@loopstack/auth 0.37.0 → 0.38.0

package/dist/auth.module.d.ts

@@ -1,6 +1,6 @@
 import { DynamicModule, MiddlewareConsumer, NestModule } from '@nestjs/common';
 export declare class AuthModule implements NestModule {
     configure(consumer: MiddlewareConsumer): void;
-    static forRoot(connection?: string): DynamicModule;
+    static forRoot(): DynamicModule;
 }
 //# sourceMappingURL=auth.module.d.ts.map

package/dist/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAU,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAgBvF,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB;IAItC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,aAAa;CAgCnD"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAU,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAgBvF,qBACa,UAAW,YAAW,UAAU;IAC3C,SAAS,CAAC,QAAQ,EAAE,kBAAkB;IAItC,MAAM,CAAC,OAAO,IAAI,aAAa;CAgChC"}

package/dist/auth.module.js

@@ -23,7 +23,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
     configure(consumer) {
         consumer.apply(cookieParser()).forRoutes('*');
     }
-    static forRoot(connection) {
+    static forRoot() {
         return {
             module: AuthModule_1,
             imports: [
@@ -37,7 +37,7 @@ let AuthModule = AuthModule_1 = class AuthModule {
                     }),
                     inject: [ConfigService],
                 }),
-                TypeOrmModule.forFeature([User, Role, ApiTokenEntity], connection),
+                TypeOrmModule.forFeature([User, Role, ApiTokenEntity]),
             ],
             controllers: [ApiTokenController, AuthController],
             providers: [

package/dist/auth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAqC,MAAM,EAAc,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,YAAY,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAG1D,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,UAAmB;QAChC,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE;gBACP,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBACnD,SAAS,CAAC,aAAa,CAAC;oBACtB,UAAU,EAAE,CAAC,aAA4B,EAAE,EAAE,CAAC,CAAC;wBAC7C,MAAM,EAAE,aAAa,CAAC,GAAG,CAAS,iBAAiB,CAAC;wBACpD,WAAW,EAAE;4BACX,SAAS,EAAE,aAAa,CAAC,GAAG,CAAmC,oBAAoB,CAAC,IAAI,IAAI;yBAC7F;qBACF,CAAC;oBACF,MAAM,EAAE,CAAC,aAAa,CAAC;iBACxB,CAAC;gBACF,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,UAAU,CAAC;aACnE;YACD,WAAW,EAAE,CAAC,kBAAkB,EAAE,cAAc,CAAC;YACjD,SAAS,EAAE;gBACT,uBAAuB;gBACvB,eAAe;gBACf,WAAW;gBACX,cAAc;gBACd,YAAY;gBACZ,WAAW;gBACX,WAAW;gBACX,YAAY;gBACZ,UAAU;gBACV,iBAAiB;aAClB;YACD,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC;SAClF,CAAC;IACJ,CAAC;CACF,CAAA;AArCY,UAAU;IADtB,MAAM,CAAC,EAAE,CAAC;GACE,UAAU,CAqCtB"}
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAqC,MAAM,EAAc,MAAM,gBAAgB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,YAAY,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAG1D,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,SAAS,CAAC,QAA4B;QACpC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,OAAO;QACZ,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE;gBACP,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBACnD,SAAS,CAAC,aAAa,CAAC;oBACtB,UAAU,EAAE,CAAC,aAA4B,EAAE,EAAE,CAAC,CAAC;wBAC7C,MAAM,EAAE,aAAa,CAAC,GAAG,CAAS,iBAAiB,CAAC;wBACpD,WAAW,EAAE;4BACX,SAAS,EAAE,aAAa,CAAC,GAAG,CAAmC,oBAAoB,CAAC,IAAI,IAAI;yBAC7F;qBACF,CAAC;oBACF,MAAM,EAAE,CAAC,aAAa,CAAC;iBACxB,CAAC;gBACF,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;aACvD;YACD,WAAW,EAAE,CAAC,kBAAkB,EAAE,cAAc,CAAC;YACjD,SAAS,EAAE;gBACT,uBAAuB;gBACvB,eAAe;gBACf,WAAW;gBACX,cAAc;gBACd,YAAY;gBACZ,WAAW;gBACX,WAAW;gBACX,YAAY;gBACZ,UAAU;gBACV,iBAAiB;aAClB;YACD,OAAO,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,CAAC;SAClF,CAAC;IACJ,CAAC;CACF,CAAA;AArCY,UAAU;IADtB,MAAM,CAAC,EAAE,CAAC;GACE,UAAU,CAqCtB"}

