     * `true` → `'strict'`, `false` / `undefined` → `'none'`.
+     */
+    emailVerificationMode?: 'none' | 'lazy' | 'strict';
+    /**
+     * @deprecated Use `emailVerificationMode: 'strict'` instead.
+     *
+     * When `true`, equivalent to `emailVerificationMode: 'strict'`.
+     * Ignored when `emailVerificationMode` is explicitly set.
+     */
+    requireEmailVerification?: boolean;
+    /**
+     * Optional callback to inject custom claims into both the access and refresh JWTs.
+     *
+     * Called with the authenticated/resolved `user` object every time a token pair is
+     * generated.  The object returned by this callback is **merged** on top of the
+     * standard `{ sub, email, role }` claims, so you can add roles, permissions, tenant
+     * IDs, or any other project-specific data.
+     *
+     * Do not return a `purpose` claim: it marks tokens that are not sessions
+     * (`purpose: '2fa'` on the 2FA step-up token, `purpose: 'admin'` on the
+     * admin console token), so the library drops it from session tokens.
+     *
+     * @example
+     * ```ts
+     * buildTokenPayload: (user) => ({
+     *   permissions: user.permissions,
+     *   tenantId: user.tenantId,
+     * }),
+     * ```
+     */
+    buildTokenPayload?: (user: BaseUser) => Record<string, unknown>;
+    /**
+     * Optional built-in static UI configuration.
+     */
+    ui?: {
+        /** Whether to enable and serve the static UI. Default is false. */
+        enabled?: boolean;
+        /**
+         * Headless UI mode.
+         *
+         * When `true`, the UI router:
+         *   - Still serves `auth.js` and other static assets (CSS, JS) at `/ui/assets/*`
+         *     so they can be loaded from a remote SPA via a `<script>` tag.
+         *   - Still exposes the `/ui/config` endpoint.
+         *   - Returns **404** for all HTML page routes (`/login`, `/register`, …) because
+         *     the hosting SPA provides its own login pages.
+         *
+         * `auth.js` automatically detects this flag from the `/ui/config` response and
+         * disables any `window.location.href` redirects on session expiry or refresh
+         * failure — preventing the library from navigating away from the external SPA.
+         *
+         * Typical use case: a Docusaurus documentation site or any React/Vue/Angular SPA
+         * that shares the same auth backend but handles its own login flow.
+         *
+         * @default false
+         */
+        headless?: boolean;
+        /** The URL where the login page is served (used for redirects). Default: `/auth/ui/login` */
+        loginUrl?: string;
+        /** Optional URL where the register page is served. Default: `/auth/ui/register` */
+        registerUrl?: string;
+        /**
+         * Optional raw CSS string injected into every UI page via a `<style>` tag.
+         * Use this to override any CSS variable or rule without providing a full stylesheet.
+         * See the Built-in UI documentation for the full list of overridable CSS variables.
+         */
+        customCss?: string;
+        /** Optional URL to a custom logo image displayed in the UI forms. */
+        customLogo?: string;
+        primaryColor?: string;
+        secondaryColor?: string;
+        logoUrl?: string;
+        siteName?: string;
+        /**
+         * Background color for the entire page (sets the `--bg-color` CSS variable).
+         * Accepts any valid CSS color value, e.g. `'#f0f4ff'` or `'rgba(240,244,255,1)'`.
+         */
+        bgColor?: string;
+        /**
+         * URL of a background image for the entire page (sets the `--bg-image` CSS variable).
+         * The image is rendered with `background-size: cover; background-position: center`.
+         * Example: `'https://example.com/auth-bg.jpg'`
+         */
+        bgImage?: string;
+        /**
+         * Background color for the form/card container (sets the `--card-bg` CSS variable).
+         * Accepts any valid CSS color value. Default is `#ffffff`.
+         */
+        cardBg?: string;
+    };
+    /**
+     * Session management configuration.
+     */
+    session?: {
+        /**
+         * Controls how strictly the library verifies session validity against the `sessionStore`.
+         *
+         * - `allcalls`: Verify the session on every single request. Maximum security, requires a low-latency store (Redis).
+         * - `refresh`: Verify the session only during token refresh. High performance with good security.
+         * - `none`: Sessions are created and tracked in the store but never verified during requests.
+         *
+         * @default 'refresh'
+         */
+        checkOn?: 'allcalls' | 'refresh' | 'none';
+    };
+    /**
+     * Optional template store for custom email and UI translations.
+     */
+    templateStore?: ITemplateStore;
+    /**
+     * Identity Provider (IdP) mode configuration.
+     * See {@link IdProviderConfig} for full field documentation.
+     */
+    idProvider?: IdProviderConfig;
+    /**
+     * Resource Server mode configuration.
+     * See {@link ResourceServerConfig} for full field documentation.
+     */
+    resourceServer?: ResourceServerConfig;
+}
+//# sourceMappingURL=auth-config.model.d.ts.map

