@ciscode/authentication-kit 1.1.0 → 1.1.2

package/dist/controllers/auth.controller.js

@@ -0,0 +1,645 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthController = void 0;
+const common_1 = require("@nestjs/common");
+const passport_config_1 = __importDefault(require("../config/passport.config"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const bcryptjs_1 = __importDefault(require("bcryptjs"));
+const jwks_rsa_1 = __importDefault(require("jwks-rsa"));
+const axios_1 = __importDefault(require("axios"));
+const user_model_1 = __importDefault(require("../models/user.model"));
+const client_model_1 = __importDefault(require("../models/client.model"));
+const role_model_1 = __importDefault(require("../models/role.model"));
+const helper_1 = require("../utils/helper");
+const TENANT_ID = process.env.MICROSOFT_TENANT_ID || 'common';
+const MSAL_MOBILE_CLIENT_ID = process.env.MSAL_MOBILE_CLIENT_ID;
+const resolveJwtExpiry = (value, fallback) => (value || fallback);
+const msJwks = (0, jwks_rsa_1.default)({
+    jwksUri: 'https://login.microsoftonline.com/common/discovery/v2.0/keys',
+    cache: true,
+    rateLimit: true,
+    jwksRequestsPerMinute: 5,
+});
+function verifyMicrosoftIdToken(idToken) {
+    return new Promise((resolve, reject) => {
+        const getKey = (header, cb) => {
+            msJwks
+                .getSigningKey(header.kid)
+                .then((k) => cb(null, k.getPublicKey()))
+                .catch(cb);
+        };
+        jsonwebtoken_1.default.verify(idToken, getKey, { algorithms: ['RS256'], audience: MSAL_MOBILE_CLIENT_ID }, (err, payload) => (err ? reject(err) : resolve(payload)));
+    });
+}
+let AuthController = class AuthController {
+    async issueTokensAndRespond(principal, res) {
+        const roleDocs = await role_model_1.default.find({ _id: { $in: principal.roles } })
+            .select('name permissions -_id')
+            .lean();
+        const roles = roleDocs.map((r) => r.name);
+        const permissions = Array.from(new Set(roleDocs.flatMap((r) => r.permissions)));
+        const accessTTL = resolveJwtExpiry(process.env.JWT_ACCESS_TOKEN_EXPIRES_IN, '15m');
+        const refreshTTL = resolveJwtExpiry(process.env.JWT_REFRESH_TOKEN_EXPIRES_IN, '7d');
+        const payload = {
+            id: principal._id,
+            email: principal.email,
+            tenantId: principal.tenantId,
+            roles,
+            permissions,
+        };
+        const accessToken = jsonwebtoken_1.default.sign(payload, process.env.JWT_SECRET, { expiresIn: accessTTL });
+        const refreshToken = jsonwebtoken_1.default.sign({ id: principal._id }, process.env.JWT_REFRESH_SECRET, { expiresIn: refreshTTL });
+        principal.refreshToken = refreshToken;
+        try {
+            await principal.save();
+        }
+        catch (e) {
+            console.error('Error saving refreshToken:', e);
+        }
+        const isProd = process.env.NODE_ENV === 'production';
+        res.cookie('refreshToken', refreshToken, {
+            httpOnly: true,
+            secure: isProd,
+            sameSite: isProd ? 'none' : 'lax',
+            path: '/',
+            maxAge: (0, helper_1.getMillisecondsFromExpiry)(refreshTTL),
+        });
+        return res.status(200).json({ accessToken, refreshToken });
+    }
+    async respondWebOrMobile(req, res, principal) {
+        const roleDocs = await role_model_1.default.find({ _id: { $in: principal.roles } })
+            .select('name permissions -_id')
+            .lean();
+        const roles = roleDocs.map((r) => r.name);
+        const permissions = Array.from(new Set(roleDocs.flatMap((r) => r.permissions)));
+        const accessTTL = resolveJwtExpiry(process.env.JWT_ACCESS_TOKEN_EXPIRES_IN, '15m');
+        const refreshTTL = resolveJwtExpiry(process.env.JWT_REFRESH_TOKEN_EXPIRES_IN, '7d');
+        const payload = {
+            id: principal._id,
+            email: principal.email,
+            tenantId: principal.tenantId,
+            roles,
+            permissions,
+        };
+        const accessToken = jsonwebtoken_1.default.sign(payload, process.env.JWT_SECRET, { expiresIn: accessTTL });
+        const refreshToken = jsonwebtoken_1.default.sign({ id: principal._id }, process.env.JWT_REFRESH_SECRET, { expiresIn: refreshTTL });
+        principal.refreshToken = refreshToken;
+        try {
+            await principal.save();
