@baseplate-dev/plugin-auth 1.0.5 → 1.0.7

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Minimum password length
+ */
+export declare const PASSWORD_MIN_LENGTH = 8;
+/**
+ * Maximum password length (prevents DoS attacks via excessive bcrypt/argon2 computation)
+ */
+export declare const PASSWORD_MAX_LENGTH = 255;
+/**
+ * Password reset token expiration time in seconds (1 hour per OWASP recommendations)
+ */
+export declare const PASSWORD_RESET_TOKEN_EXPIRY_SEC: number;
+/**
+ * Email verification token expiration time in seconds (24 hours)
+ */
+export declare const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC: number;
+//# sourceMappingURL=password.constants.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.constants.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;GAEG;AACH,eAAO,MAAM,+BAA+B,QAAU,CAAC;AAEvD;;GAEG;AACH,eAAO,MAAM,mCAAmC,QAAe,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.js

@@ -0,0 +1,18 @@
+// @ts-nocheck
+/**
+ * Minimum password length
+ */
+export const PASSWORD_MIN_LENGTH = 8;
+/**
+ * Maximum password length (prevents DoS attacks via excessive bcrypt/argon2 computation)
+ */
+export const PASSWORD_MAX_LENGTH = 255;
+/**
+ * Password reset token expiration time in seconds (1 hour per OWASP recommendations)
+ */
+export const PASSWORD_RESET_TOKEN_EXPIRY_SEC = 60 * 60;
+/**
+ * Email verification token expiration time in seconds (24 hours)
+ */
+export const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC = 60 * 60 * 24;
+//# sourceMappingURL=password.constants.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.constants.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC;;GAEG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,CAAC;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/constants/password.constants.ts

@@ -0,0 +1,21 @@
+// @ts-nocheck
+
+/**
+ * Minimum password length
+ */
+export const PASSWORD_MIN_LENGTH = 8;
+
+/**
+ * Maximum password length (prevents DoS attacks via excessive bcrypt/argon2 computation)
+ */
+export const PASSWORD_MAX_LENGTH = 255;
+
+/**
+ * Password reset token expiration time in seconds (1 hour per OWASP recommendations)
+ */
+export const PASSWORD_RESET_TOKEN_EXPIRY_SEC = 60 * 60;
+
+/**
+ * Email verification token expiration time in seconds (24 hours)
+ */
+export const EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC = 60 * 60 * 24;

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=email-verification.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.mutations.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.ts"],"names":[],"mappings":""}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.js

@@ -0,0 +1,24 @@
+// @ts-nocheck
+import { requestEmailVerification, verifyEmail, } from '$servicesEmailVerification';
+import { builder } from '%pothosImports';
+builder.mutationField('requestEmailVerification', (t) => t.fieldWithInputPayload({
+    authorize: ['user'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    resolve: async (_root, _args, context) => requestEmailVerification({
+        userId: context.auth.userIdOrThrow(),
+        context,
+    }),
+}));
+builder.mutationField('verifyEmail', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) => verifyEmail({ token: input.token, context }),
+}));
+//# sourceMappingURL=email-verification.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.mutations.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EACL,wBAAwB,EACxB,WAAW,GACZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,CAAC,aAAa,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CACvC,wBAAwB,CAAC;QACvB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE;QACpC,OAAO;KACR,CAAC;CACL,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CACzC,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzD;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAC3C,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;CAC/C,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/email-verification.mutations.ts

@@ -0,0 +1,35 @@
+// @ts-nocheck
+
+import {
+  requestEmailVerification,
+  verifyEmail,
+} from '$servicesEmailVerification';
+import { builder } from '%pothosImports';
+
+builder.mutationField('requestEmailVerification', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['user'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    resolve: async (_root, _args, context) =>
+      requestEmailVerification({
+        userId: context.auth.userIdOrThrow(),
+        context,
+      }),
+  }),
+);
+
+builder.mutationField('verifyEmail', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) =>
+      verifyEmail({ token: input.token, context }),
+  }),
+);

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=password-reset.mutations.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.mutations.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.ts"],"names":[],"mappings":""}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.js