package/dist/models/auth-config.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-config.model.d.ts","sourceRoot":"","sources":["../../src/models/auth-config.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd;;;;;;WAMG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF;;;;;;;;;;;OAWG;IACH,IAAI,CAAC,EAAE;QACL,qBAAqB;QACrB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,EAAE;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,KAAK,CAAC,EAAE;QACN;;;;;;;;;;;;;;;;;;WAkBG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAE5B;;;;;WAKG;QACH,MAAM,CAAC,EAAE,YAAY,CAAC;QAEtB;;;WAGG;QACH,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1F;;;WAGG;QACH,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9F;;;WAGG;QACH,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAE1F;;;WAGG;QACH,qBAAqB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAElG;;;;WAIG;QACH,gBAAgB,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACnF,CAAC;IACF,KAAK,CAAC,EAAE;QACN,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;YACpB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,MAAM,CAAC,EAAE;YACP,QAAQ,EAAE,MAAM,CAAC;YACjB,YAAY,EAAE,MAAM,CAAC;YACrB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IACF,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;;;;;;;;;;;OAcG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,CAAC;IAEnD;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhE;;OAEG;IACH,EAAE,CAAC,EAAE;QACH,mEAAmE;QACnE,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB;;;;;;;;;;;;;;;;;;WAkBG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,6FAA6F;QAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,mFAAmF;QACnF,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,qEAAqE;QACrE,UAAU,CAAC,EAAE,MAAM,CAAC;QAGpB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAElB;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB;;;;WAIG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QAEjB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF;;OAEG;IACH,OAAO,CAAC,EAAE;QACR;;;;;;;;WAQG;QACH,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;KAC3C,CAAC;IACF;;OAEG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;IAE/B;;;OAGG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B;;;OAGG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC"}

package/dist/models/auth-config.model.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=auth-config.model.js.map

package/dist/models/auth-config.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-config.model.js","sourceRoot":"","sources":["../../src/models/auth-config.model.ts"],"names":[],"mappings":""}

package/dist/models/errors.d.ts

@@ -0,0 +1,7 @@
+export declare class AuthError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    readonly data?: Record<string, unknown> | undefined;
+    constructor(message: string, code: string, statusCode?: number, data?: Record<string, unknown> | undefined);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/models/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/models/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;aAGhB,IAAI,EAAE,MAAM;aACZ,UAAU,EAAE,MAAM;aAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAH9C,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAY,EACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKjD"}

package/dist/models/errors.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthError = void 0;
+class AuthError extends Error {
+    constructor(message, code, statusCode = 401, data) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.data = data;
+        this.name = 'AuthError';
+    }
+}
+exports.AuthError = AuthError;
+//# sourceMappingURL=errors.js.map

package/dist/models/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/models/errors.ts"],"names":[],"mappings":";;;AAAA,MAAa,SAAU,SAAQ,KAAK;IAClC,YACE,OAAe,EACC,IAAY,EACZ,aAAqB,GAAG,EACxB,IAA8B;QAE9C,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAc;QACxB,SAAI,GAAJ,IAAI,CAA0B;QAG9C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAVD,8BAUC"}

