@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.4

package/dist/identity/auth/providers/cookie-state-store.d.ts

@@ -0,0 +1,88 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/**
+ * Options of {@link createCookieStateStore}.
+ *
+ * @stability experimental
+ */
+export interface CookieStateStoreOptions {
+    /** The HMAC key (for example the app's JWT secret; the signature is domain-separated). */
+    secret: string;
+    /** The cookie name. Default `oauth_state`. */
+    cookieName?: string;
+    /** Lifetime in seconds. Default 600. */
+    ttlSeconds?: number;
+    /** The `Secure` attribute. Default: `NODE_ENV === 'production'`. */
+    secure?: boolean;
+}
+/**
+ * The raw request as the store sees it: Passport's request plus the response the
+ * identity guard attaches.
+ *
+ * @stability experimental
+ */
+export type CookieStateStoreRequest = IncomingMessage & {
+    /** The raw response, attached by the identity sign-in guard. */
+    res?: ServerResponse;
+    /** Set by `verify`: the cookie the guard clears from the Fastify reply (the raw header would be overwritten by Fastify's own `Set-Cookie`). */
+    clearAuthStateCookie?: string;
+};
+/**
+ * The `store` object `passport-oauth2` calls.
+ *
+ * @stability experimental
+ */
+export interface CookieStateStore {
+    /**
+     * Generates a state, remembers it in the cookie and passes it to the provider.
+     *
+     * @param req - Passport's raw request, with the response attached.
+     * @param callback - receives the state to send to the provider.
+     */
+    store(req: CookieStateStoreRequest, callback: (error: Error | null, state: string) => void): void;
+    /**
+     * The same, in the shape `@types/passport-oauth2` declares (a `meta` argument that is ignored).
+     *
+     * @param req - Passport's raw request, with the response attached.
+     * @param meta - ignored.
+     * @param callback - receives the state to send to the provider.
+     */
+    store(req: CookieStateStoreRequest, meta: unknown, callback: (error: Error | null, state: string) => void): void;
+    /**
+     * Checks the returned state against the cookie and marks the cookie for clearing.
+     *
+     * @param req - Passport's raw request.
+     * @param providedState - the `state` the provider sent back.
+     * @param callback - `ok` is true for a valid, unexpired, matching state.
+     */
+    verify(req: CookieStateStoreRequest, providedState: string, callback: (error: Error | null, ok: boolean, info?: {
+        message: string;
+    }) => void): void;
+    /**
+     * The same, in the shape `@types/passport-oauth2` declares (a `meta` argument that is ignored).
+     *
+     * @param req - Passport's raw request.
+     * @param providedState - the `state` the provider sent back.
+     * @param meta - ignored.
+     * @param callback - `ok` is true for a valid, unexpired, matching state.
+     */
+    verify(req: CookieStateStoreRequest, providedState: string, meta: unknown, callback: (error: Error | null, ok: boolean, info?: {
+        message: string;
+    }) => void): void;
+}
+/**
+ * A `store` for `passport-oauth2`'s `state` option that works without a session
+ * plugin. Pass it as `store` (not `state: true`) in the strategy's options.
+ *
+ * @param options - the signing key and optional cookie settings.
+ * @returns the store: `store(req, callback)` and `verify(req, providedState, callback)`.
+ *
+ * @example
+ * ```ts
+ * new GithubStrategy({ clientID, clientSecret, callbackURL, store: createCookieStateStore({ secret: jwtSecret }) }, verify);
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+export declare function createCookieStateStore(options: CookieStateStoreOptions): CookieStateStore;
+//# sourceMappingURL=cookie-state-store.d.ts.map

package/dist/identity/auth/providers/cookie-state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-state-store.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/providers/cookie-state-store.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,uBAAuB,GAAG,eAAe,GAAG;IACtD,gEAAgE;IAChE,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,+IAA+I;IAC/I,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAClG;;;;;;OAMG;IACH,KAAK,CAAC,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IACjH;;;;;;OAMG;IACH,MAAM,CACJ,GAAG,EAAE,uBAAuB,EAC5B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAC/E,IAAI,CAAC;IACR;;;;;;;OAOG;IACH,MAAM,CACJ,GAAG,EAAE,uBAAuB,EAC5B,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAC/E,IAAI,CAAC;CACT;AAcD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,CAkCzF"}

