@breadstone/archipel-platform-authentication 0.0.1 → 0.0.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@breadstone/archipel-platform-authentication",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "JWT and OAuth authentication, MFA, session management, and email verification for NestJS applications.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -30,30 +30,42 @@
     "README.md"
   ],
   "dependencies": {
-    "@breadstone/archipel-platform-core": "0.0.1",
-    "@breadstone/archipel-platform-database": "0.0.1",
-    "@breadstone/archipel-platform-mailing": "0.0.1",
-    "@breadstone/archipel-platform-openapi": "0.0.1",
+    "@breadstone/archipel-platform-core": "0.0.3",
     "@nestjs/common": "11.1.18",
     "@nestjs/core": "11.1.18",
     "@nestjs/jwt": "11.0.2",
     "@nestjs/passport": "11.0.5",
     "@nestjs/swagger": "11.2.6",
-    "bcrypt": "6.0.0",
     "class-transformer": "0.5.1",
     "class-validator": "0.15.1",
     "express": "5.2.1",
     "passport": "0.7.0",
-    "passport-apple": "2.0.2",
     "passport-custom": "1.1.1",
-    "passport-github2": "0.1.12",
-    "passport-google-oauth20": "2.0.0",
     "passport-jwt": "4.0.1",
     "passport-local": "1.0.0",
-    "passport-microsoft": "2.1.0",
     "rxjs": "7.8.2",
     "tslib": "2.8.1"
   },
+  "peerDependencies": {
+    "passport-apple": "^2.0.2",
+    "passport-github2": "^0.1.12",
+    "passport-google-oauth20": "^2.0.0",
+    "passport-microsoft": "^2.1.0"
+  },
+  "peerDependenciesMeta": {
+    "passport-apple": {
+      "optional": true
+    },
+    "passport-github2": {
+      "optional": true
+    },
+    "passport-google-oauth20": {
+      "optional": true
+    },
+    "passport-microsoft": {
+      "optional": true
+    }
+  },
   "devDependencies": {
     "@types/passport-apple": "2.0.3",
     "@types/passport-github2": "1.2.9",
@@ -63,5 +75,20 @@
     "@types/passport-microsoft": "2.1.1",
     "@types/qrcode": "1.5.6",
     "vitest": "4.1.2"
+  },
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./apple": "./src/apple/index.js",
+    "./apple/index": "./src/apple/index.js",
+    "./github": "./src/github/index.js",
+    "./github/index": "./src/github/index.js",
+    "./google": "./src/google/index.js",
+    "./google/index": "./src/google/index.js",
+    "./microsoft": "./src/microsoft/index.js",
+    "./microsoft/index": "./src/microsoft/index.js"
   }
 }

package/src/AuthModule.d.ts

@@ -1,3 +1,4 @@
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
 import { DynamicModule, MiddlewareConsumer, Type } from '@nestjs/common';
 import { AuthSubjectPort } from './contracts/AuthSubjectPort';
 import { MfaSubjectPort } from './contracts/MfaSubjectPort';
@@ -29,9 +30,22 @@ export interface IAuthModuleOptions {
     verificationSubject: Type<VerificationSubjectPort>;
     /**
      * Optional implementation of the social auth port (OAuth strategies).
-     * When provided, social strategies (GitHub, Google, Microsoft, Apple) are registered.
+     * When provided together with `socialStrategies`, the social auth flow is enabled.
      */
     socialAuth?: Type<SocialAuthPort>;
+    /**
+     * Optional array of social strategy types to register (e.g. `AppleStrategy`, `GithubStrategy`).
+     * Import them from the provider-specific sub-paths
+     * (e.g. `@breadstone/archipel-platform-authentication/apple`).
+     * Requires `socialAuth` to be set.
+     */
+    socialStrategies?: Array<Type>;
+    /**
+     * Optional additional configuration entries to register (e.g. provider-specific OAuth keys).
+     * Import them from the provider-specific sub-paths
+     * (e.g. `APPLE_AUTH_CONFIG_ENTRIES` from `@breadstone/archipel-platform-authentication/apple`).
+     */
+    additionalConfigEntries?: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;
     /**
      * Optional implementation of the token enricher port.
      * When provided, additional claims are added to JWT tokens.

