@flusys/nestjs-auth 1.0.0-beta → 1.1.0-beta

package/fesm/services/auth-email.service.js

@@ -0,0 +1,401 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+import { BadRequestException, Inject, Injectable, Logger, Optional, Scope } from '@nestjs/common';
+import * as bcrypt from 'bcrypt';
+import * as crypto from 'crypto';
+import { LessThan } from 'typeorm';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { PendingRegistration } from '../entities/pending-registration.entity';
+import { TokenType, UserToken } from '../entities/user-token.entity';
+import { User } from '../entities/user.entity';
+import { AUTH_EMAIL_PROVIDER, IAuthEmailProvider } from '../interfaces';
+import { BCRYPT_SALT_ROUNDS } from '../config';
+export class AuthEmailService {
+    async getUserRepository() {
+        if (this.dataSourceProvider) {
+            return this.dataSourceProvider.getRepository(User);
+        }
+        throw new Error('User repository not available');
+    }
+    async getUserTokenRepository() {
+        if (this.dataSourceProvider) {
+            return this.dataSourceProvider.getRepository(UserToken);
+        }
+        throw new Error('UserToken repository not available');
+    }
+    async getPendingRegistrationRepository() {
+        if (this.dataSourceProvider) {
+            return this.dataSourceProvider.getRepository(PendingRegistration);
+        }
+        throw new Error('PendingRegistration repository not available');
+    }
+    isEmailEnabled() {
+        return !!this.emailProvider;
+    }
+    generateToken() {
+        return crypto.randomBytes(32).toString('hex');
+    }
+    // ============================================
+    // Pending Registration (New Users)
+    // ============================================
+    /**
+   * Create pending registration - stores data until email verified
+   */ async createPendingRegistration(data) {
+        if (!this.emailProvider) {
+            throw new BadRequestException('Email service is not configured');
+        }
+        const userRepository = await this.getUserRepository();
+        const pendingRepository = await this.getPendingRegistrationRepository();
+        // Check if user already exists
+        const existingUser = await userRepository.findOne({
+            where: {
+                email: data.email
+            }
+        });
+        if (existingUser) {
+            throw new BadRequestException('Registration failed. Please try again or contact support.');
+        }
+        // Delete any existing pending registration for this email
+        await pendingRepository.delete({
+            email: data.email
+        });
+        // Create pending registration
+        const token = this.generateToken();
+        const passwordHash = await bcrypt.hash(data.password, BCRYPT_SALT_ROUNDS);
+        const expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
+        const pending = pendingRepository.create({
+            email: data.email,
+            name: data.name ?? null,
+            phone: data.phone ?? null,
+            passwordHash,
+            token,
+            expiresAt,
+            companyData: data.companyData ?? null
+        });
+        await pendingRepository.save(pending);
+        // Send verification email
+        const verifyUrl = `${data.verifyUrlBase}?token=${token}`;
+        try {
+            await this.emailProvider.sendVerificationEmail(data.email, token, verifyUrl);
+            this.logger.log(`Registration verification email sent to: ${data.email}`);
+        } catch (error) {
+            this.logger.error(`Failed to send verification email: ${error.message}`);
+            throw new BadRequestException('Failed to send verification email. Please try again.');
+        }
+        return {
+            success: true,
+            message: 'Please check your email to verify your registration.'
+        };
+    }
+    // ============================================
+    // Password Reset (Existing Users)
+    // ============================================
+    /**
+   * Request password reset - sends reset email
+   */ async forgotPassword(email, resetUrlBase) {
+        if (!this.emailProvider) {
+            throw new BadRequestException('Email service is not configured');
+        }
+        const userRepository = await this.getUserRepository();
+        const tokenRepository = await this.getUserTokenRepository();
+        const user = await userRepository.findOne({
+            where: {
+                email
+            }
+        });
+        // Always return success to prevent email enumeration
+        if (!user || !user.isActive) {
+            this.logger.warn(`Password reset requested for non-existent/inactive email: ${email}`);
+            return {
+                success: true,
+                message: 'If the email exists, a password reset link has been sent.'
