@breadstone/archipel-platform-authentication 0.0.1

package/src/services/mfa/channels/SmsMfaChannel.js

@@ -0,0 +1,158 @@
+"use strict";
+// #region Imports
+var SmsMfaChannel_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SmsMfaChannel = void 0;
+const tslib_1 = require("tslib");
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const MfaSubjectPort_1 = require("../../../contracts/MfaSubjectPort");
+const MfaState_1 = require("../MfaState");
+// #endregion
+let SmsMfaChannel = SmsMfaChannel_1 = class SmsMfaChannel {
+    // #endregion
+    // #region Ctor
+    constructor(mfaSubject, configService, bcryptService) {
+        // #region Fields
+        this.method = 'sms';
+        this._logger = new common_1.Logger(SmsMfaChannel_1.name);
+        this._mfaSubject = mfaSubject;
+        this._configService = configService;
+        this._bcryptService = bcryptService;
+        this._ttlMilliseconds = archipel_platform_core_1.DateTimeUtils.parse(this._configService.tryGet('AUTH_MFA_SMS_CODE_TTL', '10m'));
+        this._minResendMilliseconds = archipel_platform_core_1.DateTimeUtils.parse(this._configService.tryGet('AUTH_MFA_SMS_MIN_RESEND', '30s'));
+    }
+    // #endregion
+    // #region Methods
+    async initSetup(userId, context) {
+        const user = await this._mfaSubject.findById(userId);
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        const phone = context?.phoneNumber ?? user.phoneNumber;
+        if (!phone) {
+            throw new common_1.BadRequestException('Phone number is required for SMS MFA');
+        }
+        const state = (0, MfaState_1.resolveMfaState)(user.mfaChannels);
+        const channel = state.channels[this.method] ?? { enabled: false };
+        const now = Date.now();
+        if (channel.lastSentAt && now - Date.parse(channel.lastSentAt) < this._minResendMilliseconds) {
+            throw new common_1.BadRequestException('OTP recently sent. Please wait before requesting another code.');
+        }
+        const code = this.generateCode();
+        const hashed = await this._bcryptService.hash(code);
+        state.channels[this.method] = {
+            enabled: false,
+            phoneNumber: phone,
+            codeHash: hashed,
+            codeExpiresAt: new Date(now + this._ttlMilliseconds).toISOString(),
+            lastSentAt: new Date(now).toISOString(),
+        };
+        state.preferredMethod = state.preferredMethod ?? this.method;
+        await this._mfaSubject.updateMfaState(userId, {
+            phoneNumber: phone,
+            mfaChannels: state,
+            mfaPreferredMethod: state.preferredMethod,
+            mfaUpdatedAt: new Date(),
+        });
+        this._logger.log(`Sending SMS MFA code to ${phone} (mock): ${code}`);
+        return {
+            method: this.method,
+        };
+    }
+    async verifySetup(userId, code) {
+        return this.verifyCodeAndMaybeEnable(userId, code, true);
+    }
+    async verifyChallenge(userId, code) {
+        return this.verifyCodeAndMaybeEnable(userId, code, false);
+    }
+    async issueChallenge(userId) {
+        const user = await this._mfaSubject.findById(userId);
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        const state = (0, MfaState_1.resolveMfaState)(user.mfaChannels);
+        const channel = state.channels[this.method];