package/src/AuthModule.js

@@ -35,12 +35,8 @@ const MfaService_1 = require("./services/MfaService");
 const SessionService_1 = require("./services/SessionService");
 const VerificationService_1 = require("./services/VerificationService");
 const AnonymousStrategy_1 = require("./strategies/AnonymousStrategy");
-const AppleStrategy_1 = require("./strategies/AppleStrategy");
-const GithubStrategy_1 = require("./strategies/GithubStrategy");
-const GoogleStrategy_1 = require("./strategies/GoogleStrategy");
 const JwtStrategy_1 = require("./strategies/JwtStrategy");
 const LocalStrategy_1 = require("./strategies/LocalStrategy");
-const MicrosoftStrategy_1 = require("./strategies/MicrosoftStrategy");
 /**
  * The `AuthModule` handles JWT-based authentication,
  * including token creation and validation.
@@ -70,13 +66,17 @@ let AuthModule = AuthModule_1 = class AuthModule {
             portProviders.push({ provide: TokenEnricherPort_1.TokenEnricherPort, useClass: options.tokenEnricher });
         }
         const strategies = [JwtStrategy_1.JwtStrategy, LocalStrategy_1.LocalStrategy, AnonymousStrategy_1.AnonymousStrategy];
-        if (options.socialAuth) {
-            strategies.push(GithubStrategy_1.GithubStrategy, GoogleStrategy_1.GoogleStrategy, MicrosoftStrategy_1.MicrosoftStrategy, AppleStrategy_1.AppleStrategy);
+        if (options.socialStrategies) {
+            strategies.push(...options.socialStrategies);
         }
+        const configEntries = [
+            ...env_1.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES,
+            ...(options.additionalConfigEntries ?? []),
+        ];
         return {
             module: AuthModule_1,
             imports: [
-                archipel_platform_core_1.ConfigModule.register('platform-authentication', env_1.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES),
+                archipel_platform_core_1.ConfigModule.register('platform-authentication', configEntries),
                 archipel_platform_core_1.EventModule,
                 archipel_platform_core_1.IdentifierModule,
                 passport_1.PassportModule.register({

package/src/apple/env.d.ts

@@ -0,0 +1,3 @@
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+/** Configuration entries required by Apple Sign-In authentication. */
+export declare const APPLE_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/apple/env.js

@@ -0,0 +1,20 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPLE_AUTH_CONFIG_ENTRIES = void 0;
+const env_1 = require("../env");
+// #endregion
+/** Configuration entries required by Apple Sign-In authentication. */
+exports.APPLE_AUTH_CONFIG_ENTRIES = [
+    { key: env_1.AUTH_APPLE_PRIVATE_KEY, required: true, description: 'Apple Sign-In private key (PEM).' },
+    { key: env_1.AUTH_APPLE_CLIENT_ID, required: true, description: 'Apple Sign-In client ID.' },
+    { key: env_1.AUTH_APPLE_TEAM_ID, required: true, description: 'Apple developer team ID.' },
+    { key: env_1.AUTH_APPLE_KEY_ID, required: true, description: 'Apple Sign-In key ID.' },
+    {
+        key: env_1.AUTH_APPLE_CALLBACK_URL,
+        required: false,
+        defaultValue: '/auth/apple/callback',
+        description: 'Apple Sign-In callback URL.',
+    },
+];
+//# sourceMappingURL=env.js.map

package/src/apple/index.d.ts

@@ -0,0 +1,2 @@
+export { AppleStrategy } from '../strategies/AppleStrategy';
+export { APPLE_AUTH_CONFIG_ENTRIES } from './env';

package/src/apple/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPLE_AUTH_CONFIG_ENTRIES = exports.AppleStrategy = void 0;
+var AppleStrategy_1 = require("../strategies/AppleStrategy");
+Object.defineProperty(exports, "AppleStrategy", { enumerable: true, get: function () { return AppleStrategy_1.AppleStrategy; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "APPLE_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.APPLE_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/env.d.ts

