@breadstone/archipel-platform-authentication 0.0.1

package/src/contracts/SessionPersistencePort.d.ts

@@ -0,0 +1,58 @@
+import type { ISessionRecord } from './ISessionRecord';
+import type { IStoreSessionArgs } from './IStoreSessionArgs';
+/**
+ * Abstract port for persisting and querying sessions.
+ * Used by the SessionService and LastActiveMiddleware.
+ *
+ * @public
+ */
+export declare abstract class SessionPersistencePort {
+    /**
+     * Store or update a session.
+     *
+     * @public
+     * @param args - The session data to store.
+     */
+    abstract store(args: IStoreSessionArgs): Promise<void>;
+    /**
+     * Find a session by its token.
+     *
+     * @public
+     * @param token - The session token.
+     * @returns The session record or `null`.
+     */
+    abstract findByToken(token: string): Promise<ISessionRecord | null>;
+    /**
+     * Find all sessions for a given user.
+     *
+     * @public
+     * @param userId - The user identifier.
+     * @returns Sessions ordered by last activity descending.
+     */
+    abstract findAllByUserId(userId: string): Promise<ReadonlyArray<ISessionRecord>>;
+    /**
+     * Update the last-active timestamp for a session.
+     *
+     * @public
+     * @param token - The session token.
+     * @param date - The new last-active date.
+     */
+    abstract updateLastActive(token: string, date: Date): Promise<void>;
+    /**
+     * Invalidate (delete) a session by its token.
+     *
+     * @public
+     * @param token - The session token.
+     * @returns `true` if a session was invalidated.
+     */
+    abstract invalidate(token: string): Promise<boolean>;
+    /**
+     * Invalidate (delete) a session by its record id and owning user id.
+     *
+     * @public
+     * @param id - The session record identifier.
+     * @param userId - The owning user identifier.
+     * @returns `true` if a session was invalidated.
+     */
+    abstract invalidateById(id: string, userId: string): Promise<boolean>;
+}

package/src/contracts/SessionPersistencePort.js

@@ -0,0 +1,15 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionPersistencePort = void 0;
+// #endregion
+/**
+ * Abstract port for persisting and querying sessions.
+ * Used by the SessionService and LastActiveMiddleware.
+ *
+ * @public
+ */
+class SessionPersistencePort {
+}
+exports.SessionPersistencePort = SessionPersistencePort;
+//# sourceMappingURL=SessionPersistencePort.js.map

package/src/contracts/SocialAuthPort.d.ts

@@ -0,0 +1,19 @@
+import type { IAuthSubject } from './IAuthSubject';
+import type { ISocialProfile } from './ISocialProfile';
+/**
+ * Abstract port for resolving or creating subjects from social / OAuth profiles.
+ * Used by all social strategies (GitHub, Google, Microsoft, Apple).
+ *
+ * @public
+ */
+export declare abstract class SocialAuthPort {
+    /**
+     * Find an existing subject matching the social profile,
+     * or create a new one if none exists.
+     *
+     * @public
+     * @param profile - The normalized social profile.
+     * @returns The existing or newly created subject.
+     */
+    abstract findOrCreateByProfile(profile: ISocialProfile): Promise<IAuthSubject>;
+}

package/src/contracts/SocialAuthPort.js

@@ -0,0 +1,15 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SocialAuthPort = void 0;
+// #endregion
+/**
+ * Abstract port for resolving or creating subjects from social / OAuth profiles.
+ * Used by all social strategies (GitHub, Google, Microsoft, Apple).
+ *
+ * @public
+ */
+class SocialAuthPort {
+}
+exports.SocialAuthPort = SocialAuthPort;
+//# sourceMappingURL=SocialAuthPort.js.map

