@flusys/nestjs-auth 0.1.0-beta.3 → 1.0.0-rc

package/cjs/dtos/authentication.dto.js

@@ -27,12 +27,18 @@ _export(exports, {
     get CompanyWithBranchesDto () {
         return CompanyWithBranchesDto;
     },
+    get ForgotPasswordDto () {
+        return ForgotPasswordDto;
+    },
     get LoginDto () {
         return LoginDto;
     },
     get LoginResponseDto () {
         return LoginResponseDto;
     },
+    get LoginResponseRequiresEmailVerificationDto () {
+        return LoginResponseRequiresEmailVerificationDto;
+    },
     get MeResponseDto () {
         return MeResponseDto;
     },
@@ -45,6 +51,12 @@ _export(exports, {
     get RegistrationResponseDto () {
         return RegistrationResponseDto;
     },
+    get ResendVerificationDto () {
+        return ResendVerificationDto;
+    },
+    get ResetPasswordDto () {
+        return ResetPasswordDto;
+    },
     get SelectDto () {
         return SelectDto;
     },
@@ -53,10 +65,14 @@ _export(exports, {
     },
     get UserInfoDto () {
         return UserInfoDto;
+    },
+    get VerifyEmailDto () {
+        return VerifyEmailDto;
     }
 });
 const _swagger = require("@nestjs/swagger");
 const _classvalidator = require("class-validator");
+const _passwordvalidator = require("../validators/password.validator");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -96,12 +112,12 @@ _ts_decorate([
 ], LoginDto.prototype, "email", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: '123456',
-        description: 'User password (min 6 chars)'
+        example: 'SecureP@ss1',
+        description: 'User password'
     }),
     (0, _classvalidator.IsString)(),
     (0, _classvalidator.IsNotEmpty)(),
-    (0, _classvalidator.MinLength)(6),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], LoginDto.prototype, "password", void 0);
 let RegistrationDto = class RegistrationDto {
@@ -140,13 +156,13 @@ _ts_decorate([
 ], RegistrationDto.prototype, "email", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: 'strongPassword123',
-        description: 'Password (min 6 chars)'
+        example: 'StrongP@ss123',
+        description: 'Password (min 8 chars, requires uppercase, lowercase, number, special char)'
     }),
     (0, _classvalidator.IsNotEmpty)(),
     (0, _classvalidator.IsString)(),
-    (0, _classvalidator.MinLength)(6),
-    (0, _classvalidator.MaxLength)(60),
+    (0, _passwordvalidator.IsStrongPassword)(),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], RegistrationDto.prototype, "password", void 0);
 _ts_decorate([
@@ -207,6 +223,7 @@ _ts_decorate([
     }),
     (0, _classvalidator.IsOptional)(),
     (0, _classvalidator.IsString)(),
+    (0, _classvalidator.MaxLength)(500),
     _ts_metadata("design:type", String)
 ], RegistrationDto.prototype, "newCompanyAddress", void 0);
 let RefreshTokenDto = class RefreshTokenDto {
@@ -236,16 +253,17 @@ _ts_decorate([
     }),
     (0, _classvalidator.IsString)(),
     (0, _classvalidator.IsNotEmpty)(),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], ChangePasswordDto.prototype, "currentPassword", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: 'newPassword456',
-        description: 'New password (min 6 chars)'
+        example: 'NewP@ssword456',
+        description: 'New password (min 8 chars, requires uppercase, lowercase, number, special char)'
     }),
     (0, _classvalidator.IsString)(),
     (0, _classvalidator.IsNotEmpty)(),
-    (0, _classvalidator.MinLength)(6),
+    (0, _passwordvalidator.IsStrongPassword)(),
     _ts_metadata("design:type", String)
 ], ChangePasswordDto.prototype, "newPassword", void 0);
 let SelectDto = class SelectDto {
@@ -558,16 +576,17 @@ let RegistrationResponseDto = class RegistrationResponseDto {
         _define_property(this, "company", void 0);
         _define_property(this, "branch", void 0);
         _define_property(this, "companyFeatureEnabled", void 0);
+        _define_property(this, "requiresEmailVerification", void 0);
     }
 };
 _ts_decorate([
-    (0, _swagger.ApiProperty)({
+    (0, _swagger.ApiPropertyOptional)({
         example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
