@breadstone/archipel-platform-authentication 0.0.13 → 0.0.14

package/src/env.js

@@ -2,74 +2,74 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_SCOPE = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_SCOPE = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_SCOPE = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_SCOPE = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_ISSUER = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 // #endregion
 /** Secret used to sign JWTs. */
-exports.AUTH_JWT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_JWT_SECRET');
+exports.AUTH_JWT_SECRET = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_JWT_SECRET');
 /** Lifetime of access tokens (e.g. `'15m'`, `'1h'`). */
-exports.AUTH_JWT_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_JWT_EXPIRES_IN');
+exports.AUTH_JWT_EXPIRES_IN = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_JWT_EXPIRES_IN');
 /** Lifetime of email-verification JWTs. */
-exports.AUTH_VERIFY_JWT_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_VERIFY_JWT_EXPIRES_IN');
+exports.AUTH_VERIFY_JWT_EXPIRES_IN = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_VERIFY_JWT_EXPIRES_IN');
 /** AES encryption key used to encrypt MFA secrets at rest. */
-exports.AUTH_MFA_ENCRYPTION_KEY = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_ENCRYPTION_KEY');
+exports.AUTH_MFA_ENCRYPTION_KEY = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_ENCRYPTION_KEY');
 /** How long an MFA challenge stays valid (e.g. `'5m'`). */
-exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_CHALLENGE_EXPIRES_IN');
+exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_CHALLENGE_EXPIRES_IN');
 /** Maximum number of failed MFA attempts before lockout. */
-exports.AUTH_MFA_MAX_ATTEMPTS = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_MAX_ATTEMPTS');
+exports.AUTH_MFA_MAX_ATTEMPTS = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_MAX_ATTEMPTS');
 /** Issuer name shown in authenticator apps for TOTP MFA. */
-exports.AUTH_MFA_ISSUER = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_ISSUER');
+exports.AUTH_MFA_ISSUER = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_ISSUER');
 /** Time-to-live for SMS OTP codes (e.g. `'10m'`). */
-exports.AUTH_MFA_SMS_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_SMS_CODE_TTL');
+exports.AUTH_MFA_SMS_CODE_TTL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_SMS_CODE_TTL');
 /** Minimum interval between SMS resend requests (e.g. `'30s'`). */
-exports.AUTH_MFA_SMS_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_SMS_MIN_RESEND');
+exports.AUTH_MFA_SMS_MIN_RESEND = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_SMS_MIN_RESEND');
 /** Time-to-live for email OTP codes (e.g. `'10m'`). */
-exports.AUTH_MFA_EMAIL_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_EMAIL_CODE_TTL');
+exports.AUTH_MFA_EMAIL_CODE_TTL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_EMAIL_CODE_TTL');
 /** Minimum interval between email OTP resend requests (e.g. `'30s'`). */
-exports.AUTH_MFA_EMAIL_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_EMAIL_MIN_RESEND');
+exports.AUTH_MFA_EMAIL_MIN_RESEND = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_EMAIL_MIN_RESEND');
 /** Time-to-live for push OTP codes (e.g. `'10m'`). */
-exports.AUTH_MFA_PUSH_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_PUSH_CODE_TTL');
+exports.AUTH_MFA_PUSH_CODE_TTL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_PUSH_CODE_TTL');
 /** Minimum interval between push OTP resend requests (e.g. `'30s'`). */
-exports.AUTH_MFA_PUSH_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_PUSH_MIN_RESEND');
+exports.AUTH_MFA_PUSH_MIN_RESEND = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MFA_PUSH_MIN_RESEND');
 /** Google OAuth2 client ID. */
-exports.AUTH_GOOGLE_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CLIENT_ID');
+exports.AUTH_GOOGLE_CLIENT_ID = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GOOGLE_CLIENT_ID');
 /** Google OAuth2 client secret. */
-exports.AUTH_GOOGLE_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CLIENT_SECRET');
+exports.AUTH_GOOGLE_CLIENT_SECRET = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GOOGLE_CLIENT_SECRET');
 /** Google OAuth2 callback URL. */
-exports.AUTH_GOOGLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CALLBACK_URL');
