@breadstone/archipel-platform-authentication 0.0.8 → 0.0.9

package/src/{strategies/GoogleStrategy.js → connectors/GoogleConnector.js}

@@ -1,24 +1,25 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GoogleStrategy = void 0;
+exports.GoogleConnector = void 0;
 const tslib_1 = require("tslib");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
 const passport_google_oauth20_1 = require("passport-google-oauth20");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
+const env_1 = require("../env");
+const ConnectorBase_1 = require("./ConnectorBase");
 // #endregion
 /**
- * The `GoogleStrategy` integrates Google OAuth authentication.
+ * The `GoogleConnector` integrates Google OAuth authentication.
  *
  * @public
  */
-let GoogleStrategy = class GoogleStrategy extends (0, passport_1.PassportStrategy)(passport_google_oauth20_1.Strategy, 'google') {
+let GoogleConnector = class GoogleConnector extends (0, ConnectorBase_1.ConnectorBase)(passport_google_oauth20_1.Strategy, 'google') {
     // #endregion
     // #region Ctor
     /**
-     * Initializes a new instance of the `GoogleStrategy` class.
+     * Initializes a new instance of the `GoogleConnector` class.
      *
      * @public
      * @param socialAuth Social auth port instance.
@@ -26,14 +27,14 @@ let GoogleStrategy = class GoogleStrategy extends (0, passport_1.PassportStrateg
      */
     constructor(socialAuth, configService) {
         const scope = configService
-            .tryGet('AUTH_GOOGLE_SCOPE', 'email,profile')
+            .tryGet(env_1.AUTH_GOOGLE_SCOPE.key, 'email,profile')
             .split(',')
             .map((s) => s.trim())
             .filter(Boolean);
         super({
-            clientID: configService.get('AUTH_GOOGLE_CLIENT_ID'),
-            clientSecret: configService.get('AUTH_GOOGLE_CLIENT_SECRET'),
-            callbackURL: configService.tryGet('AUTH_GOOGLE_CALLBACK_URL', '/auth/google/callback'),
+            clientID: configService.get(env_1.AUTH_GOOGLE_CLIENT_ID.key),
+            clientSecret: configService.get(env_1.AUTH_GOOGLE_CLIENT_SECRET.key),
+            callbackURL: configService.tryGet(env_1.AUTH_GOOGLE_CALLBACK_URL.key, '/auth/google/callback'),
             scope,
             state: true,
         });
@@ -71,9 +72,9 @@ let GoogleStrategy = class GoogleStrategy extends (0, passport_1.PassportStrateg
         return user;
     }
 };
-exports.GoogleStrategy = GoogleStrategy;
-exports.GoogleStrategy = GoogleStrategy = tslib_1.__decorate([
+exports.GoogleConnector = GoogleConnector;
+exports.GoogleConnector = GoogleConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
-], GoogleStrategy);
-//# sourceMappingURL=GoogleStrategy.js.map
+], GoogleConnector);
+//# sourceMappingURL=GoogleConnector.js.map

package/src/{strategies/JwtStrategy.d.ts → connectors/JwtConnector.d.ts}

@@ -1,18 +1,28 @@
 import { ConfigService } from '@breadstone/archipel-platform-core';
-import { Strategy } from 'passport-jwt';
 import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { JwtPayloadBase } from '../models/JwtPayloadBase';
-declare const JwtStrategy_base: new (...args: [opt: import("passport-jwt").StrategyOptionsWithRequest] | [opt: import("passport-jwt").StrategyOptionsWithoutRequest]) => Strategy & {
-    validate(...args: any[]): unknown;
+declare const JwtConnector_base: (abstract new (...args: any[]) => {
+    [x: string]: any;
+    validate(...args: unknown[]): Promise<unknown>;
+}) & {
+    apply(this: Function, thisArg: any, argArray?: any): any;
+    call(this: Function, thisArg: any, ...argArray: any[]): any;
+    bind(this: Function, thisArg: any, ...argArray: any[]): any;
+    toString(): string;
+    readonly length: number;
+    arguments: any;
+    caller: Function;
+    readonly name: string;
+    [Symbol.hasInstance](value: any): boolean;
 };
 /**
- * JWT strategy for handling token validation.
+ * JWT connector for handling token validation.
  */
-export declare class JwtStrategy extends JwtStrategy_base {
+export declare class JwtConnector extends JwtConnector_base {
     private readonly _authSubject;
     /**
-     * Constructs a new instance of the `JwtStrategy` class.
+     * Constructs a new instance of the `JwtConnector` class.
      *
      * @public
      * @param authSubject Auth subject port instance.

