@carlonicora/nestjs-neo4jsonapi 1.39.0 → 1.40.0

package/dist/foundations/two-factor/controllers/two-factor.controller.d.ts

@@ -0,0 +1,124 @@
+import { FastifyReply } from "fastify";
+import { AuthenticatedRequest } from "../../../common/interfaces/authenticated.request.interface";
+import { JsonApiService } from "../../../core/jsonapi/services/jsonapi.service";
+import { AuthService } from "../../auth/services/auth.service";
+import { PasskeyAuthenticationVerifyDTO } from "../dtos/passkey-verify.dto";
+import { TotpVerifyDTO } from "../dtos/totp-verify.dto";
+import { BackupCodeVerifyDTO, TwoFactorChallengeDTO, TwoFactorEnableDTO } from "../dtos/two-factor-verify.dto";
+import { PendingAuthPayload } from "../guards/pending-auth.guard";
+import { BackupCodeService } from "../services/backup-code.service";
+import { PasskeyService } from "../services/passkey.service";
+import { TwoFactorService } from "../services/two-factor.service";
+/**
+ * Request with pending auth payload attached.
+ */
+interface PendingAuthRequest {
+    pendingAuth: PendingAuthPayload;
+}
+/**
+ * Two-Factor Authentication Controller
+ *
+ * Handles 2FA status management and verification during login.
+ *
+ * Status/Enable/Disable endpoints require full JWT authentication.
+ * Verification endpoints require pending 2FA token (issued after password validation).
+ */
+export declare class TwoFactorController {
+    private readonly jsonApiService;
+    private readonly twoFactorService;
+    private readonly passkeyService;
+    private readonly backupCodeService;
+    private readonly authService;
+    private readonly logger;
+    constructor(jsonApiService: JsonApiService, twoFactorService: TwoFactorService, passkeyService: PasskeyService, backupCodeService: BackupCodeService, authService: AuthService);
+    /**
+     * GET /auth/two-factor/status
+     *
+     * Get the 2FA status for the authenticated user.
+     * Returns enabled state, preferred method, available methods, and backup codes count.
+     */
+    getStatus(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
+    /**
+     * POST /auth/two-factor/enable
+     *
+     * Enable 2FA for the authenticated user.
+     * Requires at least one 2FA method (TOTP or passkey) to be configured.
+     */
+    enable(req: AuthenticatedRequest, reply: FastifyReply, body: TwoFactorEnableDTO): Promise<void>;
+    /**
+     * POST /auth/two-factor/disable
+     *
+     * Disable 2FA for the authenticated user.
+     */
+    disable(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
+    /**
+     * POST /auth/two-factor/challenge
+     *
+     * Request a 2FA challenge for the specified method.
+     * For passkeys, returns WebAuthn authentication options.
+     * For TOTP and backup codes, returns a simple acknowledgment (no challenge needed).
+     *
+     * Requires pending 2FA token from login.
+     */
+    challenge(req: PendingAuthRequest, reply: FastifyReply, body: TwoFactorChallengeDTO): Promise<void>;
+    /**
+     * POST /auth/two-factor/verify/totp
+     *
+     * Verify a TOTP code to complete 2FA login.
+     * On success, the full JWT tokens are issued by the auth service.
+     *
+     * Requires pending 2FA token from login.
+     */
+    verifyTotp(req: PendingAuthRequest, reply: FastifyReply, body: TotpVerifyDTO): Promise<void>;
+    /**
+     * POST /auth/two-factor/verify/passkey/options
+     *
+     * Get passkey authentication options for 2FA verification.
+     * Returns WebAuthn options to be passed to navigator.credentials.get().
+     *
+     * Requires pending 2FA token from login.
+     */
+    getPasskeyOptions(req: PendingAuthRequest, reply: FastifyReply): Promise<void>;
+    /**
+     * POST /auth/two-factor/verify/passkey
+     *
+     * Verify a passkey to complete 2FA login.
