@breadstone/archipel-platform-authentication 0.0.8 → 0.0.10

package/src/{strategies/GoogleStrategy.js → connectors/GoogleConnector.js}

@@ -1,24 +1,25 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GoogleStrategy = void 0;
+exports.GoogleConnector = void 0;
 const tslib_1 = require("tslib");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
 const passport_google_oauth20_1 = require("passport-google-oauth20");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
+const env_1 = require("../env");
+const ConnectorBase_1 = require("./ConnectorBase");
 // #endregion
 /**
- * The `GoogleStrategy` integrates Google OAuth authentication.
+ * The `GoogleConnector` integrates Google OAuth authentication.
  *
  * @public
  */
-let GoogleStrategy = class GoogleStrategy extends (0, passport_1.PassportStrategy)(passport_google_oauth20_1.Strategy, 'google') {
+let GoogleConnector = class GoogleConnector extends (0, ConnectorBase_1.ConnectorBase)(passport_google_oauth20_1.Strategy, 'google') {
     // #endregion
     // #region Ctor
     /**
-     * Initializes a new instance of the `GoogleStrategy` class.
+     * Initializes a new instance of the `GoogleConnector` class.
      *
      * @public
      * @param socialAuth Social auth port instance.
@@ -26,14 +27,14 @@ let GoogleStrategy = class GoogleStrategy extends (0, passport_1.PassportStrateg
      */
     constructor(socialAuth, configService) {
         const scope = configService
-            .tryGet('AUTH_GOOGLE_SCOPE', 'email,profile')
+            .tryGet(env_1.AUTH_GOOGLE_SCOPE.key, 'email,profile')
             .split(',')
             .map((s) => s.trim())
             .filter(Boolean);
         super({
-            clientID: configService.get('AUTH_GOOGLE_CLIENT_ID'),
-            clientSecret: configService.get('AUTH_GOOGLE_CLIENT_SECRET'),
-            callbackURL: configService.tryGet('AUTH_GOOGLE_CALLBACK_URL', '/auth/google/callback'),
+            clientID: configService.get(env_1.AUTH_GOOGLE_CLIENT_ID.key),
+            clientSecret: configService.get(env_1.AUTH_GOOGLE_CLIENT_SECRET.key),
+            callbackURL: configService.tryGet(env_1.AUTH_GOOGLE_CALLBACK_URL.key, '/auth/google/callback'),
             scope,
             state: true,
         });
@@ -71,9 +72,9 @@ let GoogleStrategy = class GoogleStrategy extends (0, passport_1.PassportStrateg
         return user;
     }
 };
-exports.GoogleStrategy = GoogleStrategy;
-exports.GoogleStrategy = GoogleStrategy = tslib_1.__decorate([
+exports.GoogleConnector = GoogleConnector;
+exports.GoogleConnector = GoogleConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
-], GoogleStrategy);
-//# sourceMappingURL=GoogleStrategy.js.map
+], GoogleConnector);
+//# sourceMappingURL=GoogleConnector.js.map

package/src/{strategies/JwtStrategy.d.ts → connectors/JwtConnector.d.ts}

@@ -1,18 +1,28 @@
 import { ConfigService } from '@breadstone/archipel-platform-core';
-import { Strategy } from 'passport-jwt';
 import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { JwtPayloadBase } from '../models/JwtPayloadBase';
-declare const JwtStrategy_base: new (...args: [opt: import("passport-jwt").StrategyOptionsWithRequest] | [opt: import("passport-jwt").StrategyOptionsWithoutRequest]) => Strategy & {
-    validate(...args: any[]): unknown;
+declare const JwtConnector_base: (abstract new (...args: any[]) => {
+    [x: string]: any;
+    validate(...args: unknown[]): Promise<unknown>;
+}) & {
+    apply(this: Function, thisArg: any, argArray?: any): any;
+    call(this: Function, thisArg: any, ...argArray: any[]): any;
+    bind(this: Function, thisArg: any, ...argArray: any[]): any;
+    toString(): string;
+    readonly length: number;
+    arguments: any;
+    caller: Function;
+    readonly name: string;
+    [Symbol.hasInstance](value: any): boolean;
 };
 /**
- * JWT strategy for handling token validation.
+ * JWT connector for handling token validation.
  */
-export declare class JwtStrategy extends JwtStrategy_base {
+export declare class JwtConnector extends JwtConnector_base {
     private readonly _authSubject;
     /**
-     * Constructs a new instance of the `JwtStrategy` class.
+     * Constructs a new instance of the `JwtConnector` class.
      *
      * @public
      * @param authSubject Auth subject port instance.