+exports.AUTH_GOOGLE_CALLBACK_URL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GOOGLE_CALLBACK_URL');
 /** Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). */
-exports.AUTH_GOOGLE_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_SCOPE');
+exports.AUTH_GOOGLE_SCOPE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GOOGLE_SCOPE');
 /** Microsoft OAuth2 client ID. */
-exports.AUTH_MICROSOFT_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_CLIENT_ID');
+exports.AUTH_MICROSOFT_CLIENT_ID = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_CLIENT_ID');
 /** Microsoft OAuth2 client secret. */
-exports.AUTH_MICROSOFT_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_CLIENT_SECRET');
+exports.AUTH_MICROSOFT_CLIENT_SECRET = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_CLIENT_SECRET');
 /** Microsoft OAuth2 callback URL. */
-exports.AUTH_MICROSOFT_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_CALLBACK_URL');
+exports.AUTH_MICROSOFT_CALLBACK_URL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_CALLBACK_URL');
 /** Microsoft tenant ID or `'common'` for multi-tenant. */
-exports.AUTH_MICROSOFT_TENANT = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_TENANT');
+exports.AUTH_MICROSOFT_TENANT = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_TENANT');
 /** Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). */
-exports.AUTH_MICROSOFT_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_SCOPE');
+exports.AUTH_MICROSOFT_SCOPE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_MICROSOFT_SCOPE');
 /** Apple Sign-In private key (PEM string). */
-exports.AUTH_APPLE_PRIVATE_KEY = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_PRIVATE_KEY');
+exports.AUTH_APPLE_PRIVATE_KEY = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_PRIVATE_KEY');
 /** Apple Sign-In client (service) ID. */
-exports.AUTH_APPLE_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_CLIENT_ID');
+exports.AUTH_APPLE_CLIENT_ID = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_CLIENT_ID');
 /** Apple developer team ID. */
-exports.AUTH_APPLE_TEAM_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_TEAM_ID');
+exports.AUTH_APPLE_TEAM_ID = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_TEAM_ID');
 /** Apple Sign-In key ID. */
-exports.AUTH_APPLE_KEY_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_KEY_ID');
+exports.AUTH_APPLE_KEY_ID = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_KEY_ID');
 /** Apple Sign-In callback URL. */
-exports.AUTH_APPLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_CALLBACK_URL');
+exports.AUTH_APPLE_CALLBACK_URL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_CALLBACK_URL');
 /** Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). */
-exports.AUTH_APPLE_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_SCOPE');
+exports.AUTH_APPLE_SCOPE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_APPLE_SCOPE');
 /** GitHub OAuth client ID. */
-exports.AUTH_GITHUB_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CLIENT_ID');
+exports.AUTH_GITHUB_CLIENT_ID = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GITHUB_CLIENT_ID');
 /** GitHub OAuth client secret. */
-exports.AUTH_GITHUB_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CLIENT_SECRET');
+exports.AUTH_GITHUB_CLIENT_SECRET = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GITHUB_CLIENT_SECRET');
 /** GitHub OAuth callback URL. */
-exports.AUTH_GITHUB_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CALLBACK_URL');
+exports.AUTH_GITHUB_CALLBACK_URL = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GITHUB_CALLBACK_URL');
 /** Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). */
-exports.AUTH_GITHUB_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_SCOPE');
+exports.AUTH_GITHUB_SCOPE = (0, archipel_platform_configuration_1.createConfigKey)('AUTH_GITHUB_SCOPE');
 /** Username used for the anonymous seed user. */
-exports.SEED_ANONYMOUS_USERNAME = (0, archipel_platform_core_1.createConfigKey)('SEED_ANONYMOUS_USERNAME');
+exports.SEED_ANONYMOUS_USERNAME = (0, archipel_platform_configuration_1.createConfigKey)('SEED_ANONYMOUS_USERNAME');
 /** Core configuration entries required by `platform-authentication`. */
 exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
     // JWT & Session