package/src/{strategies/JwtStrategy.js → connectors/JwtConnector.js}

@@ -1,22 +1,23 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JwtStrategy = void 0;
+exports.JwtConnector = void 0;
 const tslib_1 = require("tslib");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
 const passport_jwt_1 = require("passport-jwt");
 const AuthSubjectPort_1 = require("../contracts/AuthSubjectPort");
+const env_1 = require("../env");
+const ConnectorBase_1 = require("./ConnectorBase");
 // #endregion
 /**
- * JWT strategy for handling token validation.
+ * JWT connector for handling token validation.
  */
-let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy) {
+let JwtConnector = class JwtConnector extends (0, ConnectorBase_1.ConnectorBase)(passport_jwt_1.Strategy) {
     // #endregion
     // #region Ctor
     /**
-     * Constructs a new instance of the `JwtStrategy` class.
+     * Constructs a new instance of the `JwtConnector` class.
      *
      * @public
      * @param authSubject Auth subject port instance.
@@ -26,7 +27,7 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
         super({
             jwtFromRequest: passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
             ignoreExpiration: false, // Optional: Allow or disallow expired tokens
-            secretOrKey: configService.get('AUTH_JWT_SECRET'), // The secret used for signing tokens
+            secretOrKey: configService.get(env_1.AUTH_JWT_SECRET.key), // The secret used for signing tokens
         });
         this._authSubject = authSubject;
     }
@@ -47,9 +48,9 @@ let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(pas
         return user;
     }
 };
-exports.JwtStrategy = JwtStrategy;
-exports.JwtStrategy = JwtStrategy = tslib_1.__decorate([
+exports.JwtConnector = JwtConnector;
+exports.JwtConnector = JwtConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_core_1.ConfigService])
-], JwtStrategy);
-//# sourceMappingURL=JwtStrategy.js.map
+], JwtConnector);
+//# sourceMappingURL=JwtConnector.js.map

package/src/{strategies/LocalStrategy.d.ts → connectors/LocalConnector.d.ts}

@@ -1,20 +1,30 @@
 import { BcryptService } from '@breadstone/archipel-platform-cryptography';
-import { Strategy } from 'passport-local';
 import { AuthSubjectPort } from '../contracts/AuthSubjectPort';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
-declare const LocalStrategy_base: new (...args: [] | [options: import("passport-local").IStrategyOptionsWithRequest] | [options: import("passport-local").IStrategyOptions]) => Strategy & {
-    validate(...args: any[]): unknown;
+declare const LocalConnector_base: (abstract new (...args: any[]) => {
+    [x: string]: any;
+    validate(...args: unknown[]): Promise<unknown>;
+}) & {
+    apply(this: Function, thisArg: any, argArray?: any): any;
+    call(this: Function, thisArg: any, ...argArray: any[]): any;
+    bind(this: Function, thisArg: any, ...argArray: any[]): any;
+    toString(): string;
+    readonly length: number;
+    arguments: any;
+    caller: Function;
+    readonly name: string;
+    [Symbol.hasInstance](value: any): boolean;
 };
 /**
- * Local strategy for user name and password login.
+ * Local connector for user name and password login.
  *
  * @public
  */
-export declare class LocalStrategy extends LocalStrategy_base {
+export declare class LocalConnector extends LocalConnector_base {
     private readonly _authSubject;
     private readonly _bcryptService;
     /**
-     * Constructs a new instance of the `LocalStrategy` class.
+     * Constructs a new instance of the `LocalConnector` class.
      *
      * @public
      * @param authSubject Auth subject port instance.

