@ciscode/authentication-kit 1.2.0 → 1.4.0

package/dist/services/auth.service.js

@@ -52,11 +52,14 @@ const jwt = __importStar(require("jsonwebtoken"));
 const user_repository_1 = require("../repositories/user.repository");
 const mail_service_1 = require("./mail.service");
 const role_repository_1 = require("../repositories/role.repository");
+const helper_1 = require("../utils/helper");
+const logger_service_1 = require("./logger.service");
 let AuthService = class AuthService {
-    constructor(users, mail, roles) {
+    constructor(users, mail, roles, logger) {
         this.users = users;
         this.mail = mail;
         this.roles = roles;
+        this.logger = logger;
     }
     resolveExpiry(value, fallback) {
         return (value || fallback);
@@ -78,19 +81,30 @@ let AuthService = class AuthService {
         return jwt.sign(payload, this.getEnv('JWT_RESET_SECRET'), { expiresIn });
     }
     async buildTokenPayload(userId) {
-        const user = await this.users.findByIdWithRolesAndPermissions(userId);
-        if (!user)
-            throw new Error('User not found.');
-        const roles = (user.roles || []).map((r) => r._id.toString());
-        const permissions = (user.roles || [])
-            .flatMap((r) => (r.permissions || []).map((p) => p.name))
-            .filter(Boolean);
-        return { sub: user._id.toString(), roles, permissions };
+        try {
+            const user = await this.users.findByIdWithRolesAndPermissions(userId);
+            if (!user) {
+                throw new common_1.NotFoundException('User not found');
+            }
+            const roles = (user.roles || []).map((r) => r._id.toString());
+            const permissions = (user.roles || [])
+                .flatMap((r) => (r.permissions || []).map((p) => p.name))
+                .filter(Boolean);
+            return { sub: user._id.toString(), roles, permissions };
+        }
+        catch (error) {
+            if (error instanceof common_1.NotFoundException)
+                throw error;
+            this.logger.error(`Failed to build token payload: ${error.message}`, error.stack, 'AuthService');
+            throw new common_1.InternalServerErrorException('Failed to generate authentication token');
+        }
     }
     getEnv(name) {
         const v = process.env[name];
-        if (!v)
-            throw new Error(`${name} is not set`);
+        if (!v) {
+            this.logger.error(`Environment variable ${name} is not set`, 'AuthService');
+            throw new common_1.InternalServerErrorException('Server configuration error');
+        }
         return v;
     }
     async issueTokensForUser(userId) {
@@ -100,114 +114,263 @@ let AuthService = class AuthService {
         return { accessToken, refreshToken };
     }
     async register(dto) {
-        if (await this.users.findByEmail(dto.email))
-            throw new Error('Email already in use.');
-        if (await this.users.findByUsername(dto.username))
-            throw new Error('Username already in use.');
-        if (dto.phoneNumber && (await this.users.findByPhone(dto.phoneNumber))) {
-            throw new Error('Phone already in use.');
-        }
-        const salt = await bcryptjs_1.default.genSalt(10);
-        const hashed = await bcryptjs_1.default.hash(dto.password, salt);
-        const userRole = await this.roles.findByName('user');
-        if (!userRole)
-            throw new Error('Default role not seeded.');
-        const user = await this.users.create({
-            fullname: dto.fullname,
-            username: dto.username,
-            email: dto.email,
-            phoneNumber: dto.phoneNumber,
-            avatar: dto.avatar,
-            password: hashed,
-            roles: [userRole._id],
-            isVerified: false,
-            isBanned: false,
-            passwordChangedAt: new Date()
-        });
-        const emailToken = this.signEmailToken({ sub: user._id.toString(), purpose: 'verify' });
-        await this.mail.sendVerificationEmail(user.email, emailToken);
-        return { id: user._id, email: user.email };
+        try {
+            // Generate username from fname-lname if not provided
+            if (!dto.username || dto.username.trim() === '') {
+                dto.username = (0, helper_1.generateUsernameFromName)(dto.fullname.fname, dto.fullname.lname);
+            }
+            // Check for existing user (use generic message to prevent enumeration)
+            const [existingEmail, existingUsername, existingPhone] = await Promise.all([
+                this.users.findByEmail(dto.email),
+                this.users.findByUsername(dto.username),
+                dto.phoneNumber ? this.users.findByPhone(dto.phoneNumber) : null,
+            ]);
+            if (existingEmail || existingUsername || existingPhone) {
+                throw new common_1.ConflictException('An account with these credentials already exists');
+            }
+            // Hash password
+            let hashed;
+            try {
+                const salt = await bcryptjs_1.default.genSalt(10);
+                hashed = await bcryptjs_1.default.hash(dto.password, salt);
+            }
+            catch (error) {