+        if (!channel?.enabled) {
+            throw new common_1.UnauthorizedException('SMS MFA is not enabled');
+        }
+        const phone = channel.phoneNumber ?? user.phoneNumber;
+        if (!phone) {
+            throw new common_1.BadRequestException('Phone number is required for SMS MFA');
+        }
+        const now = Date.now();
+        if (channel.lastSentAt && now - Date.parse(channel.lastSentAt) < this._minResendMilliseconds) {
+            throw new common_1.BadRequestException('OTP recently sent. Please wait before requesting another code.');
+        }
+        const code = this.generateCode();
+        const hashed = await this._bcryptService.hash(code);
+        state.channels[this.method] = {
+            ...channel,
+            phoneNumber: phone,
+            codeHash: hashed,
+            codeExpiresAt: new Date(now + this._ttlMilliseconds).toISOString(),
+            lastSentAt: new Date(now).toISOString(),
+        };
+        await this._mfaSubject.updateMfaState(userId, {
+            mfaChannels: state,
+            mfaUpdatedAt: new Date(),
+        });
+        this._logger.log(`Sending SMS MFA code to ${phone} (login): ${code}`);
+    }
+    async verifyCodeAndMaybeEnable(userId, code, enable) {
+        const user = await this._mfaSubject.findById(userId);
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        const state = (0, MfaState_1.resolveMfaState)(user.mfaChannels);
+        const channel = state.channels[this.method];
+        if (!channel?.codeHash || !channel.codeExpiresAt) {
+            throw new common_1.UnauthorizedException('SMS code not issued');
+        }
+        if (Date.parse(channel.codeExpiresAt) < Date.now()) {
+            throw new common_1.UnauthorizedException('SMS code expired');
+        }
+        const isValid = await this._bcryptService.compare(code, channel.codeHash);
+        if (!isValid) {
+            return false;
+        }
+        if (enable) {
+            state.channels[this.method] = {
+                ...channel,
+                enabled: true,
+                verifiedAt: new Date().toISOString(),
+                codeHash: undefined,
+                codeExpiresAt: undefined,
+            };
+            await this._mfaSubject.updateMfaState(userId, {
+                mfaChannels: state,
+                mfaEnabled: true,
+                mfaPreferredMethod: state.preferredMethod ?? this.method,
+                mfaVerifiedAt: new Date(),
+                mfaUpdatedAt: new Date(),
+            });
+        }
+        else {
+            state.channels[this.method] = {
+                ...channel,
+                codeHash: undefined,
+                codeExpiresAt: undefined,
+            };
+            await this._mfaSubject.updateMfaState(userId, {
+                mfaChannels: state,
+                mfaUpdatedAt: new Date(),
+            });
+        }
+        return true;
+    }
+    generateCode() {
+        return (0, node_crypto_1.randomInt)(100000, 999999).toString();
+    }
+};
+exports.SmsMfaChannel = SmsMfaChannel;
+exports.SmsMfaChannel = SmsMfaChannel = SmsMfaChannel_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort, archipel_platform_core_1.ConfigService, archipel_platform_core_1.BcryptService])
+], SmsMfaChannel);
+//# sourceMappingURL=SmsMfaChannel.js.map

