@lenne.tech/nest-server 11.43.3 → 12.1.0

package/dist/core/modules/better-auth/core-better-auth.resolver.js

@@ -1,4 +1,3 @@
-"use strict";
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -12,29 +11,28 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var CoreBetterAuthResolver_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoreBetterAuthResolver = void 0;
-const common_1 = require("@nestjs/common");
-const graphql_1 = require("@nestjs/graphql");
-const roles_decorator_1 = require("../../common/decorators/roles.decorator");
-const role_enum_1 = require("../../common/enums/role.enum");
-const logging_helper_1 = require("../../common/helpers/logging.helper");
-const error_codes_1 = require("../error-code/error-codes");
-const better_auth_types_1 = require("./better-auth.types");
-const core_better_auth_auth_model_1 = require("./core-better-auth-auth.model");
-const core_better_auth_email_verification_service_1 = require("./core-better-auth-email-verification.service");
-const core_better_auth_migration_status_model_1 = require("./core-better-auth-migration-status.model");
-const core_better_auth_models_1 = require("./core-better-auth-models");
-const core_better_auth_signup_validator_service_1 = require("./core-better-auth-signup-validator.service");
-const core_better_auth_user_mapper_1 = require("./core-better-auth-user.mapper");
-const core_better_auth_web_helper_1 = require("./core-better-auth-web.helper");
-const core_better_auth_service_1 = require("./core-better-auth.service");
+import { BadRequestException, Logger, Optional, UnauthorizedException } from '@nestjs/common';
+import { Args, Context, Mutation, Query, Resolver } from '@nestjs/graphql';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { maskEmail } from '../../common/helpers/logging.helper.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { hasSession, hasUser, requires2FA, sessionTokenFromResponse, } from './better-auth.types.js';
+import { CoreBetterAuthAuthModel } from './core-better-auth-auth.model.js';
+import { CoreBetterAuthEmailVerificationService } from './core-better-auth-email-verification.service.js';
+import { CoreBetterAuthMigrationStatusModel } from './core-better-auth-migration-status.model.js';
+import { CoreBetterAuth2FASetupModel, CoreBetterAuthFeaturesModel, CoreBetterAuthPasskeyChallengeModel, CoreBetterAuthPasskeyModel, CoreBetterAuthSessionModel, } from './core-better-auth-models.js';
+import { CoreBetterAuthSignUpValidatorService } from './core-better-auth-signup-validator.service.js';
+import { CoreBetterAuthUserMapper } from './core-better-auth-user.mapper.js';
+import { convertExpressHeaders } from './core-better-auth-web.helper.js';
+import { CoreBetterAuthService } from './core-better-auth.service.js';
+import { registerBetterAuthHandlerClass } from './core-better-auth.registry.js';
 let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthResolver {
     betterAuthService;
     userMapper;
     signUpValidator;
     emailVerificationService;
-    logger = new common_1.Logger(CoreBetterAuthResolver_1.name);
+    logger = new Logger(CoreBetterAuthResolver_1.name);
     constructor(betterAuthService, userMapper, signUpValidator, emailVerificationService) {
         this.betterAuthService = betterAuthService;
         this.userMapper = userMapper;
@@ -46,8 +44,8 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
     }
     checkEmailVerification(sessionUser) {
         if (this.emailVerificationService?.isEnabled() && !sessionUser.emailVerified) {
-            this.logger.debug(`[SignIn] Email not verified for ${(0, logging_helper_1.maskEmail)(sessionUser.email)}, blocking login`);
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.EMAIL_VERIFICATION_REQUIRED);
+            this.logger.debug(`[SignIn] Email not verified for ${maskEmail(sessionUser.email)}, blocking login`);
+            throw new UnauthorizedException(ErrorCode.EMAIL_VERIFICATION_REQUIRED);
         }
     }
     async checkEmailVerificationByEmail(email) {
@@ -56,8 +54,8 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
         }
         const verified = await this.betterAuthService.isUserEmailVerified(email);
         if (verified === false) {
-            this.logger.debug(`[SignIn/2FA] Email not verified for ${(0, logging_helper_1.maskEmail)(email)}, blocking login`);
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.EMAIL_VERIFICATION_REQUIRED);
+            this.logger.debug(`[SignIn/2FA] Email not verified for ${maskEmail(email)}, blocking login`);
+            throw new UnauthorizedException(ErrorCode.EMAIL_VERIFICATION_REQUIRED);
         }
     }
     async betterAuthSession(ctx) {
@@ -104,7 +102,7 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
         this.ensureEnabled();
         const api = this.betterAuthService.getApi();
