@breadstone/archipel-platform-authentication 0.0.1

package/README.md

@@ -0,0 +1,47 @@
+# @breadstone/archipel-platform-authentication
+
+Authentication and authorization infrastructure for NestJS applications.
+
+## ⚠️ Environment Variables (Most Important)
+
+| Variable                       | Required | Default |
+| ------------------------------ | -------- | ------- |
+| `AUTH_JWT_SECRET`              | yes      | -       |
+| `AUTH_JWT_EXPIRES_IN`          | yes      | -       |
+| `AUTH_VERIFY_JWT_EXPIRES_IN`   | yes      | -       |
+| `AUTH_GOOGLE_CLIENT_ID`        | yes      | -       |
+| `AUTH_GOOGLE_CLIENT_SECRET`    | yes      | -       |
+| `AUTH_MICROSOFT_CLIENT_ID`     | yes      | -       |
+| `AUTH_MICROSOFT_CLIENT_SECRET` | yes      | -       |
+| `AUTH_APPLE_PRIVATE_KEY`       | yes      | -       |
+| `AUTH_APPLE_CLIENT_ID`         | yes      | -       |
+| `AUTH_APPLE_TEAM_ID`           | yes      | -       |
+| `AUTH_APPLE_KEY_ID`            | yes      | -       |
+| `AUTH_GITHUB_CLIENT_ID`        | yes      | -       |
+| `AUTH_GITHUB_CLIENT_SECRET`    | yes      | -       |
+| `SEED_ANONYMOUS_USERNAME`      | yes      | -       |
+
+For the full list (including MFA/OAuth callback defaults), see [`../../ENVIRONMENT_VARIABLES.md`](../../ENVIRONMENT_VARIABLES.md).
+
+## Quick Start
+
+```typescript
+import { AuthModule } from '@breadstone/archipel-platform-authentication';
+```
+
+## Documentation
+
+📖 **Auth Module:** [`docs/backend/modules/auth.md`](../../../docs/backend/modules/auth.md)
+
+## Development
+
+```bash
+# Build
+yarn nx build platform-authentication
+
+# Test
+yarn nx test platform-authentication
+
+# Lint
+yarn nx lint platform-authentication
+```

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@breadstone/archipel-platform-authentication",
+  "version": "0.0.1",
+  "description": "JWT and OAuth authentication, MFA, session management, and email verification for NestJS applications.",
+  "type": "commonjs",
+  "main": "./src/index.js",
+  "types": "./src/index.d.ts",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/RueDeRennes/archipel",
+    "directory": "libs/platform-authentication"
+  },
+  "keywords": [
+    "nestjs",
+    "authentication",
+    "jwt",
+    "oauth",
+    "mfa",
+    "passport",
+    "session",
+    "archipel"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "src/**/*.js",
+    "src/**/*.d.ts",
+    "README.md"
+  ],
+  "dependencies": {
+    "@breadstone/archipel-platform-core": "0.0.1",
+    "@breadstone/archipel-platform-database": "0.0.1",
+    "@breadstone/archipel-platform-mailing": "0.0.1",
+    "@breadstone/archipel-platform-openapi": "0.0.1",
+    "@nestjs/common": "11.1.18",
+    "@nestjs/core": "11.1.18",
+    "@nestjs/jwt": "11.0.2",
+    "@nestjs/passport": "11.0.5",
+    "@nestjs/swagger": "11.2.6",
+    "bcrypt": "6.0.0",
+    "class-transformer": "0.5.1",
+    "class-validator": "0.15.1",
+    "express": "5.2.1",
+    "passport": "0.7.0",
+    "passport-apple": "2.0.2",
+    "passport-custom": "1.1.1",
+    "passport-github2": "0.1.12",
+    "passport-google-oauth20": "2.0.0",
+    "passport-jwt": "4.0.1",
+    "passport-local": "1.0.0",
+    "passport-microsoft": "2.1.0",
+    "rxjs": "7.8.2",
+    "tslib": "2.8.1"
+  },
+  "devDependencies": {
+    "@types/passport-apple": "2.0.3",
+    "@types/passport-github2": "1.2.9",
+    "@types/passport-google-oauth20": "2.0.17",
+    "@types/passport-jwt": "4.0.1",
+    "@types/passport-local": "1.0.38",
+    "@types/passport-microsoft": "2.1.1",
+    "@types/qrcode": "1.5.6",
+    "vitest": "4.1.2"
+  }
+}

