@carlonicora/nestjs-neo4jsonapi 1.39.0 → 1.40.0

package/dist/foundations/two-factor/services/two-factor.service.js

@@ -0,0 +1,468 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto = __importStar(require("crypto"));
+const base_config_1 = require("../../../config/base.config");
+const jsonapi_service_1 = require("../../../core/jsonapi/services/jsonapi.service");
+const two_factor_config_1 = require("../entities/two-factor-config");
+const two_factor_status_1 = require("../entities/two-factor-status");
+const two_factor_verification_1 = require("../entities/two-factor-verification");
+const pending_two_factor_repository_1 = require("../repositories/pending-two-factor.repository");
+const two_factor_config_repository_1 = require("../repositories/two-factor-config.repository");
+const backup_code_service_1 = require("./backup-code.service");
+const passkey_service_1 = require("./passkey.service");
+const totp_service_1 = require("./totp.service");
+/**
+ * Two-Factor Orchestration Service
+ *
+ * Coordinates all 2FA functionality including status management, method verification,
+ * and pending session handling. This service is the main entry point for 2FA operations
+ * and delegates to specialized services (TOTP, Passkey, BackupCode) for specific tasks.
+ */
+let TwoFactorService = class TwoFactorService {
+    constructor(jsonApiService, twoFactorConfigRepository, pendingTwoFactorRepository, totpService, passkeyService, backupCodeService) {
+        this.jsonApiService = jsonApiService;
+        this.twoFactorConfigRepository = twoFactorConfigRepository;
+        this.pendingTwoFactorRepository = pendingTwoFactorRepository;
+        this.totpService = totpService;
+        this.passkeyService = passkeyService;
+        this.backupCodeService = backupCodeService;
+        this.maxTotpAttempts = 5;
+        this.maxPasskeyAttempts = 3;
+        this.maxBackupAttempts = 3;
+        this.pendingTtlSeconds = base_config_1.baseConfig.twoFactor?.pendingTtl ?? 300; // 5 minutes default
+    }
+    /**
+     * Get the 2FA configuration for a user.
+     *
+     * @param userId - The user's ID
+     * @returns The user's TwoFactorConfig, or null if not configured
+     */
+    async getConfig(userId) {
+        const config = await this.twoFactorConfigRepository.findByUserId({ userId });
+        return config;
+    }
+    /**
+     * Get the full 2FA status for a user including available methods.
+     *
+     * @param userId - The user's ID
+     * @returns JSON:API response with 2FA status
+     */
+    async getStatus(userId) {
+        const config = await this.twoFactorConfigRepository.findByUserId({ userId });
+        // Check method availability in parallel
+        const [hasTotp, hasPasskey, backupCodesCount] = await Promise.all([
+            this.totpService.hasVerifiedAuthenticator({ userId }),
+            this.passkeyService.hasPasskeys({ userId }),
+            this.backupCodeService.getRawUnusedCount({ userId }),
+        ]);
+        const hasBackup = backupCodesCount > 0;
+        return this.jsonApiService.buildSingle(two_factor_status_1.TwoFactorStatusDescriptor.model, {
+            id: userId,
+            isEnabled: config?.isEnabled ?? false,
+            preferredMethod: config?.preferredMethod ?? "totp",
+            methods: {
+                totp: hasTotp,
+                passkey: hasPasskey,
+                backup: hasBackup,
+            },
+            backupCodesCount,
+        });
+    }
+    /**
+     * Enable 2FA for a user.
+     * Requires at least one 2FA method to be configured.
+     *
+     * @param userId - The user's ID
+     * @param preferredMethod - The preferred 2FA method (default: 'totp')
+     * @throws BadRequestException if no 2FA methods are configured
+     * @returns JSON:API response with the 2FA config
+     */
+    async enable(userId, preferredMethod = "totp") {
+        // Check that at least one method is available
+        const [hasTotp, hasPasskey] = await Promise.all([
+            this.totpService.hasVerifiedAuthenticator({ userId }),
+            this.passkeyService.hasPasskeys({ userId }),
+        ]);
+        if (!hasTotp && !hasPasskey) {
+            throw new common_1.BadRequestException("Cannot enable 2FA without at least one configured method (TOTP or Passkey)");
+        }
+        // Validate preferred method is available
+        if (preferredMethod === "totp" && !hasTotp) {
+            preferredMethod = "passkey";
+        }
+        else if (preferredMethod === "passkey" && !hasPasskey) {
+            preferredMethod = "totp";
+        }
+        // Get or create config
+        const existingConfig = await this.twoFactorConfigRepository.findByUserId({ userId });
+        let config;
+        if (existingConfig) {
+            config = await this.twoFactorConfigRepository.updateByUserId({
+                userId,
+                isEnabled: true,
+                preferredMethod,
+            });
+        }
+        else {
+            config = await this.twoFactorConfigRepository.createForUser({
+                configId: crypto.randomUUID(),
+                userId,
+                isEnabled: true,
+                preferredMethod,
+            });
+        }
+        return this.jsonApiService.buildSingle(two_factor_config_1.TwoFactorConfigDescriptor.model, config);
+    }
+    /**
+     * Disable 2FA for a user.