package/src/guards/index.js

@@ -7,6 +7,4 @@ tslib_1.__exportStar(require("./JwtAuthGuard"), exports);
 tslib_1.__exportStar(require("./LocalAuthGuard"), exports);
 tslib_1.__exportStar(require("./RolesGuard"), exports);
 tslib_1.__exportStar(require("./SocialAuthGuard"), exports);
-// export * from './_RefreshTokenAuthGuard';
-// export * from './_TwoFactorAuthGuard';
 //# sourceMappingURL=index.js.map

package/src/mfa/MfaEncryptionService.d.ts

@@ -1,4 +1,4 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 /**
  * Provides AES-GCM encryption for MFA secrets.
  *

package/src/mfa/MfaEncryptionService.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MfaEncryptionService = void 0;
 const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
 const env_1 = require("../env");
@@ -54,6 +54,6 @@ let MfaEncryptionService = class MfaEncryptionService {
 exports.MfaEncryptionService = MfaEncryptionService;
 exports.MfaEncryptionService = MfaEncryptionService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [archipel_platform_core_1.ConfigService])
+    tslib_1.__metadata("design:paramtypes", [archipel_platform_configuration_1.ConfigService])
 ], MfaEncryptionService);
 //# sourceMappingURL=MfaEncryptionService.js.map

package/src/mfa/MfaService.js

@@ -38,9 +38,6 @@ let MfaService = class MfaService {
         if (state.channels[method]?.enabled) {
             throw new common_1.BadRequestException('Selected MFA method is already enabled');
         }
-        if (state.channels[method]?.enabled) {
-            throw new common_1.BadRequestException('Selected MFA method is already enabled');
-        }
         return channel.initSetup(userId, context);
     }
     /**

package/src/mfa/channels/EmailOtpMfaChannel.d.ts

@@ -1,9 +1,18 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import { BcryptService } from '@breadstone/archipel-platform-cryptography';
 import { MfaSubjectPort } from '../../contracts/MfaSubjectPort';
 import { IMfaSetup } from '../../models';
 import { IMfaChannel } from '../IMfaChannel';
 import { IMfaSetupContext } from '../MfaState';
+/**
+ * Email-based OTP MFA channel.
+ *
+ * **Stub implementation:** OTP delivery is logged but not actually sent.
+ * Replace the `_logger.log` calls with a real email service integration
+ * (e.g. platform-mailing) before production use.
+ *
+ * @public
+ */
 export declare class EmailOtpMfaChannel implements IMfaChannel {
     readonly method = "email";
     private readonly _mfaSubject;

package/src/mfa/channels/EmailOtpMfaChannel.js

@@ -4,6 +4,7 @@ var EmailOtpMfaChannel_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EmailOtpMfaChannel = void 0;
 const tslib_1 = require("tslib");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const archipel_platform_cryptography_1 = require("@breadstone/archipel-platform-cryptography");
 const common_1 = require("@nestjs/common");
@@ -12,6 +13,15 @@ const MfaSubjectPort_1 = require("../../contracts/MfaSubjectPort");
 const env_1 = require("../../env");
 const MfaState_1 = require("../MfaState");
 // #endregion
+/**
+ * Email-based OTP MFA channel.
+ *
+ * **Stub implementation:** OTP delivery is logged but not actually sent.
+ * Replace the `_logger.log` calls with a real email service integration
+ * (e.g. platform-mailing) before production use.
+ *
+ * @public
+ */
 let EmailOtpMfaChannel = EmailOtpMfaChannel_1 = class EmailOtpMfaChannel {
     constructor(mfaSubject, configService, bcryptService) {
         this.method = 'email';
@@ -143,12 +153,12 @@ let EmailOtpMfaChannel = EmailOtpMfaChannel_1 = class EmailOtpMfaChannel {
         return true;
     }
     generateCode() {
-        return (0, node_crypto_1.randomInt)(100000, 999999).toString();
+        return (0, node_crypto_1.randomInt)(10000000, 99999999).toString();
     }
 };
 exports.EmailOtpMfaChannel = EmailOtpMfaChannel;
 exports.EmailOtpMfaChannel = EmailOtpMfaChannel = EmailOtpMfaChannel_1 = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort, archipel_platform_core_1.ConfigService, archipel_platform_cryptography_1.BcryptService])
+    tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort, archipel_platform_configuration_1.ConfigService, archipel_platform_cryptography_1.BcryptService])
 ], EmailOtpMfaChannel);
 //# sourceMappingURL=EmailOtpMfaChannel.js.map

