@flusys/nestjs-auth 7.1.0 → 8.0.0-beta.1

package/fesm/strategies/jwt.strategy.js

@@ -1,130 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
-import { Injectable, UnauthorizedException } from '@nestjs/common';
-import { ModuleRef } from '@nestjs/core';
-import { PassportStrategy } from '@nestjs/passport';
-import { ExtractJwt, Strategy } from 'passport-jwt';
-import { AUTH_MESSAGES, USER_MESSAGES } from '../config';
-import { AppUser } from '../entities/app-user.entity';
-import { AuthConfigService } from '../services/auth-config.service';
-import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
-import { AuthenticationService } from '../services/authentication.service';
-function hasCompanyContext(payload) {
-    return 'companyId' in payload && payload.companyId != null;
-}
-export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
-    async validate(_req, payload) {
-        const userRepo = await this.resolveUserRepository();
-        await this.checkTokenRevocation(payload);
-        const user = await userRepo.findOne({
-            where: {
-                id: payload.id,
-                isActive: true
-            }
-        });
-        if (!user) {
-            throw new UnauthorizedException({
-                message: 'User not found or inactive',
-                messageKey: USER_MESSAGES.NOT_FOUND
-            });
-        }
-        return this.buildUserInfo(payload);
-    }
-    async resolveUserRepository() {
-        try {
-            const provider = await this.moduleRef.resolve(AuthDataSourceProvider, undefined, {
-                strict: false
-            });
-            if (provider) {
-                return provider.getRepository(AppUser);
-            }
-        } catch  {
-            throw new UnauthorizedException({
-                message: 'Unable to access user data',
-                messageKey: SYSTEM_MESSAGES.SERVICE_NOT_AVAILABLE,
-                messageVariables: {
-                    provider: 'DataSourceProvider',
-                    available: ''
-                }
-            });
-        }
-        throw new UnauthorizedException({
-            message: 'User repository not available',
-            messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-            messageVariables: {
-                entity: 'User'
-            }
-        });
-    }
-    async checkTokenRevocation(payload) {
-        if (!payload.iat) return;
-        try {
-            const authService = await this.moduleRef.resolve(AuthenticationService, undefined, {
-                strict: false
-            });
-            if (authService && await authService.isTokenRevoked(payload.id, payload.iat)) {
-                throw new UnauthorizedException({
-                    message: 'Token has been revoked',
-                    messageKey: AUTH_MESSAGES.TOKEN_REVOKED
-                });
-            }
-        } catch (err) {
-            if (err instanceof UnauthorizedException) throw err;
-        }
-    }
-    buildUserInfo(payload) {
-        const base = {
-            id: payload.id,
-            email: payload.email
-        };
-        if (!hasCompanyContext(payload)) {
-            return base;
-        }
-        return {
-            ...base,
-            companyId: payload.companyId,
-            ...payload.branchId && {
-                branchId: payload.branchId
-            }
-        };
-    }
-    constructor(authConfig, moduleRef){
-        super({
-            jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
-            ignoreExpiration: false,
-            secretOrKeyProvider: (_req, _token, done)=>{
-                done(null, this.authConfig.getJwtSecret());
-            },
-            passReqToCallback: true
-        }), _define_property(this, "authConfig", void 0), _define_property(this, "moduleRef", void 0), this.authConfig = authConfig, this.moduleRef = moduleRef;
-    }
-}
-JwtStrategy = _ts_decorate([
-    Injectable(),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AuthConfigService === "undefined" ? Object : AuthConfigService,
-        typeof ModuleRef === "undefined" ? Object : ModuleRef
-    ])
-], JwtStrategy);