package/src/contracts/TokenEnricherPort.d.ts

@@ -0,0 +1,17 @@
+import type { IAuthSubject } from './IAuthSubject';
+/**
+ * Abstract port for enriching JWT claims with product-specific data.
+ * This is an optional port: when not provided, the token contains only base claims.
+ *
+ * @public
+ */
+export declare abstract class TokenEnricherPort {
+    /**
+     * Return additional claims to merge into the JWT payload.
+     *
+     * @public
+     * @param subject - The authenticated subject.
+     * @returns A record of additional claims.
+     */
+    abstract enrichClaims(subject: IAuthSubject): Promise<Record<string, unknown>>;
+}

package/src/contracts/TokenEnricherPort.js

@@ -0,0 +1,15 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenEnricherPort = void 0;
+// #endregion
+/**
+ * Abstract port for enriching JWT claims with product-specific data.
+ * This is an optional port: when not provided, the token contains only base claims.
+ *
+ * @public
+ */
+class TokenEnricherPort {
+}
+exports.TokenEnricherPort = TokenEnricherPort;
+//# sourceMappingURL=TokenEnricherPort.js.map

package/src/contracts/VerificationSubjectPort.d.ts

@@ -0,0 +1,40 @@
+import type { IVerifiableSubject } from './IVerifiableSubject';
+/**
+ * Abstract port for verifiable subject persistence.
+ * Used by the VerificationService to manage email/PIN verification.
+ *
+ * @public
+ */
+export declare abstract class VerificationSubjectPort {
+    /**
+     * Find a subject by login (user name or email).
+     *
+     * @public
+     * @param login - The login identifier.
+     * @returns The verifiable subject or `null`.
+     */
+    abstract findByLogin(login: string): Promise<IVerifiableSubject | null>;
+    /**
+     * Find a subject by its current verification token.
+     *
+     * @public
+     * @param token - The verification token string.
+     * @returns The subject or `null`.
+     */
+    abstract findByVerificationToken(token: string): Promise<IVerifiableSubject | null>;
+    /**
+     * Store a verification token on the subject.
+     *
+     * @public
+     * @param id - The subject identifier.
+     * @param token - The verification token to store.
+     */
+    abstract setVerificationToken(id: string, token: string | null): Promise<void>;
+    /**
+     * Mark the subject as verified and clear the token.
+     *
+     * @public
+     * @param id - The subject identifier.
+     */
+    abstract markVerified(id: string): Promise<void>;
+}

package/src/contracts/VerificationSubjectPort.js

@@ -0,0 +1,15 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerificationSubjectPort = void 0;
+// #endregion
+/**
+ * Abstract port for verifiable subject persistence.
+ * Used by the VerificationService to manage email/PIN verification.
+ *
+ * @public
+ */
+class VerificationSubjectPort {
+}
+exports.VerificationSubjectPort = VerificationSubjectPort;
+//# sourceMappingURL=VerificationSubjectPort.js.map

package/src/contracts/index.d.ts

@@ -0,0 +1,13 @@
+export { AuthSubjectPort } from './AuthSubjectPort';
+export type { IAuthSubject } from './IAuthSubject';
+export type { IMfaSubject } from './IMfaSubject';
+export type { IMfaSubjectUpdate } from './IMfaSubjectUpdate';
+export type { ISessionRecord } from './ISessionRecord';
+export type { ISocialProfile } from './ISocialProfile';
+export type { IStoreSessionArgs } from './IStoreSessionArgs';
+export type { IVerifiableSubject } from './IVerifiableSubject';
+export { MfaSubjectPort } from './MfaSubjectPort';
+export { SessionPersistencePort } from './SessionPersistencePort';
+export { SocialAuthPort } from './SocialAuthPort';
+export { TokenEnricherPort } from './TokenEnricherPort';
+export { VerificationSubjectPort } from './VerificationSubjectPort';

