@miguelmorales13/nestkit 0.5.1 → 0.7.0

package/dist/auth/oauth/index.cjs

@@ -0,0 +1,610 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+var _chunkNVCI3CQIcjs = require('../../chunk-NVCI3CQI.cjs');
+
+
+
+var _chunkFDNGAYTZcjs = require('../../chunk-FDNGAYTZ.cjs');
+require('../../chunk-R7BVS6CI.cjs');
+
+
+
+var _chunk2REOCMUDcjs = require('../../chunk-2REOCMUD.cjs');
+
+// src/auth/oauth/oauth-provider.ts
+async function readJson(response, what) {
+  const text = await response.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch (e) {
+    throw new Error(`${what}: expected JSON, got ${response.status} ${text.slice(0, 200)}`);
+  }
+  if (!response.ok) {
+    throw new Error(`${what}: HTTP ${response.status} ${text.slice(0, 200)}`);
+  }
+  return body;
+}
+function googleProvider(credentials = {}) {
+  return {
+    name: "google",
+    clientId: _nullishCoalesce(credentials.clientId, () => ( process.env.GOOGLE_CLIENT_ID)),
+    clientSecret: _nullishCoalesce(credentials.clientSecret, () => ( process.env.GOOGLE_CLIENT_SECRET)),
+    callbackUrl: _nullishCoalesce(credentials.callbackUrl, () => ( process.env.GOOGLE_CALLBACK_URL)),
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    scope: _nullishCoalesce(credentials.scope, () => ( "email profile")),
+    authorizeParams: {
+      // Without this, someone signed into several Google accounts is put
+      // straight back into the one the browser last used, with no way to pick
+      // — which reads as the app ignoring who they wanted to be.
+      prompt: "select_account",
+      access_type: "offline"
+    },
+    async fetchProfile(accessToken) {
+      const data = await readJson(
+        await fetch("https://www.googleapis.com/oauth2/v3/userinfo", {
+          headers: { Authorization: `Bearer ${accessToken}` }
+        }),
+        "Google userinfo"
+      );
+      const email = data.email;
+      if (!email) throw new Error("Google did not return an email.");
+      return {
+        providerAccountId: String(data.sub),
+        email,
+        name: data.name,
+        avatarUrl: data.picture
+      };
+    }
+  };
+}
+function facebookProvider(credentials = {}) {
+  const version = _nullishCoalesce(process.env.FACEBOOK_GRAPH_VERSION, () => ( "v21.0"));
+  return {
+    name: "facebook",
+    clientId: _nullishCoalesce(credentials.clientId, () => ( process.env.FACEBOOK_APP_ID)),
+    clientSecret: _nullishCoalesce(credentials.clientSecret, () => ( process.env.FACEBOOK_APP_SECRET)),
+    callbackUrl: _nullishCoalesce(credentials.callbackUrl, () => ( process.env.FACEBOOK_CALLBACK_URL)),
+    authorizeUrl: `https://www.facebook.com/${version}/dialog/oauth`,
+    tokenUrl: `https://graph.facebook.com/${version}/oauth/access_token`,
+    scope: _nullishCoalesce(credentials.scope, () => ( "email")),
+    async fetchProfile(accessToken) {
+      const url = new URL(`https://graph.facebook.com/${version}/me`);
+      url.searchParams.set("fields", "id,name,email,picture.type(large)");
+      const data = await readJson(
+        await fetch(url, { headers: { Authorization: `Bearer ${accessToken}` } }),
+        "Facebook me"
+      );
+      const picture = data.picture;
+      return {
+        providerAccountId: String(data.id),
+        email: _nullishCoalesce(data.email, () => ( "")),
+        name: data.name,
+        avatarUrl: _optionalChain([picture, 'optionalAccess', _ => _.data, 'optionalAccess', _2 => _2.url])
+      };
+    }
+  };
+}
+function buildAuthorizeUrl(provider, state) {
+  const params = new URLSearchParams({
+    client_id: _nullishCoalesce(provider.clientId, () => ( "")),
+    redirect_uri: _nullishCoalesce(provider.callbackUrl, () => ( "")),
+    response_type: "code",
+    scope: provider.scope,
+    ...provider.authorizeParams,
+    ...state ? { state } : {}
+  });
+  return `${provider.authorizeUrl}?${params.toString()}`;
+}
+async function exchangeCodeForToken(provider, code) {
+  const body = new URLSearchParams({
+    client_id: _nullishCoalesce(provider.clientId, () => ( "")),