+            };
+        }
+        // Invalidate existing password reset tokens for this user
+        await tokenRepository.delete({
+            userId: user.id,
+            type: TokenType.PASSWORD_RESET
+        });
+        // Create new token
+        const token = this.generateToken();
+        const userToken = tokenRepository.create({
+            userId: user.id,
+            type: TokenType.PASSWORD_RESET,
+            token,
+            expiresAt: new Date(Date.now() + this.PASSWORD_RESET_EXPIRY)
+        });
+        await tokenRepository.save(userToken);
+        // Send email
+        const resetUrl = `${resetUrlBase}?token=${token}`;
+        try {
+            await this.emailProvider.sendPasswordResetEmail(email, token, resetUrl);
+            this.logger.log(`Password reset email sent to: ${email}`);
+        } catch (error) {
+            this.logger.error(`Failed to send password reset email: ${error.message}`);
+        }
+        return {
+            success: true,
+            message: 'If the email exists, a password reset link has been sent.'
+        };
+    }
+    /**
+   * Reset password using token
+   */ async resetPassword(token, newPassword) {
+        const userRepository = await this.getUserRepository();
+        const tokenRepository = await this.getUserTokenRepository();
+        const userToken = await tokenRepository.findOne({
+            where: {
+                token,
+                type: TokenType.PASSWORD_RESET
+            }
+        });
+        if (!userToken) {
+            throw new BadRequestException('Invalid or expired reset token');
+        }
+        if (userToken.expiresAt < new Date()) {
+            await tokenRepository.delete({
+                id: userToken.id
+            });
+            throw new BadRequestException('Reset token has expired. Please request a new one.');
+        }
+        if (userToken.usedAt) {
+            throw new BadRequestException('This reset token has already been used.');
+        }
+        const user = await userRepository.findOne({
+            where: {
+                id: userToken.userId
+            }
+        });
+        if (!user) {
+            throw new BadRequestException('User not found');
+        }
+        // Update password
+        user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
+        await userRepository.save(user);
+        // Mark token as used
+        userToken.usedAt = new Date();
+        await tokenRepository.save(userToken);
+        this.logger.log(`Password reset successful for user: ${user.email}`);
+        return {
+            success: true,
+            message: 'Password has been reset successfully.'
+        };
+    }
+    // ============================================
+    // Email Verification
+    // ============================================
+    /**
+   * Verify email using token
+   * Handles both pending registration and existing user verification
+   */ async verifyEmail(token) {
+        const pendingRepository = await this.getPendingRegistrationRepository();
+        const userRepository = await this.getUserRepository();
+        const tokenRepository = await this.getUserTokenRepository();
+        // Check for pending registration first
+        const pending = await pendingRepository.findOne({
+            where: {
+                token
+            }
+        });
+        if (pending) {
+            if (pending.expiresAt < new Date()) {
+                await pendingRepository.delete({
+                    id: pending.id
+                });
+                throw new BadRequestException('Verification token has expired. Please register again.');
+            }
+            // Delete pending registration (will be consumed by caller to create user)
+            await pendingRepository.delete({
+                id: pending.id
+            });
+            return {
+                type: 'pending',
+                pending
+            };
+        }
+        // Check for existing user email verification token
+        const userToken = await tokenRepository.findOne({
+            where: {
+                token,
+                type: TokenType.EMAIL_VERIFICATION
+            }
+        });
+        if (!userToken) {
+            throw new BadRequestException('Invalid or expired verification token');
+        }
+        if (userToken.expiresAt < new Date()) {
+            await tokenRepository.delete({
+                id: userToken.id
+            });
+            throw new BadRequestException('Verification token has expired. Please request a new one.');
+        }
+        if (userToken.usedAt) {
+            return {
+                type: 'verified',
+                message: 'Email has already been verified.'
+            };
+        }
+        const user = await userRepository.findOne({
+            where: {
+                id: userToken.userId
+            }
+        });
+        if (!user) {
+            throw new BadRequestException('User not found');
+        }
+        // Mark email as verified
+        user.emailVerified = true;
+        await userRepository.save(user);
+        // Mark token as used
+        userToken.usedAt = new Date();
+        await tokenRepository.save(userToken);
+        this.logger.log(`Email verified for user: ${user.email}`);
+        return {
+            type: 'verified',
+            message: 'Email has been verified successfully.'