package/dist/identity/auth/providers/cookie-state-store.js

@@ -0,0 +1,86 @@
+"use strict";
+// =============================================================================
+// A cookie-backed `state` store for passport-oauth2 strategies (PP-14.9)
+// =============================================================================
+//
+// WHY. `state: true` / `pkce: true` of `passport-oauth2` use a session store and
+// fail with "requires session support" on every sign-in in this app (Fastify,
+// no session plugin). The slice itself adds neither, so a real OAuth 2.0
+// provider must bring a `store`. This one keeps the state in a short-lived,
+// HMAC-signed cookie:
+//
+//   - HttpOnly, SameSite=Lax (sent on the provider's top-level redirect back),
+//     Path=/api/auth, Secure in production, 10 minutes;
+//   - the value is `state.expiry.HMAC(state.expiry)`, so a forged or edited
+//     cookie fails; the comparison with the `state` the provider returned and
+//     the signature check are constant time;
+//   - cleared when the callback is verified (single use).
+//
+// It does not do PKCE (the verifier would need the same treatment); pass a
+// store of your own for that. The cookie is written on the raw response and read
+// from the raw request's `Cookie` header, which is what Passport hands a store.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCookieStateStore = createCookieStateStore;
+const node_crypto_1 = require("node:crypto");
+const sign = (secret, payload) => (0, node_crypto_1.createHmac)('sha256', secret).update(`oauth-state:${payload}`).digest();
+const equal = (a, b) => a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b);
+function readCookie(header, name) {
+    for (const part of (header ?? '').split(';')) {
+        const [key, ...value] = part.trim().split('=');
+        if (key === name)
+            return value.join('=');
+    }
+    return undefined;
+}
+/**
+ * A `store` for `passport-oauth2`'s `state` option that works without a session
+ * plugin. Pass it as `store` (not `state: true`) in the strategy's options.
+ *
+ * @param options - the signing key and optional cookie settings.
+ * @returns the store: `store(req, callback)` and `verify(req, providedState, callback)`.
+ *
+ * @example
+ * ```ts
+ * new GithubStrategy({ clientID, clientSecret, callbackURL, store: createCookieStateStore({ secret: jwtSecret }) }, verify);
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+function createCookieStateStore(options) {
+    if (!options.secret)
+        throw new TypeError('createCookieStateStore requires a secret');
+    const name = options.cookieName ?? 'oauth_state';
+    const ttl = options.ttlSeconds ?? 600;
+    const attributes = `Path=/api/auth; HttpOnly; SameSite=Lax${(options.secure ?? process.env.NODE_ENV === 'production') ? '; Secure' : ''}`;
+    // Written with the two-argument `store` and three-argument `verify` Passport
+    // dispatches on by arity (`Function.length`); the overloads above are typing only.
+    const impl = {
+        store(req, callback) {
+            const res = req.res;
+            if (!res)
+                return callback(new Error('The cookie state store needs the response; use it with the identity sign-in routes'), '');
+            const state = (0, node_crypto_1.randomBytes)(24).toString('base64url');
+            const payload = `${state}.${Math.floor(Date.now() / 1000) + ttl}`;
+            res.appendHeader('Set-Cookie', `${name}=${payload}.${sign(options.secret, payload).toString('base64url')}; Max-Age=${ttl}; ${attributes}`);
+            callback(null, state);
+        },
+        verify(req, providedState, callback) {
+            const fail = (message) => callback(null, false, { message });
+            const [state, expiry, signature] = (readCookie(req.headers.cookie, name) ?? '').split('.');
+            req.clearAuthStateCookie = name;
+            if (!state || !expiry || !signature || typeof providedState !== 'string')
+                return fail('Unable to verify authorization request state.');
+            if (!equal(sign(options.secret, `${state}.${expiry}`), Buffer.from(signature, 'base64url')))
+                return fail('Invalid authorization request state.');
+            if (Number(expiry) <= Math.floor(Date.now() / 1000))
+                return fail('The authorization request expired.');
+            if (!equal(Buffer.from(state), Buffer.from(providedState)))
+                return fail('Invalid authorization request state.');
+            callback(null, true);
+        },
+    };
+    return impl;
+}
+//# sourceMappingURL=cookie-state-store.js.map