package/src/{strategies/LocalStrategy.js → connectors/LocalConnector.js}

@@ -1,24 +1,24 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LocalStrategy = void 0;
+exports.LocalConnector = void 0;
 const tslib_1 = require("tslib");
 const archipel_platform_cryptography_1 = require("@breadstone/archipel-platform-cryptography");
 const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
 const passport_local_1 = require("passport-local");
 const AuthSubjectPort_1 = require("../contracts/AuthSubjectPort");
+const ConnectorBase_1 = require("./ConnectorBase");
 // #endregion
 /**
- * Local strategy for user name and password login.
+ * Local connector for user name and password login.
  *
  * @public
  */
-let LocalStrategy = class LocalStrategy extends (0, passport_1.PassportStrategy)(passport_local_1.Strategy) {
+let LocalConnector = class LocalConnector extends (0, ConnectorBase_1.ConnectorBase)(passport_local_1.Strategy) {
     // #endregion
     // #region Ctor
     /**
-     * Constructs a new instance of the `LocalStrategy` class.
+     * Constructs a new instance of the `LocalConnector` class.
      *
      * @public
      * @param authSubject Auth subject port instance.
@@ -51,9 +51,9 @@ let LocalStrategy = class LocalStrategy extends (0, passport_1.PassportStrategy)
         return user;
     }
 };
-exports.LocalStrategy = LocalStrategy;
-exports.LocalStrategy = LocalStrategy = tslib_1.__decorate([
+exports.LocalConnector = LocalConnector;
+exports.LocalConnector = LocalConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [AuthSubjectPort_1.AuthSubjectPort, archipel_platform_cryptography_1.BcryptService])
-], LocalStrategy);
-//# sourceMappingURL=LocalStrategy.js.map
+], LocalConnector);
+//# sourceMappingURL=LocalConnector.js.map

package/src/{strategies/MicrosoftStrategy.d.ts → connectors/MicrosoftConnector.d.ts}

@@ -1,20 +1,30 @@
 import { ConfigService } from '@breadstone/archipel-platform-core';
 import type { Profile as PassportProfile } from 'passport';
-import { Strategy } from 'passport-microsoft';
 import type { IAuthSubject } from '../contracts/IAuthSubject';
 import { SocialAuthPort } from '../contracts/SocialAuthPort';
-declare const MicrosoftStrategy_base: new (...args: [options: import("passport-microsoft").MicrosoftStrategyOptionsWithRequest] | [options: import("passport-microsoft").MicrosoftStrategyOptions]) => Strategy & {
-    validate(...args: any[]): unknown;
+declare const MicrosoftConnector_base: (abstract new (...args: any[]) => {
+    [x: string]: any;
+    validate(...args: unknown[]): Promise<unknown>;
+}) & {
+    apply(this: Function, thisArg: any, argArray?: any): any;
+    call(this: Function, thisArg: any, ...argArray: any[]): any;
+    bind(this: Function, thisArg: any, ...argArray: any[]): any;
+    toString(): string;
+    readonly length: number;
+    arguments: any;
+    caller: Function;
+    readonly name: string;
+    [Symbol.hasInstance](value: any): boolean;
 };
 /**
- * The `MicrosoftStrategy` integrates Microsoft OAuth authentication.
+ * The `MicrosoftConnector` integrates Microsoft OAuth authentication.
  *
  * @public
  */
-export declare class MicrosoftStrategy extends MicrosoftStrategy_base {
+export declare class MicrosoftConnector extends MicrosoftConnector_base {
     private readonly _socialAuth;
     /**
-     * Initializes a new instance of the `MicrosoftStrategy` class.
+     * Initializes a new instance of the `MicrosoftConnector` class.
      *
      * @public
      * @param socialAuth Social auth port instance.

