@bpinhosilva/agent-orchestrator 1.0.0-alpha.19 → 1.0.0-alpha.20

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [1.0.0-alpha.20](https://github.com/bpinhosilva/agent-orchestrator/compare/v1.0.0-alpha.19...v1.0.0-alpha.20) (2026-03-30)
+
+
+### Features
+
+* implement security fixes ([f570f92](https://github.com/bpinhosilva/agent-orchestrator/commit/f570f92a10cf1473c36a0145c160f6e23905bb1f))
+
 # [1.0.0-alpha.19](https://github.com/bpinhosilva/agent-orchestrator/compare/v1.0.0-alpha.18...v1.0.0-alpha.19) (2026-03-30)
 
 

package/dist/auth/auth.controller.d.ts

@@ -1,6 +1,7 @@
 import { AuthService } from './auth.service';
 import { RegisterDto } from './dto/register.dto';
 import { LoginDto } from './dto/login.dto';
+import type { Response as ExpressResponse, Request as ExpressRequest } from 'express';
 export declare class AuthController {
     private readonly authService;
     constructor(authService: AuthService);
@@ -11,10 +12,10 @@ export declare class AuthController {
         createdAt: Date;
         updatedAt: Date;
     }>;
-    login(loginDto: LoginDto): Promise<{
-        access_token: string;
-    }>;
+    login(loginDto: LoginDto, res: ExpressResponse): Promise<void>;
+    refresh(req: ExpressRequest, res: ExpressResponse): Promise<ExpressResponse<any, Record<string, any>>>;
     getMe(req: {
         user: unknown;
     }): unknown;
+    logout(req: ExpressRequest, res: ExpressResponse): Promise<void>;
 }

package/dist/auth/auth.controller.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthController = void 0;
 const openapi = require("@nestjs/swagger");
 const common_1 = require("@nestjs/common");
+const throttler_1 = require("@nestjs/throttler");
 const auth_service_1 = require("./auth.service");
 const register_dto_1 = require("./dto/register.dto");
 const login_dto_1 = require("./dto/login.dto");
@@ -28,16 +29,71 @@ let AuthController = class AuthController {
     register(registerDto) {
         return this.authService.register(registerDto);
     }
-    login(loginDto) {
-        return this.authService.login(loginDto);
+    async login(loginDto, res) {
+        const data = await this.authService.login(loginDto);
+        res.cookie('auth_token', data.access_token, {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === 'production',
+            sameSite: 'strict',
+            maxAge: data.expires_in * 1000,
+            path: '/',
+        });
+        res.cookie('refresh_token', data.refresh_token, {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === 'production',
+            sameSite: 'strict',
+            maxAge: data.refresh_expires_in * 1000,
+            path: '/',
+        });
+        res.json({ message: 'Logged in successfully' });
+    }
+    async refresh(req, res) {
+        const refreshToken = req.cookies?.refresh_token;
+        if (!refreshToken) {
+            return res
+                .status(common_1.HttpStatus.UNAUTHORIZED)
+                .json({ message: 'Refresh token not found' });
+        }
+        try {
+            const data = await this.authService.refresh(refreshToken);
+            res.cookie('refresh_token', data.refresh_token, {
+                httpOnly: true,
+                secure: process.env.NODE_ENV === 'production',
+                sameSite: 'strict',
+                maxAge: data.refresh_expires_in * 1000,
+                path: '/',
+            });
+            return res.json({
+                access_token: data.access_token,
+                expires_in: data.expires_in,
+                token_type: data.token_type,
+            });
+        }
+        catch {
+            res.clearCookie('auth_token', { path: '/' });
+            res.clearCookie('refresh_token', { path: '/' });
+            return res
+                .status(common_1.HttpStatus.UNAUTHORIZED)
+                .json({ message: 'Invalid or expired refresh token' });
+        }
     }
     getMe(req) {
         return req.user;
     }
+    async logout(req, res) {
+        const refreshToken = req.cookies?.refresh_token;
+        if (refreshToken) {
+            await this.authService.revokeRefreshToken(refreshToken);
+        }
+        res.clearCookie('auth_token', { path: '/' });
+        res.clearCookie('refresh_token', { path: '/' });
+        res.json({ message: 'Logged out successfully' });
+    }
 };
 exports.AuthController = AuthController;
 __decorate([
     (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60000 } }),
     (0, common_1.Post)('register'),
     openapi.ApiResponse({ status: 201 }),
     __param(0, (0, common_1.Body)()),
@@ -47,14 +103,28 @@ __decorate([
 ], AuthController.prototype, "register", null);
 __decorate([
     (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60000 } }),
     (0, common_1.HttpCode)(common_1.HttpStatus.OK),
     (0, common_1.Post)('login'),
     openapi.ApiResponse({ status: common_1.HttpStatus.OK }),
     __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Response)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [login_dto_1.LoginDto]),
-    __metadata("design:returntype", void 0)
+    __metadata("design:paramtypes", [login_dto_1.LoginDto, Object]),
+    __metadata("design:returntype", Promise)
 ], AuthController.prototype, "login", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60000 } }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, common_1.Post)('refresh'),
+    openapi.ApiResponse({ status: common_1.HttpStatus.OK }),
+    __param(0, (0, common_1.Request)()),
+    __param(1, (0, common_1.Response)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
 __decorate([
     (0, common_1.Get)('me'),
     openapi.ApiResponse({ status: 200, type: Object }),
@@ -63,6 +133,15 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", void 0)
 ], AuthController.prototype, "getMe", null);
+__decorate([
+    (0, common_1.Post)('logout'),
+    openapi.ApiResponse({ status: 201 }),
+    __param(0, (0, common_1.Request)()),
+    __param(1, (0, common_1.Response)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "logout", null);
 exports.AuthController = AuthController = __decorate([
     (0, swagger_1.ApiTags)('auth'),
     (0, common_1.Controller)('auth'),

