@flusys/nestjs-auth 7.0.2 → 7.1.0

package/fesm/services/social-auth.service.js

@@ -0,0 +1,300 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+import { LogAction } from '@flusys/nestjs-shared';
+import { HybridCache, publishDomainEvent } from '@flusys/nestjs-shared/classes';
+import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
+import { BadRequestException, Inject, Injectable, InternalServerErrorException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
+import { randomBytes } from 'crypto';
+import { IsNull } from 'typeorm';
+import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, SOCIAL_AUTH_MESSAGES, SOCIAL_STATE_PREFIX, SOCIAL_STATE_TTL_MS } from '../config';
+import { AppUser } from '../entities/app-user.entity';
+import { SocialAuthConfig } from '../entities/social-auth-config.entity';
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { getSocialProvider } from '../providers/social-provider.registry';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { AuthenticationService } from './authentication.service';
+export class SocialAuthService {
+    async listEnabledProviders(redirectUri) {
+        const repository = await this.dataSourceProvider.getRepository(SocialAuthConfig);
+        const configs = await repository.find({
+            where: {
+                isEnabled: true,
+                deletedAt: IsNull()
+            }
+        });
+        return configs.filter((config)=>!!config.clientId && !!config.clientSecret).map((config)=>({
+                provider: config.provider,
+                redirectUri
+            }));
+    }
+    async createAuthorization(provider, redirectUri) {
+        const config = await this.getUsableConfig(provider);
+        const state = randomBytes(24).toString('hex');
+        await this.getCache().set(this.stateKey(state), {
+            provider,
+            redirectUri
+        }, SOCIAL_STATE_TTL_MS);
+        return {
+            provider,
+            authorizationUrl: getSocialProvider(provider).buildAuthorizationUrl(this.toCredentials(config, redirectUri), state),
+            state
+        };
+    }
+    async completeLogin(code, state, redirectUri) {
+        const provider = await this.consumeState(state, redirectUri);
+        const config = await this.getUsableConfig(provider);
+        const profile = await getSocialProvider(provider).fetchProfile(this.toCredentials(config, redirectUri), code);
+        if (!profile.providerUserId) {
+            throw new UnauthorizedException({
+                message: `${provider} did not return an account identifier`,
+                messageKey: SOCIAL_AUTH_MESSAGES.PROFILE_INCOMPLETE,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        const user = await this.resolveUser(provider, profile);
+        const response = await this.authService.issueLoginForUser(user);
+        this.publishSocialEvent(AUTH_EVENT_ENTITIES.SESSION, AUTH_EVENT_ACTIONS.SOCIAL_LOGGED_IN, user, provider);
+        return response;
+    }
+    async resolveUser(provider, profile) {
+        this.ensureVerifiedEmail(provider, profile);
+        const userRepository = await this.dataSourceProvider.getRepository(AppUser);
+        const existing = await userRepository.findOne({
+            where: {
+                email: profile.email
+            },
+            withDeleted: true
+        });
+        if (existing?.deletedAt) {
+            throw new UnauthorizedException({
+                message: 'This account has been permanently deleted. Please contact your system administrator.',
+                messageKey: SOCIAL_AUTH_MESSAGES.ACCOUNT_DELETED
+            });
+        }
+        if (existing) {
+            // The provider already proved ownership of this email (ensureVerifiedEmail above),
+            // so a social login carries at least as much proof as clicking a verification link.
+            if (!existing.emailVerified) {
+                existing.emailVerified = true;
+                await userRepository.save(existing);
+            }
+            return existing;
+        }
+        const user = await this.registerUser(provider, userRepository, profile);
+        this.publishSocialEvent(AUTH_EVENT_ENTITIES.USER, AUTH_EVENT_ACTIONS.REGISTERED, user, provider);
+        return user;
+    }
+    ensureVerifiedEmail(provider, profile) {
+        if (!profile.email) {
+            throw new UnauthorizedException({
+                message: `${provider} did not share an email address`,
+                messageKey: SOCIAL_AUTH_MESSAGES.EMAIL_REQUIRED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        if (!profile.emailVerified) {
+            throw new UnauthorizedException({
+                message: `${provider} has not verified this email address`,
+                messageKey: SOCIAL_AUTH_MESSAGES.EMAIL_NOT_VERIFIED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+    }
+    async registerUser(provider, userRepository, profile) {
+        if (!this.dataSourceProvider.isSignUpEnabled()) {
+            throw new UnauthorizedException({
+                message: `No account is linked to this ${provider} profile`,
