@breadstone/archipel-platform-authentication 0.0.23 → 0.0.25
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -2,24 +2,34 @@
|
|
|
2
2
|
|
|
3
3
|
Authentication and authorization infrastructure for NestJS applications.
|
|
4
4
|
|
|
5
|
-
##
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
|
18
|
-
|
|
|
19
|
-
| `
|
|
20
|
-
| `
|
|
21
|
-
| `
|
|
22
|
-
| `
|
|
5
|
+
## Features
|
|
6
|
+
|
|
7
|
+
- **JWT authentication** — Access/refresh token issuance and validation
|
|
8
|
+
- **Social OAuth** — Google, Microsoft, Apple, and GitHub connectors
|
|
9
|
+
- **MFA/TOTP** — Multi-factor authentication with challenge store
|
|
10
|
+
- **Anonymous sessions** — Seeded anonymous user support
|
|
11
|
+
- **Pluggable ports** — All persistence and enrichment via injectable adapters
|
|
12
|
+
- **NestJS guards & decorators** — Ready-made guards for route protection
|
|
13
|
+
- **Health checks** — `AuthenticationHealthIndicator` for readiness probes (separate `/health` subpath)
|
|
14
|
+
|
|
15
|
+
## ⚠️ Environment Variables
|
|
16
|
+
|
|
17
|
+
| Variable | Required | Default | Description |
|
|
18
|
+
| ------------------------------ | -------- | ------- | ----------------------------------------- |
|
|
19
|
+
| `AUTH_JWT_SECRET` | yes | - | JWT signing secret |
|
|
20
|
+
| `AUTH_JWT_EXPIRES_IN` | yes | - | Access token expiry (e.g. `15m`) |
|
|
21
|
+
| `AUTH_VERIFY_JWT_EXPIRES_IN` | yes | - | Verification token expiry |
|
|
22
|
+
| `AUTH_GOOGLE_CLIENT_ID` | yes | - | Google OAuth client ID |
|
|
23
|
+
| `AUTH_GOOGLE_CLIENT_SECRET` | yes | - | Google OAuth client secret |
|
|
24
|
+
| `AUTH_MICROSOFT_CLIENT_ID` | yes | - | Microsoft OAuth client ID |
|
|
25
|
+
| `AUTH_MICROSOFT_CLIENT_SECRET` | yes | - | Microsoft OAuth client secret |
|
|
26
|
+
| `AUTH_APPLE_PRIVATE_KEY` | yes | - | Apple Sign-In private key (PEM) |
|
|
27
|
+
| `AUTH_APPLE_CLIENT_ID` | yes | - | Apple Sign-In client (service) ID |
|
|
28
|
+
| `AUTH_APPLE_TEAM_ID` | yes | - | Apple developer team ID |
|
|
29
|
+
| `AUTH_APPLE_KEY_ID` | yes | - | Apple Sign-In key ID |
|
|
30
|
+
| `AUTH_GITHUB_CLIENT_ID` | yes | - | GitHub OAuth client ID |
|
|
31
|
+
| `AUTH_GITHUB_CLIENT_SECRET` | yes | - | GitHub OAuth client secret |
|
|
32
|
+
| `SEED_ANONYMOUS_USERNAME` | yes | - | Username for the seeded anonymous account |
|
|
23
33
|
|
|
24
34
|
For the full list (including MFA/OAuth callback defaults), see [`../../ENVIRONMENT_VARIABLES.md`](../../ENVIRONMENT_VARIABLES.md).
