@nauth-toolkit/core 0.1.0

package/dist/services/password.service.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordService = void 0;
+const argon2 = __importStar(require("argon2"));
+const common_passwords_1 = require("../utils/common-passwords");
+const nauth_exception_1 = require("../exceptions/nauth.exception");
+const error_codes_enum_1 = require("../enums/error-codes.enum");
+const DEFAULT_ARGON2_CONFIG = {
+    type: argon2.argon2id,
+    memoryCost: 65536,
+    timeCost: 3,
+    parallelism: 2,
+    hashLength: 32,
+};
+class PasswordService {
+    config;
+    commonPasswords;
+    constructor(passwordConfig) {
+        this.commonPasswords = (0, common_passwords_1.loadCommonPasswords)();
+        this.config = {
+            minLength: passwordConfig?.minLength ?? 8,
+            maxLength: passwordConfig?.maxLength ?? 128,
+            requireUppercase: passwordConfig?.requireUppercase ?? true,
+            requireLowercase: passwordConfig?.requireLowercase ?? true,
+            requireNumbers: passwordConfig?.requireNumbers ?? true,
+            requireSpecialChars: passwordConfig?.requireSpecialChars ?? true,
+            specialChars: passwordConfig?.specialChars ?? '!@#$%^&*()_+=[{}|;:,.<>?-]',
+            preventCommon: passwordConfig?.preventCommon ?? true,
+            preventUserInfo: passwordConfig?.preventUserInfo ?? true,
+            historyCount: passwordConfig?.historyCount ?? 5,
+            expiryDays: passwordConfig?.expiryDays ?? 0,
+        };
+    }
+    async hashPassword(password) {
+        try {
+            return await argon2.hash(password, DEFAULT_ARGON2_CONFIG);
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, `Failed to hash password: ${errorMessage}`);
+        }
+    }
+    async verifyPassword(password, hash) {
+        try {
+            return await argon2.verify(hash, password);
+        }
+        catch {
+            return false;
+        }
+    }
+    async validatePassword(password, userInfo) {
+        const errors = [];
+        if (password.length < this.config.minLength) {
+            errors.push(`Password must be at least ${this.config.minLength} characters long`);
+        }
+        if (password.length > this.config.maxLength) {
+            errors.push(`Password must not exceed ${this.config.maxLength} characters`);
+        }
+        if (this.config.requireUppercase && !/[A-Z]/.test(password)) {
+            errors.push('Password must contain at least one uppercase letter');
+        }
+        if (this.config.requireLowercase && !/[a-z]/.test(password)) {
+            errors.push('Password must contain at least one lowercase letter');
+        }
+        if (this.config.requireNumbers && !/\d/.test(password)) {
+            errors.push('Password must contain at least one number');
+        }
+        if (this.config.requireSpecialChars) {
+            const hasSpecialChar = this.config.specialChars.split('').some((char) => password.includes(char));
+            if (!hasSpecialChar) {
+                errors.push(`Password must contain at least one special character ${this.config.specialChars}`);
+            }
+        }
+        if (this.config.preventCommon) {
+            if (this.commonPasswords.has(password.toLowerCase())) {
+                errors.push('Password is too common and easy to guess');
+            }
+        }
+        if (this.config.preventUserInfo && userInfo) {
+            const passwordLower = password.toLowerCase();
+            if (userInfo.email) {
+                const emailUsername = userInfo.email.split('@')[0].toLowerCase();
+                if (passwordLower.includes(emailUsername)) {
+                    errors.push('Password must not contain your email or username');
+                }
+            }
+            if (userInfo.username) {
+                const usernameLower = userInfo.username.toLowerCase();
+                if (passwordLower.includes(usernameLower)) {
+                    errors.push('Password must not contain your email or username');
+                }
+            }
+        }
+        return {
+            valid: errors.length === 0,
+            errors,
+        };
+    }
+    async isPasswordInHistory(password, passwordHistory) {
+        for (const oldHash of passwordHistory) {
+            const matches = await this.verifyPassword(password, oldHash);
+            if (matches) {
+                return true;
+            }
+        }
+        return false;
+    }
+    addToHistory(currentHistory, newHash) {
+        const history = [...currentHistory, newHash];
