@breadstone/archipel-platform-authentication 0.0.1

package/src/guards/JwtAuthGuard.d.ts

@@ -0,0 +1,9 @@
+declare const JwtAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+/**
+ * The `JwtAuthGuard` protects routes using JWT-based authentication.
+ *
+ * @public
+ */
+export declare class JwtAuthGuard extends JwtAuthGuard_base {
+}
+export {};

package/src/guards/JwtAuthGuard.js

@@ -0,0 +1,20 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+// #endregion
+/**
+ * The `JwtAuthGuard` protects routes using JWT-based authentication.
+ *
+ * @public
+ */
+let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)('jwt') {
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], JwtAuthGuard);
+//# sourceMappingURL=JwtAuthGuard.js.map

package/src/guards/LocalAuthGuard.d.ts

@@ -0,0 +1,9 @@
+declare const LocalAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs/passport").IAuthGuard>;
+/**
+ * The `LocalAuthGuard` protects routes using local authentication.
+ *
+ * @public
+ */
+export declare class LocalAuthGuard extends LocalAuthGuard_base {
+}
+export {};

package/src/guards/LocalAuthGuard.js

@@ -0,0 +1,20 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalAuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+// #endregion
+/**
+ * The `LocalAuthGuard` protects routes using local authentication.
+ *
+ * @public
+ */
+let LocalAuthGuard = class LocalAuthGuard extends (0, passport_1.AuthGuard)('local') {
+};
+exports.LocalAuthGuard = LocalAuthGuard;
+exports.LocalAuthGuard = LocalAuthGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], LocalAuthGuard);
+//# sourceMappingURL=LocalAuthGuard.js.map

package/src/guards/RolesGuard.d.ts

@@ -0,0 +1,16 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Observable } from 'rxjs';
+export declare class RolesGuard implements CanActivate {
+    private readonly _reflector;
+    /**
+     * Constructs a new instance of the `RolesGuard` class.
+     *
+     * @public
+     */
+    constructor(reflector: Reflector);
+    /**
+     * @public
+     */
+    canActivate(context: ExecutionContext): boolean | Promise<boolean> | Observable<boolean>;
+}

package/src/guards/RolesGuard.js

@@ -0,0 +1,43 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolesGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const RolesDecorator_1 = require("../decorators/RolesDecorator");
+// #endregion
+let RolesGuard = class RolesGuard {
+    // #endregion
+    // #region Ctor
+    /**
+     * Constructs a new instance of the `RolesGuard` class.
+     *
+     * @public
+     */
+    constructor(reflector) {
+        this._reflector = reflector;
+    }
+    // #endregion
+    // #region Methods
+    /**
+     * @public
+     */
+    canActivate(context) {
+        const roles = this._reflector.getAllAndOverride(RolesDecorator_1.ROLES_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (roles.length === 0) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        return roles.some((role) => request.user.roles.includes(role));
+    }
+};
+exports.RolesGuard = RolesGuard;
+exports.RolesGuard = RolesGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [core_1.Reflector])
+], RolesGuard);
+//# sourceMappingURL=RolesGuard.js.map

package/src/guards/SocialAuthGuard.d.ts

@@ -0,0 +1,9 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Observable } from 'rxjs';
+export declare class SocialAuthGuard implements CanActivate {
+    private static readonly _availableProviders;
+    private readonly _provider;
+    constructor(_provider: string);
+    canActivate(context: ExecutionContext): boolean | Promise<boolean> | Observable<boolean>;
+}
+export declare const socialAuthGuardFactory: (provider: string) => SocialAuthGuard;