+                messageKey: SOCIAL_AUTH_MESSAGES.ACCOUNT_NOT_LINKED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        if (this.dataSourceProvider.isCompanyFeatureEnabled()) {
+            throw new UnauthorizedException({
+                message: `No account is linked to this ${provider} profile. Please sign up manually and join or create a company first, then social sign-in will work.`,
+                messageKey: SOCIAL_AUTH_MESSAGES.COMPANY_REQUIRED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        return userRepository.save(userRepository.create({
+            email: profile.email,
+            name: profile.name,
+            password: null,
+            isActive: true,
+            emailVerified: true
+        }));
+    }
+    async getUsableConfig(provider) {
+        const repository = await this.dataSourceProvider.getRepository(SocialAuthConfig);
+        const config = await repository.findOne({
+            where: {
+                provider,
+                deletedAt: IsNull()
+            }
+        });
+        if (!config?.isEnabled) {
+            throw new BadRequestException({
+                message: `Social sign-in with ${provider} is not enabled`,
+                messageKey: SOCIAL_AUTH_MESSAGES.PROVIDER_DISABLED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        if (!config.clientId || !config.clientSecret) {
+            throw new BadRequestException({
+                message: `Social sign-in with ${provider} is missing its client credentials`,
+                messageKey: SOCIAL_AUTH_MESSAGES.PROVIDER_NOT_CONFIGURED,
+                messageVariables: {
+                    provider
+                }
+            });
+        }
+        return config;
+    }
+    toCredentials(config, redirectUri) {
+        return {
+            clientId: config.clientId,
+            clientSecret: config.clientSecret,
+            redirectUri,
+            scopes: config.scopes,
+            extraConfig: config.extraConfig
+        };
+    }
+    async consumeState(state, redirectUri) {
+        const key = this.stateKey(state);
+        const stored = await this.getCache().get(key);
+        await this.getCache().del(key);
+        if (!stored) {
+            throw new UnauthorizedException({
+                message: 'Social sign-in session is invalid or has expired',
+                messageKey: SOCIAL_AUTH_MESSAGES.STATE_INVALID
+            });
+        }
+        if (stored.redirectUri !== redirectUri) {
+            throw new UnauthorizedException({
+                message: 'Redirect URI does not match the one the sign-in started with',
+                messageKey: SOCIAL_AUTH_MESSAGES.REDIRECT_URI_MISMATCH
+            });
+        }
+        return stored.provider;
+    }
+    stateKey(state) {
+        return `${SOCIAL_STATE_PREFIX}:${state}`;
+    }
+    getCache() {
+        if (!this.cacheManager) {
+            throw new InternalServerErrorException({
+                message: 'Cache is required to hold the social sign-in state',
+                messageKey: SYSTEM_MESSAGES.SERVICE_NOT_AVAILABLE,
+                messageVariables: {
+                    provider: 'CACHE_INSTANCE',
+                    available: ''
+                }
+            });
+        }
+        return this.cacheManager;
+    }
+    publishSocialEvent(entity, action, user, provider) {
+        void publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity,
+            action,
+            ids: [
+                user.id
+            ],
+            metadata: {
+                email: user.email,
+                provider
+            },
+            user: {
+                id: user.id,
+                email: user.email
+            }
+        });
+    }
+    constructor(authService, dataSourceProvider, cacheManager){
+        _define_property(this, "authService", void 0);
+        _define_property(this, "dataSourceProvider", void 0);
+        _define_property(this, "cacheManager", void 0);
+        this.authService = authService;
+        this.dataSourceProvider = dataSourceProvider;
+        this.cacheManager = cacheManager;
+    }
+}
+_ts_decorate([
+    LogAction({
+        action: 'auth.social.authorize',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof SocialProviderTypeEnum === "undefined" ? Object : SocialProviderTypeEnum,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], SocialAuthService.prototype, "createAuthorization", null);
+_ts_decorate([
+    LogAction({
+        action: 'auth.social.login',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], SocialAuthService.prototype, "completeLogin", null);
+SocialAuthService = _ts_decorate([
+    Injectable({
+        scope: Scope.REQUEST
+    }),
+    _ts_param(0, Inject(AuthenticationService)),
+    _ts_param(1, Inject(AuthDataSourceProvider)),
+    _ts_param(2, Optional()),
+    _ts_param(2, Inject('CACHE_INSTANCE')),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof AuthenticationService === "undefined" ? Object : AuthenticationService,
+        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
+        typeof HybridCache === "undefined" ? Object : HybridCache
+    ])
+], SocialAuthService);