+        if (history.length > this.config.historyCount) {
+            return history.slice(-this.config.historyCount);
+        }
+        return history;
+    }
+}
+exports.PasswordService = PasswordService;
+//# sourceMappingURL=password.service.js.map

package/dist/services/password.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.service.js","sourceRoot":"","sources":["../../src/services/password.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAEjC,gEAAgE;AAChE,mEAA+D;AAC/D,gEAA0D;AAiB1D,MAAM,qBAAqB,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC,QAAQ;IACrB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;IACd,UAAU,EAAE,EAAE;CACN,CAAC;AAqCX,MAAa,eAAe;IAET,MAAM,CAA2B;IAGjC,eAAe,CAAc;IAE9C,YAAY,cAA+B;QAIzC,IAAI,CAAC,eAAe,GAAG,IAAA,sCAAmB,GAAE,CAAC;QAG7C,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,cAAc,EAAE,SAAS,IAAI,CAAC;YACzC,SAAS,EAAE,cAAc,EAAE,SAAS,IAAI,GAAG;YAC3C,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,IAAI;YAC1D,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,IAAI;YAC1D,cAAc,EAAE,cAAc,EAAE,cAAc,IAAI,IAAI;YACtD,mBAAmB,EAAE,cAAc,EAAE,mBAAmB,IAAI,IAAI;YAChE,YAAY,EAAE,cAAc,EAAE,YAAY,IAAI,4BAA4B;YAC1E,aAAa,EAAE,cAAc,EAAE,aAAa,IAAI,IAAI;YACpD,eAAe,EAAE,cAAc,EAAE,eAAe,IAAI,IAAI;YACxD,YAAY,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC;YAC/C,UAAU,EAAE,cAAc,EAAE,UAAU,IAAI,CAAC;SAC5C,CAAC;IACJ,CAAC;IAsBD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,cAAc,EAAE,4BAA4B,YAAY,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAoBD,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YAGP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAgCD,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,QAAgD;QAEhD,MAAM,MAAM,GAAa,EAAE,CAAC;QAG5B,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,CAAC,SAAS,kBAAkB,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC9E,CAAC;QAGD,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAEpC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wDAAwD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAID,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAGD,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,QAAQ,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YAE7C,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjE,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACtD,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;SACP,CAAC;IACJ,CAAC;IAwBD,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAyB;QAEnE,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAiBD,YAAY,CAAC,cAAwB,EAAE,OAAe;QACpD,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,EAAE,OAAO,CAAC,CAAC;QAG7C,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AApPD,0CAoPC"}

package/dist/services/phone-verification.service.d.ts

@@ -0,0 +1,32 @@
+import { Repository } from 'typeorm';
+import { BaseVerificationToken, BaseUser } from '../entities';
+import { SMSProvider } from '../interfaces/provider.interface';
+import { StorageAdapter } from '../interfaces/storage-adapter.interface';
+import { NAuthConfig } from '../interfaces/config.interface';
+import { ClientInfoService } from './client-info.service';
+import { InternalAuthAuditService as AuthAuditService } from './auth-audit.service';
+import { NAuthLogger } from '../utils/nauth-logger';
+import { SendVerificationSMSDTO, SendVerificationSMSResponseDTO, VerifyPhoneWithCodeDTO, VerifyPhoneResponseDTO, ResendVerificationSMSDTO, ResendVerificationSMSResponseDTO } from '../dto/verify-phone.dto';
+import { VerifyPhoneWithCodeBySubDTO } from '../dto/verify-phone-by-sub.dto';
+export declare class PhoneVerificationService {
+    private readonly verificationTokenRepo;
+    private readonly userRepo;
+    private readonly smsProvider;
+    private readonly storageAdapter;
+    private readonly config;
+    private readonly clientInfoService;
+    private readonly logger;
+    private readonly auditService?;
+    constructor(verificationTokenRepo: Repository<BaseVerificationToken>, userRepo: Repository<BaseUser>, smsProvider: SMSProvider, storageAdapter: StorageAdapter, config: NAuthConfig, clientInfoService: ClientInfoService, logger: NAuthLogger, auditService?: AuthAuditService | undefined);
+    sendVerificationSMS(dto: SendVerificationSMSDTO): Promise<SendVerificationSMSResponseDTO>;
+    verifyPhoneWithCode(dto: VerifyPhoneWithCodeDTO): Promise<VerifyPhoneResponseDTO>;
+    verifyPhoneWithCodeBySub(dto: VerifyPhoneWithCodeBySubDTO): Promise<VerifyPhoneResponseDTO>;
+    resendVerificationSMS(dto: ResendVerificationSMSDTO): Promise<ResendVerificationSMSResponseDTO>;
+    private resendVerificationSMSBySub;