package/src/{strategies/JwtStrategy.js → connectors/JwtConnector.js}

@@ -1,22 +1,23 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JwtStrategy = void 0;
+exports.JwtConnector = void 0;
 const tslib_1 = require("tslib");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
 const passport_jwt_1 = require("passport-jwt");
 const AuthSubjectPort_1 = require("../contracts/AuthSubjectPort");
+const env_1 = require("../env");
+const ConnectorBase_1 = require("./ConnectorBase");
 // #endregion
 /**
- * JWT strategy for handling token validation.
+ * JWT connector for handling token validation.
  */
-let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy) {
+let JwtConnector = class JwtConnector extends (0, ConnectorBase_1.ConnectorBase)(passport_jwt_1.Strategy) {
     // #endregion
     // #region Ctor
     /**
-     * Constructs a new instance of the `JwtStrategy` class.
+     * Constructs a new instance of the `JwtConnector` class.
      *
      * @public
      * @param authSubject Auth subject port instance.
@@ -26,7 +27,7 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
         super({
             jwtFromRequest: passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
             ignoreExpiration: false, // Optional: Allow or disallow expired tokens
-            secretOrKey: configService.get('AUTH_JWT_SECRET'), // The secret used for signing tokens
+            secretOrKey: configService.get(env_1.AUTH_JWT_SECRET.key), // The secret used for signing tokens
         });
         this._authSubject = authSubject;
     }
@@ -47,9 +48,9 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
         return user;
     }
 };
-exports.JwtStrategy = JwtStrategy;
-exports.JwtStrategy = JwtStrategy = tslib_1.__decorate([
+exports.JwtConnector = JwtConnector;
+exports.JwtConnector = JwtConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_core_1.ConfigService])
-], JwtStrategy);
-//# sourceMappingURL=JwtStrategy.js.map
+], JwtConnector);
+//# sourceMappingURL=JwtConnector.js.map

package/src/{strategies/LocalStrategy.d.ts → connectors/LocalConnector.d.ts}

@@ -1,20 +1,30 @@
 import { BcryptService } from '@breadstone/archipel-platform-cryptography';
-import { Strategy } from 'passport-local';
 import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
-declare const LocalStrategy_base: new (...args: [] | [options: import("passport-local").IStrategyOptionsWithRequest] | [options: import("passport-local").IStrategyOptions]) => Strategy & {
-    validate(...args: any[]): unknown;
+declare const LocalConnector_base: (abstract new (...args: any[]) => {
+    [x: string]: any;
+    validate(...args: unknown[]): Promise<unknown>;
+}) & {
+    apply(this: Function, thisArg: any, argArray?: any): any;
+    call(this: Function, thisArg: any, ...argArray: any[]): any;
+    bind(this: Function, thisArg: any, ...argArray: any[]): any;
+    toString(): string;
+    readonly length: number;
+    arguments: any;
+    caller: Function;
+    readonly name: string;
+    [Symbol.hasInstance](value: any): boolean;
 };
 /**
- * Local strategy for user name and password login.
+ * Local connector for user name and password login.
  *
  * @public
  */
-export declare class LocalStrategy extends LocalStrategy_base {
+export declare class LocalConnector extends LocalConnector_base {
     private readonly _authSubject;
     private readonly _bcryptService;
     /**
-     * Constructs a new instance of the `LocalStrategy` class.
+     * Constructs a new instance of the `LocalConnector` class.
      *
      * @public
      * @param authSubject Auth subject port instance.