package/src/guards/SocialAuthGuard.js

@@ -0,0 +1,35 @@
+"use strict";
+// #region Imports
+var SocialAuthGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.socialAuthGuardFactory = exports.SocialAuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+// #endregion
+let SocialAuthGuard = SocialAuthGuard_1 = class SocialAuthGuard {
+    // #endregion
+    // #region Ctor
+    constructor(_provider) {
+        this._provider = _provider;
+    }
+    // #endregion
+    // #region Methods
+    canActivate(context) {
+        if (!SocialAuthGuard_1._availableProviders.includes(this._provider)) {
+            throw new Error(`Unsupported OAuth provider: ${this._provider}`);
+        }
+        const guard = new ((0, passport_1.AuthGuard)(this._provider))();
+        return guard.canActivate(context);
+    }
+};
+exports.SocialAuthGuard = SocialAuthGuard;
+// #region Fields
+SocialAuthGuard._availableProviders = ['github', 'google', 'microsoft', 'apple'];
+exports.SocialAuthGuard = SocialAuthGuard = SocialAuthGuard_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [String])
+], SocialAuthGuard);
+const socialAuthGuardFactory = (provider) => new SocialAuthGuard(provider);
+exports.socialAuthGuardFactory = socialAuthGuardFactory;
+//# sourceMappingURL=SocialAuthGuard.js.map

package/src/guards/_RefreshTokenAuthGuard.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=_RefreshTokenAuthGuard.js.map

package/src/guards/_TwoFactorAuthGuard.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=_TwoFactorAuthGuard.js.map

package/src/guards/index.d.ts

@@ -0,0 +1,6 @@
+export * from './AnonymousAuthGuard';
+export * from './GithubAuthGuard';
+export * from './JwtAuthGuard';
+export * from './LocalAuthGuard';
+export * from './RolesGuard';
+export * from './SocialAuthGuard';

package/src/guards/index.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./AnonymousAuthGuard"), exports);
+tslib_1.__exportStar(require("./GithubAuthGuard"), exports);
+tslib_1.__exportStar(require("./JwtAuthGuard"), exports);
+tslib_1.__exportStar(require("./LocalAuthGuard"), exports);
+tslib_1.__exportStar(require("./RolesGuard"), exports);
+tslib_1.__exportStar(require("./SocialAuthGuard"), exports);
+// export * from './_RefreshTokenAuthGuard';
+// export * from './_TwoFactorAuthGuard';
+//# sourceMappingURL=index.js.map

package/src/index.d.ts

@@ -0,0 +1,9 @@
+export * from './AuthModule';
+export * from './contracts';
+export * from './decorators';
+export * from './env';
+export * from './guards';
+export * from './mappers/SessionMappingProfile';
+export * from './middlewares';
+export * from './models';
+export * from './services';

package/src/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./AuthModule"), exports);
+tslib_1.__exportStar(require("./contracts"), exports);
+tslib_1.__exportStar(require("./decorators"), exports);
+tslib_1.__exportStar(require("./env"), exports);
+tslib_1.__exportStar(require("./guards"), exports);
+tslib_1.__exportStar(require("./mappers/SessionMappingProfile"), exports);
+tslib_1.__exportStar(require("./middlewares"), exports);
+tslib_1.__exportStar(require("./models"), exports);
+tslib_1.__exportStar(require("./services"), exports);
+//# sourceMappingURL=index.js.map

package/src/mappers/SessionMappingProfile.d.ts

@@ -0,0 +1,42 @@
+import { IMappingBuilder, MappingProfileBase } from '@breadstone/archipel-platform-core';
+import type { ISessionRecord } from '../contracts/ISessionRecord';
+import { SessionResponse } from '../models/responses/SessionResponse';
+interface ISessionMappingInput {
+    session: ISessionRecord;
+    isCurrent: boolean;
+}
+/**
+ * Type-safe mapping key for Session entity to response transformation.
+ *
+ * @public
+ */
+export declare const SESSION_MAPPING_KEY: import("@breadstone/archipel-platform-core").IMappingKey<ISessionMappingInput, SessionResponse>;
+/**
+ * Type-safe mapping key for Session entity list to response list transformation.
+ *
+ * @public
+ */
+export declare const SESSION_LIST_MAPPING_KEY: import("@breadstone/archipel-platform-core").IMappingKey<ISessionMappingInput[], SessionResponse[]>;
+/**
+ * Mapping profile for Session entity to response transformations.
+ *
+ * @public
+ */
+export declare class SessionMappingProfile extends MappingProfileBase {
+    /**
+     * Configure mappings for Session entity.
+     *
+     * @public
+     * @param builder - The mapping builder
+     */
+    configure(builder: IMappingBuilder): void;
+    /**
+     * Map a single Session entity to response.
+     *
+     * @private
+     * @param entity - The entity to map
+     * @returns The mapped response
+     */
+    private mapEntityToResponse;
+}
+export {};

