@nauth-toolkit/core 0.1.13 → 0.1.17

package/dist/dto/user-response.dto.js

@@ -1,24 +1,100 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserResponseDto = void 0;
+/**
+ * User Response DTO
+ *
+ * Sanitized user object for API responses.
+ * Excludes all sensitive and internal fields.
+ *
+ * Security:
+ * - Never exposes password hash
+ * - Never exposes MFA secrets
+ * - Never exposes internal tracking fields
+ * - Exposes 'sub' (external UUID) instead of internal 'id'
+ *
+ * No validators needed - this is generated internally by the library via fromEntity().
+ *
+ * @example
+ * ```typescript
+ * const user = await userRepository.findOne({ where: { sub } });
+ * return UserResponseDto.fromEntity(user);
+ * ```
+ */
 class UserResponseDto {
+    /**
+     * External user identifier (UUID v4)
+     * This is the 'sub' (subject) field from JWT tokens
+     */
     sub;
+    /**
+     * User's email address
+     */
     email;
+    /**
+     * User's username (optional)
+     */
     username;
+    /**
+     * User's first name (optional)
+     */
     firstName;
+    /**
+     * User's last name (optional)
+     */
     lastName;
+    /**
+     * User's phone number (optional)
+     * E.164 format validated in service layer if present
+     */
     phone;
+    /**
+     * Email verification status
+     */
     isEmailVerified;
+    /**
+     * Phone verification status
+     */
     isPhoneVerified;
+    /**
+     * Account active status
+     */
     isActive;
+    /**
+     * MFA enabled status
+     */
     mfaEnabled;
+    /**
+     * Array of social providers linked to this account
+     *
+     * Examples: ['google', 'apple', 'facebook']
+     * null/undefined means no social auth, only password-based
+     */
     socialProviders;
+    /**
+     * Whether this user has a password set
+     * Used to determine if user can use password-based authentication
+     * or is a pure social signup (no password, only social auth)
+     */
     hasPasswordHash;
+    /**
+     * Account creation timestamp
+     */
     createdAt;
+    /**
+     * Last account update timestamp
+     */
     updatedAt;
+    /**
+     * Convert User entity to safe response DTO
+     *
+     * @param user - User entity from database
+     * @returns Sanitized user object with external identifier (sub)
+     */
     static fromEntity(user) {
         const dto = new UserResponseDto();
-        dto.sub = user.sub;
+        // Essential fields only
+        dto.sub = user.sub; // External UUID identifier
         dto.email = user.email;
         dto.username = user.username;
         dto.firstName = user.firstName;
@@ -29,11 +105,17 @@ class UserResponseDto {
         dto.isActive = user.isActive;
         dto.mfaEnabled = user.mfaEnabled;
         dto.socialProviders = user.socialProviders;
-        dto.hasPasswordHash = !!user.passwordHash;
+        dto.hasPasswordHash = !!user.passwordHash; // Check if password exists
         dto.createdAt = user.createdAt;
         dto.updatedAt = user.updatedAt;
         return dto;
     }
+    /**
+     * Convert array of User entities to safe response DTOs
+     *
+     * @param users - Array of User entities
+     * @returns Array of sanitized user objects
+     */
     static fromEntities(users) {
         return users.map((user) => UserResponseDto.fromEntity(user));
     }

package/dist/dto/user-response.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-response.dto.js","sourceRoot":"","sources":["../../src/dto/user-response.dto.ts"],"names":[],"mappings":";;;AAsBA,MAAa,eAAe;IAK1B,GAAG,CAAU;IAKb,KAAK,CAAU;IAKf,QAAQ,CAAiB;IAKzB,SAAS,CAAiB;IAK1B,QAAQ,CAAiB;IAMzB,KAAK,CAAiB;IAKtB,eAAe,CAAW;IAK1B,eAAe,CAAW;IAK1B,QAAQ,CAAW;IAKnB,UAAU,CAAW;IAQrB,eAAe,CAAmB;IAOlC,eAAe,CAAW;IAK1B,SAAS,CAAQ;IAKjB,SAAS,CAAQ;IAQjB,MAAM,CAAC,UAAU,CAAC,IAAW;QAC3B,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAGlC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACnB,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;QAC1C,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAE/B,OAAO,GAAG,CAAC;IACb,CAAC;IAQD,MAAM,CAAC,YAAY,CAAC,KAAc;QAChC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF;AAnHD,0CAmHC"}
+{"version":3,"file":"user-response.dto.js","sourceRoot":"","sources":["../../src/dto/user-response.dto.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,eAAe;IAC1B;;;OAGG;IACH,GAAG,CAAU;IAEb;;OAEG;IACH,KAAK,CAAU;IAEf;;OAEG;IACH,QAAQ,CAAiB;IAEzB;;OAEG;IACH,SAAS,CAAiB;IAE1B;;OAEG;IACH,QAAQ,CAAiB;IAEzB;;;OAGG;IACH,KAAK,CAAiB;IAEtB;;OAEG;IACH,eAAe,CAAW;IAE1B;;OAEG;IACH,eAAe,CAAW;IAE1B;;OAEG;IACH,QAAQ,CAAW;IAEnB;;OAEG;IACH,UAAU,CAAW;IAErB;;;;;OAKG;IACH,eAAe,CAAmB;IAElC;;;;OAIG;IACH,eAAe,CAAW;IAE1B;;OAEG;IACH,SAAS,CAAQ;IAEjB;;OAEG;IACH,SAAS,CAAQ;IAEjB;;;;;OAKG;IACH,MAAM,CAAC,UAAU,CAAC,IAAW;QAC3B,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAElC,wBAAwB;QACxB,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,2BAA2B;QAC/C,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC7B,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC3C,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,2BAA2B;QACtE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAE/B,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,KAAc;QAChC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF;AAnHD,0CAmHC"}

