@nage-api/auth 1.0.0-beta.2

package/dist/auth.controller.js

@@ -0,0 +1,185 @@
+"use strict";
+/**
+ * The retained auth endpoint surface (PLAN.md §15.1).
+ *
+ * Same paths as the legacy framework so existing clients keep working; the
+ * hardening is behind them. Three things are worth noticing here:
+ *
+ * - the login and OTP routes are `@Public()` **and** rate-limited harder than
+ *   the global default, because they are the ones worth brute-forcing;
+ * - `forgot` and `send` always answer 202, whatever the address;
+ * - nothing in this file touches a password, a hash or a code — it parses a
+ *   body, calls a service and returns a token pair.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthController = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nage-api/core");
+const auth_service_js_1 = require("./auth.service.js");
+const auth_dto_js_1 = require("./auth.dto.js");
+/** Tight enough to make online guessing useless, loose enough for a typo or two. */
+const CREDENTIAL_RATE_LIMIT = { limit: 10, windowMs: 300_000 };
+const CODE_RATE_LIMIT = { limit: 5, windowMs: 300_000 };
+let AuthController = class AuthController {
+    auth;
+    constructor(auth) {
+        this.auth = auth;
+    }
+    async login(body, request) {
+        return this.auth.login({
+            email: body.email,
+            password: body.password,
+            context: sessionContext(request),
+        });
+    }
+    async refresh(body, request) {
+        return this.auth.refresh(body.refreshToken, sessionContext(request));
+    }
+    /**
+     * Public because a caller whose access token has already expired must still
+     * be able to log out; the refresh token in the body is the credential.
+     */
+    async logout(body) {
+        await this.auth.logout(body.refreshToken);
+    }
+    async forgotPassword(body) {
+        // Accepted, always: a 404 here would confirm which addresses are registered.
+        await this.auth.forgotPassword(body.email);
+    }
+    async resetPassword(body) {
+        await this.auth.resetPassword({
+            email: body.email,
+            code: body.code,
+            password: body.password,
+        });
+    }
+    async sendOtp(body) {
+        await this.auth.sendLoginOtp(body.email);
+    }
+    async verifyOtp(body, request) {
+        return this.auth.verifyLoginOtp(body.email, body.code, sessionContext(request));
+    }
+    /**
+     * Administrative impersonation, retained from the legacy `/auth/user`.
+     *
+     * Not decorated with `@Roles`: which roles may impersonate is configuration
+     * (`auth.impersonation.allowedRoles`), and the service enforces it. Putting
+     * the role list in a decorator here would freeze one deployment's answer into
+     * the framework.
+     */
+    async impersonate(body, actor, request) {
+        return this.auth.impersonate(actor, body.userId, sessionContext(request));
+    }
+};
+exports.AuthController = AuthController;
+__decorate([
+    (0, common_1.Post)('local'),
+    (0, core_1.Public)(),
+    (0, core_1.RateLimit)(CREDENTIAL_RATE_LIMIT),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [auth_dto_js_1.LoginDto, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "login", null);
+__decorate([
+    (0, common_1.Post)('token'),
+    (0, core_1.Public)(),
+    (0, core_1.RateLimit)(CREDENTIAL_RATE_LIMIT),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [auth_dto_js_1.RefreshTokenDto, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
+__decorate([
+    (0, common_1.Post)('logout'),
+    (0, core_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [auth_dto_js_1.RefreshTokenDto]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "logout", null);
+__decorate([
+    (0, common_1.Post)('password/forgot'),
+    (0, core_1.Public)(),
+    (0, core_1.RateLimit)(CODE_RATE_LIMIT),
+    (0, common_1.HttpCode)(common_1.HttpStatus.ACCEPTED),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [auth_dto_js_1.ForgotPasswordDto]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "forgotPassword", null);
+__decorate([
+    (0, common_1.Post)('password/reset'),
+    (0, core_1.Public)(),
+    (0, core_1.RateLimit)(CODE_RATE_LIMIT),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [auth_dto_js_1.ResetPasswordDto]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "resetPassword", null);
+__decorate([
+    (0, common_1.Post)('otp/send'),
+    (0, core_1.Public)(),
+    (0, core_1.RateLimit)(CODE_RATE_LIMIT),
+    (0, common_1.HttpCode)(common_1.HttpStatus.ACCEPTED),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [auth_dto_js_1.SendOtpDto]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "sendOtp", null);
+__decorate([
+    (0, common_1.Post)('otp/verify'),
+    (0, core_1.Public)(),
+    (0, core_1.RateLimit)(CODE_RATE_LIMIT),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [auth_dto_js_1.VerifyOtpDto, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "verifyOtp", null);
+__decorate([
+    (0, common_1.Post)('user'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, core_1.Owner)()),
+    __param(2, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [auth_dto_js_1.ImpersonateDto, Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "impersonate", null);
+exports.AuthController = AuthController = __decorate([
+    (0, common_1.Controller)('auth'),
+    __metadata("design:paramtypes", [auth_service_js_1.AuthService])
+], AuthController);
+/** User agent and IP, recorded on the session so a user can review their logins. */
+function sessionContext(request) {
+    const agent = request.headers?.['user-agent'];
+    const userAgent = Array.isArray(agent) ? agent[0] : agent;
+    // `clientIp` falls back to 'unknown' rather than undefined, and recording
+    // that as an address would be worse than recording nothing.
+    const ip = (0, core_1.clientIp)(request);
+    return {
+        ...(userAgent === undefined ? {} : { userAgent: userAgent.slice(0, 256) }),
+        ...(ip === 'unknown' ? {} : { ip }),
+    };
+}
+//# sourceMappingURL=auth.controller.js.map