@@ -51,7 +51,9 @@ export declare const AUTH_APPLE_CALLBACK_URL: import("@breadstone/archipel-platf
 export declare const AUTH_GITHUB_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** GitHub OAuth client secret. */
 export declare const AUTH_GITHUB_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** GitHub OAuth callback URL. */
+export declare const AUTH_GITHUB_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Username used for the anonymous seed user. */
 export declare const SEED_ANONYMOUS_USERNAME: import("@breadstone/archipel-platform-core").IConfigKey<string>;
-/** All configuration entries required by `platform-authentication`. */
+/** Core configuration entries required by `platform-authentication`. */
 export declare const PLATFORM_AUTHENTICATION_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/env.js

@@ -1,7 +1,7 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
+exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 // #endregion
 // ──────────────────────────────────────────────────────────────
@@ -83,6 +83,8 @@ exports.AUTH_APPLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)(
 exports.AUTH_GITHUB_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CLIENT_ID');
 /** GitHub OAuth client secret. */
 exports.AUTH_GITHUB_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CLIENT_SECRET');
+/** GitHub OAuth callback URL. */
+exports.AUTH_GITHUB_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CALLBACK_URL');
 // ──────────────────────────────────────────────────────────────
 // Seed / Misc
 // ──────────────────────────────────────────────────────────────
@@ -91,7 +93,7 @@ exports.SEED_ANONYMOUS_USERNAME = (0, archipel_platform_core_1.createConfigKey)(
 // ──────────────────────────────────────────────────────────────
 // Registry entries
 // ──────────────────────────────────────────────────────────────
-/** All configuration entries required by `platform-authentication`. */
+/** Core configuration entries required by `platform-authentication`. */
 exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
     // JWT & Session
     { key: exports.AUTH_JWT_SECRET, required: true, description: 'Secret used to sign JWTs.' },
@@ -140,39 +142,6 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
         defaultValue: '30s',
         description: 'Min interval between push resends.',
     },
-    // OAuth — Google
-    { key: exports.AUTH_GOOGLE_CLIENT_ID, required: true, description: 'Google OAuth2 client ID.' },
-    { key: exports.AUTH_GOOGLE_CLIENT_SECRET, required: true, description: 'Google OAuth2 client secret.' },
-    {
-        key: exports.AUTH_GOOGLE_CALLBACK_URL,
-        required: false,
-        defaultValue: '/auth/google/callback',
-        description: 'Google OAuth2 callback URL.',
-    },
-    // OAuth — Microsoft
-    { key: exports.AUTH_MICROSOFT_CLIENT_ID, required: true, description: 'Microsoft OAuth2 client ID.' },
-    { key: exports.AUTH_MICROSOFT_CLIENT_SECRET, required: true, description: 'Microsoft OAuth2 client secret.' },
-    {
-        key: exports.AUTH_MICROSOFT_CALLBACK_URL,
-        required: false,
-        defaultValue: '/auth/microsoft/callback',
-        description: 'Microsoft OAuth2 callback URL.',
-    },
-    { key: exports.AUTH_MICROSOFT_TENANT, required: false, defaultValue: 'common', description: 'Microsoft tenant ID.' },
-    // OAuth — Apple
-    { key: exports.AUTH_APPLE_PRIVATE_KEY, required: true, description: 'Apple Sign-In private key (PEM).' },
-    { key: exports.AUTH_APPLE_CLIENT_ID, required: true, description: 'Apple Sign-In client ID.' },
-    { key: exports.AUTH_APPLE_TEAM_ID, required: true, description: 'Apple developer team ID.' },
-    { key: exports.AUTH_APPLE_KEY_ID, required: true, description: 'Apple Sign-In key ID.' },
-    {
-        key: exports.AUTH_APPLE_CALLBACK_URL,
-        required: false,
-        defaultValue: '/auth/apple/callback',
-        description: 'Apple Sign-In callback URL.',
-    },
-    // OAuth — GitHub
-    { key: exports.AUTH_GITHUB_CLIENT_ID, required: true, description: 'GitHub OAuth client ID.' },
-    { key: exports.AUTH_GITHUB_CLIENT_SECRET, required: true, description: 'GitHub OAuth client secret.' },
     // Seed / Misc
     { key: exports.SEED_ANONYMOUS_USERNAME, required: true, description: 'Username for the anonymous seed user.' },
 ];

package/src/github/env.d.ts

@@ -0,0 +1,3 @@
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+/** Configuration entries required by GitHub OAuth authentication. */
+export declare const GITHUB_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/github/env.js

