@flusys/nestjs-auth 7.0.2 → 8.0.0-beta.1

package/fesm/services/auth-email.service.js

@@ -1,488 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { LogAction } from '@flusys/nestjs-shared';
-import { publishDomainEvent } from '@flusys/nestjs-shared/classes';
-import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
-import { BadRequestException, Inject, Injectable, InternalServerErrorException, Optional, Scope } from '@nestjs/common';
-import * as bcrypt from 'bcrypt';
-import * as crypto from 'crypto';
-import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, USER_MESSAGES } from '../config';
-import { AppUser } from '../entities/app-user.entity';
-import { PendingRegistration } from '../entities/pending-registration.entity';
-import { TokenType, UserToken } from '../entities/user-token.entity';
-import { AUTH_EMAIL_PROVIDER, IAuthEmailProvider } from '../interfaces';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
-export class AuthEmailService {
-    isEmailEnabled() {
-        return !!this.emailProvider;
-    }
-    async getRepository(entity) {
-        if (!this.dataSourceProvider) {
-            throw new InternalServerErrorException({
-                message: `${String(entity)} repository not available`,
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: String(entity)
-                }
-            });
-        }
-        return this.dataSourceProvider.getRepository(entity);
-    }
-    generateToken() {
-        return crypto.randomBytes(32).toString('hex');
-    }
-    hashToken(token) {
-        return crypto.createHash('sha256').update(token).digest('hex');
-    }
-    assertEmailEnabled() {
-        if (!this.emailProvider) {
-            throw new BadRequestException({
-                message: 'Email service is not configured',
-                messageKey: AUTH_MESSAGES.EMAIL_NOT_CONFIGURED
-            });
-        }
-    }
-    async sendVerificationEmailSafe(email, token, verifyUrl) {
-        try {
-            await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
-        } catch  {
-            throw new BadRequestException({
-                message: 'Failed to send verification email. Please try again.',
-                messageKey: AUTH_MESSAGES.EMAIL_SEND_FAILED
-            });
-        }
-    }
-    validateTokenNotExpiredOrUsed(token, expiredMessage, expiredMessageKey, usedMessage, usedMessageKey) {
-        if (token.expiresAt < new Date()) {
-            throw new BadRequestException({
-                message: expiredMessage,
-                messageKey: expiredMessageKey
-            });
-        }
-        if (usedMessage && usedMessageKey && token.usedAt) {
-            throw new BadRequestException({
-                message: usedMessage,
-                messageKey: usedMessageKey
-            });
-        }
-    }
-    async hasPendingRegistration(email) {
-        if (!this.isEmailEnabled()) return false;
-        const pendingRepository = await this.getRepository(PendingRegistration);
-        const pending = await pendingRepository.findOne({
-            where: {
-                email
-            }
-        });
-        return !!pending && pending.expiresAt > new Date();
-    }
-    async createPendingRegistration(data) {
-        this.assertEmailEnabled();
-        const userRepository = await this.getRepository(AppUser);
-        const pendingRepository = await this.getRepository(PendingRegistration);
-        // Check if user already exists
-        const existingUser = await userRepository.findOne({
-            where: {
-                email: data.email
-            }
-        });
-        if (existingUser) {
-            throw new BadRequestException({
-                message: 'Registration failed. Please try again or contact support.',
-                messageKey: AUTH_MESSAGES.REGISTER_FAILED
-            });
-        }
-        // Delete any existing pending registration for this email
-        await pendingRepository.delete({
-            email: data.email
-        });
-        // Create pending registration with hashed token for secure storage
-        const token = this.generateToken();
-        const tokenHash = this.hashToken(token);
-        const passwordHash = await bcrypt.hash(data.password, BCRYPT_SALT_ROUNDS);
-        const expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
-        const pending = pendingRepository.create({
-            email: data.email,
-            name: data.name ?? null,
-            phone: data.phone ?? null,
-            passwordHash,
-            token: tokenHash,
-            expiresAt,
-            companyData: data.companyData ?? null,
-            additionalFields: data.additionalFields ?? null
-        });
-        await pendingRepository.save(pending);
-        // Send verification email with raw token (user receives this)
-        const verifyUrl = `${data.verifyUrlBase}?token=${token}`;
-        await this.sendVerificationEmailSafe(data.email, token, verifyUrl);
-        return {
-            success: true,
-            message: 'Please check your email to verify your registration.',
-            messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT
-        };
-    }
-    async forgotPassword(email, resetUrlBase) {
-        this.assertEmailEnabled();
-        const userRepository = await this.getRepository(AppUser);
-        const tokenRepository = await this.getRepository(UserToken);
-        const user = await userRepository.findOne({
-            where: {
-                email
-            }
-        });
-        // Always return success to prevent email enumeration
-        if (!user || !user.isActive) {
-            return {
-                success: true,
-                message: 'If the email exists, a password reset link has been sent.',