package/src/{strategies/MicrosoftStrategy.js → connectors/MicrosoftConnector.js}

@@ -1,24 +1,25 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MicrosoftStrategy = void 0;
+exports.MicrosoftConnector = void 0;
 const tslib_1 = require("tslib");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const common_1 = require("@nestjs/common");
-const passport_1 = require("@nestjs/passport");
 const passport_microsoft_1 = require("passport-microsoft");
 const SocialAuthPort_1 = require("../contracts/SocialAuthPort");
+const env_1 = require("../env");
+const ConnectorBase_1 = require("./ConnectorBase");
 // #endregion
 /**
- * The `MicrosoftStrategy` integrates Microsoft OAuth authentication.
+ * The `MicrosoftConnector` integrates Microsoft OAuth authentication.
  *
  * @public
  */
-let MicrosoftStrategy = class MicrosoftStrategy extends (0, passport_1.PassportStrategy)(passport_microsoft_1.Strategy, 'microsoft') {
+let MicrosoftConnector = class MicrosoftConnector extends (0, ConnectorBase_1.ConnectorBase)(passport_microsoft_1.Strategy, 'microsoft') {
     // #endregion
     // #region Ctor
     /**
-     * Initializes a new instance of the `MicrosoftStrategy` class.
+     * Initializes a new instance of the `MicrosoftConnector` class.
      *
      * @public
      * @param socialAuth Social auth port instance.
@@ -26,15 +27,15 @@ let MicrosoftStrategy = class MicrosoftStrategy extends (0, passport_1.PassportS
      */
     constructor(socialAuth, configService) {
         const scope = configService
-            .tryGet('AUTH_MICROSOFT_SCOPE', 'user.read')
+            .tryGet(env_1.AUTH_MICROSOFT_SCOPE.key, 'user.read')
             .split(',')
             .map((s) => s.trim())
             .filter(Boolean);
         super({
-            clientID: configService.get('AUTH_MICROSOFT_CLIENT_ID'),
-            clientSecret: configService.get('AUTH_MICROSOFT_CLIENT_SECRET'),
-            callbackURL: configService.tryGet('AUTH_MICROSOFT_CALLBACK_URL', '/auth/microsoft/callback'),
-            tenant: configService.tryGet('AUTH_MICROSOFT_TENANT', 'common'),
+            clientID: configService.get(env_1.AUTH_MICROSOFT_CLIENT_ID.key),
+            clientSecret: configService.get(env_1.AUTH_MICROSOFT_CLIENT_SECRET.key),
+            callbackURL: configService.tryGet(env_1.AUTH_MICROSOFT_CALLBACK_URL.key, '/auth/microsoft/callback'),
+            tenant: configService.tryGet(env_1.AUTH_MICROSOFT_TENANT.key, 'common'),
             scope,
             state: true,
         });
@@ -72,9 +73,9 @@ let MicrosoftStrategy = class MicrosoftStrategy extends (0, passport_1.PassportS
         return user;
     }
 };
-exports.MicrosoftStrategy = MicrosoftStrategy;
-exports.MicrosoftStrategy = MicrosoftStrategy = tslib_1.__decorate([
+exports.MicrosoftConnector = MicrosoftConnector;
+exports.MicrosoftConnector = MicrosoftConnector = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__metadata("design:paramtypes", [SocialAuthPort_1.SocialAuthPort, archipel_platform_core_1.ConfigService])
-], MicrosoftStrategy);
-//# sourceMappingURL=MicrosoftStrategy.js.map
+], MicrosoftConnector);
+//# sourceMappingURL=MicrosoftConnector.js.map