@@ -0,0 +1,18 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_AUTH_CONFIG_ENTRIES = void 0;
+const env_1 = require("../env");
+// #endregion
+/** Configuration entries required by GitHub OAuth authentication. */
+exports.GITHUB_AUTH_CONFIG_ENTRIES = [
+    { key: env_1.AUTH_GITHUB_CLIENT_ID, required: true, description: 'GitHub OAuth client ID.' },
+    { key: env_1.AUTH_GITHUB_CLIENT_SECRET, required: true, description: 'GitHub OAuth client secret.' },
+    {
+        key: env_1.AUTH_GITHUB_CALLBACK_URL,
+        required: false,
+        defaultValue: '/auth/github/callback',
+        description: 'GitHub OAuth callback URL.',
+    },
+];
+//# sourceMappingURL=env.js.map

package/src/github/index.d.ts

@@ -0,0 +1,2 @@
+export { GithubStrategy } from '../strategies/GithubStrategy';
+export { GITHUB_AUTH_CONFIG_ENTRIES } from './env';

package/src/github/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_AUTH_CONFIG_ENTRIES = exports.GithubStrategy = void 0;
+var GithubStrategy_1 = require("../strategies/GithubStrategy");
+Object.defineProperty(exports, "GithubStrategy", { enumerable: true, get: function () { return GithubStrategy_1.GithubStrategy; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "GITHUB_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.GITHUB_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/google/env.d.ts

@@ -0,0 +1,3 @@
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+/** Configuration entries required by Google OAuth authentication. */
+export declare const GOOGLE_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/google/env.js

@@ -0,0 +1,18 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GOOGLE_AUTH_CONFIG_ENTRIES = void 0;
+const env_1 = require("../env");
+// #endregion
+/** Configuration entries required by Google OAuth authentication. */
+exports.GOOGLE_AUTH_CONFIG_ENTRIES = [
+    { key: env_1.AUTH_GOOGLE_CLIENT_ID, required: true, description: 'Google OAuth2 client ID.' },
+    { key: env_1.AUTH_GOOGLE_CLIENT_SECRET, required: true, description: 'Google OAuth2 client secret.' },
+    {
+        key: env_1.AUTH_GOOGLE_CALLBACK_URL,
+        required: false,
+        defaultValue: '/auth/google/callback',
+        description: 'Google OAuth2 callback URL.',
+    },
+];
+//# sourceMappingURL=env.js.map

package/src/google/index.d.ts

@@ -0,0 +1,2 @@
+export { GoogleStrategy } from '../strategies/GoogleStrategy';
+export { GOOGLE_AUTH_CONFIG_ENTRIES } from './env';

package/src/google/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GOOGLE_AUTH_CONFIG_ENTRIES = exports.GoogleStrategy = void 0;
+var GoogleStrategy_1 = require("../strategies/GoogleStrategy");
+Object.defineProperty(exports, "GoogleStrategy", { enumerable: true, get: function () { return GoogleStrategy_1.GoogleStrategy; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "GOOGLE_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.GOOGLE_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/guards/RolesGuard.js

@@ -28,7 +28,7 @@ let RolesGuard = class RolesGuard {
             context.getHandler(),
             context.getClass(),
         ]);
-        if (roles.length === 0) {
+        if (!roles || roles.length === 0) {
             return true;
         }
         const request = context.switchToHttp().getRequest();

package/src/guards/SocialAuthGuard.d.ts

@@ -2,8 +2,8 @@ import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Observable } from 'rxjs';
 export declare class SocialAuthGuard implements CanActivate {
     private static readonly _availableProviders;
-    private readonly _provider;
-    constructor(_provider: string);
+    private readonly _routeParam;
+    constructor(routeParam: string);
     canActivate(context: ExecutionContext): boolean | Promise<boolean> | Observable<boolean>;
 }
-export declare const socialAuthGuardFactory: (provider: string) => SocialAuthGuard;
+export declare const socialAuthGuardFactory: (routeParam: string) => SocialAuthGuard;