-                messageKey: AUTH_MESSAGES.PASSWORD_RESET_EMAIL_SENT
-            };
-        }
-        // Invalidate existing password reset tokens for this user
-        await tokenRepository.delete({
-            userId: user.id,
-            type: TokenType.PASSWORD_RESET
-        });
-        // Create new token with hashed storage
-        const token = this.generateToken();
-        const tokenHash = this.hashToken(token);
-        const userToken = tokenRepository.create({
-            userId: user.id,
-            type: TokenType.PASSWORD_RESET,
-            token: tokenHash,
-            expiresAt: new Date(Date.now() + this.PASSWORD_RESET_EXPIRY)
-        });
-        await tokenRepository.save(userToken);
-        // Send email with raw token
-        const resetUrl = `${resetUrlBase}?token=${token}`;
-        try {
-            await this.emailProvider.sendPasswordResetEmail(email, token, resetUrl);
-        } catch  {
-            throw new BadRequestException({
-                message: 'Failed to process request. Please try again later.',
-                messageKey: SYSTEM_MESSAGES.INTERNAL_ERROR,
-                messageVariables: {
-                    provider: 'EmailProvider',
-                    error: 'Send email failed'
-                }
-            });
-        }
-        await this.publishUserEvent(AUTH_EVENT_ACTIONS.PASSWORD_RESET_REQUESTED, user.id, {
-            email: user.email
-        });
-        return {
-            success: true,
-            message: 'If the email exists, a password reset link has been sent.',
-            messageKey: AUTH_MESSAGES.PASSWORD_RESET_EMAIL_SENT
-        };
-    }
-    async resetPassword(token, newPassword) {
-        const userRepository = await this.getRepository(AppUser);
-        const tokenRepository = await this.getRepository(UserToken);
-        // Hash the incoming token to compare with stored hash
-        const tokenHash = this.hashToken(token);
-        const userToken = await tokenRepository.findOne({
-            where: {
-                token: tokenHash,
-                type: TokenType.PASSWORD_RESET
-            }
-        });
-        if (!userToken) {
-            throw new BadRequestException({
-                message: 'Invalid or expired reset token',
-                messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID
-            });
-        }
-        this.validateTokenNotExpiredOrUsed(userToken, 'Reset token has expired. Please request a new one.', AUTH_MESSAGES.PASSWORD_RESET_TOKEN_EXPIRED, 'This reset token has already been used.', AUTH_MESSAGES.PASSWORD_RESET_TOKEN_USED);
-        const user = await userRepository.findOne({
-            where: {
-                id: userToken.userId
-            }
-        });
-        if (!user) {
-            throw new BadRequestException({
-                message: 'User not found',
-                messageKey: USER_MESSAGES.NOT_FOUND
-            });
-        }
-        // Update password
-        user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
-        await userRepository.save(user);
-        // Mark token as used
-        userToken.usedAt = new Date();
-        await tokenRepository.save(userToken);
-        await this.publishUserEvent(AUTH_EVENT_ACTIONS.PASSWORD_RESET, user.id, {
-            email: user.email
-        });
-        return {
-            success: true,
-            message: 'Password has been reset successfully.',
-            messageKey: AUTH_MESSAGES.PASSWORD_RESET_SUCCESS
-        };
-    }
-    async verifyEmail(token) {
-        const pendingRepository = await this.getRepository(PendingRegistration);
-        const userRepository = await this.getRepository(AppUser);
-        const tokenRepository = await this.getRepository(UserToken);
-        // Hash the incoming token to compare with stored hash
-        const tokenHash = this.hashToken(token);
-        // Check for pending registration first
-        const pending = await pendingRepository.findOne({
-            where: {
-                token: tokenHash
-            }
-        });
-        if (pending) {
-            if (pending.expiresAt < new Date()) {
-                await pendingRepository.delete({
-                    id: pending.id
-                });
-                throw new BadRequestException({
-                    message: 'Verification token has expired. Please register again.',
-                    messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_EXPIRED
-                });
-            }
-            // Delete pending registration (will be consumed by caller to create user)
-            await pendingRepository.delete({
-                id: pending.id
-            });
-            return {
-                type: 'pending',
-                pending
-            };
-        }
-        // Check for existing user email verification token
-        const userToken = await tokenRepository.findOne({
-            where: {
-                token: tokenHash,
-                type: TokenType.EMAIL_VERIFICATION
-            }
-        });
-        if (!userToken) {
-            throw new BadRequestException({
-                message: 'Invalid or expired verification token',
-                messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID
-            });
-        }
-        if (userToken.expiresAt < new Date()) {
-            await tokenRepository.delete({
-                id: userToken.id
-            });
-            throw new BadRequestException({
-                message: 'Verification token has expired. Please request a new one.',
-                messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_EXPIRED
-            });
-        }
-        if (userToken.usedAt) {
