@flusys/nestjs-auth 7.0.1 → 7.1.0

package/cjs/services/social-auth.service.spec.js

@@ -0,0 +1,310 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _common = require("@nestjs/common");
+const _appuserentity = require("../entities/app-user.entity");
+const _socialauthconfigentity = require("../entities/social-auth-config.entity");
+const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
+const _socialproviderregistry = /*#__PURE__*/ _interop_require_wildcard(require("../providers/social-provider.registry"));
+const _socialauthservice = require("./social-auth.service");
+function _getRequireWildcardCache(nodeInterop) {
+    if (typeof WeakMap !== "function") return null;
+    var cacheBabelInterop = new WeakMap();
+    var cacheNodeInterop = new WeakMap();
+    return (_getRequireWildcardCache = function(nodeInterop) {
+        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
+    })(nodeInterop);
+}
+function _interop_require_wildcard(obj, nodeInterop) {
+    if (!nodeInterop && obj && obj.__esModule) {
+        return obj;
+    }
+    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
+        return {
+            default: obj
+        };
+    }
+    var cache = _getRequireWildcardCache(nodeInterop);
+    if (cache && cache.has(obj)) {
+        return cache.get(obj);
+    }
+    var newObj = {
+        __proto__: null
+    };
+    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
+    for(var key in obj){
+        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
+            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
+            if (desc && (desc.get || desc.set)) {
+                Object.defineProperty(newObj, key, desc);
+            } else {
+                newObj[key] = obj[key];
+            }
+        }
+    }
+    newObj.default = obj;
+    if (cache) {
+        cache.set(obj, newObj);
+    }
+    return newObj;
+}
+const REDIRECT_URI = 'http://localhost:2001/auth/social/callback';
+function buildConfig(overrides = {}) {
+    return {
+        id: 'config-1',
+        provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
+        isEnabled: true,
+        clientId: 'client-id',
+        clientSecret: 'client-secret',
+        scopes: null,
+        extraConfig: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+function buildProfile(overrides = {}) {
+    return {
+        providerUserId: 'google-user-1',
+        email: 'user@example.com',
+        emailVerified: true,
+        name: 'Test User',
+        avatarUrl: null,
+        ...overrides
+    };
+}
+function buildUser(overrides = {}) {
+    return {
+        id: 'user-1',
+        email: 'user@example.com',
+        isActive: true,
+        ...overrides
+    };
+}
+describe('SocialAuthService', ()=>{
+    let configRepo;
+    let userRepo;
+    let cache;
+    let authService;
+    let fetchProfile;
+    let buildAuthorizationUrl;
+    let signUpEnabled;
+    let companyFeatureEnabled;
+    function buildService() {
+        const dataSourceProvider = {
+            getRepository: jest.fn().mockImplementation(async (entity)=>{
+                if (entity === _socialauthconfigentity.SocialAuthConfig) return configRepo;
+                if (entity === _appuserentity.AppUser) return userRepo;
+                throw new Error(`Unexpected entity: ${String(entity)}`);
+            }),
+            isSignUpEnabled: ()=>signUpEnabled,
+            isCompanyFeatureEnabled: ()=>companyFeatureEnabled
+        };
+        return new _socialauthservice.SocialAuthService(authService, dataSourceProvider, cache);
+    }
+    beforeEach(()=>{
+        signUpEnabled = true;
+        companyFeatureEnabled = false;
+        configRepo = (0, _repositorymock.createMockRepository)();
+        userRepo = (0, _repositorymock.createMockRepository)();
+        cache = {
+            get: jest.fn(),
+            set: jest.fn(),
+            del: jest.fn()
+        };
+        authService = {
+            issueLoginForUser: jest.fn().mockResolvedValue({
+                accessToken: 'access-token'
+            })
+        };
+        fetchProfile = jest.fn().mockResolvedValue(buildProfile());
+        buildAuthorizationUrl = jest.fn().mockReturnValue('https://provider.test/consent');
+        jest.spyOn(_socialproviderregistry, 'getSocialProvider').mockReturnValue({
+            provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
+            defaultScopes: [
+                'openid'
+            ],
+            buildAuthorizationUrl,
+            fetchProfile
+        });
+        userRepo.create.mockImplementation((data)=>({
+                ...data
+            }));
+        userRepo.save.mockImplementation(async (entity)=>({
+                id: 'new-user',
+                ...entity
+            }));
+    });
+    afterEach(()=>jest.restoreAllMocks());
+    describe('listEnabledProviders', ()=>{
+        it('drops enabled providers that have no credentials yet', async ()=>{
+            configRepo.find.mockResolvedValue([
+                buildConfig(),
+                buildConfig({
+                    id: 'config-2',
+                    provider: _socialprovidertypeenum.SocialProviderTypeEnum.FACEBOOK,
+                    clientSecret: null
+                })
+            ]);
+            const providers = await buildService().listEnabledProviders(REDIRECT_URI);
+            expect(providers).toEqual([
+                {
+                    provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
+                    redirectUri: REDIRECT_URI
+                }
+            ]);
+        });
+    });
+    describe('createAuthorization', ()=>{
+        it('caches the state and returns the provider consent URL', async ()=>{
+            configRepo.findOne.mockResolvedValue(buildConfig());
+            const result = await buildService().createAuthorization(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE, REDIRECT_URI);
+            expect(result.authorizationUrl).toBe('https://provider.test/consent');
+            expect(cache.set).toHaveBeenCalledWith(`auth:social:state:${result.state}`, {
+                provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
+                redirectUri: REDIRECT_URI