+    private resendVerificationSMSForPhone;
+    private generateCode;
+    private generateToken;
+    private hashToken;
+    private maskPhone;
+}
+//# sourceMappingURL=phone-verification.service.d.ts.map

package/dist/services/phone-verification.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone-verification.service.d.ts","sourceRoot":"","sources":["../../src/services/phone-verification.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAU,MAAM,SAAS,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAIpF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,gCAAgC,EACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAwB7E,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAPb,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,CAAC,EACxD,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,WAAW,EACnB,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,WAAW,EACnB,YAAY,CAAC,EAAE,gBAAgB,YAAA;IAW5C,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA8JzF,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAoLjF,wBAAwB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+O3F,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,gCAAgC,CAAC;YAmBvF,0BAA0B;YA2C1B,6BAA6B;IAkB3C,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,SAAS;CAIlB"}

package/dist/services/phone-verification.service.js

@@ -0,0 +1,474 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PhoneVerificationService = void 0;
+const typeorm_1 = require("typeorm");
+const auth_audit_event_type_enum_1 = require("../enums/auth-audit-event-type.enum");
+const nauth_exception_1 = require("../exceptions/nauth.exception");
+const error_codes_enum_1 = require("../enums/error-codes.enum");
+const verify_phone_dto_1 = require("../dto/verify-phone.dto");
+const crypto = __importStar(require("crypto"));
+class PhoneVerificationService {
+    verificationTokenRepo;
+    userRepo;
+    smsProvider;
+    storageAdapter;
+    config;
+    clientInfoService;
+    logger;
+    auditService;
+    constructor(verificationTokenRepo, userRepo, smsProvider, storageAdapter, config, clientInfoService, logger, auditService) {
+        this.verificationTokenRepo = verificationTokenRepo;
+        this.userRepo = userRepo;
+        this.smsProvider = smsProvider;
+        this.storageAdapter = storageAdapter;
+        this.config = config;
+        this.clientInfoService = clientInfoService;
+        this.logger = logger;
+        this.auditService = auditService;
+    }
+    async sendVerificationSMS(dto) {
+        const { sub, skipAlreadyVerifiedCheck = true, challengeSessionId } = dto;
+        const rateLimitKey = `phone-verification:${sub}`;
+        const rateLimitMax = this.config.signup?.phoneVerification?.rateLimitMax || 3;
+        const rateLimitWindow = this.config.signup?.phoneVerification?.rateLimitWindow || 3600;
+        const ttlBefore = await this.storageAdapter.ttl(rateLimitKey);
+        const isWindowExpired = ttlBefore === -1 || ttlBefore < 0 || ttlBefore > rateLimitWindow;
+        if (ttlBefore > rateLimitWindow) {
+            await this.storageAdapter.del(rateLimitKey);
+        }
+        const currentCount = await this.storageAdapter.incr(rateLimitKey, isWindowExpired ? rateLimitWindow : undefined);
+        if (isWindowExpired && currentCount === 1) {
+            this.logger?.debug?.(`Rate limit window reset for phone verification: sub=${sub}, window=${rateLimitWindow}s, max=${rateLimitMax}`);
+        }
+        const actualTtl = await this.storageAdapter.ttl(rateLimitKey);
+        this.logger?.debug?.(`Phone verification rate limit check: sub=${sub}, count=${currentCount}/${rateLimitMax}, ttl=${actualTtl}s`);
+        if (currentCount > rateLimitMax) {
+            this.logger?.warn?.(`SMS rate limit exceeded: sub=${sub}, count=${currentCount}, max=${rateLimitMax}, retryAfter=${actualTtl}s`);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.RATE_LIMIT_SMS, `Too many verification SMS sent. Please try again in ${actualTtl > 0 ? actualTtl : rateLimitWindow} seconds`, {
+                retryAfter: actualTtl > 0 ? actualTtl : rateLimitWindow,
+                currentCount,
+                maxAttempts: rateLimitMax,
+            });
+        }
+        const user = (await this.userRepo.findOne({ where: { sub } }));
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        if (!user.phone) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_REQUIRED, 'No phone number associated with this account');
+        }
+        if (!skipAlreadyVerifiedCheck && user.isPhoneVerified) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.ALREADY_VERIFIED, 'Phone already verified');