+     * On success, the full JWT tokens are issued by the auth service.
+     *
+     * Requires pending 2FA token from login.
+     */
+    verifyPasskey(req: PendingAuthRequest, reply: FastifyReply, body: PasskeyAuthenticationVerifyDTO): Promise<void>;
+    /**
+     * POST /auth/two-factor/verify/backup
+     *
+     * Verify a backup code to complete 2FA login.
+     * Backup codes are single-use and will be marked as used after successful verification.
+     *
+     * Requires pending 2FA token from login.
+     */
+    verifyBackupCode(req: PendingAuthRequest, reply: FastifyReply, body: BackupCodeVerifyDTO): Promise<void>;
+    /**
+     * POST /auth/backup-codes/generate
+     *
+     * Generate new backup codes for the authenticated user.
+     * If the user already has backup codes, use regenerate endpoint instead.
+     * Returns the plain text codes ONCE - they should be shown to the user.
+     */
+    generateBackupCodes(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
+    /**
+     * POST /auth/backup-codes/regenerate
+     *
+     * Regenerate backup codes for the authenticated user.
+     * This deletes all existing codes (used and unused) and generates a new batch.
+     * Returns the new plain text codes ONCE - they should be shown to the user.
+     */
+    regenerateBackupCodes(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
+    /**
+     * GET /auth/backup-codes/count
+     *
+     * Get the count of unused backup codes for the authenticated user.
+     */
+    getBackupCodesCount(req: AuthenticatedRequest, reply: FastifyReply): Promise<void>;
+}
+export {};
+//# sourceMappingURL=two-factor.controller.d.ts.map

package/dist/foundations/two-factor/controllers/two-factor.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.controller.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/controllers/two-factor.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,MAAM,gDAAgD,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAG/G,OAAO,EAAoB,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAElE;;GAEG;AACH,UAAU,kBAAkB;IAC1B,WAAW,EAAE,kBAAkB,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,qBACa,mBAAmB;IAI5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAR9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;gBAGpD,cAAc,EAAE,cAAc,EAC9B,gBAAgB,EAAE,gBAAgB,EAClC,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,iBAAiB,EAEpC,WAAW,EAAE,WAAW;IAG3C;;;;;OAKG;IAGG,SAAS,CAAQ,GAAG,EAAE,oBAAoB,EAAS,KAAK,EAAE,YAAY;IAM5E;;;;;OAKG;IAGG,MAAM,CAAQ,GAAG,EAAE,oBAAoB,EAAS,KAAK,EAAE,YAAY,EAAU,IAAI,EAAE,kBAAkB;IAM3G;;;;OAIG;IAIG,OAAO,CAAQ,GAAG,EAAE,oBAAoB,EAAS,KAAK,EAAE,YAAY;IAM1E;;;;;;;;OAQG;IAGG,SAAS,CAAQ,GAAG,EAAE,kBAAkB,EAAS,KAAK,EAAE,YAAY,EAAU,IAAI,EAAE,qBAAqB;IA6B/G;;;;;;;OAOG;IAGG,UAAU,CAAQ,GAAG,EAAE,kBAAkB,EAAS,KAAK,EAAE,YAAY,EAAU,IAAI,EAAE,aAAa;IAgBxG;;;;;;;OAOG;IAGG,iBAAiB,CAAQ,GAAG,EAAE,kBAAkB,EAAS,KAAK,EAAE,YAAY;IAMlF;;;;;;;OAOG;IAGG,aAAa,CACV,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,YAAY,EAClB,IAAI,EAAE,8BAA8B;IA0B9C;;;;;;;OAOG;IAGG,gBAAgB,CACb,GAAG,EAAE,kBAAkB,EACvB,KAAK,EAAE,YAAY,EAClB,IAAI,EAAE,mBAAmB;IAiBnC;;;;;;OAMG;IAGG,mBAAmB,CAAQ,GAAG,EAAE,oBAAoB,EAAS,KAAK,EAAE,YAAY;IAUtF;;;;;;OAMG;IAGG,qBAAqB,CAAQ,GAAG,EAAE,oBAAoB,EAAS,KAAK,EAAE,YAAY;IAUxF;;;;OAIG;IAGG,mBAAmB,CAAQ,GAAG,EAAE,oBAAoB,EAAS,KAAK,EAAE,YAAY;CAKvF"}