@@ -0,0 +1,38 @@
+// @ts-nocheck
+import { completePasswordReset, requestPasswordReset, validatePasswordResetToken, } from '$servicesPasswordReset';
+import { builder } from '%pothosImports';
+builder.mutationField('requestPasswordReset', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        email: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) => requestPasswordReset({ email: input.email, context }),
+}));
+builder.mutationField('validatePasswordResetToken', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) => validatePasswordResetToken({ token: input.token }),
+}));
+builder.mutationField('resetPasswordWithToken', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+        token: t.input.field({ required: true, type: 'String' }),
+        newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) => completePasswordReset({
+        token: input.token,
+        newPassword: input.newPassword,
+    }),
+}));
+//# sourceMappingURL=password-reset.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.mutations.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,CAAC,aAAa,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAClD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzD;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAC3C,oBAAoB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;CACxD,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,EAAE,CACxD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KACzD;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClC,0BAA0B,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;CACrD,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CACpD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;KAC9C;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC/D;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAClC,qBAAqB,CAAC;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC;CACL,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/password-reset.mutations.ts

@@ -0,0 +1,54 @@
+// @ts-nocheck
+
+import {
+  completePasswordReset,
+  requestPasswordReset,
+  validatePasswordResetToken,
+} from '$servicesPasswordReset';
+import { builder } from '%pothosImports';
+
+builder.mutationField('requestPasswordReset', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) =>
+      requestPasswordReset({ email: input.email, context }),
+  }),
+);
+
+builder.mutationField('validatePasswordResetToken', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      token: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) =>
+      validatePasswordResetToken({ token: input.token }),
+  }),
+);
+
+builder.mutationField('resetPasswordWithToken', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.field({ type: 'Boolean' }),
+    },
+    input: {
+      token: t.input.field({ required: true, type: 'String' }),
+      newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) =>
+      completePasswordReset({
+        token: input.token,
+        newPassword: input.newPassword,
+      }),
+  }),
+);

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-password.mutations.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.ts"],"names":[],"mappings":""}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.js

@@ -0,0 +1,72 @@
+// @ts-nocheck
+import { authenticateUserWithEmailAndPassword, changeUserPassword, registerUserWithEmailAndPassword, resetUserPassword, } from '$servicesUserPassword';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+builder.mutationField('registerWithEmailPassword', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+        email: t.input.field({ required: true, type: 'String' }),
+        password: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) => registerUserWithEmailAndPassword({
+        input,
+        context,
+    }),
+}));
+builder.mutationField('loginWithEmailPassword', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+        email: t.input.field({ required: true, type: 'String' }),
+        password: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) => authenticateUserWithEmailAndPassword({
+        input,
+        context,
+    }),
+}));
+builder.mutationField('changePassword', (t) => t.fieldWithInputPayload({
+    authorize: ['user'],
+    payload: {
+        user: t.payload.field({
+            type: TPL_USER_OBJECT_TYPE,
+        }),
+    },
+    input: {
+        currentPassword: t.input.field({ required: true, type: 'String' }),
+        newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) => {
+        const userId = context.auth.userIdOrThrow();
+        const user = await changeUserPassword({
+            userId,
+            input,
+        });
+        return { user };
+    },
+}));
+builder.mutationField('resetUserPassword', (t) => t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+        user: t.payload.field({
+            type: TPL_USER_OBJECT_TYPE,
+        }),
+    },
+    input: {
+        userId: t.input.field({ required: true, type: 'Uuid' }),
+        newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) => {
+        const user = await resetUserPassword({
+            userId: input.userId,
+            input: { newPassword: input.newPassword },
+        });
+        return { user };
+    },
+}));
+//# sourceMappingURL=user-password.mutations.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-password.mutations.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EACL,oCAAoC,EACpC,kBAAkB,EAClB,gCAAgC,EAChC,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,CAAC,aAAa,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;KACvD;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC5D;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAC1C,gCAAgC,CAAC;QAC/B,KAAK;QACL,OAAO;KACR,CAAC;CACL,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE,CACpD,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;KACvD;IACD,KAAK,EAAE;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC5D;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAC1C,oCAAoC,CAAC;QACnC,KAAK;QACL,OAAO;KACR,CAAC;CACL,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC5C,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,MAAM,CAAC;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,IAAI,EAAE,oBAAoB;SAC3B,CAAC;KACH;IACD,KAAK,EAAE;QACL,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC/D;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC;YACpC,MAAM;YACN,KAAK;SACN,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC/C,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,IAAI,EAAE,oBAAoB;SAC3B,CAAC;KACH;IACD,KAAK,EAAE;QACL,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC/D;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;SAC1C,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/schema/user-password.mutations.ts