package/dist/identity/auth/providers/cookie-state-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-state-store.js","sourceRoot":"","sources":["../../../../src/identity/auth/providers/cookie-state-store.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,yEAAyE;AACzE,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,sBAAsB;AACtB,EAAE;AACF,+EAA+E;AAC/E,wDAAwD;AACxD,4EAA4E;AAC5E,8EAA8E;AAC9E,6CAA6C;AAC7C,0DAA0D;AAC1D,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;;AA8GhF,wDAkCC;AA9ID,6CAAuE;AAiFvE,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,OAAe,EAAU,EAAE,CAAC,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEjI,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEhG,SAAS,UAAU,CAAC,MAA0B,EAAE,IAAY;IAC1D,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IACtC,MAAM,UAAU,GAAG,yCAAyC,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAE1I,6EAA6E;IAC7E,mFAAmF;IACnF,MAAM,IAAI,GAAG;QACX,KAAK,CAAC,GAA4B,EAAE,QAAsD;YACxF,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;YACpB,IAAI,CAAC,GAAG;gBAAE,OAAO,QAAQ,CAAC,IAAI,KAAK,CAAC,oFAAoF,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/H,MAAM,KAAK,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YAClE,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,GAAG,IAAI,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,aAAa,GAAG,KAAK,UAAU,EAAE,CAAC,CAAC;YAC3I,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,CACJ,GAA4B,EAC5B,aAAqB,EACrB,QAAgF;YAEhF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3F,GAAG,CAAC,oBAAoB,GAAG,IAAI,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,OAAO,aAAa,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,+CAA+C,CAAC,CAAC;YACvI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACjJ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACvG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,sCAAsC,CAAC,CAAC;YAChH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;KACF,CAAC;IACF,OAAO,IAAwB,CAAC;AAClC,CAAC"}

package/dist/identity/auth/providers/google.provider.d.ts

@@ -0,0 +1,3 @@
+/** Hosts Google sign-in needs (the API exchanges the code and reads the profile; the browser signs in). */
+export declare const GOOGLE_OAUTH_HOSTS: readonly ["accounts.google.com", "oauth2.googleapis.com", "www.googleapis.com"];
+//# sourceMappingURL=google.provider.d.ts.map

package/dist/identity/auth/providers/google.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.provider.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/providers/google.provider.ts"],"names":[],"mappings":"AAcA,2GAA2G;AAC3G,eAAO,MAAM,kBAAkB,iFAAkF,CAAC"}

package/dist/identity/auth/providers/google.provider.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GOOGLE_OAUTH_HOSTS = void 0;
+// Google, the first registered sign-in provider (issue #727). Registered when
+// the identity slice loads; enabled when GOOGLE_CLIENT_ID and
+// GOOGLE_CLIENT_SECRET are set (the app's `google.clientId` and
+// `google.clientSecret` configuration keys), exactly as before the registry.
+//
+// Google keeps the class-based path (`strategy` + `guard`, built by Nest at
+// boot from the environment-backed configuration) and its own routes in
+// `AuthController`; only its profile mapping and its linking rule are stated
+// here, as data, so the shared sign-in path reads them like any provider's.
+const google_oauth_guard_1 = require("../guards/google-oauth.guard");
+const google_strategy_1 = require("../strategies/google.strategy");
+const external_profile_1 = require("../external-profile");
+const auth_provider_registry_1 = require("./auth-provider.registry");
+/** Hosts Google sign-in needs (the API exchanges the code and reads the profile; the browser signs in). */
+exports.GOOGLE_OAUTH_HOSTS = ['accounts.google.com', 'oauth2.googleapis.com', 'www.googleapis.com'];
+if (!auth_provider_registry_1.authProviderRegistry.has('google')) {
+    auth_provider_registry_1.authProviderRegistry.register({
+        id: 'google',
+        label: 'Google',
+        strategy: google_strategy_1.GoogleStrategy,
+        guard: google_oauth_guard_1.GoogleOAuthGuard,
+        isEnabled: (config) => Boolean(config.get('google.clientId') && config.get('google.clientSecret')),
+        mapProfile: external_profile_1.googleProfileToExternal,
+        // Google links a new sign-in to the user holding the same address: its
+        // addresses are verified by Google and the behaviour predates the seam.
+        linkExistingByEmail: true,
+        egressHosts: exports.GOOGLE_OAUTH_HOSTS,
+        doctorRemedy: 'Set GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET and GOOGLE_CALLBACK_URL (see infra/compose/.env.example) and restart the API.',
+    });
+}
+//# sourceMappingURL=google.provider.js.map