package/dist/foundations/two-factor/controllers/two-factor.controller.js

@@ -0,0 +1,352 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var TwoFactorController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorController = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_auth_guard_1 = require("../../../common/guards/jwt.auth.guard");
+const jsonapi_service_1 = require("../../../core/jsonapi/services/jsonapi.service");
+const auth_service_1 = require("../../auth/services/auth.service");
+const passkey_verify_dto_1 = require("../dtos/passkey-verify.dto");
+const totp_verify_dto_1 = require("../dtos/totp-verify.dto");
+const two_factor_verify_dto_1 = require("../dtos/two-factor-verify.dto");
+const two_factor_challenge_1 = require("../entities/two-factor-challenge");
+const two_factor_verification_1 = require("../entities/two-factor-verification");
+const pending_auth_guard_1 = require("../guards/pending-auth.guard");
+const backup_code_service_1 = require("../services/backup-code.service");
+const passkey_service_1 = require("../services/passkey.service");
+const two_factor_service_1 = require("../services/two-factor.service");
+/**
+ * Two-Factor Authentication Controller
+ *
+ * Handles 2FA status management and verification during login.
+ *
+ * Status/Enable/Disable endpoints require full JWT authentication.
+ * Verification endpoints require pending 2FA token (issued after password validation).
+ */
+let TwoFactorController = TwoFactorController_1 = class TwoFactorController {
+    constructor(jsonApiService, twoFactorService, passkeyService, backupCodeService, authService) {
+        this.jsonApiService = jsonApiService;
+        this.twoFactorService = twoFactorService;
+        this.passkeyService = passkeyService;
+        this.backupCodeService = backupCodeService;
+        this.authService = authService;
+        this.logger = new common_1.Logger(TwoFactorController_1.name);
+    }
+    /**
+     * GET /auth/two-factor/status
+     *
+     * Get the 2FA status for the authenticated user.
+     * Returns enabled state, preferred method, available methods, and backup codes count.
+     */
+    async getStatus(req, reply) {
+        const userId = req.user.userId;
+        const response = await this.twoFactorService.getStatus(userId);
+        reply.send(response);
+    }
+    /**
+     * POST /auth/two-factor/enable
+     *
+     * Enable 2FA for the authenticated user.
+     * Requires at least one 2FA method (TOTP or passkey) to be configured.
+     */
+    async enable(req, reply, body) {
+        const userId = req.user.userId;
+        const response = await this.twoFactorService.enable(userId, body.data.attributes.preferredMethod);
+        reply.send(response);
+    }
+    /**
+     * POST /auth/two-factor/disable
+     *
+     * Disable 2FA for the authenticated user.
+     */
+    async disable(req, reply) {
+        const userId = req.user.userId;
+        await this.twoFactorService.disable(userId);
+        reply.send();
+    }
+    /**
+     * POST /auth/two-factor/challenge
+     *
+     * Request a 2FA challenge for the specified method.
+     * For passkeys, returns WebAuthn authentication options.
+     * For TOTP and backup codes, returns a simple acknowledgment (no challenge needed).
+     *
+     * Requires pending 2FA token from login.
