@lenne.tech/nest-server 11.43.3 → 12.0.0

package/dist/core/modules/better-auth/core-better-auth.controller.js

@@ -1,4 +1,3 @@
-"use strict";
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -12,39 +11,37 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var CoreBetterAuthController_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoreBetterAuthController = exports.CoreBetterAuthSignUpInput = exports.CoreBetterAuthSignInInput = exports.CoreBetterAuthResponse = exports.CoreBetterAuthUserResponse = exports.CoreBetterAuthSessionInfo = void 0;
-const common_1 = require("@nestjs/common");
-const swagger_1 = require("@nestjs/swagger");
-const class_validator_1 = require("class-validator");
-const roles_decorator_1 = require("../../common/decorators/roles.decorator");
-const role_enum_1 = require("../../common/enums/role.enum");
-const cookies_helper_1 = require("../../common/helpers/cookies.helper");
-const logging_helper_1 = require("../../common/helpers/logging.helper");
-const config_service_1 = require("../../common/services/config.service");
-const error_codes_1 = require("../error-code/error-codes");
-const better_auth_types_1 = require("./better-auth.types");
-const core_better_auth_cookie_helper_1 = require("./core-better-auth-cookie.helper");
-const core_better_auth_email_verification_service_1 = require("./core-better-auth-email-verification.service");
-const core_better_auth_signup_validator_service_1 = require("./core-better-auth-signup-validator.service");
-const core_better_auth_token_helper_1 = require("./core-better-auth-token.helper");
-const core_better_auth_user_mapper_1 = require("./core-better-auth-user.mapper");
-const core_better_auth_web_helper_1 = require("./core-better-auth-web.helper");
-const core_better_auth_service_1 = require("./core-better-auth.service");
-class CoreBetterAuthSessionInfo {
+import { All, BadRequestException, Body, Controller, ForbiddenException, Get, HttpCode, HttpException, HttpStatus, InternalServerErrorException, Logger, Optional, Post, Req, Res, UnauthorizedException, } from '@nestjs/common';
+import { ApiBody, ApiCreatedResponse, ApiExcludeEndpoint, ApiOkResponse, ApiOperation, ApiProperty, ApiTags, } from '@nestjs/swagger';
+import { IsBoolean, IsEmail, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { isCookiesEnabled, isExposeTokenInBodyEnabled } from '../../common/helpers/cookies.helper.js';
+import { maskEmail, maskToken } from '../../common/helpers/logging.helper.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { hasSession, hasUser, requires2FA, sessionTokenFromResponse, } from './better-auth.types.js';
+import { createCookieHelper } from './core-better-auth-cookie.helper.js';
+import { CoreBetterAuthEmailVerificationService } from './core-better-auth-email-verification.service.js';
+import { CoreBetterAuthSignUpValidatorService } from './core-better-auth-signup-validator.service.js';
+import { isJwtShaped, isSessionToken } from './core-better-auth-token.helper.js';
+import { CoreBetterAuthUserMapper } from './core-better-auth-user.mapper.js';
+import { convertExpressHeaders, sendWebResponse, toWebRequest } from './core-better-auth-web.helper.js';
+import { CoreBetterAuthService } from './core-better-auth.service.js';
+import { registerBetterAuthHandlerClass } from './core-better-auth.registry.js';
+export class CoreBetterAuthSessionInfo {
     expiresAt;
     id;
 }
-exports.CoreBetterAuthSessionInfo = CoreBetterAuthSessionInfo;
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Session expiration time' }),
+    ApiProperty({ description: 'Session expiration time' }),
     __metadata("design:type", String)
 ], CoreBetterAuthSessionInfo.prototype, "expiresAt", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Session ID' }),
+    ApiProperty({ description: 'Session ID' }),
     __metadata("design:type", String)
 ], CoreBetterAuthSessionInfo.prototype, "id", void 0);
-class CoreBetterAuthUserResponse {
+export class CoreBetterAuthUserResponse {
     email;
     emailVerified;
     id;
@@ -52,25 +49,24 @@ class CoreBetterAuthUserResponse {
     roles;
     twoFactorEnabled;
 }
-exports.CoreBetterAuthUserResponse = CoreBetterAuthUserResponse;