package/dist/models/session.model.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Represents an active user session with optional device/context metadata.
+ *
+ * Implementations of `ISessionStore` use this shape to persist and retrieve
+ * session records. All fields beyond `sessionHandle`, `userId`, `createdAt`,
+ * and `expiresAt` are optional so you only store what you actually need.
+ */
+export interface SessionInfo {
+    /** Unique opaque identifier for this session (e.g. a UUID or a hex token). */
+    sessionHandle: string;
+    /** ID of the user who owns this session. */
+    userId: string;
+    /** Tenant ID — set when multi-tenancy is enabled. */
+    tenantId?: string;
+    /** When the session was created. */
+    createdAt: Date;
+    /** When the session expires. */
+    expiresAt: Date;
+    /** When the session was last used (updated on each authenticated request). */
+    lastActiveAt?: Date;
+    /** User-Agent header from the client that created the session. */
+    userAgent?: string;
+    /** IP address that created the session. */
+    ipAddress?: string;
+    /** Arbitrary session-level data (e.g. device name, geo-location, etc.). */
+    data?: Record<string, unknown>;
+}
+//# sourceMappingURL=session.model.d.ts.map

package/dist/models/session.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.model.d.ts","sourceRoot":"","sources":["../../src/models/session.model.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,SAAS,EAAE,IAAI,CAAC;IAChB,gCAAgC;IAChC,SAAS,EAAE,IAAI,CAAC;IAChB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}

package/dist/models/session.model.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=session.model.js.map

package/dist/models/session.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.model.js","sourceRoot":"","sources":["../../src/models/session.model.ts"],"names":[],"mappings":""}

package/dist/models/tenant.model.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Represents a tenant in a multi-tenant application.
+ *
+ * `ITenantStore` implementations use this shape to create and query tenants.
+ * The `config` field can hold arbitrary per-tenant settings (e.g. allowed
+ * OAuth providers, custom branding, feature flags).
+ */
+export interface Tenant {
+    /** Unique identifier for the tenant (e.g. slug, UUID, or subdomain). */
+    id: string;
+    /** Human-readable display name. */
+    name: string;
+    /** Whether the tenant is currently active. Defaults to `true`. */
+    isActive?: boolean;
+    /** Arbitrary per-tenant configuration (allowed auth methods, branding, etc.). */
+    config?: Record<string, unknown>;
+    /** When the tenant was created. */
+    createdAt?: Date;
+}
+//# sourceMappingURL=tenant.model.d.ts.map

package/dist/models/tenant.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.model.d.ts","sourceRoot":"","sources":["../../src/models/tenant.model.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,mCAAmC;IACnC,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB"}

package/dist/models/tenant.model.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=tenant.model.js.map

package/dist/models/tenant.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.model.js","sourceRoot":"","sources":["../../src/models/tenant.model.ts"],"names":[],"mappings":""}

package/dist/models/token.model.d.ts

@@ -0,0 +1,21 @@
+export interface TokenPair {
+    accessToken: string;
+    refreshToken: string;
+}
+export interface AccessTokenPayload {
+    sub: string;
+    email: string;
+    role?: string;
+    loginProvider?: string;
+    isEmailVerified?: boolean;
+    isTotpEnabled?: boolean;
+    /** Session ID (Handle) for stateful session validation. */
+    sid?: string;
+    iat?: number;
+    exp?: number;
+    /** Issuer claim — populated when IdP mode is enabled. */
+    iss?: string;
+    /** Any additional custom claims embedded in the JWT. */
+    [key: string]: unknown;
+}
+//# sourceMappingURL=token.model.d.ts.map

package/dist/models/token.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.model.d.ts","sourceRoot":"","sources":["../../src/models/token.model.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IAGb,wDAAwD;IACxD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/models/token.model.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=token.model.js.map

package/dist/models/token.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.model.js","sourceRoot":"","sources":["../../src/models/token.model.ts"],"names":[],"mappings":""}