package/dist/auth/auth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,iDAA6C;AAC7C,qDAAiD;AACjD,+CAA2C;AAC3C,oEAAuD;AACvD,6CAA0C;AAInC,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAIzD,QAAQ,CAAS,WAAwB;QACvC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAKD,KAAK,CAAS,QAAkB;QAC9B,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAGD,KAAK,CAAY,GAAsB;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;CACF,CAAA;AApBY,wCAAc;AAKzB;IAFC,IAAA,yBAAM,GAAE;IACR,IAAA,aAAI,EAAC,UAAU,CAAC;;IACP,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAc,0BAAW;;8CAExC;AAKD;IAHC,IAAA,yBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,aAAI,EAAC,OAAO,CAAC;kCADJ,mBAAU,CAAC,EAAE;IAEhB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAW,oBAAQ;;2CAE/B;AAGD;IADC,IAAA,YAAG,EAAC,IAAI,CAAC;;IACH,WAAA,IAAA,gBAAO,GAAE,CAAA;;;;2CAEf;yBAnBU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,MAAM,CAAC;qCAEyB,0BAAW;GAD1C,cAAc,CAoB1B"}
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../src/auth/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,iDAA6C;AAC7C,iDAA6C;AAC7C,qDAAiD;AACjD,+CAA2C;AAC3C,oEAAuD;AACvD,6CAA0C;AAQnC,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAKzD,QAAQ,CAAS,WAAwB;QACvC,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAMK,AAAN,KAAK,CAAC,KAAK,CAAS,QAAkB,EAAc,GAAoB;QACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAGpD,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;YAC1C,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7C,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI;YAC9B,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE;YAC9C,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7C,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI;YACtC,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAClD,CAAC;IAMK,AAAN,KAAK,CAAC,OAAO,CACA,GAAmB,EAClB,GAAoB;QAGhC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QAEhD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG;iBACP,MAAM,CAAC,mBAAU,CAAC,YAAY,CAAC;iBAC/B,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAsB,CAAC,CAAC;YAGpE,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE;gBAC9C,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;gBAC7C,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI;gBACtC,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAEP,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO,GAAG;iBACP,MAAM,CAAC,mBAAU,CAAC,YAAY,CAAC;iBAC/B,IAAI,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAGD,KAAK,CAAY,GAAsB;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CACC,GAAmB,EAClB,GAAoB;QAGhC,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC;QAGhD,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAsB,CAAC,CAAC;QACpE,CAAC;QAED,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,GAAG,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAvGY,wCAAc;AAMzB;IAHC,IAAA,yBAAM,GAAE;IACR,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAC/C,IAAA,aAAI,EAAC,UAAU,CAAC;;IACP,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAc,0BAAW;;8CAExC;AAMK;IAJL,IAAA,yBAAM,GAAE;IACR,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAC/C,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,aAAI,EAAC,OAAO,CAAC;kCADJ,mBAAU,CAAC,EAAE;IAEV,WAAA,IAAA,aAAI,GAAE,CAAA;IAAsB,WAAA,IAAA,iBAAQ,GAAE,CAAA;;qCAArB,oBAAQ;;2CAqBrC;AAMK;IAJL,IAAA,yBAAM,GAAE;IACR,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,aAAI,EAAC,SAAS,CAAC;kCADN,mBAAU,CAAC,EAAE;IAGpB,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,iBAAQ,GAAE,CAAA;;;;6CAoCZ;AAGD;IADC,IAAA,YAAG,EAAC,IAAI,CAAC;;IACH,WAAA,IAAA,gBAAO,GAAE,CAAA;;;;2CAEf;AAGK;IADL,IAAA,aAAI,EAAC,QAAQ,CAAC;;IAEZ,WAAA,IAAA,gBAAO,GAAE,CAAA;IACT,WAAA,IAAA,iBAAQ,GAAE,CAAA;;;;4CAaZ;yBAtGU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,MAAM,CAAC;qCAEyB,0BAAW;GAD1C,cAAc,CAuG1B"}