package/dist/auth.dto.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Request bodies for the auth endpoints.
+ *
+ * `class-validator` rather than zod here, because these run through Nest's
+ * `ValidationPipe` alongside an application's own DTOs; zod validates the
+ * environment (§11.3), class-validator validates request bodies (§16.2).
+ *
+ * Every DTO is `whitelist`-friendly: a property the class does not declare is
+ * stripped before it reaches a service, so an extra `roles: ["admin"]` in a
+ * login body goes nowhere.
+ */
+export declare class LoginDto {
+    email: string;
+    password: string;
+}
+export declare class RefreshTokenDto {
+    refreshToken: string;
+}
+export declare class ForgotPasswordDto {
+    email: string;
+}
+export declare class ResetPasswordDto {
+    email: string;
+    code: string;
+    password: string;
+}
+export declare class SendOtpDto {
+    email: string;
+}
+export declare class VerifyOtpDto {
+    email: string;
+    code: string;
+}
+export declare class ImpersonateDto {
+    userId: string;
+}
+//# sourceMappingURL=auth.dto.d.ts.map

package/dist/auth.dto.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Request bodies for the auth endpoints.
+ *
+ * `class-validator` rather than zod here, because these run through Nest's
+ * `ValidationPipe` alongside an application's own DTOs; zod validates the
+ * environment (§11.3), class-validator validates request bodies (§16.2).
+ *
+ * Every DTO is `whitelist`-friendly: a property the class does not declare is
+ * stripped before it reaches a service, so an extra `roles: ["admin"]` in a
+ * login body goes nowhere.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImpersonateDto = exports.VerifyOtpDto = exports.SendOtpDto = exports.ResetPasswordDto = exports.ForgotPasswordDto = exports.RefreshTokenDto = exports.LoginDto = void 0;
+const class_validator_1 = require("class-validator");
+/** Long enough for a passphrase, bounded so a megabyte cannot be argon2-hashed. */
+const MAX_PASSWORD_LENGTH = 256;
+class LoginDto {
+    email;
+    password;
+}
+exports.LoginDto = LoginDto;
+__decorate([
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.MaxLength)(320),
+    __metadata("design:type", String)
+], LoginDto.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(MAX_PASSWORD_LENGTH),
+    __metadata("design:type", String)
+], LoginDto.prototype, "password", void 0);
+class RefreshTokenDto {
+    refreshToken;
+}
+exports.RefreshTokenDto = RefreshTokenDto;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(512),
+    __metadata("design:type", String)
+], RefreshTokenDto.prototype, "refreshToken", void 0);
+class ForgotPasswordDto {
+    email;
+}
+exports.ForgotPasswordDto = ForgotPasswordDto;
+__decorate([
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.MaxLength)(320),
+    __metadata("design:type", String)
+], ForgotPasswordDto.prototype, "email", void 0);
+class ResetPasswordDto {
+    email;
+    code;
+    password;
+}
+exports.ResetPasswordDto = ResetPasswordDto;
+__decorate([
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.MaxLength)(320),
+    __metadata("design:type", String)
+], ResetPasswordDto.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(6, 12),
+    __metadata("design:type", String)
+], ResetPasswordDto.prototype, "code", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(MAX_PASSWORD_LENGTH),
+    __metadata("design:type", String)
+], ResetPasswordDto.prototype, "password", void 0);
+class SendOtpDto {
+    email;
+}
+exports.SendOtpDto = SendOtpDto;
+__decorate([
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.MaxLength)(320),
+    __metadata("design:type", String)
+], SendOtpDto.prototype, "email", void 0);
+class VerifyOtpDto {
+    email;
+    code;
+}
+exports.VerifyOtpDto = VerifyOtpDto;
+__decorate([
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.MaxLength)(320),
+    __metadata("design:type", String)
+], VerifyOtpDto.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(6, 12),
+    __metadata("design:type", String)
+], VerifyOtpDto.prototype, "code", void 0);
+class ImpersonateDto {
+    userId;
+}
+exports.ImpersonateDto = ImpersonateDto;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(128),
+    __metadata("design:type", String)
+], ImpersonateDto.prototype, "userId", void 0);
+//# sourceMappingURL=auth.dto.js.map