+     *
+     * @param userId - The user's ID
+     */
+    async disable(userId) {
+        const config = await this.twoFactorConfigRepository.findByUserId({ userId });
+        if (!config) {
+            return null;
+        }
+        return this.twoFactorConfigRepository.updateByUserId({
+            userId,
+            isEnabled: false,
+        });
+    }
+    /**
+     * Set the preferred 2FA method for a user.
+     *
+     * @param userId - The user's ID
+     * @param method - The preferred method
+     * @throws BadRequestException if the method is not available
+     */
+    async setPreferredMethod(userId, method) {
+        // Validate the method is available
+        let isAvailable = false;
+        switch (method) {
+            case "totp":
+                isAvailable = await this.totpService.hasVerifiedAuthenticator({ userId });
+                break;
+            case "passkey":
+                isAvailable = await this.passkeyService.hasPasskeys({ userId });
+                break;
+            case "backup":
+                throw new common_1.BadRequestException("Backup codes cannot be set as preferred method");
+        }
+        if (!isAvailable) {
+            throw new common_1.BadRequestException(`Cannot set ${method} as preferred - method not configured`);
+        }
+        const config = await this.twoFactorConfigRepository.findByUserId({ userId });
+        if (!config) {
+            throw new common_1.NotFoundException("Two-factor configuration not found");
+        }
+        return this.twoFactorConfigRepository.updateByUserId({
+            userId,
+            preferredMethod: method,
+        });
+    }
+    /**
+     * Create a pending 2FA session after successful password validation.
+     * This is called by the auth service when a user with 2FA enabled logs in.
+     *
+     * @param userId - The user's ID
+     * @returns The pending session info
+     */
+    async createPendingSession(userId) {
+        const pendingId = crypto.randomUUID();
+        const expiration = new Date(Date.now() + this.pendingTtlSeconds * 1000);
+        // Create the pending session with a simple challenge
+        // The challenge is just a random string for session identification
+        const challenge = crypto.randomBytes(32).toString("base64url");
+        await this.pendingTwoFactorRepository.createForUser({
+            pendingId,
+            userId,
+            challenge,
+            challengeType: "login",
+            expiration,
+        });
+        return {
+            pendingId,
+            expiration,
+        };
+    }
+    /**
+     * Get available 2FA methods for a user during login.
+     *
+     * @param userId - The user's ID
+     * @returns Array of available method names
+     */
+    async getAvailableMethods(userId) {
+        const [hasTotp, hasPasskey, backupCodesCount] = await Promise.all([
+            this.totpService.hasVerifiedAuthenticator({ userId }),
+            this.passkeyService.hasPasskeys({ userId }),
+            this.backupCodeService.getRawUnusedCount({ userId }),
+        ]);
+        const methods = [];
+        if (hasTotp)
+            methods.push("totp");
+        if (hasPasskey)
+            methods.push("passkey");
+        if (backupCodesCount > 0)
+            methods.push("backup");
+        return methods;
+    }
+    /**
+     * Verify a TOTP code for 2FA login.
+     *
+     * @param pendingId - The pending session ID from createPendingSession
+     * @param code - The 6-digit TOTP code
+     * @returns JSON:API response with verification result
+     */
+    async verifyTotp(pendingId, code) {
+        const pendingData = await this.validateAndGetPending(pendingId, "login");
+        // Check attempt count
+        const attemptCount = await this.pendingTwoFactorRepository.incrementAttemptCount({ pendingId });
+        if (attemptCount > this.maxTotpAttempts) {
+            await this.pendingTwoFactorRepository.deletePending({ pendingId });
+            throw new common_1.BadRequestException("Maximum TOTP attempts exceeded");
+        }
+        // Verify the code
+        const authenticatorId = await this.totpService.verifyCodeForUser({
+            userId: pendingData.userId,
+            code,
+        });
+        if (!authenticatorId) {
+            return this.jsonApiService.buildSingle(two_factor_verification_1.TwoFactorVerificationDescriptor.model, {
+                id: pendingId,
+                success: false,
+            });
+        }
+        // Clean up the pending session
+        await this.pendingTwoFactorRepository.deletePending({ pendingId });
+        return this.jsonApiService.buildSingle(two_factor_verification_1.TwoFactorVerificationDescriptor.model, {
+            id: pendingId,
+            success: true,
+            userId: pendingData.userId,
+        });
+    }
+    /**
+     * Verify a passkey for 2FA login.