+        }
+        catch (e) {
+            console.error('Saving refreshToken failed:', e);
+        }
+        let mobileRedirect;
+        if (req.query.state) {
+            try {
+                const decoded = JSON.parse(Buffer.from(req.query.state, 'base64url').toString('utf8'));
+                mobileRedirect = decoded.redirect;
+            }
+            catch (_) {
+                // ignore
+            }
+        }
+        if (mobileRedirect) {
+            const url = new URL(mobileRedirect);
+            url.searchParams.set('accessToken', accessToken);
+            url.searchParams.set('refreshToken', refreshToken);
+            return res.redirect(302, url.toString());
+        }
+        const isProd = process.env.NODE_ENV === 'production';
+        res.cookie('refreshToken', refreshToken, {
+            httpOnly: true,
+            secure: isProd,
+            sameSite: isProd ? 'none' : 'lax',
+            path: '/',
+            maxAge: (0, helper_1.getMillisecondsFromExpiry)(refreshTTL),
+        });
+        return res.status(200).json({ accessToken, refreshToken });
+    }
+    async registerClient(req, res) {
+        try {
+            const { email, password, name, roles = [] } = req.body;
+            if (!email || !password) {
+                return res.status(400).json({ message: 'Email and password are required.' });
+            }
+            if (await client_model_1.default.findOne({ email })) {
+                return res.status(409).json({ message: 'Email already in use.' });
+            }
+            const salt = await bcryptjs_1.default.genSalt(10);
+            const hashed = await bcryptjs_1.default.hash(password, salt);
+            const client = new client_model_1.default({ email, password: hashed, name, roles });
+            await client.save();
+            return res.status(201).json({
+                id: client._id,
+                email: client.email,
+                name: client.name,
+                roles: client.roles,
+            });
+        }
+        catch (err) {
+            console.error('registerClient error:', err);
+            return res.status(500).json({ message: 'Server error.' });
+        }
+    }
+    async clientLogin(req, res) {
+        try {
+            const { email, password } = req.body;
+            if (!email || !password) {
+                return res.status(400).json({ message: 'Email and password are required.' });
+            }
+            const client = await client_model_1.default.findOne({ email })
+                .select('+password')
+                .populate('roles', 'name permissions');
+            if (!client) {
+                return res.status(400).json({ message: 'Incorrect email.' });
+            }
+            const match = await bcryptjs_1.default.compare(password, client.password);
+            if (!match) {
+                return res.status(400).json({ message: 'Incorrect password.' });
+            }
+            return this.issueTokensAndRespond(client, res);
+        }
+        catch (err) {
+            console.error('clientLogin error:', err);
+            return res.status(500).json({ message: 'Server error.' });
+        }
+    }
+    localLogin(req, res, next) {
+        return passport_config_1.default.authenticate('local', { session: false }, async (err, user, info) => {
+            if (err)
+                return next(err);
+            if (!user)
+                return res.status(400).json({ message: (info === null || info === void 0 ? void 0 : info.message) || 'Invalid credentials.' });
+            try {
+                return this.issueTokensAndRespond(user, res);
+            }
+            catch (e) {
+                console.error('localLogin error:', e);
+                return res.status(500).json({ message: 'Server error.' });
+            }
+        })(req, res, next);
+    }
+    microsoftLogin(req, res, next) {
+        const redirect = req.query.redirect;
+        const state = redirect ? Buffer.from(JSON.stringify({ redirect }), 'utf8').toString('base64url') : undefined;
+        return passport_config_1.default.authenticate('azure_ad_oauth2', {
+            session: false,
+            state,
+        })(req, res, next);
+    }
+    microsoftCallback(req, res, next) {
+        passport_config_1.default.authenticate('azure_ad_oauth2', { session: false }, async (err, user) => {