+                this.logger.error(`Password hashing failed: ${error.message}`, error.stack, 'AuthService');
+                throw new common_1.InternalServerErrorException('Registration failed');
+            }
+            // Get default role
+            const userRole = await this.roles.findByName('user');
+            if (!userRole) {
+                this.logger.error('Default user role not found - seed data may be missing', 'AuthService');
+                throw new common_1.InternalServerErrorException('System configuration error');
+            }
+            // Create user
+            const user = await this.users.create({
+                fullname: dto.fullname,
+                username: dto.username,
+                email: dto.email,
+                phoneNumber: dto.phoneNumber,
+                avatar: dto.avatar,
+                jobTitle: dto.jobTitle,
+                company: dto.company,
+                password: hashed,
+                roles: [userRole._id],
+                isVerified: false,
+                isBanned: false,
+                passwordChangedAt: new Date()
+            });
+            // Send verification email (don't let email failures crash registration)
+            try {
+                const emailToken = this.signEmailToken({ sub: user._id.toString(), purpose: 'verify' });
+                await this.mail.sendVerificationEmail(user.email, emailToken);
+            }
+            catch (error) {
+                this.logger.error(`Failed to send verification email: ${error.message}`, error.stack, 'AuthService');
+                // Continue - user is created, they can resend verification
+            }
+            return { id: user._id, email: user.email };
+        }
+        catch (error) {
+            // Re-throw HTTP exceptions
+            if (error instanceof common_1.ConflictException || error instanceof common_1.InternalServerErrorException) {
+                throw error;
+            }
+            // Handle MongoDB duplicate key error (race condition)
+            if ((error === null || error === void 0 ? void 0 : error.code) === 11000) {
+                throw new common_1.ConflictException('An account with these credentials already exists');
+            }
+            this.logger.error(`Registration failed: ${error.message}`, error.stack, 'AuthService');
+            throw new common_1.InternalServerErrorException('Registration failed. Please try again');
+        }
     }
     async verifyEmail(token) {
-        const decoded = jwt.verify(token, this.getEnv('JWT_EMAIL_SECRET'));
-        if (decoded.purpose !== 'verify')
-            throw new Error('Invalid token purpose.');
-        const user = await this.users.findById(decoded.sub);
-        if (!user)
-            throw new Error('User not found.');
-        if (user.isVerified)
-            return { ok: true };
-        user.isVerified = true;
-        await user.save();
-        return { ok: true };
+        try {
+            const decoded = jwt.verify(token, this.getEnv('JWT_EMAIL_SECRET'));
+            if (decoded.purpose !== 'verify') {
+                throw new common_1.BadRequestException('Invalid verification token');
+            }
+            const user = await this.users.findById(decoded.sub);
+            if (!user) {
+                throw new common_1.NotFoundException('User not found');
+            }
+            if (user.isVerified) {
+                return { ok: true, message: 'Email already verified' };
+            }
+            user.isVerified = true;
+            await user.save();
+            return { ok: true, message: 'Email verified successfully' };
+        }
+        catch (error) {
+            if (error instanceof common_1.BadRequestException || error instanceof common_1.NotFoundException) {
+                throw error;
+            }
+            if (error.name === 'TokenExpiredError') {
+                throw new common_1.UnauthorizedException('Verification token has expired');
+            }
+            if (error.name === 'JsonWebTokenError') {
+                throw new common_1.UnauthorizedException('Invalid verification token');
+            }
+            this.logger.error(`Email verification failed: ${error.message}`, error.stack, 'AuthService');
+            throw new common_1.InternalServerErrorException('Email verification failed');
+        }
     }
     async resendVerification(email) {
-        const user = await this.users.findByEmail(email);
-        if (!user || user.isVerified)
-            return { ok: true };
-        const emailToken = this.signEmailToken({ sub: user._id.toString(), purpose: 'verify' });
-        await this.mail.sendVerificationEmail(user.email, emailToken);
-        return { ok: true };
+        try {
+            const user = await this.users.findByEmail(email);
+            // Return success even if user not found (prevent email enumeration)
+            if (!user || user.isVerified) {
+                return { ok: true, message: 'If the email exists and is unverified, a verification email has been sent' };
+            }
+            const emailToken = this.signEmailToken({ sub: user._id.toString(), purpose: 'verify' });
+            await this.mail.sendVerificationEmail(user.email, emailToken);