+     *
+     * @param pendingId - The pending session ID
+     * @param response - The WebAuthn authentication response
+     * @returns JSON:API response with verification result
+     */
+    async verifyPasskey(pendingId, response) {
+        const pendingData = await this.validateAndGetPending(pendingId, "login");
+        // Check attempt count
+        const attemptCount = await this.pendingTwoFactorRepository.incrementAttemptCount({ pendingId });
+        if (attemptCount > this.maxPasskeyAttempts) {
+            await this.pendingTwoFactorRepository.deletePending({ pendingId });
+            throw new common_1.BadRequestException("Maximum passkey attempts exceeded");
+        }
+        // For passkey verification during login, we need to use the existing passkey challenge
+        // But since this is a 2FA flow after password, we're verifying differently
+        // We need to generate auth options first if not already done
+        try {
+            // First, generate authentication options
+            const authOptions = await this.passkeyService.generateAuthenticationOptions({
+                userId: pendingData.userId,
+            });
+            // Note: In a real implementation, the client would need to perform the WebAuthn
+            // ceremony with these options. For the 2FA flow, we're doing a simplified verification.
+            // The actual passkey verification happens via the passkey.service.verifyAuthentication
+            const passkeyId = await this.passkeyService.verifyAuthentication({
+                pendingId: authOptions.data.attributes.pendingId,
+                response,
+            });
+            if (!passkeyId) {
+                return this.jsonApiService.buildSingle(two_factor_verification_1.TwoFactorVerificationDescriptor.model, {
+                    id: pendingId,
+                    success: false,
+                });
+            }
+            // Clean up the login pending session
+            await this.pendingTwoFactorRepository.deletePending({ pendingId });
+            return this.jsonApiService.buildSingle(two_factor_verification_1.TwoFactorVerificationDescriptor.model, {
+                id: pendingId,
+                success: true,
+                userId: pendingData.userId,
+            });
+        }
+        catch {
+            return this.jsonApiService.buildSingle(two_factor_verification_1.TwoFactorVerificationDescriptor.model, {
+                id: pendingId,
+                success: false,
+            });
+        }
+    }
+    /**
+     * Verify a backup code for 2FA login.
+     *
+     * @param pendingId - The pending session ID
+     * @param code - The backup code
+     * @returns JSON:API response with verification result
+     */
+    async verifyBackupCode(pendingId, code) {
+        const pendingData = await this.validateAndGetPending(pendingId, "login");
+        // Check attempt count
+        const attemptCount = await this.pendingTwoFactorRepository.incrementAttemptCount({ pendingId });
+        if (attemptCount > this.maxBackupAttempts) {
+            await this.pendingTwoFactorRepository.deletePending({ pendingId });
+            throw new common_1.BadRequestException("Maximum backup code attempts exceeded");
+        }
+        // Verify the backup code
+        const isValid = await this.backupCodeService.validateCode({
+            userId: pendingData.userId,
+            code,
+        });
+        if (!isValid) {
+            return this.jsonApiService.buildSingle(two_factor_verification_1.TwoFactorVerificationDescriptor.model, {
+                id: pendingId,
+                success: false,
+            });
+        }
+        // Update backup codes count in config
+        const unusedCount = await this.backupCodeService.getRawUnusedCount({ userId: pendingData.userId });
+        await this.twoFactorConfigRepository.updateByUserId({
+            userId: pendingData.userId,
+            backupCodesCount: unusedCount,
+        });
+        // Clean up the pending session
+        await this.pendingTwoFactorRepository.deletePending({ pendingId });
+        return this.jsonApiService.buildSingle(two_factor_verification_1.TwoFactorVerificationDescriptor.model, {
+            id: pendingId,
+            success: true,
+            userId: pendingData.userId,
+        });
+    }
+    /**
+     * Get pending session info by ID.
+     *
+     * @param pendingId - The pending session ID
+     * @returns The pending session data if found
+     */
+    async getPendingSession(pendingId) {
+        return this.pendingTwoFactorRepository.findByIdWithUser({ pendingId });
+    }
+    /**
+     * Delete a pending session.
+     *
+     * @param pendingId - The pending session ID
+     */
+    async deletePendingSession(pendingId) {
+        await this.pendingTwoFactorRepository.deletePending({ pendingId });
+    }
+    /**
+     * Update backup codes count in the config.
+     * Called after generating or using backup codes.
