@flusys/nestjs-auth 0.1.0-beta.3 → 1.0.0-rc

package/fesm/entities/user-token.entity.js

@@ -0,0 +1,113 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+import { Column, CreateDateColumn, Entity, Index, PrimaryGeneratedColumn } from 'typeorm';
+/**
+ * Token types for various user actions
+ */ export var TokenType = /*#__PURE__*/ function(TokenType) {
+    TokenType["PASSWORD_RESET"] = "password_reset";
+    TokenType["EMAIL_VERIFICATION"] = "email_verification";
+    TokenType["EMAIL_CHANGE"] = "email_change";
+    return TokenType;
+}({});
+export class UserToken {
+    constructor(){
+        _define_property(this, "id", void 0);
+        _define_property(this, "userId", void 0);
+        _define_property(this, "type", void 0);
+        _define_property(this, "token", void 0);
+        _define_property(this, "expiresAt", void 0);
+        _define_property(this, "usedAt", void 0);
+        _define_property(this, "metadata", void 0);
+        _define_property(this, "createdAt", void 0);
+    }
+}
+_ts_decorate([
+    PrimaryGeneratedColumn('uuid'),
+    _ts_metadata("design:type", String)
+], UserToken.prototype, "id", void 0);
+_ts_decorate([
+    Column({
+        type: 'uuid',
+        name: 'user_id'
+    }),
+    _ts_metadata("design:type", String)
+], UserToken.prototype, "userId", void 0);
+_ts_decorate([
+    Column({
+        type: 'varchar',
+        length: 32
+    }),
+    _ts_metadata("design:type", String)
+], UserToken.prototype, "type", void 0);
+_ts_decorate([
+    Column({
+        type: 'varchar',
+        length: 64
+    }),
+    _ts_metadata("design:type", String)
+], UserToken.prototype, "token", void 0);
+_ts_decorate([
+    Column({
+        type: 'timestamp',
+        name: 'expires_at'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], UserToken.prototype, "expiresAt", void 0);
+_ts_decorate([
+    Column({
+        type: 'timestamp',
+        name: 'used_at',
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], UserToken.prototype, "usedAt", void 0);
+_ts_decorate([
+    Column({
+        type: 'varchar',
+        length: 255,
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], UserToken.prototype, "metadata", void 0);
+_ts_decorate([
+    CreateDateColumn({
+        type: 'timestamp',
+        name: 'created_at'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], UserToken.prototype, "createdAt", void 0);
+UserToken = _ts_decorate([
+    Entity('user_tokens'),
+    Index('IDX_user_token_token', [
+        'token'
+    ], {
+        unique: true
+    }),
+    Index('IDX_user_token_user_type', [
+        'userId',
+        'type'
+    ]),
+    Index('IDX_user_token_expires', [
+        'expiresAt'
+    ])
+], UserToken);

package/fesm/guards/auth-throttler.guard.js

@@ -0,0 +1,43 @@
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+import { Injectable } from '@nestjs/common';
+import { ThrottlerException, ThrottlerGuard } from '@nestjs/throttler';
+export class AuthThrottlerGuard extends ThrottlerGuard {
+    /**
+   * Generate tracker key combining IP and email for login attempts.
+   * This prevents attackers from brute-forcing multiple accounts from the same IP.
+   */ async getTracker(req) {
+        const ip = req.ip || req.headers?.['x-forwarded-for'] || 'unknown';
+        const body = req.body;
+        const email = body?.email || '';
+        return `auth:${ip}:${email}`;
+    }
+    /**
+   * Custom error message for rate limit exceeded.
+   */ throwThrottlingException() {
+        throw new ThrottlerException('Too many authentication attempts. Please try again later.');
+    }
+    /**
+   * Skip rate limiting for authenticated users on certain endpoints.
+   */ async shouldSkip(context) {
+        const request = context.switchToHttp().getRequest();
+        const path = request.path || request.url || '';
+        // Remove query string for comparison
+        const pathOnly = path.split('?')[0];
+        // Skip rate limiting for authenticated endpoints (they have their own protection)
+        // Use exact match or prefix match to prevent bypass via path manipulation
+        const authenticatedEndpoints = [
+            '/auth/me',
+            '/auth/logout',
+            '/auth/change-password'
+        ];
+        return authenticatedEndpoints.some((endpoint)=>pathOnly === endpoint || pathOnly.startsWith(`${endpoint}/`));
+    }
+}
+AuthThrottlerGuard = _ts_decorate([
+    Injectable()
+], AuthThrottlerGuard);

