@flusys/nestjs-auth 1.1.0-beta → 2.0.0

package/fesm/services/auth-email.service.js

@@ -25,52 +25,77 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { BadRequestException, Inject, Injectable, Logger, Optional, Scope } from '@nestjs/common';
+import { BadRequestException, Inject, Injectable, InternalServerErrorException, Logger, Optional, Scope } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import * as crypto from 'crypto';
 import { LessThan } from 'typeorm';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { BCRYPT_SALT_ROUNDS } from '../config';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { TokenType, UserToken } from '../entities/user-token.entity';
 import { User } from '../entities/user.entity';
 import { AUTH_EMAIL_PROVIDER, IAuthEmailProvider } from '../interfaces';
-import { BCRYPT_SALT_ROUNDS } from '../config';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class AuthEmailService {
-    async getUserRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(User);
-        }
-        throw new Error('User repository not available');
+    isEmailEnabled() {
+        return !!this.emailProvider;
     }
-    async getUserTokenRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(UserToken);
+    // ============================================
+    // Private Helpers
+    // ============================================
+    async getRepository(entity) {
+        if (!this.dataSourceProvider) {
+            throw new InternalServerErrorException(`${String(entity)} repository not available`);
         }
-        throw new Error('UserToken repository not available');
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    generateToken() {
+        return crypto.randomBytes(32).toString('hex');
     }
-    async getPendingRegistrationRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(PendingRegistration);
+    /** Hash token for secure storage - prevents token theft if database is compromised */ hashToken(token) {
+        return crypto.createHash('sha256').update(token).digest('hex');
+    }
+    getErrorMessage(error) {
+        return error instanceof Error ? error.message : 'Unknown error';
+    }
+    assertEmailEnabled() {
+        if (!this.emailProvider) {
+            throw new BadRequestException('Email service is not configured');
         }
-        throw new Error('PendingRegistration repository not available');
     }
-    isEmailEnabled() {
-        return !!this.emailProvider;
+    async sendVerificationEmailSafe(email, token, verifyUrl, logContext) {
+        try {
+            await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
+            this.logger.log(`${logContext} verification email sent to: ${email}`);
+        } catch (error) {
+            this.logger.error(`Failed to send verification email: ${this.getErrorMessage(error)}`);
+            throw new BadRequestException('Failed to send verification email. Please try again.');
+        }
     }
-    generateToken() {
-        return crypto.randomBytes(32).toString('hex');
+    validateTokenNotExpiredOrUsed(token, expiredMessage, usedMessage) {
+        if (token.expiresAt < new Date()) {
+            throw new BadRequestException(expiredMessage);
+        }
+        if (usedMessage && token.usedAt) {
+            throw new BadRequestException(usedMessage);
+        }
     }
     // ============================================
     // Pending Registration (New Users)
     // ============================================
-    /**
-   * Create pending registration - stores data until email verified
-   */ async createPendingRegistration(data) {
-        if (!this.emailProvider) {
-            throw new BadRequestException('Email service is not configured');
-        }
-        const userRepository = await this.getUserRepository();
-        const pendingRepository = await this.getPendingRegistrationRepository();
+    async hasPendingRegistration(email) {
+        if (!this.isEmailEnabled()) return false;
+        const pendingRepository = await this.getRepository(PendingRegistration);
+        const pending = await pendingRepository.findOne({
+            where: {
+                email
+            }
+        });
+        return !!pending && pending.expiresAt > new Date();
+    }
+    async createPendingRegistration(data) {
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(User);
+        const pendingRepository = await this.getRepository(PendingRegistration);
         // Check if user already exists
         const existingUser = await userRepository.findOne({
             where: {
@@ -84,8 +109,9 @@ export class AuthEmailService {
         await pendingRepository.delete({
             email: data.email
         });
-        // Create pending registration
+        // Create pending registration with hashed token for secure storage
         const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
         const passwordHash = await bcrypt.hash(data.password, BCRYPT_SALT_ROUNDS);
         const expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
         const pending = pendingRepository.create({
@@ -93,20 +119,14 @@ export class AuthEmailService {
             name: data.name ?? null,
             phone: data.phone ?? null,
             passwordHash,
-            token,
+            token: tokenHash,
             expiresAt,
             companyData: data.companyData ?? null
         });
         await pendingRepository.save(pending);
-        // Send verification email
+        // Send verification email with raw token (user receives this)
         const verifyUrl = `${data.verifyUrlBase}?token=${token}`;
-        try {
-            await this.emailProvider.sendVerificationEmail(data.email, token, verifyUrl);
-            this.logger.log(`Registration verification email sent to: ${data.email}`);
-        } catch (error) {
-            this.logger.error(`Failed to send verification email: ${error.message}`);
-            throw new BadRequestException('Failed to send verification email. Please try again.');
-        }
+        await this.sendVerificationEmailSafe(data.email, token, verifyUrl, 'Registration');
         return {
             success: true,
             message: 'Please check your email to verify your registration.'