+            return { ok: true, message: 'Verification email sent successfully' };
+        }
+        catch (error) {
+            this.logger.error(`Resend verification failed: ${error.message}`, error.stack, 'AuthService');
+            // Return success to prevent email enumeration
+            return { ok: true, message: 'If the email exists and is unverified, a verification email has been sent' };
+        }
     }
     async login(dto) {
-        const user = await this.users.findByEmailWithPassword(dto.email);
-        if (!user)
-            throw new Error('Invalid credentials.');
-        if (user.isBanned)
-            throw new Error('Account banned.');
-        if (!user.isVerified)
-            throw new Error('Email not verified.');
-        const ok = await bcryptjs_1.default.compare(dto.password, user.password);
-        if (!ok)
-            throw new Error('Invalid credentials.');
-        const payload = await this.buildTokenPayload(user._id.toString());
-        const accessToken = this.signAccessToken(payload);
-        const refreshToken = this.signRefreshToken({ sub: user._id.toString(), purpose: 'refresh' });
-        return { accessToken, refreshToken };
+        try {
+            const user = await this.users.findByEmailWithPassword(dto.email);
+            // Use generic message to prevent user enumeration
+            if (!user) {
+                throw new common_1.UnauthorizedException('Invalid email or password');
+            }
+            if (user.isBanned) {
+                throw new common_1.ForbiddenException('Account has been banned. Please contact support');
+            }
+            if (!user.isVerified) {
+                throw new common_1.ForbiddenException('Email not verified. Please check your inbox');
+            }
+            const passwordMatch = await bcryptjs_1.default.compare(dto.password, user.password);
+            if (!passwordMatch) {
+                throw new common_1.UnauthorizedException('Invalid email or password');
+            }
+            const payload = await this.buildTokenPayload(user._id.toString());
+            const accessToken = this.signAccessToken(payload);
+            const refreshToken = this.signRefreshToken({ sub: user._id.toString(), purpose: 'refresh' });
+            return { accessToken, refreshToken };
+        }
+        catch (error) {
+            if (error instanceof common_1.UnauthorizedException || error instanceof common_1.ForbiddenException) {
+                throw error;
+            }
+            this.logger.error(`Login failed: ${error.message}`, error.stack, 'AuthService');
+            throw new common_1.InternalServerErrorException('Login failed. Please try again');
+        }
     }
     async refresh(refreshToken) {
-        const decoded = jwt.verify(refreshToken, this.getEnv('JWT_REFRESH_SECRET'));
-        if (decoded.purpose !== 'refresh')
-            throw new Error('Invalid token purpose.');
-        const user = await this.users.findById(decoded.sub);
-        if (!user)
-            throw new Error('User not found.');
-        if (user.isBanned)
-            throw new Error('Account banned.');
-        if (!user.isVerified)
-            throw new Error('Email not verified.');
-        if (user.passwordChangedAt && decoded.iat * 1000 < user.passwordChangedAt.getTime()) {
-            throw new Error('Token expired.');
-        }
-        const payload = await this.buildTokenPayload(user._id.toString());
-        const accessToken = this.signAccessToken(payload);
-        const newRefreshToken = this.signRefreshToken({ sub: user._id.toString(), purpose: 'refresh' });
-        return { accessToken, refreshToken: newRefreshToken };
+        try {
+            const decoded = jwt.verify(refreshToken, this.getEnv('JWT_REFRESH_SECRET'));
+            if (decoded.purpose !== 'refresh') {
+                throw new common_1.UnauthorizedException('Invalid token type');
+            }
+            const user = await this.users.findById(decoded.sub);
+            if (!user) {
+                throw new common_1.UnauthorizedException('Invalid refresh token');
+            }
+            if (user.isBanned) {
+                throw new common_1.ForbiddenException('Account has been banned');
+            }
+            if (!user.isVerified) {
+                throw new common_1.ForbiddenException('Email not verified');
+            }
+            // Check if token was issued before password change
+            if (user.passwordChangedAt && decoded.iat * 1000 < user.passwordChangedAt.getTime()) {
+                throw new common_1.UnauthorizedException('Token expired due to password change');
+            }
+            const payload = await this.buildTokenPayload(user._id.toString());
+            const accessToken = this.signAccessToken(payload);
+            const newRefreshToken = this.signRefreshToken({ sub: user._id.toString(), purpose: 'refresh' });
+            return { accessToken, refreshToken: newRefreshToken };
+        }
+        catch (error) {
+            if (error instanceof common_1.UnauthorizedException || error instanceof common_1.ForbiddenException) {
+                throw error;
+            }
+            if (error.name === 'TokenExpiredError') {