+            if (err)
+                return next(err);
+            if (!user)
+                return res.status(400).json({ message: 'Microsoft authentication failed.' });
+            return this.respondWebOrMobile(req, res, user);
+        })(req, res, next);
+    }
+    async microsoftExchange(req, res) {
+        try {
+            if (!MSAL_MOBILE_CLIENT_ID) {
+                console.error('MSAL_MOBILE_CLIENT_ID is not set in environment.');
+                return res.status(500).json({ message: 'Server misconfiguration.' });
+            }
+            const { idToken } = req.body || {};
+            if (!idToken) {
+                return res.status(400).json({ message: 'idToken is required.' });
+            }
+            let ms;
+            try {
+                ms = await verifyMicrosoftIdToken(idToken);
+            }
+            catch (e) {
+                console.error('ID token verify failed:', e.message || e);
+                return res.status(401).json({ message: 'Invalid Microsoft ID token.' });
+            }
+            const email = ms.preferred_username || ms.email;
+            const name = ms.name;
+            const tid = ms.tid;
+            if (TENANT_ID && TENANT_ID !== 'common' && tid && tid !== TENANT_ID) {
+                return res.status(401).json({ message: 'Tenant mismatch.' });
+            }
+            if (!email) {
+                return res.status(400).json({ message: 'Email claim missing in Microsoft ID token.' });
+            }
+            const microsoftId = ms.oid || ms.sub;
+            let user = await user_model_1.default.findOne({ email });
+            if (!user) {
+                user = new user_model_1.default({
+                    email,
+                    name,
+                    tenantId: tid || TENANT_ID,
+                    microsoftId,
+                    roles: [],
+                    status: 'active',
+                });
+                await user.save();
+            }
+            else {
+                let changed = false;
+                if (!user.microsoftId) {
+                    user.microsoftId = microsoftId;
+                    changed = true;
+                }
+                if (!user.tenantId) {
+                    user.tenantId = tid || TENANT_ID;
+                    changed = true;
+                }
+                if (changed)
+                    await user.save();
+            }
+            return this.issueTokensAndRespond(user, res);
+        }
+        catch (e) {
+            console.error('microsoftExchange error:', e);
+            return res.status(500).json({ message: 'Server error.' });
+        }
+    }
+    googleUserLogin(req, res, next) {
+        const redirect = req.query.redirect;
+        const state = redirect ? Buffer.from(JSON.stringify({ redirect }), 'utf8').toString('base64url') : undefined;
+        return passport_config_1.default.authenticate('google-user', { session: false, scope: ['profile', 'email'], state })(req, res, next);
+    }
+    googleUserCallback(req, res, next) {
+        passport_config_1.default.authenticate('google-user', { session: false }, async (err, user) => {
+            if (err)
+                return next(err);
+            if (!user)
+                return res.status(400).json({ message: 'Google authentication failed.' });
+            return this.respondWebOrMobile(req, res, user);
+        })(req, res, next);
+    }
+    googleClientLogin(req, res, next) {
+        const redirect = req.query.redirect;
+        const state = redirect ? Buffer.from(JSON.stringify({ redirect }), 'utf8').toString('base64url') : undefined;
+        return passport_config_1.default.authenticate('google-client', { session: false, scope: ['profile', 'email'], state })(req, res, next);
+    }
+    googleClientCallback(req, res, next) {
+        passport_config_1.default.authenticate('google-client', { session: false }, async (err, client) => {
+            if (err)
+                return next(err);
+            if (!client)
+                return res.status(400).json({ message: 'Google authentication failed.' });
+            return this.respondWebOrMobile(req, res, client);
+        })(req, res, next);
+    }
+    async googleExchange(req, res) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        try {
+            let { code, idToken, type = 'user', tenantId } = req.body || {};