package/dist/auth/auth.module.js

@@ -8,6 +8,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthModule = void 0;
 const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
 const auth_service_1 = require("./auth.service");
 const auth_controller_1 = require("./auth.controller");
 const users_module_1 = require("../users/users.module");
@@ -15,6 +16,7 @@ const passport_1 = require("@nestjs/passport");
 const jwt_1 = require("@nestjs/jwt");
 const config_1 = require("@nestjs/config");
 const jwt_strategy_1 = require("./strategies/jwt.strategy");
+const refresh_token_entity_1 = require("./entities/refresh-token.entity");
 let AuthModule = class AuthModule {
 };
 exports.AuthModule = AuthModule;
@@ -23,6 +25,7 @@ exports.AuthModule = AuthModule = __decorate([
         imports: [
             users_module_1.UsersModule,
             passport_1.PassportModule,
+            typeorm_1.TypeOrmModule.forFeature([refresh_token_entity_1.RefreshToken]),
             jwt_1.JwtModule.registerAsync({
                 imports: [config_1.ConfigModule],
                 inject: [config_1.ConfigService],

package/dist/auth/auth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,iDAA6C;AAC7C,uDAAmD;AACnD,wDAAoD;AACpD,+CAAkD;AAClD,qCAAwC;AACxC,2CAA6D;AAC7D,4DAAwD;AAmBjD,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IAjBtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,0BAAW;YACX,yBAAc;YACd,eAAS,CAAC,aAAa,CAAC;gBACtB,OAAO,EAAE,CAAC,qBAAY,CAAC;gBACvB,MAAM,EAAE,CAAC,sBAAa,CAAC;gBACvB,UAAU,EAAE,CAAC,aAA4B,EAAE,EAAE,CAAC,CAAC;oBAC7C,MAAM,EAAE,aAAa,CAAC,GAAG,CAAS,YAAY,CAAC;oBAC/C,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;iBAClC,CAAC;aACH,CAAC;SACH;QACD,SAAS,EAAE,CAAC,0BAAW,EAAE,0BAAW,CAAC;QACrC,WAAW,EAAE,CAAC,gCAAc,CAAC;QAC7B,OAAO,EAAE,CAAC,0BAAW,CAAC;KACvB,CAAC;GACW,UAAU,CAAG"}
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,6CAAgD;AAChD,iDAA6C;AAC7C,uDAAmD;AACnD,wDAAoD;AACpD,+CAAkD;AAClD,qCAAwC;AACxC,2CAA6D;AAC7D,4DAAwD;AACxD,0EAA+D;AAoBxD,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IAlBtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,0BAAW;YACX,yBAAc;YACd,uBAAa,CAAC,UAAU,CAAC,CAAC,mCAAY,CAAC,CAAC;YACxC,eAAS,CAAC,aAAa,CAAC;gBACtB,OAAO,EAAE,CAAC,qBAAY,CAAC;gBACvB,MAAM,EAAE,CAAC,sBAAa,CAAC;gBACvB,UAAU,EAAE,CAAC,aAA4B,EAAE,EAAE,CAAC,CAAC;oBAC7C,MAAM,EAAE,aAAa,CAAC,GAAG,CAAS,YAAY,CAAC;oBAC/C,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;iBAClC,CAAC;aACH,CAAC;SACH;QACD,SAAS,EAAE,CAAC,0BAAW,EAAE,0BAAW,CAAC;QACrC,WAAW,EAAE,CAAC,gCAAc,CAAC;QAC7B,OAAO,EAAE,CAAC,0BAAW,CAAC;KACvB,CAAC;GACW,UAAU,CAAG"}