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'User email address' }),
+    ApiProperty({ description: 'User email address' }),
     __metadata("design:type", String)
 ], CoreBetterAuthUserResponse.prototype, "email", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Whether email is verified' }),
+    ApiProperty({ description: 'Whether email is verified' }),
     __metadata("design:type", Boolean)
 ], CoreBetterAuthUserResponse.prototype, "emailVerified", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'User ID from Better-Auth' }),
+    ApiProperty({ description: 'User ID from Better-Auth' }),
     __metadata("design:type", String)
 ], CoreBetterAuthUserResponse.prototype, "id", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'User display name' }),
+    ApiProperty({ description: 'User display name' }),
     __metadata("design:type", String)
 ], CoreBetterAuthUserResponse.prototype, "name", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({
+    ApiProperty({
         description: 'Roles of the user (e.g. ["admin"]) — populated from the synced legacy user.',
         isArray: true,
         required: false,
@@ -79,10 +75,10 @@ __decorate([
     __metadata("design:type", Array)
 ], CoreBetterAuthUserResponse.prototype, "roles", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Whether 2FA is enabled', required: false }),
+    ApiProperty({ description: 'Whether 2FA is enabled', required: false }),
     __metadata("design:type", Boolean)
 ], CoreBetterAuthUserResponse.prototype, "twoFactorEnabled", void 0);
-class CoreBetterAuthResponse {
+export class CoreBetterAuthResponse {
     emailVerificationRequired;
     error;
     requiresTwoFactor;
@@ -91,81 +87,78 @@ class CoreBetterAuthResponse {
     token;
     user;
 }
-exports.CoreBetterAuthResponse = CoreBetterAuthResponse;
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Whether email verification is required before login', required: false }),
+    ApiProperty({ description: 'Whether email verification is required before login', required: false }),
     __metadata("design:type", Boolean)
 ], CoreBetterAuthResponse.prototype, "emailVerificationRequired", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Error message if failed', required: false }),
+    ApiProperty({ description: 'Error message if failed', required: false }),
     __metadata("design:type", String)
 ], CoreBetterAuthResponse.prototype, "error", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Whether 2FA is required', required: false }),
+    ApiProperty({ description: 'Whether 2FA is required', required: false }),
     __metadata("design:type", Boolean)
 ], CoreBetterAuthResponse.prototype, "requiresTwoFactor", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Session information', required: false, type: CoreBetterAuthSessionInfo }),
+    ApiProperty({ description: 'Session information', required: false, type: CoreBetterAuthSessionInfo }),
     __metadata("design:type", CoreBetterAuthSessionInfo)
 ], CoreBetterAuthResponse.prototype, "session", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Whether operation succeeded' }),
+    ApiProperty({ description: 'Whether operation succeeded' }),
     __metadata("design:type", Boolean)
 ], CoreBetterAuthResponse.prototype, "success", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'JWT token (if JWT plugin enabled)', required: false }),
+    ApiProperty({ description: 'JWT token (if JWT plugin enabled)', required: false }),
     __metadata("design:type", String)
 ], CoreBetterAuthResponse.prototype, "token", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'User information', required: false, type: CoreBetterAuthUserResponse }),
+    ApiProperty({ description: 'User information', required: false, type: CoreBetterAuthUserResponse }),
     __metadata("design:type", CoreBetterAuthUserResponse)
 ], CoreBetterAuthResponse.prototype, "user", void 0);
-class CoreBetterAuthSignInInput {
+export class CoreBetterAuthSignInInput {
     email;
     password;
 }
-exports.CoreBetterAuthSignInInput = CoreBetterAuthSignInInput;
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'User email address', example: 'user@example.com' }),
-    (0, class_validator_1.IsNotEmpty)(),