+            if (!['user', 'client'].includes(type)) {
+                return res.status(400).json({ message: 'invalid type; must be "user" or "client"' });
+            }
+            let resolvedTenantId;
+            if (type === 'user') {
+                resolvedTenantId = tenantId || process.env.DEFAULT_TENANT_ID;
+                if (!resolvedTenantId) {
+                    return res.status(400).json({ message: 'tenantId is required for user login.' });
+                }
+            }
+            let email;
+            let name;
+            let googleId;
+            if (code) {
+                const tokenResp = await axios_1.default.post('https://oauth2.googleapis.com/token', {
+                    code,
+                    client_id: process.env.GOOGLE_CLIENT_ID,
+                    client_secret: process.env.GOOGLE_CLIENT_SECRET,
+                    redirect_uri: 'postmessage',
+                    grant_type: 'authorization_code',
+                });
+                const { access_token } = tokenResp.data || {};
+                if (!access_token) {
+                    return res.status(401).json({ message: 'Failed to exchange code with Google.' });
+                }
+                const profileResp = await axios_1.default.get('https://www.googleapis.com/oauth2/v2/userinfo', {
+                    headers: { Authorization: `Bearer ${access_token}` },
+                });
+                email = (_a = profileResp.data) === null || _a === void 0 ? void 0 : _a.email;
+                name = ((_b = profileResp.data) === null || _b === void 0 ? void 0 : _b.name) || ((_c = profileResp.data) === null || _c === void 0 ? void 0 : _c.given_name) || '';
+                googleId = (_d = profileResp.data) === null || _d === void 0 ? void 0 : _d.id;
+            }
+            else if (idToken) {
+                const verifyResp = await axios_1.default.get('https://oauth2.googleapis.com/tokeninfo', {
+                    params: { id_token: idToken },
+                });
+                email = (_e = verifyResp.data) === null || _e === void 0 ? void 0 : _e.email;
+                name = ((_f = verifyResp.data) === null || _f === void 0 ? void 0 : _f.name) || '';
+                googleId = (_g = verifyResp.data) === null || _g === void 0 ? void 0 : _g.sub;
+            }
+            else {
+                return res.status(400).json({ message: 'code or idToken is required' });
+            }
+            if (!email)
+                return res.status(400).json({ message: 'Google profile missing email.' });
+            const Model = type === 'user' ? user_model_1.default : client_model_1.default;
+            let principal = await Model.findOne({ $or: [{ email }, { googleId }] });
+            if (!principal) {
+                principal = new Model(type === 'user'
+                    ? { email, name, googleId, tenantId: resolvedTenantId, roles: [], status: 'active' }
+                    : { email, name, googleId, roles: [] });
+                await principal.save();
+            }
+            else if (!principal.googleId) {
+                principal.googleId = googleId;
+                if (type === 'user' && !principal.tenantId)
+                    principal.tenantId = resolvedTenantId;
+                await principal.save();
+            }
+            const roleDocs = await role_model_1.default.find({ _id: { $in: principal.roles } })
+                .select('name permissions -_id').lean();
+            const roles = roleDocs.map((r) => r.name);
+            const permissions = Array.from(new Set(roleDocs.flatMap((r) => r.permissions)));
+            const accessTTL = resolveJwtExpiry(process.env.JWT_ACCESS_TOKEN_EXPIRES_IN, '15m');
+            const refreshTTL = resolveJwtExpiry(process.env.JWT_REFRESH_TOKEN_EXPIRES_IN, '7d');
+            const payload = { id: principal._id, email: principal.email, tenantId: principal.tenantId, roles, permissions };
+            const accessToken = jsonwebtoken_1.default.sign(payload, process.env.JWT_SECRET, { expiresIn: accessTTL });
+            const refreshToken = jsonwebtoken_1.default.sign({ id: principal._id }, process.env.JWT_REFRESH_SECRET, { expiresIn: refreshTTL });
+            principal.refreshToken = refreshToken;
+            try {
+                await principal.save();
+            }
+            catch (e) {