package/fesm/interceptors/clear-token.interceptor.js

@@ -27,8 +27,8 @@ function _ts_param(paramIndex, decorator) {
 }
 import { Injectable, Optional } from '@nestjs/common';
 import { map } from 'rxjs';
+import { DEFAULT_COOKIE_NAME } from '../config';
 import { AuthConfigService } from '../services/auth-config.service';
-const DEFAULT_COOKIE_NAME = 'fsn_refresh_token';
 export class ClearToken {
     get cookieName() {
         return this.authConfig?.getRefreshTokenCookieName() ?? DEFAULT_COOKIE_NAME;
@@ -37,14 +37,11 @@ export class ClearToken {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe(map((value)=>{
-            // Clear the refresh token cookie
             this.clearRefreshTokenCookie(req, res);
             return value;
         }));
     }
-    /**
-   * Clear refresh token cookie
-   */ clearRefreshTokenCookie(req, res) {
+    clearRefreshTokenCookie(req, res) {
         const origin = req.headers.origin || '';
         const hostname = req.hostname || '';
         const isHttps = origin.startsWith('https://') || req.secure;

package/fesm/interceptors/set-token.interceptor.js

@@ -25,84 +25,90 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { Injectable, Optional, PayloadTooLargeException } from '@nestjs/common';
+import { Inject, Injectable, Optional, PayloadTooLargeException } from '@nestjs/common';
 import { Buffer } from 'buffer';
 import { catchError, map, throwError } from 'rxjs';
+import { DEFAULT_COOKIE_NAME, MAX_COOKIE_BYTES } from '../config';
 import { AuthConfigService } from '../services/auth-config.service';
-const DEFAULT_COOKIE_NAME = 'fsn_refresh_token';
-const MAX_COOKIE_BYTES = 3500;
 export class SetToken {
     get cookieName() {
         return this.authConfig?.getRefreshTokenCookieName() ?? DEFAULT_COOKIE_NAME;
     }
+    /** Convert expiration string (e.g., '7d', '24h') to milliseconds */ getMaxAgeMs() {
+        const expiry = this.authConfig?.getRefreshTokenExpiration() ?? '7d';
+        const match = expiry.match(/^(\d+)(s|m|h|d|w)$/);
+        if (!match) {
+            return 7 * 24 * 60 * 60 * 1000; // Default 7 days
+        }
+        const value = parseInt(match[1], 10);
+        const unit = match[2];
+        const multipliers = {
+            s: 1000,
+            m: 60 * 1000,
+            h: 60 * 60 * 1000,
+            d: 24 * 60 * 60 * 1000,
+            w: 7 * 24 * 60 * 60 * 1000
+        };
+        return value * (multipliers[unit] || multipliers['d']);
+    }
     intercept(context, next) {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe(map((value)=>{
-            // Skip if no refreshToken in response
             if (!value || !value.refreshToken) {
                 return value;
             }
             const isBrowser = this.isBrowserRequest(req);
             const tokenValue = value.refreshToken;
             if (isBrowser) {
-                // Browser: Set cookie and remove from response body
                 this.setRefreshTokenCookie(req, res, tokenValue);
-                // Return response without refreshToken for browsers
                 const { refreshToken, ...responseWithoutToken } = value;
                 return responseWithoutToken;
             }
-            // API/Mobile: Keep refreshToken in response body
             return value;
         }), catchError((err)=>throwError(()=>err)));
     }
-    /**
-   * Detect if request is from a browser