package/src/services/mfa/channels/TotpMfaChannel.d.ts

@@ -0,0 +1,19 @@
+import { ConfigService, IOtpService } from '@breadstone/archipel-platform-core';
+import { MfaSubjectPort } from '../../../contracts/MfaSubjectPort';
+import { IMfaSetup } from '../../../models';
+import { IMfaChannel } from '../IMfaChannel';
+import { MfaEncryptionService } from '../MfaEncryptionService';
+import { IMfaSetupContext } from '../MfaState';
+export declare class TotpMfaChannel implements IMfaChannel {
+    readonly method = "totp";
+    private readonly _mfaSubject;
+    private readonly _configService;
+    private readonly _encryptionService;
+    private readonly _otpService;
+    private readonly _issuer;
+    constructor(mfaSubject: MfaSubjectPort, configService: ConfigService, encryptionService: MfaEncryptionService, otpService: IOtpService);
+    initSetup(userId: string, _context?: IMfaSetupContext): Promise<IMfaSetup>;
+    verifySetup(userId: string, code: string): Promise<boolean>;
+    verifyChallenge(userId: string, code: string): Promise<boolean>;
+    private loadState;
+}

package/src/services/mfa/channels/TotpMfaChannel.js

@@ -0,0 +1,100 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TotpMfaChannel = void 0;
+const tslib_1 = require("tslib");
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const common_1 = require("@nestjs/common");
+const MfaSubjectPort_1 = require("../../../contracts/MfaSubjectPort");
+const MfaEncryptionService_1 = require("../MfaEncryptionService");
+const MfaState_1 = require("../MfaState");
+// #endregion
+let TotpMfaChannel = class TotpMfaChannel {
+    // #endregion
+    // #region Ctor
+    constructor(mfaSubject, configService, encryptionService, otpService) {
+        // #region Fields
+        this.method = 'totp';
+        this._mfaSubject = mfaSubject;
+        this._configService = configService;
+        this._encryptionService = encryptionService;
+        this._otpService = otpService;
+        this._issuer = this._configService.tryGet('AUTH_MFA_ISSUER', 'Strivio');
+    }
+    // #endregion
+    // #region Methods
+    async initSetup(userId, _context) {
+        const user = await this._mfaSubject.findById(userId);
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        const accountLabel = user.email ?? user.userName ?? user.id;
+        const secret = this._otpService.generateSecret();
+        const encryptedSecret = this._encryptionService.encrypt(secret);
+        const state = (0, MfaState_1.resolveMfaState)(user.mfaChannels);
+        state.channels[this.method] = {
+            enabled: false,
+            secret: encryptedSecret,
+        };
+        state.preferredMethod = state.preferredMethod ?? this.method;
+        await this._mfaSubject.updateMfaState(userId, {
+            mfaChannels: state,
+            mfaEnabled: user.mfaEnabled ?? false,
+            mfaPreferredMethod: state.preferredMethod ?? this.method,
+            mfaUpdatedAt: new Date(),
+        });
+        const otpauthUrl = this._otpService.generateUri({ label: accountLabel, issuer: this._issuer, secret });
+        return {
+            method: this.method,
+            secret: secret,
+            otpauthUrl: otpauthUrl,
+        };
+    }
+    async verifySetup(userId, code) {
+        const state = await this.loadState(userId);
+        const channel = state.channels[this.method];
+        if (!channel?.secret) {
+            throw new common_1.BadRequestException('TOTP setup not initialized');
+        }
+        const secret = this._encryptionService.decrypt(channel.secret);
+        const isValid = this._otpService.verify(code, secret);
+        if (isValid) {
+            channel.enabled = true;
+            channel.verifiedAt = new Date().toISOString();
+            await this._mfaSubject.updateMfaState(userId, {
+                mfaChannels: state,
+                mfaEnabled: true,
+                mfaPreferredMethod: state.preferredMethod ?? this.method,
+                mfaVerifiedAt: new Date(),
+                mfaUpdatedAt: new Date(),
+            });
+        }
+        return isValid;
+    }
+    async verifyChallenge(userId, code) {
+        const state = await this.loadState(userId);
+        const channel = state.channels[this.method];
+        if (!channel?.enabled || !channel.secret) {
+            return false;
+        }
+        const secret = this._encryptionService.decrypt(channel.secret);
+        const isValid = this._otpService.verify(code, secret);
+        return isValid;
+    }
+    async loadState(userId) {
+        const user = await this._mfaSubject.findById(userId);
+        if (!user) {
+            throw new common_1.BadRequestException('User not found');
+        }
+        return (0, MfaState_1.resolveMfaState)(user.mfaChannels);
+    }
+};
+exports.TotpMfaChannel = TotpMfaChannel;
+exports.TotpMfaChannel = TotpMfaChannel = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(3, (0, common_1.Inject)(archipel_platform_core_1.OTP_SERVICE_TOKEN)),
+    tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort,
+        archipel_platform_core_1.ConfigService,
+        MfaEncryptionService_1.MfaEncryptionService, Object])
+], TotpMfaChannel);
+//# sourceMappingURL=TotpMfaChannel.js.map