+                throw new common_1.UnauthorizedException('Refresh token has expired');
+            }
+            if (error.name === 'JsonWebTokenError') {
+                throw new common_1.UnauthorizedException('Invalid refresh token');
+            }
+            this.logger.error(`Token refresh failed: ${error.message}`, error.stack, 'AuthService');
+            throw new common_1.InternalServerErrorException('Token refresh failed');
+        }
     }
     async forgotPassword(email) {
-        const user = await this.users.findByEmail(email);
-        if (!user)
-            return { ok: true };
-        const resetToken = this.signResetToken({ sub: user._id.toString(), purpose: 'reset' });
-        await this.mail.sendPasswordResetEmail(user.email, resetToken);
-        return { ok: true };
+        try {
+            const user = await this.users.findByEmail(email);
+            // Always return success to prevent email enumeration
+            if (!user) {
+                return { ok: true, message: 'If the email exists, a password reset link has been sent' };
+            }
+            const resetToken = this.signResetToken({ sub: user._id.toString(), purpose: 'reset' });
+            await this.mail.sendPasswordResetEmail(user.email, resetToken);
+            return { ok: true, message: 'Password reset link sent successfully' };
+        }
+        catch (error) {
+            this.logger.error(`Forgot password failed: ${error.message}`, error.stack, 'AuthService');
+            // Return success to prevent email enumeration
+            return { ok: true, message: 'If the email exists, a password reset link has been sent' };
+        }
     }
     async resetPassword(token, newPassword) {
-        const decoded = jwt.verify(token, this.getEnv('JWT_RESET_SECRET'));
-        if (decoded.purpose !== 'reset')
-            throw new Error('Invalid token purpose.');
-        const user = await this.users.findById(decoded.sub);
-        if (!user)
-            throw new Error('User not found.');
-        const salt = await bcryptjs_1.default.genSalt(10);
-        user.password = await bcryptjs_1.default.hash(newPassword, salt);
-        user.passwordChangedAt = new Date();
-        await user.save();
-        return { ok: true };
+        try {
+            const decoded = jwt.verify(token, this.getEnv('JWT_RESET_SECRET'));
+            if (decoded.purpose !== 'reset') {
+                throw new common_1.BadRequestException('Invalid reset token');
+            }
+            const user = await this.users.findById(decoded.sub);
+            if (!user) {
+                throw new common_1.NotFoundException('User not found');
+            }
+            // Hash new password
+            let hashedPassword;
+            try {
+                const salt = await bcryptjs_1.default.genSalt(10);
+                hashedPassword = await bcryptjs_1.default.hash(newPassword, salt);
+            }
+            catch (error) {
+                this.logger.error(`Password hashing failed: ${error.message}`, error.stack, 'AuthService');
+                throw new common_1.InternalServerErrorException('Password reset failed');
+            }
+            user.password = hashedPassword;
+            user.passwordChangedAt = new Date();
+            await user.save();
+            return { ok: true, message: 'Password reset successfully' };
+        }
+        catch (error) {
+            if (error instanceof common_1.BadRequestException || error instanceof common_1.NotFoundException || error instanceof common_1.InternalServerErrorException) {
+                throw error;
+            }
+            if (error.name === 'TokenExpiredError') {
+                throw new common_1.UnauthorizedException('Reset token has expired');
+            }
+            if (error.name === 'JsonWebTokenError') {
+                throw new common_1.UnauthorizedException('Invalid reset token');
+            }
+            this.logger.error(`Password reset failed: ${error.message}`, error.stack, 'AuthService');
+            throw new common_1.InternalServerErrorException('Password reset failed');
+        }
     }
     async deleteAccount(userId) {
-        await this.users.deleteById(userId);
-        return { ok: true };
+        try {
+            const user = await this.users.deleteById(userId);
+            if (!user) {
+                throw new common_1.NotFoundException('User not found');
+            }
+            return { ok: true, message: 'Account deleted successfully' };
+        }
+        catch (error) {
+            if (error instanceof common_1.NotFoundException) {
+                throw error;
+            }
+            this.logger.error(`Account deletion failed: ${error.message}`, error.stack, 'AuthService');
+            throw new common_1.InternalServerErrorException('Account deletion failed');
+        }
     }
 };
 exports.AuthService = AuthService;
@@ -215,5 +378,6 @@ exports.AuthService = AuthService = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [user_repository_1.UserRepository,
         mail_service_1.MailService,
-        role_repository_1.RoleRepository])
+        role_repository_1.RoleRepository,
+        logger_service_1.LoggerService])
 ], AuthService);