package/dist/auth.guard.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The global authentication guard (PLAN.md §15.1).
+ *
+ * Registered by `NageAuthModule` as an `APP_GUARD`, so authentication is
+ * opt-**out**: a new controller is protected before anyone remembers to protect
+ * it. The legacy framework wired guards per controller, which meant every new
+ * file started life unauthenticated.
+ *
+ * The guard resolves a principal and writes it into the ambient request
+ * context, so `@Owner()`, services, repositories and queue publishers all see
+ * the same value without it being threaded through call signatures.
+ */
+import { type CanActivate, type ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { ApiKeyService } from './api-key.service.js';
+import type { PrincipalResolver } from './principal.resolver.js';
+import type { TokenSigner } from './ports.js';
+export interface AuthGuardOptions {
+    readonly signer: TokenSigner;
+    readonly principals: PrincipalResolver;
+    readonly reflector: Reflector;
+    readonly apiKeys?: ApiKeyService;
+}
+export declare class AuthGuard implements CanActivate {
+    #private;
+    constructor(options: AuthGuardOptions);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=auth.guard.d.ts.map

package/dist/auth.guard.js

@@ -0,0 +1,122 @@
+"use strict";
+/**
+ * The global authentication guard (PLAN.md §15.1).
+ *
+ * Registered by `NageAuthModule` as an `APP_GUARD`, so authentication is
+ * opt-**out**: a new controller is protected before anyone remembers to protect
+ * it. The legacy framework wired guards per controller, which meant every new
+ * file started life unauthenticated.
+ *
+ * The guard resolves a principal and writes it into the ambient request
+ * context, so `@Owner()`, services, repositories and queue publishers all see
+ * the same value without it being threaded through call signatures.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nage-api/core");
+const decorators_js_1 = require("./decorators.js");
+const jwt_js_1 = require("./jwt.js");
+let AuthGuard = class AuthGuard {
+    #signer;
+    #principals;
+    #reflector;
+    #apiKeys;
+    constructor(options) {
+        this.#signer = options.signer;
+        this.#principals = options.principals;
+        this.#reflector = options.reflector;
+        this.#apiKeys = options.apiKeys;
+    }
+    async canActivate(context) {
+        // Only HTTP is guarded here; a websocket or RPC transport needs its own
+        // credential extraction, and silently passing them through would be worse
+        // than not supporting them.
+        if (context.getType() !== 'http')
+            return true;
+        const request = context.switchToHttp().getRequest();
+        const publicRoute = (0, core_1.isPublicRoute)(this.#reflector, context);
+        const bearer = readHeader(request, 'authorization');
+        const apiKey = readHeader(request, 'x-api-key');
+        if (bearer === undefined && apiKey === undefined) {
+            if (publicRoute)
+                return true;
+            throw new core_1.AuthenticationError('AUTH_REQUIRED', {
+                detail: 'No Authorization or X-Api-Key header on a protected route',
+            });
+        }
+        // A credential that was sent is always validated, even on a public route:
+        // silently ignoring an expired token would make `@OptionalOwner()` return
+        // `undefined` for a user who believes they are signed in.
+        const user = bearer !== undefined
+            ? await this.#fromBearer(bearer)
+            : await this.#fromApiKey(apiKey ?? '', context);
+        (0, core_1.setContextValue)('user', user);
+        if (user.tenantId !== undefined)
+            (0, core_1.setContextValue)('tenantId', user.tenantId);
+        // Nest reads `request.user` in a few places (and so does application code
+        // migrating from the legacy framework), so mirror it there too.
+        request['user'] = user;
+        return true;
+    }
+    async #fromBearer(header) {
+        const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+        if (match?.[1] === undefined) {
+            throw new core_1.AuthenticationError('AUTH_TOKEN_INVALID', {
+                detail: 'Authorization header is not a Bearer token',
+            });
+        }
+        const payload = await this.#signer.verify(match[1]);
+        const claims = (0, jwt_js_1.parseClaims)(payload);
+        const impersonatedBy = (0, jwt_js_1.actorId)(payload);
+        return this.#principals.resolve({
+            userId: claims.sub,
+            sessionId: claims.sid,
+            claimedRoles: claims.roles ?? [],
+            claimedPermissions: claims.permissions ?? [],
+            ...(claims.tenantId === undefined ? {} : { tenantId: String(claims.tenantId) }),
+            ...(impersonatedBy === undefined ? {} : { impersonatedBy }),
+        });
+    }
+    async #fromApiKey(presented, context) {
+        if (this.#apiKeys === undefined) {
+            throw new core_1.AuthenticationError('AUTH_TOKEN_INVALID', {
+                detail: 'An API key was presented but api-key authentication is not enabled',
+            });
+        }
+        if (!(0, decorators_js_1.isApiKeyAllowed)(this.#reflector, context)) {
+            // Fails closed: a key works only where a route has said it may.
+            throw new core_1.AuthenticationError('AUTH_REQUIRED', {
+                detail: 'This route does not accept API keys; decorate it with @AllowApiKey() if it should',
+            });
+        }
+        const record = await this.#apiKeys.verify(presented);
+        return {
+            id: record.userId ?? `api-key:${record.id}`,
+            roles: record.roles,
+            permissions: record.permissions,
+            sessionId: `api-key:${record.id}`,
+        };
+    }
+};
+exports.AuthGuard = AuthGuard;
+exports.AuthGuard = AuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Object])
+], AuthGuard);
+function readHeader(request, name) {
+    const value = request.headers?.[name];
+    if (Array.isArray(value))
+        return value[0];
+    return value === undefined || value === '' ? undefined : value;
+}
+//# sourceMappingURL=auth.guard.js.map

