@miguelmorales13/nestkit 0.5.1 → 0.7.0

package/dist/auth/oauth/index.js

@@ -0,0 +1,610 @@
+import {
+  CurrentUser,
+  JwtAuthGuard
+} from "../../chunk-A3B2EY4V.js";
+import {
+  UnauthorizedAppException,
+  ValidationAppException
+} from "../../chunk-ORWJ7LES.js";
+import "../../chunk-YFYHLYHN.js";
+import {
+  __decorateClass,
+  __decorateParam
+} from "../../chunk-4MGIQFAJ.js";
+
+// src/auth/oauth/oauth-provider.ts
+async function readJson(response, what) {
+  const text = await response.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new Error(`${what}: expected JSON, got ${response.status} ${text.slice(0, 200)}`);
+  }
+  if (!response.ok) {
+    throw new Error(`${what}: HTTP ${response.status} ${text.slice(0, 200)}`);
+  }
+  return body;
+}
+function googleProvider(credentials = {}) {
+  return {
+    name: "google",
+    clientId: credentials.clientId ?? process.env.GOOGLE_CLIENT_ID,
+    clientSecret: credentials.clientSecret ?? process.env.GOOGLE_CLIENT_SECRET,
+    callbackUrl: credentials.callbackUrl ?? process.env.GOOGLE_CALLBACK_URL,
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    scope: credentials.scope ?? "email profile",
+    authorizeParams: {
+      // Without this, someone signed into several Google accounts is put
+      // straight back into the one the browser last used, with no way to pick
+      // — which reads as the app ignoring who they wanted to be.
+      prompt: "select_account",
+      access_type: "offline"
+    },
+    async fetchProfile(accessToken) {
+      const data = await readJson(
+        await fetch("https://www.googleapis.com/oauth2/v3/userinfo", {
+          headers: { Authorization: `Bearer ${accessToken}` }
+        }),
+        "Google userinfo"
+      );
+      const email = data.email;
+      if (!email) throw new Error("Google did not return an email.");
+      return {
+        providerAccountId: String(data.sub),
+        email,
+        name: data.name,
+        avatarUrl: data.picture
+      };
+    }
+  };
+}
+function facebookProvider(credentials = {}) {
+  const version = process.env.FACEBOOK_GRAPH_VERSION ?? "v21.0";
+  return {
+    name: "facebook",
+    clientId: credentials.clientId ?? process.env.FACEBOOK_APP_ID,
+    clientSecret: credentials.clientSecret ?? process.env.FACEBOOK_APP_SECRET,
+    callbackUrl: credentials.callbackUrl ?? process.env.FACEBOOK_CALLBACK_URL,
+    authorizeUrl: `https://www.facebook.com/${version}/dialog/oauth`,
+    tokenUrl: `https://graph.facebook.com/${version}/oauth/access_token`,
+    scope: credentials.scope ?? "email",
+    async fetchProfile(accessToken) {
+      const url = new URL(`https://graph.facebook.com/${version}/me`);
+      url.searchParams.set("fields", "id,name,email,picture.type(large)");
+      const data = await readJson(
+        await fetch(url, { headers: { Authorization: `Bearer ${accessToken}` } }),
+        "Facebook me"
+      );
+      const picture = data.picture;
+      return {
+        providerAccountId: String(data.id),
+        email: data.email ?? "",
+        name: data.name,
+        avatarUrl: picture?.data?.url
+      };
+    }
+  };
+}
+function buildAuthorizeUrl(provider, state) {
+  const params = new URLSearchParams({
+    client_id: provider.clientId ?? "",
+    redirect_uri: provider.callbackUrl ?? "",
+    response_type: "code",
+    scope: provider.scope,
+    ...provider.authorizeParams,
+    ...state ? { state } : {}
+  });
+  return `${provider.authorizeUrl}?${params.toString()}`;
+}
+async function exchangeCodeForToken(provider, code) {
+  const body = new URLSearchParams({
+    client_id: provider.clientId ?? "",
+    client_secret: provider.clientSecret ?? "",
+    redirect_uri: provider.callbackUrl ?? "",
+    grant_type: "authorization_code",
+    code
+  });
+  const data = await readJson(
+    await fetch(provider.tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body
+    }),
+    `${provider.name} token exchange`
+  );
+  const token = data.access_token;
+  if (!token) throw new Error(`${provider.name} token exchange returned no access_token.`);