@@ -118,11 +138,9 @@ export class AuthEmailService {
     /**
    * Request password reset - sends reset email
    */ async forgotPassword(email, resetUrlBase) {
-        if (!this.emailProvider) {
-            throw new BadRequestException('Email service is not configured');
-        }
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(User);
+        const tokenRepository = await this.getRepository(UserToken);
         const user = await userRepository.findOne({
             where: {
                 email
@@ -141,22 +159,24 @@ export class AuthEmailService {
             userId: user.id,
             type: TokenType.PASSWORD_RESET
         });
-        // Create new token
+        // Create new token with hashed storage
         const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
         const userToken = tokenRepository.create({
             userId: user.id,
             type: TokenType.PASSWORD_RESET,
-            token,
+            token: tokenHash,
             expiresAt: new Date(Date.now() + this.PASSWORD_RESET_EXPIRY)
         });
         await tokenRepository.save(userToken);
-        // Send email
+        // Send email with raw token
         const resetUrl = `${resetUrlBase}?token=${token}`;
         try {
             await this.emailProvider.sendPasswordResetEmail(email, token, resetUrl);
             this.logger.log(`Password reset email sent to: ${email}`);
         } catch (error) {
-            this.logger.error(`Failed to send password reset email: ${error.message}`);
+            this.logger.error(`Failed to send password reset email: ${this.getErrorMessage(error)}`);
+            throw new BadRequestException('Failed to process request. Please try again later.');
         }
         return {
             success: true,
@@ -166,26 +186,20 @@ export class AuthEmailService {
     /**
    * Reset password using token
    */ async resetPassword(token, newPassword) {
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        const userRepository = await this.getRepository(User);
+        const tokenRepository = await this.getRepository(UserToken);
+        // Hash the incoming token to compare with stored hash
+        const tokenHash = this.hashToken(token);
         const userToken = await tokenRepository.findOne({
             where: {
-                token,
+                token: tokenHash,
                 type: TokenType.PASSWORD_RESET
             }
         });
         if (!userToken) {
             throw new BadRequestException('Invalid or expired reset token');
         }
-        if (userToken.expiresAt < new Date()) {
-            await tokenRepository.delete({
-                id: userToken.id
-            });
-            throw new BadRequestException('Reset token has expired. Please request a new one.');
-        }
-        if (userToken.usedAt) {
-            throw new BadRequestException('This reset token has already been used.');
-        }
+        this.validateTokenNotExpiredOrUsed(userToken, 'Reset token has expired. Please request a new one.', 'This reset token has already been used.');
         const user = await userRepository.findOne({
             where: {
                 id: userToken.userId
@@ -213,13 +227,15 @@ export class AuthEmailService {
    * Verify email using token
    * Handles both pending registration and existing user verification
    */ async verifyEmail(token) {
-        const pendingRepository = await this.getPendingRegistrationRepository();
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        const pendingRepository = await this.getRepository(PendingRegistration);
+        const userRepository = await this.getRepository(User);
+        const tokenRepository = await this.getRepository(UserToken);
+        // Hash the incoming token to compare with stored hash
+        const tokenHash = this.hashToken(token);
         // Check for pending registration first
         const pending = await pendingRepository.findOne({
             where: {
-                token
+                token: tokenHash
             }
         });
         if (pending) {
@@ -241,7 +257,7 @@ export class AuthEmailService {
         // Check for existing user email verification token
         const userToken = await tokenRepository.findOne({
             where: {
-                token,
+                token: tokenHash,
                 type: TokenType.EMAIL_VERIFICATION
             }
         });
@@ -283,12 +299,10 @@ export class AuthEmailService {
     /**
    * Resend verification email - handles both pending registrations and existing users
    */ async resendVerificationEmail(email, verifyUrlBase) {
-        if (!this.emailProvider) {
-            throw new BadRequestException('Email service is not configured');
-        }
-        const pendingRepository = await this.getPendingRegistrationRepository();
-        const userRepository = await this.getUserRepository();
-        const tokenRepository = await this.getUserTokenRepository();
+        this.assertEmailEnabled();
+        const pendingRepository = await this.getRepository(PendingRegistration);
+        const userRepository = await this.getRepository(User);
+        const tokenRepository = await this.getRepository(UserToken);
         // Check pending registration first
         const pending = await pendingRepository.findOne({
             where: {
@@ -297,16 +311,11 @@ export class AuthEmailService {
         });
         if (pending) {
             const token = this.generateToken();
-            pending.token = token;
+            pending.token = this.hashToken(token);
             pending.expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
             await pendingRepository.save(pending);
             const verifyUrl = `${verifyUrlBase}?token=${token}`;
-            try {
-                await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
-                this.logger.log(`Re-sent registration verification email to: ${email}`);
-            } catch (error) {
-                this.logger.error(`Failed to resend verification email: ${error.message}`);
-            }
+            await this.sendVerificationEmailSafe(email, token, verifyUrl, 'Re-sent registration');
             return {
                 success: true,
                 message: 'If the email requires verification, a link has been sent.'
@@ -333,17 +342,12 @@ export class AuthEmailService {
         const userToken = tokenRepository.create({
             userId: user.id,
             type: TokenType.EMAIL_VERIFICATION,
-            token,
+            token: this.hashToken(token),
             expiresAt: new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY)
         });
         await tokenRepository.save(userToken);
         const verifyUrl = `${verifyUrlBase}?token=${token}`;
-        try {
-            await this.emailProvider.sendVerificationEmail(user.email, token, verifyUrl);
-            this.logger.log(`Verification email sent to: ${user.email}`);
-        } catch (error) {
-            this.logger.error(`Failed to send verification email: ${error.message}`);
-        }
+        await this.sendVerificationEmailSafe(user.email, token, verifyUrl, 'Verification');
         return {
             success: true,
             message: 'If the email requires verification, a link has been sent.'
@@ -355,8 +359,8 @@ export class AuthEmailService {
     /**
    * Clean up expired tokens and pending registrations
    */ async cleanupExpired() {
-        const tokenRepository = await this.getUserTokenRepository();
-        const pendingRepository = await this.getPendingRegistrationRepository();
+        const tokenRepository = await this.getRepository(UserToken);
+        const pendingRepository = await this.getRepository(PendingRegistration);
         const now = new Date();
         const tokenResult = await tokenRepository.delete({
             expiresAt: LessThan(now)