-   * Checks Accept header and custom X-Client-Type header
-   */ isBrowserRequest(req) {
-        // Check custom header first (allows explicit client identification)
+    isBrowserRequest(req) {
         const clientType = req.headers['x-client-type'];
         if (clientType) {
             return clientType.toLowerCase() === 'browser' || clientType.toLowerCase() === 'web';
         }
-        // Check Accept header - browsers typically include text/html
         const accept = req.headers['accept'] || '';
         if (accept.includes('text/html')) {
             return true;
         }
-        // Check User-Agent for common browsers
         const userAgent = req.headers['user-agent'] || '';
         const browserPatterns = /mozilla|chrome|safari|firefox|edge|opera|msie/i;
-        if (browserPatterns.test(userAgent) && !userAgent.includes('Postman')) {
-            return true;
-        }
-        return false;
+        return browserPatterns.test(userAgent) && !userAgent.includes('Postman');
     }
-    /**
-   * Set refresh token in HTTP-only cookie
-   */ setRefreshTokenCookie(req, res, tokenValue) {
-        const origin = req.headers.origin || '';
+    setRefreshTokenCookie(req, res, tokenValue) {
         const hostname = req.hostname || '';
-        const isHttps = origin.startsWith('https://') || req.secure;
-        let cookieDomain = hostname;
+        // Determine if we're in production - always use secure cookies in production
+        // This handles TLS-terminating proxies correctly (they set x-forwarded-proto)
+        const isProduction = process.env.NODE_ENV === 'production';
+        const forwardedProto = req.headers['x-forwarded-proto'];
+        const isHttps = isProduction || forwardedProto === 'https' || req.secure;
+        // Set cookie domain - only for subdomains with 3+ parts
+        // For security, limit to same domain unless explicitly configured
+        let cookieDomain;
         const domainParts = hostname.split('.');
-        if (domainParts.length > 2) {
+        if (domainParts.length > 2 && !hostname.includes('localhost')) {
             cookieDomain = '.' + domainParts.slice(-2).join('.');
         }
-        // Check cookie size
-        const rawCookieString = `${this.cookieName}=${tokenValue}; HttpOnly; Domain=${cookieDomain}`;
+        const rawCookieString = `${this.cookieName}=${tokenValue}; HttpOnly`;
         const estimatedBytes = Buffer.byteLength(rawCookieString, 'utf8');
         if (estimatedBytes > MAX_COOKIE_BYTES) {
             throw new PayloadTooLargeException(`Refresh token too large (≈${estimatedBytes} bytes)`);
         }
-        // Set HTTP-only secure cookie
         res.cookie(this.cookieName, tokenValue, {
             httpOnly: true,
             secure: isHttps,
             sameSite: isHttps ? 'strict' : 'lax',
-            domain: cookieDomain,
+            ...cookieDomain && {
+                domain: cookieDomain
+            },
             path: '/',
-            maxAge: 7 * 24 * 60 * 60 * 1000
+            maxAge: this.getMaxAgeMs()
         });
     }
     constructor(authConfig){
@@ -113,6 +119,7 @@ export class SetToken {
 SetToken = _ts_decorate([
     Injectable(),
     _ts_param(0, Optional()),
+    _ts_param(0, Inject(AuthConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof AuthConfigService === "undefined" ? Object : AuthConfigService