package/src/guards/SocialAuthGuard.js

@@ -10,16 +10,18 @@ const passport_1 = require("@nestjs/passport");
 let SocialAuthGuard = SocialAuthGuard_1 = class SocialAuthGuard {
     // #endregion
     // #region Ctor
-    constructor(_provider) {
-        this._provider = _provider;
+    constructor(routeParam) {
+        this._routeParam = routeParam.startsWith(':') ? routeParam.slice(1) : routeParam;
     }
     // #endregion
     // #region Methods
     canActivate(context) {
-        if (!SocialAuthGuard_1._availableProviders.includes(this._provider)) {
-            throw new Error(`Unsupported OAuth provider: ${this._provider}`);
+        const request = context.switchToHttp().getRequest();
+        const provider = request.params[this._routeParam];
+        if (!provider || !SocialAuthGuard_1._availableProviders.includes(provider)) {
+            throw new common_1.BadRequestException(`Unsupported OAuth provider: ${provider}`);
         }
-        const guard = new ((0, passport_1.AuthGuard)(this._provider))();
+        const guard = new ((0, passport_1.AuthGuard)(provider))();
         return guard.canActivate(context);
     }
 };
@@ -30,6 +32,6 @@ exports.SocialAuthGuard = SocialAuthGuard = SocialAuthGuard_1 = tslib_1.__decora
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [String])
 ], SocialAuthGuard);
-const socialAuthGuardFactory = (provider) => new SocialAuthGuard(provider);
+const socialAuthGuardFactory = (routeParam) => new SocialAuthGuard(routeParam);
 exports.socialAuthGuardFactory = socialAuthGuardFactory;
 //# sourceMappingURL=SocialAuthGuard.js.map

package/src/microsoft/env.d.ts

@@ -0,0 +1,3 @@
+import { type IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+/** Configuration entries required by Microsoft OAuth authentication. */
+export declare const MICROSOFT_AUTH_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/microsoft/env.js

@@ -0,0 +1,19 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROSOFT_AUTH_CONFIG_ENTRIES = void 0;
+const env_1 = require("../env");
+// #endregion
+/** Configuration entries required by Microsoft OAuth authentication. */
+exports.MICROSOFT_AUTH_CONFIG_ENTRIES = [
+    { key: env_1.AUTH_MICROSOFT_CLIENT_ID, required: true, description: 'Microsoft OAuth2 client ID.' },
+    { key: env_1.AUTH_MICROSOFT_CLIENT_SECRET, required: true, description: 'Microsoft OAuth2 client secret.' },
+    {
+        key: env_1.AUTH_MICROSOFT_CALLBACK_URL,
+        required: false,
+        defaultValue: '/auth/microsoft/callback',
+        description: 'Microsoft OAuth2 callback URL.',
+    },
+    { key: env_1.AUTH_MICROSOFT_TENANT, required: false, defaultValue: 'common', description: 'Microsoft tenant ID.' },
+];
+//# sourceMappingURL=env.js.map

package/src/microsoft/index.d.ts

@@ -0,0 +1,2 @@
+export { MicrosoftStrategy } from '../strategies/MicrosoftStrategy';
+export { MICROSOFT_AUTH_CONFIG_ENTRIES } from './env';

package/src/microsoft/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROSOFT_AUTH_CONFIG_ENTRIES = exports.MicrosoftStrategy = void 0;
+var MicrosoftStrategy_1 = require("../strategies/MicrosoftStrategy");
+Object.defineProperty(exports, "MicrosoftStrategy", { enumerable: true, get: function () { return MicrosoftStrategy_1.MicrosoftStrategy; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "MICROSOFT_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.MICROSOFT_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/serializer/SessionSerializer.js