         if (!api) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
+            throw new BadRequestException(ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
         }
         return this.attemptSignIn(email, password, api, true);
     }
@@ -113,16 +111,16 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
             const response = (await api.signInEmail({
                 body: { email, password },
             }));
-            this.logger.debug(`[SignIn] API response for ${(0, logging_helper_1.maskEmail)(email)}: ${JSON.stringify(response)?.substring(0, 200)}`);
+            this.logger.debug(`[SignIn] API response for ${maskEmail(email)}: ${JSON.stringify(response)?.substring(0, 200)}`);
             const responseAny = response;
             if (responseAny?.error || responseAny?.code === 'CREDENTIAL_ACCOUNT_NOT_FOUND') {
-                this.logger.debug(`[SignIn] API returned error for ${(0, logging_helper_1.maskEmail)(email)}: ${responseAny?.error || responseAny?.code}`);
+                this.logger.debug(`[SignIn] API returned error for ${maskEmail(email)}: ${responseAny?.error || responseAny?.code}`);
                 throw new Error(responseAny?.error || responseAny?.code || 'Credential account not found');
             }
             if (!response) {
-                throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_CREDENTIALS);
+                throw new UnauthorizedException(ErrorCode.INVALID_CREDENTIALS);
             }
-            if ((0, better_auth_types_1.requires2FA)(response)) {
+            if (requires2FA(response)) {
                 await this.checkEmailVerificationByEmail(email);
                 return {
                     requiresTwoFactor: true,
@@ -130,48 +128,48 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
                     user: null,
                 };
             }
-            if ((0, better_auth_types_1.hasUser)(response)) {
+            if (hasUser(response)) {
                 const sessionUser = response.user;
                 this.checkEmailVerification(sessionUser);
                 const mappedUser = await this.userMapper.mapSessionUser(sessionUser);
                 const tokenResponse = response;
                 const rawToken = tokenResponse.accessToken ||
                     tokenResponse.token ||
-                    ((0, better_auth_types_1.hasSession)(response) ? response.session.token : undefined);
+                    (hasSession(response) ? response.session.token : undefined);
                 const token = await this.resolveJwtToken(rawToken);
                 return {
                     requiresTwoFactor: false,
-                    session: (0, better_auth_types_1.hasSession)(response) ? this.mapSessionInfo(response.session) : null,
+                    session: hasSession(response) ? this.mapSessionInfo(response.session) : null,
                     success: true,
                     token,
                     user: mappedUser ? this.mapToUserModel(mappedUser) : null,
                 };
             }
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_CREDENTIALS);
+            throw new UnauthorizedException(ErrorCode.INVALID_CREDENTIALS);
         }
         catch (error) {
-            this.logger.debug(`[SignIn] Sign-in failed for ${(0, logging_helper_1.maskEmail)(email)}: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            this.logger.debug(`[SignIn] Sign-in failed for ${maskEmail(email)}: ${error instanceof Error ? error.message : 'Unknown error'}`);
             if (allowMigration) {
-                this.logger.debug(`[SignIn] Attempting migration for ${(0, logging_helper_1.maskEmail)(email)}...`);
+                this.logger.debug(`[SignIn] Attempting migration for ${maskEmail(email)}...`);
                 const migrated = await this.userMapper.migrateAccountToIam(email, password);
-                this.logger.debug(`[SignIn] Migration result for ${(0, logging_helper_1.maskEmail)(email)}: ${migrated}`);
+                this.logger.debug(`[SignIn] Migration result for ${maskEmail(email)}: ${migrated}`);
                 if (migrated) {
-                    this.logger.debug(`[SignIn] Migrated legacy user ${(0, logging_helper_1.maskEmail)(email)} to IAM, retrying sign-in`);
+                    this.logger.debug(`[SignIn] Migrated legacy user ${maskEmail(email)} to IAM, retrying sign-in`);
                     const normalizedPassword = this.userMapper.normalizePasswordForIam(password);
                     return this.attemptSignInDirect(email, normalizedPassword, api);
                 }
             }
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_CREDENTIALS);
+            throw new UnauthorizedException(ErrorCode.INVALID_CREDENTIALS);
         }
     }
     async attemptSignInDirect(email, password, api) {