+        }
+        const resendDelay = this.config.signup?.phoneVerification?.resendDelay ?? 60;
+        const lastToken = (await this.verificationTokenRepo.findOne({
+            where: { userId: user.id, type: 'phone' },
+            order: { createdAt: 'DESC' },
+        }));
+        if (lastToken) {
+            const secondsSinceLastSend = (Date.now() - lastToken.createdAt.getTime()) / 1000;
+            if (secondsSinceLastSend < resendDelay) {
+                const waitSeconds = Math.ceil(resendDelay - secondsSinceLastSend);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.RATE_LIMIT_RESEND, `Please wait ${waitSeconds} seconds before requesting another code`, {
+                    retryAfter: waitSeconds,
+                    resendDelay,
+                });
+            }
+        }
+        await this.verificationTokenRepo.update({ userId: user.id, type: 'phone', usedAt: (0, typeorm_1.IsNull)() }, { usedAt: new Date() });
+        const code = this.generateCode();
+        const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
+        const clientInfo = this.clientInfoService.get();
+        const { ipAddress, userAgent } = clientInfo;
+        const verificationToken = this.verificationTokenRepo.create({
+            userId: user.id,
+            challengeSessionId: challengeSessionId ?? null,
+            type: 'phone',
+            token: tokenHash,
+            code,
+            expiresAt: new Date(Date.now() + (this.config.signup?.phoneVerification?.expiresIn || 300) * 1000),
+            attempts: 0,
+            ipAddress,
+            userAgent,
+        });
+        const saved = (await this.verificationTokenRepo.save(verificationToken));
+        this.logger?.log?.(`SMS token created: sub=${sub}, tokenId=${saved.id}, code=${code}, codeType=${typeof code}, userId=${user.id}, usedAt=${saved.usedAt || 'null'}`);
+        await this.smsProvider.sendOTP(user.phone, code);
+        this.logger?.log?.(`SMS verification code sent: sub=${sub}, tokenId=${saved.id}, phone=${this.maskPhone(user.phone)}`);
+        try {
+            await this.auditService?.recordEvent({
+                userId: user.id,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PHONE_VERIFICATION_REQUESTED,
+                eventStatus: 'INFO',
+                metadata: {
+                    verificationTokenId: saved.id,
+                    phone: this.maskPhone(user.phone),
+                },
+            });
+        }
+        catch (auditError) {
+            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+            this.logger?.error?.(`Failed to record PHONE_VERIFICATION_REQUESTED audit event: ${errorMessage}`, {
+                error: auditError,
+                userId: user.id,
+            });
+        }
+        return { tokenId: saved.id };
+    }
+    async verifyPhoneWithCode(dto) {
+        const { phone, code, challengeSessionId } = dto;
+        const whereClause = {
+            type: 'phone',
+            code,
+            usedAt: (0, typeorm_1.IsNull)(),
+            ...(challengeSessionId !== undefined && { challengeSessionId }),
+        };
+        const candidateTokens = (await this.verificationTokenRepo.find({
+            where: whereClause,
+            order: { createdAt: 'DESC' },
+        }));
+        let matched = null;
+        for (const token of candidateTokens) {
+            const user = (await this.userRepo.findOne({ where: { id: token.userId } }));
+            if (user && user.phone === phone) {
+                matched = { token, user };
+                break;
+            }
+        }
+        if (!matched) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_INVALID, 'Invalid or expired verification code');
+        }
+        const { token, user } = matched;
+        const maxAttemptsPerUser = this.config.signup?.phoneVerification?.maxAttemptsPerUser ?? 10;
+        const maxAttemptsPerIP = this.config.signup?.phoneVerification?.maxAttemptsPerIP ?? 20;
+        const attemptWindow = this.config.signup?.phoneVerification?.attemptWindow ?? 3600;
+        const userRateLimitKey = `verify-attempts:user:${user.id}`;
+        const userAttempts = await this.storageAdapter.incr(userRateLimitKey);
+        if (userAttempts === 1) {
+            await this.storageAdapter.expire(userRateLimitKey, attemptWindow);
+        }
+        if (userAttempts > maxAttemptsPerUser) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_TOO_MANY_ATTEMPTS, 'Too many verification attempts. Please try again later.');
+        }