     }),
     _ts_metadata("design:type", String)
 ], RegistrationResponseDto.prototype, "accessToken", void 0);
 _ts_decorate([
-    (0, _swagger.ApiProperty)({
+    (0, _swagger.ApiPropertyOptional)({
         example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
     }),
     _ts_metadata("design:type", String)
@@ -594,12 +613,19 @@ _ts_decorate([
     _ts_metadata("design:type", typeof BranchInfoDto === "undefined" ? Object : BranchInfoDto)
 ], RegistrationResponseDto.prototype, "branch", void 0);
 _ts_decorate([
-    (0, _swagger.ApiProperty)({
+    (0, _swagger.ApiPropertyOptional)({
         example: true,
         description: 'Whether company feature is enabled'
     }),
     _ts_metadata("design:type", Boolean)
 ], RegistrationResponseDto.prototype, "companyFeatureEnabled", void 0);
+_ts_decorate([
+    (0, _swagger.ApiPropertyOptional)({
+        example: true,
+        description: 'Whether email verification is required'
+    }),
+    _ts_metadata("design:type", Boolean)
+], RegistrationResponseDto.prototype, "requiresEmailVerification", void 0);
 let MeResponseDto = class MeResponseDto {
     constructor(){
         _define_property(this, "user", void 0);
@@ -674,3 +700,83 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Array)
 ], CompanySelectionResponseDto.prototype, "companies", void 0);
+let LoginResponseRequiresEmailVerificationDto = class LoginResponseRequiresEmailVerificationDto {
+    constructor(){
+        _define_property(this, "requiresEmailVerification", void 0);
+        _define_property(this, "email", void 0);
+        _define_property(this, "message", void 0);
+    }
+};
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: true
+    }),
+    _ts_metadata("design:type", Boolean)
+], LoginResponseRequiresEmailVerificationDto.prototype, "requiresEmailVerification", void 0);
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'john@example.com'
+    }),
+    _ts_metadata("design:type", String)
+], LoginResponseRequiresEmailVerificationDto.prototype, "email", void 0);
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'Please verify your email address before logging in.'
+    }),
+    _ts_metadata("design:type", String)
+], LoginResponseRequiresEmailVerificationDto.prototype, "message", void 0);
+let ForgotPasswordDto = class ForgotPasswordDto {
+    constructor(){
+        _define_property(this, "email", void 0);
+    }
+};
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'john@example.com',
+        description: 'Email address to send reset link to'
+    }),
+    (0, _classvalidator.IsEmail)(),
+    (0, _classvalidator.IsNotEmpty)(),
+    _ts_metadata("design:type", String)
+], ForgotPasswordDto.prototype, "email", void 0);
+let ResetPasswordDto = class ResetPasswordDto {
+    constructor(){
+        _define_property(this, "token", void 0);
+        _define_property(this, "newPassword", void 0);
+    }
+};
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'a1b2c3d4e5f6...',
+        description: 'Password reset token from email'
+    }),
+    (0, _classvalidator.IsString)(),
+    (0, _classvalidator.IsNotEmpty)(),
+    _ts_metadata("design:type", String)
+], ResetPasswordDto.prototype, "token", void 0);
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'NewSecureP@ss123',
+        description: 'New password (min 8 chars, requires uppercase, lowercase, number, special char)'
+    }),
+    (0, _classvalidator.IsString)(),
+    (0, _classvalidator.IsNotEmpty)(),
+    (0, _passwordvalidator.IsStrongPassword)(),
+    _ts_metadata("design:type", String)
+], ResetPasswordDto.prototype, "newPassword", void 0);
+let VerifyEmailDto = class VerifyEmailDto {
+    constructor(){
+        _define_property(this, "token", void 0);
+    }
+};
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'a1b2c3d4e5f6...',
+        description: 'Email verification token from email'
+    }),
+    (0, _classvalidator.IsString)(),
+    (0, _classvalidator.IsNotEmpty)(),
+    _ts_metadata("design:type", String)
+], VerifyEmailDto.prototype, "token", void 0);
+let ResendVerificationDto = class ResendVerificationDto extends ForgotPasswordDto {
+};