@@ -0,0 +1,91 @@
+// @ts-nocheck
+
+import {
+  authenticateUserWithEmailAndPassword,
+  changeUserPassword,
+  registerUserWithEmailAndPassword,
+  resetUserPassword,
+} from '$servicesUserPassword';
+import { userSessionPayload } from '%authModuleImports';
+import { builder } from '%pothosImports';
+
+builder.mutationField('registerWithEmailPassword', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+      password: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) =>
+      registerUserWithEmailAndPassword({
+        input,
+        context,
+      }),
+  }),
+);
+
+builder.mutationField('loginWithEmailPassword', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      session: t.payload.field({ type: userSessionPayload }),
+    },
+    input: {
+      email: t.input.field({ required: true, type: 'String' }),
+      password: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (root, { input }, context) =>
+      authenticateUserWithEmailAndPassword({
+        input,
+        context,
+      }),
+  }),
+);
+
+builder.mutationField('changePassword', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['user'],
+    payload: {
+      user: t.payload.field({
+        type: TPL_USER_OBJECT_TYPE,
+      }),
+    },
+    input: {
+      currentPassword: t.input.field({ required: true, type: 'String' }),
+      newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }, context) => {
+      const userId = context.auth.userIdOrThrow();
+      const user = await changeUserPassword({
+        userId,
+        input,
+      });
+      return { user };
+    },
+  }),
+);
+
+builder.mutationField('resetUserPassword', (t) =>
+  t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+      user: t.payload.field({
+        type: TPL_USER_OBJECT_TYPE,
+      }),
+    },
+    input: {
+      userId: t.input.field({ required: true, type: 'Uuid' }),
+      newPassword: t.input.field({ required: true, type: 'String' }),
+    },
+    resolve: async (_root, { input }) => {
+      const user = await resetUserPassword({
+        userId: input.userId,
+        input: { newPassword: input.newPassword },
+      });
+      return { user };
+    },
+  }),
+);

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.d.ts

@@ -0,0 +1,24 @@
+import type { RequestServiceContext } from '%requestServiceContextImports';
+/**
+ * Request an email verification for the authenticated user.
+ * Sends a verification email with a link to verify.
+ */
+export declare function requestEmailVerification({ userId, context, }: {
+    userId: string;
+    context: RequestServiceContext;
+}): Promise<{
+    success: true;
+}>;
+/**
+ * Verify a user's email using the token from the verification email.
+ * This is a public (anonymous) mutation — the token proves identity.
+ *
+ * @throws BadRequestError if token is invalid or expired
+ */
+export declare function verifyEmail({ token, context, }: {
+    token: string;
+    context: RequestServiceContext;
+}): Promise<{
+    success: true;
+}>;
+//# sourceMappingURL=email-verification.service.d.ts.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AA2C3E;;;GAGG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,MAAM,EACN,OAAO,GACR,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,qBAAqB,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CA0C7B;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,EAChC,KAAK,EACL,OAAO,GACR,EAAE;IACD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,qBAAqB,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CA4B7B"}