package/src/AuthModule.d.ts

@@ -0,0 +1,57 @@
+import { DynamicModule, MiddlewareConsumer, Type } from '@nestjs/common';
+import { AuthSubjectPort } from './contracts/AuthSubjectPort';
+import { MfaSubjectPort } from './contracts/MfaSubjectPort';
+import { SessionPersistencePort } from './contracts/SessionPersistencePort';
+import { SocialAuthPort } from './contracts/SocialAuthPort';
+import { TokenEnricherPort } from './contracts/TokenEnricherPort';
+import { VerificationSubjectPort } from './contracts/VerificationSubjectPort';
+/**
+ * Options for configuring the `AuthModule`.
+ *
+ * @public
+ */
+export interface IAuthModuleOptions {
+    /**
+     * Implementation of the auth subject port (user lookup for JWT/Local/Anonymous strategies).
+     */
+    authSubject: Type<AuthSubjectPort>;
+    /**
+     * Implementation of the MFA subject port (MFA state persistence).
+     */
+    mfaSubject: Type<MfaSubjectPort>;
+    /**
+     * Implementation of the session persistence port.
+     */
+    sessionPersistence: Type<SessionPersistencePort>;
+    /**
+     * Implementation of the verification subject port (email/pin verification).
+     */
+    verificationSubject: Type<VerificationSubjectPort>;
+    /**
+     * Optional implementation of the social auth port (OAuth strategies).
+     * When provided, social strategies (GitHub, Google, Microsoft, Apple) are registered.
+     */
+    socialAuth?: Type<SocialAuthPort>;
+    /**
+     * Optional implementation of the token enricher port.
+     * When provided, additional claims are added to JWT tokens.
+     */
+    tokenEnricher?: Type<TokenEnricherPort>;
+}
+/**
+ * The `AuthModule` handles JWT-based authentication,
+ * including token creation and validation.
+ *
+ * @public
+ */
+export declare class AuthModule {
+    /**
+     * Registers the auth module with the provided port implementations.
+     *
+     * @public
+     * @param options - Port implementations for the auth module.
+     * @returns The configured dynamic module.
+     */
+    static register(options: IAuthModuleOptions): DynamicModule;
+    configure(consumer: MiddlewareConsumer): void;
+}