package/src/contracts/index.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerificationSubjectPort = exports.TokenEnricherPort = exports.SocialAuthPort = exports.SessionPersistencePort = exports.MfaSubjectPort = exports.AuthSubjectPort = void 0;
+var AuthSubjectPort_1 = require("./AuthSubjectPort");
+Object.defineProperty(exports, "AuthSubjectPort", { enumerable: true, get: function () { return AuthSubjectPort_1.AuthSubjectPort; } });
+var MfaSubjectPort_1 = require("./MfaSubjectPort");
+Object.defineProperty(exports, "MfaSubjectPort", { enumerable: true, get: function () { return MfaSubjectPort_1.MfaSubjectPort; } });
+var SessionPersistencePort_1 = require("./SessionPersistencePort");
+Object.defineProperty(exports, "SessionPersistencePort", { enumerable: true, get: function () { return SessionPersistencePort_1.SessionPersistencePort; } });
+var SocialAuthPort_1 = require("./SocialAuthPort");
+Object.defineProperty(exports, "SocialAuthPort", { enumerable: true, get: function () { return SocialAuthPort_1.SocialAuthPort; } });
+var TokenEnricherPort_1 = require("./TokenEnricherPort");
+Object.defineProperty(exports, "TokenEnricherPort", { enumerable: true, get: function () { return TokenEnricherPort_1.TokenEnricherPort; } });
+var VerificationSubjectPort_1 = require("./VerificationSubjectPort");
+Object.defineProperty(exports, "VerificationSubjectPort", { enumerable: true, get: function () { return VerificationSubjectPort_1.VerificationSubjectPort; } });
+//# sourceMappingURL=index.js.map

package/src/decorators/RolesDecorator.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Represents the key for the `UseRoles` decorator.
+ *
+ * @public
+ */
+export declare const ROLES_KEY = "use_roles";
+/**
+ * Represents the `UseRoles` decorator.
+ *
+ * @public
+ */
+export declare function UseRoles(...roles: Array<string>): Function;

package/src/decorators/RolesDecorator.js

@@ -0,0 +1,23 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROLES_KEY = void 0;
+exports.UseRoles = UseRoles;
+const common_1 = require("@nestjs/common");
+// #endregion
+/**
+ * Represents the key for the `UseRoles` decorator.
+ *
+ * @public
+ */
+exports.ROLES_KEY = 'use_roles';
+/**
+ * Represents the `UseRoles` decorator.
+ *
+ * @public
+ */
+// eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
+function UseRoles(...roles) {
+    return (0, common_1.SetMetadata)(exports.ROLES_KEY, roles);
+}
+//# sourceMappingURL=RolesDecorator.js.map

package/src/decorators/TokenDecorator.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Represents the `Token` decorator.
+ *
+ * @public
+ */
+export declare function Token(): Function;

package/src/decorators/TokenDecorator.js

@@ -0,0 +1,20 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Token = Token;
+const common_1 = require("@nestjs/common");
+// #endregion
+/**
+ * Represents the `Token` decorator.
+ *
+ * @public
+ */
+// eslint-disable-next-line @typescript-eslint/no-unsafe-function-type
+function Token() {
+    return (0, common_1.createParamDecorator)((_, context) => {
+        const request = context.switchToHttp().getRequest();
+        const auth = request.headers.authorization?.split(' ')[1];
+        return auth;
+    })();
+}
+//# sourceMappingURL=TokenDecorator.js.map

package/src/decorators/UserDecorator.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Represents the `User` decorator.
+ *
+ * @public
+ */
+export declare const User: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/src/decorators/UserDecorator.js