package/dist/auth/auth.service.d.ts

@@ -1,13 +1,24 @@
 import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { Repository } from 'typeorm';
 import { UsersService } from '../users/users.service';
 import { RegisterDto } from './dto/register.dto';
 import { LoginDto } from './dto/login.dto';
+import { RefreshToken } from './entities/refresh-token.entity';
 import { User } from '../users/entities/user.entity';
 export declare class AuthService {
     private usersService;
     private jwtService;
-    constructor(usersService: UsersService, jwtService: JwtService);
+    private configService;
+    private refreshTokenRepository;
+    private readonly accessTokenExpiresIn;
+    private readonly refreshTokenExpiresIn;
+    private readonly absoluteMaxExpiresIn;
+    constructor(usersService: UsersService, jwtService: JwtService, configService: ConfigService, refreshTokenRepository: Repository<RefreshToken>);
     validateUser(userId: string): Promise<Omit<User, 'password'> | null>;
+    private generateAccessToken;
+    private generateRefreshToken;
+    validateRefreshToken(token: string): Promise<string | null>;
     register(registerDto: RegisterDto): Promise<{
         id: string;
         name: string;
@@ -17,5 +28,18 @@ export declare class AuthService {
     }>;
     login(loginDto: LoginDto): Promise<{
         access_token: string;
+        refresh_token: string;
+        expires_in: number;
+        refresh_expires_in: number;
+        refresh_absolute_expires_in: number;
+        token_type: string;
     }>;
+    refresh(refreshToken: string): Promise<{
+        access_token: string;
+        refresh_token: string;
+        expires_in: number;
+        refresh_expires_in: number;
+        token_type: string;
+    }>;
+    revokeRefreshToken(token: string): Promise<void>;
 }