+     */
+    async challenge(req, reply, body) {
+        const { userId, pendingId } = req.pendingAuth;
+        const method = body.data.attributes.method;
+        if (method === "passkey") {
+            // Generate WebAuthn authentication options - service returns JSON:API
+            const optionsResponse = await this.passkeyService.generateAuthenticationOptions({ userId });
+            // Build challenge response with passkey options
+            const response = this.jsonApiService.buildSingle(two_factor_challenge_1.TwoFactorChallengeDescriptor.model, {
+                id: pendingId,
+                method: "passkey",
+                pendingId: optionsResponse.data.attributes.pendingId,
+                options: optionsResponse.data.attributes.options,
+            });
+            reply.send(response);
+            return;
+        }
+        // For TOTP and backup codes, no challenge is needed - just return available methods
+        const methods = await this.twoFactorService.getAvailableMethods(userId);
+        const response = this.jsonApiService.buildSingle(two_factor_challenge_1.TwoFactorChallengeDescriptor.model, {
+            id: pendingId,
+            method,
+            pendingId,
+            availableMethods: methods,
+        });
+        reply.send(response);
+    }
+    /**
+     * POST /auth/two-factor/verify/totp
+     *
+     * Verify a TOTP code to complete 2FA login.
+     * On success, the full JWT tokens are issued by the auth service.
+     *
+     * Requires pending 2FA token from login.
+     */
+    async verifyTotp(req, reply, body) {
+        const { pendingId, userId } = req.pendingAuth;
+        const verificationResult = await this.twoFactorService.verifyTotp(pendingId, body.data.attributes.code);
+        // Check if verification was successful
+        if (verificationResult.data?.attributes?.success) {
+            // Return full auth tokens
+            const authResponse = await this.authService.completeTwoFactorLogin(userId);
+            reply.send(authResponse);
+            return;
+        }
+        // Verification failed - return the error response
+        reply.send(verificationResult);
+    }
+    /**
+     * POST /auth/two-factor/verify/passkey/options
+     *
+     * Get passkey authentication options for 2FA verification.
+     * Returns WebAuthn options to be passed to navigator.credentials.get().
+     *
+     * Requires pending 2FA token from login.
+     */
+    async getPasskeyOptions(req, reply) {
+        const { userId } = req.pendingAuth;
+        const response = await this.passkeyService.generateAuthenticationOptions({ userId });
+        reply.send(response);
+    }
+    /**
+     * POST /auth/two-factor/verify/passkey
+     *
+     * Verify a passkey to complete 2FA login.
+     * On success, the full JWT tokens are issued by the auth service.
+     *
+     * Requires pending 2FA token from login.
+     */
+    async verifyPasskey(req, reply, body) {
+        const { pendingId } = body.data.attributes;
+        const passkeyId = await this.passkeyService.verifyAuthentication({
+            pendingId,
+            response: body.data.attributes.response,
+        });
+        // Delete the login pending session
+        await this.twoFactorService.deletePendingSession(req.pendingAuth.pendingId);
+        if (passkeyId) {
+            // Verification successful - return full auth tokens
+            const authResponse = await this.authService.completeTwoFactorLogin(req.pendingAuth.userId);
+            reply.send(authResponse);
+            return;
+        }
+        // Verification failed
+        const response = this.jsonApiService.buildSingle(two_factor_verification_1.TwoFactorVerificationDescriptor.model, {
+            id: req.pendingAuth.pendingId,
+            success: false,
+        });
+        reply.send(response);
+    }
+    /**
+     * POST /auth/two-factor/verify/backup
+     *
+     * Verify a backup code to complete 2FA login.
+     * Backup codes are single-use and will be marked as used after successful verification.
+     *
+     * Requires pending 2FA token from login.
+     */
+    async verifyBackupCode(req, reply, body) {
+        const { pendingId, userId } = req.pendingAuth;
+        const verificationResult = await this.twoFactorService.verifyBackupCode(pendingId, body.data.attributes.code);
+        // Check if verification was successful
+        if (verificationResult.data?.attributes?.success) {
+            // Return full auth tokens
+            const authResponse = await this.authService.completeTwoFactorLogin(userId);
+            reply.send(authResponse);
+            return;
+        }
+        // Verification failed - return the error response
+        reply.send(verificationResult);
+    }
+    /**
+     * POST /auth/backup-codes/generate
+     *
+     * Generate new backup codes for the authenticated user.