package/src/mfa/channels/PushMfaChannel.d.ts

@@ -1,12 +1,17 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import { BcryptService } from '@breadstone/archipel-platform-cryptography';
 import { MfaSubjectPort } from '../../contracts/MfaSubjectPort';
 import { IMfaSetup } from '../../models';
 import { IMfaChannel } from '../IMfaChannel';
 import { IMfaSetupContext } from '../MfaState';
 /**
- * Simplified push-style MFA channel that simulates a device approval code.
- * This is intentionally minimal so it can be replaced by a real push provider later.
+ * Push-style MFA channel that simulates a device approval code.
+ *
+ * **Stub implementation:** Approval delivery is logged but not actually sent.
+ * Replace the `_logger.log` calls with a real push notification provider
+ * before production use.
+ *
+ * @public
  */
 export declare class PushMfaChannel implements IMfaChannel {
     readonly method = "push";

package/src/mfa/channels/PushMfaChannel.js

@@ -4,6 +4,7 @@ var PushMfaChannel_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PushMfaChannel = void 0;
 const tslib_1 = require("tslib");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const archipel_platform_cryptography_1 = require("@breadstone/archipel-platform-cryptography");
 const common_1 = require("@nestjs/common");
@@ -13,8 +14,13 @@ const env_1 = require("../../env");
 const MfaState_1 = require("../MfaState");
 // #endregion
 /**
- * Simplified push-style MFA channel that simulates a device approval code.
- * This is intentionally minimal so it can be replaced by a real push provider later.
+ * Push-style MFA channel that simulates a device approval code.
+ *
+ * **Stub implementation:** Approval delivery is logged but not actually sent.
+ * Replace the `_logger.log` calls with a real push notification provider
+ * before production use.
+ *
+ * @public
  */
 let PushMfaChannel = PushMfaChannel_1 = class PushMfaChannel {
     // #endregion
@@ -141,12 +147,12 @@ let PushMfaChannel = PushMfaChannel_1 = class PushMfaChannel {
         return true;
     }
     generateCode() {
-        return (0, node_crypto_1.randomInt)(100000, 999999).toString();
+        return (0, node_crypto_1.randomInt)(10000000, 99999999).toString();
     }
 };
 exports.PushMfaChannel = PushMfaChannel;
 exports.PushMfaChannel = PushMfaChannel = PushMfaChannel_1 = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort, archipel_platform_core_1.ConfigService, archipel_platform_cryptography_1.BcryptService])
+    tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort, archipel_platform_configuration_1.ConfigService, archipel_platform_cryptography_1.BcryptService])
 ], PushMfaChannel);
 //# sourceMappingURL=PushMfaChannel.js.map

package/src/mfa/channels/SmsMfaChannel.d.ts

@@ -1,9 +1,18 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import { BcryptService } from '@breadstone/archipel-platform-cryptography';
 import { MfaSubjectPort } from '../../contracts/MfaSubjectPort';
 import { IMfaSetup } from '../../models';
 import { IMfaChannel } from '../IMfaChannel';
 import { IMfaSetupContext } from '../MfaState';
+/**
+ * SMS-based MFA channel.
+ *
+ * **Stub implementation:** OTP delivery is logged but not actually sent.
+ * Replace the `_logger.log` calls with a real SMS gateway integration
+ * (e.g. Twilio, Azure Communication Services) before production use.
+ *
+ * @public
+ */
 export declare class SmsMfaChannel implements IMfaChannel {
     readonly method = "sms";
     private readonly _mfaSubject;