+    client_secret: _nullishCoalesce(provider.clientSecret, () => ( "")),
+    redirect_uri: _nullishCoalesce(provider.callbackUrl, () => ( "")),
+    grant_type: "authorization_code",
+    code
+  });
+  const data = await readJson(
+    await fetch(provider.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body
+    }),
+    `${provider.name} token exchange`
+  );
+  const token = data.access_token;
+  if (!token) throw new Error(`${provider.name} token exchange returned no access_token.`);
+  return token;
+}
+
+// src/auth/oauth/oauth.options.ts
+var OAUTH_AUTH_OPTIONS = /* @__PURE__ */ Symbol("OAUTH_AUTH_OPTIONS");
+var OAUTH_STORE = /* @__PURE__ */ Symbol("OAUTH_STORE");
+var REFRESH_TOKEN_STORE = /* @__PURE__ */ Symbol("REFRESH_TOKEN_STORE");
+function resolveOAuthOptions(options) {
+  const webUrl = options.webUrl.replace(/\/$/, "");
+  return {
+    providers: options.providers,
+    webUrl,
+    onLoginRedirect: _nullishCoalesce(options.onLoginRedirect, () => ( ((accessToken) => `${webUrl}/oauth-callback#accessToken=${accessToken}`))),
+    onErrorRedirect: _nullishCoalesce(options.onErrorRedirect, () => ( ((message) => `${webUrl}/login?error=${encodeURIComponent(message)}`))),
+    onLinkRedirect: _nullishCoalesce(options.onLinkRedirect, () => ( ((provider, error) => error ? `${webUrl}/profile?error=${encodeURIComponent(error)}` : `${webUrl}/profile?linked=${provider}`))),
+    cookie: {
+      name: _nullishCoalesce(_optionalChain([options, 'access', _3 => _3.cookie, 'optionalAccess', _4 => _4.name]), () => ( "refresh_token")),
+      path: _nullishCoalesce(_optionalChain([options, 'access', _5 => _5.cookie, 'optionalAccess', _6 => _6.path]), () => ( "/auth")),
+      sameSite: _nullishCoalesce(_optionalChain([options, 'access', _7 => _7.cookie, 'optionalAccess', _8 => _8.sameSite]), () => ( "lax")),
+      secure: _nullishCoalesce(_optionalChain([options, 'access', _9 => _9.cookie, 'optionalAccess', _10 => _10.secure]), () => ( process.env.NODE_ENV === "production"))
+    },
+    linkCookieName: _nullishCoalesce(options.linkCookieName, () => ( "link_intent")),
+    accessTtlSeconds: _nullishCoalesce(options.accessTtlSeconds, () => ( 15 * 60)),
+    refreshTtlSeconds: _nullishCoalesce(options.refreshTtlSeconds, () => ( 30 * 24 * 60 * 60)),
+    linkTtlSeconds: _nullishCoalesce(options.linkTtlSeconds, () => ( 10 * 60)),
+    accessSecret: options.accessSecret,
+    refreshSecret: options.refreshSecret,
+    singleSession: _nullishCoalesce(options.singleSession, () => ( true)),
+    syncProfile: _nullishCoalesce(options.syncProfile, () => ( ((_user, profile) => ({ name: profile.name, avatarUrl: _nullishCoalesce(profile.avatarUrl, () => ( null)) })))),
+    mapUser: options.mapUser,
+    unavailableMessage: _nullishCoalesce(options.unavailableMessage, () => ( ((provider) => `Signing in with ${provider} is unavailable.`))),
+    genericErrorMessage: _nullishCoalesce(options.genericErrorMessage, () => ( (() => "Sign-in could not be completed. Please try again."))),
+    missingEmailMessage: _nullishCoalesce(options.missingEmailMessage, () => ( ((provider) => `${provider} did not share your email address, so we cannot create your account.`)))
+  };
+}
+
+// src/auth/oauth/oauth-auth.service.ts
+var _common = require('@nestjs/common');
+var _crypto = require('crypto');
+var _jsonwebtoken = require('jsonwebtoken'); var _jsonwebtoken2 = _interopRequireDefault(_jsonwebtoken);
+function hashToken(token) {
+  return _crypto.createHash.call(void 0, "sha256").update(token).digest("hex");
+}
+function requireSecret(explicit, envName) {
+  const value = _nullishCoalesce(explicit, () => ( process.env[envName]));
+  if (!value) throw new Error(`OAuthAuthService: ${envName} is not set`);
+  return value;
+}
+var OAuthAuthService = class {
+  constructor(options, store, sessions) {
+    this.store = store;
+    this.sessions = sessions;
+    this.options = resolveOAuthOptions(options);
+  }
+  get config() {
+    return this.options;
+  }
+  /**
+   * Looks up a configured provider, or explains that it is unavailable.