+     *
+     * @param userId - The user's ID
+     */
+    async updateBackupCodesCount(userId) {
+        const unusedCount = await this.backupCodeService.getRawUnusedCount({ userId });
+        const config = await this.twoFactorConfigRepository.findByUserId({ userId });
+        if (config) {
+            await this.twoFactorConfigRepository.updateByUserId({
+                userId,
+                backupCodesCount: unusedCount,
+            });
+        }
+    }
+    /**
+     * Check if 2FA should be automatically disabled due to no methods remaining.
+     * Called when removing the last TOTP authenticator or passkey.
+     *
+     * @param userId - The user's ID
+     * @returns true if 2FA was disabled
+     */
+    async checkAndDisableIfNoMethods(userId) {
+        const [hasTotp, hasPasskey] = await Promise.all([
+            this.totpService.hasVerifiedAuthenticator({ userId }),
+            this.passkeyService.hasPasskeys({ userId }),
+        ]);
+        if (!hasTotp && !hasPasskey) {
+            const config = await this.twoFactorConfigRepository.findByUserId({ userId });
+            if (config?.isEnabled) {
+                await this.disable(userId);
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Validate a pending session and return its data.
+     *
+     * @param pendingId - The pending session ID
+     * @param expectedType - The expected challenge type
+     * @throws NotFoundException if session not found
+     * @throws BadRequestException if session expired or wrong type
+     */
+    async validateAndGetPending(pendingId, expectedType) {
+        const pendingData = await this.pendingTwoFactorRepository.findByIdWithUser({ pendingId });
+        if (!pendingData) {
+            throw new common_1.NotFoundException("Pending 2FA session not found");
+        }
+        const { pending } = pendingData;
+        // Check challenge type
+        if (pending.challengeType !== expectedType) {
+            throw new common_1.BadRequestException(`Invalid challenge type: expected ${expectedType}`);
+        }
+        // Check expiration
+        if (new Date() > pending.expiration) {
+            await this.pendingTwoFactorRepository.deletePending({ pendingId });
+            throw new common_1.BadRequestException("2FA session has expired");
+        }
+        return pendingData;
+    }
+};
+exports.TwoFactorService = TwoFactorService;
+exports.TwoFactorService = TwoFactorService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jsonapi_service_1.JsonApiService,
+        two_factor_config_repository_1.TwoFactorConfigRepository,
+        pending_two_factor_repository_1.PendingTwoFactorRepository,
+        totp_service_1.TotpService,
+        passkey_service_1.PasskeyService,
+        backup_code_service_1.BackupCodeService])
+], TwoFactorService);
+//# sourceMappingURL=two-factor.service.js.map

package/dist/foundations/two-factor/services/two-factor.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.service.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/services/two-factor.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoF;AACpF,+CAAiC;AACjC,6DAAyD;AACzD,oFAAgF;AAEhF,qEAA2F;AAC3F,qEAA0E;AAC1E,iFAAsF;AACtF,iGAA2F;AAC3F,+FAAyF;AACzF,+DAA0D;AAC1D,uDAAmD;AACnD,iDAA6C;AAyB7C;;;;;;GAMG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAM3B,YACmB,cAA8B,EAC9B,yBAAoD,EACpD,0BAAsD,EACtD,WAAwB,EACxB,cAA8B,EAC9B,iBAAoC;QALpC,mBAAc,GAAd,cAAc,CAAgB;QAC9B,8BAAyB,GAAzB,yBAAyB,CAA2B;QACpD,+BAA0B,GAA1B,0BAA0B,CAA4B;QACtD,gBAAW,GAAX,WAAW,CAAa;QACxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAVtC,oBAAe,GAAG,CAAC,CAAC;QACpB,uBAAkB,GAAG,CAAC,CAAC;QACvB,sBAAiB,GAAG,CAAC,CAAC;QAUrC,IAAI,CAAC,iBAAiB,GAAG,wBAAU,CAAC,SAAS,EAAE,UAAU,IAAI,GAAG,CAAC,CAAC,oBAAoB;IACxF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7E,wCAAwC;QACxC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChE,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;YACrD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,gBAAgB,GAAG,CAAC,CAAC;QAEvC,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,6CAAyB,CAAC,KAAK,EAAE;YACtE,EAAE,EAAE,MAAM;YACV,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,KAAK;YACrC,eAAe,EAAG,MAAM,EAAE,eAAmC,IAAI,MAAM;YACvE,OAAO,EAAE;gBACP,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,SAAS;aAClB;YACD,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