+        const clientInfo = this.clientInfoService.get();
+        if (clientInfo.ipAddress) {
+            const ipRateLimitKey = `verify-attempts:ip:${clientInfo.ipAddress}`;
+            const ipAttempts = await this.storageAdapter.incr(ipRateLimitKey);
+            if (ipAttempts === 1) {
+                await this.storageAdapter.expire(ipRateLimitKey, attemptWindow);
+            }
+            if (ipAttempts > maxAttemptsPerIP) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_TOO_MANY_ATTEMPTS, 'Too many verification attempts from this IP. Please try again later.');
+            }
+        }
+        const isExpired = typeof token.isExpired === 'function' ? !!token.isExpired() : token.expiresAt.getTime() <= Date.now();
+        if (isExpired) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_EXPIRED, 'Verification code has expired');
+        }
+        const maxAttempts = this.config.signup?.phoneVerification?.maxAttempts ?? 3;
+        const tooManyAttempts = typeof token.maxAttemptsExceeded === 'function'
+            ? !!token.maxAttemptsExceeded(maxAttempts)
+            : token.attempts >= maxAttempts;
+        if (tooManyAttempts) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_TOO_MANY_ATTEMPTS, 'Too many failed attempts. Request a new code.', {
+                maxAttempts,
+                currentAttempts: token.attempts,
+            });
+        }
+        token.attempts += 1;
+        if (token.code !== code) {
+            await this.verificationTokenRepo.save(token);
+            this.logger?.debug?.(`Phone verification failed: phone=${this.maskPhone(phone)}, attempts=${token.attempts}/${maxAttempts}`);
+            try {
+                await this.auditService?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PHONE_VERIFICATION_FAILED,
+                    eventStatus: 'FAILURE',
+                    reason: 'invalid_code',
+                    description: 'Invalid verification code provided',
+                    metadata: {
+                        verificationTokenId: token.id,
+                        attempts: token.attempts,
+                        phone: this.maskPhone(phone),
+                    },
+                });
+            }
+            catch (auditError) {
+                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record PHONE_VERIFICATION_FAILED audit event: ${errorMessage}`, {
+                    error: auditError,
+                    userId: user.id,
+                });
+            }
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_INVALID, 'Invalid verification code', {
+                attemptsRemaining: Math.max(0, maxAttempts - token.attempts),
+            });
+        }
+        token.usedAt = new Date();
+        await this.verificationTokenRepo.save(token);
+        await this.userRepo.update(user.id, {
+            isPhoneVerified: true,
+            isActive: true,
+        });
+        this.logger?.log?.(`Phone verification successful: userId=${user.id}, phone=${this.maskPhone(phone)}`);
+        try {
+            await this.auditService?.recordEvent({
+                userId: user.id,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PHONE_VERIFIED,
+                eventStatus: 'SUCCESS',
+                metadata: {
+                    verificationTokenId: token.id,
+                    verificationMethod: 'code',
+                    phone: this.maskPhone(phone),
+                },
+            });
+        }
+        catch (auditError) {
+            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+            this.logger?.error?.(`Failed to record PHONE_VERIFIED audit event: ${errorMessage}`, {
+                error: auditError,
+                userId: user.id,
+            });
+        }
+        return { message: 'Phone verified successfully. Please log in to continue.' };
+    }
+    async verifyPhoneWithCodeBySub(dto) {
+        const { sub, code, challengeSessionId } = dto;
+        const user = (await this.userRepo.findOne({ where: { sub } }));
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        if (!user.phone) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_REQUIRED, 'No phone number associated with this account');
+        }
+        const wasPhoneVerified = Boolean(user.isPhoneVerified);
+        const maxAttemptsPerIP = this.config.signup?.phoneVerification?.maxAttemptsPerIP ?? 20;
+        const attemptWindow = this.config.signup?.phoneVerification?.attemptWindow ?? 3600;
+        const clientInfo = this.clientInfoService.get();
+        const codeString = String(code);