+   *
+   * Missing credentials make one provider stop existing rather than stopping
+   * the boot — the same fail-late rule the rest of nestkit's optional
+   * integrations follow. An unknown name and an unconfigured one answer
+   * identically on purpose: neither is something the caller can act on
+   * differently, and distinguishing them only tells a prober what exists.
+   */
+  provider(name) {
+    const found = this.options.providers.find((p) => p.name === name);
+    if (!_optionalChain([found, 'optionalAccess', _11 => _11.clientId]) || !found.clientSecret) {
+      throw new (0, _common.ServiceUnavailableException)(this.options.unavailableMessage(name));
+    }
+    return found;
+  }
+  authorizeUrl(name) {
+    return buildAuthorizeUrl(this.provider(name));
+  }
+  /** Exchanges the callback's `code` for a normalised profile. */
+  async profileFromCode(name, code) {
+    const provider = this.provider(name);
+    const accessToken = await exchangeCodeForToken(provider, code);
+    const profile = await provider.fetchProfile(accessToken);
+    if (!profile.email) {
+      throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)(this.options.missingEmailMessage(name));
+    }
+    return { ...profile, email: normaliseEmail(profile.email) };
+  }
+  /**
+   * Signs someone in, creating the account the first time.
+   *
+   * The provider is a parameter because the flow is identical for all of
+   * them: find the linked account, and failing that link by email to whoever
+   * is already registered. That email link is what makes signing in with
+   * Facebook today and Google tomorrow land on one account instead of two.
+   */
+  async login(providerName, profile) {
+    const provider = this.provider(providerName).name;
+    const existing = await this.store.findAccount(provider, profile.providerAccountId);
+    let user = _nullishCoalesce(_optionalChain([existing, 'optionalAccess', _12 => _12.user]), () => ( null));
+    if (!user) {
+      const email = normaliseEmail(profile.email);
+      user = await _asyncNullishCoalesce(await this.store.findUserByEmail(email), async () => ( await this.store.createUser({
+        email,
+        name: profile.name,
+        avatarUrl: profile.avatarUrl
+      })));
+      await this.store.createAccount({
+        userId: user.id,
+        provider,
+        providerAccountId: profile.providerAccountId,
+        avatarUrl: _nullishCoalesce(profile.avatarUrl, () => ( null))
+      });
+    } else {
+      await this.store.updateAccountAvatar(
+        provider,
+        profile.providerAccountId,
+        _nullishCoalesce(profile.avatarUrl, () => ( null))
+      );
+    }
+    const changes = this.options.syncProfile(user, profile);
+    if (changes && (changes.name !== user.name || changes.avatarUrl !== user.avatarUrl)) {
+      user = await this.store.updateUser(user.id, changes);
+    }
+    if (this.options.singleSession) {
+      await this.sessions.revokeAllForUser(user.id);
+    }
+    const tokens = await this.issueTokenPair(user);
+    return { user: this.present(user), ...tokens };
+  }
+  /**
+   * Rotates a refresh token: the old one is spent, a new pair comes back.