@@ -0,0 +1,16 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.User = void 0;
+const common_1 = require("@nestjs/common");
+// #endregion
+/**
+ * Represents the `User` decorator.
+ *
+ * @public
+ */
+exports.User = (0, common_1.createParamDecorator)((_data, context) => {
+    const request = context.switchToHttp().getRequest();
+    return request.user;
+});
+//# sourceMappingURL=UserDecorator.js.map

package/src/decorators/index.d.ts

@@ -0,0 +1,3 @@
+export * from './RolesDecorator';
+export * from './TokenDecorator';
+export * from './UserDecorator';

package/src/decorators/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./RolesDecorator"), exports);
+tslib_1.__exportStar(require("./TokenDecorator"), exports);
+tslib_1.__exportStar(require("./UserDecorator"), exports);
+//# sourceMappingURL=index.js.map

package/src/env.d.ts

@@ -0,0 +1,57 @@
+import { IConfigRegistryEntry } from '@breadstone/archipel-platform-core';
+/** Secret used to sign JWTs. */
+export declare const AUTH_JWT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Lifetime of access tokens (e.g. `'15m'`, `'1h'`). */
+export declare const AUTH_JWT_EXPIRES_IN: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Lifetime of email-verification JWTs. */
+export declare const AUTH_VERIFY_JWT_EXPIRES_IN: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** AES encryption key used to encrypt MFA secrets at rest. */
+export declare const AUTH_MFA_ENCRYPTION_KEY: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** How long an MFA challenge stays valid (e.g. `'5m'`). */
+export declare const AUTH_MFA_CHALLENGE_EXPIRES_IN: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Maximum number of failed MFA attempts before lockout. */
+export declare const AUTH_MFA_MAX_ATTEMPTS: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Time-to-live for SMS OTP codes (e.g. `'10m'`). */
+export declare const AUTH_MFA_SMS_CODE_TTL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Minimum interval between SMS resend requests (e.g. `'30s'`). */
+export declare const AUTH_MFA_SMS_MIN_RESEND: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Time-to-live for email OTP codes (e.g. `'10m'`). */
+export declare const AUTH_MFA_EMAIL_CODE_TTL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Minimum interval between email OTP resend requests (e.g. `'30s'`). */
+export declare const AUTH_MFA_EMAIL_MIN_RESEND: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Time-to-live for push OTP codes (e.g. `'10m'`). */
+export declare const AUTH_MFA_PUSH_CODE_TTL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Minimum interval between push OTP resend requests (e.g. `'30s'`). */
+export declare const AUTH_MFA_PUSH_MIN_RESEND: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Google OAuth2 client ID. */
+export declare const AUTH_GOOGLE_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Google OAuth2 client secret. */
+export declare const AUTH_GOOGLE_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Google OAuth2 callback URL. */
+export declare const AUTH_GOOGLE_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Microsoft OAuth2 client ID. */
+export declare const AUTH_MICROSOFT_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Microsoft OAuth2 client secret. */
+export declare const AUTH_MICROSOFT_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Microsoft OAuth2 callback URL. */
+export declare const AUTH_MICROSOFT_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Microsoft tenant ID or `'common'` for multi-tenant. */
+export declare const AUTH_MICROSOFT_TENANT: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Apple Sign-In private key (PEM string). */
+export declare const AUTH_APPLE_PRIVATE_KEY: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Apple Sign-In client (service) ID. */
+export declare const AUTH_APPLE_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Apple developer team ID. */
+export declare const AUTH_APPLE_TEAM_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Apple Sign-In key ID. */
+export declare const AUTH_APPLE_KEY_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Apple Sign-In callback URL. */
+export declare const AUTH_APPLE_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** GitHub OAuth client ID. */
+export declare const AUTH_GITHUB_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** GitHub OAuth client secret. */
+export declare const AUTH_GITHUB_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Username used for the anonymous seed user. */
+export declare const SEED_ANONYMOUS_USERNAME: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** All configuration entries required by `platform-authentication`. */
+export declare const PLATFORM_AUTHENTICATION_CONFIG_ENTRIES: ReadonlyArray<Omit<IConfigRegistryEntry, 'module'>>;