-            return {
-                type: 'verified',
-                message: 'Email has already been verified.',
-                messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS
-            };
-        }
-        const user = await userRepository.findOne({
-            where: {
-                id: userToken.userId
-            }
-        });
-        if (!user) {
-            throw new BadRequestException({
-                message: 'User not found',
-                messageKey: USER_MESSAGES.NOT_FOUND
-            });
-        }
-        // Mark email as verified
-        user.emailVerified = true;
-        await userRepository.save(user);
-        // Mark token as used
-        userToken.usedAt = new Date();
-        await tokenRepository.save(userToken);
-        await this.publishUserEvent(AUTH_EVENT_ACTIONS.EMAIL_VERIFIED, user.id, {
-            email: user.email
-        });
-        return {
-            type: 'verified',
-            message: 'Email has been verified successfully.',
-            messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS
-        };
-    }
-    async publishUserEvent(action, userId, metadata) {
-        await publishDomainEvent({
-            module: AUTH_EVENT_MODULE,
-            entity: AUTH_EVENT_ENTITIES.USER,
-            action,
-            ids: [
-                userId
-            ],
-            metadata
-        });
-    }
-    async resendVerificationEmail(email, verifyUrlBase) {
-        this.assertEmailEnabled();
-        const pendingRepository = await this.getRepository(PendingRegistration);
-        const userRepository = await this.getRepository(AppUser);
-        const tokenRepository = await this.getRepository(UserToken);
-        // Check pending registration first
-        const pending = await pendingRepository.findOne({
-            where: {
-                email
-            }
-        });
-        if (pending) {
-            const token = this.generateToken();
-            pending.token = this.hashToken(token);
-            pending.expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
-            await pendingRepository.save(pending);
-            const verifyUrl = `${verifyUrlBase}?token=${token}`;
-            await this.sendVerificationEmailSafe(email, token, verifyUrl);
-            return {
-                success: true,
-                message: 'If the email requires verification, a link has been sent.',
-                messageKey: EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS
-            };
-        }
-        // Check existing user
-        const user = await userRepository.findOne({
-            where: {
-                email
-            }
-        });
-        if (!user || user.emailVerified) {
-            return {
-                success: true,
-                message: 'If the email requires verification, a link has been sent.',
-                messageKey: EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS
-            };
-        }
-        // Invalidate existing tokens and create new one
-        await tokenRepository.delete({
-            userId: user.id,
-            type: TokenType.EMAIL_VERIFICATION
-        });
-        const token = this.generateToken();
-        const userToken = tokenRepository.create({
-            userId: user.id,
-            type: TokenType.EMAIL_VERIFICATION,
-            token: this.hashToken(token),
-            expiresAt: new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY)
-        });
-        await tokenRepository.save(userToken);
-        const verifyUrl = `${verifyUrlBase}?token=${token}`;
-        await this.sendVerificationEmailSafe(user.email, token, verifyUrl);
-        return {
-            success: true,
-            message: 'If the email requires verification, a link has been sent.',
-            messageKey: EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS
-        };
-    }
-    constructor(dataSourceProvider, emailProvider){
-        _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "emailProvider", void 0);
-        _define_property(this, "PASSWORD_RESET_EXPIRY", void 0); // 1 hour
-        _define_property(this, "EMAIL_VERIFICATION_EXPIRY", void 0); // 24 hours
-        this.dataSourceProvider = dataSourceProvider;
-        this.emailProvider = emailProvider;
-        this.PASSWORD_RESET_EXPIRY = 60 * 60 * 1000;
-        this.EMAIL_VERIFICATION_EXPIRY = 24 * 60 * 60 * 1000;
-    }
-}
-_ts_decorate([
-    LogAction({
-        action: 'auth.createPendingRegistration',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        Object
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthEmailService.prototype, "createPendingRegistration", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.forgotPassword',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthEmailService.prototype, "forgotPassword", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.resetPassword',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthEmailService.prototype, "resetPassword", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.verifyEmailToken',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthEmailService.prototype, "verifyEmail", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.sendVerificationEmail',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthEmailService.prototype, "resendVerificationEmail", null);
-AuthEmailService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Optional()),
-    _ts_param(0, Inject(AuthDataSourceProvider)),
-    _ts_param(1, Optional()),
-    _ts_param(1, Inject(AUTH_EMAIL_PROVIDER)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
-        typeof IAuthEmailProvider === "undefined" ? Object : IAuthEmailProvider
-    ])
-], AuthEmailService);