+   *
+   * Revoking before issuing, and only continuing when the revoke actually hit
+   * a live row, is the whole point — replaying a token that has already been
+   * used finds nothing to revoke and is rejected.
+   */
+  async refresh(rawRefreshToken) {
+    const payload = this.verifyRefresh(rawRefreshToken);
+    const { count } = await this.sessions.revokeIfActive(hashToken(rawRefreshToken));
+    if (count === 0) throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("Invalid refresh token.");
+    const user = await this.store.findUserById(payload.sub);
+    if (!user) throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("Invalid refresh token.");
+    return this.issueTokenPair(user);
+  }
+  async logout(rawRefreshToken) {
+    await this.sessions.revokeIfActive(hashToken(rawRefreshToken));
+  }
+  async currentUser(userId) {
+    const user = await this.store.findUserById(userId);
+    if (!user) throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("User not found.");
+    return this.present(user);
+  }
+  /**
+   * Issues the short-lived permission to link another provider.
+   *
+   * Needed because the OAuth leg is a whole-browser navigation, not a request
+   * with headers: the access token does not travel there. So a permission is
+   * minted, parked in an httpOnly cookie, and read back by the callback to
+   * tell "link this to me" from "sign in". It carries its own `typ` so it can
+   * never pass as an access token, or the other way round, despite sharing a
+   * secret.
+   */
+  issueLinkToken(userId) {
+    const ttl = this.options.linkTtlSeconds;
+    const token = _jsonwebtoken2.default.sign(
+      { sub: userId, typ: "link" },
+      requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET"),
+      { expiresIn: ttl }
+    );
+    return { token, expiresAt: new Date(Date.now() + ttl * 1e3) };
+  }
+  /**
+   * The user id behind a link permission, or null.
+   *
+   * Null rather than an exception: with no valid permission the callback just
+   * performs an ordinary sign-in, which is the correct outcome.
+   */
+  readLinkToken(token) {
+    if (!token) return null;
+    try {
+      const payload = _jsonwebtoken2.default.verify(
+        token,
+        requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET")
+      );
+      return payload.typ === "link" && payload.sub ? payload.sub : null;
+    } catch (e2) {
+      return null;
+    }
+  }
+  /**
+   * Ties a provider account to the already-signed-in user.
+   *
+   * This is the way out when the emails do not match: if someone's Facebook
+   * is registered under a different address, linking by email can never join
+   * them, and without this they keep two profiles forever.
+   */
+  async linkAccount(userId, providerName, profile) {
+    const provider = this.provider(providerName).name;
+    const existing = await this.store.findAccount(provider, profile.providerAccountId);
+    if (existing && existing.userId !== userId) {
+      throw new (0, _chunkFDNGAYTZcjs.ValidationAppException)(
+        "That account is already connected to another profile.",
+        { provider },
+        "OAUTH_ACCOUNT_TAKEN"
+      );
+    }
+    const alreadyLinked = await this.store.findAccountByUserAndProvider(userId, provider);
+    if (alreadyLinked && alreadyLinked.providerAccountId !== profile.providerAccountId) {
+      throw new (0, _chunkFDNGAYTZcjs.ValidationAppException)(
+        "You already have an account from that provider connected.",
+        { provider },
+        "OAUTH_PROVIDER_ALREADY_LINKED"
+      );
+    }
+    if (existing) {
+      await this.store.updateAccountAvatar(
+        provider,
+        profile.providerAccountId,
+        _nullishCoalesce(profile.avatarUrl, () => ( null))
+      );
+      return;
+    }
+    await this.store.createAccount({
+      userId,
+      provider,
+      providerAccountId: profile.providerAccountId,
+      avatarUrl: _nullishCoalesce(profile.avatarUrl, () => ( null))
+    });
+  }
+  /**
+   * Which providers are linked, and what photo each one offers.
+   *
+   * Enough to build both a "connect another account" screen and an avatar
+   * picker; what the app does with the choice is the app's decision.