package/fesm/services/social-auth.service.spec.js

@@ -0,0 +1,265 @@
+import { createMockRepository } from '@test-utils/mocks/repository.mock';
+import { BadRequestException, UnauthorizedException } from '@nestjs/common';
+import { AppUser } from '../entities/app-user.entity';
+import { SocialAuthConfig } from '../entities/social-auth-config.entity';
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import * as registry from '../providers/social-provider.registry';
+import { SocialAuthService } from './social-auth.service';
+const REDIRECT_URI = 'http://localhost:2001/auth/social/callback';
+function buildConfig(overrides = {}) {
+    return {
+        id: 'config-1',
+        provider: SocialProviderTypeEnum.GOOGLE,
+        isEnabled: true,
+        clientId: 'client-id',
+        clientSecret: 'client-secret',
+        scopes: null,
+        extraConfig: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+function buildProfile(overrides = {}) {
+    return {
+        providerUserId: 'google-user-1',
+        email: 'user@example.com',
+        emailVerified: true,
+        name: 'Test User',
+        avatarUrl: null,
+        ...overrides
+    };
+}
+function buildUser(overrides = {}) {
+    return {
+        id: 'user-1',
+        email: 'user@example.com',
+        isActive: true,
+        ...overrides
+    };
+}
+describe('SocialAuthService', ()=>{
+    let configRepo;
+    let userRepo;
+    let cache;
+    let authService;
+    let fetchProfile;
+    let buildAuthorizationUrl;
+    let signUpEnabled;
+    let companyFeatureEnabled;
+    function buildService() {
+        const dataSourceProvider = {
+            getRepository: jest.fn().mockImplementation(async (entity)=>{
+                if (entity === SocialAuthConfig) return configRepo;
+                if (entity === AppUser) return userRepo;
+                throw new Error(`Unexpected entity: ${String(entity)}`);
+            }),
+            isSignUpEnabled: ()=>signUpEnabled,
+            isCompanyFeatureEnabled: ()=>companyFeatureEnabled
+        };
+        return new SocialAuthService(authService, dataSourceProvider, cache);
+    }
+    beforeEach(()=>{
+        signUpEnabled = true;
+        companyFeatureEnabled = false;
+        configRepo = createMockRepository();
+        userRepo = createMockRepository();
+        cache = {
+            get: jest.fn(),
+            set: jest.fn(),
+            del: jest.fn()
+        };
+        authService = {
+            issueLoginForUser: jest.fn().mockResolvedValue({
+                accessToken: 'access-token'
+            })
+        };
+        fetchProfile = jest.fn().mockResolvedValue(buildProfile());
+        buildAuthorizationUrl = jest.fn().mockReturnValue('https://provider.test/consent');
+        jest.spyOn(registry, 'getSocialProvider').mockReturnValue({
+            provider: SocialProviderTypeEnum.GOOGLE,
+            defaultScopes: [
+                'openid'
+            ],
+            buildAuthorizationUrl,
+            fetchProfile
+        });
+        userRepo.create.mockImplementation((data)=>({
+                ...data
+            }));
+        userRepo.save.mockImplementation(async (entity)=>({
+                id: 'new-user',
+                ...entity
+            }));
+    });
+    afterEach(()=>jest.restoreAllMocks());
+    describe('listEnabledProviders', ()=>{
+        it('drops enabled providers that have no credentials yet', async ()=>{
+            configRepo.find.mockResolvedValue([
+                buildConfig(),
+                buildConfig({
+                    id: 'config-2',
+                    provider: SocialProviderTypeEnum.FACEBOOK,
+                    clientSecret: null
+                })
+            ]);
+            const providers = await buildService().listEnabledProviders(REDIRECT_URI);
+            expect(providers).toEqual([
+                {
+                    provider: SocialProviderTypeEnum.GOOGLE,
+                    redirectUri: REDIRECT_URI
+                }
+            ]);
+        });
+    });
+    describe('createAuthorization', ()=>{
+        it('caches the state and returns the provider consent URL', async ()=>{
+            configRepo.findOne.mockResolvedValue(buildConfig());
+            const result = await buildService().createAuthorization(SocialProviderTypeEnum.GOOGLE, REDIRECT_URI);
+            expect(result.authorizationUrl).toBe('https://provider.test/consent');
+            expect(cache.set).toHaveBeenCalledWith(`auth:social:state:${result.state}`, {
+                provider: SocialProviderTypeEnum.GOOGLE,
+                redirectUri: REDIRECT_URI
+            }, 10 * 60 * 1000);
+        });
+        it('rejects a provider that is configured but switched off', async ()=>{
+            configRepo.findOne.mockResolvedValue(buildConfig({
+                isEnabled: false
+            }));
+            await expect(buildService().createAuthorization(SocialProviderTypeEnum.GOOGLE, REDIRECT_URI)).rejects.toThrow(BadRequestException);
+        });
+        it('rejects a provider that is switched on but has no credentials', async ()=>{
+            configRepo.findOne.mockResolvedValue(buildConfig({
+                clientId: null
+            }));
+            await expect(buildService().createAuthorization(SocialProviderTypeEnum.GOOGLE, REDIRECT_URI)).rejects.toThrow(BadRequestException);
+        });
+    });
+    describe('completeLogin', ()=>{
+        beforeEach(()=>{
+            cache.get.mockResolvedValue({