,kBAAmC,MAAM;QACpE,8CAA8C;QAC9C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;YACrD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,4EAA4E,CAAC,CAAC;QAC9G,CAAC;QAED,yCAAyC;QACzC,IAAI,eAAe,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,eAAe,GAAG,SAAS,CAAC;QAC9B,CAAC;aAAM,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YACxD,eAAe,GAAG,MAAM,CAAC;QAC3B,CAAC;QAED,uBAAuB;QACvB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAErF,IAAI,MAAuB,CAAC;QAC5B,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC;gBAC3D,MAAM;gBACN,SAAS,EAAE,IAAI;gBACf,eAAe;aAChB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,aAAa,CAAC;gBAC1D,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE;gBAC7B,MAAM;gBACN,SAAS,EAAE,IAAI;gBACf,eAAe;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,6CAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC;YACnD,MAAM;YACN,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,MAAuB;QAC9D,mCAAmC;QACnC,IAAI,WAAW,GAAG,KAAK,CAAC;QAExB,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,MAAM;gBACT,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1E,MAAM;YACR,KAAK,SAAS;gBACZ,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChE,MAAM;YACR,KAAK,QAAQ;gBACX,MAAM,IAAI,4BAAmB,CAAC,gDAAgD,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,4BAAmB,CAAC,cAAc,MAAM,uCAAuC,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,0BAAiB,CAAC,oCAAoC,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC;YACnD,MAAM;YACN,eAAe,EAAE,MAAM;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;QAExE,qDAAqD;QACrD,mEAAmE;QACnE,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE/D,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC;YAClD,SAAS;YACT,MAAM;YACN,SAAS;YACT,aAAa,EAAE,OAAO;YACtB,UAAU;SACX,CAAC,CAAC;QAEH,OAAO;YACL,SAAS;YACT,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CAAC,MAAc;QACtC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChE,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;YACrD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;SACrD,CAAC,CAAC;QAEH,MAAM,OAAO,GAAsB,EAAE,CAAC;QAEtC,IAAI,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,UAAU;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,gBAAgB,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAAY;QAC9C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEzE,sBAAsB;QACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,IAAI,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACxC,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,4BAAmB,CAAC,gCAAgC,CAAC,CAAC;QAClE,CAAC;QAED,kBAAkB;QAClB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAC/D,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;gBAC5E,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAED,+BAA+B;QAC/B,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;YAC5E,EAAE,EAAE,SAAS;YACb,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,QAAyF;QAEzF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEzE,sBAAsB;QACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,IAAI,YAAY,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,4BAAmB,CAAC,mCAAmC,CAAC,CAAC;QACrE,CAAC;QAED,uFAAuF;QACvF,2EAA2E;QAC3E,6DAA6D;QAC7D,IAAI,CAAC;YACH,yCAAyC;YACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC;gBAC1E,MAAM,EAAE,WAAW,CAAC,MAAM;aAC3B,CAAC,CAAC;YAEH,gFAAgF;YAChF,wFAAwF;YACxF,uFAAuF;YACvF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBAC/D,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS;gBAChD,QAAQ;aACT,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;oBAC5E,EAAE,EAAE,SAAS;oBACb,OAAO,EAAE,KAAK;iBACf,CAAC,CAAC;YACL,CAAC;YAED,qCAAqC;YACrC,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YAEnE,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;gBAC5E,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,WAAW,CAAC,MAAM;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;gBAC5E,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,IAAY;QACpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEzE,sBAAsB;QACtB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,IAAI,YAAY,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1C,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;QACzE,CAAC;QAED,yBAAyB;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;YACxD,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;gBAC5E,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC;QAED,sCAAsC