package/src/strategies/AnonymousStrategy.d.ts

@@ -0,0 +1,32 @@
+import { ConfigService } from '@breadstone/archipel-platform-core';
+import { Strategy } from 'passport-custom';
+import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
+import type { IAuthSubject } from '../contracts/IAuthSubject';
+declare const AnonymousStrategy_base: new () => Strategy & {
+    validate(...args: any[]): unknown;
+};
+/**
+ * Anonymous strategy for temporary user login.
+ *
+ * @public
+ */
+export declare class AnonymousStrategy extends AnonymousStrategy_base {
+    private readonly _authSubject;
+    private readonly _configService;
+    /**
+     * Constructs a new instance of the `AnonymousStrategy` class.
+     *
+     * @public
+     * @param authSubject Auth subject port instance.
+     * @param configService Configuration service instance.
+     */
+    constructor(authSubject: AuthSubjectPort, configService: ConfigService);
+    /**
+     * Validates the authentication credentials.
+     *
+     * @public
+     * @returns The authenticated user and this is also later available in the request.user object
+     */
+    validate(): Promise<IAuthSubject>;
+}
+export {};

package/src/strategies/AnonymousStrategy.js

@@ -0,0 +1,53 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AnonymousStrategy = void 0;
+const tslib_1 = require("tslib");
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const passport_custom_1 = require("passport-custom");
+const AuthSubjectPort_1 = require("../contracts/AuthSubjectPort");
+// #endregion
+/**
+ * Anonymous strategy for temporary user login.
+ *
+ * @public
+ */
+let AnonymousStrategy = class AnonymousStrategy extends (0, passport_1.PassportStrategy)(passport_custom_1.Strategy, 'anonymous') {
+    // #endregion
+    // #region Ctor
+    /**
+     * Constructs a new instance of the `AnonymousStrategy` class.
+     *
+     * @public
+     * @param authSubject Auth subject port instance.
+     * @param configService Configuration service instance.
+     */
+    constructor(authSubject, configService) {
+        super();
+        this._authSubject = authSubject;
+        this._configService = configService;
+    }
+    // #endregion
+    // #region Methods
+    /**
+     * Validates the authentication credentials.
+     *
+     * @public
+     * @returns The authenticated user and this is also later available in the request.user object
+     */
+    async validate() {
+        const user = await this._authSubject.findAnonymous(this._configService.get('SEED_ANONYMOUS_USERNAME'));
+        if (!user) {
+            throw new common_1.NotFoundException('User not found');
+        }
+        return user;
+    }
+};
+exports.AnonymousStrategy = AnonymousStrategy;
+exports.AnonymousStrategy = AnonymousStrategy = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_core_1.ConfigService])
+], AnonymousStrategy);
+//# sourceMappingURL=AnonymousStrategy.js.map

package/src/strategies/AppleStrategy.d.ts

@@ -0,0 +1,38 @@
+import { ConfigService } from '@breadstone/archipel-platform-core';
+import type { Profile as PassportProfile } from 'passport';
+import type { IAuthSubject } from '../contracts/IAuthSubject';
+import { SocialAuthPort } from '../contracts/SocialAuthPort';
+type IAppleProfile = PassportProfile & {
+    email?: string;
+};
+declare const AppleStrategy_base: new (...args: [options: import("passport-apple").AuthenticateOptionsWithRequest] | [options: import("passport-apple").AuthenticateOptions]) => import("passport-apple") & {
+    validate(...args: any[]): unknown;
+};
+/**
+ * The `AppleStrategy` integrates Apple Sign In authentication.
+ *
+ * @public
+ */
+export declare class AppleStrategy extends AppleStrategy_base {
+    private readonly _socialAuth;
+    /**
+     * Initializes a new instance of the `AppleStrategy` class.
+     *
+     * @public
+     * @param socialAuth Social auth port instance.
+     * @param configService Configuration service instance.
+     */
+    constructor(socialAuth: SocialAuthPort, configService: ConfigService);
+    /**
+     * Validates the Apple authentication payload.
+     *
+     * @public
+     * @param accessToken OAuth access token.
+     * @param refreshToken OAuth refresh token.
+     * @param idToken Apple identity token.
+     * @param profile Apple profile data.
+     * @returns The authenticated user.
+     */
+    validate(accessToken: string, refreshToken: string, idToken: string, profile: IAppleProfile): Promise<IAuthSubject>;
+}
+export {};