package/fesm/interfaces/auth-email-provider.interface.js

@@ -0,0 +1,38 @@
+/**
+ * Auth Email Provider Interface
+ *
+ * This interface defines the contract for email sending in the auth module.
+ * It allows auth to work independently of the email module.
+ *
+ * To use email features in auth:
+ * 1. Provide AUTH_EMAIL_PROVIDER in your app module
+ * 2. Implement IAuthEmailProvider using EmailSendService from nestjs-email
+ *
+ * @example
+ * ```typescript
+ * // In app.module.ts or a provider file
+ * {
+ *   provide: AUTH_EMAIL_PROVIDER,
+ *   useFactory: (emailSendService: EmailSendService) => ({
+ *     sendPasswordResetEmail: async (email, token, resetUrl) => {
+ *       await emailSendService.sendTemplateEmail({
+ *         templateSlug: 'password-reset',
+ *         to: email,
+ *         variables: { resetUrl, token },
+ *       });
+ *     },
+ *     sendVerificationEmail: async (email, token, verifyUrl) => {
+ *       await emailSendService.sendTemplateEmail({
+ *         templateSlug: 'email-verification',
+ *         to: email,
+ *         variables: { verifyUrl, token },
+ *       });
+ *     },
+ *   }),
+ *   inject: [EmailSendService],
+ * }
+ * ```
+ */ /**
+ * Injection token for auth email provider
+ * Use this to provide the email implementation
+ */ export const AUTH_EMAIL_PROVIDER = 'AUTH_EMAIL_PROVIDER';

package/fesm/interfaces/authentication.interface.js

@@ -1,7 +1 @@
-// =============================================================================
-// TOKEN INTERFACES
-// =============================================================================
-/**
- * Login Response when company/branch selection is required
- * Frontend shows selection UI and calls /select endpoint with chosen company + branch
- */ export { };
+/** Login Response when email verification is required */ export { };

package/fesm/interfaces/index.js

@@ -1,5 +1,7 @@
 export * from './authentication.interface';
+export * from './auth-email-provider.interface';
 export * from './company-branch.interface';
 export * from './company.interface';
 export * from './user.interface';
+export * from './user-enricher.interface';
 export * from './auth-module-options.interface';

package/fesm/interfaces/user-enricher.interface.js

@@ -0,0 +1,26 @@
+/**
+ * User Enricher Provider Interface
+ *
+ * Allows consuming applications to extend user list and profile
+ * without modifying the base nestjs-auth package.
+ *
+ * This follows the Provider Interface Pattern:
+ * - nestjs-auth defines the interface (this file)
+ * - Consuming apps implement the interface
+ * - nestjs-auth optionally injects the implementation
+ *
+ * @example
+ * // In your app module
+ * providers: [
+ *   { provide: USER_ENRICHER, useClass: MyUserEnricher },
+ * ]
+ *
+ * // Your enricher implementation
+ * @Injectable()
+ * export class MyUserEnricher implements IUserEnricher {
+ *   async enrichListQuery(query, user) {
+ *     query.leftJoinAndSelect('user.department', 'department');
+ *     return { extraFields: ['department.name'] };
+ *   }
+ * }
+ */ export { };