package/src/mfa/channels/SmsMfaChannel.js

@@ -4,6 +4,7 @@ var SmsMfaChannel_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SmsMfaChannel = void 0;
 const tslib_1 = require("tslib");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const archipel_platform_cryptography_1 = require("@breadstone/archipel-platform-cryptography");
 const common_1 = require("@nestjs/common");
@@ -12,6 +13,15 @@ const MfaSubjectPort_1 = require("../../contracts/MfaSubjectPort");
 const env_1 = require("../../env");
 const MfaState_1 = require("../MfaState");
 // #endregion
+/**
+ * SMS-based MFA channel.
+ *
+ * **Stub implementation:** OTP delivery is logged but not actually sent.
+ * Replace the `_logger.log` calls with a real SMS gateway integration
+ * (e.g. Twilio, Azure Communication Services) before production use.
+ *
+ * @public
+ */
 let SmsMfaChannel = SmsMfaChannel_1 = class SmsMfaChannel {
     // #endregion
     // #region Ctor
@@ -149,12 +159,12 @@ let SmsMfaChannel = SmsMfaChannel_1 = class SmsMfaChannel {
         return true;
     }
     generateCode() {
-        return (0, node_crypto_1.randomInt)(100000, 999999).toString();
+        return (0, node_crypto_1.randomInt)(10000000, 99999999).toString();
     }
 };
 exports.SmsMfaChannel = SmsMfaChannel;
 exports.SmsMfaChannel = SmsMfaChannel = SmsMfaChannel_1 = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort, archipel_platform_core_1.ConfigService, archipel_platform_cryptography_1.BcryptService])
+    tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort, archipel_platform_configuration_1.ConfigService, archipel_platform_cryptography_1.BcryptService])
 ], SmsMfaChannel);
 //# sourceMappingURL=SmsMfaChannel.js.map

package/src/mfa/channels/TotpMfaChannel.d.ts

@@ -1,4 +1,4 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
 import { IOtpService } from '@breadstone/archipel-platform-cryptography/otp';
 import { MfaSubjectPort } from '../../contracts/MfaSubjectPort';
 import { IMfaSetup } from '../../models';

package/src/mfa/channels/TotpMfaChannel.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TotpMfaChannel = void 0;
 const tslib_1 = require("tslib");
-const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const otp_1 = require("@breadstone/archipel-platform-cryptography/otp");
 const common_1 = require("@nestjs/common");
 const MfaSubjectPort_1 = require("../../contracts/MfaSubjectPort");
@@ -96,7 +96,7 @@ exports.TotpMfaChannel = TotpMfaChannel = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__param(3, (0, common_1.Inject)(otp_1.OTP_SERVICE_TOKEN)),
     tslib_1.__metadata("design:paramtypes", [MfaSubjectPort_1.MfaSubjectPort,
-        archipel_platform_core_1.ConfigService,
+        archipel_platform_configuration_1.ConfigService,
         MfaEncryptionService_1.MfaEncryptionService, Object])
 ], TotpMfaChannel);
 //# sourceMappingURL=TotpMfaChannel.js.map

package/src/services/ChallengeService.d.ts

@@ -1,4 +1,5 @@
-import { ConfigService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
+import { ChallengeStorePort } from '../contracts/ChallengeStorePort';
 export interface IMfaChallengeState {
     id: string;
     userId: string;
@@ -15,13 +16,16 @@ export interface IMfaChallengeState {
 /**
  * Stores and validates MFA login challenges.
  *
+ * Delegates persistence to {@link ChallengeStorePort} so the backing store
+ * (in-memory, Redis, etc.) can be swapped without changing business logic.
+ *
  * @public
  */
 export declare class ChallengeService {
     private readonly _ttlMilliseconds;
     private readonly _maxAttempts;
-    private readonly _challenges;
-    constructor(configService: ConfigService);
+    private readonly _store;
+    constructor(configService: ConfigService, store: ChallengeStorePort);
     /**
      * Issues a new MFA challenge for a user.
      */