-    (0, class_validator_1.IsEmail)(),
+    ApiProperty({ description: 'User email address', example: 'user@example.com' }),
+    IsNotEmpty(),
+    IsEmail(),
     __metadata("design:type", String)
 ], CoreBetterAuthSignInInput.prototype, "email", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'User password' }),
-    (0, class_validator_1.IsNotEmpty)(),
-    (0, class_validator_1.IsString)(),
+    ApiProperty({ description: 'User password' }),
+    IsNotEmpty(),
+    IsString(),
     __metadata("design:type", String)
 ], CoreBetterAuthSignInInput.prototype, "password", void 0);
-class CoreBetterAuthSignUpInput {
+export class CoreBetterAuthSignUpInput {
     email;
     name;
     password;
     termsAndPrivacyAccepted;
 }
-exports.CoreBetterAuthSignUpInput = CoreBetterAuthSignUpInput;
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'User email address', example: 'user@example.com' }),
-    (0, class_validator_1.IsNotEmpty)(),
-    (0, class_validator_1.IsEmail)(),
+    ApiProperty({ description: 'User email address', example: 'user@example.com' }),
+    IsNotEmpty(),
+    IsEmail(),
     __metadata("design:type", String)
 ], CoreBetterAuthSignUpInput.prototype, "email", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Display name', example: 'John Doe', required: false }),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
+    ApiProperty({ description: 'Display name', example: 'John Doe', required: false }),
+    IsOptional(),
+    IsString(),
     __metadata("design:type", String)
 ], CoreBetterAuthSignUpInput.prototype, "name", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'User password (min 8 characters)' }),
-    (0, class_validator_1.IsNotEmpty)(),
-    (0, class_validator_1.IsString)(),
+    ApiProperty({ description: 'User password (min 8 characters)' }),
+    IsNotEmpty(),
+    IsString(),
     __metadata("design:type", String)
 ], CoreBetterAuthSignUpInput.prototype, "password", void 0);
 __decorate([
-    (0, swagger_1.ApiProperty)({ description: 'Whether user accepted terms and privacy policy', required: false }),
-    (0, class_validator_1.IsBoolean)(),
-    (0, class_validator_1.IsOptional)(),
+    ApiProperty({ description: 'Whether user accepted terms and privacy policy', required: false }),
+    IsBoolean(),
+    IsOptional(),
     __metadata("design:type", Boolean)
 ], CoreBetterAuthSignUpInput.prototype, "termsAndPrivacyAccepted", void 0);
 let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuthController {
@@ -174,7 +167,7 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
     configService;
     signUpValidator;
     emailVerificationService;
-    logger = new common_1.Logger(CoreBetterAuthController_1.name);
+    logger = new Logger(CoreBetterAuthController_1.name);
     cookieHelper;
     constructor(betterAuthService, userMapper, configService, signUpValidator, emailVerificationService) {
         this.betterAuthService = betterAuthService;
@@ -185,7 +178,7 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
         const jwtConfig = this.configService.getFastButReadOnly('jwt');
         const legacyAuthEnabled = !!(jwtConfig?.secret || jwtConfig?.secretOrPrivateKey);
         const betterAuthConfig = this.betterAuthService.getConfig();
-        this.cookieHelper = (0, core_better_auth_cookie_helper_1.createCookieHelper)(this.betterAuthService.getBasePath(), {
+        this.cookieHelper = createCookieHelper(this.betterAuthService.getBasePath(), {
             domain: this.betterAuthService.getCookieDomain(),
             env: this.configService.getFastButReadOnly('env'),
             legacyCookieEnabled: legacyAuthEnabled,
@@ -212,16 +205,16 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
     async signIn(req, res, input) {
         this.ensureEnabled();
         if (!input) {
-            throw new common_1.BadRequestException('Missing input');
+            throw new BadRequestException('Missing input');
         }
         const api = this.betterAuthService.getApi();
         if (!api) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
+            throw new BadRequestException(ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
         }
         try {