|
|
25
35
|
|
|
@@ -35,15 +45,34 @@ import { AuthModule } from '@breadstone/archipel-platform-authentication';
|
|
|
35
45
|
mfaSubject: PrismaMfaSubjectAdapter,
|
|
36
46
|
sessionPersistence: PrismaSessionAdapter,
|
|
37
47
|
verificationSubject: PrismaVerificationAdapter,
|
|
38
|
-
challengeStore: RedisChallengeStore, // optional
|
|
39
|
-
socialAuth: PrismaSocialAuthAdapter, // optional
|
|
40
|
-
tokenEnricher: AppTokenEnricherAdapter, // optional
|
|
48
|
+
challengeStore: RedisChallengeStore, // optional — defaults to in-memory
|
|
49
|
+
socialAuth: PrismaSocialAuthAdapter, // optional — enables OAuth
|
|
50
|
+
tokenEnricher: AppTokenEnricherAdapter, // optional — enriches JWT claims
|
|
41
51
|
}),
|
|
42
52
|
],
|
|
43
53
|
})
|
|
44
54
|
export class AppModule {}
|
|
45
55
|
```
|
|
46
56
|
|
|
57
|
+
## Import Options
|
|
58
|
+
|
|
59
|
+
```typescript
|
|
60
|
+
// Main import (module, guards, ports)
|
|
61
|
+
import { AuthModule, AuthSubjectPort, SessionPersistencePort } from '@breadstone/archipel-platform-authentication';
|
|
62
|
+
|
|
63
|
+
// Social auth connectors (tree-shakable sub-exports)
|
|
64
|
+
import { GoogleConnector } from '@breadstone/archipel-platform-authentication/connectors/google';
|
|
65
|
+
import { MicrosoftConnector } from '@breadstone/archipel-platform-authentication/connectors/microsoft';
|
|
66
|
+
import { AppleConnector } from '@breadstone/archipel-platform-authentication/connectors/apple';
|
|
67
|
+
import { GithubConnector } from '@breadstone/archipel-platform-authentication/connectors/github';
|
|
68
|
+
|
|
69
|
+
// MFA/TOTP
|
|
70
|
+
import { TotpService } from '@breadstone/archipel-platform-authentication/mfa/totp';
|
|
71
|
+
|
|
72
|
+
// Health indicator (optional)
|
|
73
|
+
import { AuthenticationHealthIndicator } from '@breadstone/archipel-platform-authentication/health';
|
|
74
|
+
```
|
|
75
|
+
|
|
47
76
|
## Ports
|
|
48
77
|
|
|
49
78
|
| Port | Required | Description |
|
|
@@ -56,6 +85,30 @@ export class AppModule {}
|
|
|
56
85
|
| `SocialAuthPort` | No | OAuth user creation/linking |
|
|
57
86
|
| `TokenEnricherPort` | No | Custom JWT claim injection |
|
|
58
87
|
|
|
88
|
+
## Resource Limits
|
|
89
|
+
|
|
90
|
+
| Limit | Value | Description |
|
|
91
|
+
| ------------------------------ | ------ | ---------------------------------------------------------------- |
|
|
92
|
+
| In-memory challenge store size | 10,000 | `InMemoryChallengeStore` max entries; oldest evicted on overflow |
|
|
93
|
+
|
|
94
|
+
## Lifecycle
|
|
95
|
+
|
|
96
|
+
- **Shutdown (`OnModuleDestroy`):** `InMemoryChallengeStore` clears its cleanup interval.
