@flusys/nestjs-auth 0.1.0-beta.3 → 1.0.0-rc

package/cjs/interceptors/clear-token.interceptor.js

@@ -10,6 +10,7 @@ Object.defineProperty(exports, "ClearToken", {
 });
 const _common = require("@nestjs/common");
 const _rxjs = require("rxjs");
+const _config = require("../config");
 const _authconfigservice = require("../services/auth-config.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -38,23 +39,19 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-const DEFAULT_COOKIE_NAME = 'fsn_refresh_token';
 let ClearToken = class ClearToken {
     get cookieName() {
-        return this.authConfig?.getRefreshTokenCookieName() ?? DEFAULT_COOKIE_NAME;
+        return this.authConfig?.getRefreshTokenCookieName() ?? _config.DEFAULT_COOKIE_NAME;
     }
     intercept(context, next) {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe((0, _rxjs.map)((value)=>{
-            // Clear the refresh token cookie
             this.clearRefreshTokenCookie(req, res);
             return value;
         }));
     }
-    /**
-   * Clear refresh token cookie
-   */ clearRefreshTokenCookie(req, res) {
+    clearRefreshTokenCookie(req, res) {
         const origin = req.headers.origin || '';
         const hostname = req.hostname || '';
         const isHttps = origin.startsWith('https://') || req.secure;