package/dist/identity/auth/providers/google.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.provider.js","sourceRoot":"","sources":["../../../../src/identity/auth/providers/google.provider.ts"],"names":[],"mappings":";;;AAAA,8EAA8E;AAC9E,8DAA8D;AAC9D,gEAAgE;AAChE,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,6EAA6E;AAC7E,4EAA4E;AAC5E,qEAAgE;AAChE,mEAA+D;AAC/D,0DAA8D;AAC9D,qEAAgE;AAEhE,2GAA2G;AAC9F,QAAA,kBAAkB,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,oBAAoB,CAAU,CAAC;AAElH,IAAI,CAAC,6CAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxC,6CAAoB,CAAC,QAAQ,CAAC;QAC5B,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,QAAQ,EAAE,gCAAc;QACxB,KAAK,EAAE,qCAAgB;QACvB,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAS,iBAAiB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAS,qBAAqB,CAAC,CAAC;QAClH,UAAU,EAAE,0CAAuB;QACnC,uEAAuE;QACvE,wEAAwE;QACxE,mBAAmB,EAAE,IAAI;QACzB,WAAW,EAAE,0BAAkB;QAC/B,YAAY,EACV,0HAA0H;KAC7H,CAAC,CAAC;AACL,CAAC"}

package/dist/identity/auth/sign-in-policy.d.ts

@@ -0,0 +1,87 @@
+import type { AuthLoginDeniedReason } from './auth-error-codes';
+import type { ExternalProfile } from './external-profile';
+/**
+ * Injection token of the app's {@link SignInPolicy}. Bind it with
+ * `IdentityModule.forRoot({ signInPolicy })`; a provider in the app's own module
+ * is invisible to identity's internals. Optional: without it every sign-in the
+ * allowlist admits is allowed.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+export declare const IDENTITY_SIGNIN_POLICY: unique symbol;
+/**
+ * What the policy knows about the sign-in beyond the profile.
+ *
+ * @stability experimental
+ */
+export interface SignInContext {
+    /** The existing user this sign-in resolves to (by provider identity, or by a permitted email link), or `null` when a user would be created. */
+    readonly existingUserId: string | null;
+    /** True when the address is `INITIAL_ADMIN_EMAIL` (the allowlist bypass). */
+    readonly isInitialAdmin: boolean;
+}
+/**
+ * An allowing answer: continue. `roles` are applied ONLY when this sign-in
+ * creates the user (so an administrator's later role edits stick): a role whose
+ * scope is `org` becomes the new membership's role in the default organization
+ * (at most one; the initial administrator keeps `org_admin`), a role whose scope
+ * is `system` is added to the user's system roles. An unknown role name fails
+ * the sign-in closed (`authentication_failed`) before anything is written.
+ *
+ * Map roles only from claims the provider vouches for; a role granted from an
+ * unverified field is a privilege escalation.
+ *
+ * @stability experimental
+ */
+export interface SignInAllow {
+    /** Always `true`. */
+    readonly allow: true;
+    /** Role names to apply to a user this sign-in creates. */
+    readonly roles?: readonly string[];
+}
+/**
+ * A refusing answer: the redirect carries only the closed code, never text.
+ *
+ * @stability experimental
+ */
+export interface SignInDeny {
+    /** Always `false`. */
+    readonly allow: false;
+    /** One of the closed login-denied reasons. */
+    readonly reason: AuthLoginDeniedReason;
+}
+/**
+ * A policy's answer: {@link SignInAllow} or {@link SignInDeny}.
+ *
+ * @stability experimental
+ */
+export type SignInDecision = SignInAllow | SignInDeny;
+/**
+ * The app's sign-in policy.
+ *
+ * @example
+ * ```ts
+ * class CompanyDomainPolicy implements SignInPolicy {
+ *   async beforeLogin(profile: ExternalProfile): Promise<SignInDecision> {
+ *     return profile.email?.endsWith('@acme.example')
+ *       ? { allow: true }
+ *       : { allow: false, reason: 'access_denied' };
+ *   }
+ * }
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+export interface SignInPolicy {
+    /**
+     * Decides one sign-in. A throw refuses the sign-in as `authentication_failed`
+     * (fail closed).
+     *
+     * @param profile - the provider's profile (never log `raw`).
+     * @param ctx - the existing user, if any, and the initial-admin flag.
+     */
+    beforeLogin(profile: ExternalProfile, ctx: SignInContext): Promise<SignInDecision> | SignInDecision;
+}
+//# sourceMappingURL=sign-in-policy.d.ts.map