+  return token;
+}
+
+// src/auth/oauth/oauth.options.ts
+var OAUTH_AUTH_OPTIONS = /* @__PURE__ */ Symbol("OAUTH_AUTH_OPTIONS");
+var OAUTH_STORE = /* @__PURE__ */ Symbol("OAUTH_STORE");
+var REFRESH_TOKEN_STORE = /* @__PURE__ */ Symbol("REFRESH_TOKEN_STORE");
+function resolveOAuthOptions(options) {
+  const webUrl = options.webUrl.replace(/\/$/, "");
+  return {
+    providers: options.providers,
+    webUrl,
+    onLoginRedirect: options.onLoginRedirect ?? ((accessToken) => `${webUrl}/oauth-callback#accessToken=${accessToken}`),
+    onErrorRedirect: options.onErrorRedirect ?? ((message) => `${webUrl}/login?error=${encodeURIComponent(message)}`),
+    onLinkRedirect: options.onLinkRedirect ?? ((provider, error) => error ? `${webUrl}/profile?error=${encodeURIComponent(error)}` : `${webUrl}/profile?linked=${provider}`),
+    cookie: {
+      name: options.cookie?.name ?? "refresh_token",
+      path: options.cookie?.path ?? "/auth",
+      sameSite: options.cookie?.sameSite ?? "lax",
+      secure: options.cookie?.secure ?? process.env.NODE_ENV === "production"
+    },
+    linkCookieName: options.linkCookieName ?? "link_intent",
+    accessTtlSeconds: options.accessTtlSeconds ?? 15 * 60,
+    refreshTtlSeconds: options.refreshTtlSeconds ?? 30 * 24 * 60 * 60,
+    linkTtlSeconds: options.linkTtlSeconds ?? 10 * 60,
+    accessSecret: options.accessSecret,
+    refreshSecret: options.refreshSecret,
+    singleSession: options.singleSession ?? true,
+    syncProfile: options.syncProfile ?? ((_user, profile) => ({ name: profile.name, avatarUrl: profile.avatarUrl ?? null })),
+    mapUser: options.mapUser,
+    unavailableMessage: options.unavailableMessage ?? ((provider) => `Signing in with ${provider} is unavailable.`),
+    genericErrorMessage: options.genericErrorMessage ?? (() => "Sign-in could not be completed. Please try again."),
+    missingEmailMessage: options.missingEmailMessage ?? ((provider) => `${provider} did not share your email address, so we cannot create your account.`)
+  };
+}
+
+// src/auth/oauth/oauth-auth.service.ts
+import { Inject, Injectable, ServiceUnavailableException } from "@nestjs/common";
+import { createHash, randomUUID } from "crypto";
+import jwt from "jsonwebtoken";
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function requireSecret(explicit, envName) {
+  const value = explicit ?? process.env[envName];
+  if (!value) throw new Error(`OAuthAuthService: ${envName} is not set`);
+  return value;
+}
+var OAuthAuthService = class {
+  constructor(options, store, sessions) {
+    this.store = store;
+    this.sessions = sessions;
+    this.options = resolveOAuthOptions(options);
+  }
+  get config() {
+    return this.options;
+  }
+  /**
+   * Looks up a configured provider, or explains that it is unavailable.
+   *
+   * Missing credentials make one provider stop existing rather than stopping
+   * the boot — the same fail-late rule the rest of nestkit's optional
+   * integrations follow. An unknown name and an unconfigured one answer
+   * identically on purpose: neither is something the caller can act on
+   * differently, and distinguishing them only tells a prober what exists.
+   */
+  provider(name) {
+    const found = this.options.providers.find((p) => p.name === name);
+    if (!found?.clientId || !found.clientSecret) {
+      throw new ServiceUnavailableException(this.options.unavailableMessage(name));
+    }
+    return found;
+  }
+  authorizeUrl(name) {
+    return buildAuthorizeUrl(this.provider(name));
+  }
+  /** Exchanges the callback's `code` for a normalised profile. */
+  async profileFromCode(name, code) {
+    const provider = this.provider(name);
+    const accessToken = await exchangeCodeForToken(provider, code);
+    const profile = await provider.fetchProfile(accessToken);
+    if (!profile.email) {
+      throw new UnauthorizedAppException(this.options.missingEmailMessage(name));
+    }
+    return { ...profile, email: normaliseEmail(profile.email) };
+  }
+  /**
+   * Signs someone in, creating the account the first time.
