@flusys/nestjs-auth 1.1.0-beta → 2.0.0-rc.0

package/cjs/services/auth-email.service.js

@@ -12,12 +12,12 @@ const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _crypto = /*#__PURE__*/ _interop_require_wildcard(require("crypto"));
 const _typeorm = require("typeorm");
-const _authdatasourceprovider = require("./auth-datasource.provider");
+const _config = require("../config");
 const _pendingregistrationentity = require("../entities/pending-registration.entity");
 const _usertokenentity = require("../entities/user-token.entity");
 const _userentity = require("../entities/user.entity");
 const _interfaces = require("../interfaces");
-const _config = require("../config");
+const _authdatasourceprovider = require("./auth-datasource.provider");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -87,41 +87,66 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthEmailService = class AuthEmailService {
-    async getUserRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(_userentity.User);
-        }
-        throw new Error('User repository not available');
+    isEmailEnabled() {
+        return !!this.emailProvider;
     }
-    async getUserTokenRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(_usertokenentity.UserToken);
+    // ============================================
+    // Private Helpers
+    // ============================================
+    async getRepository(entity) {
+        if (!this.dataSourceProvider) {
+            throw new _common.InternalServerErrorException(`${String(entity)} repository not available`);
         }
-        throw new Error('UserToken repository not available');
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    generateToken() {
+        return _crypto.randomBytes(32).toString('hex');
     }
-    async getPendingRegistrationRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(_pendingregistrationentity.PendingRegistration);
+    /** Hash token for secure storage - prevents token theft if database is compromised */ hashToken(token) {
+        return _crypto.createHash('sha256').update(token).digest('hex');
+    }
+    getErrorMessage(error) {
+        return error instanceof Error ? error.message : 'Unknown error';
+    }
+    assertEmailEnabled() {
+        if (!this.emailProvider) {
+            throw new _common.BadRequestException('Email service is not configured');
         }
-        throw new Error('PendingRegistration repository not available');
     }
-    isEmailEnabled() {
-        return !!this.emailProvider;
+    async sendVerificationEmailSafe(email, token, verifyUrl, logContext) {
+        try {
+            await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
+            this.logger.log(`${logContext} verification email sent to: ${email}`);
+        } catch (error) {
+            this.logger.error(`Failed to send verification email: ${this.getErrorMessage(error)}`);
+            throw new _common.BadRequestException('Failed to send verification email. Please try again.');
+        }
     }
-    generateToken() {
-        return _crypto.randomBytes(32).toString('hex');
+    validateTokenNotExpiredOrUsed(token, expiredMessage, usedMessage) {
+        if (token.expiresAt < new Date()) {
+            throw new _common.BadRequestException(expiredMessage);
+        }
+        if (usedMessage && token.usedAt) {
+            throw new _common.BadRequestException(usedMessage);
+        }
     }
     // ============================================
     // Pending Registration (New Users)
     // ============================================
-    /**
-   * Create pending registration - stores data until email verified
-   */ async createPendingRegistration(data) {
-        if (!this.emailProvider) {
-            throw new _common.BadRequestException('Email service is not configured');
-        }
-        const userRepository = await this.getUserRepository();
-        const pendingRepository = await this.getPendingRegistrationRepository();
+    async hasPendingRegistration(email) {
+        if (!this.isEmailEnabled()) return false;
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
+        const pending = await pendingRepository.findOne({
+            where: {
+                email
+            }
+        });
+        return !!pending && pending.expiresAt > new Date();
+    }
+    async createPendingRegistration(data) {
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(_userentity.User);
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
         // Check if user already exists
         const existingUser = await userRepository.findOne({
             where: {
@@ -135,8 +160,9 @@ let AuthEmailService = class AuthEmailService {
         await pendingRepository.delete({
             email: data.email
         });
-        // Create pending registration
+        // Create pending registration with hashed token for secure storage
         const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
         const passwordHash = await _bcrypt.hash(data.password, _config.BCRYPT_SALT_ROUNDS);
         const expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
         const pending = pendingRepository.create({
@@ -144,20 +170,14 @@ let AuthEmailService = class AuthEmailService {
             name: data.name ?? null,
             phone: data.phone ?? null,
             passwordHash,
-            token,
+            token: tokenHash,
             expiresAt,
             companyData: data.companyData ?? null
         });
         await pendingRepository.save(pending);
-        // Send verification email
+        // Send verification email with raw token (user receives this)
         const verifyUrl = `${data.verifyUrlBase}?token=${token}`;
-        try {
-            await this.emailProvider.sendVerificationEmail(data.email, token, verifyUrl);
-            this.logger.log(`Registration verification email sent to: ${data.email}`);
-        } catch (error) {
-            this.logger.error(`Failed to send verification email: ${error.message}`);
-            throw new _common.BadRequestException('Failed to send verification email. Please try again.');
-        }
+        await this.sendVerificationEmailSafe(data.email, token, verifyUrl, 'Registration');
         return {
             success: true,
             message: 'Please check your email to verify your registration.'