|
|
97
|
+
|
|
98
|
+
## Peer Dependencies
|
|
99
|
+
|
|
100
|
+
| Package | Required | Notes |
|
|
101
|
+
| -------------------------------------- | -------- | ----------------------------- |
|
|
102
|
+
| `@nestjs/common` | Yes | NestJS core |
|
|
103
|
+
| `@nestjs/jwt` | Yes | JWT token handling |
|
|
104
|
+
| `class-validator` | Yes | DTO validation |
|
|
105
|
+
| `class-transformer` | Yes | DTO transformation |
|
|
106
|
+
| `passport` | Yes | Authentication middleware |
|
|
107
|
+
| `passport-jwt` | Yes | JWT passport strategy |
|
|
108
|
+
| `google-auth-library` | No | Required for Google connector |
|
|
109
|
+
| `@breadstone/archipel-platform-health` | No | Required for health indicator |
|
|
110
|
+
| `@nestjs/terminus` | No | Required for health indicator |
|
|
111
|
+
|
|
59
112
|
## Documentation
|
|
60
113
|
|
|
61
114
|
📖 **Auth Guide:** [`.docs/guides/authentication-and-authorization.md`](../../.docs/guides/authentication-and-authorization.md)
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@breadstone/archipel-platform-authentication",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.25",
|
|
4
4
|
"description": "JWT and OAuth authentication, MFA, session management, and email verification for NestJS applications.",
|
|
5
5
|
"type": "commonjs",
|
|
6
6
|
"main": "./src/index.js",
|
|
@@ -21,6 +21,9 @@
|
|
|
21
21
|
],
|
|
22
22
|
"mfa/totp": [
|
|
23
23
|
"./src/mfa/totp/index.d.ts"
|
|
24
|
+
],
|
|
25
|
+
"health": [
|
|
26
|
+
"./src/health/index.d.ts"
|
|
24
27
|
]
|
|
25
28
|
}
|
|
26
29
|
},
|
|
@@ -49,12 +52,17 @@
|
|
|
49
52
|
"types": "./src/mfa/totp/index.d.ts",
|
|
50
53
|
"default": "./src/mfa/totp/index.js"
|
|
51
54
|
},
|
|
55
|
+
"./health": {
|
|
56
|
+
"types": "./src/health/index.d.ts",
|
|
57
|
+
"default": "./src/health/index.js"
|
|
58
|
+
},
|
|
52
59
|
"./package.json": "./package.json",
|
|
53
60
|
"./connectors/apple/index": "./src/connectors/apple/index.js",
|
|
54
61
|
"./connectors/github/index": "./src/connectors/github/index.js",
|
|
55
62
|
"./connectors/google/index": "./src/connectors/google/index.js",
|
|
56
63
|
"./connectors/microsoft/index": "./src/connectors/microsoft/index.js",
|
|
57
|
-
"./mfa/totp/index": "./src/mfa/totp/index.js"
|
|
64
|
+
"./mfa/totp/index": "./src/mfa/totp/index.js",
|
|
65
|
+
"./health/index": "./src/health/index.js"
|
|
58
66
|
},
|
|
59
67
|
"license": "MIT",
|
|
60
68
|
"repository": {
|
|
@@ -81,19 +89,20 @@
|
|
|
81
89
|
"README.md"
|
|
82
90
|
],
|
|
83
91
|
"dependencies": {
|
|
84
|
-
"@breadstone/archipel-platform-configuration": "0.0.
|
|
85
|
-
"@breadstone/archipel-platform-core": "0.0.
|
|
86
|
-
"@breadstone/archipel-platform-cryptography": "0.0.
|
|
87
|
-
"@breadstone/archipel-platform-mapping": "0.0.
|
|
88
|
-
"@breadstone/archipel-platform-resources": "0.0.23",
|
|
92
|
+
"@breadstone/archipel-platform-configuration": "0.0.25",
|
|
93
|
+
"@breadstone/archipel-platform-core": "0.0.25",
|
|
94
|
+
"@breadstone/archipel-platform-cryptography": "0.0.25",
|
|
95
|
+
"@breadstone/archipel-platform-mapping": "0.0.25",
|
|
89
96
|
"tslib": "2.8.1"
|
|
90
97
|
},
|
|
91
98
|
"peerDependencies": {
|
|
99
|
+
"@breadstone/archipel-platform-health": ">=0.0.1",
|
|
92
100
|
"@nestjs/common": ">=11.0.0",
|
|
93
101
|
"@nestjs/core": ">=11.0.0",
|
|
94
102
|
"@nestjs/jwt": ">=11.0.0",
|
|
95
103
|
"@nestjs/passport": ">=11.0.0",
|
|
96
104
|
"@nestjs/swagger": ">=11.0.0",
|
|
105
|
+
"@nestjs/terminus": ">=11.0.0",
|
|
97
106
|
"class-transformer": ">=0.5.0",
|
|
98
107
|
"class-validator": ">=0.14.0",
|
|
99
108
|
"express": ">=5.0.0",
|
|
@@ -108,6 +117,12 @@
|
|
|
108
117
|
"rxjs": ">=7.0.0"
|
|
109
118
|
},
|
|
110
119
|
"peerDependenciesMeta": {
|
|
120
|
+
"@breadstone/archipel-platform-health": {
|
|
121
|
+
"optional": true
|
|
122
|
+
},
|
|
123
|
+
"@nestjs/terminus": {
|
|
124
|
+
"optional": true
|
|
125
|
+
},
|
|
111
126
|
"passport-apple": {
|
|
112
127
|
"optional": true
|
|
113
128
|
},
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import { IHealthIndicator } from '@breadstone/archipel-platform-health';
|
|
2
|
+
import { HealthIndicatorResult } from '@nestjs/terminus';
|
|
3
|
+
/**
|
|
4
|
+
* Health indicator for the authentication infrastructure.