+   *
+   * The provider is a parameter because the flow is identical for all of
+   * them: find the linked account, and failing that link by email to whoever
+   * is already registered. That email link is what makes signing in with
+   * Facebook today and Google tomorrow land on one account instead of two.
+   */
+  async login(providerName, profile) {
+    const provider = this.provider(providerName).name;
+    const existing = await this.store.findAccount(provider, profile.providerAccountId);
+    let user = existing?.user ?? null;
+    if (!user) {
+      const email = normaliseEmail(profile.email);
+      user = await this.store.findUserByEmail(email) ?? await this.store.createUser({
+        email,
+        name: profile.name,
+        avatarUrl: profile.avatarUrl
+      });
+      await this.store.createAccount({
+        userId: user.id,
+        provider,
+        providerAccountId: profile.providerAccountId,
+        avatarUrl: profile.avatarUrl ?? null
+      });
+    } else {
+      await this.store.updateAccountAvatar(
+        provider,
+        profile.providerAccountId,
+        profile.avatarUrl ?? null
+      );
+    }
+    const changes = this.options.syncProfile(user, profile);
+    if (changes && (changes.name !== user.name || changes.avatarUrl !== user.avatarUrl)) {
+      user = await this.store.updateUser(user.id, changes);
+    }
+    if (this.options.singleSession) {
+      await this.sessions.revokeAllForUser(user.id);
+    }
+    const tokens = await this.issueTokenPair(user);
+    return { user: this.present(user), ...tokens };
+  }
+  /**
+   * Rotates a refresh token: the old one is spent, a new pair comes back.
+   *
+   * Revoking before issuing, and only continuing when the revoke actually hit
+   * a live row, is the whole point — replaying a token that has already been
+   * used finds nothing to revoke and is rejected.
+   */
+  async refresh(rawRefreshToken) {
+    const payload = this.verifyRefresh(rawRefreshToken);
+    const { count } = await this.sessions.revokeIfActive(hashToken(rawRefreshToken));
+    if (count === 0) throw new UnauthorizedAppException("Invalid refresh token.");
+    const user = await this.store.findUserById(payload.sub);
+    if (!user) throw new UnauthorizedAppException("Invalid refresh token.");
+    return this.issueTokenPair(user);
+  }
+  async logout(rawRefreshToken) {
+    await this.sessions.revokeIfActive(hashToken(rawRefreshToken));
+  }
+  async currentUser(userId) {
+    const user = await this.store.findUserById(userId);
+    if (!user) throw new UnauthorizedAppException("User not found.");
+    return this.present(user);
+  }
+  /**
+   * Issues the short-lived permission to link another provider.
+   *
+   * Needed because the OAuth leg is a whole-browser navigation, not a request
+   * with headers: the access token does not travel there. So a permission is
+   * minted, parked in an httpOnly cookie, and read back by the callback to
+   * tell "link this to me" from "sign in". It carries its own `typ` so it can
+   * never pass as an access token, or the other way round, despite sharing a
+   * secret.
+   */
+  issueLinkToken(userId) {
+    const ttl = this.options.linkTtlSeconds;
+    const token = jwt.sign(
+      { sub: userId, typ: "link" },
+      requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET"),
+      { expiresIn: ttl }
+    );
+    return { token, expiresAt: new Date(Date.now() + ttl * 1e3) };
+  }
+  /**
+   * The user id behind a link permission, or null.
+   *
+   * Null rather than an exception: with no valid permission the callback just
+   * performs an ordinary sign-in, which is the correct outcome.
+   */
+  readLinkToken(token) {
+    if (!token) return null;
+    try {
+      const payload = jwt.verify(
+        token,
+        requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET")
+      );
+      return payload.typ === "link" && payload.sub ? payload.sub : null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Ties a provider account to the already-signed-in user.
+   *
+   * This is the way out when the emails do not match: if someone's Facebook
+   * is registered under a different address, linking by email can never join
+   * them, and without this they keep two profiles forever.