             const migrated = await this.userMapper.migrateAccountToIam(input.email, input.password);
             if (migrated) {
-                this.logger.debug(`Migrated legacy user ${(0, logging_helper_1.maskEmail)(input.email)} to IAM`);
+                this.logger.debug(`Migrated legacy user ${maskEmail(input.email)} to IAM`);
             }
         }
         catch (error) {
@@ -238,14 +231,14 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
                 request: this.csrfCheckedRequest(req ?? res?.req, '/sign-in/email'),
             }));
             if (!response) {
-                throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_CREDENTIALS);
+                throw new UnauthorizedException(ErrorCode.INVALID_CREDENTIALS);
             }
-            if ((0, better_auth_types_1.requires2FA)(response)) {
+            if (requires2FA(response)) {
                 await this.checkEmailVerificationByEmail(input.email);
-                this.logger.debug(`2FA required for ${(0, logging_helper_1.maskEmail)(input.email)}, forwarding to native handler for cookie handling`);
+                this.logger.debug(`2FA required for ${maskEmail(input.email)}, forwarding to native handler for cookie handling`);
                 const authInstance = this.betterAuthService.getInstance();
                 if (!authInstance) {
-                    throw new common_1.InternalServerErrorException(error_codes_1.ErrorCode.BETTERAUTH_NOT_INITIALIZED);
+                    throw new InternalServerErrorException(ErrorCode.BETTERAUTH_NOT_INITIALIZED);
                 }
                 const modifiedBody = JSON.stringify({
                     email: input.email,
@@ -274,48 +267,48 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
             }
             const responseAny = response;
             if (responseAny?.error || responseAny?.code === 'CREDENTIAL_ACCOUNT_NOT_FOUND') {
-                throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_CREDENTIALS);
+                throw new UnauthorizedException(ErrorCode.INVALID_CREDENTIALS);
             }
-            if ((0, better_auth_types_1.hasUser)(response)) {
+            if (hasUser(response)) {
                 this.checkEmailVerification(response.user);
                 await this.userMapper.linkOrCreateUser(response.user);
                 const mappedUser = await this.userMapper.mapSessionUser(response.user);
-                const rawToken = responseAny.accessToken || responseAny.token || ((0, better_auth_types_1.hasSession)(response) ? response.session.token : undefined);
+                const rawToken = responseAny.accessToken || responseAny.token || (hasSession(response) ? response.session.token : undefined);
                 const token = await this.resolveJwtToken(rawToken);
                 const sessionToken = this.sessionTokenForCookie(response);
                 const result = {
                     requiresTwoFactor: false,
-                    session: (0, better_auth_types_1.hasSession)(response) ? this.mapSession(response.session) : undefined,
+                    session: hasSession(response) ? this.mapSession(response.session) : undefined,
                     success: true,
                     token,
                     user: mappedUser ? this.mapUser(response.user, mappedUser) : undefined,
                 };
                 return this.processCookies(res, result, sessionToken);
             }
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_CREDENTIALS);
+            throw new UnauthorizedException(ErrorCode.INVALID_CREDENTIALS);
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
             this.logger.debug(`Sign-in error: ${errorMessage}`);
-            if (error instanceof common_1.UnauthorizedException) {
+            if (error instanceof UnauthorizedException) {
                 throw error;
             }
             this.rethrowCsrfRefusal(error, 'sign-in');
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_CREDENTIALS);
+            throw new UnauthorizedException(ErrorCode.INVALID_CREDENTIALS);
         }
     }
     async signUp(res, input) {
         this.ensureEnabled();
         this.betterAuthService.ensureSignUpEnabled();
         if (!input) {