package/dist/dto/user-update.dto.d.ts

@@ -1,12 +1,144 @@
 import { MFADeviceMethod } from '../enums/mfa-method.enum';
+/**
+ * DTO for updating user attributes
+ *
+ * Security:
+ * - All fields validated against DB constraints
+ * - Input sanitization applied automatically
+ * - Email uniqueness checked in service layer
+ * - Phone uniqueness checked in service layer
+ * - Username uniqueness checked in service layer
+ *
+ * @example
+ * ```typescript
+ * const updateData: UserUpdateDTO = {
+ *   firstName: 'John',
+ *   lastName: 'Doe',
+ *   email: 'john.doe@example.com',
+ *   phone: '+61444567890'
+ * };
+ * ```
+ */
 export declare class UserUpdateDTO {
+    /**
+     * Optional username update
+     *
+     * Validation:
+     * - 3-50 characters
+     * - Alphanumeric, underscores, and hyphens only
+     * - Max 255 characters (DB limit)
+     * - Uniqueness checked in service layer
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Case preserved (username can be case-sensitive per config)
+     */
     username?: string;
+    /**
+     * Optional first name update
+     *
+     * Validation:
+     * - 1-100 characters
+     * - Letters, spaces, hyphens, and apostrophes only
+     * - Max 100 characters (DB limit)
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Title case preserved
+     */
     firstName?: string;
+    /**
+     * Optional last name update
+     *
+     * Validation:
+     * - 1-100 characters
+     * - Letters, spaces, hyphens, and apostrophes only
+     * - Max 100 characters (DB limit)
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Title case preserved
+     */
     lastName?: string;
+    /**
+     * Optional email address update
+     *
+     * Validation:
+     * - Valid email format (RFC 5322)
+     * - Max 255 characters (matches DB limit)
+     * - Uniqueness checked in service layer
+     *
+     * Sanitization:
+     * - Trimmed and lowercased
+     */
     email?: string;
+    /**
+     * Optional phone number update
+     *
+     * Validation:
+     * - E.164 format (international standard)
+     * - MUST start with + (required for security)
+     * - Max 20 characters (DB limit)
+     * - Uniqueness checked in service layer
+     *
+     * Sanitization:
+     * - Whitespace removed
+     * - Only digits and leading + preserved
+     *
+     * Security:
+     * - Strict E.164 validation prevents SQL injection
+     * - Max length prevents oversized inputs
+     */
     phone?: string;
+    /**
+     * Optional metadata update (custom fields)
+     *
+     * Security:
+     * - Validated in service layer if used
+     * - Max depth/size limits should be enforced
+     * - Existing metadata merged with new values
+     */
     metadata?: Record<string, unknown>;
+    /**
+     * Optional preferred MFA method
+     *
+     * Sets the user's preferred MFA method for authentication.
+     * Must be one of the MFA device methods the user has configured.
+     *
+     * Validation:
+     * - Must be one of: totp, sms, email, passkey
+     * - Max 50 characters (matches typical method name length)
+     *
+     * @example
+     * ```typescript
+     * await authService.updateUserAttributes(userId, {
+     *   preferredMfaMethod: 'totp'
+     * });
+     * ```
+     */
     preferredMfaMethod?: MFADeviceMethod;
+    /**
+     * Optional flag to retain verification status when updating email/phone
+     *
+     * When true:
+     * - Email verification status is preserved when email is updated
+     * - Phone verification status is preserved when phone is updated
+     * - Useful when verification was done externally or outside nauth-toolkit
+     *
+     * When false or undefined (default):
+     * - Email verification is reset to false when email is updated
+     * - Phone verification is reset to false when phone is updated
+     * - User must re-verify the new email/phone
+     *
+     * @example
+     * ```typescript
+     * // Update email but keep verification status (external verification)
+     * await authService.updateUserAttributes(userId, {
+     *   email: 'new@example.com',
+     *   retainVerification: true
+     * });
+     * ```
+     */
     retainVerification?: boolean;
 }
 //# sourceMappingURL=user-update.dto.d.ts.map