package/cjs/interceptors/set-token.interceptor.js

@@ -11,6 +11,7 @@ Object.defineProperty(exports, "SetToken", {
 const _common = require("@nestjs/common");
 const _buffer = require("buffer");
 const _rxjs = require("rxjs");
+const _config = require("../config");
 const _authconfigservice = require("../services/auth-config.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -39,80 +40,85 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-const DEFAULT_COOKIE_NAME = 'fsn_refresh_token';
-const MAX_COOKIE_BYTES = 3500;
 let SetToken = class SetToken {
     get cookieName() {
-        return this.authConfig?.getRefreshTokenCookieName() ?? DEFAULT_COOKIE_NAME;
+        return this.authConfig?.getRefreshTokenCookieName() ?? _config.DEFAULT_COOKIE_NAME;
+    }
+    /** Convert expiration string (e.g., '7d', '24h') to milliseconds */ getMaxAgeMs() {
+        const expiry = this.authConfig?.getRefreshTokenExpiration() ?? '7d';
+        const match = expiry.match(/^(\d+)(s|m|h|d|w)$/);
+        if (!match) {
+            return 7 * 24 * 60 * 60 * 1000; // Default 7 days
+        }
+        const value = parseInt(match[1], 10);
+        const unit = match[2];
+        const multipliers = {
+            s: 1000,
+            m: 60 * 1000,
+            h: 60 * 60 * 1000,
+            d: 24 * 60 * 60 * 1000,
+            w: 7 * 24 * 60 * 60 * 1000
+        };
+        return value * (multipliers[unit] || multipliers['d']);
     }
     intercept(context, next) {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe((0, _rxjs.map)((value)=>{
-            // Skip if no refreshToken in response
             if (!value || !value.refreshToken) {
                 return value;
             }
             const isBrowser = this.isBrowserRequest(req);
             const tokenValue = value.refreshToken;
             if (isBrowser) {
-                // Browser: Set cookie and remove from response body
                 this.setRefreshTokenCookie(req, res, tokenValue);
-                // Return response without refreshToken for browsers
                 const { refreshToken, ...responseWithoutToken } = value;
                 return responseWithoutToken;
             }
-            // API/Mobile: Keep refreshToken in response body
             return value;
         }), (0, _rxjs.catchError)((err)=>(0, _rxjs.throwError)(()=>err)));
     }
-    /**
-   * Detect if request is from a browser
-   * Checks Accept header and custom X-Client-Type header
-   */ isBrowserRequest(req) {
-        // Check custom header first (allows explicit client identification)
+    isBrowserRequest(req) {
         const clientType = req.headers['x-client-type'];
         if (clientType) {
             return clientType.toLowerCase() === 'browser' || clientType.toLowerCase() === 'web';
         }
-        // Check Accept header - browsers typically include text/html
         const accept = req.headers['accept'] || '';
         if (accept.includes('text/html')) {
             return true;
         }
-        // Check User-Agent for common browsers
         const userAgent = req.headers['user-agent'] || '';
         const browserPatterns = /mozilla|chrome|safari|firefox|edge|opera|msie/i;
-        if (browserPatterns.test(userAgent) && !userAgent.includes('Postman')) {
-            return true;
-        }
-        return false;
+        return browserPatterns.test(userAgent) && !userAgent.includes('Postman');
     }
-    /**
-   * Set refresh token in HTTP-only cookie
-   */ setRefreshTokenCookie(req, res, tokenValue) {
-        const origin = req.headers.origin || '';
+    setRefreshTokenCookie(req, res, tokenValue) {
         const hostname = req.hostname || '';
-        const isHttps = origin.startsWith('https://') || req.secure;
-        let cookieDomain = hostname;
+        // Determine if we're in production - always use secure cookies in production
+        // This handles TLS-terminating proxies correctly (they set x-forwarded-proto)
+        const isProduction = process.env.NODE_ENV === 'production';
+        const forwardedProto = req.headers['x-forwarded-proto'];
+        const isHttps = isProduction || forwardedProto === 'https' || req.secure;
+        // Set cookie domain - only for subdomains with 3+ parts
+        // For security, limit to same domain unless explicitly configured
+        let cookieDomain;
         const domainParts = hostname.split('.');
-        if (domainParts.length > 2) {
+        if (domainParts.length > 2 && !hostname.includes('localhost')) {
             cookieDomain = '.' + domainParts.slice(-2).join('.');
         }
-        // Check cookie size
-        const rawCookieString = `${this.cookieName}=${tokenValue}; HttpOnly; Domain=${cookieDomain}`;
+        const rawCookieString = `${this.cookieName}=${tokenValue}; HttpOnly`;
         const estimatedBytes = _buffer.Buffer.byteLength(rawCookieString, 'utf8');
-        if (estimatedBytes > MAX_COOKIE_BYTES) {
+        if (estimatedBytes > _config.MAX_COOKIE_BYTES) {
             throw new _common.PayloadTooLargeException(`Refresh token too large (≈${estimatedBytes} bytes)`);
         }
-        // Set HTTP-only secure cookie
         res.cookie(this.cookieName, tokenValue, {
             httpOnly: true,
             secure: isHttps,
             sameSite: isHttps ? 'strict' : 'lax',
-            domain: cookieDomain,
+            ...cookieDomain && {
+                domain: cookieDomain
+            },
             path: '/',
-            maxAge: 7 * 24 * 60 * 60 * 1000
+            maxAge: this.getMaxAgeMs()
         });
     }
     constructor(authConfig){
@@ -123,6 +129,7 @@ let SetToken = class SetToken {
 SetToken = _ts_decorate([
     (0, _common.Injectable)(),
     _ts_param(0, (0, _common.Optional)()),
+    _ts_param(0, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService

package/cjs/interfaces/auth-email-provider.interface.js

@@ -0,0 +1,45 @@
+/**
+ * Auth Email Provider Interface
+ *
+ * This interface defines the contract for email sending in the auth module.
+ * It allows auth to work independently of the email module.
+ *
+ * To use email features in auth:
+ * 1. Provide AUTH_EMAIL_PROVIDER in your app module
+ * 2. Implement IAuthEmailProvider using EmailSendService from nestjs-email
+ *
+ * @example
+ * ```typescript
+ * // In app.module.ts or a provider file
+ * {
+ *   provide: AUTH_EMAIL_PROVIDER,
+ *   useFactory: (emailSendService: EmailSendService) => ({
+ *     sendPasswordResetEmail: async (email, token, resetUrl) => {
+ *       await emailSendService.sendTemplateEmail({
+ *         templateSlug: 'password-reset',
+ *         to: email,
+ *         variables: { resetUrl, token },
+ *       });
+ *     },
+ *     sendVerificationEmail: async (email, token, verifyUrl) => {
+ *       await emailSendService.sendTemplateEmail({
+ *         templateSlug: 'email-verification',
+ *         to: email,
+ *         variables: { verifyUrl, token },
+ *       });
+ *     },
+ *   }),
+ *   inject: [EmailSendService],
+ * }
+ * ```
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AUTH_EMAIL_PROVIDER", {
+    enumerable: true,
+    get: function() {
+        return AUTH_EMAIL_PROVIDER;
+    }
+});
+const AUTH_EMAIL_PROVIDER = 'AUTH_EMAIL_PROVIDER';

package/cjs/interfaces/authentication.interface.js

@@ -1,6 +1,3 @@
-// =============================================================================
-// TOKEN INTERFACES
-// =============================================================================
 "use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true

package/cjs/interfaces/index.js

@@ -3,9 +3,11 @@ Object.defineProperty(exports, "__esModule", {
     value: true
 });
 _export_star(require("./authentication.interface"), exports);
+_export_star(require("./auth-email-provider.interface"), exports);
 _export_star(require("./company-branch.interface"), exports);
 _export_star(require("./company.interface"), exports);
 _export_star(require("./user.interface"), exports);
+_export_star(require("./user-enricher.interface"), exports);
 _export_star(require("./auth-module-options.interface"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {

package/cjs/interfaces/user-enricher.interface.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});