;QACtC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACnG,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC;YAClD,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,gBAAgB,EAAE,WAAW;SAC9B,CAAC,CAAC;QAEH,+BAA+B;QAC/B,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAEnE,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;YAC5E,EAAE,EAAE,SAAS;YACb,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,OAAO,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QAC1C,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAAC,MAAc;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,yBAAyB,CAAC,cAAc,CAAC;gBAClD,MAAM;gBACN,gBAAgB,EAAE,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,0BAA0B,CAAC,MAAc;QAC7C,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;YACrD,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7E,IAAI,MAAM,EAAE,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,qBAAqB,CACjC,SAAiB,EACjB,YAAoB;QAEpB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,0BAAiB,CAAC,+BAA+B,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;QAEhC,uBAAuB;QACvB,IAAI,OAAO,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YAC3C,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAA;AAxcY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAQwB,gCAAc;QACH,wDAAyB;QACxB,0DAA0B;QACzC,0BAAW;QACR,gCAAc;QACX,uCAAiB;GAZ5C,gBAAgB,CAwc5B"}

package/dist/foundations/two-factor/two-factor.module.d.ts

@@ -0,0 +1,23 @@
+import { OnModuleInit } from "@nestjs/common";
+/**
+ * TwoFactorModule - Two-Factor Authentication Module
+ *
+ * Provides comprehensive 2FA functionality including:
+ * - TOTP (Time-based One-Time Password) authentication
+ * - Passkey/WebAuthn authentication
+ * - Backup codes for account recovery
+ * - Pending session management for 2FA login flow
+ *
+ * @example
+ * ```typescript
+ * // Import in AuthModule
+ * @Module({
+ *   imports: [TwoFactorModule],
+ * })
+ * export class AuthModule {}
+ * ```
+ */
+export declare class TwoFactorModule implements OnModuleInit {
+    onModuleInit(): void;
+}
+//# sourceMappingURL=two-factor.module.d.ts.map

package/dist/foundations/two-factor/two-factor.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.module.d.ts","sourceRoot":"","sources":["../../../src/foundations/two-factor/two-factor.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AA2ClE;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAkDa,eAAgB,YAAW,YAAY;IAClD,YAAY;CAgBb"}

package/dist/foundations/two-factor/two-factor.module.js

@@ -0,0 +1,132 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorModule = void 0;
+const common_1 = require("@nestjs/common");
+const registry_1 = require("../../common/registries/registry");
+const jsonapi_module_1 = require("../../core/jsonapi/jsonapi.module");
+const auth_module_1 = require("../auth/auth.module");
+const user_module_1 = require("../user/user.module");
+// Controllers
+const passkey_controller_1 = require("./controllers/passkey.controller");
+const totp_controller_1 = require("./controllers/totp.controller");
+const two_factor_controller_1 = require("./controllers/two-factor.controller");
+// Entity Descriptors (models for registration)
+const backup_code_1 = require("./entities/backup-code");
+const backup_codes_count_1 = require("./entities/backup-codes-count");
+const backup_codes_generation_1 = require("./entities/backup-codes-generation");
+const passkey_1 = require("./entities/passkey");
+const passkey_authentication_options_1 = require("./entities/passkey-authentication-options");
+const passkey_registration_options_1 = require("./entities/passkey-registration-options");
+const pending_two_factor_1 = require("./entities/pending-two-factor");
+const totp_authenticator_1 = require("./entities/totp-authenticator");
+const totp_setup_1 = require("./entities/totp-setup");
+const two_factor_challenge_1 = require("./entities/two-factor-challenge");
+const two_factor_config_1 = require("./entities/two-factor-config");
+const two_factor_status_1 = require("./entities/two-factor-status");
+const two_factor_verification_1 = require("./entities/two-factor-verification");
+// Repositories
+const backup_code_repository_1 = require("./repositories/backup-code.repository");
+const passkey_repository_1 = require("./repositories/passkey.repository");
+const pending_two_factor_repository_1 = require("./repositories/pending-two-factor.repository");
