@baseplate-dev/plugin-auth 1.0.5 → 1.0.7

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-roles.mutations.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.ts"],"names":[],"mappings":""}

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.js

@@ -0,0 +1,23 @@
+// @ts-nocheck
+import { updateUserRoles } from '$userRolesService';
+import { builder } from '%pothosImports';
+builder.mutationField('updateUserRoles', (t) => t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+        user: t.payload.field({
+            type: TPL_USER_OBJECT_TYPE,
+        }),
+    },
+    input: {
+        userId: t.input.field({ required: true, type: 'Uuid' }),
+        roles: t.input.field({
+            required: true,
+            type: ['String'],
+        }),
+    },
+    resolve: async (root, { input }) => {
+        const user = await updateUserRoles(input);
+        return { user };
+    },
+}));
+//# sourceMappingURL=user-roles.mutations.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-roles.mutations.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YACpB,IAAI,EAAE,oBAAoB;SAC3B,CAAC;KACH;IACD,KAAK,EAAE;QACL,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;YACnB,QAAQ,EAAE,IAAI;YACd,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC;KACH;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;CACF,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-roles.mutations.ts

@@ -0,0 +1,26 @@
+// @ts-nocheck
+
+import { updateUserRoles } from '$userRolesService';
+import { builder } from '%pothosImports';
+
+builder.mutationField('updateUserRoles', (t) =>
+  t.fieldWithInputPayload({
+    authorize: TPL_ADMIN_ROLES,
+    payload: {
+      user: t.payload.field({
+        type: TPL_USER_OBJECT_TYPE,
+      }),
+    },
+    input: {
+      userId: t.input.field({ required: true, type: 'Uuid' }),
+      roles: t.input.field({
+        required: true,
+        type: ['String'],
+      }),
+    },
+    resolve: async (root, { input }) => {
+      const user = await updateUserRoles(input);
+      return { user };
+    },
+  }),
+);

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session-payload.object-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session-payload.object-type.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/schema/user-session-payload.object-type.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,kBAAkB,KAmB9B,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session-payload.object-type.js

@@ -0,0 +1,19 @@
+// @ts-nocheck
+import { authRoleEnum } from '$authRoleEnum';
+import { builder } from '%pothosImports';
+export const userSessionPayload = builder.simpleObject('UserSessionPayload', {
+    fields: (t) => ({
+        expiresAt: t.field({ type: 'DateTime', nullable: true }),
+        userId: t.field({ type: 'Uuid' }),
+        roles: t.field({ type: [authRoleEnum] }),
+    }),
+}, (t) => ({
+    user: t.prismaField({
+        type: TPL_USER_OBJECT_TYPE,
+        resolve: async (query, root) => TPL_PRISMA_USER.findUniqueOrThrow({
+            where: { id: root.userId },
+            ...query,
+        }),
+    }),
+}));
+//# sourceMappingURL=user-session-payload.object-type.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session-payload.object-type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session-payload.object-type.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/schema/user-session-payload.object-type.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,YAAY,CACpD,oBAAoB,EACpB;IACE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACd,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACxD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACjC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;KACzC,CAAC;CACH,EACD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC;QAClB,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAC7B,eAAe,CAAC,iBAAiB,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE;YAC1B,GAAG,KAAK;SACT,CAAC;KACL,CAAC;CACH,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session-payload.object-type.ts

@@ -0,0 +1,25 @@
+// @ts-nocheck
+
+import { authRoleEnum } from '$authRoleEnum';
+import { builder } from '%pothosImports';
+
+export const userSessionPayload = builder.simpleObject(
+  'UserSessionPayload',
+  {
+    fields: (t) => ({
+      expiresAt: t.field({ type: 'DateTime', nullable: true }),
+      userId: t.field({ type: 'Uuid' }),
+      roles: t.field({ type: [authRoleEnum] }),
+    }),
+  },
+  (t) => ({
+    user: t.prismaField({
+      type: TPL_USER_OBJECT_TYPE,
+      resolve: async (query, root) =>
+        TPL_PRISMA_USER.findUniqueOrThrow({
+          where: { id: root.userId },
+          ...query,
+        }),
+    }),
+  }),
+);

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session.mutations.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.ts"],"names":[],"mappings":""}