package/cjs/modules/auth.module.js

@@ -12,7 +12,6 @@ const _modules = require("@flusys/nestjs-shared/modules");
 const _common = require("@nestjs/common");
 const _jwt = require("@nestjs/jwt");
 const _passport = require("@nestjs/passport");
-const _typeorm = require("@nestjs/typeorm");
 const _authconfigservice = require("../services/auth-config.service");
 const _authdatasourceprovider = require("../services/auth-datasource.provider");
 const _authconstants = require("../config/auth.constants");
@@ -34,7 +33,7 @@ let AuthModule = class AuthModule {
         return this.buildDynamicModule(options);
     }
     static forRootAsync(asyncOptions) {
-        const { global = false, includeController = true, bootstrapAppConfig: { enableCompanyFeature } = {}, imports: externalImports = [] } = asyncOptions;
+        const { global = false, includeController = true, bootstrapAppConfig: { enableCompanyFeature } = {}, imports: externalImports = [], providers: additionalProviders = [] } = asyncOptions;
         const asyncProviders = this.createAsyncProviders(asyncOptions);
         // Build imports
         const imports = [
@@ -61,6 +60,7 @@ let AuthModule = class AuthModule {
         // Build providers
         const providers = [
             ...asyncProviders,
+            ...additionalProviders,
             // Config & Infrastructure
             _authconfigservice.AuthConfigService,
             _authdatasourceprovider.AuthDataSourceProvider,
@@ -68,6 +68,7 @@ let AuthModule = class AuthModule {
             _jwtstrategy.JwtStrategy,
             _guards.JwtAuthGuard,
             _services.AuthenticationService,
+            _services.AuthEmailService,
             // Interceptors
             _settokeninterceptor.SetToken,
             _cleartokeninterceptor.ClearToken,
@@ -87,6 +88,7 @@ let AuthModule = class AuthModule {
             _jwtstrategy.JwtStrategy,
             _guards.JwtAuthGuard,
             _services.AuthenticationService,
+            _services.AuthEmailService,
             _services.UserService
         ];
         if (enableCompanyFeature) {
@@ -102,7 +104,7 @@ let AuthModule = class AuthModule {
         };
     }
     static buildDynamicModule(options) {
-        const { bootstrapAppConfig: { enableCompanyFeature } = {}, includeController = true, global = false } = options;
+        const { bootstrapAppConfig: { enableCompanyFeature } = {}, includeController = true, global = false, providers: additionalProviders = [] } = options;
         const imports = [
             _passport.PassportModule.register({
                 defaultStrategy: 'jwt'
@@ -128,6 +130,7 @@ let AuthModule = class AuthModule {
                 provide: _authconstants.AUTH_MODULE_OPTIONS,
                 useValue: options
             },
+            ...additionalProviders,
             // Config & Infrastructure
             _authconfigservice.AuthConfigService,
             _authdatasourceprovider.AuthDataSourceProvider,
@@ -135,6 +138,7 @@ let AuthModule = class AuthModule {
             _jwtstrategy.JwtStrategy,
             _guards.JwtAuthGuard,
             _services.AuthenticationService,
+            _services.AuthEmailService,
             // Interceptors
             _settokeninterceptor.SetToken,
             _cleartokeninterceptor.ClearToken,
@@ -153,6 +157,7 @@ let AuthModule = class AuthModule {
             _jwtstrategy.JwtStrategy,
             _guards.JwtAuthGuard,
             _services.AuthenticationService,
+            _services.AuthEmailService,
             _services.UserService
         ];
         if (enableCompanyFeature) {
@@ -233,23 +238,6 @@ let AuthModule = class AuthModule {
             }
         ];
     }
-    /**
-   * Create repository providers that use AuthDataSourceProvider
-   * This replaces TypeOrmModule.forFeature() functionality
-   * Note: Must be REQUEST-scoped since AuthDataSourceProvider is REQUEST-scoped
-   */ static getRepositoryProviders(enableCompanyFeature) {
-        const entities = this.getEntities(enableCompanyFeature);
-        return entities.map((entity)=>({
-                provide: (0, _typeorm.getRepositoryToken)(entity),
-                scope: _common.Scope.REQUEST,
-                useFactory: async (dataSourceProvider)=>{
-                    return await dataSourceProvider.getRepository(entity);
-                },
-                inject: [
-                    _authdatasourceprovider.AuthDataSourceProvider
-                ]
-            }));
-    }
     static getEntities(enableCompanyFeature = false) {
         const coreEntities = [
             _entities.User