package/fesm/strategies/jwt.strategy.spec.js

@@ -1,162 +0,0 @@
-import { UnauthorizedException } from '@nestjs/common';
-import { createMockRepository } from '@test-utils/mocks/repository.mock';
-import { JwtStrategy } from './jwt.strategy';
-import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
-import { AuthenticationService } from '../services/authentication.service';
-describe('JwtStrategy', ()=>{
-    let strategy;
-    let userRepo;
-    let mockAuthConfig;
-    let mockModuleRef;
-    let mockDataSourceProvider;
-    let mockAuthService;
-    beforeEach(()=>{
-        userRepo = createMockRepository();
-        mockAuthConfig = {
-            getJwtSecret: jest.fn().mockReturnValue('jwt-secret')
-        };
-        mockDataSourceProvider = {
-            getRepository: jest.fn().mockResolvedValue(userRepo)
-        };
-        mockAuthService = {
-            isTokenRevoked: jest.fn().mockResolvedValue(false)
-        };
-        mockModuleRef = {
-            resolve: jest.fn().mockImplementation(async (token)=>{
-                if (token === AuthDataSourceProvider) return mockDataSourceProvider;
-                if (token === AuthenticationService) return mockAuthService;
-                return null;
-            })
-        };
-        strategy = new JwtStrategy(mockAuthConfig, mockModuleRef);
-    });
-    describe('validate', ()=>{
-        const req = {};
-        it('returns basic user info for a payload without company context', async ()=>{
-            userRepo.findOne.mockResolvedValue({
-                id: 'user-1',
-                isActive: true
-            });
-            const result = await strategy.validate(req, {
-                id: 'user-1',
-                email: 'user@example.com',
-                type: 'access'
-            });
-            expect(result).toEqual({
-                id: 'user-1',
-                email: 'user@example.com'
-            });
-        });
-        it('includes companyId and branchId when present in the payload', async ()=>{
-            userRepo.findOne.mockResolvedValue({
-                id: 'user-1',
-                isActive: true
-            });
-            const result = await strategy.validate(req, {
-                id: 'user-1',
-                email: 'user@example.com',
-                type: 'access',
-                companyId: 'company-1',
-                branchId: 'branch-1'
-            });
-            expect(result).toEqual({
-                id: 'user-1',
-                email: 'user@example.com',
-                companyId: 'company-1',
-                branchId: 'branch-1'
-            });
-        });
-        it('omits branchId when only companyId is present', async ()=>{
-            userRepo.findOne.mockResolvedValue({
-                id: 'user-1',
-                isActive: true
-            });
-            const result = await strategy.validate(req, {
-                id: 'user-1',
-                email: 'user@example.com',
-                type: 'access',
-                companyId: 'company-1'
-            });
-            expect(result).toEqual({
-                id: 'user-1',
-                email: 'user@example.com',
-                companyId: 'company-1'
-            });
-        });
-        it('throws UnauthorizedException when the user is not found or inactive', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            await expect(strategy.validate(req, {
-                id: 'missing-user',
-                email: 'x@example.com',
-                type: 'access'
-            })).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws UnauthorizedException when the token has been revoked', async ()=>{
-            userRepo.findOne.mockResolvedValue({
-                id: 'user-1',
-                isActive: true
-            });
-            mockAuthService.isTokenRevoked.mockResolvedValue(true);
-            await expect(strategy.validate(req, {
-                id: 'user-1',
-                email: 'user@example.com',
-                type: 'access',
-                iat: 1000
-            })).rejects.toThrow(UnauthorizedException);
-        });
-        it('skips revocation check when the payload has no iat', async ()=>{
-            userRepo.findOne.mockResolvedValue({
-                id: 'user-1',
-                isActive: true
-            });
-            await strategy.validate(req, {
-                id: 'user-1',
-                email: 'user@example.com',
-                type: 'access'
-            });
-            expect(mockAuthService.isTokenRevoked).not.toHaveBeenCalled();
-        });
-        it('throws UnauthorizedException when the data source provider cannot be resolved', async ()=>{
-            mockModuleRef.resolve.mockImplementation(async (token)=>{
-                if (token === AuthDataSourceProvider) return null;
-                return mockAuthService;
-            });
-            await expect(strategy.validate(req, {
-                id: 'user-1',
-                email: 'user@example.com',
-                type: 'access'
-            })).rejects.toThrow(UnauthorizedException);
-        });
-        it('propagates an UnauthorizedException raised while resolving the data source provider', async ()=>{
-            mockModuleRef.resolve.mockImplementation(async (token)=>{
-                if (token === AuthDataSourceProvider) throw new Error('resolution failed');
-                return mockAuthService;
-            });
-            await expect(strategy.validate(req, {
-                id: 'user-1',
-                email: 'user@example.com',
-                type: 'access'
-            })).rejects.toThrow(UnauthorizedException);
-        });
-        it('does not fail validation when the authentication service cannot be resolved for revocation checks', async ()=>{
-            userRepo.findOne.mockResolvedValue({
-                id: 'user-1',
-                isActive: true
-            });
-            mockModuleRef.resolve.mockImplementation(async (token)=>{
-                if (token === AuthDataSourceProvider) return mockDataSourceProvider;
-                return null;
-            });
-            const result = await strategy.validate(req, {
-                id: 'user-1',
-                email: 'user@example.com',
-                type: 'access',
-                iat: 1000
-            });
-            expect(result).toEqual({
-                id: 'user-1',
-                email: 'user@example.com'
-            });
-        });
-    });
-});