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.js

@@ -0,0 +1,87 @@
+// @ts-nocheck
+import { EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC } from '$constantsPassword';
+import { createAuthVerification, validateAuthVerification, } from '%authModuleImports';
+import { config } from '%configServiceImports';
+import { sendEmail } from '%emailModuleImports';
+import { BadRequestError } from '%errorHandlerServiceImports';
+import { prisma } from '%prismaImports';
+import { memoizeRateLimiter } from '%rateLimitImports';
+const EMAIL_VERIFY_TYPE = 'email-verify';
+/**
+ * Rate limiters for email verification operations.
+ */
+// Per-user rate limit: 3 requests per 20 minutes
+const getRequestEmailVerificationUserLimiter = memoizeRateLimiter('request-email-verification-user', {
+    points: 3,
+    duration: 60 * 20, // 20 minutes
+});
+// Per-IP rate limit: 10 requests/hour
+const getRequestEmailVerificationIpLimiter = memoizeRateLimiter('request-email-verification-ip', {
+    points: 10,
+    duration: 60 * 60, // 1 hour
+});
+// Per-IP rate limit for verify endpoint: 10 requests/hour
+const getVerifyEmailIpLimiter = memoizeRateLimiter('verify-email-ip', {
+    points: 10,
+    duration: 60 * 60, // 1 hour
+});
+/**
+ * Request an email verification for the authenticated user.
+ * Sends a verification email with a link to verify.
+ */
+export async function requestEmailVerification({ userId, context, }) {
+    await Promise.all([
+        getRequestEmailVerificationIpLimiter().consumeOrThrow(context.reqInfo.ip, 'Too many verification attempts. Please try again later.', 'too-many-requests'),
+        getRequestEmailVerificationUserLimiter().consumeOrThrow(userId, 'Too many verification attempts. Please try again later.', 'too-many-requests'),
+    ]);
+    const user = await prisma.user.findUnique({
+        where: { id: userId },
+        select: { id: true, email: true, emailVerified: true },
+    });
+    if (!user?.email) {
+        throw new BadRequestError('No email address on account', 'no-email');
+    }
+    if (user.emailVerified) {
+        return { success: true };
+    }
+    const { token } = await createAuthVerification({
+        type: EMAIL_VERIFY_TYPE,
+        userId: user.id,
+        expiresInSec: EMAIL_VERIFICATION_TOKEN_EXPIRY_SEC,
+    });
+    // Construct verification URL using configured domain
+    const verifyLink = `${config.AUTH_FRONTEND_URL}/auth/verify-email?token=${encodeURIComponent(token)}`;
+    await sendEmail(TPL_ACCOUNT_VERIFICATION_EMAIL, {
+        to: user.email,
+        data: { verifyLink },
+    });
+    return { success: true };
+}
+/**
+ * Verify a user's email using the token from the verification email.
+ * This is a public (anonymous) mutation — the token proves identity.
+ *
+ * @throws BadRequestError if token is invalid or expired
+ */
+export async function verifyEmail({ token, context, }) {
+    await getVerifyEmailIpLimiter().consumeOrThrow(context.reqInfo.ip, 'Too many verification attempts. Please try again later.', 'too-many-requests');
+    const record = await validateAuthVerification({
+        type: EMAIL_VERIFY_TYPE,
+        token,
+    });
+    if (!record?.userId) {
+        throw new BadRequestError('Invalid or expired token', 'invalid-token');
+    }
+    // Delete this token + remaining email-verify tokens + update user in one transaction
+    await prisma.$transaction([
+        prisma.authVerification.deleteMany({
+            where: { type: EMAIL_VERIFY_TYPE, userId: record.userId },
+        }),
+        prisma.user.update({
+            where: { id: record.userId },
+            data: { emailVerified: true },
+        }),
+    ]);
+    return { success: true };
+}
+//# sourceMappingURL=email-verification.service.js.map

package/dist/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.service.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-email-password/templates/module/services/email-verification.service.ts"],"names":[],"mappings":"AAAA,cAAc;AAId,OAAO,EAAE,mCAAmC,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC;;GAEG;AAEH,iDAAiD;AACjD,MAAM,sCAAsC,GAAG,kBAAkB,CAC/D,iCAAiC,EACjC;IACE,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,aAAa;CACjC,CACF,CAAC;AAEF,sCAAsC;AACtC,MAAM,oCAAoC,GAAG,kBAAkB,CAC7D,+BAA+B,EAC/B;IACE,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS;CAC7B,CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,uBAAuB,GAAG,kBAAkB,CAAC,iBAAiB,EAAE;IACpE,MAAM,EAAE,EAAE;IACV,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS;CAC7B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,MAAM,EACN,OAAO,GAIR;IACC,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,oCAAoC,EAAE,CAAC,cAAc,CACnD,OAAO,CAAC,OAAO,CAAC,EAAE,EAClB,yDAAyD,EACzD,mBAAmB,CACpB;QACD,sCAAsC,EAAE,CAAC,cAAc,CACrD,MAAM,EACN,yDAAyD,EACzD,mBAAmB,CACpB;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACxC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;QACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;KACvD,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,UAAU,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,sBAAsB,CAAC;QAC7C,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,YAAY,EAAE,mCAAmC;KAClD,CAAC,CAAC;IAEH,qDAAqD;IACrD,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,iBAAiB,4BAA4B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAEtG,MAAM,SAAS,CAAC,8BAA8B,EAAE;QAC9C,EAAE,EAAE,IAAI,CAAC,KAAK;QACd,IAAI,EAAE,EAAE,UAAU,EAAE;KACrB,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAChC,KAAK,EACL,OAAO,GAIR;IACC,MAAM,uBAAuB,EAAE,CAAC,cAAc,CAC5C,OAAO,CAAC,OAAO,CAAC,EAAE,EAClB,yDAAyD,EACzD,mBAAmB,CACpB,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,IAAI,EAAE,iBAAiB;QACvB,KAAK;KACN,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAAC;IACzE,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;SAC1D,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACjB,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;SAC9B,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC"}