+const totp_authenticator_repository_1 = require("./repositories/totp-authenticator.repository");
+const two_factor_config_repository_1 = require("./repositories/two-factor-config.repository");
+// Services
+const backup_code_service_1 = require("./services/backup-code.service");
+const passkey_service_1 = require("./services/passkey.service");
+const totp_encryption_service_1 = require("./services/totp-encryption.service");
+const totp_service_1 = require("./services/totp.service");
+const two_factor_service_1 = require("./services/two-factor.service");
+// Guards
+const pending_auth_guard_1 = require("./guards/pending-auth.guard");
+/**
+ * TwoFactorModule - Two-Factor Authentication Module
+ *
+ * Provides comprehensive 2FA functionality including:
+ * - TOTP (Time-based One-Time Password) authentication
+ * - Passkey/WebAuthn authentication
+ * - Backup codes for account recovery
+ * - Pending session management for 2FA login flow
+ *
+ * @example
+ * ```typescript
+ * // Import in AuthModule
+ * @Module({
+ *   imports: [TwoFactorModule],
+ * })
+ * export class AuthModule {}
+ * ```
+ */
+let TwoFactorModule = class TwoFactorModule {
+    onModuleInit() {
+        // Register all 2FA models with the global model registry
+        registry_1.modelRegistry.register(backup_code_1.BackupCodeDescriptor.model);
+        registry_1.modelRegistry.register(backup_codes_count_1.BackupCodesCountDescriptor.model);
+        registry_1.modelRegistry.register(backup_codes_generation_1.BackupCodesGenerationDescriptor.model);
+        registry_1.modelRegistry.register(passkey_1.PasskeyDescriptor.model);
+        registry_1.modelRegistry.register(passkey_authentication_options_1.PasskeyAuthenticationOptionsDescriptor.model);
+        registry_1.modelRegistry.register(passkey_registration_options_1.PasskeyRegistrationOptionsDescriptor.model);
+        registry_1.modelRegistry.register(pending_two_factor_1.PendingTwoFactorDescriptor.model);
+        registry_1.modelRegistry.register(totp_authenticator_1.TotpAuthenticatorDescriptor.model);
+        registry_1.modelRegistry.register(totp_setup_1.TotpSetupDescriptor.model);
+        registry_1.modelRegistry.register(two_factor_challenge_1.TwoFactorChallengeDescriptor.model);
+        registry_1.modelRegistry.register(two_factor_config_1.TwoFactorConfigDescriptor.model);
+        registry_1.modelRegistry.register(two_factor_status_1.TwoFactorStatusDescriptor.model);
+        registry_1.modelRegistry.register(two_factor_verification_1.TwoFactorVerificationDescriptor.model);
+    }
+};
+exports.TwoFactorModule = TwoFactorModule;
+exports.TwoFactorModule = TwoFactorModule = __decorate([
+    (0, common_1.Module)({
+        imports: [jsonapi_module_1.JsonApiModule, user_module_1.UserModule, (0, common_1.forwardRef)(() => auth_module_1.AuthModule)],
+        controllers: [passkey_controller_1.PasskeyController, totp_controller_1.TotpController, two_factor_controller_1.TwoFactorController],
+        providers: [
+            // Serializers from descriptors
+            backup_code_1.BackupCodeDescriptor.model.serialiser,
+            backup_codes_count_1.BackupCodesCountDescriptor.model.serialiser,
+            backup_codes_generation_1.BackupCodesGenerationDescriptor.model.serialiser,
+            passkey_1.PasskeyDescriptor.model.serialiser,
+            passkey_authentication_options_1.PasskeyAuthenticationOptionsDescriptor.model.serialiser,
+            passkey_registration_options_1.PasskeyRegistrationOptionsDescriptor.model.serialiser,
+            pending_two_factor_1.PendingTwoFactorDescriptor.model.serialiser,
+            totp_authenticator_1.TotpAuthenticatorDescriptor.model.serialiser,
+            totp_setup_1.TotpSetupDescriptor.model.serialiser,
+            two_factor_challenge_1.TwoFactorChallengeDescriptor.model.serialiser,
+            two_factor_config_1.TwoFactorConfigDescriptor.model.serialiser,
+            two_factor_status_1.TwoFactorStatusDescriptor.model.serialiser,
+            two_factor_verification_1.TwoFactorVerificationDescriptor.model.serialiser,
+            // Repositories
+            backup_code_repository_1.BackupCodeRepository,
+            passkey_repository_1.PasskeyRepository,
+            pending_two_factor_repository_1.PendingTwoFactorRepository,
+            totp_authenticator_repository_1.TotpAuthenticatorRepository,