package/src/env.js

@@ -0,0 +1,179 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+// #endregion
+// ──────────────────────────────────────────────────────────────
+// JWT & Session
+// ──────────────────────────────────────────────────────────────
+/** Secret used to sign JWTs. */
+exports.AUTH_JWT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_JWT_SECRET');
+/** Lifetime of access tokens (e.g. `'15m'`, `'1h'`). */
+exports.AUTH_JWT_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_JWT_EXPIRES_IN');
+/** Lifetime of email-verification JWTs. */
+exports.AUTH_VERIFY_JWT_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_VERIFY_JWT_EXPIRES_IN');
+// ──────────────────────────────────────────────────────────────
+// MFA — General
+// ──────────────────────────────────────────────────────────────
+/** AES encryption key used to encrypt MFA secrets at rest. */
+exports.AUTH_MFA_ENCRYPTION_KEY = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_ENCRYPTION_KEY');
+/** How long an MFA challenge stays valid (e.g. `'5m'`). */
+exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_CHALLENGE_EXPIRES_IN');
+/** Maximum number of failed MFA attempts before lockout. */
+exports.AUTH_MFA_MAX_ATTEMPTS = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_MAX_ATTEMPTS');
+// ──────────────────────────────────────────────────────────────
+// MFA — SMS Channel
+// ──────────────────────────────────────────────────────────────
+/** Time-to-live for SMS OTP codes (e.g. `'10m'`). */
+exports.AUTH_MFA_SMS_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_SMS_CODE_TTL');
+/** Minimum interval between SMS resend requests (e.g. `'30s'`). */
+exports.AUTH_MFA_SMS_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_SMS_MIN_RESEND');
+// ──────────────────────────────────────────────────────────────
+// MFA — Email Channel
+// ──────────────────────────────────────────────────────────────
+/** Time-to-live for email OTP codes (e.g. `'10m'`). */
+exports.AUTH_MFA_EMAIL_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_EMAIL_CODE_TTL');
+/** Minimum interval between email OTP resend requests (e.g. `'30s'`). */
+exports.AUTH_MFA_EMAIL_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_EMAIL_MIN_RESEND');
+// ──────────────────────────────────────────────────────────────
+// MFA — Push Channel
+// ──────────────────────────────────────────────────────────────
+/** Time-to-live for push OTP codes (e.g. `'10m'`). */
+exports.AUTH_MFA_PUSH_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_PUSH_CODE_TTL');
+/** Minimum interval between push OTP resend requests (e.g. `'30s'`). */
+exports.AUTH_MFA_PUSH_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_PUSH_MIN_RESEND');
+// ──────────────────────────────────────────────────────────────
+// OAuth — Google
+// ──────────────────────────────────────────────────────────────
+/** Google OAuth2 client ID. */
+exports.AUTH_GOOGLE_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CLIENT_ID');
+/** Google OAuth2 client secret. */
+exports.AUTH_GOOGLE_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CLIENT_SECRET');
+/** Google OAuth2 callback URL. */
+exports.AUTH_GOOGLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CALLBACK_URL');
+// ──────────────────────────────────────────────────────────────
+// OAuth — Microsoft
+// ──────────────────────────────────────────────────────────────
+/** Microsoft OAuth2 client ID. */
+exports.AUTH_MICROSOFT_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_CLIENT_ID');
+/** Microsoft OAuth2 client secret. */
+exports.AUTH_MICROSOFT_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_CLIENT_SECRET');
+/** Microsoft OAuth2 callback URL. */
+exports.AUTH_MICROSOFT_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_CALLBACK_URL');
+/** Microsoft tenant ID or `'common'` for multi-tenant. */
+exports.AUTH_MICROSOFT_TENANT = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_TENANT');
+// ──────────────────────────────────────────────────────────────
+// OAuth — Apple
+// ──────────────────────────────────────────────────────────────
+/** Apple Sign-In private key (PEM string). */
+exports.AUTH_APPLE_PRIVATE_KEY = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_PRIVATE_KEY');
+/** Apple Sign-In client (service) ID. */
+exports.AUTH_APPLE_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_CLIENT_ID');
+/** Apple developer team ID. */
+exports.AUTH_APPLE_TEAM_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_TEAM_ID');
+/** Apple Sign-In key ID. */
+exports.AUTH_APPLE_KEY_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_KEY_ID');
+/** Apple Sign-In callback URL. */
+exports.AUTH_APPLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_CALLBACK_URL');
+// ──────────────────────────────────────────────────────────────