+            }, 10 * 60 * 1000);
+        });
+        it('rejects a provider that is configured but switched off', async ()=>{
+            configRepo.findOne.mockResolvedValue(buildConfig({
+                isEnabled: false
+            }));
+            await expect(buildService().createAuthorization(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE, REDIRECT_URI)).rejects.toThrow(_common.BadRequestException);
+        });
+        it('rejects a provider that is switched on but has no credentials', async ()=>{
+            configRepo.findOne.mockResolvedValue(buildConfig({
+                clientId: null
+            }));
+            await expect(buildService().createAuthorization(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE, REDIRECT_URI)).rejects.toThrow(_common.BadRequestException);
+        });
+    });
+    describe('completeLogin', ()=>{
+        beforeEach(()=>{
+            cache.get.mockResolvedValue({
+                provider: _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE,
+                redirectUri: REDIRECT_URI
+            });
+            configRepo.findOne.mockResolvedValue(buildConfig());
+        });
+        it('signs in the AppUser that already has this email, marking the email verified', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            const result = await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            // The provider already proved ownership of the email, so a previously-unverified
+            // account is marked verified rather than silently bypassing app-side verification.
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                id: 'user-1',
+                emailVerified: true
+            }));
+            expect(authService.issueLoginForUser).toHaveBeenCalledWith(expect.objectContaining({
+                id: 'user-1',
+                emailVerified: true
+            }));
+            expect(result).toEqual({
+                accessToken: 'access-token'
+            });
+        });
+        it('refuses to sign in or re-register an email that belongs to a permanently deleted account', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser({
+                deletedAt: new Date()
+            }));
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
+            expect(userRepo.findOne).toHaveBeenCalledWith(expect.objectContaining({
+                withDeleted: true
+            }));
+            expect(userRepo.save).not.toHaveBeenCalled();
+            expect(userRepo.create).not.toHaveBeenCalled();
+        });
+        it('does not re-save an existing user whose email is already verified', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser({
+                emailVerified: true
+            }));
+            await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            expect(userRepo.save).not.toHaveBeenCalled();
+        });
+        it('adopts an existing password account that shares the email without creating a new one', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            expect(userRepo.create).not.toHaveBeenCalled();
+        });
+        it('creates a new AppUser with no password on a first sign-in', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                email: 'user@example.com',
+                password: null,
+                emailVerified: true
+            }));
+        });
+        it('refuses an unknown email when sign-up is disabled', async ()=>{
+            signUpEnabled = false;
+            userRepo.findOne.mockResolvedValue(null);
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
+            expect(userRepo.save).not.toHaveBeenCalled();
+        });
+        it('signs an existing user in even when sign-up is disabled', async ()=>{
+            signUpEnabled = false;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).resolves.toEqual({
+                accessToken: 'access-token'
+            });
+            expect(userRepo.create).not.toHaveBeenCalled();
+        });
+        it('refuses to create an account that could not be given a company', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(null);
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
+            expect(userRepo.save).not.toHaveBeenCalled();
+        });
+        it('signs in a user who already has a company, company feature and all', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).resolves.toEqual({
+                accessToken: 'access-token'
+            });
+        });
+        it('refuses an email the provider has not verified', async ()=>{
+            fetchProfile.mockResolvedValue(buildProfile({
+                emailVerified: false
+            }));
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
+            expect(userRepo.findOne).not.toHaveBeenCalled();
+        });
+        it('marks an auto-created account verified, since only verified profiles get that far', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                emailVerified: true
+            }));
+        });
+        it('refuses a profile the provider gave no email for', async ()=>{
+            fetchProfile.mockResolvedValue(buildProfile({
+                email: null
+            }));
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('refuses a profile with no account identifier', async ()=>{
+            fetchProfile.mockResolvedValue(buildProfile({
+                providerUserId: ''
+            }));
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('refuses an unknown or expired state', async ()=>{
+            cache.get.mockResolvedValue(undefined);
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('refuses a redirect URI the sign-in did not start with', async ()=>{
+            await expect(buildService().completeLogin('code', 'state', 'https://evil.test/callback')).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('burns the state even when the redirect URI does not match, so it cannot be retried', async ()=>{
+            await expect(buildService().completeLogin('code', 'state', 'https://evil.test/callback')).rejects.toThrow(_common.UnauthorizedException);
+            expect(cache.del).toHaveBeenCalledWith('auth:social:state:state');
+        });
+    });
+});