+                provider: SocialProviderTypeEnum.GOOGLE,
+                redirectUri: REDIRECT_URI
+            });
+            configRepo.findOne.mockResolvedValue(buildConfig());
+        });
+        it('signs in the AppUser that already has this email, marking the email verified', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            const result = await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            // The provider already proved ownership of the email, so a previously-unverified
+            // account is marked verified rather than silently bypassing app-side verification.
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                id: 'user-1',
+                emailVerified: true
+            }));
+            expect(authService.issueLoginForUser).toHaveBeenCalledWith(expect.objectContaining({
+                id: 'user-1',
+                emailVerified: true
+            }));
+            expect(result).toEqual({
+                accessToken: 'access-token'
+            });
+        });
+        it('refuses to sign in or re-register an email that belongs to a permanently deleted account', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser({
+                deletedAt: new Date()
+            }));
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
+            expect(userRepo.findOne).toHaveBeenCalledWith(expect.objectContaining({
+                withDeleted: true
+            }));
+            expect(userRepo.save).not.toHaveBeenCalled();
+            expect(userRepo.create).not.toHaveBeenCalled();
+        });
+        it('does not re-save an existing user whose email is already verified', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser({
+                emailVerified: true
+            }));
+            await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            expect(userRepo.save).not.toHaveBeenCalled();
+        });
+        it('adopts an existing password account that shares the email without creating a new one', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            expect(userRepo.create).not.toHaveBeenCalled();
+        });
+        it('creates a new AppUser with no password on a first sign-in', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                email: 'user@example.com',
+                password: null,
+                emailVerified: true
+            }));
+        });
+        it('refuses an unknown email when sign-up is disabled', async ()=>{
+            signUpEnabled = false;
+            userRepo.findOne.mockResolvedValue(null);
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
+            expect(userRepo.save).not.toHaveBeenCalled();
+        });
+        it('signs an existing user in even when sign-up is disabled', async ()=>{
+            signUpEnabled = false;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).resolves.toEqual({
+                accessToken: 'access-token'
+            });
+            expect(userRepo.create).not.toHaveBeenCalled();
+        });
+        it('refuses to create an account that could not be given a company', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(null);
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
+            expect(userRepo.save).not.toHaveBeenCalled();
+        });
+        it('signs in a user who already has a company, company feature and all', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).resolves.toEqual({
+                accessToken: 'access-token'
+            });
+        });
+        it('refuses an email the provider has not verified', async ()=>{
+            fetchProfile.mockResolvedValue(buildProfile({
+                emailVerified: false
+            }));
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
+            expect(userRepo.findOne).not.toHaveBeenCalled();
+        });
+        it('marks an auto-created account verified, since only verified profiles get that far', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await buildService().completeLogin('code', 'state', REDIRECT_URI);
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                emailVerified: true
+            }));
+        });
+        it('refuses a profile the provider gave no email for', async ()=>{
+            fetchProfile.mockResolvedValue(buildProfile({
+                email: null
+            }));
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
+        });
+        it('refuses a profile with no account identifier', async ()=>{
+            fetchProfile.mockResolvedValue(buildProfile({
+                providerUserId: ''
+            }));
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
+        });
+        it('refuses an unknown or expired state', async ()=>{
+            cache.get.mockResolvedValue(undefined);
+            await expect(buildService().completeLogin('code', 'state', REDIRECT_URI)).rejects.toThrow(UnauthorizedException);
+        });
+        it('refuses a redirect URI the sign-in did not start with', async ()=>{
+            await expect(buildService().completeLogin('code', 'state', 'https://evil.test/callback')).rejects.toThrow(UnauthorizedException);
+        });
+        it('burns the state even when the redirect URI does not match, so it cannot be retried', async ()=>{
+            await expect(buildService().completeLogin('code', 'state', 'https://evil.test/callback')).rejects.toThrow(UnauthorizedException);
+            expect(cache.del).toHaveBeenCalledWith('auth:social:state:state');
+        });
+    });
+});