+     * If the user already has backup codes, use regenerate endpoint instead.
+     * Returns the plain text codes ONCE - they should be shown to the user.
+     */
+    async generateBackupCodes(req, reply) {
+        const userId = req.user.userId;
+        const response = await this.backupCodeService.generateCodes({ userId });
+        // Update backup codes count in 2FA config
+        await this.twoFactorService.updateBackupCodesCount(userId);
+        reply.send(response);
+    }
+    /**
+     * POST /auth/backup-codes/regenerate
+     *
+     * Regenerate backup codes for the authenticated user.
+     * This deletes all existing codes (used and unused) and generates a new batch.
+     * Returns the new plain text codes ONCE - they should be shown to the user.
+     */
+    async regenerateBackupCodes(req, reply) {
+        const userId = req.user.userId;
+        const response = await this.backupCodeService.regenerateCodes({ userId });
+        // Update backup codes count in 2FA config
+        await this.twoFactorService.updateBackupCodesCount(userId);
+        reply.send(response);
+    }
+    /**
+     * GET /auth/backup-codes/count
+     *
+     * Get the count of unused backup codes for the authenticated user.
+     */
+    async getBackupCodesCount(req, reply) {
+        const userId = req.user.userId;
+        const response = await this.backupCodeService.getUnusedCount({ userId });
+        reply.send(response);
+    }
+};
+exports.TwoFactorController = TwoFactorController;
+__decorate([
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, common_1.Get)("two-factor/status"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "getStatus", null);
+__decorate([
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, common_1.Post)("two-factor/enable"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, two_factor_verify_dto_1.TwoFactorEnableDTO]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "enable", null);
+__decorate([
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, common_1.Post)("two-factor/disable"),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "disable", null);
+__decorate([
+    (0, common_1.UseGuards)(pending_auth_guard_1.PendingAuthGuard),
+    (0, common_1.Post)("two-factor/challenge"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, two_factor_verify_dto_1.TwoFactorChallengeDTO]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "challenge", null);
+__decorate([
+    (0, common_1.UseGuards)(pending_auth_guard_1.PendingAuthGuard),
+    (0, common_1.Post)("two-factor/verify/totp"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, totp_verify_dto_1.TotpVerifyDTO]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "verifyTotp", null);
+__decorate([
+    (0, common_1.UseGuards)(pending_auth_guard_1.PendingAuthGuard),
+    (0, common_1.Post)("two-factor/verify/passkey/options"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "getPasskeyOptions", null);
+__decorate([
+    (0, common_1.UseGuards)(pending_auth_guard_1.PendingAuthGuard),
+    (0, common_1.Post)("two-factor/verify/passkey"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, passkey_verify_dto_1.PasskeyAuthenticationVerifyDTO]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "verifyPasskey", null);
+__decorate([
+    (0, common_1.UseGuards)(pending_auth_guard_1.PendingAuthGuard),
+    (0, common_1.Post)("two-factor/verify/backup"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, two_factor_verify_dto_1.BackupCodeVerifyDTO]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "verifyBackupCode", null);
+__decorate([
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, common_1.Post)("backup-codes/generate"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "generateBackupCodes", null);
+__decorate([
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, common_1.Post)("backup-codes/regenerate"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "regenerateBackupCodes", null);
+__decorate([
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, common_1.Get)("backup-codes/count"),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], TwoFactorController.prototype, "getBackupCodesCount", null);
+exports.TwoFactorController = TwoFactorController = TwoFactorController_1 = __decorate([
+    (0, common_1.Controller)("auth"),