-            throw new common_1.BadRequestException('Missing input');
+            throw new BadRequestException('Missing input');
         }
         if (this.signUpValidator) {
             this.signUpValidator.validateSignUpInput({ termsAndPrivacyAccepted: input.termsAndPrivacyAccepted });
         }
         const api = this.betterAuthService.getApi();
         if (!api) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
+            throw new BadRequestException(ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
         }
         const normalizedPassword = this.userMapper.normalizePasswordForIam(input.password);
         try {
@@ -329,24 +322,24 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
                 request: this.csrfCheckedRequest(res?.req, '/sign-up/email'),
             });
             if (!response) {
-                throw new common_1.BadRequestException(error_codes_1.ErrorCode.SIGNUP_FAILED);
+                throw new BadRequestException(ErrorCode.SIGNUP_FAILED);
             }
-            if ((0, better_auth_types_1.hasUser)(response)) {
+            if (hasUser(response)) {
                 await this.userMapper.linkOrCreateUser(response.user, {
                     termsAndPrivacyAccepted: input.termsAndPrivacyAccepted,
                 });
                 await this.userMapper.syncPasswordToLegacy(response.user.id, response.user.email, input.password);
                 const mappedUser = await this.userMapper.mapSessionUser(response.user);
                 const responseAny = response;
-                const rawToken = responseAny.accessToken || responseAny.token || ((0, better_auth_types_1.hasSession)(response) ? response.session.token : undefined);
+                const rawToken = responseAny.accessToken || responseAny.token || (hasSession(response) ? response.session.token : undefined);
                 const token = await this.resolveJwtToken(rawToken);
                 if (this.emailVerificationService?.isEnabled()) {
-                    const sessionToken = (0, better_auth_types_1.sessionTokenFromResponse)(response);
+                    const sessionToken = sessionTokenFromResponse(response);
                     if (sessionToken) {
                         await this.betterAuthService.revokeSession(sessionToken);
                     }
                     this.clearAuthCookies(res);
-                    this.logger.debug(`[SignUp] Email verification required for ${(0, logging_helper_1.maskEmail)(response.user.email)}, session revoked`);
+                    this.logger.debug(`[SignUp] Email verification required for ${maskEmail(response.user.email)}, session revoked`);
                     return {
                         emailVerificationRequired: true,
                         requiresTwoFactor: false,
@@ -356,23 +349,23 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
                 }
                 const result = {
                     requiresTwoFactor: false,
-                    session: (0, better_auth_types_1.hasSession)(response) ? this.mapSession(response.session) : undefined,
+                    session: hasSession(response) ? this.mapSession(response.session) : undefined,
                     success: true,
                     token,
                     user: mappedUser ? this.mapUser(response.user, mappedUser) : undefined,
                 };
                 return this.processCookies(res, result, this.sessionTokenForCookie(response));
             }
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.SIGNUP_FAILED);
+            throw new BadRequestException(ErrorCode.SIGNUP_FAILED);
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
             this.logger.debug(`Sign-up error: ${errorMessage}`);
             this.rethrowCsrfRefusal(error, 'sign-up');
             if (errorMessage.includes('already exists')) {
-                throw new common_1.BadRequestException(error_codes_1.ErrorCode.EMAIL_ALREADY_EXISTS);
+                throw new BadRequestException(ErrorCode.EMAIL_ALREADY_EXISTS);
             }
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.SIGNUP_FAILED);
+            throw new BadRequestException(ErrorCode.SIGNUP_FAILED);
         }
     }