package/src/{strategies/LocalStrategy.js → connectors/LocalConnector.js}

@@ -1,24 +1,24 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LocalStrategy = void 0;
+exports.LocalConnector = void 0;
 const tslib_1 = require("tslib");
 const archipel_platform_cryptography_1 = require("@breadstone/archipel-platform-cryptography");
 const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
 const passport_local_1 = require("passport-local");
 const AuthSubjectPort_1 = require("../contracts/AuthSubjectPort");
+const ConnectorBase_1 = require("./ConnectorBase");
 // #endregion
 /**
- * Local strategy for user name and password login.
+ * Local connector for user name and password login.
  *
  * @public
  */
-let LocalStrategy = class LocalStrategy extends (0, passport_1.PassportStrategy)(passport_local_1.Strategy) {
+let LocalConnector = class LocalConnector extends (0, ConnectorBase_1.ConnectorBase)(passport_local_1.Strategy) {
     // #endregion
     // #region Ctor
     /**
-     * Constructs a new instance of the `LocalStrategy` class.
+     * Constructs a new instance of the `LocalConnector` class.
      *
      * @public
      * @param authSubject Auth subject port instance.
@@ -51,9 +51,9 @@ let LocalStrategy = class LocalStrategy extends (0, passport_1.PassportStrategy)
         return user;
     }
 };
-exports.LocalStrategy = LocalStrategy;
-exports.LocalStrategy = LocalStrategy = tslib_1.__decorate([
+exports.LocalConnector = LocalConnector;
+exports.LocalConnector = LocalConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_cryptography_1.BcryptService])
-], LocalStrategy);
-//# sourceMappingURL=LocalStrategy.js.map
+], LocalConnector);
+//# sourceMappingURL=LocalConnector.js.map

package/src/{strategies/MicrosoftStrategy.d.ts → connectors/MicrosoftConnector.d.ts}

@@ -1,20 +1,30 @@
 import { ConfigService } from '@breadstone/archipel-platform-core';
 import type { Profile as PassportProfile } from 'passport';
-import { Strategy } from 'passport-microsoft';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { SocialAuthPort } from '../contracts/SocialAuthPort';
-declare const MicrosoftStrategy_base: new (...args: [options: import("passport-microsoft").MicrosoftStrategyOptionsWithRequest] | [options: import("passport-microsoft").MicrosoftStrategyOptions]) => Strategy & {
-    validate(...args: any[]): unknown;
+declare const MicrosoftConnector_base: (abstract new (...args: any[]) => {
+    [x: string]: any;
+    validate(...args: unknown[]): Promise<unknown>;
+}) & {
+    apply(this: Function, thisArg: any, argArray?: any): any;
+    call(this: Function, thisArg: any, ...argArray: any[]): any;
+    bind(this: Function, thisArg: any, ...argArray: any[]): any;
+    toString(): string;
+    readonly length: number;
+    arguments: any;
+    caller: Function;
+    readonly name: string;
+    [Symbol.hasInstance](value: any): boolean;
 };
 /**
- * The `MicrosoftStrategy` integrates Microsoft OAuth authentication.
+ * The `MicrosoftConnector` integrates Microsoft OAuth authentication.
  *
  * @public
  */
-export declare class MicrosoftStrategy extends MicrosoftStrategy_base {
+export declare class MicrosoftConnector extends MicrosoftConnector_base {
     private readonly _socialAuth;
     /**
-     * Initializes a new instance of the `MicrosoftStrategy` class.
+     * Initializes a new instance of the `MicrosoftConnector` class.
      *
      * @public
      * @param socialAuth Social auth port instance.