package/config/auth.constants.d.ts

@@ -5,3 +5,5 @@ export declare const DEFAULT_COOKIE_NAME = "fsn_refresh_token";
 export declare const MAX_COOKIE_BYTES = 3500;
 export declare const SESSION_CACHE_PREFIX = "auth:session";
 export declare const TOKEN_REVOKED_PREFIX = "auth:revoked";
+export declare const SOCIAL_STATE_PREFIX = "auth:social:state";
+export declare const SOCIAL_STATE_TTL_MS: number;

package/config/event-actions.d.ts

@@ -10,6 +10,7 @@ export declare const AUTH_EVENT_ACTIONS: {
     readonly EMAIL_VERIFIED: "email-verified";
     readonly PERMISSION_GRANTED: "permission-granted";
     readonly PERMISSION_REVOKED: "permission-revoked";
+    readonly SOCIAL_LOGGED_IN: "social-logged-in";
 };
 export declare const AUTH_EVENT_ENTITIES: {
     readonly USER: "appuser";
@@ -17,5 +18,6 @@ export declare const AUTH_EVENT_ENTITIES: {
     readonly COMPANY_BRANCH: "company_branch";
     readonly SESSION: "session";
     readonly USER_PERMISSION: "user_company_permission";
+    readonly SOCIAL_AUTH_CONFIG: "social_auth_config";
 };
 export declare const AUTH_EVENT_MODULE = "auth";

package/config/message-keys.d.ts

@@ -12,7 +12,9 @@ export declare const AUTH_MESSAGES: {
     readonly SELECT_SUCCESS: "auth.select.success";
     readonly SWITCH_COMPANY_SUCCESS: "auth.switch.company.success";
     readonly REGISTER_EMAIL_EXISTS: "auth.register.email.exists";
+    readonly REGISTER_ACCOUNT_DELETED: "auth.register.account.deleted";
     readonly REGISTER_COMPANY_ALREADY_ASSIGNED: "auth.register.company.already.assigned";
+    readonly REGISTER_SIGNUP_DISABLED: "auth.register.signup.disabled";
     readonly PASSWORD_CHANGE_SUCCESS: "auth.password.change.success";
     readonly PASSWORD_CHANGE_INVALID_CURRENT: "auth.password.change.invalid.current";
     readonly PASSWORD_CHANGE_CURRENT_REQUIRED: "auth.password.change.current.required";
@@ -49,6 +51,25 @@ export declare const EMAIL_VERIFICATION_MESSAGES: {
     readonly VERIFICATION_NOT_ENABLED: "email.verification.not.enabled";
     readonly RESEND_SUCCESS: "email.verification.resend.success";
 };
+export declare const SOCIAL_AUTH_MESSAGES: {
+    readonly PROVIDERS_SUCCESS: "auth.social.providers.success";
+    readonly AUTHORIZE_SUCCESS: "auth.social.authorize.success";
+    readonly LOGIN_SUCCESS: "auth.social.login.success";
+    readonly PROVIDER_DISABLED: "auth.social.provider.disabled";
+    readonly PROVIDER_NOT_CONFIGURED: "auth.social.provider.not.configured";
+    readonly STATE_INVALID: "auth.social.state.invalid";
+    readonly REDIRECT_URI_MISMATCH: "auth.social.redirect.uri.mismatch";
+    readonly EXCHANGE_FAILED: "auth.social.exchange.failed";
+    readonly PROFILE_INCOMPLETE: "auth.social.profile.incomplete";
+    readonly ACCOUNT_NOT_LINKED: "auth.social.account.not.linked";
+    readonly COMPANY_REQUIRED: "auth.social.company.required";
+    readonly EMAIL_REQUIRED: "auth.social.email.required";
+    readonly EMAIL_NOT_VERIFIED: "auth.social.email.not.verified";
+    readonly ACCOUNT_DELETED: "auth.social.account.deleted";
+};
+export declare const SOCIAL_AUTH_CONFIG_MESSAGES: {
+    readonly PROVIDER_ALREADY_CONFIGURED: "social.config.provider.already.configured";
+};
 export declare const USER_MESSAGES: {
     readonly NOT_FOUND: "user.not.found";
     readonly PROFILE_UPDATE_SUCCESS: "user.profile.update.success";

