@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/identity/auth/auth.controller.js

@@ -0,0 +1,367 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthController = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const swagger_1 = require("@nestjs/swagger");
+const auth_service_1 = require("./auth.service");
+const auth_error_codes_1 = require("./auth-error-codes");
+const sign_in_response_1 = require("./sign-in-response");
+const google_oauth_guard_1 = require("./guards/google-oauth.guard");
+const google_oauth_exception_filter_1 = require("./filters/google-oauth-exception.filter");
+const jwt_auth_guard_1 = require("./guards/jwt-auth.guard");
+const public_decorator_1 = require("./decorators/public.decorator");
+const current_user_decorator_1 = require("./decorators/current-user.decorator");
+const auth_decorator_1 = require("./decorators/auth.decorator");
+const current_principal_decorator_1 = require("./decorators/current-principal.decorator");
+const switch_org_dto_1 = require("./dto/switch-org.dto");
+const auth_provider_dto_1 = require("./dto/auth-provider.dto");
+const auth_user_dto_1 = require("./dto/auth-user.dto");
+const index_1 = require("../../core/index");
+/**
+ * REACHABLE DURING A MAINTENANCE WINDOW, as a whole controller (#257).
+ *
+ * The exemption is class-level rather than route-by-route because every route
+ * on it is one of four things a window must not break:
+ *
+ *   * `providers`, `google`, `google/callback` — SIGNING IN. A window in which
+ *     nobody can sign in is a window nobody can end: `allowAdmins` is worth
+ *     nothing to an administrator who cannot obtain a token, and the only way
+ *     back would be the environment break-glass and a restart.
+ *   * `refresh` — STAYING signed in. An access token is minutes long; a window
+ *     that outlives one would evict the very admin who opened it. The same
+ *     holds for `switch-org` (#724), a rotation for another organization.
+ *   * `me` — the identity lookup the maintenance page itself needs, to decide
+ *     whether the person looking at it is an admin who can carry on.
+ *   * `logout` / `logout-all` — signing OUT must never be the thing that is
+ *     unavailable. A user who wants their session ended during an incident is
+ *     entitled to have it ended.
+ *
+ * Note this is REACHABILITY only: `@Auth()` and `@Public()` still decide who
+ * may call what, exactly as they do outside a window.
+ */
+let AuthController = AuthController_1 = class AuthController {
+    authService;
+    configService;
+    logger = new common_1.Logger(AuthController_1.name);
+    constructor(authService, configService) {
+        this.authService = authService;
+        this.configService = configService;
+    }
+    /**
+     * GET /auth/providers
+     * Returns list of enabled OAuth providers
+     */
+    async getProviders() {
+        const providers = await this.authService.getEnabledProviders();
+        return {
+            data: {
+                providers,
+            },
+        };
+    }
+    /**
+     * GET /auth/google
+     * Initiates Google OAuth flow
+     */
+    async googleAuth() {
+        // Guard handles the redirect to Google
+    }
+    /**
+     * GET /auth/google/callback
+     * Google OAuth callback endpoint
+     */
+    async googleAuthCallback(req, res) {
+        // Google profile is attached by the guard
+        const profile = req.user;
+        if (!profile) {
+            this.logger.error('No profile found in Google OAuth callback');
+            return res.status(302).redirect((0, auth_error_codes_1.buildAuthErrorRedirectUrl)(this.configService.get('appUrl'), 'authentication_failed'));
+        }
+        // Handle login, set the refresh cookie and redirect (or redirect with the
+        // error code): the same ending every provider's callback uses.
+        return (0, sign_in_response_1.respondToSignIn)({
+            reply: res,
+            appUrl: this.configService.get('appUrl'),
+            signIn: () => this.authService.handleGoogleLogin(profile),
+            logger: this.logger,
+            label: 'Google OAuth callback',
+        });
+    }
+    /**
+     * GET /auth/me
+     * Returns current authenticated user information
+     */
+    async getCurrentUser(user) {
+        // #724: computed for the org the presented credential is bound to.