+   */
+  async linkedAccounts(userId) {
+    const accounts = await this.store.listAccountsByUser(userId);
+    return {
+      connected: accounts.map((a) => a.provider),
+      avatars: accounts.filter((a) => Boolean(a.avatarUrl)).map((a) => ({ provider: a.provider, avatarUrl: a.avatarUrl }))
+    };
+  }
+  present(user) {
+    return this.options.mapUser ? this.options.mapUser(user) : user;
+  }
+  async issueTokenPair(user) {
+    const accessToken = _jsonwebtoken2.default.sign(
+      { sub: user.id, email: user.email },
+      requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET"),
+      { expiresIn: this.options.accessTtlSeconds }
+    );
+    const refreshToken = _jsonwebtoken2.default.sign(
+      // The jti keeps two tokens minted for the same user in the same second
+      // from coming out byte-identical — a JWT is deterministic given the
+      // same payload and secret, and identical tokens collide on the unique
+      // index over the stored hash.
+      { sub: user.id, jti: _crypto.randomUUID.call(void 0, ) },
+      requireSecret(this.options.refreshSecret, "JWT_REFRESH_SECRET"),
+      { expiresIn: this.options.refreshTtlSeconds }
+    );
+    const expiresAt = new Date(Date.now() + this.options.refreshTtlSeconds * 1e3);
+    await this.sessions.create(user.id, hashToken(refreshToken), expiresAt);
+    return { accessToken, refreshToken, refreshTokenExpiresAt: expiresAt };
+  }
+  verifyRefresh(token) {
+    try {
+      return _jsonwebtoken2.default.verify(
+        token,
+        requireSecret(this.options.refreshSecret, "JWT_REFRESH_SECRET")
+      );
+    } catch (e3) {
+      throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("Invalid refresh token.");
+    }
+  }
+};
+OAuthAuthService = exports.OAuthAuthService = _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+  _common.Injectable.call(void 0, ),
+  _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Inject.call(void 0, OAUTH_AUTH_OPTIONS)),
+  _chunk2REOCMUDcjs.__decorateParam.call(void 0, 1, _common.Inject.call(void 0, OAUTH_STORE)),
+  _chunk2REOCMUDcjs.__decorateParam.call(void 0, 2, _common.Inject.call(void 0, REFRESH_TOKEN_STORE))
+], OAuthAuthService);
+function normaliseEmail(email) {
+  return email.trim().toLowerCase();
+}
+
+// src/auth/oauth/oauth-callback.filter.ts
+
+
+
+
+
+
+
+// src/auth/oauth/http.ts
+function setCookie(reply, name, value, options) {
+  if (typeof reply.setCookie === "function") reply.setCookie(name, value, options);
+  else if (typeof reply.cookie === "function") reply.cookie(name, value, options);
+  else throw new Error("No cookie support on the reply: register @fastify/cookie or cookie-parser.");
+}
+function clearCookie(reply, name, options) {
+  _optionalChain([reply, 'access', _13 => _13.clearCookie, 'optionalCall', _14 => _14(name, options)]);
+}
+function redirect(reply, url) {
+  reply.redirect(url, 302);
+}
+
+// src/auth/oauth/oauth-callback.filter.ts
+var OAuthCallbackFilter = class {
+  constructor(options) {
+    this.logger = new (0, _common.Logger)(OAuthCallbackFilter.name);
+    this.options = resolveOAuthOptions(options);
+  }
+  catch(exception, host) {
+    const reply = host.switchToHttp().getResponse();
+    this.logger.error(
+      `OAuth callback failed: ${exception instanceof Error ? exception.stack : String(exception)}`
+    );
+    const message = exception instanceof _common.HttpException ? exception.message : this.options.genericErrorMessage();
+    redirect(reply, this.options.onErrorRedirect(message));
+  }
+};
+OAuthCallbackFilter = exports.OAuthCallbackFilter = _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+  _common.Catch.call(void 0, ),
+  _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Inject.call(void 0, OAUTH_AUTH_OPTIONS))
+], OAuthCallbackFilter);
+
+// src/auth/oauth/oauth.controller.ts
+
+
+
+
+
+
+
+
+
+
+
+function createOAuthController(options = {}) {
+  const Guard = _nullishCoalesce(options.guard, () => ( _chunkNVCI3CQIcjs.JwtAuthGuard));
+  const userId = _nullishCoalesce(options.userId, () => ( ((user) => user.sub)));
+  let OAuthControllerHost = class {