     csrfCheckedRequest(req, path) {
@@ -401,7 +394,7 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
         if (code && ['CROSS_SITE_NAVIGATION_LOGIN_BLOCKED', 'INVALID_ORIGIN', 'MISSING_OR_NULL_ORIGIN'].includes(code)) {
             this.logger.warn(`Refused ${action}: ${code} (Better-Auth CSRF protection). If this is your own frontend, add its origin to ` +
                 'cors.allowedOrigins — an explicit betterAuth.trustedOrigins replaces the derived list.');
-            throw new common_1.ForbiddenException(error_codes_1.ErrorCode.ACCESS_DENIED);
+            throw new ForbiddenException(ErrorCode.ACCESS_DENIED);
         }
     }
     async signOut(req, res) {
@@ -448,13 +441,13 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
     }
     ensureEnabled() {
         if (!this.betterAuthService.isEnabled()) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.BETTERAUTH_DISABLED);
+            throw new BadRequestException(ErrorCode.BETTERAUTH_DISABLED);
         }
     }
     checkEmailVerification(sessionUser) {
         if (this.emailVerificationService?.isEnabled() && !sessionUser.emailVerified) {
-            this.logger.debug(`[SignIn] Email not verified for ${(0, logging_helper_1.maskEmail)(sessionUser.email)}, blocking login`);
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.EMAIL_VERIFICATION_REQUIRED);
+            this.logger.debug(`[SignIn] Email not verified for ${maskEmail(sessionUser.email)}, blocking login`);
+            throw new UnauthorizedException(ErrorCode.EMAIL_VERIFICATION_REQUIRED);
         }
     }
     async checkEmailVerificationByEmail(email) {
@@ -463,15 +456,15 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
         }
         const verified = await this.betterAuthService.isUserEmailVerified(email);
         if (verified === false) {
-            this.logger.debug(`[SignIn/2FA] Email not verified for ${(0, logging_helper_1.maskEmail)(email)}, blocking login`);
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.EMAIL_VERIFICATION_REQUIRED);
+            this.logger.debug(`[SignIn/2FA] Email not verified for ${maskEmail(email)}, blocking login`);
+            throw new UnauthorizedException(ErrorCode.EMAIL_VERIFICATION_REQUIRED);
         }
     }
     extractSessionToken(req) {
         const authHeader = req.headers.authorization;
         if (authHeader?.startsWith('Bearer ')) {
             const bearerToken = authHeader.substring(7);
-            if ((0, core_better_auth_token_helper_1.isSessionToken)(bearerToken)) {
+            if (isSessionToken(bearerToken)) {
                 return bearerToken;
             }
         }
@@ -479,7 +472,7 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
         return req.cookies?.[cookieName] || req.cookies?.['token'] || null;
     }
     extractHeaders(req) {
-        return (0, core_better_auth_web_helper_1.convertExpressHeaders)(req.headers);
+        return convertExpressHeaders(req.headers);
     }
     mapSession(session) {
         if (!session)
@@ -499,13 +492,13 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
         };
     }
     sessionTokenForCookie(response) {
-        const resolved = (0, better_auth_types_1.sessionTokenFromResponse)(response);
-        return (0, core_better_auth_token_helper_1.isJwtShaped)(resolved) ? undefined : resolved;
+        const resolved = sessionTokenFromResponse(response);
+        return isJwtShaped(resolved) ? undefined : resolved;
     }
     processCookies(res, result, sessionToken) {
         const cookiesConfig = this.configService.getFastButReadOnly('cookies');
-        const cookiesEnabled = (0, cookies_helper_1.isCookiesEnabled)(cookiesConfig);
-        const exposeTokenInBody = (0, cookies_helper_1.isExposeTokenInBodyEnabled)(cookiesConfig);
+        const cookiesEnabled = isCookiesEnabled(cookiesConfig);
+        const exposeTokenInBody = isExposeTokenInBodyEnabled(cookiesConfig);
         if (sessionToken && cookiesEnabled) {
             this.cookieHelper.setSessionCookies(res, sessionToken, result.session?.id);
             if (!exposeTokenInBody && result.token) {
@@ -522,14 +515,14 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
         this.ensureEnabled();