+    __param(4, (0, common_1.Inject)((0, common_1.forwardRef)(() => auth_service_1.AuthService))),
+    __metadata("design:paramtypes", [jsonapi_service_1.JsonApiService,
+        two_factor_service_1.TwoFactorService,
+        passkey_service_1.PasskeyService,
+        backup_code_service_1.BackupCodeService,
+        auth_service_1.AuthService])
+], TwoFactorController);
+//# sourceMappingURL=two-factor.controller.js.map

package/dist/foundations/two-factor/controllers/two-factor.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.controller.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/controllers/two-factor.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAawB;AAGxB,0EAAqE;AAErE,oFAAgF;AAChF,mEAA+D;AAC/D,mEAA4E;AAC5E,6DAAwD;AACxD,yEAA+G;AAC/G,2EAAgF;AAChF,iFAAsF;AACtF,qEAAoF;AACpF,yEAAoE;AACpE,iEAA6D;AAC7D,uEAAkE;AASlE;;;;;;;GAOG;AAEI,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAG9B,YACmB,cAA8B,EAC9B,gBAAkC,EAClC,cAA8B,EAC9B,iBAAoC,EAErD,WAAyC;QALxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QAEpC,gBAAW,GAAX,WAAW,CAAa;QAR1B,WAAM,GAAW,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IASpE,CAAC;IAEJ;;;;;OAKG;IAGG,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAyB,EAAS,KAAmB;QAC1E,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IAGG,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAyB,EAAS,KAAmB,EAAU,IAAwB;QACzG,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAClG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IAIG,AAAN,KAAK,CAAC,OAAO,CAAQ,GAAyB,EAAS,KAAmB;QACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IAGG,AAAN,KAAK,CAAC,SAAS,CAAQ,GAAuB,EAAS,KAAmB,EAAU,IAA2B;QAC7G,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAE3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,sEAAsE;YACtE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5F,gDAAgD;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,mDAA4B,CAAC,KAAK,EAAE;gBACnF,EAAE,EAAE,SAAS;gBACb,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS;gBACpD,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO;aACjD,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,oFAAoF;QACpF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,mDAA4B,CAAC,KAAK,EAAE;YACnF,EAAE,EAAE,SAAS;YACb,MAAM;YACN,SAAS;YACT,gBAAgB,EAAE,OAAO;SAC1B,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IAGG,AAAN,KAAK,CAAC,UAAU,CAAQ,GAAuB,EAAS,KAAmB,EAAU,IAAmB;QACtG,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAExG,uCAAuC;QACvC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YACjD,0BAA0B;YAC1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAC3E,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,kDAAkD;QAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IAGG,AAAN,KAAK,CAAC,iBAAiB,CAAQ,GAAuB,EAAS,KAAmB;QAChF,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IAGG,AAAN,KAAK,CAAC,aAAa,CACV,GAAuB,EACvB,KAAmB,EAClB,IAAoC;QAE5C,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;YAC/D,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAe;SAC/C,CAAC,CAAC;QAEH,mCAAmC;QACnC,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAE5E,IAAI,SAAS,EAAE,CAAC;YACd,oDAAoD;YACpD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3F,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,yDAA+B,CAAC,KAAK,EAAE;YACtF,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS;YAC7B,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IAGG,AAAN,KAAK,CAAC,gBAAgB,CACb,GAAuB,EACvB,KAAmB,EAClB,IAAyB;QAEjC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE9G,uCAAuC;QACvC,IAAI,kBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YACjD,0BAA0B;YAC1B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;YAC3E,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,kDAAkD;QAClD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IAGG,AAAN,KAAK,CAAC,mBAAmB,CAAQ,GAAyB,EAAS,KAAmB;QACpF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,0CAA0C;QAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAE3D,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;;;OAMG;IAGG,AAAN,KAAK,CAAC,qBAAqB,CAAQ,GAAyB,EAAS,KAAmB;QACtF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAE1E,0CAA0C;QAC1C,MAAM,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAE3D,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IAED;;;;OAIG;IAGG,AAAN,KAAK,CAAC,mBAAmB,CAAQ,GAAyB,EAAS,KAAmB;QACpF,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;CACF,CAAA;AA/PY,kDAAmB;AAoBxB;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,YAAG,EAAC,mBAAmB,CAAC;IACR,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;oDAIvD;AAUK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACZ,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,0CAAkB;;iDAI1G;AAUK;IAHL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAIrD;AAaK;IAFL,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,sBAAsB,CAAC;IACZ,WAAA,IAAA,YAAG,GAAE,CAAA;IAA2B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,6CAAqB;;oDA2B9G;AAYK;IAFL,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,wBAAwB,CAAC;IACb,WAAA,IAAA,YAAG,GAAE,CAAA;IAA2B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,+BAAa;;qDAcvG;AAYK;IAFL,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,mCAAmC,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAA2B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAI7D;AAYK;IAFL,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,2BAA2B,CAAC;IAE/B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,mDAA8B;;wDAwB7C;AAYK;IAFL,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,aAAI,EAAC,0BAA0B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,2CAAmB;;2DAelC;AAWK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,aAAI,EAAC,uBAAuB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQjE;AAWK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,aAAI,EAAC,yBAAyB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gEAQnE;AASK;IAFL,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,YAAG,EAAC,oBAAoB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAA6B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAIjE;8BA9PU,mBAAmB;IAD/B,IAAA,mBAAU,EAAC,MAAM,CAAC;IASd,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC,CAAC,CAAA;qCAJL,gCAAc;QACZ,qCAAgB;QAClB,gCAAc;QACX,uCAAiB;QAEvB,0BAAW;GAThC,mBAAmB,CA+P/B"}

package/dist/foundations/two-factor/dtos/passkey-options.dto.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Attributes for passkey registration options request.
+ */
+export declare class PasskeyRegistrationOptionsAttributesDTO {
+    /**
+     * The user's username or email (displayed in the passkey prompt).
+     */
+    userName: string;
+    /**
+     * The user's display name (optional, defaults to userName).
+     */
+    userDisplayName?: string;
+}
+/**
+ * Data wrapper for passkey registration options request.
+ */
+export declare class PasskeyRegistrationOptionsDataDTO {
+    type: string;
+    attributes: PasskeyRegistrationOptionsAttributesDTO;
+}
+/**
+ * DTO for passkey registration options request.
+ *
+ * Used to generate WebAuthn registration options for creating a new passkey.
+ * Returns options to be passed to navigator.credentials.create().
+ *
+ * Endpoint: POST /auth/passkey/register/options
+ */
+export declare class PasskeyRegistrationOptionsDTO {
+    data: PasskeyRegistrationOptionsDataDTO;
+}
+/**
+ * DTO for passkey authentication options request.
+ *
+ * No attributes needed - uses userId from token.
+ * Returns options to be passed to navigator.credentials.get().
+ *
+ * Endpoint: POST /auth/two-factor/verify/passkey/options
+ */
+export declare class PasskeyAuthenticationOptionsDTO {
+}
+//# sourceMappingURL=passkey-options.dto.d.ts.map

package/dist/foundations/two-factor/dtos/passkey-options.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-options.dto.d.ts","sourceRoot":"","sources":["../../../../src/foundations/two-factor/dtos/passkey-options.dto.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,qBAAa,uCAAuC;IAClD;;OAEG;IAIH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IAGH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,iCAAiC;IAE5C,IAAI,EAAE,MAAM,CAAC;IAKb,UAAU,EAAE,uCAAuC,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,qBAAa,6BAA6B;IAIxC,IAAI,EAAE,iCAAiC,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,qBAAa,+BAA+B;CAE3C"}

package/dist/foundations/two-factor/dtos/passkey-options.dto.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasskeyAuthenticationOptionsDTO = exports.PasskeyRegistrationOptionsDTO = exports.PasskeyRegistrationOptionsDataDTO = exports.PasskeyRegistrationOptionsAttributesDTO = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const passkey_meta_1 = require("../entities/passkey.meta");
+/**
+ * Attributes for passkey registration options request.