package/cjs/dtos/user-permission.dto.js

@@ -254,9 +254,23 @@ _ts_decorate([
 ], UserBranchPermissionDto.prototype, "companyId", void 0);
 let UserCompaniesResponseDto = class UserCompaniesResponseDto {
     constructor(){
+        _define_property(this, "success", void 0);
+        _define_property(this, "message", void 0);
         _define_property(this, "data", void 0);
     }
 };
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: true
+    }),
+    _ts_metadata("design:type", Boolean)
+], UserCompaniesResponseDto.prototype, "success", void 0);
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'User companies retrieved successfully'
+    }),
+    _ts_metadata("design:type", String)
+], UserCompaniesResponseDto.prototype, "message", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
         description: 'List of companies the user has access to',
@@ -284,9 +298,23 @@ _ts_decorate([
 ], UserCompaniesResponseDto.prototype, "data", void 0);
 let UserBranchesResponseDto = class UserBranchesResponseDto {
     constructor(){
+        _define_property(this, "success", void 0);
+        _define_property(this, "message", void 0);
         _define_property(this, "data", void 0);
     }
 };
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: true
+    }),
+    _ts_metadata("design:type", Boolean)
+], UserBranchesResponseDto.prototype, "success", void 0);
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'User branches retrieved successfully'
+    }),
+    _ts_metadata("design:type", String)
+], UserBranchesResponseDto.prototype, "message", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
         description: 'List of branches the user has access to',

package/cjs/dtos/user.dto.js

@@ -21,6 +21,7 @@ _export(exports, {
 });
 const _swagger = require("@nestjs/swagger");
 const _classvalidator = require("class-validator");
+const _passwordvalidator = require("../validators/password.validator");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -83,10 +84,13 @@ _ts_decorate([
 ], CreateUserDto.prototype, "email", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: 'password123',
-        description: 'Password'
+        example: 'SecureP@ss123',
+        description: 'Password (must meet complexity requirements)'
     }),
     (0, _classvalidator.IsString)(),
+    (0, _classvalidator.IsNotEmpty)(),
+    (0, _passwordvalidator.IsStrongPassword)(),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], CreateUserDto.prototype, "password", void 0);
 _ts_decorate([
@@ -139,6 +143,7 @@ let UpdateUserDto = class UpdateUserDto {
         _define_property(this, "phone", void 0);
         _define_property(this, "email", void 0);
         _define_property(this, "password", void 0);
+        _define_property(this, "oldPassword", void 0);
         _define_property(this, "profilePictureId", void 0);
         _define_property(this, "isActive", void 0);
         _define_property(this, "emailVerified", void 0);
@@ -150,7 +155,7 @@ _ts_decorate([
     (0, _swagger.ApiProperty)({
         description: 'User ID'
     }),
-    (0, _classvalidator.IsString)(),
+    (0, _classvalidator.IsUUID)(),
     _ts_metadata("design:type", String)
 ], UpdateUserDto.prototype, "id", void 0);
 _ts_decorate([
@@ -182,12 +187,22 @@ _ts_decorate([
 ], UpdateUserDto.prototype, "email", void 0);
 _ts_decorate([
     (0, _swagger.ApiPropertyOptional)({
-        description: 'New password'
+        description: 'New password (must meet complexity requirements)'
     }),
     (0, _classvalidator.IsOptional)(),
     (0, _classvalidator.IsString)(),
+    (0, _passwordvalidator.IsStrongPassword)(),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], UpdateUserDto.prototype, "password", void 0);
+_ts_decorate([
+    (0, _swagger.ApiPropertyOptional)({
+        description: 'Current password (required when changing password on own profile)'
+    }),
+    (0, _classvalidator.IsOptional)(),
+    (0, _classvalidator.IsString)(),
+    _ts_metadata("design:type", String)
+], UpdateUserDto.prototype, "oldPassword", void 0);
 _ts_decorate([
     (0, _swagger.ApiPropertyOptional)({
         description: 'Profile picture file ID'