package/dist/identity/auth/sign-in-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-policy.d.ts","sourceRoot":"","sources":["../../../src/identity/auth/sign-in-policy.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAAE,OAAO,MAAkE,CAAC;AAE/G;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,+IAA+I;IAC/I,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B,qBAAqB;IACrB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,sBAAsB;IACtB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,UAAU,CAAC;AAEtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAAC;CACrG"}

package/dist/identity/auth/sign-in-policy.js

@@ -0,0 +1,34 @@
+"use strict";
+// =============================================================================
+// The sign-in policy seam (PP-14.9)
+// =============================================================================
+//
+// The allowlist is the platform's only built-in gate on who may sign in. An app
+// that needs more (a company domain, a tenant id claim, a provider-specific
+// group, a role derived from a claim) binds a `SignInPolicy`:
+//
+//   IdentityModule.forRoot({ signInPolicy: { useClass: CompanyDomainPolicy } })
+//
+// WHERE IT RUNS. After the allowlist (and the verified-address rule) and before
+// any write: a denial creates, links and updates nothing. It runs for EVERY
+// provider, Google included, so a domain rule cannot be bypassed by choosing
+// another provider. Without a binding nothing changes: every sign-in the
+// allowlist admits is allowed.
+//
+// WHAT IT CANNOT DO. It cannot widen access: the allowlist, the disabled-account
+// check and the tenancy rules still run after it. `INITIAL_ADMIN_EMAIL` bypasses
+// the allowlist, not the policy.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_SIGNIN_POLICY = void 0;
+/**
+ * Injection token of the app's {@link SignInPolicy}. Bind it with
+ * `IdentityModule.forRoot({ signInPolicy })`; a provider in the app's own module
+ * is invisible to identity's internals. Optional: without it every sign-in the
+ * allowlist admits is allowed.
+ *
+ * @extensionPoint token
+ * @stability experimental
+ */
+exports.IDENTITY_SIGNIN_POLICY = Symbol.for('@marinoscar/platform/identity/SIGNIN_POLICY');
+//# sourceMappingURL=sign-in-policy.js.map

package/dist/identity/auth/sign-in-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-policy.js","sourceRoot":"","sources":["../../../src/identity/auth/sign-in-policy.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,8DAA8D;AAC9D,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,iCAAiC;AACjC,gFAAgF;;;AAKhF;;;;;;;;GAQG;AACU,QAAA,sBAAsB,GAAkB,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC"}