package/fesm/modules/auth.module.js

@@ -5,10 +5,9 @@ function _ts_decorate(decorators, target, key, desc) {
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 import { CacheModule, UtilsModule } from '@flusys/nestjs-shared/modules';
-import { Module, Scope } from '@nestjs/common';
+import { Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
-import { getRepositoryToken } from '@nestjs/typeorm';
 import { AuthConfigService } from '../services/auth-config.service';
 import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
@@ -17,14 +16,14 @@ import { Company, CompanyBranch, User, UserCompanyPermission } from '../entities
 import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { ClearToken } from '../interceptors/clear-token.interceptor';
 import { SetToken } from '../interceptors/set-token.interceptor';
-import { AuthenticationService, BranchService, CompanySelectionSessionService, CompanyService, UserPermissionService, UserService } from '../services';
+import { AuthEmailService, AuthenticationService, BranchService, CompanySelectionSessionService, CompanyService, UserPermissionService, UserService } from '../services';
 import { JwtStrategy } from '../strategies/jwt.strategy';
 export class AuthModule {
     static forRoot(options) {
         return this.buildDynamicModule(options);
     }
     static forRootAsync(asyncOptions) {
-        const { global = false, includeController = true, bootstrapAppConfig: { enableCompanyFeature } = {}, imports: externalImports = [] } = asyncOptions;
+        const { global = false, includeController = true, bootstrapAppConfig: { enableCompanyFeature } = {}, imports: externalImports = [], providers: additionalProviders = [] } = asyncOptions;
         const asyncProviders = this.createAsyncProviders(asyncOptions);
         // Build imports
         const imports = [
@@ -51,6 +50,7 @@ export class AuthModule {
         // Build providers
         const providers = [
             ...asyncProviders,
+            ...additionalProviders,
             // Config & Infrastructure
             AuthConfigService,
             AuthDataSourceProvider,
@@ -58,6 +58,7 @@ export class AuthModule {
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
+            AuthEmailService,
             // Interceptors
             SetToken,
             ClearToken,
@@ -77,6 +78,7 @@ export class AuthModule {
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
+            AuthEmailService,
             UserService
         ];
         if (enableCompanyFeature) {
@@ -92,7 +94,7 @@ export class AuthModule {
         };
     }
     static buildDynamicModule(options) {
-        const { bootstrapAppConfig: { enableCompanyFeature } = {}, includeController = true, global = false } = options;
+        const { bootstrapAppConfig: { enableCompanyFeature } = {}, includeController = true, global = false, providers: additionalProviders = [] } = options;
         const imports = [
             PassportModule.register({
                 defaultStrategy: 'jwt'
@@ -118,6 +120,7 @@ export class AuthModule {
                 provide: AUTH_MODULE_OPTIONS,
                 useValue: options
             },
+            ...additionalProviders,
             // Config & Infrastructure
             AuthConfigService,
             AuthDataSourceProvider,
@@ -125,6 +128,7 @@ export class AuthModule {
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
+            AuthEmailService,
             // Interceptors
             SetToken,
             ClearToken,
@@ -143,6 +147,7 @@ export class AuthModule {
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
+            AuthEmailService,
             UserService
         ];
         if (enableCompanyFeature) {
@@ -223,23 +228,6 @@ export class AuthModule {
             }
         ];
     }
-    /**
-   * Create repository providers that use AuthDataSourceProvider
-   * This replaces TypeOrmModule.forFeature() functionality
-   * Note: Must be REQUEST-scoped since AuthDataSourceProvider is REQUEST-scoped
-   */ static getRepositoryProviders(enableCompanyFeature) {
-        const entities = this.getEntities(enableCompanyFeature);
-        return entities.map((entity)=>({
-                provide: getRepositoryToken(entity),
-                scope: Scope.REQUEST,
-                useFactory: async (dataSourceProvider)=>{
-                    return await dataSourceProvider.getRepository(entity);
-                },
-                inject: [
-                    AuthDataSourceProvider
-                ]
-            }));
-    }
     static getEntities(enableCompanyFeature = false) {
         const coreEntities = [
             User