package/dist/services/logger.service.d.ts

@@ -0,0 +1,8 @@
+export declare class LoggerService {
+    private logger;
+    log(message: string, context?: string): void;
+    error(message: string, trace?: string, context?: string): void;
+    warn(message: string, context?: string): void;
+    debug(message: string, context?: string): void;
+    verbose(message: string, context?: string): void;
+}

package/dist/services/logger.service.js

@@ -0,0 +1,38 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoggerService = void 0;
+const common_1 = require("@nestjs/common");
+let LoggerService = class LoggerService {
+    constructor() {
+        this.logger = new common_1.Logger('AuthKit');
+    }
+    log(message, context) {
+        this.logger.log(message, context);
+    }
+    error(message, trace, context) {
+        this.logger.error(message, trace, context);
+    }
+    warn(message, context) {
+        this.logger.warn(message, context);
+    }
+    debug(message, context) {
+        if (process.env.NODE_ENV === 'development') {
+            this.logger.debug(message, context);
+        }
+    }
+    verbose(message, context) {
+        if (process.env.NODE_ENV === 'development') {
+            this.logger.verbose(message, context);
+        }
+    }
+};
+exports.LoggerService = LoggerService;
+exports.LoggerService = LoggerService = __decorate([
+    (0, common_1.Injectable)()
+], LoggerService);