package/src/{strategies/MicrosoftStrategy.js → connectors/MicrosoftConnector.js}

@@ -1,24 +1,25 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MicrosoftStrategy = void 0;
+exports.MicrosoftConnector = void 0;
 const tslib_1 = require("tslib");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
 const passport_microsoft_1 = require("passport-microsoft");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
+const env_1 = require("../env");
+const ConnectorBase_1 = require("./ConnectorBase");
 // #endregion
 /**
- * The `MicrosoftStrategy` integrates Microsoft OAuth authentication.
+ * The `MicrosoftConnector` integrates Microsoft OAuth authentication.
  *
  * @public
  */
-let MicrosoftStrategy = class MicrosoftStrategy extends (0, passport_1.PassportStrategy)(passport_microsoft_1.Strategy, 'microsoft') {
+let MicrosoftConnector = class MicrosoftConnector extends (0, ConnectorBase_1.ConnectorBase)(passport_microsoft_1.Strategy, 'microsoft') {
     // #endregion
     // #region Ctor
     /**
-     * Initializes a new instance of the `MicrosoftStrategy` class.
+     * Initializes a new instance of the `MicrosoftConnector` class.
      *
      * @public
      * @param socialAuth Social auth port instance.
@@ -26,15 +27,15 @@ let MicrosoftStrategy = class MicrosoftStrategy extends (0, passport_1.PassportS
      */
     constructor(socialAuth, configService) {
         const scope = configService
-            .tryGet('AUTH_MICROSOFT_SCOPE', 'user.read')
+            .tryGet(env_1.AUTH_MICROSOFT_SCOPE.key, 'user.read')
             .split(',')
             .map((s) => s.trim())
             .filter(Boolean);
         super({
-            clientID: configService.get('AUTH_MICROSOFT_CLIENT_ID'),
-            clientSecret: configService.get('AUTH_MICROSOFT_CLIENT_SECRET'),
-            callbackURL: configService.tryGet('AUTH_MICROSOFT_CALLBACK_URL', '/auth/microsoft/callback'),
-            tenant: configService.tryGet('AUTH_MICROSOFT_TENANT', 'common'),
+            clientID: configService.get(env_1.AUTH_MICROSOFT_CLIENT_ID.key),
+            clientSecret: configService.get(env_1.AUTH_MICROSOFT_CLIENT_SECRET.key),
+            callbackURL: configService.tryGet(env_1.AUTH_MICROSOFT_CALLBACK_URL.key, '/auth/microsoft/callback'),
+            tenant: configService.tryGet(env_1.AUTH_MICROSOFT_TENANT.key, 'common'),
             scope,
             state: true,
         });
@@ -72,9 +73,9 @@ let MicrosoftStrategy = class MicrosoftStrategy extends (0, passport_1.PassportS
         return user;
     }
 };
-exports.MicrosoftStrategy = MicrosoftStrategy;
-exports.MicrosoftStrategy = MicrosoftStrategy = tslib_1.__decorate([
+exports.MicrosoftConnector = MicrosoftConnector;
+exports.MicrosoftConnector = MicrosoftConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
-], MicrosoftStrategy);
-//# sourceMappingURL=MicrosoftStrategy.js.map
+], MicrosoftConnector);
+//# sourceMappingURL=MicrosoftConnector.js.map

package/src/{apple → connectors/apple}/env.js

@@ -2,7 +2,7 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.APPLE_AUTH_CONFIG_ENTRIES = void 0;
-const env_1 = require("../env");
+const env_1 = require("../../env");
 // #endregion
 /** Configuration entries required by Apple Sign-In authentication. */
 exports.APPLE_AUTH_CONFIG_ENTRIES = [

package/src/connectors/apple/index.d.ts

@@ -0,0 +1,2 @@
+export { AppleConnector } from '../AppleConnector';
+export { APPLE_AUTH_CONFIG_ENTRIES } from './env';

package/src/connectors/apple/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPLE_AUTH_CONFIG_ENTRIES = exports.AppleConnector = void 0;
+var AppleConnector_1 = require("../AppleConnector");
+Object.defineProperty(exports, "AppleConnector", { enumerable: true, get: function () { return AppleConnector_1.AppleConnector; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "APPLE_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.APPLE_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/{github → connectors/github}/env.js

@@ -2,7 +2,7 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GITHUB_AUTH_CONFIG_ENTRIES = void 0;
-const env_1 = require("../env");
+const env_1 = require("../../env");
 // #endregion
 /** Configuration entries required by GitHub OAuth authentication. */
 exports.GITHUB_AUTH_CONFIG_ENTRIES = [

package/src/connectors/github/index.d.ts

@@ -0,0 +1,2 @@
+export { GithubConnector } from '../GithubConnector';
+export { GITHUB_AUTH_CONFIG_ENTRIES } from './env';

package/src/connectors/github/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_AUTH_CONFIG_ENTRIES = exports.GithubConnector = void 0;
+var GithubConnector_1 = require("../GithubConnector");
+Object.defineProperty(exports, "GithubConnector", { enumerable: true, get: function () { return GithubConnector_1.GithubConnector; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "GITHUB_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.GITHUB_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/{google → connectors/google}/env.js