@@ -169,11 +189,9 @@ let AuthEmailService = class AuthEmailService {
     /**
    * Request password reset - sends reset email
    */ async forgotPassword(email, resetUrlBase) {
-        if (!this.emailProvider) {
-            throw new _common.BadRequestException('Email service is not configured');
-        }
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(_userentity.User);
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         const user = await userRepository.findOne({
             where: {
                 email
@@ -192,22 +210,24 @@ let AuthEmailService = class AuthEmailService {
             userId: user.id,
             type: _usertokenentity.TokenType.PASSWORD_RESET
         });
-        // Create new token
+        // Create new token with hashed storage
         const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
         const userToken = tokenRepository.create({
             userId: user.id,
             type: _usertokenentity.TokenType.PASSWORD_RESET,
-            token,
+            token: tokenHash,
             expiresAt: new Date(Date.now() + this.PASSWORD_RESET_EXPIRY)
         });
         await tokenRepository.save(userToken);
-        // Send email
+        // Send email with raw token
         const resetUrl = `${resetUrlBase}?token=${token}`;
         try {
             await this.emailProvider.sendPasswordResetEmail(email, token, resetUrl);
             this.logger.log(`Password reset email sent to: ${email}`);
         } catch (error) {
-            this.logger.error(`Failed to send password reset email: ${error.message}`);
+            this.logger.error(`Failed to send password reset email: ${this.getErrorMessage(error)}`);
+            throw new _common.BadRequestException('Failed to process request. Please try again later.');
         }
         return {
             success: true,
@@ -217,26 +237,20 @@ let AuthEmailService = class AuthEmailService {
     /**
    * Reset password using token
    */ async resetPassword(token, newPassword) {
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        const userRepository = await this.getRepository(_userentity.User);
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
+        // Hash the incoming token to compare with stored hash
+        const tokenHash = this.hashToken(token);
         const userToken = await tokenRepository.findOne({
             where: {
-                token,
+                token: tokenHash,
                 type: _usertokenentity.TokenType.PASSWORD_RESET
             }
         });
         if (!userToken) {
             throw new _common.BadRequestException('Invalid or expired reset token');
         }
-        if (userToken.expiresAt < new Date()) {
-            await tokenRepository.delete({
-                id: userToken.id
-            });
-            throw new _common.BadRequestException('Reset token has expired. Please request a new one.');
-        }
-        if (userToken.usedAt) {
-            throw new _common.BadRequestException('This reset token has already been used.');
-        }
+        this.validateTokenNotExpiredOrUsed(userToken, 'Reset token has expired. Please request a new one.', 'This reset token has already been used.');
         const user = await userRepository.findOne({
             where: {
                 id: userToken.userId
@@ -264,13 +278,15 @@ let AuthEmailService = class AuthEmailService {
    * Verify email using token
    * Handles both pending registration and existing user verification
    */ async verifyEmail(token) {
-        const pendingRepository = await this.getPendingRegistrationRepository();
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
+        const userRepository = await this.getRepository(_userentity.User);
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
+        // Hash the incoming token to compare with stored hash
+        const tokenHash = this.hashToken(token);
         // Check for pending registration first
         const pending = await pendingRepository.findOne({
             where: {
-                token
+                token: tokenHash
             }
         });
         if (pending) {
@@ -292,7 +308,7 @@ let AuthEmailService = class AuthEmailService {
         // Check for existing user email verification token
         const userToken = await tokenRepository.findOne({
             where: {
-                token,
+                token: tokenHash,
                 type: _usertokenentity.TokenType.EMAIL_VERIFICATION
             }
         });
@@ -334,12 +350,10 @@ let AuthEmailService = class AuthEmailService {
     /**
    * Resend verification email - handles both pending registrations and existing users
    */ async resendVerificationEmail(email, verifyUrlBase) {
-        if (!this.emailProvider) {
-            throw new _common.BadRequestException('Email service is not configured');
-        }
-        const pendingRepository = await this.getPendingRegistrationRepository();
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        this.assertEmailEnabled();
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
+        const userRepository = await this.getRepository(_userentity.User);
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         // Check pending registration first
         const pending = await pendingRepository.findOne({
             where: {
@@ -348,16 +362,11 @@ let AuthEmailService = class AuthEmailService {
         });
         if (pending) {
             const token = this.generateToken();
-            pending.token = token;
+            pending.token = this.hashToken(token);
             pending.expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
             await pendingRepository.save(pending);
             const verifyUrl = `${verifyUrlBase}?token=${token}`;
-            try {
-                await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
-                this.logger.log(`Re-sent registration verification email to: ${email}`);
-            } catch (error) {
-                this.logger.error(`Failed to resend verification email: ${error.message}`);
-            }
+            await this.sendVerificationEmailSafe(email, token, verifyUrl, 'Re-sent registration');
             return {
                 success: true,
                 message: 'If the email requires verification, a link has been sent.'
@@ -384,17 +393,12 @@ let AuthEmailService = class AuthEmailService {
         const userToken = tokenRepository.create({
             userId: user.id,
             type: _usertokenentity.TokenType.EMAIL_VERIFICATION,
-            token,
+            token: this.hashToken(token),
             expiresAt: new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY)
         });
         await tokenRepository.save(userToken);
         const verifyUrl = `${verifyUrlBase}?token=${token}`;
-        try {
-            await this.emailProvider.sendVerificationEmail(user.email, token, verifyUrl);
-            this.logger.log(`Verification email sent to: ${user.email}`);
-        } catch (error) {
-            this.logger.error(`Failed to send verification email: ${error.message}`);
-        }
+        await this.sendVerificationEmailSafe(user.email, token, verifyUrl, 'Verification');
         return {
             success: true,
             message: 'If the email requires verification, a link has been sent.'
@@ -406,8 +410,8 @@ let AuthEmailService = class AuthEmailService {
     /**
    * Clean up expired tokens and pending registrations
    */ async cleanupExpired() {
-        const tokenRepository = await this.getUserTokenRepository();
-        const pendingRepository = await this.getPendingRegistrationRepository();
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
         const now = new Date();
         const tokenResult = await tokenRepository.delete({
             expiresAt: (0, _typeorm.LessThan)(now)