+    constructor(auth) {
+      this.auth = auth;
+    }
+    async refresh(request, reply) {
+      const raw = _optionalChain([request, 'access', _15 => _15.cookies, 'optionalAccess', _16 => _16[this.auth.config.cookie.name]]);
+      if (!raw) throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("No refresh token.");
+      const { accessToken, refreshToken, refreshTokenExpiresAt } = await this.auth.refresh(raw);
+      this.writeRefreshCookie(reply, refreshToken, refreshTokenExpiresAt);
+      return { accessToken };
+    }
+    async logout(request, reply) {
+      const raw = _optionalChain([request, 'access', _17 => _17.cookies, 'optionalAccess', _18 => _18[this.auth.config.cookie.name]]);
+      if (raw) await this.auth.logout(raw);
+      clearCookie(reply, this.auth.config.cookie.name, { path: this.auth.config.cookie.path });
+      return { success: true };
+    }
+    me(user) {
+      return this.auth.currentUser(userId(user));
+    }
+    linkedAccounts(user) {
+      return this.auth.linkedAccounts(userId(user));
+    }
+    linkIntent(user, reply) {
+      const { token, expiresAt } = this.auth.issueLinkToken(userId(user));
+      setCookie(reply, this.auth.config.linkCookieName, token, {
+        ...this.cookieBase(),
+        expires: expiresAt
+      });
+      return { ok: true };
+    }
+    start(provider, reply) {
+      redirect(reply, this.auth.authorizeUrl(provider));
+    }
+    async callback(provider, code, request, reply) {
+      if (!code) throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)(this.auth.config.genericErrorMessage());
+      const profile = await this.auth.profileFromCode(provider, code);
+      const linkUserId = this.auth.readLinkToken(_optionalChain([request, 'access', _19 => _19.cookies, 'optionalAccess', _20 => _20[this.auth.config.linkCookieName]]));
+      if (linkUserId) {
+        clearCookie(reply, this.auth.config.linkCookieName, { path: this.auth.config.cookie.path });
+        try {
+          await this.auth.linkAccount(linkUserId, provider, profile);
+          redirect(reply, this.auth.config.onLinkRedirect(provider));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Could not connect the account.";
+          redirect(reply, this.auth.config.onLinkRedirect(provider, message));
+        }
+        return;
+      }
+      const { accessToken, refreshToken, refreshTokenExpiresAt } = await this.auth.login(
+        provider,
+        profile
+      );
+      this.writeRefreshCookie(reply, refreshToken, refreshTokenExpiresAt);
+      redirect(reply, this.auth.config.onLoginRedirect(accessToken));
+    }
+    cookieBase() {
+      const { secure, sameSite, path } = this.auth.config.cookie;
+      return { httpOnly: true, secure, sameSite, path };
+    }
+    writeRefreshCookie(reply, token, expiresAt) {
+      setCookie(reply, this.auth.config.cookie.name, token, {
+        ...this.cookieBase(),
+        expires: expiresAt
+      });
+    }
+  };
+  _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+    _common.Post.call(void 0, "refresh"),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Req.call(void 0, )),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 1, _common.Res.call(void 0, { passthrough: true }))
+  ], OAuthControllerHost.prototype, "refresh", 1);
+  _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+    _common.Post.call(void 0, "logout"),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Req.call(void 0, )),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 1, _common.Res.call(void 0, { passthrough: true }))
+  ], OAuthControllerHost.prototype, "logout", 1);
+  _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+    _common.UseGuards.call(void 0, Guard),
+    _common.Get.call(void 0, "me"),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _chunkNVCI3CQIcjs.CurrentUser.call(void 0, ))
+  ], OAuthControllerHost.prototype, "me", 1);
+  _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+    _common.UseGuards.call(void 0, Guard),
+    _common.Get.call(void 0, "linked-accounts"),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _chunkNVCI3CQIcjs.CurrentUser.call(void 0, ))