         const response = (await api.signInEmail({
             body: { email, password },
         }));
-        if (!response || !(0, better_auth_types_1.hasUser)(response)) {
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_CREDENTIALS);
+        if (!response || !hasUser(response)) {
+            throw new UnauthorizedException(ErrorCode.INVALID_CREDENTIALS);
         }
-        if ((0, better_auth_types_1.requires2FA)(response)) {
+        if (requires2FA(response)) {
             await this.checkEmailVerificationByEmail(email);
             return { requiresTwoFactor: true, success: false, user: null };
         }
@@ -179,11 +177,11 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
         this.checkEmailVerification(sessionUser);
         const mappedUser = await this.userMapper.mapSessionUser(sessionUser);
         const responseAny = response;
-        const rawToken = responseAny.accessToken || responseAny.token || ((0, better_auth_types_1.hasSession)(response) ? response.session.token : undefined);
+        const rawToken = responseAny.accessToken || responseAny.token || (hasSession(response) ? response.session.token : undefined);
         const token = await this.resolveJwtToken(rawToken);
         return {
             requiresTwoFactor: false,
-            session: (0, better_auth_types_1.hasSession)(response) ? this.mapSessionInfo(response.session) : null,
+            session: hasSession(response) ? this.mapSessionInfo(response.session) : null,
             success: true,
             token,
             user: mappedUser ? this.mapToUserModel(mappedUser) : null,
@@ -197,7 +195,7 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
         }
         const api = this.betterAuthService.getApi();
         if (!api) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
+            throw new BadRequestException(ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
         }
         try {
             const response = (await api.signUpEmail({
@@ -208,18 +206,18 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
                 },
             }));
             if (!response) {
-                throw new common_1.BadRequestException(error_codes_1.ErrorCode.SIGNUP_FAILED);
+                throw new BadRequestException(ErrorCode.SIGNUP_FAILED);
             }
-            if ((0, better_auth_types_1.hasUser)(response)) {
+            if (hasUser(response)) {
                 const sessionUser = response.user;
                 await this.userMapper.linkOrCreateUser(sessionUser, { termsAndPrivacyAccepted });
                 const mappedUser = await this.userMapper.mapSessionUser(sessionUser);
                 if (this.emailVerificationService?.isEnabled()) {
-                    const sessionToken = (0, better_auth_types_1.sessionTokenFromResponse)(response);
+                    const sessionToken = sessionTokenFromResponse(response);
                     if (sessionToken) {
                         await this.betterAuthService.revokeSession(sessionToken);
                     }
-                    this.logger.debug(`[SignUp] Email verification required for ${(0, logging_helper_1.maskEmail)(sessionUser.email)}, session revoked`);
+                    this.logger.debug(`[SignUp] Email verification required for ${maskEmail(sessionUser.email)}, session revoked`);
                     return {
                         emailVerificationRequired: true,
                         requiresTwoFactor: false,
@@ -229,23 +227,23 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
                 }
                 return {
                     requiresTwoFactor: false,
-                    session: (0, better_auth_types_1.hasSession)(response) ? this.mapSessionInfo(response.session) : null,
+                    session: hasSession(response) ? this.mapSessionInfo(response.session) : null,
                     success: true,
                     user: mappedUser ? this.mapToUserModel(mappedUser) : null,
                 };
             }
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.SIGNUP_FAILED);
+            throw new BadRequestException(ErrorCode.SIGNUP_FAILED);
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
             this.logger.debug(`Sign-up error: ${errorMessage}`);
             if (errorMessage.includes('already exists')) {
-                throw new common_1.BadRequestException(error_codes_1.ErrorCode.EMAIL_ALREADY_EXISTS);
+                throw new BadRequestException(ErrorCode.EMAIL_ALREADY_EXISTS);
             }
-            if (error instanceof common_1.BadRequestException) {
+            if (error instanceof BadRequestException) {
                 throw error;
             }
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.SIGNUP_FAILED);
+            throw new BadRequestException(ErrorCode.SIGNUP_FAILED);