+// OAuth — GitHub
+// ──────────────────────────────────────────────────────────────
+/** GitHub OAuth client ID. */
+exports.AUTH_GITHUB_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CLIENT_ID');
+/** GitHub OAuth client secret. */
+exports.AUTH_GITHUB_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CLIENT_SECRET');
+// ──────────────────────────────────────────────────────────────
+// Seed / Misc
+// ──────────────────────────────────────────────────────────────
+/** Username used for the anonymous seed user. */
+exports.SEED_ANONYMOUS_USERNAME = (0, archipel_platform_core_1.createConfigKey)('SEED_ANONYMOUS_USERNAME');
+// ──────────────────────────────────────────────────────────────
+// Registry entries
+// ──────────────────────────────────────────────────────────────
+/** All configuration entries required by `platform-authentication`. */
+exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
+    // JWT & Session
+    { key: exports.AUTH_JWT_SECRET, required: true, description: 'Secret used to sign JWTs.' },
+    { key: exports.AUTH_JWT_EXPIRES_IN, required: true, description: 'Lifetime of access tokens.' },
+    { key: exports.AUTH_VERIFY_JWT_EXPIRES_IN, required: true, description: 'Lifetime of email-verification JWTs.' },
+    // MFA — General
+    {
+        key: exports.AUTH_MFA_ENCRYPTION_KEY,
+        required: false,
+        defaultValue: '',
+        description: 'AES encryption key for MFA secrets.',
+    },
+    {
+        key: exports.AUTH_MFA_CHALLENGE_EXPIRES_IN,
+        required: false,
+        defaultValue: '5m',
+        description: 'MFA challenge validity period.',
+    },
+    {
+        key: exports.AUTH_MFA_MAX_ATTEMPTS,
+        required: false,
+        defaultValue: '5',
+        description: 'Max failed MFA attempts before lockout.',
+    },
+    // MFA — SMS
+    { key: exports.AUTH_MFA_SMS_CODE_TTL, required: false, defaultValue: '10m', description: 'TTL for SMS OTP codes.' },
+    {
+        key: exports.AUTH_MFA_SMS_MIN_RESEND,
+        required: false,
+        defaultValue: '30s',
+        description: 'Min interval between SMS resends.',
+    },
+    // MFA — Email
+    { key: exports.AUTH_MFA_EMAIL_CODE_TTL, required: false, defaultValue: '10m', description: 'TTL for email OTP codes.' },
+    {
+        key: exports.AUTH_MFA_EMAIL_MIN_RESEND,
+        required: false,
+        defaultValue: '30s',
+        description: 'Min interval between email resends.',
+    },
+    // MFA — Push
+    { key: exports.AUTH_MFA_PUSH_CODE_TTL, required: false, defaultValue: '10m', description: 'TTL for push OTP codes.' },
+    {
+        key: exports.AUTH_MFA_PUSH_MIN_RESEND,
+        required: false,
+        defaultValue: '30s',
+        description: 'Min interval between push resends.',
+    },
+    // OAuth — Google
+    { key: exports.AUTH_GOOGLE_CLIENT_ID, required: true, description: 'Google OAuth2 client ID.' },
+    { key: exports.AUTH_GOOGLE_CLIENT_SECRET, required: true, description: 'Google OAuth2 client secret.' },
+    {
+        key: exports.AUTH_GOOGLE_CALLBACK_URL,
+        required: false,
+        defaultValue: '/auth/google/callback',
+        description: 'Google OAuth2 callback URL.',
+    },
+    // OAuth — Microsoft
+    { key: exports.AUTH_MICROSOFT_CLIENT_ID, required: true, description: 'Microsoft OAuth2 client ID.' },
+    { key: exports.AUTH_MICROSOFT_CLIENT_SECRET, required: true, description: 'Microsoft OAuth2 client secret.' },
+    {
+        key: exports.AUTH_MICROSOFT_CALLBACK_URL,
+        required: false,
+        defaultValue: '/auth/microsoft/callback',
+        description: 'Microsoft OAuth2 callback URL.',
+    },
+    { key: exports.AUTH_MICROSOFT_TENANT, required: false, defaultValue: 'common', description: 'Microsoft tenant ID.' },
+    // OAuth — Apple
+    { key: exports.AUTH_APPLE_PRIVATE_KEY, required: true, description: 'Apple Sign-In private key (PEM).' },
+    { key: exports.AUTH_APPLE_CLIENT_ID, required: true, description: 'Apple Sign-In client ID.' },
+    { key: exports.AUTH_APPLE_TEAM_ID, required: true, description: 'Apple developer team ID.' },
+    { key: exports.AUTH_APPLE_KEY_ID, required: true, description: 'Apple Sign-In key ID.' },
+    {
+        key: exports.AUTH_APPLE_CALLBACK_URL,
+        required: false,
+        defaultValue: '/auth/apple/callback',
+        description: 'Apple Sign-In callback URL.',
+    },
+    // OAuth — GitHub
+    { key: exports.AUTH_GITHUB_CLIENT_ID, required: true, description: 'GitHub OAuth client ID.' },
+    { key: exports.AUTH_GITHUB_CLIENT_SECRET, required: true, description: 'GitHub OAuth client secret.' },
+    // Seed / Misc
+    { key: exports.SEED_ANONYMOUS_USERNAME, required: true, description: 'Username for the anonymous seed user.' },
+];
+//# sourceMappingURL=env.js.map