package/src/{apple → connectors/apple}/env.js

@@ -2,7 +2,7 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.APPLE_AUTH_CONFIG_ENTRIES = void 0;
-const env_1 = require("../env");
+const env_1 = require("../../env");
 // #endregion
 /** Configuration entries required by Apple Sign-In authentication. */
 exports.APPLE_AUTH_CONFIG_ENTRIES = [

package/src/connectors/apple/index.d.ts

@@ -0,0 +1,2 @@
+export { AppleConnector } from '../AppleConnector';
+export { APPLE_AUTH_CONFIG_ENTRIES } from './env';

package/src/connectors/apple/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPLE_AUTH_CONFIG_ENTRIES = exports.AppleConnector = void 0;
+var AppleConnector_1 = require("../AppleConnector");
+Object.defineProperty(exports, "AppleConnector", { enumerable: true, get: function () { return AppleConnector_1.AppleConnector; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "APPLE_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.APPLE_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/{github → connectors/github}/env.js

@@ -2,7 +2,7 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GITHUB_AUTH_CONFIG_ENTRIES = void 0;
-const env_1 = require("../env");
+const env_1 = require("../../env");
 // #endregion
 /** Configuration entries required by GitHub OAuth authentication. */
 exports.GITHUB_AUTH_CONFIG_ENTRIES = [

package/src/connectors/github/index.d.ts

@@ -0,0 +1,2 @@
+export { GithubConnector } from '../GithubConnector';
+export { GITHUB_AUTH_CONFIG_ENTRIES } from './env';

package/src/connectors/github/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_AUTH_CONFIG_ENTRIES = exports.GithubConnector = void 0;
+var GithubConnector_1 = require("../GithubConnector");
+Object.defineProperty(exports, "GithubConnector", { enumerable: true, get: function () { return GithubConnector_1.GithubConnector; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "GITHUB_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.GITHUB_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/{google → connectors/google}/env.js

@@ -2,7 +2,7 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GOOGLE_AUTH_CONFIG_ENTRIES = void 0;
-const env_1 = require("../env");
+const env_1 = require("../../env");
 // #endregion
 /** Configuration entries required by Google OAuth authentication. */
 exports.GOOGLE_AUTH_CONFIG_ENTRIES = [

package/src/connectors/google/index.d.ts

@@ -0,0 +1,2 @@
+export { GoogleConnector } from '../GoogleConnector';
+export { GOOGLE_AUTH_CONFIG_ENTRIES } from './env';

package/src/connectors/google/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GOOGLE_AUTH_CONFIG_ENTRIES = exports.GoogleConnector = void 0;
+var GoogleConnector_1 = require("../GoogleConnector");
+Object.defineProperty(exports, "GoogleConnector", { enumerable: true, get: function () { return GoogleConnector_1.GoogleConnector; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "GOOGLE_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.GOOGLE_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/{microsoft → connectors/microsoft}/env.js

@@ -2,7 +2,7 @@
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MICROSOFT_AUTH_CONFIG_ENTRIES = void 0;
-const env_1 = require("../env");
+const env_1 = require("../../env");
 // #endregion
 /** Configuration entries required by Microsoft OAuth authentication. */
 exports.MICROSOFT_AUTH_CONFIG_ENTRIES = [

package/src/connectors/microsoft/index.d.ts

@@ -0,0 +1,2 @@
+export { MicrosoftConnector } from '../MicrosoftConnector';
+export { MICROSOFT_AUTH_CONFIG_ENTRIES } from './env';

package/src/connectors/microsoft/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MICROSOFT_AUTH_CONFIG_ENTRIES = exports.MicrosoftConnector = void 0;
+var MicrosoftConnector_1 = require("../MicrosoftConnector");
+Object.defineProperty(exports, "MicrosoftConnector", { enumerable: true, get: function () { return MicrosoftConnector_1.MicrosoftConnector; } });
+var env_1 = require("./env");
+Object.defineProperty(exports, "MICROSOFT_AUTH_CONFIG_ENTRIES", { enumerable: true, get: function () { return env_1.MICROSOFT_AUTH_CONFIG_ENTRIES; } });
+//# sourceMappingURL=index.js.map

