@breadstone/archipel-platform-authentication 0.0.22 → 0.0.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +65 -18
  2. package/package.json +5 -6
  3. package/src/contracts/IMfaSubjectUpdate.d.ts +1 -1
  4. package/src/env.js +4 -4
package/README.md CHANGED
@@ -2,24 +2,33 @@
2
2
 
3
3
  Authentication and authorization infrastructure for NestJS applications.
4
4
 
5
- ## ⚠️ Environment Variables (Most Important)
6
-
7
- | Variable | Required | Default |
8
- | ------------------------------ | -------- | ------- |
9
- | `AUTH_JWT_SECRET` | yes | - |
10
- | `AUTH_JWT_EXPIRES_IN` | yes | - |
11
- | `AUTH_VERIFY_JWT_EXPIRES_IN` | yes | - |
12
- | `AUTH_GOOGLE_CLIENT_ID` | yes | - |
13
- | `AUTH_GOOGLE_CLIENT_SECRET` | yes | - |
14
- | `AUTH_MICROSOFT_CLIENT_ID` | yes | - |
15
- | `AUTH_MICROSOFT_CLIENT_SECRET` | yes | - |
16
- | `AUTH_APPLE_PRIVATE_KEY` | yes | - |
17
- | `AUTH_APPLE_CLIENT_ID` | yes | - |
18
- | `AUTH_APPLE_TEAM_ID` | yes | - |
19
- | `AUTH_APPLE_KEY_ID` | yes | - |
20
- | `AUTH_GITHUB_CLIENT_ID` | yes | - |
21
- | `AUTH_GITHUB_CLIENT_SECRET` | yes | - |
22
- | `SEED_ANONYMOUS_USERNAME` | yes | - |
5
+ ## Features
6
+
7
+ - **JWT authentication** — Access/refresh token issuance and validation
8
+ - **Social OAuth** — Google, Microsoft, Apple, and GitHub connectors
9
+ - **MFA/TOTP** — Multi-factor authentication with challenge store
10
+ - **Anonymous sessions** — Seeded anonymous user support
11
+ - **Pluggable ports** — All persistence and enrichment via injectable adapters
12
+ - **NestJS guards & decorators** — Ready-made guards for route protection
13
+
14
+ ## ⚠️ Environment Variables
15
+
16
+ | Variable | Required | Default | Description |
17
+ | ------------------------------ | -------- | ------- | ----------------------------------------- |
18
+ | `AUTH_JWT_SECRET` | yes | - | JWT signing secret |
19
+ | `AUTH_JWT_EXPIRES_IN` | yes | - | Access token expiry (e.g. `15m`) |
20
+ | `AUTH_VERIFY_JWT_EXPIRES_IN` | yes | - | Verification token expiry |
21
+ | `AUTH_GOOGLE_CLIENT_ID` | yes | - | Google OAuth client ID |
22
+ | `AUTH_GOOGLE_CLIENT_SECRET` | yes | - | Google OAuth client secret |
23
+ | `AUTH_MICROSOFT_CLIENT_ID` | yes | - | Microsoft OAuth client ID |
24
+ | `AUTH_MICROSOFT_CLIENT_SECRET` | yes | - | Microsoft OAuth client secret |
25
+ | `AUTH_APPLE_PRIVATE_KEY` | yes | - | Apple Sign-In private key (PEM) |
26
+ | `AUTH_APPLE_CLIENT_ID` | yes | - | Apple Sign-In client (service) ID |
27
+ | `AUTH_APPLE_TEAM_ID` | yes | - | Apple developer team ID |
28
+ | `AUTH_APPLE_KEY_ID` | yes | - | Apple Sign-In key ID |
29
+ | `AUTH_GITHUB_CLIENT_ID` | yes | - | GitHub OAuth client ID |
30
+ | `AUTH_GITHUB_CLIENT_SECRET` | yes | - | GitHub OAuth client secret |
31
+ | `SEED_ANONYMOUS_USERNAME` | yes | - | Username for the seeded anonymous account |
23
32
 
24
33
  For the full list (including MFA/OAuth callback defaults), see [`../../ENVIRONMENT_VARIABLES.md`](../../ENVIRONMENT_VARIABLES.md).
25
34
 