package/fesm/validators/password.validator.js

@@ -1,48 +0,0 @@
-import { registerDecorator } from 'class-validator';
-/**
- * Strong password validation decorator.
- * Validates that passwords meet complexity requirements to prevent weak passwords.
- *
- * @example
- * ```typescript
- * @IsStrongPassword()
- * password!: string;
- *
- * // With custom options
- * @IsStrongPassword({ minLength: 12, requireSpecialChar: false })
- * password!: string;
- * ```
- */ export function IsStrongPassword(options = {}, validationOptions) {
-    const { minLength = 8, maxLength = 128, requireUppercase = true, requireLowercase = true, requireNumber = true, requireSpecialChar = true } = options;
-    return function(object, propertyName) {
-        registerDecorator({
-            name: 'isStrongPassword',
-            target: object.constructor,
-            propertyName: propertyName,
-            options: validationOptions,
-            validator: {
-                validate (value) {
-                    if (typeof value !== 'string') return false;
-                    const checks = [
-                        value.length >= minLength,
-                        value.length <= maxLength,
-                        !requireUppercase || /[A-Z]/.test(value),
-                        !requireLowercase || /[a-z]/.test(value),
-                        !requireNumber || /[0-9]/.test(value),
-                        !requireSpecialChar || /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?~`]/.test(value)
-                    ];
-                    return checks.every(Boolean);
-                },
-                defaultMessage (args) {
-                    const requirements = [];
-                    if (minLength > 0) requirements.push(`at least ${minLength} characters`);
-                    if (requireUppercase) requirements.push('one uppercase letter');
-                    if (requireLowercase) requirements.push('one lowercase letter');
-                    if (requireNumber) requirements.push('one number');
-                    if (requireSpecialChar) requirements.push('one special character (!@#$%^&*...)');
-                    return `Password must contain ${requirements.join(', ')}`;
-                }
-            }
-        });
-    };
-}

package/fesm/validators/password.validator.spec.js

@@ -1,157 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-import { validate } from 'class-validator';
-import { IsStrongPassword } from './password.validator';
-let DefaultPasswordDto = class DefaultPasswordDto {
-    constructor(){
-        _define_property(this, "password", void 0);
-    }
-};
-_ts_decorate([
-    IsStrongPassword(),
-    _ts_metadata("design:type", String)
-], DefaultPasswordDto.prototype, "password", void 0);
-let CustomPasswordDto = class CustomPasswordDto {
-    constructor(){
-        _define_property(this, "password", void 0);
-    }
-};
-_ts_decorate([
-    IsStrongPassword({
-        minLength: 12,
-        requireSpecialChar: false
-    }),
-    _ts_metadata("design:type", String)
-], CustomPasswordDto.prototype, "password", void 0);
-let NoComplexityPasswordDto = class NoComplexityPasswordDto {
-    constructor(){
-        _define_property(this, "password", void 0);
-    }
-};
-_ts_decorate([
-    IsStrongPassword({
-        requireUppercase: false,
-        requireLowercase: false,
-        requireNumber: false,
-        requireSpecialChar: false,
-        minLength: 4
-    }),
-    _ts_metadata("design:type", String)
-], NoComplexityPasswordDto.prototype, "password", void 0);
-async function validatePassword(dto) {
-    const errors = await validate(dto);
-    return errors.length === 0;
-}
-describe('IsStrongPassword', ()=>{
-    describe('default options', ()=>{
-        it('accepts a password meeting all default complexity rules', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'StrongP@ss1';
-            expect(await validatePassword(dto)).toBe(true);
-        });
-        it('rejects a password shorter than the minimum length', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'Sh0rt!';
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('accepts a password at exactly the minimum length boundary', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'Ab1!Ab1!'; // 8 chars
-            expect(await validatePassword(dto)).toBe(true);
-        });
-        it('rejects a password longer than the maximum length', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'A1!' + 'a'.repeat(127); // 130 chars total
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('accepts a password at exactly the maximum length boundary', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'A1!' + 'a'.repeat(125); // 128 chars total
-            expect(await validatePassword(dto)).toBe(true);
-        });
-        it('rejects a password missing an uppercase letter', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'lowercase1!';
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('rejects a password missing a lowercase letter', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'UPPERCASE1!';
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('rejects a password missing a number', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'NoNumbers!';
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('rejects a password missing a special character', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'NoSpecial1';
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('rejects a non-string value', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 12345678;
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('rejects an empty string', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = '';
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('produces a descriptive default error message', async ()=>{
-            const dto = new DefaultPasswordDto();
-            dto.password = 'bad';
-            const errors = await validate(dto);
-            expect(errors).toHaveLength(1);
-            const message = Object.values(errors[0].constraints ?? {})[0];
-            expect(message).toContain('at least 8 characters');
-            expect(message).toContain('one uppercase letter');
-            expect(message).toContain('one lowercase letter');
-            expect(message).toContain('one number');
-            expect(message).toContain('one special character');
-        });
-    });
-    describe('custom options', ()=>{
-        it('enforces a custom minimum length', async ()=>{
-            const dto = new CustomPasswordDto();
-            dto.password = 'Short1Aa';
-            expect(await validatePassword(dto)).toBe(false);
-        });
-        it('accepts a password without special chars when requireSpecialChar is false', async ()=>{
-            const dto = new CustomPasswordDto();
-            dto.password = 'LongEnoughPassword1';
-            expect(await validatePassword(dto)).toBe(true);
-        });
-        it('allows fully relaxed complexity requirements', async ()=>{
-            const dto = new NoComplexityPasswordDto();
-            dto.password = 'abcd';
-            expect(await validatePassword(dto)).toBe(true);
-        });
-        it('still enforces minLength when complexity checks are disabled', async ()=>{
-            const dto = new NoComplexityPasswordDto();
-            dto.password = 'abc';
-            expect(await validatePassword(dto)).toBe(false);
-        });
-    });
-});