+        const currentUser = user.activeOrgId === undefined
+            ? await this.authService.getCurrentUser(user.id)
+            : await this.authService.getCurrentUser(user.id, user.activeOrgId);
+        return {
+            data: currentUser,
+        };
+    }
+    /**
+     * POST /auth/refresh
+     * Refresh access token using refresh token from cookie
+     */
+    async refresh(req, res) {
+        const refreshToken = req.cookies[sign_in_response_1.REFRESH_TOKEN_COOKIE];
+        if (!refreshToken) {
+            throw new common_1.UnauthorizedException('No refresh token provided');
+        }
+        const tokens = await this.authService.refreshAccessToken(refreshToken);
+        // Set new refresh token in cookie (rotation)
+        (0, sign_in_response_1.setRefreshTokenCookie)(res, tokens.refreshToken);
+        // Return new access token
+        return {
+            accessToken: tokens.accessToken,
+            expiresIn: tokens.expiresIn,
+        };
+    }
+    /**
+     * POST /auth/switch-org
+     * Re-issue the session for another organization (#724)
+     */
+    async switchOrg(dto, principal, req, res) {
+        const tokens = await this.authService.switchOrg({
+            id: principal.userId,
+            tokenKind: principal.credential,
+            activeOrgId: principal.activeOrgId ?? null,
+        }, dto.orgId, req.cookies[sign_in_response_1.REFRESH_TOKEN_COOKIE]);
+        // Same cookie, same attributes as a rotation (SECURITY-ARCHITECTURE §3).
+        (0, sign_in_response_1.setRefreshTokenCookie)(res, tokens.refreshToken);
+        return {
+            accessToken: tokens.accessToken,
+            expiresIn: tokens.expiresIn,
+        };
+    }
+    /**
+     * POST /auth/logout
+     * Logout current user and revoke refresh token
+     */
+    async logout(user, req, res) {
+        const refreshToken = req.cookies[sign_in_response_1.REFRESH_TOKEN_COOKIE];
+        await this.authService.logout(user.id, refreshToken);
+        // Clear refresh token cookie
+        res.clearCookie(sign_in_response_1.REFRESH_TOKEN_COOKIE, { path: '/api/auth' });
+        this.logger.log(`User logged out: ${user.email}`);
+    }
+    /**
+     * POST /auth/logout-all
+     * Logout from all devices by revoking all refresh tokens
+     */
+    async logoutAll(user, res) {
+        await this.authService.revokeAllUserTokens(user.id);
+        // Clear refresh token cookie
+        res.clearCookie(sign_in_response_1.REFRESH_TOKEN_COOKIE, { path: '/api/auth' });
+        this.logger.log(`User logged out from all devices: ${user.email}`);
+    }
+};
+exports.AuthController = AuthController;
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Get)('providers'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List enabled OAuth providers',
+        description: 'Returns a list of OAuth providers that are configured and enabled',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'List of enabled providers',
+        type: auth_provider_dto_1.AuthProvidersResponseDto,
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "getProviders", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Get)('google'),
+    (0, common_1.UseGuards)(google_oauth_guard_1.GoogleOAuthGuard),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Initiate Google OAuth',
+        description: 'Redirects to Google OAuth consent screen. Pass select_account=1 to make Google show its account chooser instead of re-using the signed-in account.',
+    }),
+    (0, swagger_1.ApiQuery)({
+        name: 'select_account',
+        required: false,
+        description: 'Set to 1 to forward prompt=select_account to Google so the person can pick a different account. Any other value is ignored.',
+        schema: { type: 'string', enum: ['1'] },
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 302,
+        description: 'Redirects to Google OAuth',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "googleAuth", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Get)('google/callback'),
+    (0, common_1.UseGuards)(google_oauth_guard_1.GoogleOAuthGuard)
+    // Callback route only: guard failures run before the method body, so its
+    // try/catch never sees them (#652).