package/dist/auth/auth.service.js

@@ -41,18 +41,32 @@ var __importStar = (this && this.__importStar) || (function () {
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthService = void 0;
 const common_1 = require("@nestjs/common");
 const jwt_1 = require("@nestjs/jwt");
+const config_1 = require("@nestjs/config");
+const typeorm_1 = require("typeorm");
+const typeorm_2 = require("@nestjs/typeorm");
 const users_service_1 = require("../users/users.service");
+const refresh_token_entity_1 = require("./entities/refresh-token.entity");
 const bcrypt = __importStar(require("bcrypt"));
 let AuthService = class AuthService {
     usersService;
     jwtService;
-    constructor(usersService, jwtService) {
+    configService;
+    refreshTokenRepository;
+    accessTokenExpiresIn = '60m';
+    refreshTokenExpiresIn = '1d';
+    absoluteMaxExpiresIn = 30 * 24 * 60 * 60 * 1000;
+    constructor(usersService, jwtService, configService, refreshTokenRepository) {
         this.usersService = usersService;
         this.jwtService = jwtService;
+        this.configService = configService;
+        this.refreshTokenRepository = refreshTokenRepository;
     }
     async validateUser(userId) {
         try {
@@ -67,6 +81,74 @@ let AuthService = class AuthService {
         }
         return null;
     }
+    generateAccessToken(payload) {
+        return this.jwtService.sign(payload, {
+            expiresIn: this.accessTokenExpiresIn,
+        });
+    }
+    async generateRefreshToken(userId) {
+        const issuedAt = new Date();
+        const expiresAt = new Date(issuedAt.getTime() + 24 * 60 * 60 * 1000);
+        const absoluteExpiry = new Date(issuedAt.getTime() + this.absoluteMaxExpiresIn);
+        const payload = {
+            sub: userId,
+            type: 'refresh',
+            iat: Math.floor(issuedAt.getTime() / 1000),
+        };
+        const token = this.jwtService.sign(payload, {
+            expiresIn: this.refreshTokenExpiresIn,
+            secret: this.configService.get('JWT_SECRET'),
+        });
+        const hashedToken = await bcrypt.hash(token, 10);
+        await this.refreshTokenRepository.save({
+            userId,
+            token: hashedToken,
+            issuedAt,
+            expiresAt,
+            absoluteExpiry,
+            revokedAt: null,
+        });
+        return { token, expiresAt, absoluteExpiry };
+    }
+    async validateRefreshToken(token) {
+        try {
+            const payload = this.jwtService.verify(token, {
+                secret: this.configService.get('JWT_SECRET'),
+            });
+            if (payload.type !== 'refresh') {
+                return null;
+            }
+            const refreshTokens = await this.refreshTokenRepository.find({
+                where: {
+                    userId: payload.sub,
+                    revokedAt: (0, typeorm_1.IsNull)(),
+                },
+            });
+            if (!refreshTokens.length) {
+                return null;
+            }
+            let tokenFound = false;
+            for (const dbToken of refreshTokens) {
+                const isMatch = await bcrypt.compare(token, dbToken.token);
+                if (isMatch) {
+                    if (new Date() > dbToken.expiresAt) {
+                        return null;
+                    }
+                    if (new Date() > dbToken.absoluteExpiry) {
+                        return null;
+                    }
+                    tokenFound = true;
+                    break;
+                }
+            }
+            return tokenFound
+                ? payload.sub
+                : null;
+        }
+        catch {
+            return null;
+        }
+    }
     async register(registerDto) {
         const existingUser = await this.usersService.findByEmail(registerDto.email);
         if (existingUser) {
@@ -93,15 +175,61 @@ let AuthService = class AuthService {
             throw new common_1.UnauthorizedException('Invalid credentials');
         }
         const payload = { email: user.email, sub: user.id };
+        const accessToken = this.generateAccessToken(payload);
+        const { token: refreshToken } = await this.generateRefreshToken(user.id);
+        return {
+            access_token: accessToken,
+            refresh_token: refreshToken,
+            expires_in: 3600,
+            refresh_expires_in: 86400,
+            refresh_absolute_expires_in: 2592000,
+            token_type: 'Bearer',
+        };
+    }
+    async refresh(refreshToken) {
+        const userId = await this.validateRefreshToken(refreshToken);
+        if (!userId) {
+            throw new common_1.UnauthorizedException('Invalid or expired refresh token');
+        }
+        const user = await this.usersService.findOne(userId);
+        if (!user) {
+            throw new common_1.UnauthorizedException('User not found');
+        }
+        await this.refreshTokenRepository.update({ userId, revokedAt: (0, typeorm_1.IsNull)() }, { revokedAt: new Date() });
+        const payload = { email: user.email, sub: user.id };
+        const newAccessToken = this.generateAccessToken(payload);
+        const { token: newRefreshToken } = await this.generateRefreshToken(user.id);
         return {
-            access_token: this.jwtService.sign(payload),
+            access_token: newAccessToken,
+            refresh_token: newRefreshToken,
+            expires_in: 3600,
+            refresh_expires_in: 86400,
+            token_type: 'Bearer',
         };
     }
+    async revokeRefreshToken(token) {
+        try {
+            const payload = this.jwtService.verify(token, {
+                secret: this.configService.get('JWT_SECRET'),
+            });
+            if (payload.sub) {
+                await this.refreshTokenRepository.update({
+                    userId: payload.sub,
+                    revokedAt: (0, typeorm_1.IsNull)(),
+                }, { revokedAt: new Date() });
+            }
+        }
+        catch {
+        }
+    }
 };
 exports.AuthService = AuthService;
 exports.AuthService = AuthService = __decorate([
     (0, common_1.Injectable)(),
+    __param(3, (0, typeorm_2.InjectRepository)(refresh_token_entity_1.RefreshToken)),
     __metadata("design:paramtypes", [users_service_1.UsersService,
-        jwt_1.JwtService])
+        jwt_1.JwtService,
+        config_1.ConfigService,
+        typeorm_1.Repository])
 ], AuthService);
 //# sourceMappingURL=auth.service.js.map