package/cjs/services/auth-config.service.js

@@ -39,83 +39,78 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthConfigService = class AuthConfigService {
-    // ==================== Database Mode ====================
-    /**
-   * Get database mode (single or multi-tenant)
-   */ getDatabaseMode() {
+    // Database Mode
+    /** Get database mode (single or multi-tenant) */ getDatabaseMode() {
         return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
     }
-    /**
-   * Check if running in multi-tenant mode
-   */ isMultiTenant() {
+    /** Check if running in multi-tenant mode */ isMultiTenant() {
         return this.getDatabaseMode() === 'multi-tenant';
     }
-    // ==================== Feature Flags ====================
-    /**
-   * Check if company feature is enabled
-   */ isCompanyFeatureEnabled() {
+    // Feature Flags
+    /** Check if company feature is enabled */ isCompanyFeatureEnabled() {
         return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
-    // ==================== JWT Configuration ====================
-    /**
-   * Get JWT secret key
-   */ getJwtSecret() {
-        return this.config.jwtSecret ?? 'default-secret-change-in-production';
+    // JWT Configuration
+    /** Get JWT secret key */ getJwtSecret() {
+        if (!this.config.jwtSecret) {
+            throw new _common.InternalServerErrorException('[AuthModule] JWT_SECRET is required - set via environment or module config');
+        }
+        return this.config.jwtSecret;
     }
-    /**
-   * Get JWT expiration time
-   */ getJwtExpiration() {
+    /** Get JWT expiration time */ getJwtExpiration() {
         return this.config.jwtExpiration ?? '1h';
     }
-    /**
-   * Get refresh token secret key
-   */ getRefreshTokenSecret() {
-        return this.config.refreshTokenSecret ?? this.getJwtSecret();
-    }
-    /**
-   * Get refresh token expiration time
-   */ getRefreshTokenExpiration() {
+    /** Get refresh token secret key */ getRefreshTokenSecret() {
+        if (this.config.refreshTokenSecret) {
+            return this.config.refreshTokenSecret;
+        }
+        // Production: require separate refresh token secret for security
+        if (process.env.NODE_ENV === 'production') {
+            throw new _common.InternalServerErrorException('[AuthModule] REFRESH_TOKEN_SECRET is required in production - ' + 'using the same secret for access and refresh tokens is a security risk');
+        }
+        // Development: warn once about fallback to JWT secret
+        if (!this.refreshTokenSecretWarned) {
+            this.refreshTokenSecretWarned = true;
+            this.logger.warn('REFRESH_TOKEN_SECRET not configured - using JWT_SECRET as fallback. ' + 'For better security, configure a separate refresh token secret.');
+        }
+        return this.config.jwtSecret ?? this.getJwtSecret();
+    }
+    /** Get refresh token expiration time */ getRefreshTokenExpiration() {
         return this.config.refreshTokenExpiration ?? '7d';
     }
-    /**
-   * Get refresh token cookie name
-   */ getRefreshTokenCookieName() {
+    /** Get refresh token cookie name */ getRefreshTokenCookieName() {
         return this.config.refreshTokenCookieName ?? 'fsn_refresh_token';
     }
-    // ==================== Database Configuration ====================
-    /**
-   * Get default database config
-   */ getDefaultDatabaseConfig() {
+    // Frontend Configuration
+    /** Get frontend URL for email links */ getFrontendUrl() {
+        return this.config.frontendUrl;
+    }
+    // Database Configuration
+    /** Get default database config */ getDefaultDatabaseConfig() {
         return this.config.defaultDatabaseConfig ?? this.config.tenantDefaultDatabaseConfig;
     }
-    /**
-   * Get tenant default database config (for multi-tenant)
-   */ getTenantDefaultDatabaseConfig() {
+    /** Get tenant default database config (for multi-tenant) */ getTenantDefaultDatabaseConfig() {
         return this.config.tenantDefaultDatabaseConfig;
     }
-    /**
-   * Get registered tenants
-   */ getTenants() {
+    /** Get registered tenants */ getTenants() {
         return this.config.tenants ?? [];
     }
-    // ==================== Raw Options ====================
-    /**
-   * Get full module options
-   */ getOptions() {
+    // Raw Options
+    /** Get full module options */ getOptions() {
         return {
             ...this.options
         };
     }
-    /**
-   * Get runtime config
-   */ getConfig() {
+    /** Get runtime config */ getConfig() {
         return {
             ...this.config
         };
     }
     constructor(injectedOptions){
+        _define_property(this, "logger", new _common.Logger(AuthConfigService.name));
         _define_property(this, "options", void 0);
         _define_property(this, "config", void 0);
+        _define_property(this, "refreshTokenSecretWarned", false);
         this.options = injectedOptions ?? {
             global: false,
             includeController: true