package/src/AuthModule.js

@@ -0,0 +1,158 @@
+"use strict";
+// #region Imports
+var AuthModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const tslib_1 = require("tslib");
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const passport_1 = require("@nestjs/passport");
+const AuthSubjectPort_1 = require("./contracts/AuthSubjectPort");
+const MfaSubjectPort_1 = require("./contracts/MfaSubjectPort");
+const SessionPersistencePort_1 = require("./contracts/SessionPersistencePort");
+const SocialAuthPort_1 = require("./contracts/SocialAuthPort");
+const TokenEnricherPort_1 = require("./contracts/TokenEnricherPort");
+const VerificationSubjectPort_1 = require("./contracts/VerificationSubjectPort");
+const env_1 = require("./env");
+const AnonymousAuthGuard_1 = require("./guards/AnonymousAuthGuard");
+const GithubAuthGuard_1 = require("./guards/GithubAuthGuard");
+const JwtAuthGuard_1 = require("./guards/JwtAuthGuard");
+const LocalAuthGuard_1 = require("./guards/LocalAuthGuard");
+const RolesGuard_1 = require("./guards/RolesGuard");
+const SessionMappingProfile_1 = require("./mappers/SessionMappingProfile");
+const middlewares_1 = require("./middlewares");
+const SessionSerializer_1 = require("./serializer/SessionSerializer");
+const AuthTokenService_1 = require("./services/AuthTokenService");
+const ChallengeService_1 = require("./services/ChallengeService");
+const EmailOtpMfaChannel_1 = require("./services/mfa/channels/EmailOtpMfaChannel");
+const PushMfaChannel_1 = require("./services/mfa/channels/PushMfaChannel");
+const SmsMfaChannel_1 = require("./services/mfa/channels/SmsMfaChannel");
+const TotpMfaChannel_1 = require("./services/mfa/channels/TotpMfaChannel");
+const MfaEncryptionService_1 = require("./services/mfa/MfaEncryptionService");
+const MfaTokens_1 = require("./services/mfa/MfaTokens");
+const MfaService_1 = require("./services/MfaService");
+const SessionService_1 = require("./services/SessionService");
+const VerificationService_1 = require("./services/VerificationService");
+const AnonymousStrategy_1 = require("./strategies/AnonymousStrategy");
+const AppleStrategy_1 = require("./strategies/AppleStrategy");
+const GithubStrategy_1 = require("./strategies/GithubStrategy");
+const GoogleStrategy_1 = require("./strategies/GoogleStrategy");
+const JwtStrategy_1 = require("./strategies/JwtStrategy");
+const LocalStrategy_1 = require("./strategies/LocalStrategy");
+const MicrosoftStrategy_1 = require("./strategies/MicrosoftStrategy");
+/**
+ * The `AuthModule` handles JWT-based authentication,
+ * including token creation and validation.
+ *
+ * @public
+ */
+let AuthModule = AuthModule_1 = class AuthModule {
+    // #region Methods
+    /**
+     * Registers the auth module with the provided port implementations.
+     *
+     * @public
+     * @param options - Port implementations for the auth module.
+     * @returns The configured dynamic module.
+     */
+    static register(options) {
+        const portProviders = [
+            { provide: AuthSubjectPort_1.AuthSubjectPort, useClass: options.authSubject },
+            { provide: MfaSubjectPort_1.MfaSubjectPort, useClass: options.mfaSubject },
+            { provide: SessionPersistencePort_1.SessionPersistencePort, useClass: options.sessionPersistence },
+            { provide: VerificationSubjectPort_1.VerificationSubjectPort, useClass: options.verificationSubject },
+        ];
+        if (options.socialAuth) {
+            portProviders.push({ provide: SocialAuthPort_1.SocialAuthPort, useClass: options.socialAuth });
+        }
+        if (options.tokenEnricher) {
+            portProviders.push({ provide: TokenEnricherPort_1.TokenEnricherPort, useClass: options.tokenEnricher });
+        }
+        const strategies = [JwtStrategy_1.JwtStrategy, LocalStrategy_1.LocalStrategy, AnonymousStrategy_1.AnonymousStrategy];
+        if (options.socialAuth) {
+            strategies.push(GithubStrategy_1.GithubStrategy, GoogleStrategy_1.GoogleStrategy, MicrosoftStrategy_1.MicrosoftStrategy, AppleStrategy_1.AppleStrategy);