+            two_factor_config_repository_1.TwoFactorConfigRepository,
+            // Services
+            backup_code_service_1.BackupCodeService,
+            passkey_service_1.PasskeyService,
+            totp_encryption_service_1.TotpEncryptionService,
+            totp_service_1.TotpService,
+            two_factor_service_1.TwoFactorService,
+            // Guards
+            pending_auth_guard_1.PendingAuthGuard,
+        ],
+        exports: [
+            // Export services for use by other modules (e.g., AuthModule)
+            two_factor_service_1.TwoFactorService,
+            totp_service_1.TotpService,
+            passkey_service_1.PasskeyService,
+            backup_code_service_1.BackupCodeService,
+            totp_encryption_service_1.TotpEncryptionService,
+            pending_auth_guard_1.PendingAuthGuard,
+            // Export repositories for advanced use cases
+            two_factor_config_repository_1.TwoFactorConfigRepository,
+            pending_two_factor_repository_1.PendingTwoFactorRepository,
+        ],
+    })
+], TwoFactorModule);
+//# sourceMappingURL=two-factor.module.js.map

package/dist/foundations/two-factor/two-factor.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.module.js","sourceRoot":"","sources":["../../../src/foundations/two-factor/two-factor.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAkE;AAClE,+DAAiE;AACjE,sEAAkE;AAClE,qDAAiD;AACjD,qDAAiD;AAEjD,cAAc;AACd,yEAAqE;AACrE,mEAA+D;AAC/D,+EAA0E;AAE1E,+CAA+C;AAC/C,wDAA8D;AAC9D,sEAA2E;AAC3E,gFAAqF;AACrF,gDAAuD;AACvD,8FAAmG;AACnG,0FAA+F;AAC/F,sEAA2E;AAC3E,sEAA4E;AAC5E,sDAA4D;AAC5D,0EAA+E;AAC/E,oEAAyE;AACzE,oEAAyE;AACzE,gFAAqF;AAErF,eAAe;AACf,kFAA6E;AAC7E,0EAAsE;AACtE,gGAA0F;AAC1F,gGAA2F;AAC3F,8FAAwF;AAExF,WAAW;AACX,wEAAmE;AACnE,gEAA4D;AAC5D,gFAA2E;AAC3E,0DAAsD;AACtD,sEAAiE;AAEjE,SAAS;AACT,oEAA+D;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AAmDI,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YAAY;QACV,yDAAyD;QACzD,wBAAa,CAAC,QAAQ,CAAC,kCAAoB,CAAC,KAAK,CAAC,CAAC;QACnD,wBAAa,CAAC,QAAQ,CAAC,+CAA0B,CAAC,KAAK,CAAC,CAAC;QACzD,wBAAa,CAAC,QAAQ,CAAC,yDAA+B,CAAC,KAAK,CAAC,CAAC;QAC9D,wBAAa,CAAC,QAAQ,CAAC,2BAAiB,CAAC,KAAK,CAAC,CAAC;QAChD,wBAAa,CAAC,QAAQ,CAAC,uEAAsC,CAAC,KAAK,CAAC,CAAC;QACrE,wBAAa,CAAC,QAAQ,CAAC,mEAAoC,CAAC,KAAK,CAAC,CAAC;QACnE,wBAAa,CAAC,QAAQ,CAAC,+CAA0B,CAAC,KAAK,CAAC,CAAC;QACzD,wBAAa,CAAC,QAAQ,CAAC,gDAA2B,CAAC,KAAK,CAAC,CAAC;QAC1D,wBAAa,CAAC,QAAQ,CAAC,gCAAmB,CAAC,KAAK,CAAC,CAAC;QAClD,wBAAa,CAAC,QAAQ,CAAC,mDAA4B,CAAC,KAAK,CAAC,CAAC;QAC3D,wBAAa,CAAC,QAAQ,CAAC,6CAAyB,CAAC,KAAK,CAAC,CAAC;QACxD,wBAAa,CAAC,QAAQ,CAAC,6CAAyB,CAAC,KAAK,CAAC,CAAC;QACxD,wBAAa,CAAC,QAAQ,CAAC,yDAA+B,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AAjBY,0CAAe;0BAAf,eAAe;IAlD3B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,8BAAa,EAAE,wBAAU,EAAE,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC,CAAC;QAClE,WAAW,EAAE,CAAC,sCAAiB,EAAE,gCAAc,EAAE,2CAAmB,CAAC;QACrE,SAAS,EAAE;YACT,+BAA+B;YAC/B,kCAAoB,CAAC,KAAK,CAAC,UAAU;YACrC,+CAA0B,CAAC,KAAK,CAAC,UAAU;YAC3C,yDAA+B,CAAC,KAAK,CAAC,UAAU;YAChD,2BAAiB,CAAC,KAAK,CAAC,UAAU;YAClC,uEAAsC,CAAC,KAAK,CAAC,UAAU;YACvD,mEAAoC,CAAC,KAAK,CAAC,UAAU;YACrD,+CAA0B,CAAC,KAAK,CAAC,UAAU;YAC3C,gDAA2B,CAAC,KAAK,CAAC,UAAU;YAC5C,gCAAmB,CAAC,KAAK,CAAC,UAAU;YACpC,mDAA4B,CAAC,KAAK,CAAC,UAAU;YAC7C,6CAAyB,CAAC,KAAK,CAAC,UAAU;YAC1C,6CAAyB,CAAC,KAAK,CAAC,UAAU;YAC1C,yDAA+B,CAAC,KAAK,CAAC,UAAU;YAEhD,eAAe;YACf,6CAAoB;YACpB,sCAAiB;YACjB,0DAA0B;YAC1B,2DAA2B;YAC3B,wDAAyB;YAEzB,WAAW;YACX,uCAAiB;YACjB,gCAAc;YACd,+CAAqB;YACrB,0BAAW;YACX,qCAAgB;YAEhB,SAAS;YACT,qCAAgB;SACjB;QACD,OAAO,EAAE;YACP,8DAA8D;YAC9D,qCAAgB;YAChB,0BAAW;YACX,gCAAc;YACd,uCAAiB;YACjB,+CAAqB;YACrB,qCAAgB;YAEhB,6CAA6C;YAC7C,wDAAyB;YACzB,0DAA0B;SAC3B;KACF,CAAC;GACW,eAAe,CAiB3B"}

package/dist/foundations/user/repositories/user.repository.d.ts

@@ -16,6 +16,14 @@ export declare class UserRepository implements OnModuleInit {
     findOneForAdmin(params: {
         userId: string;
     }): Promise<User>;
+    /**
+     * Find user for 2FA login completion.
+     * Does NOT require companyId in CLS - finds company through user relationship.
+     * Returns user with roles, company, and features needed for token creation.
+     */
+    findForTwoFactorLogin(params: {
+        userId: string;
+    }): Promise<User>;
     findFullUser(params: {
         userId: string;
     }): Promise<User>;