package/cjs/entities/index.js

@@ -30,8 +30,10 @@ _export(exports, {
 });
 const _companybranchentity = _export_star(require("./company-branch.entity"), exports);
 const _companyentity = _export_star(require("./company.entity"), exports);
+const _pendingregistrationentity = _export_star(require("./pending-registration.entity"), exports);
 const _usercompanypermissionentity = require("./user-company-permission.entity");
 const _userentity = _export_star(require("./user.entity"), exports);
+const _usertokenentity = _export_star(require("./user-token.entity"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {
         if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {
@@ -46,7 +48,9 @@ function _export_star(from, to) {
     return from;
 }
 const CoreEntities = [
-    _userentity.User
+    _userentity.User,
+    _usertokenentity.UserToken,
+    _pendingregistrationentity.PendingRegistration
 ];
 const CompanyEntities = [
     _companyentity.Company,

package/cjs/entities/pending-registration.entity.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "PendingRegistration", {
+    enumerable: true,
+    get: function() {
+        return PendingRegistration;
+    }
+});
+const _typeorm = require("typeorm");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+let PendingRegistration = class PendingRegistration {
+    constructor(){
+        _define_property(this, "id", void 0);
+        _define_property(this, "email", void 0);
+        _define_property(this, "name", void 0);
+        _define_property(this, "phone", void 0);
+        _define_property(this, "passwordHash", void 0);
+        _define_property(this, "token", void 0);
+        _define_property(this, "expiresAt", void 0);
+        _define_property(this, "companyData", void 0);
+        _define_property(this, "createdAt", void 0);
+    }
+};
+_ts_decorate([
+    (0, _typeorm.PrimaryGeneratedColumn)('uuid'),
+    _ts_metadata("design:type", String)
+], PendingRegistration.prototype, "id", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'varchar',
+        length: 255
+    }),
+    _ts_metadata("design:type", String)
+], PendingRegistration.prototype, "email", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'varchar',
+        length: 255,
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], PendingRegistration.prototype, "name", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'varchar',
+        length: 255,
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], PendingRegistration.prototype, "phone", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'text',
+        name: 'passwordHash'
+    }),
+    _ts_metadata("design:type", String)
+], PendingRegistration.prototype, "passwordHash", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'varchar',
+        length: 64
+    }),
+    _ts_metadata("design:type", String)
+], PendingRegistration.prototype, "token", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'timestamp',
+        name: 'expires_at'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], PendingRegistration.prototype, "expiresAt", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'json',
+        nullable: true,
+        name: 'company_data'
+    }),
+    _ts_metadata("design:type", Object)
+], PendingRegistration.prototype, "companyData", void 0);
+_ts_decorate([
+    (0, _typeorm.CreateDateColumn)({
+        type: 'timestamp',
+        name: 'created_at'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], PendingRegistration.prototype, "createdAt", void 0);
+PendingRegistration = _ts_decorate([
+    (0, _typeorm.Entity)('pending_registrations'),
+    (0, _typeorm.Index)('IDX_pending_reg_email', [
+        'email'
+    ], {
+        unique: true
+    }),
+    (0, _typeorm.Index)('IDX_pending_reg_token', [
+        'token'
+    ], {
+        unique: true
+    }),
+    (0, _typeorm.Index)('IDX_pending_reg_expires', [
+        'expiresAt'
+    ])
+], PendingRegistration);

package/cjs/entities/user-company-permission.entity.js

@@ -44,12 +44,6 @@ function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 let UserCompanyPermission = class UserCompanyPermission {
-    /* ---------- Helpers ---------- */ isCompanyPermission() {
-        return this.permissionType === _enums.PermissionType.COMPANY;
-    }
-    isBranchPermission() {
-        return this.permissionType === _enums.PermissionType.BRANCH;
-    }
     constructor(){
         _define_property(this, "id", void 0);
         /* ---------- Ownership ---------- */ _define_property(this, "userId", void 0);