         }
     }
     async betterAuthSignOut(ctx) {
@@ -269,23 +267,23 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
     async betterAuthVerify2FA(code, ctx) {
         this.ensureEnabled();
         if (!this.betterAuthService.isTwoFactorEnabled()) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.TWO_FACTOR_NOT_ENABLED_SERVER);
+            throw new BadRequestException(ErrorCode.TWO_FACTOR_NOT_ENABLED_SERVER);
         }
         const api = this.betterAuthService.getApi();
         if (!api) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
+            throw new BadRequestException(ErrorCode.BETTERAUTH_API_NOT_AVAILABLE);
         }
         try {
             const headers = this.convertHeaders(ctx.req.headers);
             const twoFactorApi = api.twoFactor;
             if (!twoFactorApi?.verifyTotp) {
-                throw new common_1.BadRequestException(error_codes_1.ErrorCode.TWO_FACTOR_METHOD_NOT_AVAILABLE);
+                throw new BadRequestException(ErrorCode.TWO_FACTOR_METHOD_NOT_AVAILABLE);
             }
             const response = await twoFactorApi.verifyTotp({
                 body: { code },
                 headers,
             });
-            if (response && (0, better_auth_types_1.hasUser)(response)) {
+            if (response && hasUser(response)) {
                 const sessionUser = response.user;
                 const mappedUser = await this.userMapper.mapSessionUser(sessionUser);
                 return {
@@ -294,11 +292,11 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
                     user: mappedUser ? this.mapToUserModel(mappedUser) : null,
                 };
             }
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_2FA_CODE);
+            throw new UnauthorizedException(ErrorCode.INVALID_2FA_CODE);
         }
         catch (error) {
             this.logger.debug(`2FA verification error: ${error instanceof Error ? error.message : 'Unknown error'}`);
-            throw new common_1.UnauthorizedException(error_codes_1.ErrorCode.INVALID_2FA_CODE);
+            throw new UnauthorizedException(ErrorCode.INVALID_2FA_CODE);
         }
     }
     async betterAuthEnable2FA(password, ctx) {
@@ -334,7 +332,7 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
     async betterAuthDisable2FA(password, ctx) {
         this.ensureEnabled();
         if (!this.betterAuthService.isTwoFactorEnabled()) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.TWO_FACTOR_NOT_ENABLED_SERVER);
+            throw new BadRequestException(ErrorCode.TWO_FACTOR_NOT_ENABLED_SERVER);
         }
         const api = this.betterAuthService.getApi();
         if (!api) {
@@ -344,7 +342,7 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
             const headers = this.convertHeaders(ctx.req.headers);
             const twoFactorApi = api.twoFactor;
             if (!twoFactorApi?.disable) {
-                throw new common_1.BadRequestException(error_codes_1.ErrorCode.TWO_FACTOR_METHOD_NOT_AVAILABLE);
+                throw new BadRequestException(ErrorCode.TWO_FACTOR_METHOD_NOT_AVAILABLE);
             }
             const response = await twoFactorApi.disable({
                 body: { password },
@@ -360,7 +358,7 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
     async betterAuthGenerateBackupCodes(ctx) {
         this.ensureEnabled();
         if (!this.betterAuthService.isTwoFactorEnabled()) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.TWO_FACTOR_NOT_ENABLED_SERVER);
+            throw new BadRequestException(ErrorCode.TWO_FACTOR_NOT_ENABLED_SERVER);
         }
         const api = this.betterAuthService.getApi();
         if (!api) {
@@ -370,7 +368,7 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
             const headers = this.convertHeaders(ctx.req.headers);
             const twoFactorApi = api.twoFactor;
             if (!twoFactorApi?.generateBackupCodes) {
-                throw new common_1.BadRequestException(error_codes_1.ErrorCode.TWO_FACTOR_METHOD_NOT_AVAILABLE);
+                throw new BadRequestException(ErrorCode.TWO_FACTOR_METHOD_NOT_AVAILABLE);
             }
             const response = await twoFactorApi.generateBackupCodes({ headers });
             return response?.backupCodes || null;
@@ -436,7 +434,7 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
     async betterAuthDeletePasskey(passkeyId, ctx) {
         this.ensureEnabled();
         if (!this.betterAuthService.isPasskeyEnabled()) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.PASSKEY_NOT_ENABLED_SERVER);
+            throw new BadRequestException(ErrorCode.PASSKEY_NOT_ENABLED_SERVER);
         }
         const api = this.betterAuthService.getApi();
         if (!api) {
@@ -446,7 +444,7 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