package/src/services/ChallengeService.js

@@ -3,22 +3,27 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ChallengeService = void 0;
 const tslib_1 = require("tslib");
+const archipel_platform_configuration_1 = require("@breadstone/archipel-platform-configuration");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
+const ChallengeStorePort_1 = require("../contracts/ChallengeStorePort");
 const env_1 = require("../env");
 /**
  * Stores and validates MFA login challenges.
  *
+ * Delegates persistence to {@link ChallengeStorePort} so the backing store
+ * (in-memory, Redis, etc.) can be swapped without changing business logic.
+ *
  * @public
  */
 let ChallengeService = class ChallengeService {
     // #endregion
     // #region Ctor
-    constructor(configService) {
+    constructor(configService, store) {
         this._ttlMilliseconds = archipel_platform_core_1.DateTimeUtils.parse(configService.tryGet(env_1.AUTH_MFA_CHALLENGE_EXPIRES_IN.key, '5m'));
         this._maxAttempts = Number(configService.tryGet(env_1.AUTH_MFA_MAX_ATTEMPTS.key, '5'));
-        this._challenges = new Map();
+        this._store = store;
     }
     // #endregion
     // #region Methods
@@ -41,19 +46,19 @@ let ChallengeService = class ChallengeService {
             expiresAt: new Date(now.getTime() + this._ttlMilliseconds),
             attempts: 0,
         };
-        this._challenges.set(id, challenge);
+        await this._store.set(id, challenge);
         return challenge;
     }
     /**
      * Retrieves an active challenge, throwing if invalid or expired.
      */
     async get(challengeId) {
-        const challenge = this._challenges.get(challengeId);
+        const challenge = await this._store.get(challengeId);
         if (!challenge) {
             throw new common_1.UnauthorizedException('Invalid MFA challenge');
         }
         if (challenge.expiresAt.getTime() <= Date.now()) {
-            this._challenges.delete(challengeId);
+            await this._store.delete(challengeId);
             throw new common_1.UnauthorizedException('MFA challenge expired');
         }
         return challenge;
@@ -69,22 +74,22 @@ let ChallengeService = class ChallengeService {
             attempts: attempts,
         };
         if (attempts >= this._maxAttempts) {
-            this._challenges.delete(challengeId);
+            await this._store.delete(challengeId);
             throw new common_1.UnauthorizedException('MFA challenge locked after too many attempts');
         }
-        this._challenges.set(challengeId, updated);
+        await this._store.set(challengeId, updated);
         return updated;
     }
     /**
      * Invalidates a challenge after successful verification.
      */
     async invalidate(challengeId) {
-        this._challenges.delete(challengeId);
+        await this._store.delete(challengeId);
     }
 };
 exports.ChallengeService = ChallengeService;
 exports.ChallengeService = ChallengeService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
-    tslib_1.__metadata("design:paramtypes", [archipel_platform_core_1.ConfigService])
+    tslib_1.__metadata("design:paramtypes", [archipel_platform_configuration_1.ConfigService, ChallengeStorePort_1.ChallengeStorePort])
 ], ChallengeService);
 //# sourceMappingURL=ChallengeService.js.map

package/src/services/InMemoryChallengeStore.d.ts

@@ -0,0 +1,16 @@
+import { ChallengeStorePort } from '../contracts/ChallengeStorePort';
+import type { IMfaChallengeState } from './ChallengeService';
+/**
+ * Default in-memory implementation of the {@link ChallengeStorePort}.
+ *
+ * Suitable for single-instance deployments only. For production multi-instance
+ * setups, replace with a Redis-backed implementation via `IAuthModuleOptions.challengeStore`.
+ *
+ * @public
+ */
+export declare class InMemoryChallengeStore extends ChallengeStorePort {
+    private readonly _store;
+    set(id: string, challenge: IMfaChallengeState): Promise<void>;
+    get(id: string): Promise<IMfaChallengeState | undefined>;
+    delete(id: string): Promise<void>;
+}