package/cjs/services/auth-datasource.provider.js

@@ -83,11 +83,8 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.MultiTenantDataSourceService {
-    // ==================== Override Static Cache Access Methods ====================
-    /**
-   * CRITICAL: Override to access Auth-specific static properties
-   * Without this, parent class methods would access parent's static properties
-   */ async getSingleDataSource() {
+    // Override Static Cache Access Methods
+    /** Override to access Auth-specific static properties */ async getSingleDataSource() {
         if (!AuthDataSourceProvider.singleDataSource) {
             if (AuthDataSourceProvider.singleConnectionLock) {
                 return AuthDataSourceProvider.singleConnectionLock;
@@ -95,7 +92,7 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
             const lockPromise = (async ()=>{
                 const config = this.getDefaultDatabaseConfig();
                 if (!config) {
-                    throw new Error('Default database config is not available');
+                    throw new _common.InternalServerErrorException('Default database config is not available');
                 }
                 const ds = await this.createDataSourceFromConfig(config);
                 AuthDataSourceProvider.singleDataSource = ds;
@@ -111,9 +108,7 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
         }
         return AuthDataSourceProvider.singleDataSource;
     }
-    /**
-   * CRITICAL: Override to use Auth-specific static cache for tenant connections
-   */ async getOrCreateTenantConnection(tenant) {
+    /** Override to use Auth-specific static cache for tenant connections */ async getOrCreateTenantConnection(tenant) {
         // Return existing initialized connection from Auth-specific cache
         const existing = AuthDataSourceProvider.tenantConnections.get(tenant.id);
         if (existing?.isInitialized) {
@@ -136,10 +131,8 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
             AuthDataSourceProvider.connectionLocks.delete(tenant.id);
         }
     }
-    // ==================== Factory Methods ====================
-    /**
-   * Build parent options from AuthModuleOptions
-   */ static buildParentOptions(options) {
+    // Factory Methods
+    /** Build parent options from AuthModuleOptions */ static buildParentOptions(options) {
         return {
             bootstrapAppConfig: options.bootstrapAppConfig,
             defaultDatabaseConfig: options.config?.defaultDatabaseConfig,
@@ -147,31 +140,24 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
             tenants: options.config?.tenants
         };
     }
-    // ==================== Feature Flags ====================
-    /**
-   * Get global enable company feature flag
-   */ getEnableCompanyFeature() {
+    // Feature Flags
+    /** Get global enable company feature flag */ getEnableCompanyFeature() {
         return this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
-    /**
-   * Get enable company feature for specific tenant
-   * Falls back to global setting if not specified per-tenant
-   */ getEnableCompanyFeatureForTenant(tenant) {
+    /** Get enable company feature for specific tenant. Falls back to global setting. */ getEnableCompanyFeatureForTenant(tenant) {
         return tenant?.enableCompanyFeature ?? this.getEnableCompanyFeature();
     }
-    /**
-   * Get enable company feature for current request context
-   */ getEnableCompanyFeatureForCurrentTenant() {
+    /** Get enable company feature for current request context */ getEnableCompanyFeatureForCurrentTenant() {
         return this.getEnableCompanyFeatureForTenant(this.getCurrentTenant() ?? undefined);
     }
-    // ==================== Entity Management ====================
-    /**
-   * Get auth entities based on company feature flag
-   */ async getAuthEntities(enableCompanyFeature) {
+    // Entity Management
+    /** Get auth entities based on company feature flag */ async getAuthEntities(enableCompanyFeature) {
         const enable = enableCompanyFeature ?? this.getEnableCompanyFeature();
-        const { Company, CompanyBranch, User, UserCompanyPermission } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("../entities")));
+        const { Company, CompanyBranch, User, UserCompanyPermission, UserToken, PendingRegistration } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("../entities")));
         const coreEntities = [
-            User
+            User,
+            UserToken,
+            PendingRegistration
         ];
         const companyEntities = enable ? [
             Company,
@@ -183,10 +169,8 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
             ...companyEntities
         ];
     }
-    // ==================== Overrides ====================
-    /**
-   * Override to dynamically set entities based on tenant config
-   */ async createDataSourceFromConfig(config) {
+    // Overrides
+    /** Override to dynamically set entities based on tenant config */ async createDataSourceFromConfig(config) {
         const currentTenant = this.getCurrentTenant();
         const enableCompanyFeature = this.getEnableCompanyFeatureForTenant(currentTenant ?? undefined);
         const entities = await this.getAuthEntities(enableCompanyFeature);