+        this.logger?.log?.(`Looking for verification token: sub=${sub}, code=${codeString}, codeType=${typeof code}, userId=${user.id}`);
+        const whereClause = {
+            userId: user.id,
+            type: 'phone',
+            code: codeString,
+            usedAt: (0, typeorm_1.IsNull)(),
+            ...(challengeSessionId !== undefined && { challengeSessionId }),
+        };
+        const verificationToken = (await this.verificationTokenRepo.findOne({
+            where: whereClause,
+            order: { createdAt: 'DESC' },
+        }));
+        const incrementIPRateLimit = async () => {
+            if (clientInfo.ipAddress) {
+                const ipRateLimitKey = `verify-attempts:ip:${clientInfo.ipAddress}`;
+                const ipAttempts = await this.storageAdapter.incr(ipRateLimitKey);
+                if (ipAttempts === 1) {
+                    await this.storageAdapter.expire(ipRateLimitKey, attemptWindow);
+                }
+                if (ipAttempts > maxAttemptsPerIP) {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_TOO_MANY_ATTEMPTS, 'Too many verification attempts from this IP. Please try again later.');
+                }
+            }
+        };
+        if (!verificationToken) {
+            this.logger?.warn?.(`Phone verification token not found: sub=${sub}, code=${codeString}, originalCodeType=${typeof code}, userId=${user.id}`);
+            await incrementIPRateLimit();
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_INVALID, 'Invalid or expired verification code');
+        }
+        const isExpired = typeof verificationToken.isExpired === 'function'
+            ? !!verificationToken.isExpired()
+            : verificationToken.expiresAt.getTime() <= Date.now();
+        if (isExpired) {
+            await incrementIPRateLimit();
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_EXPIRED, 'Verification code has expired');
+        }
+        const maxAttempts = this.config.signup?.phoneVerification?.maxAttempts ?? 3;
+        const tooManyAttempts = typeof verificationToken.maxAttemptsExceeded === 'function'
+            ? !!verificationToken.maxAttemptsExceeded(maxAttempts)
+            : verificationToken.attempts >= maxAttempts;
+        if (tooManyAttempts) {
+            await incrementIPRateLimit();
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_TOO_MANY_ATTEMPTS, 'Too many failed attempts. Request a new code.', {
+                maxAttempts,
+                currentAttempts: verificationToken.attempts,
+            });
+        }
+        const maxAttemptsPerUser = this.config.signup?.phoneVerification?.maxAttemptsPerUser ?? 10;
+        const incrementUserRateLimit = async () => {
+            const userRateLimitKey = `verify-attempts:user:${user.id}`;
+            const userAttempts = await this.storageAdapter.incr(userRateLimitKey);
+            if (userAttempts === 1) {
+                await this.storageAdapter.expire(userRateLimitKey, attemptWindow);
+            }
+            if (userAttempts > maxAttemptsPerUser) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_TOO_MANY_ATTEMPTS, 'Too many verification attempts. Please try again later.');
+            }
+        };
+        verificationToken.attempts += 1;
+        const storedCode = String(verificationToken.code).trim();
+        const providedCode = String(code).trim();
+        if (storedCode !== providedCode) {
+            await incrementIPRateLimit();
+            await incrementUserRateLimit();
+            await this.verificationTokenRepo.save(verificationToken);
+            this.logger?.debug?.(`Phone verification failed: sub=${sub}, attempts=${verificationToken.attempts}/${maxAttempts}`);
+            try {
+                await this.auditService?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PHONE_VERIFICATION_FAILED,
+                    eventStatus: 'FAILURE',
+                    reason: 'invalid_code',
+                    description: 'Invalid verification code provided',
+                    metadata: {
+                        verificationTokenId: verificationToken.id,
+                        attempts: verificationToken.attempts,
+                        phone: this.maskPhone(user.phone || ''),
+                    },
+                });
+            }
+            catch (auditError) {
+                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record PHONE_VERIFICATION_FAILED audit event (by sub): ${errorMessage}`, {
+                    error: auditError,
+                    userId: user.id,
+                });
+            }