package/controllers/index.d.ts

@@ -1,6 +1,8 @@
 export * from './authentication.controller';
 export * from './company-selection.controller';
 export * from './email-verification.controller';
+export * from './social-auth.controller';
+export * from './social-auth-config.controller';
 export * from './user.controller';
 export * from './company.controller';
 export * from './branch.controller';

package/controllers/social-auth-config.controller.d.ts

@@ -0,0 +1,22 @@
+import { CreateSocialAuthConfigDto, SocialAuthConfigResponseDto, UpdateSocialAuthConfigDto } from '../dtos/social-auth.dto';
+import { SocialAuthConfigService } from '../services/social-auth-config.service';
+declare const SocialAuthConfigController_base: abstract new (service: SocialAuthConfigService) => {
+    readonly enabledEndpoints: import("@flusys/nestjs-shared").ApiEndpoint[] | "all";
+    service: SocialAuthConfigService;
+    isEnabled(endpoint: import("@flusys/nestjs-shared").ApiEndpoint): boolean;
+    insert(addDto: CreateSocialAuthConfigDto, user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").SingleResponseDto<SocialAuthConfigResponseDto>>;
+    insertMany(addDto: CreateSocialAuthConfigDto[], user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").BulkResponseDto<SocialAuthConfigResponseDto>>;
+    getById(id: string, body: import("@flusys/nestjs-shared").GetByIdBodyDto, user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").SingleResponseDto<SocialAuthConfigResponseDto>>;
+    getByIds(body: import("@flusys/nestjs-shared").GetByIdsDto, user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").ListResponseDto<SocialAuthConfigResponseDto>>;
+    update(updateDto: UpdateSocialAuthConfigDto, user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").SingleResponseDto<SocialAuthConfigResponseDto>>;
+    updateMany(updateDtos: UpdateSocialAuthConfigDto[], user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").BulkResponseDto<SocialAuthConfigResponseDto>>;
+    bulkUpsert(dtos: (CreateSocialAuthConfigDto | UpdateSocialAuthConfigDto)[], user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").BulkResponseDto<SocialAuthConfigResponseDto>>;
+    getByFilter(filter: Record<string, any>, user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").SingleResponseDto<SocialAuthConfigResponseDto>>;
+    getAll(filterAndPaginationDto: import("@flusys/nestjs-shared").FilterAndPaginationDto, user: import("@flusys/nestjs-shared").ILoggedUserInfo | null, search?: string): Promise<import("@flusys/nestjs-shared").ListResponseDto<SocialAuthConfigResponseDto>>;
+    delete(deleteDto: import("@flusys/nestjs-shared").DeleteDto, user: import("@flusys/nestjs-shared").ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").MessageResponseDto>;
+};
+export declare class SocialAuthConfigController extends SocialAuthConfigController_base {
+    socialAuthConfigService: SocialAuthConfigService;
+    constructor(socialAuthConfigService: SocialAuthConfigService);
+}
+export {};