package/dist/services/config-validation.service.d.ts

@@ -2,8 +2,11 @@ import { OnModuleInit } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 export declare class ConfigValidationService implements OnModuleInit {
     private configService;
+    private readonly logger;
     constructor(configService: ConfigService);
     onModuleInit(): void;
     private validateAuthConfig;
+    private assertNoAuthAllowed;
+    private assertStrongSecret;
 }
 //# sourceMappingURL=config-validation.service.d.ts.map

package/dist/services/config-validation.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-validation.service.d.ts","sourceRoot":"","sources":["../../src/services/config-validation.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,qBACa,uBAAwB,YAAW,YAAY;IAC9C,OAAO,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAEhD,YAAY;IAIZ,OAAO,CAAC,kBAAkB;CAoB3B"}
+{"version":3,"file":"config-validation.service.d.ts","sourceRoot":"","sources":["../../src/services/config-validation.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAe/C,qBACa,uBAAwB,YAAW,YAAY;IAG9C,OAAO,CAAC,aAAa;IAFjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;gBAE/C,aAAa,EAAE,aAAa;IAEhD,YAAY;IAIZ,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,mBAAmB;IAqB3B,OAAO,CAAC,kBAAkB;CAW3B"}

package/dist/services/config-validation.service.js

@@ -7,10 +7,19 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { Injectable } from '@nestjs/common';
+var ConfigValidationService_1;
+import { Injectable, Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
-let ConfigValidationService = class ConfigValidationService {
+const FORBIDDEN_SECRETS = new Set([
+    'dev-secret-change-me',
+    'dev-insecure-secret-auth-disabled',
+    'JWT_SECRET',
+    'JWT_REFRESH_SECRET',
+]);
+const MIN_SECRET_LENGTH = 32;
+let ConfigValidationService = ConfigValidationService_1 = class ConfigValidationService {
     configService;
+    logger = new Logger(ConfigValidationService_1.name);
     constructor(configService) {
         this.configService = configService;
     }
@@ -18,22 +27,38 @@ let ConfigValidationService = class ConfigValidationService {
         this.validateAuthConfig();
     }
     validateAuthConfig() {
-        const requiredConfigs = [
-            { key: 'auth.jwt.secret', name: 'JWT_SECRET' },
-        ];
-        const missingConfigs = [];
-        requiredConfigs.forEach(({ key, name }) => {
-            const value = this.configService.get(key);
-            if (!value) {
-                missingConfigs.push(name);
-            }
-        });
-        if (missingConfigs.length > 0) {
-            throw new Error(`Missing required configuration values: ${missingConfigs.join(', ')}`);
+        const enableAuth = this.configService.get('app.enableAuth');
+        if (!enableAuth) {
+            this.assertNoAuthAllowed();
+            return;
+        }
+        this.assertStrongSecret(this.configService.get('auth.jwt.secret'), 'JWT_SECRET');
+        this.assertStrongSecret(this.configService.get('auth.jwt.refreshSecret'), 'JWT_REFRESH_SECRET');
+    }
+    assertNoAuthAllowed() {
+        const nodeEnv = this.configService.get('app.nodeEnv');
+        const acknowledged = process.env.LOOPSTACK_ALLOW_NO_AUTH === 'true';
+        if (nodeEnv === 'production' && !acknowledged) {
+            throw new Error('Authentication is disabled (LOOPSTACK_AUTH is not "true") while NODE_ENV=production. ' +
+                'Refusing to start, as this would serve the API unauthenticated. Enable auth with ' +
+                'LOOPSTACK_AUTH=true, or explicitly acknowledge an unauthenticated deployment with ' +
+                'LOOPSTACK_ALLOW_NO_AUTH=true.');
+        }
+        this.logger.warn('Authentication is DISABLED — every request resolves to the local user. Set LOOPSTACK_AUTH=true to enable authentication.');
+    }
+    assertStrongSecret(value, name) {
+        if (!value) {
+            throw new Error(`${name} is required when auth is enabled (LOOPSTACK_AUTH=true). Set a strong, unique secret.`);
+        }
+        if (FORBIDDEN_SECRETS.has(value)) {
+            throw new Error(`${name} is set to a known default/insecure value. Set a strong, unique secret.`);
+        }
+        if (value.length < MIN_SECRET_LENGTH) {
+            throw new Error(`${name} must be at least ${MIN_SECRET_LENGTH} characters when auth is enabled.`);
         }
     }
 };
-ConfigValidationService = __decorate([
+ConfigValidationService = ConfigValidationService_1 = __decorate([
     Injectable(),
     __metadata("design:paramtypes", [ConfigService])
 ], ConfigValidationService);