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.js

@@ -0,0 +1,18 @@
+// @ts-nocheck
+import { userSessionService } from '$userSessionService';
+import { builder } from '%pothosImports';
+builder.mutationField('logOut', (t) => t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+        success: t.payload.boolean({
+            description: 'Whether the logout was successful.',
+        }),
+    },
+    resolve: async (parent, args, context) => {
+        if (context.auth.session?.type === 'user') {
+            await userSessionService.clearSession(context.auth.session, context);
+        }
+        return { success: true };
+    },
+}));
+//# sourceMappingURL=user-session.mutations.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session.mutations.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,CAAC,qBAAqB,CAAC;IACtB,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YACzB,WAAW,EAAE,oCAAoC;SAClD,CAAC;KACH;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QACvC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1C,MAAM,kBAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.mutations.ts

@@ -0,0 +1,22 @@
+// @ts-nocheck
+
+import { userSessionService } from '$userSessionService';
+import { builder } from '%pothosImports';
+
+builder.mutationField('logOut', (t) =>
+  t.fieldWithInputPayload({
+    authorize: ['public'],
+    payload: {
+      success: t.payload.boolean({
+        description: 'Whether the logout was successful.',
+      }),
+    },
+    resolve: async (parent, args, context) => {
+      if (context.auth.session?.type === 'user') {
+        await userSessionService.clearSession(context.auth.session, context);
+      }
+
+      return { success: true };
+    },
+  }),
+);

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session.queries.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/schema/user-session.queries.ts"],"names":[],"mappings":""}

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.queries.js

@@ -0,0 +1,36 @@
+// @ts-nocheck
+import { userSessionPayload } from '$schemaUserSessionPayloadObjectType';
+import { builder } from '%pothosImports';
+import { prisma } from '%prismaImports';
+builder.queryField('currentUserSession', (t) => t.field({
+    type: userSessionPayload,
+    description: 'Get the current user session',
+    nullable: true,
+    authorize: ['public'],
+    resolve: (root, args, { auth }) => {
+        if (auth.session?.type !== 'user') {
+            return undefined;
+        }
+        return {
+            expiresAt: auth.session.expiresAt?.toISOString(),
+            userId: auth.session.userId,
+            roles: auth.roles,
+        };
+    },
+}));
+builder.queryField('viewer', (t) => t.prismaField({
+    type: TPL_USER_OBJECT_TYPE,
+    nullable: true,
+    description: 'The currently authenticated user',
+    authorize: ['public'],
+    resolve: async (query, root, args, { auth }) => {
+        if (auth.session?.type !== 'user') {
+            return null;
+        }
+        return prisma.user.findUnique({
+            where: { id: auth.session.userId },
+            ...query,
+        });
+    },
+}));
+//# sourceMappingURL=user-session.queries.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-session.queries.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/schema/user-session.queries.ts"],"names":[],"mappings":"AAAA,cAAc;AAEd,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC,CAAC,KAAK,CAAC;IACN,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,8BAA8B;IAC3C,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAChC,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE;YAChD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;CACF,CAAC,CACH,CAAC;AAEF,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACjC,CAAC,CAAC,WAAW,CAAC;IACZ,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,IAAI;IACd,WAAW,EAAE,kCAAkC;IAC/C,SAAS,EAAE,CAAC,QAAQ,CAAC;IACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7C,IAAI,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAClC,GAAG,KAAK;SACT,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CACH,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/schema/user-session.queries.ts

@@ -0,0 +1,43 @@
+// @ts-nocheck
+
+import { userSessionPayload } from '$schemaUserSessionPayloadObjectType';
+import { builder } from '%pothosImports';
+import { prisma } from '%prismaImports';
+
+builder.queryField('currentUserSession', (t) =>
+  t.field({
+    type: userSessionPayload,
+    description: 'Get the current user session',
+    nullable: true,
+    authorize: ['public'],
+    resolve: (root, args, { auth }) => {
+      if (auth.session?.type !== 'user') {
+        return undefined;
+      }
+
+      return {
+        expiresAt: auth.session.expiresAt?.toISOString(),
+        userId: auth.session.userId,
+        roles: auth.roles,
+      };
+    },
+  }),
+);
+
+builder.queryField('viewer', (t) =>
+  t.prismaField({
+    type: TPL_USER_OBJECT_TYPE,
+    nullable: true,
+    description: 'The currently authenticated user',
+    authorize: ['public'],
+    resolve: async (query, root, args, { auth }) => {
+      if (auth.session?.type !== 'user') {
+        return null;
+      }
+      return prisma.user.findUnique({
+        where: { id: auth.session.userId },
+        ...query,
+      });
+    },
+  }),
+);