@@ -2,7 +2,7 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GOOGLE_AUTH_CONFIG_ENTRIES = void 0;
-const env_1 = require("../env");
+const env_1 = require("../../env");
 // #endregion
 /** Configuration entries required by Google OAuth authentication. */
 exports.GOOGLE_AUTH_CONFIG_ENTRIES = [

package/src/connectors/google/index.d.ts

@@ -0,0 +1,2 @@
+export { GoogleConnector } from '../GoogleConnector';
+export { GOOGLE_AUTH_CONFIG_ENTRIES } from './env';

package/src/connectors/google/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GOOGLE_AUTH_CONFIG_ENTRIES = exports.GoogleConnector = void 0;
+var GoogleConnector_1 = require("../GoogleConnector");
+Object.defineProperty(exports, "GoogleConnector", { enumerable: true, get: function () { return GoogleConnector_1.GoogleConnector; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "GOOGLE_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.GOOGLE_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/{microsoft → connectors/microsoft}/env.js

@@ -2,7 +2,7 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MICROSOFT_AUTH_CONFIG_ENTRIES = void 0;
-const env_1 = require("../env");
+const env_1 = require("../../env");
 // #endregion
 /** Configuration entries required by Microsoft OAuth authentication. */
 exports.MICROSOFT_AUTH_CONFIG_ENTRIES = [

package/src/connectors/microsoft/index.d.ts

@@ -0,0 +1,2 @@
+export { MicrosoftConnector } from '../MicrosoftConnector';
+export { MICROSOFT_AUTH_CONFIG_ENTRIES } from './env';

package/src/connectors/microsoft/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROSOFT_AUTH_CONFIG_ENTRIES = exports.MicrosoftConnector = void 0;
+var MicrosoftConnector_1 = require("../MicrosoftConnector");
+Object.defineProperty(exports, "MicrosoftConnector", { enumerable: true, get: function () { return MicrosoftConnector_1.MicrosoftConnector; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "MICROSOFT_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.MICROSOFT_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/env.d.ts

@@ -11,6 +11,8 @@ export declare const AUTH_MFA_ENCRYPTION_KEY: import("@breadstone/archipel-platf
 export declare const AUTH_MFA_CHALLENGE_EXPIRES_IN: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Maximum number of failed MFA attempts before lockout. */
 export declare const AUTH_MFA_MAX_ATTEMPTS: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Issuer name shown in authenticator apps for TOTP MFA. */
+export declare const AUTH_MFA_ISSUER: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Time-to-live for SMS OTP codes (e.g. `'10m'`). */
 export declare const AUTH_MFA_SMS_CODE_TTL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Minimum interval between SMS resend requests (e.g. `'30s'`). */