+    ,
+    (0, common_1.UseFilters)(google_oauth_exception_filter_1.GoogleOAuthExceptionFilter),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Google OAuth callback',
+        description: 'Handles the OAuth callback from Google and redirects to the frontend /auth/callback page: with the access token on success, or with error=<code> on any failure.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 302,
+        description: 'Redirects to frontend with the token in query params, or with error set to one of not_allowlisted, account_disabled, access_denied, authentication_failed, server_misconfigured, no_organization',
+    }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "googleAuthCallback", null);
+__decorate([
+    (0, common_1.Get)('me'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)('JWT-auth'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Get current user',
+        description: 'Returns information about the currently authenticated user',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'Current user information',
+        type: auth_user_dto_1.CurrentUserDto,
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Unauthorized - invalid or missing token',
+    }),
+    __param(0, (0, current_user_decorator_1.CurrentUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "getCurrentUser", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Post)('refresh'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Refresh access token',
+        description: 'Exchanges a refresh token for a new access token',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'New access token',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Invalid or expired refresh token',
+    }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
+__decorate([
+    (0, common_1.Post)('switch-org'),
+    (0, auth_decorator_1.Auth)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Switch the active organization',
+        description: 'Re-issues the session for another organization the caller is an active member of: the ' +
+            'presented refresh token (the HttpOnly `refresh_token` cookie) is revoked, a new one bound ' +
+            'to `orgId` is set, and a new access token whose `org` claim is `orgId` is returned, in the ' +
+            'same shape as `POST /api/auth/refresh`. Only a browser session can switch: a personal ' +
+            'access token or a device credential is bound to one organization for life (403). In ' +
+            'single-organization mode only the default organization qualifies, so switching to it is ' +
+            'a no-op re-issue. Writes the `auth:org_switched` audit event.',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 200,
+        description: 'New access token for the requested organization (the refresh cookie is rotated)',
+        type: auth_user_dto_1.TokenResponseDto,
+    }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'Validation failed (`orgId` is not a UUID)' }),
+    (0, swagger_1.ApiResponse)({ status: 401, description: 'Missing or invalid access token or refresh token' }),
+    (0, swagger_1.ApiResponse)({
+        status: 403,
+        description: 'The credential is a personal access token or a device credential, which cannot switch organization',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Not an organization the caller is an active member of' }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, current_principal_decorator_1.CurrentPrincipal)()),
+    __param(2, (0, common_1.Req)()),
+    __param(3, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [switch_org_dto_1.SwitchOrgDto, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "switchOrg", null);
+__decorate([
+    (0, common_1.Post)('logout'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiBearerAuth)('JWT-auth'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Logout',
+        description: 'Logout endpoint and revoke refresh token',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 204,
+        description: 'Logout successful',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Unauthorized - invalid or missing token',
+    }),
+    __param(0, (0, current_user_decorator_1.CurrentUser)()),
+    __param(1, (0, common_1.Req)()),
+    __param(2, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "logout", null);
+__decorate([
+    (0, common_1.Post)('logout-all'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiBearerAuth)('JWT-auth'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Logout from all devices',
+        description: 'Revoke all refresh tokens for the current user',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 204,
+        description: 'All tokens revoked successfully',
+    }),
+    (0, swagger_1.ApiResponse)({
+        status: 401,
+        description: 'Unauthorized - invalid or missing token',
+    }),
+    __param(0, (0, current_user_decorator_1.CurrentUser)()),
+    __param(1, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "logoutAll", null);
+exports.AuthController = AuthController = AuthController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Authentication'),