+        }
+        return {
+            module: AuthModule_1,
+            imports: [
+                archipel_platform_core_1.ConfigModule.register('platform-authentication', env_1.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES),
+                archipel_platform_core_1.EventModule,
+                archipel_platform_core_1.IdentifierModule,
+                passport_1.PassportModule.register({
+                    defaultStrategy: 'jwt',
+                    session: true,
+                }),
+                jwt_1.JwtModule.register({
+                    secret: process.env['AUTH_JWT_SECRET'],
+                    signOptions: {
+                        expiresIn: archipel_platform_core_1.DateTimeUtils.parse(process.env['AUTH_JWT_EXPIRES_IN']),
+                    },
+                }),
+                archipel_platform_core_1.MappingModule.withProfiles([SessionMappingProfile_1.SessionMappingProfile]),
+            ],
+            providers: [
+                ...portProviders,
+                ...strategies,
+                SessionSerializer_1.SessionSerializer,
+                JwtAuthGuard_1.JwtAuthGuard,
+                LocalAuthGuard_1.LocalAuthGuard,
+                AnonymousAuthGuard_1.AnonymousAuthGuard,
+                GithubAuthGuard_1.GithubAuthGuard,
+                RolesGuard_1.RolesGuard,
+                AuthTokenService_1.AuthTokenService,
+                VerificationService_1.VerificationService,
+                SessionService_1.SessionService,
+                MfaService_1.MfaService,
+                ChallengeService_1.ChallengeService,
+                TotpMfaChannel_1.TotpMfaChannel,
+                SmsMfaChannel_1.SmsMfaChannel,
+                EmailOtpMfaChannel_1.EmailOtpMfaChannel,
+                PushMfaChannel_1.PushMfaChannel,
+                MfaEncryptionService_1.MfaEncryptionService,
+                {
+                    provide: archipel_platform_core_1.OTP_SERVICE_TOKEN,
+                    useClass: archipel_platform_core_1.OtpService,
+                },
+                {
+                    provide: MfaTokens_1.MFA_CHANNELS,
+                    useFactory: (totpChannel, smsChannel, emailChannel, pushChannel) => [totpChannel, smsChannel, emailChannel, pushChannel],
+                    inject: [TotpMfaChannel_1.TotpMfaChannel, SmsMfaChannel_1.SmsMfaChannel, EmailOtpMfaChannel_1.EmailOtpMfaChannel, PushMfaChannel_1.PushMfaChannel],
+                },
+                archipel_platform_core_1.DeviceParserService,
+                middlewares_1.LastActiveMiddleware,
+                archipel_platform_core_1.BcryptService,
+                archipel_platform_core_1.CryptoService,
+                archipel_platform_core_1.HostService,
+            ],
+            exports: [
+                AuthTokenService_1.AuthTokenService,
+                VerificationService_1.VerificationService,
+                SessionService_1.SessionService,
+                MfaService_1.MfaService,
+                ChallengeService_1.ChallengeService,
+                JwtAuthGuard_1.JwtAuthGuard,
+                LocalAuthGuard_1.LocalAuthGuard,
+                AnonymousAuthGuard_1.AnonymousAuthGuard,
+                GithubAuthGuard_1.GithubAuthGuard,
+                RolesGuard_1.RolesGuard,
+            ],
+        };
+    }
+    configure(consumer) {
+        consumer.apply(archipel_platform_core_1.LimitRequestSizeMiddleware).forRoutes({
+            path: 'api/auth/register',
+            method: common_1.RequestMethod.POST,
+        });
+        consumer.apply(middlewares_1.LastActiveMiddleware).forRoutes({
+            path: '*',
+            method: common_1.RequestMethod.ALL,
+        });
+    }
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = AuthModule_1 = tslib_1.__decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], AuthModule);
+//# sourceMappingURL=AuthModule.js.map