package/src/mappers/SessionMappingProfile.js

@@ -0,0 +1,68 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionMappingProfile = exports.SESSION_LIST_MAPPING_KEY = exports.SESSION_MAPPING_KEY = void 0;
+const tslib_1 = require("tslib");
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const common_1 = require("@nestjs/common");
+const SessionResponse_1 = require("../models/responses/SessionResponse");
+/**
+ * Type-safe mapping key for Session entity to response transformation.
+ *
+ * @public
+ */
+exports.SESSION_MAPPING_KEY = (0, archipel_platform_core_1.createMappingKey)('session.entity-to-response');
+/**
+ * Type-safe mapping key for Session entity list to response list transformation.
+ *
+ * @public
+ */
+exports.SESSION_LIST_MAPPING_KEY = (0, archipel_platform_core_1.createMappingKey)('session.entity-list-to-response');
+/**
+ * Mapping profile for Session entity to response transformations.
+ *
+ * @public
+ */
+let SessionMappingProfile = class SessionMappingProfile extends archipel_platform_core_1.MappingProfileBase {
+    // #region Methods
+    /**
+     * Configure mappings for Session entity.
+     *
+     * @public
+     * @param builder - The mapping builder
+     */
+    configure(builder) {
+        builder
+            .createKeyedMap(exports.SESSION_MAPPING_KEY, (entity) => this.mapEntityToResponse(entity))
+            .createKeyedMap(exports.SESSION_LIST_MAPPING_KEY, (entities) => entities.map((e) => this.mapEntityToResponse(e)));
+    }
+    /**
+     * Map a single Session entity to response.
+     *
+     * @private
+     * @param entity - The entity to map
+     * @returns The mapped response
+     */
+    mapEntityToResponse(input) {
+        const response = new SessionResponse_1.SessionResponse();
+        response.id = input.session.id;
+        response.deviceType = input.session.deviceType ?? null;
+        response.deviceName = input.session.deviceName ?? null;
+        response.browserName = input.session.browserName ?? null;
+        response.browserVersion = input.session.browserVersion ?? null;
+        response.osName = input.session.osName ?? null;
+        response.osVersion = input.session.osVersion ?? null;
+        response.location = input.session.location ?? null;
+        response.ipAddress = input.session.ipAddress;
+        response.lastActive = input.session.lastActive;
+        response.createdAt = input.session.createdAt;
+        response.isCurrent = input.isCurrent;
+        response.clientName = input.session.clientName ?? null;
+        return response;
+    }
+};
+exports.SessionMappingProfile = SessionMappingProfile;
+exports.SessionMappingProfile = SessionMappingProfile = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], SessionMappingProfile);
+//# sourceMappingURL=SessionMappingProfile.js.map

package/src/middlewares/LastActiveMiddleware.d.ts

@@ -0,0 +1,29 @@
+import { NestMiddleware } from '@nestjs/common';
+import { Request, Response, NextFunction } from 'express';
+import { SessionService } from '../services/SessionService';
+/**
+ * Middleware to automatically update the lastActive timestamp for authenticated sessions.
+ * Extracts the JWT token from the Authorization header and updates the session asynchronously.
+ *
+ * @public
+ */
+export declare class LastActiveMiddleware implements NestMiddleware {
+    private readonly _sessionService;
+    /**
+     * Constructs a new instance of the `LastActiveMiddleware` class.
+     *
+     * @public
+     * @param sessionService - Session service instance
+     */
+    constructor(sessionService: SessionService);
+    /**
+     * Middleware execution method.
+     * Extracts token from Authorization header and updates lastActive timestamp asynchronously.
+     *
+     * @public
+     * @param req - Express request object
+     * @param _res - Express response object (unused)
+     * @param next - Next middleware function
+     */
+    use(req: Request, _res: Response, next: NextFunction): void;
+}