package/src/env.d.ts

@@ -11,6 +11,8 @@ export declare const AUTH_MFA_ENCRYPTION_KEY: import("@breadstone/archipel-platf
 export declare const AUTH_MFA_CHALLENGE_EXPIRES_IN: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Maximum number of failed MFA attempts before lockout. */
 export declare const AUTH_MFA_MAX_ATTEMPTS: import("@breadstone/archipel-platform-core").IConfigKey<string>;
+/** Issuer name shown in authenticator apps for TOTP MFA. */
+export declare const AUTH_MFA_ISSUER: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Time-to-live for SMS OTP codes (e.g. `'10m'`). */
 export declare const AUTH_MFA_SMS_CODE_TTL: import("@breadstone/archipel-platform-core").IConfigKey<string>;
 /** Minimum interval between SMS resend requests (e.g. `'30s'`). */

package/src/env.js

@@ -1,7 +1,7 @@
 "use strict";
 // #region Imports
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_SCOPE = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_SCOPE = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_SCOPE = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_SCOPE = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
+exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = exports.SEED_ANONYMOUS_USERNAME = exports.AUTH_GITHUB_SCOPE = exports.AUTH_GITHUB_CALLBACK_URL = exports.AUTH_GITHUB_CLIENT_SECRET = exports.AUTH_GITHUB_CLIENT_ID = exports.AUTH_APPLE_SCOPE = exports.AUTH_APPLE_CALLBACK_URL = exports.AUTH_APPLE_KEY_ID = exports.AUTH_APPLE_TEAM_ID = exports.AUTH_APPLE_CLIENT_ID = exports.AUTH_APPLE_PRIVATE_KEY = exports.AUTH_MICROSOFT_SCOPE = exports.AUTH_MICROSOFT_TENANT = exports.AUTH_MICROSOFT_CALLBACK_URL = exports.AUTH_MICROSOFT_CLIENT_SECRET = exports.AUTH_MICROSOFT_CLIENT_ID = exports.AUTH_GOOGLE_SCOPE = exports.AUTH_GOOGLE_CALLBACK_URL = exports.AUTH_GOOGLE_CLIENT_SECRET = exports.AUTH_GOOGLE_CLIENT_ID = exports.AUTH_MFA_PUSH_MIN_RESEND = exports.AUTH_MFA_PUSH_CODE_TTL = exports.AUTH_MFA_EMAIL_MIN_RESEND = exports.AUTH_MFA_EMAIL_CODE_TTL = exports.AUTH_MFA_SMS_MIN_RESEND = exports.AUTH_MFA_SMS_CODE_TTL = exports.AUTH_MFA_ISSUER = exports.AUTH_MFA_MAX_ATTEMPTS = exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = exports.AUTH_MFA_ENCRYPTION_KEY = exports.AUTH_VERIFY_JWT_EXPIRES_IN = exports.AUTH_JWT_EXPIRES_IN = exports.AUTH_JWT_SECRET = void 0;
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 // #endregion
 // ──────────────────────────────────────────────────────────────
@@ -22,6 +22,8 @@ exports.AUTH_MFA_ENCRYPTION_KEY = (0, archipel_platform_core_1.createConfigKey)(
 exports.AUTH_MFA_CHALLENGE_EXPIRES_IN = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_CHALLENGE_EXPIRES_IN');
 /** Maximum number of failed MFA attempts before lockout. */
 exports.AUTH_MFA_MAX_ATTEMPTS = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_MAX_ATTEMPTS');
+/** Issuer name shown in authenticator apps for TOTP MFA. */
+exports.AUTH_MFA_ISSUER = (0, archipel_platform_core_1.createConfigKey)('AUTH_MFA_ISSUER');
 // ──────────────────────────────────────────────────────────────
 // MFA — SMS Channel
 // ──────────────────────────────────────────────────────────────
@@ -110,8 +112,7 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
     // MFA — General
     {
         key: exports.AUTH_MFA_ENCRYPTION_KEY,
-        required: false,
-        defaultValue: '',
+        required: true,
         description: 'AES encryption key for MFA secrets.',
     },
     {
@@ -126,6 +127,11 @@ exports.PLATFORM_AUTHENTICATION_CONFIG_ENTRIES = [
         defaultValue: '5',
         description: 'Max failed MFA attempts before lockout.',
     },
+    {
+        key: exports.AUTH_MFA_ISSUER,
+        required: true,
+        description: 'Issuer name shown in authenticator apps for TOTP MFA.',
+    },
     // MFA — SMS
     { key: exports.AUTH_MFA_SMS_CODE_TTL, required: false, defaultValue: '10m', description: 'TTL for SMS OTP codes.' },
     {