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.d.ts

@@ -0,0 +1,40 @@
+import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+/**
+ * Creates a new auth verification using the split-token pattern.
+ *
+ * @param type - Verification type (e.g., "password-reset", "email-verify")
+ * @param userId - Optional user ID to associate with the token
+ * @param expiresInSec - Token lifetime in seconds
+ * @param metadata - Optional JSON metadata to store with the token
+ * @returns The combined token (`{selector}.{verifier}`) to send to the user
+ */
+export declare function createAuthVerification({ type, userId, expiresInSec, metadata, }: {
+    type: string;
+    userId?: string;
+    expiresInSec: number;
+    metadata?: Prisma.JsonValue;
+}): Promise<{
+    token: string;
+}>;
+/**
+ * Validates an auth verification token without consuming it.
+ * Returns the full record if valid so the caller can delete it
+ * as part of their own transaction.
+ *
+ * Security: If the selector matches but the verifier is wrong or expired,
+ * the token is deleted to prevent brute-force attempts.
+ *
+ * @throws BadRequestError if token is invalid, expired, or malformed
+ */
+export declare function validateAuthVerification({ type, token, }: {
+    type: string;
+    token: string;
+}): Promise<AuthVerification | null>;
+/**
+ * Cleanup job to delete expired auth verification tokens.
+ * Should be called periodically (e.g., via cron job or queue).
+ */
+export declare function cleanupExpiredAuthVerifications(): Promise<{
+    deletedCount: number;
+}>;
+//# sourceMappingURL=auth-verification.service.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-verification.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAiDxE;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,EAC3C,IAAI,EACJ,MAAM,EACN,YAAY,EACZ,QAAQ,GACT,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAiB7B;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,IAAI,EACJ,KAAK,GACN,EAAE;IACD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAwBnC;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,IAAI,OAAO,CAAC;IAC/D,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC,CAQD"}

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.js

@@ -0,0 +1,106 @@
+// @ts-nocheck
+import { prisma } from '%prismaImports';
+import * as crypto from 'node:crypto';
+/**
+ * Split-token pattern for secure verification flows.
+ *
+ * - selector: random identifier used for DB lookup (stored as `identifier`)
+ * - verifier: random secret, hashed before storage (stored as `value`)
+ * - token: `{selector}.{verifier}` — the value sent to the user
+ */
+function generateSplitToken() {
+    return {
+        selector: crypto.randomBytes(16).toString('base64url'),
+        verifier: crypto.randomBytes(16).toString('base64url'),
+    };
+}
+function hashVerifier(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('hex');
+}
+/**
+ * Constant-time comparison of two hex strings to prevent timing attacks.
+ */
+function safeCompare(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
+}
+function encodeToken(selector, verifier) {
+    return `${selector}.${verifier}`;
+}
+function decodeToken(token) {
+    const dotIndex = token.indexOf('.');
+    if (dotIndex === -1) {
+        return null;
+    }
+    return {
+        selector: token.slice(0, dotIndex),
+        verifier: token.slice(dotIndex + 1),
+    };
+}
+/**
+ * Creates a new auth verification using the split-token pattern.
+ *
+ * @param type - Verification type (e.g., "password-reset", "email-verify")
+ * @param userId - Optional user ID to associate with the token
+ * @param expiresInSec - Token lifetime in seconds
+ * @param metadata - Optional JSON metadata to store with the token
+ * @returns The combined token (`{selector}.{verifier}`) to send to the user
+ */
+export async function createAuthVerification({ type, userId, expiresInSec, metadata, }) {
+    const { selector, verifier } = generateSplitToken();
+    const value = hashVerifier(verifier);
+    const expiresAt = new Date(Date.now() + expiresInSec * 1000);
+    await prisma.authVerification.create({
+        data: {
+            type,
+            identifier: selector,
+            value,
+            userId,
+            metadata: metadata ?? undefined,
+            expiresAt,
+        },
+    });
+    return { token: encodeToken(selector, verifier) };
+}
+/**
+ * Validates an auth verification token without consuming it.
+ * Returns the full record if valid so the caller can delete it
+ * as part of their own transaction.
+ *
+ * Security: If the selector matches but the verifier is wrong or expired,
+ * the token is deleted to prevent brute-force attempts.
+ *
+ * @throws BadRequestError if token is invalid, expired, or malformed
+ */
+export async function validateAuthVerification({ type, token, }) {
+    const decoded = decodeToken(token);
+    if (!decoded) {
+        return null;
+    }
+    const record = await prisma.authVerification.findUnique({
+        where: { type_identifier: { type, identifier: decoded.selector } },
+    });
+    if (!record) {
+        return null;
+    }
+    if (!safeCompare(record.value, hashVerifier(decoded.verifier)) ||
+        record.expiresAt < new Date()) {
+        await prisma.authVerification.delete({ where: { id: record.id } });
+        return null;
+    }
+    return record;
+}
+/**
+ * Cleanup job to delete expired auth verification tokens.
+ * Should be called periodically (e.g., via cron job or queue).
+ */
+export async function cleanupExpiredAuthVerifications() {
+    const result = await prisma.authVerification.deleteMany({
+        where: {
+            expiresAt: { lt: new Date() },
+        },
+    });
+    return { deletedCount: result.count };
+}
+//# sourceMappingURL=auth-verification.service.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-verification.service.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.ts"],"names":[],"mappings":"AAAA,cAAc;AAId,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC;;;;;;GAMG;AAEH,SAAS,kBAAkB;IACzB,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,QAAgB;IACrD,OAAO,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAClB,KAAa;IAEb,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;KACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,IAAI,EACJ,MAAM,EACN,YAAY,EACZ,QAAQ,GAMT;IACC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,CAAC,CAAC;IAE7D,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC;QACnC,IAAI,EAAE;YACJ,IAAI;YACJ,UAAU,EAAE,QAAQ;YACpB,KAAK;YACL,MAAM;YACN,QAAQ,EAAE,QAAQ,IAAI,SAAS;YAC/B,SAAS;SACV;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAC7C,IAAI,EACJ,KAAK,GAIN;IACC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAEnC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACtD,KAAK,EAAE,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE;KACnE,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAC7B,CAAC;QACD,MAAM,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B;IAGnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACtD,KAAK,EAAE;YACL,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE;SAC9B;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACxC,CAAC"}