@@ -1,9 +1,8 @@
 "use strict";
-/* eslint-disable no-unused-vars */
+// #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionSerializer = void 0;
 const tslib_1 = require("tslib");
-// #region Imports
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 // #endregion

package/src/services/mfa/channels/EmailOtpMfaChannel.js

@@ -50,7 +50,7 @@ let EmailOtpMfaChannel = EmailOtpMfaChannel_1 = class EmailOtpMfaChannel {
             mfaPreferredMethod: state.preferredMethod,
             mfaUpdatedAt: new Date(),
         });
-        this._logger.log(`Sending Email MFA code to ${email} (mock): ${code}`);
+        this._logger.log(`Sending Email MFA code to ${email} (mock)`);
         return {
             method: this.method,
         };
@@ -92,7 +92,7 @@ let EmailOtpMfaChannel = EmailOtpMfaChannel_1 = class EmailOtpMfaChannel {
             mfaChannels: state,
             mfaUpdatedAt: new Date(),
         });
-        this._logger.log(`Sending Email MFA code to ${email} (login): ${code}`);
+        this._logger.log(`Sending Email MFA code to ${email} (login)`);
     }
     async verifyCodeAndMaybeEnable(userId, code, enable) {
         const user = await this._mfaSubject.findById(userId);

package/src/services/mfa/channels/PushMfaChannel.js

@@ -55,7 +55,7 @@ let PushMfaChannel = PushMfaChannel_1 = class PushMfaChannel {
             mfaUpdatedAt: new Date(),
         });
         // Replace with actual push notification send once available.
-        this._logger.log(`Simulating push approval code for user ${user.id}: ${code}`);
+        this._logger.log(`Simulating push approval code for user ${user.id}`);
         return { method: this.method };
     }
     async verifySetup(userId, code) {
@@ -90,7 +90,7 @@ let PushMfaChannel = PushMfaChannel_1 = class PushMfaChannel {
             mfaChannels: state,
             mfaUpdatedAt: new Date(),
         });
-        this._logger.log(`Simulating push approval for user ${user.id}: ${code}`);
+        this._logger.log(`Simulating push approval for user ${user.id}`);
     }
     async verifyCodeAndMaybeEnable(userId, code, enable) {
         const user = await this._mfaSubject.findById(userId);

package/src/services/mfa/channels/SmsMfaChannel.js

@@ -56,7 +56,7 @@ let SmsMfaChannel = SmsMfaChannel_1 = class SmsMfaChannel {
             mfaPreferredMethod: state.preferredMethod,
             mfaUpdatedAt: new Date(),
         });
-        this._logger.log(`Sending SMS MFA code to ${phone} (mock): ${code}`);
+        this._logger.log(`Sending SMS MFA code to ${phone} (mock)`);
         return {
             method: this.method,
         };
@@ -98,7 +98,7 @@ let SmsMfaChannel = SmsMfaChannel_1 = class SmsMfaChannel {
             mfaChannels: state,
             mfaUpdatedAt: new Date(),
         });
-        this._logger.log(`Sending SMS MFA code to ${phone} (login): ${code}`);
+        this._logger.log(`Sending SMS MFA code to ${phone} (login)`);
     }
     async verifyCodeAndMaybeEnable(userId, code, enable) {
         const user = await this._mfaSubject.findById(userId);

package/src/strategies/GithubStrategy.d.ts

@@ -7,7 +7,6 @@ declare const GithubStrategy_base: new (...args: [options: import("passport-gith
 };
 export declare class GithubStrategy extends GithubStrategy_base {
     private readonly _socialAuth;
-    private readonly _configService;
     /**
      * Constructs a new instance of the `GithubStrategy` class.
      *