package/dist/auth/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/auth/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAIwB;AACxB,qCAAyC;AACzC,0DAAsD;AAGtD,+CAAiC;AAI1B,IAAM,WAAW,GAAjB,MAAM,WAAW;IAEZ;IACA;IAFV,YACU,YAA0B,EAC1B,UAAsB;QADtB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;IAC7B,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,IAAI,EAAE,CAAC;gBAET,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;gBACrC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAwB;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAC1C,GAAG,WAAW;YACd,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;QAGH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAkB;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpD,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;SAC5C,CAAC;IACJ,CAAC;CACF,CAAA;AAzDY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAGa,4BAAY;QACd,gBAAU;GAHrB,WAAW,CAyDvB"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/auth/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAIwB;AACxB,qCAAyC;AACzC,2CAA+C;AAC/C,qCAA6C;AAC7C,6CAAmD;AACnD,0DAAsD;AAGtD,0EAA+D;AAC/D,+CAAiC;AAI1B,IAAM,WAAW,GAAjB,MAAM,WAAW;IAMZ;IACA;IACA;IAEA;IATO,oBAAoB,GAAG,KAAK,CAAC;IAC7B,qBAAqB,GAAG,IAAI,CAAC;IAC7B,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEjE,YACU,YAA0B,EAC1B,UAAsB,EACtB,aAA4B,EAE5B,sBAAgD;QAJhD,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;QACtB,kBAAa,GAAb,aAAa,CAAe;QAE5B,2BAAsB,GAAtB,sBAAsB,CAA0B;IACvD,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,IAAI,EAAE,CAAC;gBAET,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;gBACrC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,mBAAmB,CAAC,OAA+B;QACzD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;YACnC,SAAS,EAAE,IAAI,CAAC,oBAAoB;SACrC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,MAAc;QAEd,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACrE,MAAM,cAAc,GAAG,IAAI,IAAI,CAC7B,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,oBAAoB,CAC/C,CAAC;QAEF,MAAM,OAAO,GAAG;YACd,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;SAC3C,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE;YAC1C,SAAS,EAAE,IAAI,CAAC,qBAAqB;YACrC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,YAAY,CAAC;SACrD,CAAC,CAAC;QAGH,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAGjD,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YACrC,MAAM;YACN,KAAK,EAAE,WAAW;YAClB,QAAQ;YACR,SAAS;YACT,cAAc;YACd,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,KAAa;QACtC,IAAI,CAAC;YAGH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC5C,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,YAAY,CAAC;aACrD,CAAC,CAAC;YAEH,IAAK,OAAmC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YAGD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;gBAC3D,KAAK,EAAE;oBACL,MAAM,EAAG,OAAmC,CAAC,GAAa;oBAC1D,SAAS,EAAE,IAAA,gBAAM,GAAE;iBACpB;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAGD,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC3D,IAAI,OAAO,EAAE,CAAC;oBAEZ,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;wBACnC,OAAO,IAAI,CAAC;oBACd,CAAC;oBAGD,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;wBACxC,OAAO,IAAI,CAAC;oBACd,CAAC;oBAED,UAAU,GAAG,IAAI,CAAC;oBAClB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,OAAO,UAAU;gBACf,CAAC,CAAG,OAAmC,CAAC,GAAc;gBACtD,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAwB;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;YAC1C,GAAG,WAAW;YACd,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;QAGH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,QAAkB;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEzE,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;YAC3B,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,KAAK;YACzB,2BAA2B,EAAE,OAAO;YACpC,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAGD,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CACtC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC/B,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAC1B,CAAC;QAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAGzD,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5E,OAAO;YACL,YAAY,EAAE,cAAc;YAC5B,aAAa,EAAE,eAAe;YAC9B,UAAU,EAAE,IAAI;YAChB,kBAAkB,EAAE,KAAK;YACzB,UAAU,EAAE,QAAQ;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,IAAI,CAAC;YAGH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC5C,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,YAAY,CAAC;aACrD,CAAC,CAAC;YAIH,IAAK,OAAmC,CAAC,GAAG,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CACtC;oBACE,MAAM,EAAG,OAAmC,CAAC,GAAa;oBAC1D,SAAS,EAAE,IAAA,gBAAM,GAAE;iBACpB,EACD,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAC1B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAGT,CAAC;IACH,CAAC;CACF,CAAA;AA/NY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAUR,WAAA,IAAA,0BAAgB,EAAC,mCAAY,CAAC,CAAA;qCAHT,4BAAY;QACd,gBAAU;QACP,sBAAa;QAEJ,oBAAU;GAVjC,WAAW,CA+NvB"}