package/index.d.ts

@@ -8,5 +8,6 @@ export * from './helpers';
 export * from './interceptors';
 export * from './interfaces';
 export * from './modules';
+export * from './providers';
 export * from './services';
 export * from './strategies/jwt.strategy';

package/interfaces/index.d.ts

@@ -2,6 +2,7 @@ export * from './authentication.interface';
 export * from './auth-email-provider.interface';
 export * from './company-branch.interface';
 export * from './company.interface';
+export * from './social-auth.interface';
 export * from './user.interface';
 export * from './user-enricher.interface';
 export * from './auth-module-options.interface';

package/interfaces/social-auth.interface.d.ts

@@ -0,0 +1,43 @@
+import { IIdentity } from '@flusys/nestjs-shared/interfaces';
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+export interface ISocialAuthConfig extends IIdentity {
+    provider: SocialProviderTypeEnum;
+    isEnabled: boolean;
+    clientId: string | null;
+    hasClientSecret: boolean;
+    scopes: string[] | null;
+    extraConfig: Record<string, unknown> | null;
+}
+export interface ISocialProviderInfo {
+    provider: SocialProviderTypeEnum;
+    redirectUri: string;
+}
+export interface ISocialAuthorization {
+    provider: SocialProviderTypeEnum;
+    authorizationUrl: string;
+    state: string;
+}
+export interface ISocialProfile {
+    providerUserId: string;
+    email: string | null;
+    emailVerified: boolean;
+    name: string | null;
+    avatarUrl: string | null;
+}
+export interface ISocialProviderCredentials {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    scopes?: string[] | null;
+    extraConfig?: Record<string, unknown> | null;
+}
+export interface ISocialAuthProvider {
+    readonly provider: SocialProviderTypeEnum;
+    readonly defaultScopes: string[];
+    buildAuthorizationUrl(credentials: ISocialProviderCredentials, state: string): string;
+    fetchProfile(credentials: ISocialProviderCredentials, code: string): Promise<ISocialProfile>;
+}
+export interface ISocialAuthState {
+    provider: SocialProviderTypeEnum;
+    redirectUri: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "7.0.2",
+  "version": "7.1.0",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -98,7 +98,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "7.0.2",
-    "@flusys/nestjs-shared": "7.0.2"
+    "@flusys/nestjs-core": "7.1.0",
+    "@flusys/nestjs-shared": "7.1.0"
   }
 }

package/providers/facebook.social-provider.d.ts

@@ -0,0 +1,10 @@
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { ISocialAuthProvider, ISocialProfile, ISocialProviderCredentials } from '../interfaces/social-auth.interface';
+declare class FacebookSocialProvider implements ISocialAuthProvider {
+    readonly provider = SocialProviderTypeEnum.FACEBOOK;
+    readonly defaultScopes: string[];
+    buildAuthorizationUrl(credentials: ISocialProviderCredentials, state: string): string;
+    fetchProfile(credentials: ISocialProviderCredentials, code: string): Promise<ISocialProfile>;
+}
+export declare const facebookSocialProvider: FacebookSocialProvider;
+export {};

package/providers/google.social-provider.d.ts

@@ -0,0 +1,10 @@
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { ISocialAuthProvider, ISocialProfile, ISocialProviderCredentials } from '../interfaces/social-auth.interface';
+declare class GoogleSocialProvider implements ISocialAuthProvider {
+    readonly provider = SocialProviderTypeEnum.GOOGLE;
+    readonly defaultScopes: string[];
+    buildAuthorizationUrl(credentials: ISocialProviderCredentials, state: string): string;
+    fetchProfile(credentials: ISocialProviderCredentials, code: string): Promise<ISocialProfile>;
+}
+export declare const googleSocialProvider: GoogleSocialProvider;
+export {};

package/providers/index.d.ts

@@ -0,0 +1 @@
+export * from './social-provider.registry';

package/providers/linkedin.social-provider.d.ts

@@ -0,0 +1,10 @@
+import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum';
+import { ISocialAuthProvider, ISocialProfile, ISocialProviderCredentials } from '../interfaces/social-auth.interface';
+declare class LinkedInSocialProvider implements ISocialAuthProvider {
+    readonly provider = SocialProviderTypeEnum.LINKEDIN;
+    readonly defaultScopes: string[];
+    buildAuthorizationUrl(credentials: ISocialProviderCredentials, state: string): string;
+    fetchProfile(credentials: ISocialProviderCredentials, code: string): Promise<ISocialProfile>;
+}
+export declare const linkedInSocialProvider: LinkedInSocialProvider;
+export {};