package/dist/auth.module.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `NageAuthModule` — one `forRoot` that registers both guards globally
+ * (PLAN.md §15.1, §11.1).
+ *
+ * The module owns the composition: an application supplies stores and secrets,
+ * and gets back a protected surface. It deliberately does **not** offer a way
+ * to register the controller without the guards — a package that lets you take
+ * the endpoints and skip the protection is a footgun with a `forRoot`.
+ *
+ * Every store defaults to its in-memory implementation so the module is usable
+ * (and testable) before a database exists; a real deployment passes its own,
+ * and `assertProductionStores` refuses the in-memory ones there.
+ */
+import { type DynamicModule } from '@nestjs/common';
+import type { AuthConfig, NodeEnvironment, RoleMatrix } from '@nage-api/contracts';
+import { type PolicyFunction } from './policy.js';
+import type { ApiKeyStore, AuthAuditSink, AuthUserStore, Clock, LockoutStore, OtpChannel, OtpStore, PasswordHasher, SessionStore, TokenSigner } from './ports.js';
+/** Secrets the package needs. All are required; none has a usable default. */
+export interface AuthSecrets {
+    /** PEM private key (or the shared secret when the algorithm is HS256). */
+    readonly jwtPrivateKey: string;
+    /** PEM public key. Not needed for HS256. */
+    readonly jwtPublicKey?: string;
+    /** Pre-hash key for passwords; makes a dumped user table useless alone. */
+    readonly passwordPepper: string;
+    /** HMAC key for stored refresh tokens. */
+    readonly sessionPepper: string;
+    /** HMAC key for stored OTP codes. */
+    readonly otpPepper: string;
+    /** HMAC key for stored API keys. Required only when api keys are enabled. */
+    readonly apiKeyPepper?: string;
+}
+export interface NageAuthModuleOptions {
+    readonly auth?: AuthConfig;
+    readonly environment: NodeEnvironment;
+    readonly secrets: AuthSecrets;
+    /** Role → permissions. Without it, permissions must be granted per user. */
+    readonly roles?: RoleMatrix;
+    readonly impersonation?: {
+        readonly enabled?: boolean;
+        readonly allowedRoles?: readonly string[];
+        readonly ttl?: string;
+    };
+    readonly policies?: Readonly<Record<string, PolicyFunction>>;
+    /** How long a resolved principal may be cached. Default 5s. */
+    readonly principalCacheTtlMs?: number;
+    readonly users?: AuthUserStore;
+    readonly sessions?: SessionStore;
+    readonly otpStore?: OtpStore;
+    readonly otpChannel?: OtpChannel;
+    readonly apiKeys?: ApiKeyStore;
+    readonly lockout?: LockoutStore;
+    readonly hasher?: PasswordHasher;
+    readonly signer?: TokenSigner;
+    readonly audit?: AuthAuditSink;
+    readonly clock?: Clock;
+}
+export declare class NageAuthModule {
+    static forRoot(options: NageAuthModuleOptions): DynamicModule;
+}
+//# sourceMappingURL=auth.module.d.ts.map