package/dist/models/user.model.d.ts

@@ -0,0 +1,92 @@
+export interface BaseUser {
+    id: string;
+    email: string;
+    password?: string;
+    role?: string;
+    /** First name of the user (optional). */
+    firstName?: string | null;
+    /** Last name / surname of the user (optional). */
+    lastName?: string | null;
+    /**
+     * Authentication provider used to create/link this account.
+     * Examples: `'local'`, `'google'`, `'github'`, `'magic-link'`, `'sms'`.
+     * Defaults to `'local'` when not set.
+     */
+    loginProvider?: string | null;
+    refreshToken?: string | null;
+    refreshTokenExpiry?: Date | null;
+    resetToken?: string | null;
+    resetTokenExpiry?: Date | null;
+    /**
+     * TOTP secret stored after the user completes the 2FA setup flow
+     * (`POST /auth/2fa/verify-setup`).  When `null` the user has not paired an
+     * authenticator app yet.
+     */
+    totpSecret?: string | null;
+    isEmailVerified?: boolean;
+    /**
+     * Whether the user has successfully completed the TOTP setup flow.
+     * Set to `true` by `POST /auth/2fa/verify-setup`, set to `false` by
+     * `POST /auth/2fa/disable`.
+     */
+    isTotpEnabled?: boolean;
+    magicLinkToken?: string | null;
+    magicLinkTokenExpiry?: Date | null;
+    smsCode?: string | null;
+    smsCodeExpiry?: Date | null;
+    phoneNumber?: string | null;
+    /** When `true` this user must have 2FA active to complete login. */
+    require2FA?: boolean;
+    /** Token sent in the email-verification link. */
+    emailVerificationToken?: string | null;
+    /** Expiry for the email-verification token. */
+    emailVerificationTokenExpiry?: Date | null;
+    /**
+     * Deadline by which the user must verify their email address when
+     * `emailVerificationMode` is set to `'lazy'`.  After this date the login
+     * is blocked until the email is confirmed.  Set this field (e.g. to
+     * `createdAt + gracePeriodDays`) when creating a new user; leave `null` to
+     * keep the user in a permanent grace period.
+     */
+    emailVerificationDeadline?: Date | null;
+    /** New email address awaiting confirmation in the change-email flow. */
+    pendingEmail?: string | null;
+    /** Token sent to the new address in the change-email flow. */
+    emailChangeToken?: string | null;
+    /** Expiry for the email-change token. */
+    emailChangeTokenExpiry?: Date | null;
+    /** Email address being linked in the account-link flow. */
+    accountLinkPendingEmail?: string | null;
+    /** Provider name being linked in the account-link flow (defaults to `'email'`). */
+    accountLinkPendingProvider?: string | null;
+    /** Token sent to the target email in the account-link flow. */
+    accountLinkToken?: string | null;
+    /** Expiry for the account-link token. */
+    accountLinkTokenExpiry?: Date | null;
+    /**
+     * The unique user identifier returned by the OAuth provider (e.g. Google's
+     * `sub` claim, GitHub's numeric user id).  Used with `loginProvider` to look
+     * up existing OAuth accounts without relying on email matching, which is
+     * vulnerable to account-takeover attacks.
+     *
+     * Store this alongside `loginProvider` so that `IUserStore.findByProviderAccount`
+     * can perform a precise (`provider` + `providerAccountId`) lookup.
+     */
+    providerAccountId?: string | null;
+    /**
+     * Timestamp of the user's last successful login.  Useful for purging inactive
+     * users or for auditing purposes.
+     */
+    lastLogin?: Date | null;
+    /**
+     * When `true` this user has administrator privileges.
+     *
+     * Used by the `'is-admin-flag'` access policy on `createAdminRouter()`.
+     * For more granular RBAC control use `IRolesPermissionsStore` and a custom
+     * `accessPolicy` function instead.
+     *
+     * @since 1.8.0
+     */
+    isAdmin?: boolean;
+}
+//# sourceMappingURL=user.model.d.ts.map

package/dist/models/user.model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.model.d.ts","sourceRoot":"","sources":["../../src/models/user.model.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,oBAAoB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oEAAoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iDAAiD;IACjD,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,+CAA+C;IAC/C,4BAA4B,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,yBAAyB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxC,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,yCAAyC;IACzC,sBAAsB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACrC,2DAA2D;IAC3D,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,mFAAmF;IACnF,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,yCAAyC;IACzC,sBAAsB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACrC;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;OAGG;IACH,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB"}

package/dist/models/user.model.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=user.model.js.map

package/dist/models/user.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.model.js","sourceRoot":"","sources":["../../src/models/user.model.ts"],"names":[],"mappings":""}