package/src/middlewares/LastActiveMiddleware.js

@@ -0,0 +1,55 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LastActiveMiddleware = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const SessionService_1 = require("../services/SessionService");
+// #endregion
+/**
+ * Middleware to automatically update the lastActive timestamp for authenticated sessions.
+ * Extracts the JWT token from the Authorization header and updates the session asynchronously.
+ *
+ * @public
+ */
+let LastActiveMiddleware = class LastActiveMiddleware {
+    // #endregion
+    // #region Ctor
+    /**
+     * Constructs a new instance of the `LastActiveMiddleware` class.
+     *
+     * @public
+     * @param sessionService - Session service instance
+     */
+    constructor(sessionService) {
+        this._sessionService = sessionService;
+    }
+    // #endregion
+    // #region Methods
+    /**
+     * Middleware execution method.
+     * Extracts token from Authorization header and updates lastActive timestamp asynchronously.
+     *
+     * @public
+     * @param req - Express request object
+     * @param _res - Express response object (unused)
+     * @param next - Next middleware function
+     */
+    use(req, _res, next) {
+        const authHeader = req.headers.authorization;
+        if (authHeader?.startsWith('Bearer ')) {
+            const token = authHeader.substring(7);
+            // Update lastActive asynchronously without blocking the request
+            this._sessionService.updateLastActive(token).catch(() => {
+                // Silently fail - we don't want to break the request if session update fails
+            });
+        }
+        next();
+    }
+};
+exports.LastActiveMiddleware = LastActiveMiddleware;
+exports.LastActiveMiddleware = LastActiveMiddleware = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [SessionService_1.SessionService])
+], LastActiveMiddleware);
+//# sourceMappingURL=LastActiveMiddleware.js.map

package/src/middlewares/index.d.ts

@@ -0,0 +1 @@
+export * from './LastActiveMiddleware';

package/src/middlewares/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./LastActiveMiddleware"), exports);
+//# sourceMappingURL=index.js.map

package/src/models/IMfaChallengePayload.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Represents the MFA challenge payload encoded in a challenge token.
+ *
+ * @public
+ */
+export interface IMfaChallengePayload {
+    /**
+     * Defines the token discriminator used to validate challenge tokens.
+     */
+    readonly type: 'mfa';
+    /**
+     * Identifies the authenticated user.
+     */
+    readonly userId: string;
+    /**
+     * Captures the originating IP address for the challenge.
+     */
+    readonly ipAddress: string;
+    /**
+     * Captures the originating user agent for the challenge.
+     */
+    readonly userAgent?: string;
+    /**
+     * Optional location associated with the login attempt.
+     */
+    readonly location?: string;
+    /**
+     * Optional client name associated with the login attempt.
+     */
+    readonly clientName?: string;
+}

package/src/models/IMfaChallengePayload.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=IMfaChallengePayload.js.map

package/src/models/IMfaConfirmation.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Represents the activation result for multi-factor authentication.
+ *
+ * @public
+ */
+export interface IMfaConfirmation {
+    /**
+     * Contains one-time recovery codes presented to the user.
+     */
+    readonly backupCodes: ReadonlyArray<string>;
+}

package/src/models/IMfaConfirmation.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=IMfaConfirmation.js.map

package/src/models/IMfaSetup.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Represents the data required to onboard a multi-factor authenticator.
+ *
+ * @public
+ */
+export interface IMfaSetup {
+    /**
+     * Contains the shared secret in Base32 format.
+     */
+    readonly secret?: string;
+    /**
+     * Identifies the MFA method being provisioned.
+     */
+    readonly method: string;
+    /**
+     * Contains the provisioning URI compatible with authenticator applications.
+     */
+    readonly otpauthUrl?: string;
+    /**
+     * Provides a pre-rendered QR code in data URL form.
+     */
+    readonly quickResponseCodeDataUrl?: string;
+}