+   */
+  async linkAccount(userId, providerName, profile) {
+    const provider = this.provider(providerName).name;
+    const existing = await this.store.findAccount(provider, profile.providerAccountId);
+    if (existing && existing.userId !== userId) {
+      throw new ValidationAppException(
+        "That account is already connected to another profile.",
+        { provider },
+        "OAUTH_ACCOUNT_TAKEN"
+      );
+    }
+    const alreadyLinked = await this.store.findAccountByUserAndProvider(userId, provider);
+    if (alreadyLinked && alreadyLinked.providerAccountId !== profile.providerAccountId) {
+      throw new ValidationAppException(
+        "You already have an account from that provider connected.",
+        { provider },
+        "OAUTH_PROVIDER_ALREADY_LINKED"
+      );
+    }
+    if (existing) {
+      await this.store.updateAccountAvatar(
+        provider,
+        profile.providerAccountId,
+        profile.avatarUrl ?? null
+      );
+      return;
+    }
+    await this.store.createAccount({
+      userId,
+      provider,
+      providerAccountId: profile.providerAccountId,
+      avatarUrl: profile.avatarUrl ?? null
+    });
+  }
+  /**
+   * Which providers are linked, and what photo each one offers.
+   *
+   * Enough to build both a "connect another account" screen and an avatar
+   * picker; what the app does with the choice is the app's decision.
+   */
+  async linkedAccounts(userId) {
+    const accounts = await this.store.listAccountsByUser(userId);
+    return {
+      connected: accounts.map((a) => a.provider),
+      avatars: accounts.filter((a) => Boolean(a.avatarUrl)).map((a) => ({ provider: a.provider, avatarUrl: a.avatarUrl }))
+    };
+  }
+  present(user) {
+    return this.options.mapUser ? this.options.mapUser(user) : user;
+  }
+  async issueTokenPair(user) {
+    const accessToken = jwt.sign(
+      { sub: user.id, email: user.email },
+      requireSecret(this.options.accessSecret, "JWT_ACCESS_SECRET"),
+      { expiresIn: this.options.accessTtlSeconds }
+    );
+    const refreshToken = jwt.sign(
+      // The jti keeps two tokens minted for the same user in the same second
+      // from coming out byte-identical — a JWT is deterministic given the
+      // same payload and secret, and identical tokens collide on the unique
+      // index over the stored hash.
+      { sub: user.id, jti: randomUUID() },
+      requireSecret(this.options.refreshSecret, "JWT_REFRESH_SECRET"),
+      { expiresIn: this.options.refreshTtlSeconds }
+    );
+    const expiresAt = new Date(Date.now() + this.options.refreshTtlSeconds * 1e3);
+    await this.sessions.create(user.id, hashToken(refreshToken), expiresAt);
+    return { accessToken, refreshToken, refreshTokenExpiresAt: expiresAt };
+  }
+  verifyRefresh(token) {
+    try {
+      return jwt.verify(
+        token,
+        requireSecret(this.options.refreshSecret, "JWT_REFRESH_SECRET")
+      );
+    } catch {
+      throw new UnauthorizedAppException("Invalid refresh token.");
+    }
+  }
+};
+OAuthAuthService = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(OAUTH_AUTH_OPTIONS)),
+  __decorateParam(1, Inject(OAUTH_STORE)),
+  __decorateParam(2, Inject(REFRESH_TOKEN_STORE))
+], OAuthAuthService);
+function normaliseEmail(email) {
+  return email.trim().toLowerCase();
+}
+
+// src/auth/oauth/oauth-callback.filter.ts
+import {
+  Catch,
+  HttpException,
+  Inject as Inject2,
+  Logger
+} from "@nestjs/common";
+
+// src/auth/oauth/http.ts
+function setCookie(reply, name, value, options) {
+  if (typeof reply.setCookie === "function") reply.setCookie(name, value, options);
+  else if (typeof reply.cookie === "function") reply.cookie(name, value, options);
+  else throw new Error("No cookie support on the reply: register @fastify/cookie or cookie-parser.");
+}
+function clearCookie(reply, name, options) {
+  reply.clearCookie?.(name, options);