package/dist/identity/auth/sign-in-response.d.ts

@@ -0,0 +1,94 @@
+import type { Logger } from '@nestjs/common';
+import type { FullTokenResponse } from './auth.service';
+import type { CookieReply } from './cookie-http';
+/**
+ * The refresh-token cookie's name.
+ *
+ * @stability experimental
+ */
+export declare const REFRESH_TOKEN_COOKIE = "refresh_token";
+/**
+ * The attributes of the refresh-token cookie.
+ *
+ * @stability experimental
+ */
+export interface RefreshTokenCookieOptions {
+    /** Always `true`: script cannot read the cookie. */
+    httpOnly: true;
+    /** `true` when `NODE_ENV` is `production` (read at load). */
+    secure: boolean;
+    /** Always `lax`. */
+    sameSite: 'lax';
+    /** Always `/api/auth`: the cookie goes only to the auth routes. */
+    path: string;
+    /** Lifetime in seconds (the cookie spec counts seconds): 14 days. */
+    maxAge: number;
+}
+/**
+ * The refresh-token cookie's attributes: HttpOnly, `SameSite=Lax`,
+ * `Path=/api/auth`, 14 days (seconds, as the cookie spec counts), `Secure` when
+ * `NODE_ENV` is `production` (read at load).
+ *
+ * @stability experimental
+ */
+export declare const REFRESH_TOKEN_COOKIE_OPTIONS: Readonly<RefreshTokenCookieOptions>;
+/**
+ * Sets the refresh token in the HttpOnly cookie with the slice's attributes.
+ *
+ * @param reply - the Fastify reply (with `@fastify/cookie`).
+ * @param refreshToken - the refresh token.
+ *
+ * @stability experimental
+ */
+export declare function setRefreshTokenCookie(reply: CookieReply, refreshToken: string): void;
+/**
+ * The web app's callback URL for a finished sign-in:
+ * `${appUrl}/auth/callback?token=<access>&expiresIn=<seconds>`.
+ *
+ * @param appUrl - the web app's origin (`appUrl` configuration).
+ * @param tokens - the tokens `completeExternalLogin` returned.
+ *
+ * @stability experimental
+ */
+export declare function buildSignInSuccessRedirectUrl(appUrl: string | undefined, tokens: Pick<FullTokenResponse, 'accessToken' | 'expiresIn'>): string;
+/**
+ * What {@link respondToSignIn} takes.
+ *
+ * @stability experimental
+ */
+export interface RespondToSignInInput {
+    /** The Fastify reply. */
+    reply: CookieReply;
+    /** The web app's origin (`appUrl` configuration). */
+    appUrl: string | undefined;
+    /** Runs the login (`() => authService.completeExternalLogin(profile)`); its throw becomes an `error=<code>` redirect. */
+    signIn: () => Promise<FullTokenResponse>;
+    /** The caller's logger. */
+    logger: Pick<Logger, 'log' | 'error'>;
+    /** Names the callback in log lines (`Google OAuth callback`). */
+    label: string;
+}
+/**
+ * Runs a sign-in and answers the browser: on success the refresh cookie and a
+ * 302 to the web callback with the access token; on any failure a 302 to the
+ * callback with `error=<code>` (`resolveAuthErrorCode`, the closed set).
+ *
+ * @param input - see {@link RespondToSignInInput}.
+ * @returns the reply, after `redirect`.
+ *
+ * @example
+ * ```ts
+ * @Get('callback')
+ * callback(@Req() req, @Res() reply: CookieReply) {
+ *   return respondToSignIn({
+ *     reply, appUrl: this.config.get('appUrl'), logger: this.logger, label: 'SSO callback',
+ *     signIn: () => this.auth.completeExternalLogin(mapMyProfile(req.body)),
+ *   });
+ * }
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+export declare function respondToSignIn(input: RespondToSignInInput): Promise<unknown>;
+//# sourceMappingURL=sign-in-response.d.ts.map

package/dist/identity/auth/sign-in-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-response.d.ts","sourceRoot":"","sources":["../../../src/identity/auth/sign-in-response.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAI7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,oDAAoD;IACpD,QAAQ,EAAE,IAAI,CAAC;IACf,6DAA6D;IAC7D,MAAM,EAAE,OAAO,CAAC;IAChB,oBAAoB;IACpB,QAAQ,EAAE,KAAK,CAAC;IAChB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,yBAAyB,CAM3E,CAAC;AAEH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAEpF;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,iBAAiB,EAAE,aAAa,GAAG,WAAW,CAAC,GAAG,MAAM,CAK9I;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,yBAAyB;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,yHAAyH;IACzH,MAAM,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzC,2BAA2B;IAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;IACtC,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAgCnF"}