+    (0, common_1.Controller)('auth'),
+    (0, index_1.AllowDuringMaintenance)(),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        config_1.ConfigService])
+], AuthController);
+//# sourceMappingURL=auth.controller.js.map

package/dist/identity/auth/auth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../src/identity/auth/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAawB;AACxB,2CAA+C;AAC/C,6CAMyB;AAEzB,iDAA6C;AAC7C,yDAA+D;AAC/D,yDAAkG;AAClG,oEAA+D;AAC/D,2FAAqF;AACrF,4DAAuD;AACvD,oEAAuD;AACvD,gFAAkE;AAClE,gEAAmD;AACnD,0FAA4E;AAG5E,yDAAoD;AAEpD,+DAGiC;AACjC,uDAAuE;AACvE,4CAA0D;AAE1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AAII,IAAM,cAAc,sBAApB,MAAM,cAAc;IAIN;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAE1D,YACmB,WAAwB,EACxB,aAA4B;QAD5B,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;IAC5C,CAAC;IAEJ;;;OAGG;IAYG,AAAN,KAAK,CAAC,YAAY;QAChB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;QAC/D,OAAO;YACL,IAAI,EAAE;gBACJ,SAAS;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IAoBG,AAAN,KAAK,CAAC,UAAU;QACd,uCAAuC;IACzC,CAAC;IAED;;;OAGG;IAiBG,AAAN,KAAK,CAAC,kBAAkB,CACf,GAA8C,EAC9C,GAAiB;QAExB,0CAA0C;QAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAC7B,IAAA,4CAAyB,EACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,QAAQ,CAAC,EACxC,uBAAuB,CACxB,CACF,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,+DAA+D;QAC/D,OAAO,IAAA,kCAAe,EAAC;YACrB,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,QAAQ,CAAC;YAChD,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACzD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,uBAAuB;SAC/B,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IAiBG,AAAN,KAAK,CAAC,cAAc,CACH,IAAiB;QAEhC,mEAAmE;QACnE,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,KAAK,SAAS;YAC5B,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACvE,OAAO;YACL,IAAI,EAAE,WAAW;SAClB,CAAC;IACJ,CAAC;IAED;;;OAGG;IAgBG,AAAN,KAAK,CAAC,OAAO,CACJ,GAAmB,EACE,GAAiB;QAE7C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,uCAAoB,CAAC,CAAC;QAEvD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEvE,6CAA6C;QAC7C,IAAA,wCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,YAAa,CAAC,CAAC;QAEjD,0BAA0B;QAC1B,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;;OAGG;IA2BG,AAAN,KAAK,CAAC,SAAS,CACL,GAAiB,EACL,SAAoB,EACjC,GAAmB,EACE,GAAiB;QAE7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAC7C;YACE,EAAE,EAAE,SAAS,CAAC,MAAM;YACpB,SAAS,EAAE,SAAS,CAAC,UAAU;YAC/B,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,IAAI;SAC3C,EACD,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,OAAO,CAAC,uCAAoB,CAAC,CAClC,CAAC;QAEF,yEAAyE;QACzE,IAAA,wCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,YAAa,CAAC,CAAC;QAEjD,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED;;;OAGG;IAiBG,AAAN,KAAK,CAAC,MAAM,CACK,IAAiB,EACzB,GAAmB,EACE,GAAiB;QAE7C,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,uCAAoB,CAAC,CAAC;QAEvD,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAErD,6BAA6B;QAC7B,GAAG,CAAC,WAAW,CAAC,uCAAoB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IAiBG,AAAN,KAAK,CAAC,SAAS,CACE,IAAiB,EACJ,GAAiB;QAE7C,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEpD,6BAA6B;QAC7B,GAAG,CAAC,WAAW,CAAC,uCAAoB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAE7D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;CACF,CAAA;AA9SY,wCAAc;AAuBnB;IAXL,IAAA,yBAAM,GAAE;IACR,IAAA,YAAG,EAAC,WAAW,CAAC;IAChB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,mEAAmE;KACjF,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4CAAwB;KAC/B,CAAC;;;;kDAQD;AAyBK;IAnBL,IAAA,yBAAM,GAAE;IACR,IAAA,YAAG,EAAC,QAAQ,CAAC;IACb,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC3B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,oJAAoJ;KACvJ,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,KAAK;QACf,WAAW,EACT,6HAA6H;QAC/H,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;KACxC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;KACzC,CAAC;;;;gDAGD;AAsBK;IAhBL,IAAA,yBAAM,GAAE;IACR,IAAA,YAAG,EAAC,iBAAiB,CAAC;IACtB,IAAA,kBAAS,EAAC,qCAAgB,CAAC;IAC5B,yEAAyE;IACzE,oCAAoC;;IACnC,IAAA,mBAAU,EAAC,0DAA0B,CAAC;IACtC,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,kKAAkK;KACrK,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EACT,kMAAkM;KACrM,CAAC;IAEC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAwBP;AAsBK;IAhBL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,uBAAa,EAAC,UAAU,CAAC;IACzB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,4DAA4D;KAC1E,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,8BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,yCAAyC;KACvD,CAAC;IAEC,WAAA,IAAA,oCAAW,GAAE,CAAA;;;;oDAUf;AAqBK;IAfL,IAAA,yBAAM,GAAE;IACR,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EAAE,kDAAkD;KAChE,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kBAAkB;KAChC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;KAChD,CAAC;IAEC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;6CAkB5B;AAgCK;IA1BL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,qBAAI,GAAE;IACN,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,wFAAwF;YACxF,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