package/dist/auth/entities/refresh-token.entity.d.ts

@@ -0,0 +1,12 @@
+import { User } from '../../users/entities/user.entity';
+export declare class RefreshToken {
+    id: string;
+    userId: string;
+    user: User;
+    token: string;
+    issuedAt: Date;
+    expiresAt: Date;
+    absoluteExpiry: Date;
+    createdAt: Date;
+    revokedAt: Date | null;
+}

package/dist/auth/entities/refresh-token.entity.js

@@ -0,0 +1,72 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshToken = void 0;
+const openapi = require("@nestjs/swagger");
+const typeorm_1 = require("typeorm");
+const user_entity_1 = require("../../users/entities/user.entity");
+let RefreshToken = class RefreshToken {
+    id;
+    userId;
+    user;
+    token;
+    issuedAt;
+    expiresAt;
+    absoluteExpiry;
+    createdAt;
+    revokedAt;
+    static _OPENAPI_METADATA_FACTORY() {
+        return { id: { required: true, type: () => String }, userId: { required: true, type: () => String }, user: { required: true, type: () => require("../../users/entities/user.entity").User }, token: { required: true, type: () => String }, issuedAt: { required: true, type: () => Date }, expiresAt: { required: true, type: () => Date }, absoluteExpiry: { required: true, type: () => Date }, createdAt: { required: true, type: () => Date }, revokedAt: { required: true, type: () => Date, nullable: true } };
+    }
+};
+exports.RefreshToken = RefreshToken;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], RefreshToken.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)(),
+    __metadata("design:type", String)
+], RefreshToken.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => user_entity_1.User, { onDelete: 'CASCADE' }),
+    (0, typeorm_1.JoinColumn)({ name: 'userId' }),
+    __metadata("design:type", user_entity_1.User)
+], RefreshToken.prototype, "user", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text' }),
+    __metadata("design:type", String)
+], RefreshToken.prototype, "token", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)(),
+    __metadata("design:type", Date)
+], RefreshToken.prototype, "issuedAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'datetime' }),
+    __metadata("design:type", Date)
+], RefreshToken.prototype, "expiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'datetime' }),
+    __metadata("design:type", Date)
+], RefreshToken.prototype, "absoluteExpiry", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)(),
+    __metadata("design:type", Date)
+], RefreshToken.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'datetime', nullable: true }),
+    __metadata("design:type", Object)
+], RefreshToken.prototype, "revokedAt", void 0);
+exports.RefreshToken = RefreshToken = __decorate([
+    (0, typeorm_1.Entity)('refresh_tokens'),
+    (0, typeorm_1.Index)(['userId', 'expiresAt'])
+], RefreshToken);
+//# sourceMappingURL=refresh-token.entity.js.map

package/dist/auth/entities/refresh-token.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/refresh-token.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,qCAQiB;AACjB,kEAAwD;AAIjD,IAAM,YAAY,GAAlB,MAAM,YAAY;IAEvB,EAAE,CAAS;IAGX,MAAM,CAAS;IAIf,IAAI,CAAO;IAGX,KAAK,CAAS;IAGd,QAAQ,CAAO;IAGf,SAAS,CAAO;IAGhB,cAAc,CAAO;IAGrB,SAAS,CAAO;IAGhB,SAAS,CAAc;;;;CACxB,CAAA;AA5BY,oCAAY;AAEvB;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;wCACpB;AAGX;IADC,IAAA,gBAAM,GAAE;;4CACM;AAIf;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,kBAAI,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC9C,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;8BACzB,kBAAI;0CAAC;AAGX;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;2CACX;AAGd;IADC,IAAA,0BAAgB,GAAE;8BACT,IAAI;8CAAC;AAGf;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;8BAClB,IAAI;+CAAC;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;8BACb,IAAI;oDAAC;AAGrB;IADC,IAAA,0BAAgB,GAAE;8BACR,IAAI;+CAAC;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACtB;uBA3BZ,YAAY;IAFxB,IAAA,gBAAM,EAAC,gBAAgB,CAAC;IACxB,IAAA,eAAK,EAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;GAClB,YAAY,CA4BxB"}

