@flusys/nestjs-auth 1.0.0-rc → 1.0.1

package/fesm/services/auth-email.service.js

@@ -29,51 +29,73 @@ import { BadRequestException, Inject, Injectable, InternalServerErrorException,
 import * as bcrypt from 'bcrypt';
 import * as crypto from 'crypto';
 import { LessThan } from 'typeorm';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { BCRYPT_SALT_ROUNDS } from '../config';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { TokenType, UserToken } from '../entities/user-token.entity';
 import { User } from '../entities/user.entity';
 import { AUTH_EMAIL_PROVIDER, IAuthEmailProvider } from '../interfaces';
-import { BCRYPT_SALT_ROUNDS } from '../config';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class AuthEmailService {
-    async getUserRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(User);
-        }
-        throw new InternalServerErrorException('User repository not available');
-    }
-    async getUserTokenRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(UserToken);
-        }
-        throw new InternalServerErrorException('UserToken repository not available');
-    }
-    async getPendingRegistrationRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(PendingRegistration);
-        }
-        throw new InternalServerErrorException('PendingRegistration repository not available');
-    }
     isEmailEnabled() {
         return !!this.emailProvider;
     }
+    // ============================================
+    // Private Helpers
+    // ============================================
+    async getRepository(entity) {
+        if (!this.dataSourceProvider) {
+            throw new InternalServerErrorException(`${String(entity)} repository not available`);
+        }
+        return this.dataSourceProvider.getRepository(entity);
+    }
     generateToken() {
         return crypto.randomBytes(32).toString('hex');
     }
     /** Hash token for secure storage - prevents token theft if database is compromised */ hashToken(token) {
         return crypto.createHash('sha256').update(token).digest('hex');
     }
-    // ============================================
-    // Pending Registration (New Users)
-    // ============================================
-    /**
-   * Create pending registration - stores data until email verified
-   */ async createPendingRegistration(data) {
+    getErrorMessage(error) {
+        return error instanceof Error ? error.message : 'Unknown error';
+    }
+    assertEmailEnabled() {
         if (!this.emailProvider) {
             throw new BadRequestException('Email service is not configured');
         }
-        const userRepository = await this.getUserRepository();
-        const pendingRepository = await this.getPendingRegistrationRepository();
+    }
+    async sendVerificationEmailSafe(email, token, verifyUrl, logContext) {
+        try {
+            await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
+            this.logger.log(`${logContext} verification email sent to: ${email}`);
+        } catch (error) {
+            this.logger.error(`Failed to send verification email: ${this.getErrorMessage(error)}`);
+            throw new BadRequestException('Failed to send verification email. Please try again.');
+        }
+    }
+    validateTokenNotExpiredOrUsed(token, expiredMessage, usedMessage) {
+        if (token.expiresAt < new Date()) {
+            throw new BadRequestException(expiredMessage);
+        }
+        if (usedMessage && token.usedAt) {
+            throw new BadRequestException(usedMessage);
+        }
+    }
+    // ============================================
+    // Pending Registration (New Users)
+    // ============================================
+    async hasPendingRegistration(email) {
+        if (!this.isEmailEnabled()) return false;
+        const pendingRepository = await this.getRepository(PendingRegistration);
+        const pending = await pendingRepository.findOne({
+            where: {
+                email
+            }
+        });
+        return !!pending && pending.expiresAt > new Date();
+    }
+    async createPendingRegistration(data) {
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(User);
+        const pendingRepository = await this.getRepository(PendingRegistration);
         // Check if user already exists
         const existingUser = await userRepository.findOne({
             where: {
@@ -104,14 +126,7 @@ export class AuthEmailService {
         await pendingRepository.save(pending);
         // Send verification email with raw token (user receives this)
         const verifyUrl = `${data.verifyUrlBase}?token=${token}`;
-        try {
-            await this.emailProvider.sendVerificationEmail(data.email, token, verifyUrl);
-            this.logger.log(`Registration verification email sent to: ${data.email}`);
-        } catch (error) {
-            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-            this.logger.error(`Failed to send verification email: ${errorMessage}`);
-            throw new BadRequestException('Failed to send verification email. Please try again.');
-        }
+        await this.sendVerificationEmailSafe(data.email, token, verifyUrl, 'Registration');
         return {
             success: true,
             message: 'Please check your email to verify your registration.'