package/dist/services/config-validation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-validation.service.js","sourceRoot":"","sources":["../../src/services/config-validation.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAgB,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGxC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACd;IAApB,YAAoB,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;IAAG,CAAC;IAEpD,YAAY;QACV,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAEO,kBAAkB;QACxB,MAAM,eAAe,GAAG;YAGtB,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,YAAY,EAAE;SAC/C,CAAC;QAEF,MAAM,cAAc,GAAa,EAAE,CAAC;QAEpC,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,GAAG,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,0CAA0C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;CACF,CAAA;AA3BY,uBAAuB;IADnC,UAAU,EAAE;qCAEwB,aAAa;GADrC,uBAAuB,CA2BnC"}
+{"version":3,"file":"config-validation.service.js","sourceRoot":"","sources":["../../src/services/config-validation.service.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAgB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAM/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,sBAAsB;IACtB,mCAAmC;IACnC,YAAY;IACZ,oBAAoB;CACrB,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAGtB,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAGd;IAFH,MAAM,GAAG,IAAI,MAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,YAAoB,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;IAAG,CAAC;IAEpD,YAAY;QACV,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAEO,kBAAkB;QAGxB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAU,gBAAgB,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,iBAAiB,CAAC,EAAE,YAAY,CAAC,CAAC;QACzF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,wBAAwB,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC1G,CAAC;IAEO,mBAAmB;QAIzB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,aAAa,CAAC,CAAC;QAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,MAAM,CAAC;QAEpE,IAAI,OAAO,KAAK,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,uFAAuF;gBACrF,mFAAmF;gBACnF,oFAAoF;gBACpF,+BAA+B,CAClC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IAEO,kBAAkB,CAAC,KAAyB,EAAE,IAAY;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uFAAuF,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yEAAyE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,iBAAiB,mCAAmC,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;CACF,CAAA;AAtDY,uBAAuB;IADnC,UAAU,EAAE;qCAIwB,aAAa;GAHrC,uBAAuB,CAsDnC"}

package/package.json

@@ -2,7 +2,7 @@
   "name": "@loopstack/auth",
   "displayName": "Loopstack Auth Module",
   "description": "The auth module of the loopstack automation framework",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "license": "MIT",
   "author": {
     "name": "Jakob Klippel",
@@ -30,9 +30,9 @@
     "watch": "nest build --watch"
   },
   "dependencies": {
-    "@loopstack/common": "^0.37.0",
-    "@loopstack/contracts": "^0.37.0",
-    "@loopstack/core": "^0.37.0",
+    "@loopstack/common": "^0.38.0",
+    "@loopstack/contracts": "^0.38.0",
+    "@loopstack/core": "^0.38.0",
     "axios": "^1.15.0",
     "cookie-parser": "^1.4.7",
     "jose": "^6.2.2",