@@ -44,6 +53,22 @@ import { AuthModule } from '@breadstone/archipel-platform-authentication';
44
53
  export class AppModule {}
45
54
  ```
46
55
 
56
+ ## Import Options
57
+
58
+ ```typescript
59
+ // Main import (module, guards, ports)
60
+ import { AuthModule, AuthSubjectPort, SessionPersistencePort } from '@breadstone/archipel-platform-authentication';
61
+
62
+ // Social auth connectors (tree-shakable sub-exports)
63
+ import { GoogleConnector } from '@breadstone/archipel-platform-authentication/connectors/google';
64
+ import { MicrosoftConnector } from '@breadstone/archipel-platform-authentication/connectors/microsoft';
65
+ import { AppleConnector } from '@breadstone/archipel-platform-authentication/connectors/apple';
66
+ import { GithubConnector } from '@breadstone/archipel-platform-authentication/connectors/github';
67
+
68
+ // MFA/TOTP
69
+ import { TotpService } from '@breadstone/archipel-platform-authentication/mfa/totp';
70
+ ```
71
+
47
72
  ## Ports
48
73
 
49
74
  | Port | Required | Description |
@@ -56,6 +81,28 @@ export class AppModule {}
56
81
  | `SocialAuthPort` | No | OAuth user creation/linking |
57
82
  | `TokenEnricherPort` | No | Custom JWT claim injection |
58
83
 
84
+ ## Resource Limits
85
+
86
+ | Limit | Value | Description |
87
+ | ------------------------------ | ------ | ---------------------------------------------------------------- |
88
+ | In-memory challenge store size | 10,000 | `InMemoryChallengeStore` max entries; oldest evicted on overflow |
89
+
90
+ ## Lifecycle
91
+
92
+ - **Shutdown (`OnModuleDestroy`):** `InMemoryChallengeStore` clears its cleanup interval.
93
+
94
+ ## Peer Dependencies
95
+
96
+ | Package | Required | Notes |
97
+ | --------------------- | -------- | ----------------------------- |
98
+ | `@nestjs/common` | Yes | NestJS core |
99
+ | `@nestjs/jwt` | Yes | JWT token handling |
100
+ | `class-validator` | Yes | DTO validation |
101
+ | `class-transformer` | Yes | DTO transformation |
102
+ | `passport` | Yes | Authentication middleware |
103
+ | `passport-jwt` | Yes | JWT passport strategy |
104
+ | `google-auth-library` | No | Required for Google connector |
105
+
59
106
  ## Documentation
60
107
 
61
108
  📖 **Auth Guide:** [`.docs/guides/authentication-and-authorization.md`](../../.docs/guides/authentication-and-authorization.md)
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@breadstone/archipel-platform-authentication",
3
- "version": "0.0.22",
3
+ "version": "0.0.24",
4
4
  "description": "JWT and OAuth authentication, MFA, session management, and email verification for NestJS applications.",
5
5
  "type": "commonjs",
6
6
  "main": "./src/index.js",
@@ -81,11 +81,10 @@
81
81
  "README.md"
82
82
  ],
83
83
  "dependencies": {
84
- "@breadstone/archipel-platform-configuration": "0.0.22",
85
- "@breadstone/archipel-platform-core": "0.0.22",
86
- "@breadstone/archipel-platform-cryptography": "0.0.22",
87
- "@breadstone/archipel-platform-mapping": "0.0.22",
88
- "@breadstone/archipel-platform-resources": "0.0.22",
84
+ "@breadstone/archipel-platform-configuration": "0.0.24",
85
+ "@breadstone/archipel-platform-core": "0.0.24",
86
+ "@breadstone/archipel-platform-cryptography": "0.0.24",
87
+ "@breadstone/archipel-platform-mapping": "0.0.24",
89
88
  "tslib": "2.8.1"
90
89
  },
91
90
  "peerDependencies": {
package/src/contracts/IMfaSubjectUpdate.d.ts CHANGED
@@ -1,6 +1,6 @@
1
1
  /**
2
2
  * Data payload for updating MFA state on the underlying entity.
3
- * All properties are optional — only the provided ones are applied.
3
+ * All properties are optional - only the provided ones are applied.
4
4
  *
5
5
  * @public
6
6
  */
package/src/env.js CHANGED
@@ -112,7 +112,7 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
112
112
  required: true,
113
113
  description: 'Lifetime of email-verification JWTs.',
114
114
  },
115
- // MFA — General
115
+ // MFA - General
116
116
  {
117
117
  key: exports.AUTH_MFA_ENCRYPTION_KEY,
118
118
  required: true,
@@ -135,7 +135,7 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
135
135
  required: true,
136
136
  description: 'Issuer name shown in authenticator apps for TOTP MFA.',
137
137
  },
138
- // MFA — SMS
138
+ // MFA - SMS
139
139
  {
140
140
  key: exports.AUTH_MFA_SMS_CODE_TTL,
141
141
  required: false,
@@ -148,7 +148,7 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
148
148
  defaultValue: '30s',
149
149
  description: 'Min interval between SMS resends.',
150
150
  },
151
- // MFA — Email
151
+ // MFA - Email
152
152
  {
153
153
  key: exports.AUTH_MFA_EMAIL_CODE_TTL,
154
154
  required: false,
@@ -161,7 +161,7 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
161
161
  defaultValue: '30s',
162
162
  description: 'Min interval between email resends.',
163
163
  },
164
- // MFA — Push
164
+ // MFA - Push
165
165
  {
166
166
  key: exports.AUTH_MFA_PUSH_CODE_TTL,
167
167
  required: false,