package/src/strategies/AppleStrategy.js

@@ -0,0 +1,79 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppleStrategy = void 0;
+const tslib_1 = require("tslib");
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const passport_apple_1 = require("passport-apple");
+const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
+/**
+ * The `AppleStrategy` integrates Apple Sign In authentication.
+ *
+ * @public
+ */
+let AppleStrategy = class AppleStrategy extends (0, passport_1.PassportStrategy)(passport_apple_1.Strategy, 'apple') {
+    // #endregion
+    // #region Ctor
+    /**
+     * Initializes a new instance of the `AppleStrategy` class.
+     *
+     * @public
+     * @param socialAuth Social auth port instance.
+     * @param configService Configuration service instance.
+     */
+    constructor(socialAuth, configService) {
+        const rawPrivateKey = configService.get('AUTH_APPLE_PRIVATE_KEY');
+        const normalizedPrivateKey = rawPrivateKey.replace(/\r/g, '').replace(/\\n/g, '\n');
+        super({
+            clientID: configService.get('AUTH_APPLE_CLIENT_ID'),
+            teamID: configService.get('AUTH_APPLE_TEAM_ID'),
+            keyID: configService.get('AUTH_APPLE_KEY_ID'),
+            callbackURL: configService.tryGet('AUTH_APPLE_CALLBACK_URL', '/auth/apple/callback'),
+            privateKeyString: normalizedPrivateKey,
+            scope: ['name', 'email'],
+            state: true,
+        });
+        this._socialAuth = socialAuth;
+    }
+    // #endregion
+    // #region Methods
+    /**
+     * Validates the Apple authentication payload.
+     *
+     * @public
+     * @param accessToken OAuth access token.
+     * @param refreshToken OAuth refresh token.
+     * @param idToken Apple identity token.
+     * @param profile Apple profile data.
+     * @returns The authenticated user.
+     */
+    async validate(accessToken, refreshToken, idToken, profile) {
+        void accessToken;
+        void refreshToken;
+        void idToken;
+        const email = profile.emails?.[0]?.value ?? profile.email ?? null;
+        if (!email) {
+            throw new common_1.UnauthorizedException('No email provided from Apple');
+        }
+        const displayName = profile.displayName ?? profile.name?.givenName ?? profile.name?.familyName ?? email.split('@')[0];
+        if (!displayName) {
+            throw new common_1.UnauthorizedException('No display name provided from Apple');
+        }
+        const userName = profile.username ?? email.split('@')[0];
+        const user = await this._socialAuth.findOrCreateByProfile({
+            provider: 'apple',
+            email: email,
+            userName: userName,
+            displayName: displayName,
+        });
+        return user;
+    }
+};
+exports.AppleStrategy = AppleStrategy;
+exports.AppleStrategy = AppleStrategy = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
+], AppleStrategy);
+//# sourceMappingURL=AppleStrategy.js.map

package/src/strategies/GithubStrategy.d.ts

@@ -0,0 +1,24 @@
+import { ConfigService } from '@breadstone/archipel-platform-core';
+import { type Profile, Strategy } from 'passport-github2';
+import type { IAuthSubject } from '../contracts/IAuthSubject';
+import { SocialAuthPort } from '../contracts/SocialAuthPort';
+declare const GithubStrategy_base: new (...args: [options: import("passport-github2").StrategyOptionsWithRequest] | [options: import("passport-github2").StrategyOptions]) => Strategy & {
+    validate(...args: any[]): unknown;
+};
+export declare class GithubStrategy extends GithubStrategy_base {
+    private readonly _socialAuth;
+    private readonly _configService;
+    /**
+     * Constructs a new instance of the `GithubStrategy` class.
+     *
+     * @public
+     * @param socialAuth Social auth port instance.
+     * @param configService Configuration service instance.
+     */
+    constructor(socialAuth: SocialAuthPort, configService: ConfigService);
+    /**
+     * @public
+     */
+    validate(_accessToken: string, _refreshToken: string, profile: Profile): Promise<IAuthSubject>;
+}
+export {};