|
|
5
|
+
*
|
|
6
|
+
* @public
|
|
7
|
+
*/
|
|
8
|
+
export declare class AuthenticationHealthIndicator implements IHealthIndicator {
|
|
9
|
+
readonly key: string;
|
|
10
|
+
/**
|
|
11
|
+
* Returns the health status of the authentication infrastructure.
|
|
12
|
+
*
|
|
13
|
+
* @public
|
|
14
|
+
* @returns The health indicator result.
|
|
15
|
+
*/
|
|
16
|
+
check(): HealthIndicatorResult<string>;
|
|
17
|
+
}
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
// #region Imports
|
|
3
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
4
|
+
exports.AuthenticationHealthIndicator = void 0;
|
|
5
|
+
const tslib_1 = require("tslib");
|
|
6
|
+
const common_1 = require("@nestjs/common");
|
|
7
|
+
// #endregion
|
|
8
|
+
/**
|
|
9
|
+
* Health indicator for the authentication infrastructure.
|
|
10
|
+
*
|
|
11
|
+
* @public
|
|
12
|
+
*/
|
|
13
|
+
let AuthenticationHealthIndicator = class AuthenticationHealthIndicator {
|
|
14
|
+
constructor() {
|
|
15
|
+
// #region Properties
|
|
16
|
+
this.key = 'authentication';
|
|
17
|
+
// #endregion
|
|
18
|
+
}
|
|
19
|
+
// #endregion
|
|
20
|
+
// #region Methods
|
|
21
|
+
/**
|
|
22
|
+
* Returns the health status of the authentication infrastructure.
|
|
23
|
+
*
|
|
24
|
+
* @public
|
|
25
|
+
* @returns The health indicator result.
|
|
26
|
+
*/
|
|
27
|
+
check() {
|
|
28
|
+
return {
|
|
29
|
+
[this.key]: {
|
|
30
|
+
status: 'up',
|
|
31
|
+
},
|
|
32
|
+
};
|
|
33
|
+
}
|
|
34
|
+
};
|
|
35
|
+
exports.AuthenticationHealthIndicator = AuthenticationHealthIndicator;
|
|
36
|
+
exports.AuthenticationHealthIndicator = AuthenticationHealthIndicator = tslib_1.__decorate([
|
|
37
|
+
(0, common_1.Injectable)()
|
|
38
|
+
], AuthenticationHealthIndicator);
|
|
39
|
+
//# sourceMappingURL=AuthenticationHealthIndicator.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export { AuthenticationHealthIndicator } from './AuthenticationHealthIndicator';
|
|
@@ -0,0 +1,6 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
+
exports.AuthenticationHealthIndicator = void 0;
|
|
4
|
+
var AuthenticationHealthIndicator_1 = require("./AuthenticationHealthIndicator");
|
|
5
|
+
Object.defineProperty(exports, "AuthenticationHealthIndicator", { enumerable: true, get: function () { return AuthenticationHealthIndicator_1.AuthenticationHealthIndicator; } });
|
|
6
|
+
//# sourceMappingURL=index.js.map
|