+                console.error('Saving refreshToken failed:', e);
+            }
+            const isProd = process.env.NODE_ENV === 'production';
+            res.cookie('refreshToken', refreshToken, {
+                httpOnly: true,
+                secure: isProd,
+                sameSite: isProd ? 'none' : 'lax',
+                path: '/',
+                maxAge: (0, helper_1.getMillisecondsFromExpiry)(refreshTTL),
+            });
+            return res.status(200).json({ accessToken, refreshToken });
+        }
+        catch (err) {
+            console.error('googleExchange error:', ((_h = err === null || err === void 0 ? void 0 : err.response) === null || _h === void 0 ? void 0 : _h.data) || err.message || err);
+            return res.status(500).json({ message: 'Server error during Google exchange.' });
+        }
+    }
+    facebookUserLogin(req, res, next) {
+        const redirect = req.query.redirect;
+        const state = redirect ? Buffer.from(JSON.stringify({ redirect }), 'utf8').toString('base64url') : undefined;
+        return passport_config_1.default.authenticate('facebook-user', { session: false, scope: ['email'], state })(req, res, next);
+    }
+    facebookUserCallback(req, res, next) {
+        passport_config_1.default.authenticate('facebook-user', { session: false }, async (err, user) => {
+            if (err)
+                return next(err);
+            if (!user)
+                return res.status(400).json({ message: 'Facebook authentication failed.' });
+            return this.respondWebOrMobile(req, res, user);
+        })(req, res, next);
+    }
+    facebookClientLogin(req, res, next) {
+        const redirect = req.query.redirect;
+        const state = redirect ? Buffer.from(JSON.stringify({ redirect }), 'utf8').toString('base64url') : undefined;
+        return passport_config_1.default.authenticate('facebook-client', { session: false, scope: ['email'], state })(req, res, next);
+    }
+    facebookClientCallback(req, res, next) {
+        passport_config_1.default.authenticate('facebook-client', { session: false }, async (err, client) => {
+            if (err)
+                return next(err);
+            if (!client)
+                return res.status(400).json({ message: 'Facebook authentication failed.' });
+            return this.respondWebOrMobile(req, res, client);
+        })(req, res, next);
+    }
+    microsoftClientLogin(req, res, next) {
+        const redirect = req.query.redirect;
+        const state = redirect ? Buffer.from(JSON.stringify({ redirect }), 'utf8').toString('base64url') : undefined;
+        return passport_config_1.default.authenticate('azure_ad_oauth2_client', { session: false, state })(req, res, next);
+    }
+    microsoftClientCallback(req, res, next) {
+        passport_config_1.default.authenticate('azure_ad_oauth2_client', { session: false }, async (err, client) => {
+            if (err)
+                return next(err);
+            if (!client)
+                return res.status(400).json({ message: 'Microsoft authentication failed.' });
+            return this.respondWebOrMobile(req, res, client);
+        })(req, res, next);
+    }
+    async refreshToken(req, res) {
+        var _a;
+        try {
+            const refreshToken = ((_a = req.cookies) === null || _a === void 0 ? void 0 : _a.refreshToken) || req.body.refreshToken;
+            if (!refreshToken) {
+                return res.status(401).json({ message: 'Refresh token missing.' });
+            }
+            let decoded;
+            try {
+                decoded = jsonwebtoken_1.default.verify(refreshToken, process.env.JWT_REFRESH_SECRET);
+            }
+            catch (err) {
+                const msg = err.name === 'TokenExpiredError' ? 'Refresh token expired.' : 'Invalid refresh token.';
+                return res.status(401).json({ message: msg });
+            }
+            let principal = await user_model_1.default.findById(decoded.id);
+            let principalType = 'user';
+            if (!principal) {
+                principal = await client_model_1.default.findById(decoded.id);
+                principalType = 'client';
+            }
+            if (!principal)
+                return res.status(401).json({ message: 'Account not found.' });
+            if (principal.refreshToken !== refreshToken) {
+                return res.status(401).json({ message: 'Refresh token mismatch.' });