         const authInstance = this.betterAuthService.getInstance();
         if (!authInstance) {
-            throw new common_1.InternalServerErrorException(error_codes_1.ErrorCode.BETTERAUTH_NOT_INITIALIZED);
+            throw new InternalServerErrorException(ErrorCode.BETTERAUTH_NOT_INITIALIZED);
         }
         this.logger.debug(`Forwarding to Better Auth: ${req.method} ${req.path}`);
         try {
             const sessionToken = this.getSessionTokenFromRequest(req);
-            this.logger.debug(`Session token for forwarding: ${(0, logging_helper_1.maskToken)(sessionToken)}`);
+            this.logger.debug(`Session token for forwarding: ${maskToken(sessionToken)}`);
             const config = this.betterAuthService.getConfig();
-            const webRequest = await (0, core_better_auth_web_helper_1.toWebRequest)(req, {
+            const webRequest = await toWebRequest(req, {
                 basePath: this.betterAuthService.getBasePath(),
                 baseUrl: this.betterAuthService.getBaseUrl(),
                 logger: this.logger,
@@ -538,14 +531,14 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
             });
             const response = await authInstance.handler(webRequest);
             this.logger.debug(`Better Auth handler response status: ${response.status}`);
-            await (0, core_better_auth_web_helper_1.sendWebResponse)(res, response);
+            await sendWebResponse(res, response);
         }
         catch (error) {
             this.logger.error(`Better Auth handler error: ${error instanceof Error ? error.message : 'Unknown error'}`);
-            if (error instanceof common_1.HttpException) {
+            if (error instanceof HttpException) {
                 throw error;
             }
-            throw new common_1.InternalServerErrorException('Authentication handler error');
+            throw new InternalServerErrorException('Authentication handler error');
         }
     }
     getSessionTokenFromRequest(req) {
@@ -556,92 +549,93 @@ let CoreBetterAuthController = CoreBetterAuthController_1 = class CoreBetterAuth
         return this.extractSessionToken(req);
     }
 };
-exports.CoreBetterAuthController = CoreBetterAuthController;
 __decorate([
-    (0, swagger_1.ApiOkResponse)({ description: 'Better-Auth feature flags' }),
-    (0, swagger_1.ApiOperation)({
+    ApiOkResponse({ description: 'Better-Auth feature flags' }),
+    ApiOperation({
         description: 'Get enabled Better-Auth features for client-side feature detection',
         summary: 'Get Features',
     }),
-    (0, common_1.Get)('features'),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
+    Get('features'),
+    Roles(RoleEnum.S_EVERYONE),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Object)
 ], CoreBetterAuthController.prototype, "getFeatures", null);
 __decorate([
-    (0, swagger_1.ApiBody)({ type: CoreBetterAuthSignInInput }),
-    (0, swagger_1.ApiCreatedResponse)({ description: 'Signed in successfully', type: CoreBetterAuthResponse }),
-    (0, swagger_1.ApiOperation)({ description: 'Sign in via Better-Auth with email and password', summary: 'Sign In' }),
-    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
-    (0, common_1.Post)('sign-in/email'),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Res)({ passthrough: true })),
-    __param(2, (0, common_1.Body)()),
+    ApiBody({ type: CoreBetterAuthSignInInput }),
+    ApiCreatedResponse({ description: 'Signed in successfully', type: CoreBetterAuthResponse }),
+    ApiOperation({ description: 'Sign in via Better-Auth with email and password', summary: 'Sign In' }),
+    HttpCode(HttpStatus.OK),
+    Post('sign-in/email'),
+    Roles(RoleEnum.S_EVERYONE),
+    __param(0, Req()),
+    __param(1, Res({ passthrough: true })),
+    __param(2, Body()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object, CoreBetterAuthSignInInput]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthController.prototype, "signIn", null);
 __decorate([
-    (0, swagger_1.ApiBody)({ type: CoreBetterAuthSignUpInput }),
-    (0, swagger_1.ApiCreatedResponse)({ description: 'Signed up successfully', type: CoreBetterAuthResponse }),