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_INVALID, 'Invalid verification code', {
+                attemptsRemaining: Math.max(0, maxAttempts - verificationToken.attempts),
+            });
+        }
+        verificationToken.usedAt = new Date();
+        await this.verificationTokenRepo.save(verificationToken);
+        if (!wasPhoneVerified) {
+            await this.userRepo.update({ sub }, {
+                isPhoneVerified: true,
+                isActive: true,
+            });
+            this.logger?.log?.(`Phone verification successful: sub=${sub}, userId=${user.id} - phone marked as verified`);
+        }
+        else {
+            this.logger?.log?.(`Phone verification code validated: sub=${sub}, userId=${user.id} - phone already verified`);
+        }
+        try {
+            await this.auditService?.recordEvent({
+                userId: user.id,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PHONE_VERIFIED,
+                eventStatus: 'SUCCESS',
+                metadata: {
+                    verificationTokenId: verificationToken.id,
+                    verificationMethod: 'code',
+                    phone: this.maskPhone(user.phone || ''),
+                },
+            });
+        }
+        catch (auditError) {
+            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+            this.logger?.error?.(`Failed to record PHONE_VERIFIED audit event (by sub): ${errorMessage}`, {
+                error: auditError,
+                userId: user.id,
+            });
+        }
+        return { message: 'Phone verified successfully. Please log in to continue.' };
+    }
+    async resendVerificationSMS(dto) {
+        if (!dto.sub && !dto.phone) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'Either sub or phone must be provided');
+        }
+        if (dto.sub) {
+            return this.resendVerificationSMSBySub(dto.sub);
+        }
+        return this.resendVerificationSMSForPhone(dto.phone);
+    }
+    async resendVerificationSMSBySub(sub) {
+        const user = (await this.userRepo.findOne({ where: { sub } }));
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        const resendDelay = this.config.signup?.phoneVerification?.resendDelay ?? 60;
+        const lastToken = (await this.verificationTokenRepo.findOne({
+            where: { userId: user.id, type: 'phone' },
+            order: { createdAt: 'DESC' },
+        }));
+        if (lastToken) {
+            const secondsSinceLastSend = (Date.now() - lastToken.createdAt.getTime()) / 1000;
+            if (secondsSinceLastSend < resendDelay) {
+                const waitSeconds = Math.ceil(resendDelay - secondsSinceLastSend);
+                this.logger?.debug?.(`Resend rate limit: sub=${sub}, wait=${waitSeconds}s, delay=${resendDelay}s`);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.RATE_LIMIT_RESEND, `Please wait ${waitSeconds} seconds before requesting another code`, {
+                    retryAfter: waitSeconds,
+                    resendDelay,
+                });
+            }
+        }
+        this.logger?.debug?.(`Resending SMS verification code: sub=${sub}`);
+        const sendDto = Object.assign(new verify_phone_dto_1.SendVerificationSMSDTO(), {
+            sub,
+            challengeSessionId: lastToken?.challengeSessionId ?? undefined,
+        });
+        const result = await this.sendVerificationSMS(sendDto);
+        return { tokenId: result.tokenId };
+    }
+    async resendVerificationSMSForPhone(phone) {
+        const user = (await this.userRepo.findOne({ where: { phone } }));
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        if (user.isPhoneVerified) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.ALREADY_VERIFIED, 'Phone number is already verified');
+        }
+        return this.resendVerificationSMSBySub(user.sub);
+    }
+    generateCode() {
+        const codeLength = this.config.signup?.phoneVerification?.codeLength || 6;
+        const min = Math.pow(10, codeLength - 1);
+        const max = Math.pow(10, codeLength) - 1;
+        return Math.floor(min + Math.random() * (max - min + 1)).toString();
+    }
+    generateToken() {
+        return crypto.randomBytes(32).toString('hex');
+    }
+    hashToken(token) {
+        return crypto.createHash('sha256').update(token).digest('hex');
+    }
+    maskPhone(phone) {
+        if (!phone || phone.length < 4)
+            return '***';
+        return `***${phone.slice(-4)}`;
+    }
+}
+exports.PhoneVerificationService = PhoneVerificationService;
+//# sourceMappingURL=phone-verification.service.js.map