+  ], OAuthControllerHost.prototype, "linkedAccounts", 1);
+  _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+    _common.UseGuards.call(void 0, Guard),
+    _common.Post.call(void 0, "link-intent"),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _chunkNVCI3CQIcjs.CurrentUser.call(void 0, )),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 1, _common.Res.call(void 0, { passthrough: true }))
+  ], OAuthControllerHost.prototype, "linkIntent", 1);
+  _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+    _common.Get.call(void 0, ":provider"),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Param.call(void 0, "provider")),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 1, _common.Res.call(void 0, ))
+  ], OAuthControllerHost.prototype, "start", 1);
+  _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+    _common.Get.call(void 0, ":provider/callback"),
+    _common.UseFilters.call(void 0, OAuthCallbackFilter),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 0, _common.Param.call(void 0, "provider")),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 1, _common.Query.call(void 0, "code")),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 2, _common.Req.call(void 0, )),
+    _chunk2REOCMUDcjs.__decorateParam.call(void 0, 3, _common.Res.call(void 0, ))
+  ], OAuthControllerHost.prototype, "callback", 1);
+  OAuthControllerHost = _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+    _common.Controller.call(void 0, _nullishCoalesce(options.path, () => ( "auth")))
+  ], OAuthControllerHost);
+  return OAuthControllerHost;
+}
+
+// src/auth/oauth/oauth-auth.module.ts
+
+var OAuthAuthModule = class {
+  static forRoot(config) {
+    return {
+      module: OAuthAuthModule,
+      imports: _nullishCoalesce(config.imports, () => ( [])),
+      providers: [
+        { provide: OAUTH_AUTH_OPTIONS, useValue: config.options },
+        ...config.providers,
+        OAuthAuthService,
+        OAuthCallbackFilter
+      ],
+      // The options travel out too: a consumer's own controller needs the
+      // cookie name and the redirect builders, and re-deriving them there is
+      // how the two copies drift apart.
+      exports: [OAuthAuthService, OAuthCallbackFilter, OAUTH_AUTH_OPTIONS]
+    };
+  }
+};
+OAuthAuthModule = exports.OAuthAuthModule = _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+  _common.Module.call(void 0, {})
+], OAuthAuthModule);
+
+
+
+
+
+
+
+
+
+
+
+
+
+exports.OAUTH_AUTH_OPTIONS = OAUTH_AUTH_OPTIONS; exports.OAUTH_STORE = OAUTH_STORE; exports.OAuthAuthModule = OAuthAuthModule; exports.OAuthAuthService = OAuthAuthService; exports.OAuthCallbackFilter = OAuthCallbackFilter; exports.REFRESH_TOKEN_STORE = REFRESH_TOKEN_STORE; exports.buildAuthorizeUrl = buildAuthorizeUrl; exports.createOAuthController = createOAuthController; exports.exchangeCodeForToken = exchangeCodeForToken; exports.facebookProvider = facebookProvider; exports.googleProvider = googleProvider; exports.resolveOAuthOptions = resolveOAuthOptions;

package/dist/auth/oauth/index.d.ts

@@ -0,0 +1,12 @@
+export { googleProvider, facebookProvider, buildAuthorizeUrl, exchangeCodeForToken, } from './oauth-provider.js';
+export type { OAuthProfile, OAuthProviderConfig, ProviderCredentials, } from './oauth-provider.js';
+export type { OAuthUser, OAuthAccount, OAuthStorePort, RefreshTokenStorePort, ProfileSyncPolicy, } from './oauth.ports.js';
+export { OAUTH_AUTH_OPTIONS, OAUTH_STORE, REFRESH_TOKEN_STORE, resolveOAuthOptions, } from './oauth.options.js';
+export type { OAuthAuthOptions, OAuthCookieOptions, ResolvedOAuthOptions, } from './oauth.options.js';
+export { OAuthAuthService } from './oauth-auth.service.js';
+export type { TokenPair } from './oauth-auth.service.js';
+export { OAuthCallbackFilter } from './oauth-callback.filter.js';
+export { createOAuthController } from './oauth.controller.js';
+export type { CreateOAuthControllerOptions } from './oauth.controller.js';
+export { OAuthAuthModule } from './oauth-auth.module.js';
+export type { OAuthAuthModuleOptions } from './oauth-auth.module.js';