@breadstone/archipel-platform-authentication 0.0.5 → 0.0.7

package/package.json

@@ -1,10 +1,26 @@
 {
   "name": "@breadstone/archipel-platform-authentication",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "JWT and OAuth authentication, MFA, session management, and email verification for NestJS applications.",
   "type": "commonjs",
   "main": "./src/index.js",
   "types": "./src/index.d.ts",
+  "typesVersions": {
+    "*": {
+      "apple": [
+        "./src/apple/index.d.ts"
+      ],
+      "github": [
+        "./src/github/index.d.ts"
+      ],
+      "google": [
+        "./src/google/index.d.ts"
+      ],
+      "microsoft": [
+        "./src/microsoft/index.d.ts"
+      ]
+    }
+  },
   "exports": {
     ".": {
       "types": "./src/index.d.ts",
@@ -57,7 +73,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@breadstone/archipel-platform-core": "0.0.5",
+    "@breadstone/archipel-platform-core": "0.0.7",
     "passport": "0.7.0",
     "passport-custom": "1.1.1",
     "passport-jwt": "4.0.1",

package/src/apple/env.js

@@ -16,5 +16,11 @@ exports.APPLE_AUTH_CONFIG_ENTRIES = [
         defaultValue: '/auth/apple/callback',
         description: 'Apple Sign-In callback URL.',
     },
+    {
+        key: env_1.AUTH_APPLE_SCOPE,
+        required: false,
+        defaultValue: 'name,email',
+        description: 'Comma-separated list of Apple Sign-In scopes.',
+    },
 ];
 //# sourceMappingURL=env.js.map

package/src/env.d.ts

@@ -29,6 +29,8 @@ export declare const AUTH_GOOGLE_CLIENT_ID: import("@breadstone/archipel-platfor
 export declare const AUTH_GOOGLE_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Google OAuth2 callback URL. */
 export declare const AUTH_GOOGLE_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). */
+export declare const AUTH_GOOGLE_SCOPE: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Microsoft OAuth2 client ID. */
 export declare const AUTH_MICROSOFT_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Microsoft OAuth2 client secret. */
@@ -37,6 +39,8 @@ export declare const AUTH_MICROSOFT_CLIENT_SECRET: import("@breadstone/archipel-
 export declare const AUTH_MICROSOFT_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Microsoft tenant ID or `'common'` for multi-tenant. */
 export declare const AUTH_MICROSOFT_TENANT: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). */
+export declare const AUTH_MICROSOFT_SCOPE: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Apple Sign-In private key (PEM string). */
 export declare const AUTH_APPLE_PRIVATE_KEY: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Apple Sign-In client (service) ID. */
@@ -47,12 +51,16 @@ export declare const AUTH_APPLE_TEAM_ID: import("@breadstone/archipel-platform-c
 export declare const AUTH_APPLE_KEY_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Apple Sign-In callback URL. */
 export declare const AUTH_APPLE_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). */
+export declare const AUTH_APPLE_SCOPE: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** GitHub OAuth client ID. */
 export declare const AUTH_GITHUB_CLIENT_ID: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** GitHub OAuth client secret. */
 export declare const AUTH_GITHUB_CLIENT_SECRET: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** GitHub OAuth callback URL. */
 export declare const AUTH_GITHUB_CALLBACK_URL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). */
+export declare const AUTH_GITHUB_SCOPE: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Username used for the anonymous seed user. */
 export declare const SEED_ANONYMOUS_USERNAME: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Core configuration entries required by `platform-authentication`. */

package/src/env.js

@@ -1,7 +1,7 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
+exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_SCOPE = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_SCOPE = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_SCOPE = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_SCOPE = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 // #endregion
 // ──────────────────────────────────────────────────────────────
@@ -52,6 +52,8 @@ exports.AUTH_GOOGLE_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('A
 exports.AUTH_GOOGLE_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CLIENT_SECRET');
 /** Google OAuth2 callback URL. */
 exports.AUTH_GOOGLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CALLBACK_URL');
+/** Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). */
+exports.AUTH_GOOGLE_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_SCOPE');
 // ──────────────────────────────────────────────────────────────
 // OAuth — Microsoft
 // ──────────────────────────────────────────────────────────────
@@ -63,6 +65,8 @@ exports.AUTH_MICROSOFT_CLIENT_SECRET = (0, archipel_platform_core_1.createConfig
 exports.AUTH_MICROSOFT_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_CALLBACK_URL');
 /** Microsoft tenant ID or `'common'` for multi-tenant. */
 exports.AUTH_MICROSOFT_TENANT = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_TENANT');
+/** Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). */
+exports.AUTH_MICROSOFT_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_SCOPE');
 // ──────────────────────────────────────────────────────────────
 // OAuth — Apple
 // ──────────────────────────────────────────────────────────────
@@ -76,6 +80,8 @@ exports.AUTH_APPLE_TEAM_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH
 exports.AUTH_APPLE_KEY_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_KEY_ID');
 /** Apple Sign-In callback URL. */
 exports.AUTH_APPLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_CALLBACK_URL');
+/** Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). */
+exports.AUTH_APPLE_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_SCOPE');
 // ──────────────────────────────────────────────────────────────
 // OAuth — GitHub
 // ──────────────────────────────────────────────────────────────
@@ -85,6 +91,8 @@ exports.AUTH_GITHUB_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('A
 exports.AUTH_GITHUB_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CLIENT_SECRET');
 /** GitHub OAuth callback URL. */
 exports.AUTH_GITHUB_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CALLBACK_URL');
+/** Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). */
+exports.AUTH_GITHUB_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_SCOPE');
 // ──────────────────────────────────────────────────────────────
 // Seed / Misc
 // ──────────────────────────────────────────────────────────────