+}
+function redirect(reply, url) {
+  reply.redirect(url, 302);
+}
+
+// src/auth/oauth/oauth-callback.filter.ts
+var OAuthCallbackFilter = class {
+  constructor(options) {
+    this.logger = new Logger(OAuthCallbackFilter.name);
+    this.options = resolveOAuthOptions(options);
+  }
+  catch(exception, host) {
+    const reply = host.switchToHttp().getResponse();
+    this.logger.error(
+      `OAuth callback failed: ${exception instanceof Error ? exception.stack : String(exception)}`
+    );
+    const message = exception instanceof HttpException ? exception.message : this.options.genericErrorMessage();
+    redirect(reply, this.options.onErrorRedirect(message));
+  }
+};
+OAuthCallbackFilter = __decorateClass([
+  Catch(),
+  __decorateParam(0, Inject2(OAUTH_AUTH_OPTIONS))
+], OAuthCallbackFilter);
+
+// src/auth/oauth/oauth.controller.ts
+import {
+  Controller,
+  Get,
+  Param,
+  Post,
+  Query,
+  Req,
+  Res,
+  UseFilters,
+  UseGuards
+} from "@nestjs/common";
+function createOAuthController(options = {}) {
+  const Guard = options.guard ?? JwtAuthGuard;
+  const userId = options.userId ?? ((user) => user.sub);
+  let OAuthControllerHost = class {
+    constructor(auth) {
+      this.auth = auth;
+    }
+    async refresh(request, reply) {
+      const raw = request.cookies?.[this.auth.config.cookie.name];
+      if (!raw) throw new UnauthorizedAppException("No refresh token.");
+      const { accessToken, refreshToken, refreshTokenExpiresAt } = await this.auth.refresh(raw);
+      this.writeRefreshCookie(reply, refreshToken, refreshTokenExpiresAt);
+      return { accessToken };
+    }
+    async logout(request, reply) {
+      const raw = request.cookies?.[this.auth.config.cookie.name];
+      if (raw) await this.auth.logout(raw);
+      clearCookie(reply, this.auth.config.cookie.name, { path: this.auth.config.cookie.path });
+      return { success: true };
+    }
+    me(user) {
+      return this.auth.currentUser(userId(user));
+    }
+    linkedAccounts(user) {
+      return this.auth.linkedAccounts(userId(user));
+    }
+    linkIntent(user, reply) {
+      const { token, expiresAt } = this.auth.issueLinkToken(userId(user));
+      setCookie(reply, this.auth.config.linkCookieName, token, {
+        ...this.cookieBase(),
+        expires: expiresAt
+      });
+      return { ok: true };
+    }
+    start(provider, reply) {
+      redirect(reply, this.auth.authorizeUrl(provider));
+    }
+    async callback(provider, code, request, reply) {
+      if (!code) throw new UnauthorizedAppException(this.auth.config.genericErrorMessage());
+      const profile = await this.auth.profileFromCode(provider, code);
+      const linkUserId = this.auth.readLinkToken(request.cookies?.[this.auth.config.linkCookieName]);
+      if (linkUserId) {
+        clearCookie(reply, this.auth.config.linkCookieName, { path: this.auth.config.cookie.path });
+        try {
+          await this.auth.linkAccount(linkUserId, provider, profile);
+          redirect(reply, this.auth.config.onLinkRedirect(provider));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : "Could not connect the account.";
+          redirect(reply, this.auth.config.onLinkRedirect(provider, message));
+        }
+        return;
+      }
+      const { accessToken, refreshToken, refreshTokenExpiresAt } = await this.auth.login(
+        provider,
+        profile
+      );
+      this.writeRefreshCookie(reply, refreshToken, refreshTokenExpiresAt);
+      redirect(reply, this.auth.config.onLoginRedirect(accessToken));
+    }
+    cookieBase() {
+      const { secure, sameSite, path } = this.auth.config.cookie;
+      return { httpOnly: true, secure, sameSite, path };
+    }
+    writeRefreshCookie(reply, token, expiresAt) {
+      setCookie(reply, this.auth.config.cookie.name, token, {
+        ...this.cookieBase(),
+        expires: expiresAt
+      });
+    }