,sFAAsF;YACtF,0FAA0F;YAC1F,+DAA+D;KAClE,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,iFAAiF;QAC9F,IAAI,EAAE,gCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;IACtF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IAC7F,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,oGAAoG;KAClH,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;IAEhG,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,8CAAgB,GAAE,CAAA;IAClB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;qCAHd,6BAAY;;+CAsB1B;AAsBK;IAhBL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,uBAAa,EAAC,UAAU,CAAC;IACzB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,QAAQ;QACjB,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,mBAAmB;KACjC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,yCAAyC;KACvD,CAAC;IAEC,WAAA,IAAA,oCAAW,GAAE,CAAA;IACb,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;4CAU5B;AAsBK;IAhBL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,kBAAS,EAAC,6BAAY,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,uBAAa,EAAC,UAAU,CAAC;IACzB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,gDAAgD;KAC9D,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,iCAAiC;KAC/C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,yCAAyC;KACvD,CAAC;IAEC,WAAA,IAAA,oCAAW,GAAE,CAAA;IACb,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;+CAQ5B;yBA7SU,cAAc;IAH1B,IAAA,iBAAO,EAAC,gBAAgB,CAAC;IACzB,IAAA,mBAAU,EAAC,MAAM,CAAC;IAClB,IAAA,8BAAsB,GAAE;qCAKS,0BAAW;QACT,sBAAa;GALpC,cAAc,CA8S1B"}

package/dist/identity/auth/auth.module.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Sign-in, sessions and tokens: `AuthController` (`/api/auth/*`), `AuthService`,
+ * the JWT strategy, the initial-administrator bootstrap, the nightly
+ * `auth.token.cleanup` job with its enqueue-only cron, and the `auth.*` Doctor
+ * checks. Mounted by `IdentityModule.forRoot()` with the host-port modules,
+ * `PatModule`, `OrganizationsModule` and every registered sign-in provider's
+ * strategy; never import it directly.
+ *
+ * Exports `AuthService`, `AdminBootstrapService` and `JwtModule`.
+ *
+ * @stability experimental
+ */
+export declare class AuthModule {
+}
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/identity/auth/auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../../src/identity/auth/auth.module.ts"],"names":[],"mappings":"AAoBA;;;;;;;;;;;GAWG;AACH,qBA+Ca,UAAU;CAAG"}

package/dist/identity/auth/auth.module.js

@@ -0,0 +1,89 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const jwt_1 = require("@nestjs/jwt");
+const config_1 = require("@nestjs/config");
+const allowlist_module_1 = require("../allowlist/allowlist.module");
+const auth_controller_1 = require("./auth.controller");
+const auth_provider_controller_1 = require("./auth-provider.controller");
+const auth_service_1 = require("./auth.service");
+const jwt_strategy_1 = require("./strategies/jwt.strategy");
+const admin_bootstrap_service_1 = require("./admin-bootstrap.service");
+const identity_configuration_1 = require("../identity.configuration");
+const token_cleanup_task_1 = require("./tasks/token-cleanup.task");
+const token_cleanup_handler_1 = require("./handlers/token-cleanup.handler");
+const auth_providers_doctor_check_1 = require("./doctor/auth-providers.doctor-check");
+const auth_providers_egress_contributor_1 = require("./doctor/egress/auth-providers.egress.contributor");
+const initial_admin_doctor_check_1 = require("./doctor/initial-admin.doctor-check");
+const jwt_secret_doctor_check_1 = require("./doctor/jwt-secret.doctor-check");
+const principal_cache_module_1 = require("./principal-cache/principal-cache.module");
+const principal_cache_doctor_check_1 = require("./doctor/principal-cache.doctor-check");
+/**
+ * Sign-in, sessions and tokens: `AuthController` (`/api/auth/*`), `AuthService`,
+ * the JWT strategy, the initial-administrator bootstrap, the nightly
+ * `auth.token.cleanup` job with its enqueue-only cron, and the `auth.*` Doctor
+ * checks. Mounted by `IdentityModule.forRoot()` with the host-port modules,
+ * `PatModule`, `OrganizationsModule` and every registered sign-in provider's
+ * strategy; never import it directly.
+ *
+ * Exports `AuthService`, `AdminBootstrapService` and `JwtModule`.
+ *
+ * @stability experimental
+ */
+let AuthModule = class AuthModule {
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            // Passport configuration
+            passport_1.PassportModule.register({ defaultStrategy: 'jwt' }),
+            // JWT configuration. No fallback secret: a missing JWT_SECRET is a boot
+            // error (`requireJwtSecret`), never a key published in this package.
+            jwt_1.JwtModule.registerAsync({
+                inject: [config_1.ConfigService],
+                useFactory: (config) => ({
+                    secret: (0, identity_configuration_1.requireJwtSecret)(config),
+                    signOptions: {
+                        expiresIn: `${config.get('jwt.accessTtlMinutes', 15)}m`,
+                    },
+                }),
+            }),
+            // PP-1.12 (#683): `validateJwtPayload` reads principals through it.