package/src/env.js

@@ -1,51 +1,35 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_SCOPE = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_SCOPE = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_SCOPE = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_SCOPE = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
+exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_SCOPE = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_SCOPE = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_SCOPE = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_SCOPE = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_ISSUER = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 // #endregion
-// ──────────────────────────────────────────────────────────────
-// JWT & Session
-// ──────────────────────────────────────────────────────────────
 /** Secret used to sign JWTs. */
 exports.AUTH_JWT_SECRET = (0, archipel_platform_core_1.createConfigKey)('AUTH_JWT_SECRET');
 /** Lifetime of access tokens (e.g. `'15m'`, `'1h'`). */
 exports.AUTH_JWT_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_JWT_EXPIRES_IN');
 /** Lifetime of email-verification JWTs. */
 exports.AUTH_VERIFY_JWT_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_VERIFY_JWT_EXPIRES_IN');
-// ──────────────────────────────────────────────────────────────
-// MFA — General
-// ──────────────────────────────────────────────────────────────
 /** AES encryption key used to encrypt MFA secrets at rest. */
 exports.AUTH_MFA_ENCRYPTION_KEY = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_ENCRYPTION_KEY');
 /** How long an MFA challenge stays valid (e.g. `'5m'`). */
 exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_CHALLENGE_EXPIRES_IN');
 /** Maximum number of failed MFA attempts before lockout. */
 exports.AUTH_MFA_MAX_ATTEMPTS = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_MAX_ATTEMPTS');
-// ──────────────────────────────────────────────────────────────
-// MFA — SMS Channel
-// ──────────────────────────────────────────────────────────────
+/** Issuer name shown in authenticator apps for TOTP MFA. */
+exports.AUTH_MFA_ISSUER = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_ISSUER');
 /** Time-to-live for SMS OTP codes (e.g. `'10m'`). */
 exports.AUTH_MFA_SMS_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_SMS_CODE_TTL');
 /** Minimum interval between SMS resend requests (e.g. `'30s'`). */
 exports.AUTH_MFA_SMS_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_SMS_MIN_RESEND');
-// ──────────────────────────────────────────────────────────────
-// MFA — Email Channel
-// ──────────────────────────────────────────────────────────────
 /** Time-to-live for email OTP codes (e.g. `'10m'`). */
 exports.AUTH_MFA_EMAIL_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_EMAIL_CODE_TTL');
 /** Minimum interval between email OTP resend requests (e.g. `'30s'`). */
 exports.AUTH_MFA_EMAIL_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_EMAIL_MIN_RESEND');
-// ──────────────────────────────────────────────────────────────
-// MFA — Push Channel
-// ──────────────────────────────────────────────────────────────
 /** Time-to-live for push OTP codes (e.g. `'10m'`). */
 exports.AUTH_MFA_PUSH_CODE_TTL = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_PUSH_CODE_TTL');
 /** Minimum interval between push OTP resend requests (e.g. `'30s'`). */
 exports.AUTH_MFA_PUSH_MIN_RESEND = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_PUSH_MIN_RESEND');
-// ──────────────────────────────────────────────────────────────
-// OAuth — Google
-// ──────────────────────────────────────────────────────────────
 /** Google OAuth2 client ID. */
 exports.AUTH_GOOGLE_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CLIENT_ID');
 /** Google OAuth2 client secret. */
@@ -54,9 +38,6 @@ exports.AUTH_GOOGLE_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey
 exports.AUTH_GOOGLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_CALLBACK_URL');
 /** Comma-separated list of Google OAuth scopes (e.g. `'email,profile'`). */
 exports.AUTH_GOOGLE_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_GOOGLE_SCOPE');
-// ──────────────────────────────────────────────────────────────
-// OAuth — Microsoft
-// ──────────────────────────────────────────────────────────────
 /** Microsoft OAuth2 client ID. */
 exports.AUTH_MICROSOFT_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_CLIENT_ID');
 /** Microsoft OAuth2 client secret. */
@@ -67,9 +48,6 @@ exports.AUTH_MICROSOFT_CALLBACK_URL = (0, archipel_platform_core_1.createConfigK
 exports.AUTH_MICROSOFT_TENANT = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_TENANT');
 /** Comma-separated list of Microsoft OAuth scopes (e.g. `'user.read,mail.read'`). */
 exports.AUTH_MICROSOFT_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_MICROSOFT_SCOPE');
-// ──────────────────────────────────────────────────────────────
-// OAuth — Apple
-// ──────────────────────────────────────────────────────────────