package/src/contracts/AuthSubjectPort.d.ts

@@ -0,0 +1,33 @@
+import type { IAuthSubject } from './IAuthSubject';
+/**
+ * Abstract port for resolving authentication subjects by identity.
+ * Used by the JWT, Local, and Anonymous strategies.
+ *
+ * @public
+ */
+export declare abstract class AuthSubjectPort {
+    /**
+     * Find a subject by its unique identifier.
+     *
+     * @public
+     * @param id - The subject identifier.
+     * @returns The subject or `null`.
+     */
+    abstract findById(id: string): Promise<IAuthSubject | null>;
+    /**
+     * Find a subject by its login name (user name or email).
+     *
+     * @public
+     * @param login - The login identifier.
+     * @returns The subject or `null`.
+     */
+    abstract findByLogin(login: string): Promise<IAuthSubject | null>;
+    /**
+     * Find the anonymous / seed subject by user name.
+     *
+     * @public
+     * @param userName - The anonymous user name.
+     * @returns The subject or `null`.
+     */
+    abstract findAnonymous(userName: string): Promise<IAuthSubject | null>;
+}

package/src/contracts/AuthSubjectPort.js

@@ -0,0 +1,15 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthSubjectPort = void 0;
+// #endregion
+/**
+ * Abstract port for resolving authentication subjects by identity.
+ * Used by the JWT, Local, and Anonymous strategies.
+ *
+ * @public
+ */
+class AuthSubjectPort {
+}
+exports.AuthSubjectPort = AuthSubjectPort;
+//# sourceMappingURL=AuthSubjectPort.js.map

package/src/contracts/IAuthSubject.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Generic authentication subject returned by the {@link AuthSubjectPort}.
+ * Represents any entity that can authenticate (user, service account, etc.).
+ *
+ * @public
+ */
+export interface IAuthSubject {
+    /**
+     * Unique identifier.
+     */
+    readonly id: string;
+    /**
+     * Login name (user name, email alias, etc.).
+     */
+    readonly userName: string | null;
+    /**
+     * Email address.
+     */
+    readonly email: string | null;
+    /**
+     * Hashed password. `null` for social-only accounts.
+     */
+    readonly password: string | null;
+    /**
+     * Whether the account has been verified (e.g. email confirmation).
+     */
+    readonly isVerified: boolean;
+    /**
+     * Whether the account is anonymous.
+     */
+    readonly isAnonymous: boolean;
+    /**
+     * Assigned role strings (e.g. `['user', 'admin']`).
+     */
+    readonly roles: ReadonlyArray<string>;
+    /**
+     * Whether MFA is enabled for this subject.
+     */
+    readonly mfaEnabled: boolean;
+}

package/src/contracts/IAuthSubject.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=IAuthSubject.js.map

package/src/contracts/IMfaSubject.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Represents an MFA-enabled subject. Contains the data the MFA subsystem
+ * needs to read and write MFA state on the underlying user-like entity.
+ *
+ * @public
+ */
+export interface IMfaSubject {
+    /**
+     * Unique identifier.
+     */
+    readonly id: string;
+    /**
+     * Email address, used by the email OTP channel.
+     */
+    readonly email: string | null;
+    /**
+     * User name, used as TOTP account label.
+     */
+    readonly userName: string | null;
+    /**
+     * Whether MFA is currently enabled.
+     */
+    readonly mfaEnabled: boolean;
+    /**
+     * Legacy TOTP secret (plain text). Used for migration to channel-based state.
+     */
+    readonly mfaSecret: string | null;
+    /**
+     * Hashed backup codes.
+     */
+    readonly mfaBackupCodes: ReadonlyArray<string>;
+    /**
+     * Preferred MFA method.
+     */
+    readonly mfaPreferredMethod: string | null;
+    /**
+     * Last time MFA was verified.
+     */
+    readonly mfaVerifiedAt: Date | null;
+    /**
+     * Serialized per-channel MFA state (JSON object).
+     */
+    readonly mfaChannels: unknown;
+    /**
+     * Phone number, used by the SMS channel.
+     */
+    readonly phoneNumber: string | null;
+}

package/src/contracts/IMfaSubject.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=IMfaSubject.js.map

package/src/contracts/IMfaSubjectUpdate.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Data payload for updating MFA state on the underlying entity.
+ * All properties are optional — only the provided ones are applied.
+ *
+ * @public
+ */
+export interface IMfaSubjectUpdate {
+    readonly mfaEnabled?: boolean;
+    readonly mfaSecret?: string | null;
+    readonly mfaBackupCodes?: string[];
+    readonly mfaPreferredMethod?: string | null;
+    readonly mfaVerifiedAt?: Date | null;
+    readonly mfaUpdatedAt?: Date;
+    readonly mfaChannels?: unknown;
+    readonly phoneNumber?: string;
+}

package/src/contracts/IMfaSubjectUpdate.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=IMfaSubjectUpdate.js.map