package/dist/identity/auth/sign-in-response.js

@@ -0,0 +1,128 @@
+"use strict";
+// =============================================================================
+// The browser half of a sign-in: the refresh cookie and the redirect (PP-14.9)
+// =============================================================================
+//
+// Moved out of `AuthController`'s private members so that EVERY provider's
+// callback (Google's, the generic `AuthProviderController`'s and a `custom`
+// provider's own controller) ends a sign-in identically:
+//
+//   - the refresh token is set in the HttpOnly `refresh_token` cookie, the ONLY
+//     cookie the slice sets (`SameSite=Lax`, `Path=/api/auth`, 14 days,
+//     `Secure` in production);
+//   - the browser is redirected to the web app's `/auth/callback` with the
+//     ACCESS token and its lifetime in the query string (the access token is
+//     read only from `Authorization: Bearer` afterwards) or, on a refusal,
+//     with `error=<code>` from the closed set (the exception's message never
+//     reaches the redirect);
+//   - the redirect is an explicit 302 (Nest pre-sets 200 and Fastify's
+//     `redirect` keeps a status that was set).
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFRESH_TOKEN_COOKIE_OPTIONS = exports.REFRESH_TOKEN_COOKIE = void 0;
+exports.setRefreshTokenCookie = setRefreshTokenCookie;
+exports.buildSignInSuccessRedirectUrl = buildSignInSuccessRedirectUrl;
+exports.respondToSignIn = respondToSignIn;
+const index_1 = require("../../core/index");
+const auth_error_codes_1 = require("./auth-error-codes");
+/**
+ * The refresh-token cookie's name.
+ *
+ * @stability experimental
+ */
+exports.REFRESH_TOKEN_COOKIE = 'refresh_token';
+/**
+ * The refresh-token cookie's attributes: HttpOnly, `SameSite=Lax`,
+ * `Path=/api/auth`, 14 days (seconds, as the cookie spec counts), `Secure` when
+ * `NODE_ENV` is `production` (read at load).
+ *
+ * @stability experimental
+ */
+exports.REFRESH_TOKEN_COOKIE_OPTIONS = Object.freeze({
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/api/auth',
+    maxAge: 14 * 24 * 60 * 60,
+});
+/**
+ * Sets the refresh token in the HttpOnly cookie with the slice's attributes.
+ *
+ * @param reply - the Fastify reply (with `@fastify/cookie`).
+ * @param refreshToken - the refresh token.
+ *
+ * @stability experimental
+ */
+function setRefreshTokenCookie(reply, refreshToken) {
+    reply.setCookie(exports.REFRESH_TOKEN_COOKIE, refreshToken, { ...exports.REFRESH_TOKEN_COOKIE_OPTIONS });
+}
+/**
+ * The web app's callback URL for a finished sign-in:
+ * `${appUrl}/auth/callback?token=<access>&expiresIn=<seconds>`.
+ *
+ * @param appUrl - the web app's origin (`appUrl` configuration).
+ * @param tokens - the tokens `completeExternalLogin` returned.
+ *
+ * @stability experimental
+ */
+function buildSignInSuccessRedirectUrl(appUrl, tokens) {
+    const redirectUrl = new URL('/auth/callback', appUrl);
+    redirectUrl.searchParams.set('token', tokens.accessToken);
+    redirectUrl.searchParams.set('expiresIn', tokens.expiresIn.toString());
+    return redirectUrl.toString();
+}
+/**
+ * Runs a sign-in and answers the browser: on success the refresh cookie and a
+ * 302 to the web callback with the access token; on any failure a 302 to the
+ * callback with `error=<code>` (`resolveAuthErrorCode`, the closed set).
+ *
+ * @param input - see {@link RespondToSignInInput}.
+ * @returns the reply, after `redirect`.
+ *
+ * @example
+ * ```ts
+ * @Get('callback')
+ * callback(@Req() req, @Res() reply: CookieReply) {
+ *   return respondToSignIn({
+ *     reply, appUrl: this.config.get('appUrl'), logger: this.logger, label: 'SSO callback',
+ *     signIn: () => this.auth.completeExternalLogin(mapMyProfile(req.body)),
+ *   });
+ * }
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+async function respondToSignIn(input) {
+    const { reply, appUrl, signIn, logger, label } = input;
+    try {
+        const tokens = await signIn();
+        // Set refresh token in HttpOnly cookie
+        logger.log(`Setting refresh token cookie with options: ${JSON.stringify(exports.REFRESH_TOKEN_COOKIE_OPTIONS)}`);
+        setRefreshTokenCookie(reply, tokens.refreshToken);
+        // Redirect to frontend with access token only. The URL carries the access
+        // token, so it is never logged.
+        logger.log('Redirecting to the web app callback');
+        return reply.status(302).redirect(buildSignInSuccessRedirectUrl(appUrl, tokens));
+    }
+    catch (error) {
+        // Log with full context for debugging
+        if (error instanceof index_1.DatabaseSeedException) {
+            logger.error(`Database seed error during ${label} - seeds have not been run`, {
+                error: error.message,
+                stack: error.stack,
+            });
+        }
+        else {
+            logger.error(`Error in ${label}`, error);
+        }
+        // Closed set of codes only: the exception's message never reaches the
+        // redirect, so the callback page cannot be made to show attacker-chosen text.
+        //
+        // EXPLICIT 302, like the success branch: by the time a route handler runs,
+        // Nest has already set the reply's status to the route default (200), and
+        // Fastify's `redirect(url)` keeps a status that was set.
+        return reply.status(302).redirect((0, auth_error_codes_1.buildAuthErrorRedirectUrl)(appUrl, (0, auth_error_codes_1.resolveAuthErrorCode)(error)));
+    }
+}
+//# sourceMappingURL=sign-in-response.js.map