package/controllers/social-auth.controller.d.ts

@@ -0,0 +1,11 @@
+import { SingleResponseDto } from '@flusys/nestjs-shared/dtos';
+import { CompanySelectionResponseDto, LoginResponseDto } from '../dtos/authentication.dto';
+import { SocialAuthorizeDto, SocialAuthorizeResponseDto, SocialCallbackDto, SocialProviderInfoDto, SocialProvidersDto } from '../dtos/social-auth.dto';
+import { SocialAuthService } from '../services/social-auth.service';
+export declare class SocialAuthController {
+    private readonly socialAuthService;
+    constructor(socialAuthService: SocialAuthService);
+    getProviders(dto: SocialProvidersDto): Promise<SingleResponseDto<SocialProviderInfoDto[]>>;
+    authorize(dto: SocialAuthorizeDto): Promise<SingleResponseDto<SocialAuthorizeResponseDto>>;
+    callback(dto: SocialCallbackDto): Promise<SingleResponseDto<LoginResponseDto | CompanySelectionResponseDto>>;
+}

package/dtos/index.d.ts

@@ -1,5 +1,6 @@
 export * from './authentication.dto';
 export * from './company-branch.dto';
 export * from './company.dto';
+export * from './social-auth.dto';
 export * from './user.dto';
 export * from './user-permission.dto';

package/dtos/social-auth.dto.d.ts

@@ -0,0 +1,42 @@
+import { IdentityResponseDto } from '@flusys/nestjs-shared/dtos';
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+export declare class CreateSocialAuthConfigDto {
+    provider: SocialProviderTypeEnum;
+    isEnabled?: boolean;
+    clientId?: string;
+    clientSecret?: string;
+    scopes?: string[];
+    extraConfig?: Record<string, unknown>;
+}
+declare const UpdateSocialAuthConfigDto_base: import("@nestjs/common").Type<Partial<CreateSocialAuthConfigDto>>;
+export declare class UpdateSocialAuthConfigDto extends UpdateSocialAuthConfigDto_base {
+    id: string;
+}
+export declare class SocialAuthConfigResponseDto extends IdentityResponseDto {
+    provider: SocialProviderTypeEnum;
+    isEnabled: boolean;
+    clientId: string | null;
+    hasClientSecret: boolean;
+    scopes: string[] | null;
+    extraConfig: Record<string, unknown> | null;
+}
+export declare class SocialProviderInfoDto {
+    provider: SocialProviderTypeEnum;
+    redirectUri: string;
+}
+export declare class SocialProvidersDto {
+    redirectUri: string;
+}
+export declare class SocialAuthorizeDto extends SocialProvidersDto {
+    provider: SocialProviderTypeEnum;
+}
+export declare class SocialAuthorizeResponseDto {
+    provider: SocialProviderTypeEnum;
+    authorizationUrl: string;
+    state: string;
+}
+export declare class SocialCallbackDto extends SocialProvidersDto {
+    code: string;
+    state: string;
+}
+export {};

package/entities/index.d.ts

@@ -2,15 +2,17 @@ export * from './app-user.entity';
 export * from './company-branch.entity';
 export * from './company.entity';
 export * from './pending-registration.entity';
+export * from './social-auth-config.entity';
 export { PermissionType, UserCompanyPermission } from './user-company-permission.entity';
 export * from './user-token.entity';
 import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
 import { PendingRegistration } from './pending-registration.entity';
+import { SocialAuthConfig } from './social-auth-config.entity';
 import { UserCompanyPermission } from './user-company-permission.entity';
 import { UserToken } from './user-token.entity';
-declare const BaseEntities: (typeof AppUser | typeof UserToken)[];
+declare const BaseEntities: (typeof AppUser | typeof SocialAuthConfig | typeof UserToken)[];
 declare const EmailEntities: (typeof PendingRegistration)[];
 declare const CompanyEntities: (typeof Company | typeof CompanyBranch | typeof UserCompanyPermission)[];
 export interface IAuthEntitiesConfig {

package/entities/social-auth-config.entity.d.ts

@@ -0,0 +1,9 @@
+import { Identity } from '@flusys/nestjs-shared/entities';
+export declare class SocialAuthConfig extends Identity {
+    provider: string;
+    isEnabled: boolean;
+    clientId: string | null;
+    clientSecret: string | null;
+    scopes: string[] | null;
+    extraConfig: Record<string, unknown> | null;
+}

package/enums/index.d.ts

@@ -1 +1,2 @@
+export * from './social-provider-type.enum';
 export * from './user-org-permission-type.enum';

package/enums/social-provider-type.enum.d.ts

@@ -0,0 +1,6 @@
+export declare enum SocialProviderTypeEnum {
+    GOOGLE = "google",
+    FACEBOOK = "facebook",
+    LINKEDIN = "linkedin",
+    MICROSOFT = "microsoft"
+}