package/src/{services/mfa → mfa}/IMfaChannel.d.ts

@@ -1,4 +1,4 @@
-import { IMfaSetup } from '../../models';
+import { IMfaSetup } from '../models';
 import { IMfaSetupContext } from './MfaState';
 /**
  * Defines the contract each MFA channel must implement.

package/src/{services/mfa → mfa}/MfaEncryptionService.js

@@ -3,9 +3,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MfaEncryptionService = void 0;
 const tslib_1 = require("tslib");
-const common_1 = require("@nestjs/common");
 const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
+const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
+const env_1 = require("../env");
 // #endregion
 /**
  * Provides AES-GCM encryption for MFA secrets.
@@ -16,9 +17,8 @@ let MfaEncryptionService = class MfaEncryptionService {
     // #endregion
     // #region Ctor
     constructor(configService) {
-        const rawKey = configService.tryGet('AUTH_MFA_ENCRYPTION_KEY', '');
-        const material = rawKey && rawKey.length > 0 ? rawKey : 'strivio-mfa-default-key';
-        this._key = (0, node_crypto_1.createHash)('sha256').update(material).digest();
+        const rawKey = configService.get(env_1.AUTH_MFA_ENCRYPTION_KEY.key);
+        this._key = (0, node_crypto_1.createHash)('sha256').update(rawKey).digest();
     }
     // #endregion
     // #region Methods

package/src/{services → mfa}/MfaService.d.ts

@@ -1,9 +1,9 @@
 import { BcryptService } from '@breadstone/archipel-platform-cryptography';
 import { MfaSubjectPort } from '../contracts/MfaSubjectPort';
 import { IMfaConfirmation, IMfaSetup } from '../models';
-import { IMfaChannel } from './mfa/IMfaChannel';
-import { MfaEncryptionService } from './mfa/MfaEncryptionService';
-import { IMfaSetupContext } from './mfa/MfaState';
+import { IMfaChannel } from './IMfaChannel';
+import { MfaEncryptionService } from './MfaEncryptionService';
+import { IMfaSetupContext } from './MfaState';
 /**
  * Orchestrates MFA channels, backup codes, and user preferences.
  *

package/src/{services → mfa}/MfaService.js

@@ -7,9 +7,9 @@ const archipel_platform_cryptography_1 = require("@breadstone/archipel-platform-
 const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
 const MfaSubjectPort_1 = require("../contracts/MfaSubjectPort");
-const MfaEncryptionService_1 = require("./mfa/MfaEncryptionService");
-const MfaState_1 = require("./mfa/MfaState");
-const MfaTokens_1 = require("./mfa/MfaTokens");
+const MfaEncryptionService_1 = require("./MfaEncryptionService");
+const MfaState_1 = require("./MfaState");
+const MfaTokens_1 = require("./MfaTokens");
 // #endregion
 /**
  * Orchestrates MFA channels, backup codes, and user preferences.