package/src/github/env.js

@@ -14,5 +14,11 @@ exports.GITHUB_AUTH_CONFIG_ENTRIES = [
         defaultValue: '/auth/github/callback',
         description: 'GitHub OAuth callback URL.',
     },
+    {
+        key: env_1.AUTH_GITHUB_SCOPE,
+        required: false,
+        defaultValue: 'user:email',
+        description: 'Comma-separated list of GitHub OAuth scopes.',
+    },
 ];
 //# sourceMappingURL=env.js.map

package/src/google/env.js

@@ -14,5 +14,11 @@ exports.GOOGLE_AUTH_CONFIG_ENTRIES = [
         defaultValue: '/auth/google/callback',
         description: 'Google OAuth2 callback URL.',
     },
+    {
+        key: env_1.AUTH_GOOGLE_SCOPE,
+        required: false,
+        defaultValue: 'email,profile',
+        description: 'Comma-separated list of Google OAuth scopes.',
+    },
 ];
 //# sourceMappingURL=env.js.map

package/src/microsoft/env.js

@@ -15,5 +15,11 @@ exports.MICROSOFT_AUTH_CONFIG_ENTRIES = [
         description: 'Microsoft OAuth2 callback URL.',
     },
     { key: env_1.AUTH_MICROSOFT_TENANT, required: false, defaultValue: 'common', description: 'Microsoft tenant ID.' },
+    {
+        key: env_1.AUTH_MICROSOFT_SCOPE,
+        required: false,
+        defaultValue: 'user.read',
+        description: 'Comma-separated list of Microsoft OAuth scopes.',
+    },
 ];
 //# sourceMappingURL=env.js.map

package/src/strategies/AppleStrategy.js

@@ -26,13 +26,18 @@ let AppleStrategy = class AppleStrategy extends (0, passport_1.PassportStrategy)
     constructor(socialAuth, configService) {
         const rawPrivateKey = configService.get('AUTH_APPLE_PRIVATE_KEY');
         const normalizedPrivateKey = rawPrivateKey.replace(/\r/g, '').replace(/\\n/g, '\n');
+        const scope = configService
+            .tryGet('AUTH_APPLE_SCOPE', 'name,email')
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean);
         super({
             clientID: configService.get('AUTH_APPLE_CLIENT_ID'),
             teamID: configService.get('AUTH_APPLE_TEAM_ID'),
             keyID: configService.get('AUTH_APPLE_KEY_ID'),
             callbackURL: configService.tryGet('AUTH_APPLE_CALLBACK_URL', '/auth/apple/callback'),
             privateKeyString: normalizedPrivateKey,
-            scope: ['name', 'email'],
+            scope,
             state: true,
         });
         this._socialAuth = socialAuth;

package/src/strategies/GithubStrategy.js

@@ -20,10 +20,16 @@ let GithubStrategy = class GithubStrategy extends (0, passport_1.PassportStrateg
      * @param configService Configuration service instance.
      */
     constructor(socialAuth, configService) {
+        const scope = configService
+            .tryGet('AUTH_GITHUB_SCOPE', 'user:email')
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean);
         super({
             clientID: configService.get('AUTH_GITHUB_CLIENT_ID'),
             clientSecret: configService.get('AUTH_GITHUB_CLIENT_SECRET'),
             callbackURL: configService.tryGet('AUTH_GITHUB_CALLBACK_URL', '/auth/github/callback'),
+            scope,
         });
         this._socialAuth = socialAuth;
     }

package/src/strategies/GoogleStrategy.js

@@ -25,11 +25,16 @@ let GoogleStrategy = class GoogleStrategy extends (0, passport_1.PassportStrateg
      * @param configService Configuration service instance.
      */
     constructor(socialAuth, configService) {
+        const scope = configService
+            .tryGet('AUTH_GOOGLE_SCOPE', 'email,profile')
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean);
         super({
             clientID: configService.get('AUTH_GOOGLE_CLIENT_ID'),
             clientSecret: configService.get('AUTH_GOOGLE_CLIENT_SECRET'),
             callbackURL: configService.tryGet('AUTH_GOOGLE_CALLBACK_URL', '/auth/google/callback'),
-            scope: ['email', 'profile'],
+            scope,
             state: true,
         });
         this._socialAuth = socialAuth;

package/src/strategies/MicrosoftStrategy.js

@@ -25,12 +25,17 @@ let MicrosoftStrategy = class MicrosoftStrategy extends (0, passport_1.PassportS
      * @param configService Configuration service instance.
      */
     constructor(socialAuth, configService) {
+        const scope = configService
+            .tryGet('AUTH_MICROSOFT_SCOPE', 'user.read')
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean);
         super({
             clientID: configService.get('AUTH_MICROSOFT_CLIENT_ID'),
             clientSecret: configService.get('AUTH_MICROSOFT_CLIENT_SECRET'),
             callbackURL: configService.tryGet('AUTH_MICROSOFT_CALLBACK_URL', '/auth/microsoft/callback'),
             tenant: configService.tryGet('AUTH_MICROSOFT_TENANT', 'common'),
-            scope: ['user.read'],
+            scope,
             state: true,
         });
         this._socialAuth = socialAuth;