package/src/strategies/GithubStrategy.js

@@ -8,11 +8,6 @@ const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 const passport_github2_1 = require("passport-github2");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
-// import type { authConfig } from '../../../configs/auth.config';
-// import { AuthConfig } from '../../../configs/auth.config';
-// import { UserService } from '../../user/user.service';
-// import { OauthStoreService } from '../oauth/oauth.store';
-// import { pickUserMe } from '../utils';
 // #endregion
 let GithubStrategy = class GithubStrategy extends (0, passport_1.PassportStrategy)(passport_github2_1.Strategy, 'github') {
     // #endregion
@@ -28,12 +23,9 @@ let GithubStrategy = class GithubStrategy extends (0, passport_1.PassportStrateg
         super({
             clientID: configService.get('AUTH_GITHUB_CLIENT_ID'),
             clientSecret: configService.get('AUTH_GITHUB_CLIENT_SECRET'),
-            state: true,
-            callbackURL: '/auth/github/callback',
-            // store: oauthStoreService
+            callbackURL: configService.tryGet('AUTH_GITHUB_CALLBACK_URL', '/auth/github/callback'),
         });
         this._socialAuth = socialAuth;
-        this._configService = configService;
     }
     // #endregion
     // #region Methods
@@ -41,18 +33,19 @@ let GithubStrategy = class GithubStrategy extends (0, passport_1.PassportStrateg
      * @public
      */
     async validate(_accessToken, _refreshToken, profile) {
-        const email = profile.emails?.[0].value;
+        const email = profile.emails?.[0]?.value;
         if (!email) {
             throw new common_1.UnauthorizedException('No email provided from GitHub');
         }
-        if (!profile.displayName) {
+        const displayName = profile.displayName || profile.username;
+        if (!displayName) {
             throw new common_1.UnauthorizedException('No display name provided from GitHub');
         }
         const user = await this._socialAuth.findOrCreateByProfile({
             provider: 'github',
             email: email,
             userName: profile.username ?? null,
-            displayName: profile.displayName ?? null,
+            displayName: displayName,
         });
         return user;
     }

package/src/strategies/JwtStrategy.js

@@ -42,7 +42,7 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
     async validate(payload) {
         const user = await this._authSubject.findById(payload.id);
         if (!user) {
-            throw new common_1.NotFoundException('User not found');
+            throw new common_1.UnauthorizedException('Invalid token subject');
         }
         return user;
     }

package/src/strategies/LocalStrategy.d.ts

@@ -1,3 +1,4 @@
+import { BcryptService } from '@breadstone/archipel-platform-core';
 import { Strategy } from 'passport-local';
 import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
@@ -11,13 +12,15 @@ declare const LocalStrategy_base: new (...args: [] | [options: import("passport-
  */
 export declare class LocalStrategy extends LocalStrategy_base {
     private readonly _authSubject;
+    private readonly _bcryptService;
     /**
      * Constructs a new instance of the `LocalStrategy` class.
      *
      * @public
      * @param authSubject Auth subject port instance.
+     * @param bcryptService Bcrypt service instance.
      */
-    constructor(authSubject: AuthSubjectPort);
+    constructor(authSubject: AuthSubjectPort, bcryptService: BcryptService);
     /**
      * Validates the authentication credentials.
      *

package/src/strategies/LocalStrategy.js

@@ -3,6 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalStrategy = void 0;
 const tslib_1 = require("tslib");
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 const passport_local_1 = require("passport-local");
@@ -21,10 +22,12 @@ let LocalStrategy = class LocalStrategy extends (0, passport_1.PassportStrategy)
      *
      * @public
      * @param authSubject Auth subject port instance.
+     * @param bcryptService Bcrypt service instance.
      */
-    constructor(authSubject) {
+    constructor(authSubject, bcryptService) {
         super();
         this._authSubject = authSubject;
+        this._bcryptService = bcryptService;
     }
     // #endregion
     // #region Methods
@@ -38,11 +41,11 @@ let LocalStrategy = class LocalStrategy extends (0, passport_1.PassportStrategy)
      */
     async validate(userName, password) {
         const user = await this._authSubject.findByLogin(userName);
-        if (!user) {
-            throw new common_1.NotFoundException('User not found');
+        if (!user || !user.password) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
         }
-        // TODO Check if we need bcrypt here...
-        if (user.password !== password) {
+        const isPasswordValid = await this._bcryptService.compare(password, user.password);
+        if (!isPasswordValid) {
             throw new common_1.UnauthorizedException('Invalid credentials');
         }
         return user;
@@ -51,6 +54,6 @@ let LocalStrategy = class LocalStrategy extends (0, passport_1.PassportStrategy)
 exports.LocalStrategy = LocalStrategy;
 exports.LocalStrategy = LocalStrategy = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort])
+    tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_core_1.BcryptService])
 ], LocalStrategy);
 //# sourceMappingURL=LocalStrategy.js.map