@@ -123,11 +138,9 @@ export class AuthEmailService {
     /**
    * Request password reset - sends reset email
    */ async forgotPassword(email, resetUrlBase) {
-        if (!this.emailProvider) {
-            throw new BadRequestException('Email service is not configured');
-        }
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(User);
+        const tokenRepository = await this.getRepository(UserToken);
         const user = await userRepository.findOne({
             where: {
                 email
@@ -162,9 +175,7 @@ export class AuthEmailService {
             await this.emailProvider.sendPasswordResetEmail(email, token, resetUrl);
             this.logger.log(`Password reset email sent to: ${email}`);
         } catch (error) {
-            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-            this.logger.error(`Failed to send password reset email: ${errorMessage}`);
-            // Don't silently fail - but still use same message to prevent enumeration
+            this.logger.error(`Failed to send password reset email: ${this.getErrorMessage(error)}`);
             throw new BadRequestException('Failed to process request. Please try again later.');
         }
         return {
@@ -175,8 +186,8 @@ export class AuthEmailService {
     /**
    * Reset password using token
    */ async resetPassword(token, newPassword) {
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        const userRepository = await this.getRepository(User);
+        const tokenRepository = await this.getRepository(UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
         const userToken = await tokenRepository.findOne({
@@ -188,15 +199,7 @@ export class AuthEmailService {
         if (!userToken) {
             throw new BadRequestException('Invalid or expired reset token');
         }
-        if (userToken.expiresAt < new Date()) {
-            await tokenRepository.delete({
-                id: userToken.id
-            });
-            throw new BadRequestException('Reset token has expired. Please request a new one.');
-        }
-        if (userToken.usedAt) {
-            throw new BadRequestException('This reset token has already been used.');
-        }
+        this.validateTokenNotExpiredOrUsed(userToken, 'Reset token has expired. Please request a new one.', 'This reset token has already been used.');
         const user = await userRepository.findOne({
             where: {
                 id: userToken.userId
@@ -224,9 +227,9 @@ export class AuthEmailService {
    * Verify email using token
    * Handles both pending registration and existing user verification
    */ async verifyEmail(token) {
-        const pendingRepository = await this.getPendingRegistrationRepository();
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        const pendingRepository = await this.getRepository(PendingRegistration);
+        const userRepository = await this.getRepository(User);
+        const tokenRepository = await this.getRepository(UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
         // Check for pending registration first
@@ -251,7 +254,7 @@ export class AuthEmailService {
                 pending
             };
         }
-        // Check for existing user email verification token (token already hashed above)
+        // Check for existing user email verification token
         const userToken = await tokenRepository.findOne({
             where: {
                 token: tokenHash,
@@ -296,12 +299,10 @@ export class AuthEmailService {
     /**
    * Resend verification email - handles both pending registrations and existing users
    */ async resendVerificationEmail(email, verifyUrlBase) {
-        if (!this.emailProvider) {
-            throw new BadRequestException('Email service is not configured');
-        }
-        const pendingRepository = await this.getPendingRegistrationRepository();
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        this.assertEmailEnabled();
+        const pendingRepository = await this.getRepository(PendingRegistration);
+        const userRepository = await this.getRepository(User);
+        const tokenRepository = await this.getRepository(UserToken);
         // Check pending registration first
         const pending = await pendingRepository.findOne({
             where: {
@@ -310,19 +311,11 @@ export class AuthEmailService {
         });
         if (pending) {
             const token = this.generateToken();
-            const tokenHash = this.hashToken(token);
-            pending.token = tokenHash; // Store hashed token
+            pending.token = this.hashToken(token);
             pending.expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
             await pendingRepository.save(pending);
             const verifyUrl = `${verifyUrlBase}?token=${token}`;
-            try {
-                await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
-                this.logger.log(`Re-sent registration verification email to: ${email}`);
-            } catch (error) {
-                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-                this.logger.error(`Failed to resend verification email: ${errorMessage}`);
-                throw new BadRequestException('Failed to send verification email. Please try again.');
-            }
+            await this.sendVerificationEmailSafe(email, token, verifyUrl, 'Re-sent registration');
             return {
                 success: true,
                 message: 'If the email requires verification, a link has been sent.'
@@ -346,23 +339,15 @@ export class AuthEmailService {
             type: TokenType.EMAIL_VERIFICATION
         });
         const token = this.generateToken();
-        const tokenHash = this.hashToken(token);
         const userToken = tokenRepository.create({
             userId: user.id,
             type: TokenType.EMAIL_VERIFICATION,
-            token: tokenHash,
+            token: this.hashToken(token),
             expiresAt: new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY)
         });
         await tokenRepository.save(userToken);
         const verifyUrl = `${verifyUrlBase}?token=${token}`;
-        try {
-            await this.emailProvider.sendVerificationEmail(user.email, token, verifyUrl);
-            this.logger.log(`Verification email sent to: ${user.email}`);
-        } catch (error) {
-            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
-            this.logger.error(`Failed to send verification email: ${errorMessage}`);
-            throw new BadRequestException('Failed to send verification email. Please try again.');
-        }
+        await this.sendVerificationEmailSafe(user.email, token, verifyUrl, 'Verification');
         return {
             success: true,
             message: 'If the email requires verification, a link has been sent.'
@@ -374,8 +359,8 @@ export class AuthEmailService {
     /**
    * Clean up expired tokens and pending registrations
    */ async cleanupExpired() {
-        const tokenRepository = await this.getUserTokenRepository();
-        const pendingRepository = await this.getPendingRegistrationRepository();
+        const tokenRepository = await this.getRepository(UserToken);
+        const pendingRepository = await this.getRepository(PendingRegistration);
         const now = new Date();
         const tokenResult = await tokenRepository.delete({
             expiresAt: LessThan(now)