package/fesm/services/auth-config.service.js

@@ -25,87 +25,82 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { Inject, Injectable, Optional } from '@nestjs/common';
+import { Inject, Injectable, InternalServerErrorException, Logger, Optional } from '@nestjs/common';
 import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
 export class AuthConfigService {
-    // ==================== Database Mode ====================
-    /**
-   * Get database mode (single or multi-tenant)
-   */ getDatabaseMode() {
+    // Database Mode
+    /** Get database mode (single or multi-tenant) */ getDatabaseMode() {
         return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
     }
-    /**
-   * Check if running in multi-tenant mode
-   */ isMultiTenant() {
+    /** Check if running in multi-tenant mode */ isMultiTenant() {
         return this.getDatabaseMode() === 'multi-tenant';
     }
-    // ==================== Feature Flags ====================
-    /**
-   * Check if company feature is enabled
-   */ isCompanyFeatureEnabled() {
+    // Feature Flags
+    /** Check if company feature is enabled */ isCompanyFeatureEnabled() {
         return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
-    // ==================== JWT Configuration ====================
-    /**
-   * Get JWT secret key
-   */ getJwtSecret() {
-        return this.config.jwtSecret ?? 'default-secret-change-in-production';
+    // JWT Configuration
+    /** Get JWT secret key */ getJwtSecret() {
+        if (!this.config.jwtSecret) {
+            throw new InternalServerErrorException('[AuthModule] JWT_SECRET is required - set via environment or module config');
+        }
+        return this.config.jwtSecret;
     }
-    /**
-   * Get JWT expiration time
-   */ getJwtExpiration() {
+    /** Get JWT expiration time */ getJwtExpiration() {
         return this.config.jwtExpiration ?? '1h';
     }
-    /**
-   * Get refresh token secret key
-   */ getRefreshTokenSecret() {
-        return this.config.refreshTokenSecret ?? this.getJwtSecret();
+    /** Get refresh token secret key */ getRefreshTokenSecret() {
+        if (this.config.refreshTokenSecret) {
+            return this.config.refreshTokenSecret;
+        }
+        // Production: require separate refresh token secret for security
+        if (process.env.NODE_ENV === 'production') {
+            throw new InternalServerErrorException('[AuthModule] REFRESH_TOKEN_SECRET is required in production - ' + 'using the same secret for access and refresh tokens is a security risk');
+        }
+        // Development: warn once about fallback to JWT secret
+        if (!this.refreshTokenSecretWarned) {
+            this.refreshTokenSecretWarned = true;
+            this.logger.warn('REFRESH_TOKEN_SECRET not configured - using JWT_SECRET as fallback. ' + 'For better security, configure a separate refresh token secret.');
+        }
+        return this.config.jwtSecret ?? this.getJwtSecret();
     }
-    /**
-   * Get refresh token expiration time
-   */ getRefreshTokenExpiration() {
+    /** Get refresh token expiration time */ getRefreshTokenExpiration() {
         return this.config.refreshTokenExpiration ?? '7d';
     }
-    /**
-   * Get refresh token cookie name
-   */ getRefreshTokenCookieName() {
+    /** Get refresh token cookie name */ getRefreshTokenCookieName() {
         return this.config.refreshTokenCookieName ?? 'fsn_refresh_token';
     }
-    // ==================== Database Configuration ====================
-    /**
-   * Get default database config
-   */ getDefaultDatabaseConfig() {
+    // Frontend Configuration
+    /** Get frontend URL for email links */ getFrontendUrl() {
+        return this.config.frontendUrl;
+    }
+    // Database Configuration
+    /** Get default database config */ getDefaultDatabaseConfig() {
         return this.config.defaultDatabaseConfig ?? this.config.tenantDefaultDatabaseConfig;
     }
-    /**
-   * Get tenant default database config (for multi-tenant)
-   */ getTenantDefaultDatabaseConfig() {
+    /** Get tenant default database config (for multi-tenant) */ getTenantDefaultDatabaseConfig() {
         return this.config.tenantDefaultDatabaseConfig;
     }
-    /**
-   * Get registered tenants
-   */ getTenants() {
+    /** Get registered tenants */ getTenants() {
         return this.config.tenants ?? [];
     }
-    // ==================== Raw Options ====================
-    /**
-   * Get full module options
-   */ getOptions() {
+    // Raw Options
+    /** Get full module options */ getOptions() {
         return {
             ...this.options
         };
     }
-    /**
-   * Get runtime config
-   */ getConfig() {
+    /** Get runtime config */ getConfig() {
         return {
             ...this.config
         };
     }
     constructor(injectedOptions){
+        _define_property(this, "logger", new Logger(AuthConfigService.name));
         _define_property(this, "options", void 0);
         _define_property(this, "config", void 0);
+        _define_property(this, "refreshTokenSecretWarned", false);
         this.options = injectedOptions ?? {
             global: false,
             includeController: true