+            }
+            const roleDocs = await role_model_1.default.find({ _id: { $in: principal.roles } })
+                .select('name permissions -_id').lean();
+            const roles = roleDocs.map((r) => r.name);
+            const permissions = Array.from(new Set(roleDocs.flatMap((r) => r.permissions)));
+            const payload = {
+                id: principal._id,
+                email: principal.email,
+                tenantId: principal.tenantId,
+                roles,
+                permissions,
+            };
+            const accessTokenExpiresIn = resolveJwtExpiry(process.env.JWT_ACCESS_TOKEN_EXPIRES_IN, '15m');
+            const accessToken = jsonwebtoken_1.default.sign(payload, process.env.JWT_SECRET, { expiresIn: accessTokenExpiresIn });
+            return res.status(200).json({ accessToken, type: principalType });
+        }
+        catch (error) {
+            console.error('[Refresh] Unexpected error:', error);
+            return res.status(500).json({ message: 'Server error during token refresh.' });
+        }
+    }
+};
+exports.AuthController = AuthController;
+__decorate([
+    (0, common_1.Post)('clients/register'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "registerClient", null);
+__decorate([
+    (0, common_1.Post)('clients/login'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "clientLogin", null);
+__decorate([
+    (0, common_1.Post)('login'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "localLogin", null);
+__decorate([
+    (0, common_1.Get)('microsoft'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "microsoftLogin", null);
+__decorate([
+    (0, common_1.Get)('microsoft/callback'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "microsoftCallback", null);
+__decorate([
+    (0, common_1.Post)('microsoft/exchange'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "microsoftExchange", null);
+__decorate([
+    (0, common_1.Get)('google'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "googleUserLogin", null);
+__decorate([
+    (0, common_1.Get)('google/callback'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "googleUserCallback", null);
+__decorate([
+    (0, common_1.Get)('client/google'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "googleClientLogin", null);
+__decorate([
+    (0, common_1.Get)('client/google/callback'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "googleClientCallback", null);
+__decorate([
+    (0, common_1.Post)('google/exchange'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "googleExchange", null);
+__decorate([
+    (0, common_1.Get)('facebook'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "facebookUserLogin", null);
+__decorate([
+    (0, common_1.Get)('facebook/callback'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "facebookUserCallback", null);
+__decorate([
+    (0, common_1.Get)('client/facebook'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "facebookClientLogin", null);
+__decorate([
+    (0, common_1.Get)('client/facebook/callback'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "facebookClientCallback", null);
+__decorate([
+    (0, common_1.Get)('client/microsoft'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "microsoftClientLogin", null);
+__decorate([
+    (0, common_1.Get)('client/microsoft/callback'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __param(2, (0, common_1.Next)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Function]),
+    __metadata("design:returntype", void 0)
+], AuthController.prototype, "microsoftClientCallback", null);
+__decorate([
+    (0, common_1.Post)('refresh-token'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refreshToken", null);
+exports.AuthController = AuthController = __decorate([
+    (0, common_1.Controller)('api/auth')
+], AuthController);

package/dist/controllers/password-reset.controller.d.ts

@@ -0,0 +1,8 @@
+import type { Request, Response } from 'express';
+export declare class PasswordResetController {
+    private requestPasswordReset;
+    private resetPassword;
+    forgotPassword(req: Request, res: Response): Promise<Response<any, Record<string, any>>>;
+    requestPasswordResetRoute(req: Request, res: Response): Promise<Response<any, Record<string, any>>>;
+    resetPasswordRoute(req: Request, res: Response): Promise<Response<any, Record<string, any>>>;
+}