package/dist/main.js

@@ -1,8 +1,13 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@nestjs/core");
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const helmet_1 = __importDefault(require("helmet"));
+const cookie_parser_1 = __importDefault(require("cookie-parser"));
 const app_module_1 = require("./app.module");
 const config_1 = require("@nestjs/config");
 const http_exception_filter_1 = require("./common/filters/http-exception.filter");
@@ -13,7 +18,23 @@ async function bootstrap() {
     app.setGlobalPrefix('api/v1');
     app.useGlobalPipes(new common_1.ValidationPipe({ transform: true, whitelist: true }));
     app.useGlobalFilters(new http_exception_filter_1.HttpExceptionFilter());
+    app.use((0, helmet_1.default)());
+    app.use((0, cookie_parser_1.default)());
     const configService = app.get(config_1.ConfigService);
+    const nodeEnv = configService.get('NODE_ENV') || 'development';
+    const corsOptions = {
+        credentials: true,
+    };
+    if (nodeEnv === 'development') {
+        corsOptions.origin = ['http://localhost:5173', 'http://localhost:3000'];
+    }
+    else if (nodeEnv === 'production') {
+        corsOptions.origin = ['http://localhost:15789', 'http://0.0.0.0:15789'];
+    }
+    else {
+        corsOptions.origin = true;
+    }
+    app.enableCors(corsOptions);
     const port = configService.get('PORT') || 3000;
     const config = new swagger_1.DocumentBuilder()
         .setTitle('Agent Orchestrator API')

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;AAAA,uCAA2C;AAC3C,2CAAgD;AAChD,6CAAiE;AACjE,6CAAyC;AACzC,2CAA+C;AAE/C,kFAA6E;AAE7E,KAAK,UAAU,SAAS;IACtB,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,sBAAS,EAAE;QAC9C,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9B,GAAG,CAAC,cAAc,CAAC,IAAI,uBAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,gBAAgB,CAAC,IAAI,2CAAmB,EAAE,CAAC,CAAC;IAEhD,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,sBAAa,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAS,MAAM,CAAC,IAAI,IAAI,CAAC;IAEvD,MAAM,MAAM,GAAG,IAAI,yBAAe,EAAE;SACjC,QAAQ,CAAC,wBAAwB,CAAC;SAClC,cAAc,CAAC,kDAAkD,CAAC;SAClE,UAAU,CAAC,KAAK,CAAC;SACjB,aAAa,EAAE;SACf,KAAK,EAAE,CAAC;IACX,MAAM,QAAQ,GAAG,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3D,uBAAa,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE1C,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AACD,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;;;;AAAA,uCAA2C;AAC3C,2CAAgD;AAChD,6CAAiE;AACjE,oDAA4B;AAC5B,kEAAyC;AACzC,6CAAyC;AACzC,2CAA+C;AAG/C,kFAA6E;AAE7E,KAAK,UAAU,SAAS;IACtB,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,sBAAS,EAAE;QAC9C,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;KACrD,CAAC,CAAC;IAEH,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC9B,GAAG,CAAC,cAAc,CAAC,IAAI,uBAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,GAAG,CAAC,gBAAgB,CAAC,IAAI,2CAAmB,EAAE,CAAC,CAAC;IAGhD,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAM,GAAE,CAAC,CAAC;IAGlB,GAAG,CAAC,GAAG,CAAC,IAAA,uBAAY,GAAE,CAAC,CAAC;IAGxB,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,sBAAa,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAS,UAAU,CAAC,IAAI,aAAa,CAAC;IACvE,MAAM,WAAW,GAAgB;QAC/B,WAAW,EAAE,IAAI;KAClB,CAAC;IAEF,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,WAAW,CAAC,MAAM,GAAG,CAAC,uBAAuB,EAAE,uBAAuB,CAAC,CAAC;IAC1E,CAAC;SAAM,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QACpC,WAAW,CAAC,MAAM,GAAG,CAAC,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;IAC1E,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC;IAED,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAE5B,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAS,MAAM,CAAC,IAAI,IAAI,CAAC;IAEvD,MAAM,MAAM,GAAG,IAAI,yBAAe,EAAE;SACjC,QAAQ,CAAC,wBAAwB,CAAC;SAClC,cAAc,CAAC,kDAAkD,CAAC;SAClE,UAAU,CAAC,KAAK,CAAC;SACjB,aAAa,EAAE;SACf,KAAK,EAAE,CAAC;IACX,MAAM,QAAQ,GAAG,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3D,uBAAa,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE1C,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,8BAA8B,MAAM,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AACD,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/migrations/1774850116434-CreateRefreshTokens.d.ts

@@ -0,0 +1,6 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+export declare class CreateRefreshTokens1774850116434 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}