+ */
+class PasskeyRegistrationOptionsAttributesDTO {
+}
+exports.PasskeyRegistrationOptionsAttributesDTO = PasskeyRegistrationOptionsAttributesDTO;
+__decorate([
+    (0, class_validator_1.IsDefined)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], PasskeyRegistrationOptionsAttributesDTO.prototype, "userName", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], PasskeyRegistrationOptionsAttributesDTO.prototype, "userDisplayName", void 0);
+/**
+ * Data wrapper for passkey registration options request.
+ */
+class PasskeyRegistrationOptionsDataDTO {
+}
+exports.PasskeyRegistrationOptionsDataDTO = PasskeyRegistrationOptionsDataDTO;
+__decorate([
+    (0, class_validator_1.Equals)(passkey_meta_1.passkeyMeta.endpoint),
+    __metadata("design:type", String)
+], PasskeyRegistrationOptionsDataDTO.prototype, "type", void 0);
+__decorate([
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_transformer_1.Type)(() => PasskeyRegistrationOptionsAttributesDTO),
+    __metadata("design:type", PasskeyRegistrationOptionsAttributesDTO)
+], PasskeyRegistrationOptionsDataDTO.prototype, "attributes", void 0);
+/**
+ * DTO for passkey registration options request.
+ *
+ * Used to generate WebAuthn registration options for creating a new passkey.
+ * Returns options to be passed to navigator.credentials.create().
+ *
+ * Endpoint: POST /auth/passkey/register/options
+ */
+class PasskeyRegistrationOptionsDTO {
+}
+exports.PasskeyRegistrationOptionsDTO = PasskeyRegistrationOptionsDTO;
+__decorate([
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_transformer_1.Type)(() => PasskeyRegistrationOptionsDataDTO),
+    __metadata("design:type", PasskeyRegistrationOptionsDataDTO)
+], PasskeyRegistrationOptionsDTO.prototype, "data", void 0);
+/**
+ * DTO for passkey authentication options request.
+ *
+ * No attributes needed - uses userId from token.
+ * Returns options to be passed to navigator.credentials.get().
+ *
+ * Endpoint: POST /auth/two-factor/verify/passkey/options
+ */
+class PasskeyAuthenticationOptionsDTO {
+}
+exports.PasskeyAuthenticationOptionsDTO = PasskeyAuthenticationOptionsDTO;
+//# sourceMappingURL=passkey-options.dto.js.map

package/dist/foundations/two-factor/dtos/passkey-options.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-options.dto.js","sourceRoot":"","sources":["../../../../src/foundations/two-factor/dtos/passkey-options.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,yDAAyC;AACzC,qDAAsG;AACtG,2DAAuD;AAEvD;;GAEG;AACH,MAAa,uCAAuC;CAenD;AAfD,0FAeC;AARC;IAHC,IAAA,2BAAS,GAAE;IACX,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;yEACM;AAOjB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;gFACc;AAG3B;;GAEG;AACH,MAAa,iCAAiC;CAQ7C;AARD,8EAQC;AANC;IADC,IAAA,wBAAM,EAAC,0BAAW,CAAC,QAAQ,CAAC;;+DAChB;AAKb;IAHC,IAAA,gCAAc,GAAE;IAChB,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,uCAAuC,CAAC;8BACxC,uCAAuC;qEAAC;AAGtD;;;;;;;GAOG;AACH,MAAa,6BAA6B;CAKzC;AALD,sEAKC;AADC;IAHC,IAAA,gCAAc,GAAE;IAChB,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,iCAAiC,CAAC;8BACxC,iCAAiC;2DAAC;AAG1C;;;;;;;GAOG;AACH,MAAa,+BAA+B;CAE3C;AAFD,0EAEC"}