package/src/services/InMemoryChallengeStore.js

@@ -0,0 +1,40 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryChallengeStore = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const ChallengeStorePort_1 = require("../contracts/ChallengeStorePort");
+// #endregion
+/**
+ * Default in-memory implementation of the {@link ChallengeStorePort}.
+ *
+ * Suitable for single-instance deployments only. For production multi-instance
+ * setups, replace with a Redis-backed implementation via `IAuthModuleOptions.challengeStore`.
+ *
+ * @public
+ */
+let InMemoryChallengeStore = class InMemoryChallengeStore extends ChallengeStorePort_1.ChallengeStorePort {
+    constructor() {
+        // #region Fields
+        super(...arguments);
+        this._store = new Map();
+        // #endregion
+    }
+    // #endregion
+    // #region Methods
+    async set(id, challenge) {
+        this._store.set(id, challenge);
+    }
+    async get(id) {
+        return this._store.get(id);
+    }
+    async delete(id) {
+        this._store.delete(id);
+    }
+};
+exports.InMemoryChallengeStore = InMemoryChallengeStore;
+exports.InMemoryChallengeStore = InMemoryChallengeStore = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], InMemoryChallengeStore);
+//# sourceMappingURL=InMemoryChallengeStore.js.map

package/src/services/SessionService.d.ts

@@ -63,4 +63,12 @@ export declare class SessionService {
      * @returns `true` if a session was invalidated.
      */
     invalidate(token: string): Promise<boolean>;
+    /**
+     * Validates that a session token has an acceptable format.
+     * Rejects empty, too-short, or obviously malformed tokens.
+     *
+     * @param token - The session token to validate.
+     * @throws BadRequestException if the token is invalid.
+     */
+    private validateToken;
 }

package/src/services/SessionService.js

@@ -41,6 +41,7 @@ let SessionService = class SessionService {
      * @param clientName - Optional client application name.
      */
     async store(token, userId, ipAddress, deviceInfo, location, clientName) {
+        this.validateToken(token);
         await this._sessionPersistence.store({
             token,
             userId,
@@ -99,6 +100,20 @@ let SessionService = class SessionService {
     async invalidate(token) {
         return this._sessionPersistence.invalidate(token);
     }
+    /**
+     * Validates that a session token has an acceptable format.
+     * Rejects empty, too-short, or obviously malformed tokens.
+     *
+     * @param token - The session token to validate.
+     * @throws BadRequestException if the token is invalid.
+     */
+    validateToken(token) {
+        const JWT_MIN_LENGTH = 32;
+        const JWT_PATTERN = /^[\w\-._~+/]+=*$/;
+        if (!token || token.length < JWT_MIN_LENGTH || !JWT_PATTERN.test(token)) {
+            throw new common_1.BadRequestException('Invalid session token format');
+        }
+    }
 };
 exports.SessionService = SessionService;
 exports.SessionService = SessionService = tslib_1.__decorate([

package/src/services/VerificationService.d.ts

@@ -1,4 +1,5 @@
-import { ConfigService, HostService } from '@breadstone/archipel-platform-core';
+import { ConfigService } from '@breadstone/archipel-platform-configuration';
+import { HostService } from '@breadstone/archipel-platform-core';
 import { JwtService } from '@nestjs/jwt';
 import { VerificationSubjectPort } from '../contracts/VerificationSubjectPort';
 /**
@@ -53,4 +54,12 @@ export declare class VerificationService {
      * @returns The URL to verify the email.
      */
     buildVerificationLink(token: string): string;
+    /**
+     * Performs a constant-time string comparison to prevent timing attacks.
+     *
+     * @param a - First string.
+     * @param b - Second string.
+     * @returns Whether the strings are equal.
+     */
+    private safeEqual;
 }