+  };
+  __decorateClass([
+    Post("refresh"),
+    __decorateParam(0, Req()),
+    __decorateParam(1, Res({ passthrough: true }))
+  ], OAuthControllerHost.prototype, "refresh", 1);
+  __decorateClass([
+    Post("logout"),
+    __decorateParam(0, Req()),
+    __decorateParam(1, Res({ passthrough: true }))
+  ], OAuthControllerHost.prototype, "logout", 1);
+  __decorateClass([
+    UseGuards(Guard),
+    Get("me"),
+    __decorateParam(0, CurrentUser())
+  ], OAuthControllerHost.prototype, "me", 1);
+  __decorateClass([
+    UseGuards(Guard),
+    Get("linked-accounts"),
+    __decorateParam(0, CurrentUser())
+  ], OAuthControllerHost.prototype, "linkedAccounts", 1);
+  __decorateClass([
+    UseGuards(Guard),
+    Post("link-intent"),
+    __decorateParam(0, CurrentUser()),
+    __decorateParam(1, Res({ passthrough: true }))
+  ], OAuthControllerHost.prototype, "linkIntent", 1);
+  __decorateClass([
+    Get(":provider"),
+    __decorateParam(0, Param("provider")),
+    __decorateParam(1, Res())
+  ], OAuthControllerHost.prototype, "start", 1);
+  __decorateClass([
+    Get(":provider/callback"),
+    UseFilters(OAuthCallbackFilter),
+    __decorateParam(0, Param("provider")),
+    __decorateParam(1, Query("code")),
+    __decorateParam(2, Req()),
+    __decorateParam(3, Res())
+  ], OAuthControllerHost.prototype, "callback", 1);
+  OAuthControllerHost = __decorateClass([
+    Controller(options.path ?? "auth")
+  ], OAuthControllerHost);
+  return OAuthControllerHost;
+}
+
+// src/auth/oauth/oauth-auth.module.ts
+import { Module } from "@nestjs/common";
+var OAuthAuthModule = class {
+  static forRoot(config) {
+    return {
+      module: OAuthAuthModule,
+      imports: config.imports ?? [],
+      providers: [
+        { provide: OAUTH_AUTH_OPTIONS, useValue: config.options },
+        ...config.providers,
+        OAuthAuthService,
+        OAuthCallbackFilter
+      ],
+      // The options travel out too: a consumer's own controller needs the
+      // cookie name and the redirect builders, and re-deriving them there is
+      // how the two copies drift apart.
+      exports: [OAuthAuthService, OAuthCallbackFilter, OAUTH_AUTH_OPTIONS]
+    };
+  }
+};
+OAuthAuthModule = __decorateClass([
+  Module({})
+], OAuthAuthModule);
+export {
+  OAUTH_AUTH_OPTIONS,
+  OAUTH_STORE,
+  OAuthAuthModule,
+  OAuthAuthService,
+  OAuthCallbackFilter,
+  REFRESH_TOKEN_STORE,
+  buildAuthorizeUrl,
+  createOAuthController,
+  exchangeCodeForToken,
+  facebookProvider,
+  googleProvider,
+  resolveOAuthOptions
+};

package/dist/auth/oauth/oauth-auth.module.d.ts

@@ -0,0 +1,28 @@
+import { type DynamicModule, type ModuleMetadata, type Provider } from '@nestjs/common';
+import { type OAuthAuthOptions } from './oauth.options.js';
+import type { OAuthUser } from './oauth.ports.js';
+export interface OAuthAuthModuleOptions<U extends OAuthUser = OAuthUser> {
+    options: OAuthAuthOptions<U>;
+    /**
+     * Whatever provides `OAUTH_STORE` and `REFRESH_TOKEN_STORE` — usually one
+     * repository class bound to both tokens.
+     *
+     * Plain Nest providers rather than a bespoke `useClass`/`useExisting`
+     * wrapper: there is no shape this module needs that Nest's own DI does not
+     * already express, and a second vocabulary for it would only be one more
+     * thing to look up.
+     */
+    providers: Provider[];
+    /** Modules exporting whatever those providers inject (a PrismaModule, say). */
+    imports?: ModuleMetadata['imports'];
+}
+/**
+ * OAuth sign-in with rotating refresh sessions.
+ *
+ * Brings no controller of its own — call `createOAuthController()` from the
+ * consuming module, so the route prefix and any extra endpoints stay the
+ * app's decision. See `OAuthAuthService`.
+ */
+export declare class OAuthAuthModule {
+    static forRoot<U extends OAuthUser>(config: OAuthAuthModuleOptions<U>): DynamicModule;
+}