package/src/strategies/GithubStrategy.js

@@ -0,0 +1,65 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GithubStrategy = void 0;
+const tslib_1 = require("tslib");
+const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const passport_github2_1 = require("passport-github2");
+const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
+// import type { authConfig } from '../../../configs/auth.config';
+// import { AuthConfig } from '../../../configs/auth.config';
+// import { UserService } from '../../user/user.service';
+// import { OauthStoreService } from '../oauth/oauth.store';
+// import { pickUserMe } from '../utils';
+// #endregion
+let GithubStrategy = class GithubStrategy extends (0, passport_1.PassportStrategy)(passport_github2_1.Strategy, 'github') {
+    // #endregion
+    // #region Ctor
+    /**
+     * Constructs a new instance of the `GithubStrategy` class.
+     *
+     * @public
+     * @param socialAuth Social auth port instance.
+     * @param configService Configuration service instance.
+     */
+    constructor(socialAuth, configService) {
+        super({
+            clientID: configService.get('AUTH_GITHUB_CLIENT_ID'),
+            clientSecret: configService.get('AUTH_GITHUB_CLIENT_SECRET'),
+            state: true,
+            callbackURL: '/auth/github/callback',
+            // store: oauthStoreService
+        });
+        this._socialAuth = socialAuth;
+        this._configService = configService;
+    }
+    // #endregion
+    // #region Methods
+    /**
+     * @public
+     */
+    async validate(_accessToken, _refreshToken, profile) {
+        const email = profile.emails?.[0].value;
+        if (!email) {
+            throw new common_1.UnauthorizedException('No email provided from GitHub');
+        }
+        if (!profile.displayName) {
+            throw new common_1.UnauthorizedException('No display name provided from GitHub');
+        }
+        const user = await this._socialAuth.findOrCreateByProfile({
+            provider: 'github',
+            email: email,
+            userName: profile.username ?? null,
+            displayName: profile.displayName ?? null,
+        });
+        return user;
+    }
+};
+exports.GithubStrategy = GithubStrategy;
+exports.GithubStrategy = GithubStrategy = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
+], GithubStrategy);
+//# sourceMappingURL=GithubStrategy.js.map

package/src/strategies/GoogleStrategy.d.ts

@@ -0,0 +1,34 @@
+import { ConfigService } from '@breadstone/archipel-platform-core';
+import { Profile, Strategy } from 'passport-google-oauth20';
+import type { IAuthSubject } from '../contracts/IAuthSubject';
+import { SocialAuthPort } from '../contracts/SocialAuthPort';
+declare const GoogleStrategy_base: new (...args: [options: import("passport-google-oauth20").StrategyOptionsWithRequest] | [options: import("passport-google-oauth20").StrategyOptions] | [options: import("passport-google-oauth20").StrategyOptions] | [options: import("passport-google-oauth20").StrategyOptionsWithRequest]) => Strategy & {
+    validate(...args: any[]): unknown;
+};
+/**
+ * The `GoogleStrategy` integrates Google OAuth authentication.
+ *
+ * @public
+ */
+export declare class GoogleStrategy extends GoogleStrategy_base {
+    private readonly _socialAuth;
+    /**
+     * Initializes a new instance of the `GoogleStrategy` class.
+     *
+     * @public
+     * @param socialAuth Social auth port instance.
+     * @param configService Configuration service instance.
+     */
+    constructor(socialAuth: SocialAuthPort, configService: ConfigService);
+    /**
+     * Validates the Google authentication payload.
+     *
+     * @public
+     * @param accessToken OAuth access token.
+     * @param refreshToken OAuth refresh token.
+     * @param profile Google profile data.
+     * @returns The authenticated user.
+     */
+    validate(accessToken: string, refreshToken: string, profile: Profile): Promise<IAuthSubject>;
+}
+export {};