+            principal_cache_module_1.PrincipalCacheModule,
+            // Allowlist module for email allowlist checks
+            allowlist_module_1.AllowlistModule,
+            // The app's host ports (the notifier `handleGoogleLogin` raises
+            // `user.welcome` through, the jobs port the nightly token cleanup is
+            // queued through), `PatService` (PAT validation in JwtAuthGuard) and
+            // `OrganizationsService` (`createNewUser` joins a new user to the default
+            // org) come from global modules `IdentityModule.forRoot()` mounts.
+        ],
+        controllers: [auth_controller_1.AuthController, auth_provider_controller_1.AuthProviderController],
+        providers: [
+            auth_service_1.AuthService,
+            admin_bootstrap_service_1.AdminBootstrapService,
+            jwt_strategy_1.JwtStrategy,
+            token_cleanup_task_1.TokenCleanupTask,
+            token_cleanup_handler_1.TokenCleanupHandler,
+            // Doctor checks (#634) — see `DoctorCheckRegistry` in `@marinoscar/platform-api/doctor`.
+            jwt_secret_doctor_check_1.JwtSecretDoctorCheck,
+            auth_providers_doctor_check_1.AuthProvidersDoctorCheck,
+            initial_admin_doctor_check_1.InitialAdminDoctorCheck,
+            // PP-1.12 (#683): `auth.principal-cache`.
+            principal_cache_doctor_check_1.PrincipalCacheDoctorCheck,
+            // Egress inventory (#773): each registered sign-in provider's outbound hosts.
+            auth_providers_egress_contributor_1.AuthProvidersEgressContributor,
+        ],
+        exports: [auth_service_1.AuthService, admin_bootstrap_service_1.AdminBootstrapService, jwt_1.JwtModule],
+    })
+], AuthModule);
+//# sourceMappingURL=auth.module.js.map

package/dist/identity/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../../src/identity/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,+CAAkD;AAClD,qCAAwC;AACxC,2CAA+C;AAC/C,oEAAgE;AAChE,uDAAmD;AACnD,yEAAoE;AACpE,iDAA6C;AAC7C,4DAAwD;AACxD,uEAAkE;AAClE,sEAA6D;AAC7D,mEAA8D;AAC9D,4EAAuE;AACvE,sFAAgF;AAChF,yGAAmG;AACnG,oFAA8E;AAC9E,8EAAwE;AACxE,qFAAgF;AAChF,wFAAkF;AAElF;;;;;;;;;;;GAWG;AAgDI,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IA/CtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,yBAAyB;YACzB,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;YAEnD,wEAAwE;YACxE,qEAAqE;YACrE,eAAS,CAAC,aAAa,CAAC;gBACtB,MAAM,EAAE,CAAC,sBAAa,CAAC;gBACvB,UAAU,EAAE,CAAC,MAAqB,EAAE,EAAE,CAAC,CAAC;oBACtC,MAAM,EAAE,IAAA,yCAAgB,EAAC,MAAM,CAAC;oBAChC,WAAW,EAAE;wBACX,SAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAS,sBAAsB,EAAE,EAAE,CAAC,GAAG;qBAChE;iBACF,CAAC;aACH,CAAC;YAEF,oEAAoE;YACpE,6CAAoB;YAEpB,8CAA8C;YAC9C,kCAAe;YAEf,gEAAgE;YAChE,qEAAqE;YACrE,qEAAqE;YACrE,0EAA0E;YAC1E,mEAAmE;SACpE;QACD,WAAW,EAAE,CAAC,gCAAc,EAAE,iDAAsB,CAAC;QACrD,SAAS,EAAE;YACT,0BAAW;YACX,+CAAqB;YACrB,0BAAW;YACX,qCAAgB;YAChB,2CAAmB;YACnB,yFAAyF;YACzF,8CAAoB;YACpB,sDAAwB;YACxB,oDAAuB;YACvB,0CAA0C;YAC1C,wDAAyB;YACzB,8EAA8E;YAC9E,kEAA8B;SAC/B;QACD,OAAO,EAAE,CAAC,0BAAW,EAAE,+CAAqB,EAAE,eAAS,CAAC;KACzD,CAAC;GACW,UAAU,CAAG"}