package/fesm/config/auth.constants.js

@@ -9,3 +9,6 @@ export const MAX_COOKIE_BYTES = 3500;
 // Cache Key Prefixes
 export const SESSION_CACHE_PREFIX = 'auth:session';
 export const TOKEN_REVOKED_PREFIX = 'auth:revoked';
+export const SOCIAL_STATE_PREFIX = 'auth:social:state';
+// Social Login
+export const SOCIAL_STATE_TTL_MS = 10 * 60 * 1000; // 10 minutes

package/fesm/config/event-actions.js

@@ -12,13 +12,15 @@
     PASSWORD_RESET: 'password-reset',
     EMAIL_VERIFIED: 'email-verified',
     PERMISSION_GRANTED: 'permission-granted',
-    PERMISSION_REVOKED: 'permission-revoked'
+    PERMISSION_REVOKED: 'permission-revoked',
+    SOCIAL_LOGGED_IN: 'social-logged-in'
 };
 /** Every entity the auth module publishes under, ApiService backed or not */ export const AUTH_EVENT_ENTITIES = {
     USER: 'appuser',
     COMPANY: 'company',
     COMPANY_BRANCH: 'company_branch',
     SESSION: 'session',
-    USER_PERMISSION: 'user_company_permission'
+    USER_PERMISSION: 'user_company_permission',
+    SOCIAL_AUTH_CONFIG: 'social_auth_config'
 };
 export const AUTH_EVENT_MODULE = 'auth';

package/fesm/config/message-keys.js

@@ -13,7 +13,9 @@ export const AUTH_MESSAGES = {
     SELECT_SUCCESS: 'auth.select.success',
     SWITCH_COMPANY_SUCCESS: 'auth.switch.company.success',
     REGISTER_EMAIL_EXISTS: 'auth.register.email.exists',
+    REGISTER_ACCOUNT_DELETED: 'auth.register.account.deleted',
     REGISTER_COMPANY_ALREADY_ASSIGNED: 'auth.register.company.already.assigned',
+    REGISTER_SIGNUP_DISABLED: 'auth.register.signup.disabled',
     PASSWORD_CHANGE_SUCCESS: 'auth.password.change.success',
     PASSWORD_CHANGE_INVALID_CURRENT: 'auth.password.change.invalid.current',
     PASSWORD_CHANGE_CURRENT_REQUIRED: 'auth.password.change.current.required',
@@ -50,6 +52,25 @@ export const EMAIL_VERIFICATION_MESSAGES = {
     VERIFICATION_NOT_ENABLED: 'email.verification.not.enabled',
     RESEND_SUCCESS: 'email.verification.resend.success'
 };
+export const SOCIAL_AUTH_MESSAGES = {
+    PROVIDERS_SUCCESS: 'auth.social.providers.success',
+    AUTHORIZE_SUCCESS: 'auth.social.authorize.success',
+    LOGIN_SUCCESS: 'auth.social.login.success',
+    PROVIDER_DISABLED: 'auth.social.provider.disabled',
+    PROVIDER_NOT_CONFIGURED: 'auth.social.provider.not.configured',
+    STATE_INVALID: 'auth.social.state.invalid',
+    REDIRECT_URI_MISMATCH: 'auth.social.redirect.uri.mismatch',
+    EXCHANGE_FAILED: 'auth.social.exchange.failed',
+    PROFILE_INCOMPLETE: 'auth.social.profile.incomplete',
+    ACCOUNT_NOT_LINKED: 'auth.social.account.not.linked',
+    COMPANY_REQUIRED: 'auth.social.company.required',
+    EMAIL_REQUIRED: 'auth.social.email.required',
+    EMAIL_NOT_VERIFIED: 'auth.social.email.not.verified',
+    ACCOUNT_DELETED: 'auth.social.account.deleted'
+};
+export const SOCIAL_AUTH_CONFIG_MESSAGES = {
+    PROVIDER_ALREADY_CONFIGURED: 'social.config.provider.already.configured'
+};
 export const USER_MESSAGES = {
     NOT_FOUND: 'user.not.found',
     PROFILE_UPDATE_SUCCESS: 'user.profile.update.success',

package/fesm/controllers/index.js

@@ -1,6 +1,8 @@
 export * from './authentication.controller';
 export * from './company-selection.controller';
 export * from './email-verification.controller';
+export * from './social-auth.controller';
+export * from './social-auth-config.controller';
 export * from './user.controller';
 export * from './company.controller';
 export * from './branch.controller';