package/dist/identity/auth/sign-in-response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-response.js","sourceRoot":"","sources":["../../../src/identity/auth/sign-in-response.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,yDAAyD;AACzD,EAAE;AACF,gFAAgF;AAChF,wEAAwE;AACxE,+BAA+B;AAC/B,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,6BAA6B;AAC7B,uEAAuE;AACvE,+CAA+C;AAC/C,gFAAgF;;;AAyDhF,sDAEC;AAWD,sEAKC;AA0CD,0CAgCC;AAjJD,4CAAyD;AACzD,yDAAqF;AAIrF;;;;GAIG;AACU,QAAA,oBAAoB,GAAG,eAAe,CAAC;AAoBpD;;;;;;GAMG;AACU,QAAA,4BAA4B,GAAwC,MAAM,CAAC,MAAM,CAAC;IAC7F,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;IAC7C,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;CAC1B,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,KAAkB,EAAE,YAAoB;IAC5E,KAAK,CAAC,SAAS,CAAC,4BAAoB,EAAE,YAAY,EAAE,EAAE,GAAG,oCAA4B,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,6BAA6B,CAAC,MAA0B,EAAE,MAA4D;IACpI,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACtD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1D,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC;AAChC,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;QAE9B,uCAAuC;QACvC,MAAM,CAAC,GAAG,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,oCAA4B,CAAC,EAAE,CAAC,CAAC;QACzG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,YAAa,CAAC,CAAC;QAEnD,0EAA0E;QAC1E,gCAAgC;QAChC,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sCAAsC;QACtC,IAAI,KAAK,YAAY,6BAAqB,EAAE,CAAC;YAC3C,MAAM,CAAC,KAAK,CAAC,8BAA8B,KAAK,4BAA4B,EAAE;gBAC5E,KAAK,EAAE,KAAK,CAAC,OAAO;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,sEAAsE;QACtE,8EAA8E;QAC9E,EAAE;QACF,2EAA2E;QAC3E,0EAA0E;QAC1E,yDAAyD;QACzD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAA,4CAAyB,EAAC,MAAM,EAAE,IAAA,uCAAoB,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;AACH,CAAC"}

package/dist/identity/auth/strategies/google.strategy.d.ts

@@ -0,0 +1,44 @@
+import { ConfigService } from '@nestjs/config';
+import { Strategy, VerifyCallback, Profile } from 'passport-google-oauth20';
+/**
+ * Google OAuth profile information extracted from the provider
+ *
+ * @stability stable
+ */
+export interface GoogleProfile {
+    /** Google's subject id. */
+    id: string;
+    /** The account's email. */
+    email: string;
+    /** The account's display name. */
+    displayName: string;
+    /** The account's picture URL, when it has one. */
+    picture?: string;
+}
+declare const GoogleStrategy_base: new (...args: [options: import("passport-google-oauth20").StrategyOptionsWithRequest] | [options: import("passport-google-oauth20").StrategyOptions] | [options: import("passport-google-oauth20").StrategyOptions] | [options: import("passport-google-oauth20").StrategyOptionsWithRequest]) => Strategy & {
+    validate(...args: any[]): unknown;
+};
+/**
+ * Google OAuth 2.0 authentication strategy
+ *
+ * Handles the OAuth flow with Google:
+ * 1. Redirects user to Google login
+ * 2. Google redirects back to callback URL
+ * 3. Strategy validates the authorization code
+ * 4. Extracts user profile information
+ */
+export declare class GoogleStrategy extends GoogleStrategy_base {
+    private readonly configService;
+    constructor(configService: ConfigService);
+    /**
+     * Validates the Google OAuth response and extracts user profile
+     *
+     * @param accessToken - OAuth access token (not used in our implementation)
+     * @param refreshToken - OAuth refresh token (not used in our implementation)
+     * @param profile - User profile from Google
+     * @param done - Passport callback
+     */
+    validate(accessToken: string, refreshToken: string, profile: Profile, done: VerifyCallback): Promise<void>;
+}
+export {};
+//# sourceMappingURL=google.strategy.d.ts.map

package/dist/identity/auth/strategies/google.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.strategy.d.ts","sourceRoot":"","sources":["../../../../src/identity/auth/strategies/google.strategy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAE5E;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;;;;AAED;;;;;;;;GAQG;AACH,qBACa,cAAe,SAAQ,mBAAoC;IAC1D,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IASzD;;;;;;;OAOG;IACG,QAAQ,CACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,IAAI,CAAC;CAmBjB"}