package/src/contracts/ISessionRecord.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Represents a persisted session record.
+ *
+ * @public
+ */
+export interface ISessionRecord {
+    readonly id: string;
+    readonly token: string;
+    readonly userId: string;
+    readonly ipAddress: string;
+    readonly userAgent: string | null;
+    readonly deviceType: string | null;
+    readonly deviceName: string | null;
+    readonly browserName: string | null;
+    readonly browserVersion: string | null;
+    readonly osName: string | null;
+    readonly osVersion: string | null;
+    readonly location: string | null;
+    readonly clientName: string | null;
+    readonly lastActive: Date;
+    readonly createdAt: Date;
+}

package/src/contracts/ISessionRecord.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=ISessionRecord.js.map

package/src/contracts/ISocialProfile.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Profile data received from a social / OAuth provider.
+ *
+ * @public
+ */
+export interface ISocialProfile {
+    /**
+     * The OAuth provider name (e.g. 'github', 'google', 'microsoft', 'apple').
+     */
+    readonly provider: string;
+    /**
+     * User name as reported by the provider.
+     */
+    readonly userName: string | null;
+    /**
+     * Email address as reported by the provider.
+     */
+    readonly email: string;
+    /**
+     * Display name.
+     */
+    readonly displayName: string | null;
+}

package/src/contracts/ISocialProfile.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=ISocialProfile.js.map

package/src/contracts/IStoreSessionArgs.d.ts

@@ -0,0 +1,14 @@
+import type { IDeviceInfo } from '@breadstone/archipel-platform-core';
+/**
+ * Arguments for storing a new session.
+ *
+ * @public
+ */
+export interface IStoreSessionArgs {
+    readonly token: string;
+    readonly userId: string;
+    readonly ipAddress: string;
+    readonly deviceInfo?: IDeviceInfo;
+    readonly location?: string;
+    readonly clientName?: string;
+}

package/src/contracts/IStoreSessionArgs.js

@@ -0,0 +1,4 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=IStoreSessionArgs.js.map

package/src/contracts/IVerifiableSubject.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Represents a verifiable authentication subject.
+ * Used by the {@link VerificationService} to verify email / PIN.
+ *
+ * @public
+ */
+export interface IVerifiableSubject {
+    /**
+     * Unique identifier.
+     */
+    readonly id: string;
+    /**
+     * Email address.
+     */
+    readonly email: string | null;
+    /**
+     * User / login name.
+     */
+    readonly userName: string | null;
+    /**
+     * Whether the account has already been verified.
+     */
+    readonly isVerified: boolean;
+    /**
+     * Current verification token stored on the entity.
+     */
+    readonly verificationToken: string | null;
+}

package/src/contracts/IVerifiableSubject.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=IVerifiableSubject.js.map

package/src/contracts/MfaSubjectPort.d.ts

@@ -0,0 +1,26 @@
+import type { IMfaSubject } from './IMfaSubject';
+import type { IMfaSubjectUpdate } from './IMfaSubjectUpdate';
+/**
+ * Abstract port for reading and writing MFA state on the underlying subject entity.
+ * Used by the MfaService and all MFA channel implementations.
+ *
+ * @public
+ */
+export declare abstract class MfaSubjectPort {
+    /**
+     * Find an MFA subject by its unique identifier.
+     *
+     * @public
+     * @param id - The subject identifier.
+     * @returns The MFA subject or `null`.
+     */
+    abstract findById(id: string): Promise<IMfaSubject | null>;
+    /**
+     * Update MFA-related fields on the subject.
+     *
+     * @public
+     * @param id - The subject identifier.
+     * @param data - The partial update payload.
+     */
+    abstract updateMfaState(id: string, data: IMfaSubjectUpdate): Promise<void>;
+}

package/src/contracts/MfaSubjectPort.js

@@ -0,0 +1,15 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MfaSubjectPort = void 0;
+// #endregion
+/**
+ * Abstract port for reading and writing MFA state on the underlying subject entity.
+ * Used by the MfaService and all MFA channel implementations.
+ *
+ * @public
+ */
+class MfaSubjectPort {
+}
+exports.MfaSubjectPort = MfaSubjectPort;
+//# sourceMappingURL=MfaSubjectPort.js.map