-    (0, swagger_1.ApiOperation)({ description: 'Sign up via Better-Auth with email and password', summary: 'Sign Up' }),
-    (0, common_1.Post)('sign-up/email'),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
-    __param(0, (0, common_1.Res)({ passthrough: true })),
-    __param(1, (0, common_1.Body)()),
+    ApiBody({ type: CoreBetterAuthSignUpInput }),
+    ApiCreatedResponse({ description: 'Signed up successfully', type: CoreBetterAuthResponse }),
+    ApiOperation({ description: 'Sign up via Better-Auth with email and password', summary: 'Sign Up' }),
+    Post('sign-up/email'),
+    Roles(RoleEnum.S_EVERYONE),
+    __param(0, Res({ passthrough: true })),
+    __param(1, Body()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, CoreBetterAuthSignUpInput]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthController.prototype, "signUp", null);
 __decorate([
-    (0, swagger_1.ApiOkResponse)({ description: 'Signed out successfully', type: CoreBetterAuthResponse }),
-    (0, swagger_1.ApiOperation)({ description: 'Sign out from Better-Auth', summary: 'Sign Out' }),
-    (0, common_1.Post)('sign-out'),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Res)({ passthrough: true })),
+    ApiOkResponse({ description: 'Signed out successfully', type: CoreBetterAuthResponse }),
+    ApiOperation({ description: 'Sign out from Better-Auth', summary: 'Sign Out' }),
+    Post('sign-out'),
+    Roles(RoleEnum.S_EVERYONE),
+    __param(0, Req()),
+    __param(1, Res({ passthrough: true })),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthController.prototype, "signOut", null);
 __decorate([
-    (0, swagger_1.ApiOkResponse)({ description: 'Current session', type: CoreBetterAuthResponse }),
-    (0, swagger_1.ApiOperation)({ description: 'Get current session from Better-Auth', summary: 'Get Session' }),
-    (0, common_1.Get)('session'),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
-    __param(0, (0, common_1.Req)()),
+    ApiOkResponse({ description: 'Current session', type: CoreBetterAuthResponse }),
+    ApiOperation({ description: 'Get current session from Better-Auth', summary: 'Get Session' }),
+    Get('session'),
+    Roles(RoleEnum.S_EVERYONE),
+    __param(0, Req()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthController.prototype, "getSession", null);
 __decorate([
-    (0, common_1.All)('*path'),
-    (0, swagger_1.ApiExcludeEndpoint)(),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
-    __param(0, (0, common_1.Req)()),
-    __param(1, (0, common_1.Res)()),
+    All('*path'),
+    ApiExcludeEndpoint(),
+    Roles(RoleEnum.S_EVERYONE),
+    __param(0, Req()),
+    __param(1, Res()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthController.prototype, "handlePluginRoutes", null);
 __decorate([
-    (0, swagger_1.ApiExcludeEndpoint)(),
+    ApiExcludeEndpoint(),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthController.prototype, "handleBetterAuthPlugins", null);
-exports.CoreBetterAuthController = CoreBetterAuthController = CoreBetterAuthController_1 = __decorate([
-    (0, swagger_1.ApiTags)('Better-Auth'),
-    (0, common_1.Controller)('iam'),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.ADMIN),
-    __param(3, (0, common_1.Optional)()),
-    __param(4, (0, common_1.Optional)()),
-    __metadata("design:paramtypes", [core_better_auth_service_1.CoreBetterAuthService,
-        core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-        config_service_1.ConfigService,
-        core_better_auth_signup_validator_service_1.CoreBetterAuthSignUpValidatorService,
-        core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService])
+CoreBetterAuthController = CoreBetterAuthController_1 = __decorate([
+    ApiTags('Better-Auth'),
+    Controller('iam'),
+    Roles(RoleEnum.ADMIN),
+    __param(3, Optional()),
+    __param(4, Optional()),
+    __metadata("design:paramtypes", [CoreBetterAuthService,
+        CoreBetterAuthUserMapper,
+        ConfigService,
+        CoreBetterAuthSignUpValidatorService,
+        CoreBetterAuthEmailVerificationService])
 ], CoreBetterAuthController);
+export { CoreBetterAuthController };
+registerBetterAuthHandlerClass(CoreBetterAuthController);
 //# sourceMappingURL=core-better-auth.controller.js.map