             const headers = this.convertHeaders(ctx.req.headers);
             const passkeyApi = api.passkey;
             if (!passkeyApi?.deletePasskey) {
-                throw new common_1.BadRequestException(error_codes_1.ErrorCode.TWO_FACTOR_METHOD_NOT_AVAILABLE);
+                throw new BadRequestException(ErrorCode.TWO_FACTOR_METHOD_NOT_AVAILABLE);
             }
             const response = await passkeyApi.deletePasskey({
                 body: { id: passkeyId },
@@ -461,11 +459,11 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
     }
     ensureEnabled() {
         if (!this.betterAuthService.isEnabled()) {
-            throw new common_1.BadRequestException(error_codes_1.ErrorCode.BETTERAUTH_DISABLED);
+            throw new BadRequestException(ErrorCode.BETTERAUTH_DISABLED);
         }
     }
     convertHeaders(headers) {
-        return (0, core_better_auth_web_helper_1.convertExpressHeaders)(headers);
+        return convertExpressHeaders(headers);
     }
     mapSessionInfo(session) {
         return {
@@ -486,169 +484,170 @@ let CoreBetterAuthResolver = CoreBetterAuthResolver_1 = class CoreBetterAuthReso
         };
     }
 };
-exports.CoreBetterAuthResolver = CoreBetterAuthResolver;
 __decorate([
-    (0, graphql_1.Query)(() => core_better_auth_models_1.CoreBetterAuthSessionModel, {
+    Query(() => CoreBetterAuthSessionModel, {
         description: 'Get current Better-Auth session',
         nullable: true,
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_USER),
+    __param(0, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthSession", null);
 __decorate([
-    (0, graphql_1.Query)(() => Boolean, { description: 'Check if Better-Auth is enabled' }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
+    Query(() => Boolean, { description: 'Check if Better-Auth is enabled' }),
+    Roles(RoleEnum.S_EVERYONE),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Boolean)
 ], CoreBetterAuthResolver.prototype, "betterAuthEnabled", null);
 __decorate([
-    (0, graphql_1.Query)(() => core_better_auth_models_1.CoreBetterAuthFeaturesModel, { description: 'Get enabled Better-Auth features' }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
+    Query(() => CoreBetterAuthFeaturesModel, { description: 'Get enabled Better-Auth features' }),
+    Roles(RoleEnum.S_EVERYONE),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
-    __metadata("design:returntype", core_better_auth_models_1.CoreBetterAuthFeaturesModel)
+    __metadata("design:returntype", CoreBetterAuthFeaturesModel)
 ], CoreBetterAuthResolver.prototype, "betterAuthFeatures", null);
 __decorate([
-    (0, graphql_1.Query)(() => String, {
+    Query(() => String, {
         description: 'Get fresh JWT token for the current session (requires valid session)',
         nullable: true,
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_USER),
+    __param(0, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthToken", null);
 __decorate([
-    (0, graphql_1.Query)(() => core_better_auth_migration_status_model_1.CoreBetterAuthMigrationStatusModel, {
+    Query(() => CoreBetterAuthMigrationStatusModel, {
         description: 'Get migration status from Legacy Auth to Better-Auth (IAM) - Admin only',
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.ADMIN),
+    Roles(RoleEnum.ADMIN),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthMigrationStatus", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => core_better_auth_auth_model_1.CoreBetterAuthAuthModel, {
+    Mutation(() => CoreBetterAuthAuthModel, {
         description: 'Sign in via Better-Auth (email/password)',
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
-    __param(0, (0, graphql_1.Args)('email')),
-    __param(1, (0, graphql_1.Args)('password')),
-    __param(2, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_EVERYONE),
+    __param(0, Args('email')),
+    __param(1, Args('password')),
+    __param(2, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, String, Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthSignIn", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => core_better_auth_auth_model_1.CoreBetterAuthAuthModel, {
+    Mutation(() => CoreBetterAuthAuthModel, {
         description: 'Sign up via Better-Auth (email/password)',
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
-    __param(0, (0, graphql_1.Args)('email')),
-    __param(1, (0, graphql_1.Args)('password')),
-    __param(2, (0, graphql_1.Args)('name', { nullable: true })),
-    __param(3, (0, graphql_1.Args)('termsAndPrivacyAccepted', { nullable: true })),
+    Roles(RoleEnum.S_EVERYONE),
+    __param(0, Args('email')),
+    __param(1, Args('password')),
+    __param(2, Args('name', { nullable: true })),