package/dist/local-auth/core/generators/auth-module/templates/module/services/auth-verification.service.ts

@@ -0,0 +1,146 @@
+// @ts-nocheck
+
+import type { AuthVerification, Prisma } from '%prismaGeneratedImports';
+
+import { prisma } from '%prismaImports';
+import * as crypto from 'node:crypto';
+
+/**
+ * Split-token pattern for secure verification flows.
+ *
+ * - selector: random identifier used for DB lookup (stored as `identifier`)
+ * - verifier: random secret, hashed before storage (stored as `value`)
+ * - token: `{selector}.{verifier}` — the value sent to the user
+ */
+
+function generateSplitToken(): { selector: string; verifier: string } {
+  return {
+    selector: crypto.randomBytes(16).toString('base64url'),
+    verifier: crypto.randomBytes(16).toString('base64url'),
+  };
+}
+
+function hashVerifier(verifier: string): string {
+  return crypto.createHash('sha256').update(verifier).digest('hex');
+}
+
+/**
+ * Constant-time comparison of two hex strings to prevent timing attacks.
+ */
+function safeCompare(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
+}
+
+function encodeToken(selector: string, verifier: string): string {
+  return `${selector}.${verifier}`;
+}
+
+function decodeToken(
+  token: string,
+): { selector: string; verifier: string } | null {
+  const dotIndex = token.indexOf('.');
+  if (dotIndex === -1) {
+    return null;
+  }
+  return {
+    selector: token.slice(0, dotIndex),
+    verifier: token.slice(dotIndex + 1),
+  };
+}
+
+/**
+ * Creates a new auth verification using the split-token pattern.
+ *
+ * @param type - Verification type (e.g., "password-reset", "email-verify")
+ * @param userId - Optional user ID to associate with the token
+ * @param expiresInSec - Token lifetime in seconds
+ * @param metadata - Optional JSON metadata to store with the token
+ * @returns The combined token (`{selector}.{verifier}`) to send to the user
+ */
+export async function createAuthVerification({
+  type,
+  userId,
+  expiresInSec,
+  metadata,
+}: {
+  type: string;
+  userId?: string;
+  expiresInSec: number;
+  metadata?: Prisma.JsonValue;
+}): Promise<{ token: string }> {
+  const { selector, verifier } = generateSplitToken();
+  const value = hashVerifier(verifier);
+  const expiresAt = new Date(Date.now() + expiresInSec * 1000);
+
+  await prisma.authVerification.create({
+    data: {
+      type,
+      identifier: selector,
+      value,
+      userId,
+      metadata: metadata ?? undefined,
+      expiresAt,
+    },
+  });
+
+  return { token: encodeToken(selector, verifier) };
+}
+
+/**
+ * Validates an auth verification token without consuming it.
+ * Returns the full record if valid so the caller can delete it
+ * as part of their own transaction.
+ *
+ * Security: If the selector matches but the verifier is wrong or expired,
+ * the token is deleted to prevent brute-force attempts.
+ *
+ * @throws BadRequestError if token is invalid, expired, or malformed
+ */
+export async function validateAuthVerification({
+  type,
+  token,
+}: {
+  type: string;
+  token: string;
+}): Promise<AuthVerification | null> {
+  const decoded = decodeToken(token);
+
+  if (!decoded) {
+    return null;
+  }
+
+  const record = await prisma.authVerification.findUnique({
+    where: { type_identifier: { type, identifier: decoded.selector } },
+  });
+
+  if (!record) {
+    return null;
+  }
+
+  if (
+    !safeCompare(record.value, hashVerifier(decoded.verifier)) ||
+    record.expiresAt < new Date()
+  ) {
+    await prisma.authVerification.delete({ where: { id: record.id } });
+    return null;
+  }
+
+  return record;
+}
+
+/**
+ * Cleanup job to delete expired auth verification tokens.
+ * Should be called periodically (e.g., via cron job or queue).
+ */
+export async function cleanupExpiredAuthVerifications(): Promise<{
+  deletedCount: number;
+}> {
+  const result = await prisma.authVerification.deleteMany({
+    where: {
+      expiresAt: { lt: new Date() },
+    },
+  });
+
+  return { deletedCount: result.count };
+}