package/src/guards/AnonymousAuthGuard.d.ts

@@ -0,0 +1,9 @@
+declare const AnonymousAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+/**
+ * The `AnonymousAuthGuard` protects routes using anonymous authentication.
+ *
+ * @public
+ */
+export declare class AnonymousAuthGuard extends AnonymousAuthGuard_base {
+}
+export {};

package/src/guards/AnonymousAuthGuard.js

@@ -0,0 +1,20 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AnonymousAuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+// #endregion
+/**
+ * The `AnonymousAuthGuard` protects routes using anonymous authentication.
+ *
+ * @public
+ */
+let AnonymousAuthGuard = class AnonymousAuthGuard extends (0, passport_1.AuthGuard)('anonymous') {
+};
+exports.AnonymousAuthGuard = AnonymousAuthGuard;
+exports.AnonymousAuthGuard = AnonymousAuthGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], AnonymousAuthGuard);
+//# sourceMappingURL=AnonymousAuthGuard.js.map

package/src/guards/GithubAuthGuard.d.ts

@@ -0,0 +1,9 @@
+declare const GithubAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+/**
+ * The `GithubAuthGuard` protects routes using GitHub authentication.
+ *
+ * @public
+ */
+export declare class GithubAuthGuard extends GithubAuthGuard_base {
+}
+export {};

package/src/guards/GithubAuthGuard.js

@@ -0,0 +1,20 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GithubAuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+// #endregion
+/**
+ * The `GithubAuthGuard` protects routes using GitHub authentication.
+ *
+ * @public
+ */
+let GithubAuthGuard = class GithubAuthGuard extends (0, passport_1.AuthGuard)('github') {
+};
+exports.GithubAuthGuard = GithubAuthGuard;
+exports.GithubAuthGuard = GithubAuthGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], GithubAuthGuard);
+//# sourceMappingURL=GithubAuthGuard.js.map