package/cjs/entities/user-token.entity.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get TokenType () {
+        return TokenType;
+    },
+    get UserToken () {
+        return UserToken;
+    }
+});
+const _typeorm = require("typeorm");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+var TokenType = /*#__PURE__*/ function(TokenType) {
+    TokenType["PASSWORD_RESET"] = "password_reset";
+    TokenType["EMAIL_VERIFICATION"] = "email_verification";
+    TokenType["EMAIL_CHANGE"] = "email_change";
+    return TokenType;
+}({});
+let UserToken = class UserToken {
+    constructor(){
+        _define_property(this, "id", void 0);
+        _define_property(this, "userId", void 0);
+        _define_property(this, "type", void 0);
+        _define_property(this, "token", void 0);
+        _define_property(this, "expiresAt", void 0);
+        _define_property(this, "usedAt", void 0);
+        _define_property(this, "metadata", void 0);
+        _define_property(this, "createdAt", void 0);
+    }
+};
+_ts_decorate([
+    (0, _typeorm.PrimaryGeneratedColumn)('uuid'),
+    _ts_metadata("design:type", String)
+], UserToken.prototype, "id", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'uuid',
+        name: 'user_id'
+    }),
+    _ts_metadata("design:type", String)
+], UserToken.prototype, "userId", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'varchar',
+        length: 32
+    }),
+    _ts_metadata("design:type", String)
+], UserToken.prototype, "type", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'varchar',
+        length: 64
+    }),
+    _ts_metadata("design:type", String)
+], UserToken.prototype, "token", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'timestamp',
+        name: 'expires_at'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], UserToken.prototype, "expiresAt", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'timestamp',
+        name: 'used_at',
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], UserToken.prototype, "usedAt", void 0);
+_ts_decorate([
+    (0, _typeorm.Column)({
+        type: 'varchar',
+        length: 255,
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], UserToken.prototype, "metadata", void 0);
+_ts_decorate([
+    (0, _typeorm.CreateDateColumn)({
+        type: 'timestamp',
+        name: 'created_at'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], UserToken.prototype, "createdAt", void 0);
+UserToken = _ts_decorate([
+    (0, _typeorm.Entity)('user_tokens'),
+    (0, _typeorm.Index)('IDX_user_token_token', [
+        'token'
+    ], {
+        unique: true
+    }),
+    (0, _typeorm.Index)('IDX_user_token_user_type', [
+        'userId',
+        'type'
+    ]),
+    (0, _typeorm.Index)('IDX_user_token_expires', [
+        'expiresAt'
+    ])
+], UserToken);

package/cjs/guards/auth-throttler.guard.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AuthThrottlerGuard", {
+    enumerable: true,
+    get: function() {
+        return AuthThrottlerGuard;
+    }
+});
+const _common = require("@nestjs/common");
+const _throttler = require("@nestjs/throttler");
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+let AuthThrottlerGuard = class AuthThrottlerGuard extends _throttler.ThrottlerGuard {
+    /**
+   * Generate tracker key combining IP and email for login attempts.
+   * This prevents attackers from brute-forcing multiple accounts from the same IP.
+   */ async getTracker(req) {
+        const ip = req.ip || req.headers?.['x-forwarded-for'] || 'unknown';
+        const body = req.body;
+        const email = body?.email || '';
+        return `auth:${ip}:${email}`;
+    }
+    /**
+   * Custom error message for rate limit exceeded.
+   */ throwThrottlingException() {
+        throw new _throttler.ThrottlerException('Too many authentication attempts. Please try again later.');
+    }
+    /**
+   * Skip rate limiting for authenticated users on certain endpoints.
+   */ async shouldSkip(context) {
+        const request = context.switchToHttp().getRequest();
+        const path = request.path || request.url || '';
+        // Remove query string for comparison
+        const pathOnly = path.split('?')[0];
+        // Skip rate limiting for authenticated endpoints (they have their own protection)
+        // Use exact match or prefix match to prevent bypass via path manipulation
+        const authenticatedEndpoints = [
+            '/auth/me',
+            '/auth/logout',
+            '/auth/change-password'
+        ];
+        return authenticatedEndpoints.some((endpoint)=>pathOnly === endpoint || pathOnly.startsWith(`${endpoint}/`));
+    }
+};
+AuthThrottlerGuard = _ts_decorate([
+    (0, _common.Injectable)()
+], AuthThrottlerGuard);