+        };
+    }
+    /**
+   * Resend verification email - handles both pending registrations and existing users
+   */ async resendVerificationEmail(email, verifyUrlBase) {
+        if (!this.emailProvider) {
+            throw new BadRequestException('Email service is not configured');
+        }
+        const pendingRepository = await this.getPendingRegistrationRepository();
+        const userRepository = await this.getUserRepository();
+        const tokenRepository = await this.getUserTokenRepository();
+        // Check pending registration first
+        const pending = await pendingRepository.findOne({
+            where: {
+                email
+            }
+        });
+        if (pending) {
+            const token = this.generateToken();
+            pending.token = token;
+            pending.expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
+            await pendingRepository.save(pending);
+            const verifyUrl = `${verifyUrlBase}?token=${token}`;
+            try {
+                await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
+                this.logger.log(`Re-sent registration verification email to: ${email}`);
+            } catch (error) {
+                this.logger.error(`Failed to resend verification email: ${error.message}`);
+            }
+            return {
+                success: true,
+                message: 'If the email requires verification, a link has been sent.'
+            };
+        }
+        // Check existing user
+        const user = await userRepository.findOne({
+            where: {
+                email
+            }
+        });
+        if (!user || user.emailVerified) {
+            return {
+                success: true,
+                message: 'If the email requires verification, a link has been sent.'
+            };
+        }
+        // Invalidate existing tokens and create new one
+        await tokenRepository.delete({
+            userId: user.id,
+            type: TokenType.EMAIL_VERIFICATION
+        });
+        const token = this.generateToken();
+        const userToken = tokenRepository.create({
+            userId: user.id,
+            type: TokenType.EMAIL_VERIFICATION,
+            token,
+            expiresAt: new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY)
+        });
+        await tokenRepository.save(userToken);
+        const verifyUrl = `${verifyUrlBase}?token=${token}`;
+        try {
+            await this.emailProvider.sendVerificationEmail(user.email, token, verifyUrl);
+            this.logger.log(`Verification email sent to: ${user.email}`);
+        } catch (error) {
+            this.logger.error(`Failed to send verification email: ${error.message}`);
+        }
+        return {
+            success: true,
+            message: 'If the email requires verification, a link has been sent.'
+        };
+    }
+    // ============================================
+    // Cleanup
+    // ============================================
+    /**
+   * Clean up expired tokens and pending registrations
+   */ async cleanupExpired() {
+        const tokenRepository = await this.getUserTokenRepository();
+        const pendingRepository = await this.getPendingRegistrationRepository();
+        const now = new Date();
+        const tokenResult = await tokenRepository.delete({
+            expiresAt: LessThan(now)
+        });
+        const pendingResult = await pendingRepository.delete({
+            expiresAt: LessThan(now)
+        });
+        const deletedTokens = tokenResult.affected ?? 0;
+        const deletedPending = pendingResult.affected ?? 0;
+        this.logger.log(`Cleaned up ${deletedTokens} expired tokens and ${deletedPending} expired pending registrations`);
+        return {
+            deletedTokens,
+            deletedPending
+        };
+    }
+    constructor(dataSourceProvider, emailProvider){
+        _define_property(this, "dataSourceProvider", void 0);
+        _define_property(this, "emailProvider", void 0);
+        _define_property(this, "logger", void 0);
+        _define_property(this, "PASSWORD_RESET_EXPIRY", void 0); // 1 hour
+        _define_property(this, "EMAIL_VERIFICATION_EXPIRY", void 0); // 24 hours
+        this.dataSourceProvider = dataSourceProvider;
+        this.emailProvider = emailProvider;
+        this.logger = new Logger(AuthEmailService.name);
+        this.PASSWORD_RESET_EXPIRY = 60 * 60 * 1000;
+        this.EMAIL_VERIFICATION_EXPIRY = 24 * 60 * 60 * 1000;
+    }
+}
+AuthEmailService = _ts_decorate([
+    Injectable({
+        scope: Scope.REQUEST
+    }),
+    _ts_param(0, Optional()),
+    _ts_param(0, Inject(AuthDataSourceProvider)),
+    _ts_param(1, Optional()),
+    _ts_param(1, Inject(AUTH_EMAIL_PROVIDER)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
+        typeof IAuthEmailProvider === "undefined" ? Object : IAuthEmailProvider
+    ])
+], AuthEmailService);