 /** Apple Sign-In private key (PEM string). */
 exports.AUTH_APPLE_PRIVATE_KEY = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_PRIVATE_KEY');
 /** Apple Sign-In client (service) ID. */
@@ -82,9 +60,6 @@ exports.AUTH_APPLE_KEY_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_
 exports.AUTH_APPLE_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_CALLBACK_URL');
 /** Comma-separated list of Apple Sign-In scopes (e.g. `'name,email'`). */
 exports.AUTH_APPLE_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_APPLE_SCOPE');
-// ──────────────────────────────────────────────────────────────
-// OAuth — GitHub
-// ──────────────────────────────────────────────────────────────
 /** GitHub OAuth client ID. */
 exports.AUTH_GITHUB_CLIENT_ID = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CLIENT_ID');
 /** GitHub OAuth client secret. */
@@ -93,25 +68,30 @@ exports.AUTH_GITHUB_CLIENT_SECRET = (0, archipel_platform_core_1.createConfigKey
 exports.AUTH_GITHUB_CALLBACK_URL = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_CALLBACK_URL');
 /** Comma-separated list of GitHub OAuth scopes (e.g. `'user:email,read:user'`). */
 exports.AUTH_GITHUB_SCOPE = (0, archipel_platform_core_1.createConfigKey)('AUTH_GITHUB_SCOPE');
-// ──────────────────────────────────────────────────────────────
-// Seed / Misc
-// ──────────────────────────────────────────────────────────────
 /** Username used for the anonymous seed user. */
 exports.SEED_ANONYMOUS_USERNAME = (0, archipel_platform_core_1.createConfigKey)('SEED_ANONYMOUS_USERNAME');
-// ──────────────────────────────────────────────────────────────
-// Registry entries
-// ──────────────────────────────────────────────────────────────
 /** Core configuration entries required by `platform-authentication`. */
 exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
     // JWT & Session
-    { key: exports.AUTH_JWT_SECRET, required: true, description: 'Secret used to sign JWTs.' },
-    { key: exports.AUTH_JWT_EXPIRES_IN, required: true, description: 'Lifetime of access tokens.' },
-    { key: exports.AUTH_VERIFY_JWT_EXPIRES_IN, required: true, description: 'Lifetime of email-verification JWTs.' },
+    {
+        key: exports.AUTH_JWT_SECRET,
+        required: true,
+        description: 'Secret used to sign JWTs.',
+    },
+    {
+        key: exports.AUTH_JWT_EXPIRES_IN,
+        required: true,
+        description: 'Lifetime of access tokens.',
+    },
+    {
+        key: exports.AUTH_VERIFY_JWT_EXPIRES_IN,
+        required: true,
+        description: 'Lifetime of email-verification JWTs.',
+    },
     // MFA — General
     {
         key: exports.AUTH_MFA_ENCRYPTION_KEY,
-        required: false,
-        defaultValue: '',
+        required: true,
         description: 'AES encryption key for MFA secrets.',
     },
     {
@@ -126,8 +106,18 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
         defaultValue: '5',
         description: 'Max failed MFA attempts before lockout.',
     },
+    {
+        key: exports.AUTH_MFA_ISSUER,
+        required: true,
+        description: 'Issuer name shown in authenticator apps for TOTP MFA.',
+    },
     // MFA — SMS
-    { key: exports.AUTH_MFA_SMS_CODE_TTL, required: false, defaultValue: '10m', description: 'TTL for SMS OTP codes.' },
+    {
+        key: exports.AUTH_MFA_SMS_CODE_TTL,
+        required: false,
+        defaultValue: '10m',
+        description: 'TTL for SMS OTP codes.',
+    },
     {
         key: exports.AUTH_MFA_SMS_MIN_RESEND,
         required: false,
@@ -135,7 +125,12 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
         description: 'Min interval between SMS resends.',
     },
     // MFA — Email
-    { key: exports.AUTH_MFA_EMAIL_CODE_TTL, required: false, defaultValue: '10m', description: 'TTL for email OTP codes.' },
+    {
+        key: exports.AUTH_MFA_EMAIL_CODE_TTL,
+        required: false,
+        defaultValue: '10m',
+        description: 'TTL for email OTP codes.',
+    },
     {
         key: exports.AUTH_MFA_EMAIL_MIN_RESEND,
         required: false,
@@ -143,7 +138,12 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
         description: 'Min interval between email resends.',
     },
     // MFA — Push
-    { key: exports.AUTH_MFA_PUSH_CODE_TTL, required: false, defaultValue: '10m', description: 'TTL for push OTP codes.' },
+    {
+        key: exports.AUTH_MFA_PUSH_CODE_TTL,
+        required: false,
+        defaultValue: '10m',
+        description: 'TTL for push OTP codes.',
+    },
     {
         key: exports.AUTH_MFA_PUSH_MIN_RESEND,
         required: false,
@@ -151,6 +151,10 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
         description: 'Min interval between push resends.',
     },
     // Seed / Misc
-    { key: exports.SEED_ANONYMOUS_USERNAME, required: true, description: 'Username for the anonymous seed user.' },
+    {
+        key: exports.SEED_ANONYMOUS_USERNAME,
+        required: true,
+        description: 'Username for the anonymous seed user.',
+    },
 ];
 //# sourceMappingURL=env.js.map