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.d.ts

@@ -0,0 +1,15 @@
+import type { User } from '%prismaGeneratedImports';
+/**
+ * Updates the roles assigned to a user.
+ * Filters out built-in roles (public, user, system) as these are automatically assigned.
+ *
+ * @param params - The parameters for updating user roles
+ * @param params.userId - The ID of the user to update
+ * @param params.roles - Array of role names to assign to the user
+ * @returns The updated user with their roles
+ */
+export declare function updateUserRoles({ userId, roles, }: {
+    userId: string;
+    roles: string[];
+}): Promise<User>;
+//# sourceMappingURL=user-roles.service.d.ts.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-roles.service.d.ts","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAKpD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,EACpC,MAAM,EACN,KAAK,GACN,EAAE;IACD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB"}

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.js

@@ -0,0 +1,35 @@
+// @ts-nocheck
+import { AUTH_ROLE_CONFIG } from '%authRolesImports';
+import { prisma } from '%prismaImports';
+/**
+ * Updates the roles assigned to a user.
+ * Filters out built-in roles (public, user, system) as these are automatically assigned.
+ *
+ * @param params - The parameters for updating user roles
+ * @param params.userId - The ID of the user to update
+ * @param params.roles - Array of role names to assign to the user
+ * @returns The updated user with their roles
+ */
+export async function updateUserRoles({ userId, roles, }) {
+    // Filter out built-in roles (public, user, system)
+    const validRoles = roles.filter((role) => {
+        if (!(role in AUTH_ROLE_CONFIG)) {
+            return false;
+        }
+        const roleConfig = AUTH_ROLE_CONFIG[role];
+        return !roleConfig.builtIn;
+    });
+    await prisma.$transaction([
+        prisma.userRole.deleteMany({
+            where: { userId, role: { notIn: validRoles } },
+        }),
+        prisma.userRole.createMany({
+            data: validRoles.map((role) => ({ userId, role })),
+            skipDuplicates: true,
+        }),
+    ]);
+    return prisma.user.findUnique({
+        where: { id: userId },
+    });
+}
+//# sourceMappingURL=user-roles.service.js.map

package/dist/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-roles.service.js","sourceRoot":"","sources":["../../../../../../../../src/local-auth/core/generators/auth-module/templates/module/services/user-roles.service.ts"],"names":[],"mappings":"AAAA,cAAc;AAKd,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAExC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,MAAM,EACN,KAAK,GAIN;IACC,mDAAmD;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,CAAC,IAAI,IAAI,gBAAgB,CAAC,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAgB,CAAC,CAAC;QACtD,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,CAAC,YAAY,CAAC;QACxB,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;SAC/C,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACzB,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,cAAc,EAAE,IAAI;SACrB,CAAC;KACH,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;KACtB,CAAkB,CAAC;AACtB,CAAC"}