+    __param(3, Args('termsAndPrivacyAccepted', { nullable: true })),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, String, String, Boolean]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthSignUp", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => Boolean, { description: 'Sign out via Better-Auth' }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Context)()),
+    Mutation(() => Boolean, { description: 'Sign out via Better-Auth' }),
+    Roles(RoleEnum.S_USER),
+    __param(0, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthSignOut", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => core_better_auth_auth_model_1.CoreBetterAuthAuthModel, {
+    Mutation(() => CoreBetterAuthAuthModel, {
         description: 'Verify 2FA code during sign-in',
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_EVERYONE),
-    __param(0, (0, graphql_1.Args)('code')),
-    __param(1, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_EVERYONE),
+    __param(0, Args('code')),
+    __param(1, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthVerify2FA", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => core_better_auth_models_1.CoreBetterAuth2FASetupModel, {
+    Mutation(() => CoreBetterAuth2FASetupModel, {
         description: 'Enable 2FA for the current user',
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Args)('password')),
-    __param(1, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_USER),
+    __param(0, Args('password')),
+    __param(1, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthEnable2FA", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => Boolean, {
+    Mutation(() => Boolean, {
         description: 'Disable 2FA for the current user',
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Args)('password')),
-    __param(1, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_USER),
+    __param(0, Args('password')),
+    __param(1, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthDisable2FA", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => [String], {
+    Mutation(() => [String], {
         description: 'Generate new backup codes for 2FA',
         nullable: true,
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_USER),
+    __param(0, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthGenerateBackupCodes", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => core_better_auth_models_1.CoreBetterAuthPasskeyChallengeModel, {
+    Mutation(() => CoreBetterAuthPasskeyChallengeModel, {
         description: 'Get passkey registration challenge for WebAuthn',
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_USER),
+    __param(0, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthGetPasskeyChallenge", null);
 __decorate([
-    (0, graphql_1.Query)(() => [core_better_auth_models_1.CoreBetterAuthPasskeyModel], {
+    Query(() => [CoreBetterAuthPasskeyModel], {
         description: 'List passkeys for the current user',
         nullable: true,
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_USER),
+    __param(0, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthListPasskeys", null);
 __decorate([
-    (0, graphql_1.Mutation)(() => Boolean, {
+    Mutation(() => Boolean, {
         description: 'Delete a passkey by ID',
     }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.S_USER),
-    __param(0, (0, graphql_1.Args)('passkeyId')),
-    __param(1, (0, graphql_1.Context)()),
+    Roles(RoleEnum.S_USER),
+    __param(0, Args('passkeyId')),
+    __param(1, Context()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], CoreBetterAuthResolver.prototype, "betterAuthDeletePasskey", null);
-exports.CoreBetterAuthResolver = CoreBetterAuthResolver = CoreBetterAuthResolver_1 = __decorate([
-    (0, graphql_1.Resolver)(() => core_better_auth_auth_model_1.CoreBetterAuthAuthModel, { isAbstract: true }),
-    (0, roles_decorator_1.Roles)(role_enum_1.RoleEnum.ADMIN),
-    __param(2, (0, common_1.Optional)()),
-    __param(3, (0, common_1.Optional)()),
-    __metadata("design:paramtypes", [core_better_auth_service_1.CoreBetterAuthService,
-        core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-        core_better_auth_signup_validator_service_1.CoreBetterAuthSignUpValidatorService,
-        core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService])
+CoreBetterAuthResolver = CoreBetterAuthResolver_1 = __decorate([
+    Resolver(() => CoreBetterAuthAuthModel, { isAbstract: true }),
+    Roles(RoleEnum.ADMIN),
+    __param(2, Optional()),
+    __param(3, Optional()),
+    __metadata("design:paramtypes", [CoreBetterAuthService,
+        CoreBetterAuthUserMapper,
+        CoreBetterAuthSignUpValidatorService,
+        CoreBetterAuthEmailVerificationService])
 ], CoreBetterAuthResolver);
+export { CoreBetterAuthResolver };
+registerBetterAuthHandlerClass(CoreBetterAuthResolver);
 //# sourceMappingURL=core-better-auth.resolver.js.map