package/src/models/IMfaSetup.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=IMfaSetup.js.map

package/src/models/ISignInResult.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Represents the outcome of a sign-in attempt.
+ *
+ * @public
+ */
+export interface ISignInResult {
+    /**
+     * Indicates whether a multi-factor token is required.
+     */
+    readonly mfaRequired: boolean;
+    /**
+     * Indicates whether email verification is required.
+     */
+    readonly verificationRequired?: boolean;
+    /**
+     * Contains the issued access token when MFA is not required.
+     */
+    readonly accessToken?: string;
+    /**
+     * Contains the challenge identifier required to complete MFA.
+     */
+    readonly challengeId?: string;
+    /**
+     * Lists enabled MFA methods available for the challenge.
+     */
+    readonly methods?: ReadonlyArray<string>;
+    /**
+     * Indicates the preferred MFA method.
+     */
+    readonly preferredMethod?: string;
+}

package/src/models/ISignInResult.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=ISignInResult.js.map

package/src/models/JwtPayloadBase.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Abstract base class for JWT payloads.
+ * Products extend this to add their own claims (e.g. `profileId`, `isPro`).
+ * Used as both a serialization contract and NestJS injection token.
+ *
+ * @public
+ */
+export declare abstract class JwtPayloadBase {
+    /**
+     * Subject identifier.
+     */
+    readonly id: string;
+    /**
+     * Email address.
+     */
+    readonly email: string | null;
+    /**
+     * Assigned roles.
+     */
+    readonly roles: ReadonlyArray<string>;
+    /**
+     * Issued-at timestamp (set by JWT library).
+     */
+    readonly iat?: number;
+    /**
+     * Expiration timestamp (set by JWT library).
+     */
+    readonly exp?: number;
+    protected constructor(id: string, email: string | null, roles: ReadonlyArray<string>);
+    /**
+     * Serializes this payload to a plain object suitable for `JwtService.signAsync()`.
+     *
+     * @public
+     */
+    toJSON(): Record<string, unknown>;
+    /**
+     * Creates an instance from a decoded JWT payload object.
+     * Subclasses **must** override this static-like factory on a per-product basis.
+     *
+     * @public
+     * @param raw - The raw decoded JWT payload.
+     */
+    static fromJSON(raw: Record<string, unknown>): JwtPayloadBase;
+}

package/src/models/JwtPayloadBase.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtPayloadBase = void 0;
+/**
+ * Abstract base class for JWT payloads.
+ * Products extend this to add their own claims (e.g. `profileId`, `isPro`).
+ * Used as both a serialization contract and NestJS injection token.
+ *
+ * @public
+ */
+class JwtPayloadBase {
+    // #endregion
+    // #region Ctor
+    constructor(id, email, roles) {
+        this.id = id;
+        this.email = email;
+        this.roles = roles;
+    }
+    // #endregion
+    // #region Methods
+    /**
+     * Serializes this payload to a plain object suitable for `JwtService.signAsync()`.
+     *
+     * @public
+     */
+    toJSON() {
+        return {
+            id: this.id,
+            email: this.email,
+            roles: [...this.roles],
+        };
+    }
+    /**
+     * Creates an instance from a decoded JWT payload object.
+     * Subclasses **must** override this static-like factory on a per-product basis.
+     *
+     * @public
+     * @param raw - The raw decoded JWT payload.
+     */
+    static fromJSON(raw) {
+        return new DefaultJwtPayload(raw['id'], raw['email'] ?? null, raw['roles'] ?? []);
+    }
+}
+exports.JwtPayloadBase = JwtPayloadBase;
+/**
+ * Default (minimal) JWT payload used when no product-specific subclass is registered.
+ *
+ * @internal
+ */
+class DefaultJwtPayload extends JwtPayloadBase {
+    constructor(id, email, roles) {
+        super(id, email, roles);
+    }
+}
+//# sourceMappingURL=JwtPayloadBase.js.map