package/src/{services/mfa → mfa}/MfaState.js

@@ -12,12 +12,12 @@ function resolveMfaState(raw) {
         return {
             preferredMethod: typed.preferredMethod,
             channels: typed.channels ?? {},
-            trustedDevices: typed.trustedDevices ?? []
+            trustedDevices: typed.trustedDevices ?? [],
         };
     }
     return {
         channels: {},
-        trustedDevices: []
+        trustedDevices: [],
     };
 }
 //# sourceMappingURL=MfaState.js.map

package/src/{services/mfa → mfa}/channels/EmailOtpMfaChannel.d.ts

@@ -1,7 +1,7 @@
 import { ConfigService } from '@breadstone/archipel-platform-core';
 import { BcryptService } from '@breadstone/archipel-platform-cryptography';
-import { MfaSubjectPort } from '../../../contracts/MfaSubjectPort';
-import { IMfaSetup } from '../../../models';
+import { MfaSubjectPort } from '../../contracts/MfaSubjectPort';
+import { IMfaSetup } from '../../models';
 import { IMfaChannel } from '../IMfaChannel';
 import { IMfaSetupContext } from '../MfaState';
 export declare class EmailOtpMfaChannel implements IMfaChannel {

package/src/{services/mfa → mfa}/channels/EmailOtpMfaChannel.js

@@ -8,7 +8,8 @@ const archipel_platform_core_1 = require("@breadstone/archipel-platform-core");
 const archipel_platform_cryptography_1 = require("@breadstone/archipel-platform-cryptography");
 const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
-const MfaSubjectPort_1 = require("../../../contracts/MfaSubjectPort");
+const MfaSubjectPort_1 = require("../../contracts/MfaSubjectPort");
+const env_1 = require("../../env");
 const MfaState_1 = require("../MfaState");
 // #endregion
 let EmailOtpMfaChannel = EmailOtpMfaChannel_1 = class EmailOtpMfaChannel {
@@ -18,8 +19,8 @@ let EmailOtpMfaChannel = EmailOtpMfaChannel_1 = class EmailOtpMfaChannel {
         this._mfaSubject = mfaSubject;
         this._configService = configService;
         this._bcryptService = bcryptService;
-        this._ttlMilliseconds = archipel_platform_core_1.DateTimeUtils.parse(this._configService.tryGet('AUTH_MFA_EMAIL_CODE_TTL', '10m'));
-        this._minResendMilliseconds = archipel_platform_core_1.DateTimeUtils.parse(this._configService.tryGet('AUTH_MFA_EMAIL_MIN_RESEND', '30s'));
+        this._ttlMilliseconds = archipel_platform_core_1.DateTimeUtils.parse(this._configService.tryGet(env_1.AUTH_MFA_EMAIL_CODE_TTL.key, '10m'));
+        this._minResendMilliseconds = archipel_platform_core_1.DateTimeUtils.parse(this._configService.tryGet(env_1.AUTH_MFA_EMAIL_MIN_RESEND.key, '30s'));
     }
     async initSetup(userId, context) {
         const user = await this._mfaSubject.findById(userId);

package/src/{services/mfa → mfa}/channels/PushMfaChannel.d.ts

@@ -1,7 +1,7 @@
 import { ConfigService } from '@breadstone/archipel-platform-core';
 import { BcryptService } from '@breadstone/archipel-platform-cryptography';
-import { MfaSubjectPort } from '../../../contracts/MfaSubjectPort';
-import { IMfaSetup } from '../../../models';
+import { MfaSubjectPort } from '../../contracts/MfaSubjectPort';
+import { IMfaSetup } from '../../models';
 import { IMfaChannel } from '../IMfaChannel';
 import { IMfaSetupContext } from '../MfaState';
 /**