package/dist/services/mail.service.d.ts

@@ -1,5 +1,8 @@
+import { LoggerService } from './logger.service';
 export declare class MailService {
+    private readonly logger;
     private transporter;
+    constructor(logger: LoggerService);
     sendVerificationEmail(email: string, token: string): Promise<void>;
     sendPasswordResetEmail(email: string, token: string): Promise<void>;
 }

package/dist/services/mail.service.js

@@ -1,12 +1,24 @@
 "use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MailService = void 0;
 const nodemailer_1 = __importDefault(require("nodemailer"));
-class MailService {
-    constructor() {
+const common_1 = require("@nestjs/common");
+const logger_service_1 = require("./logger.service");
+let MailService = class MailService {
+    constructor(logger) {
+        this.logger = logger;
         this.transporter = nodemailer_1.default.createTransport({
             host: process.env.SMTP_HOST,
             port: parseInt(process.env.SMTP_PORT, 10),
@@ -18,22 +30,42 @@ class MailService {
         });
     }
     async sendVerificationEmail(email, token) {
-        const url = `${process.env.FRONTEND_URL}/confirm-email?token=${token}`;
-        await this.transporter.sendMail({
-            from: process.env.FROM_EMAIL,
-            to: email,
-            subject: 'Verify your email',
-            text: `Click to verify your email: ${url}`
-        });
+        try {
+            const url = `${process.env.FRONTEND_URL}/confirm-email?token=${token}`;
+            await this.transporter.sendMail({
+                from: process.env.FROM_EMAIL,
+                to: email,
+                subject: 'Verify your email',
+                text: `Click to verify your email: ${url}`,
+                html: `<p>Click <a href="${url}">here</a> to verify your email</p>`
+            });
+            this.logger.log(`Verification email sent to ${email}`, 'MailService');
+        }
+        catch (error) {
+            this.logger.error(`Failed to send verification email to ${email}: ${error.message}`, error.stack, 'MailService');
+            throw error; // Re-throw so caller can handle
+        }
     }
     async sendPasswordResetEmail(email, token) {
-        const url = `${process.env.FRONTEND_URL}/reset-password?token=${token}`;
-        await this.transporter.sendMail({
-            from: process.env.FROM_EMAIL,
-            to: email,
-            subject: 'Reset your password',
-            text: `Reset your password: ${url}`
-        });
+        try {
+            const url = `${process.env.FRONTEND_URL}/reset-password?token=${token}`;
+            await this.transporter.sendMail({
+                from: process.env.FROM_EMAIL,
+                to: email,
+                subject: 'Reset your password',
+                text: `Reset your password: ${url}`,
+                html: `<p>Click <a href="${url}">here</a> to reset your password</p>`
+            });
+            this.logger.log(`Password reset email sent to ${email}`, 'MailService');
+        }
+        catch (error) {
+            this.logger.error(`Failed to send password reset email to ${email}: ${error.message}`, error.stack, 'MailService');
+            throw error; // Re-throw so caller can handle
+        }
     }
-}
+};
 exports.MailService = MailService;
+exports.MailService = MailService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [logger_service_1.LoggerService])
+], MailService);

package/dist/services/oauth.service.d.ts

@@ -1,12 +1,15 @@
 import { UserRepository } from '../repositories/user.repository';
 import { RoleRepository } from '../repositories/role.repository';
 import { AuthService } from './auth.service';
+import { LoggerService } from './logger.service';
 export declare class OAuthService {
     private readonly users;
     private readonly roles;
     private readonly auth;
+    private readonly logger;
     private msJwks;
-    constructor(users: UserRepository, roles: RoleRepository, auth: AuthService);
+    private axiosConfig;
+    constructor(users: UserRepository, roles: RoleRepository, auth: AuthService, logger: LoggerService);
     private getDefaultRoleId;
     private verifyMicrosoftIdToken;
     loginWithMicrosoft(idToken: string): Promise<{