package/dist/dto/user-update.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-update.dto.d.ts","sourceRoot":"","sources":["../../src/dto/user-update.dto.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAa,MAAM,0BAA0B,CAAC;AAsBtE,qBAAa,aAAa;IA2BxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IA2BlB,SAAS,CAAC,EAAE,MAAM,CAAC;IA2BnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAsBlB,KAAK,CAAC,EAAE,MAAM,CAAC;IAgCf,KAAK,CAAC,EAAE,MAAM,CAAC;IAWf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAwBnC,kBAAkB,CAAC,EAAE,eAAe,CAAC;IA0BrC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B"}
+{"version":3,"file":"user-update.dto.d.ts","sourceRoot":"","sources":["../../src/dto/user-update.dto.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAa,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,aAAa;IACxB;;;;;;;;;;;;OAYG;IAcH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;OAWG;IAcH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;;;OAWG;IAcH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;OAUG;IAUH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;;;;;;;;;;OAgBG;IAcH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;OAOG;IAEH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC;;;;;;;;;;;;;;;;OAgBG;IAMH,kBAAkB,CAAC,EAAE,eAAe,CAAC;IAErC;;;;;;;;;;;;;;;;;;;;;OAqBG;IAGH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B"}

package/dist/dto/user-update.dto.js

@@ -13,14 +13,146 @@ exports.UserUpdateDTO = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const mfa_method_enum_1 = require("../enums/mfa-method.enum");
+/**
+ * DTO for updating user attributes
+ *
+ * Security:
+ * - All fields validated against DB constraints
+ * - Input sanitization applied automatically
+ * - Email uniqueness checked in service layer
+ * - Phone uniqueness checked in service layer
+ * - Username uniqueness checked in service layer
+ *
+ * @example
+ * ```typescript
+ * const updateData: UserUpdateDTO = {
+ *   firstName: 'John',
+ *   lastName: 'Doe',
+ *   email: 'john.doe@example.com',
+ *   phone: '+61444567890'
+ * };
+ * ```
+ */
 class UserUpdateDTO {
+    /**
+     * Optional username update
+     *
+     * Validation:
+     * - 3-50 characters
+     * - Alphanumeric, underscores, and hyphens only
+     * - Max 255 characters (DB limit)
+     * - Uniqueness checked in service layer
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Case preserved (username can be case-sensitive per config)
+     */
     username;
+    /**
+     * Optional first name update
+     *
+     * Validation:
+     * - 1-100 characters
+     * - Letters, spaces, hyphens, and apostrophes only
+     * - Max 100 characters (DB limit)
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Title case preserved
+     */
     firstName;
+    /**
+     * Optional last name update
+     *
+     * Validation:
+     * - 1-100 characters
+     * - Letters, spaces, hyphens, and apostrophes only
+     * - Max 100 characters (DB limit)
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Title case preserved
+     */
     lastName;
+    /**
+     * Optional email address update
+     *
+     * Validation:
+     * - Valid email format (RFC 5322)
+     * - Max 255 characters (matches DB limit)
+     * - Uniqueness checked in service layer
+     *
+     * Sanitization:
+     * - Trimmed and lowercased
+     */
     email;
+    /**
+     * Optional phone number update
+     *
+     * Validation:
+     * - E.164 format (international standard)
+     * - MUST start with + (required for security)
+     * - Max 20 characters (DB limit)
+     * - Uniqueness checked in service layer
+     *
+     * Sanitization:
+     * - Whitespace removed
+     * - Only digits and leading + preserved
+     *
+     * Security:
+     * - Strict E.164 validation prevents SQL injection
+     * - Max length prevents oversized inputs
+     */
     phone;
+    /**
+     * Optional metadata update (custom fields)
+     *
+     * Security:
+     * - Validated in service layer if used
+     * - Max depth/size limits should be enforced
+     * - Existing metadata merged with new values
+     */
     metadata;
+    /**
+     * Optional preferred MFA method
+     *
+     * Sets the user's preferred MFA method for authentication.
+     * Must be one of the MFA device methods the user has configured.
+     *
+     * Validation:
+     * - Must be one of: totp, sms, email, passkey
+     * - Max 50 characters (matches typical method name length)
+     *
+     * @example
+     * ```typescript
+     * await authService.updateUserAttributes(userId, {
+     *   preferredMfaMethod: 'totp'
+     * });
+     * ```
+     */
     preferredMfaMethod;
+    /**
+     * Optional flag to retain verification status when updating email/phone
+     *
+     * When true:
+     * - Email verification status is preserved when email is updated
+     * - Phone verification status is preserved when phone is updated
+     * - Useful when verification was done externally or outside nauth-toolkit
+     *
+     * When false or undefined (default):
+     * - Email verification is reset to false when email is updated
+     * - Phone verification is reset to false when phone is updated
+     * - User must re-verify the new email/phone
+     *
+     * @example
+     * ```typescript
+     * // Update email but keep verification status (external verification)
+     * await authService.updateUserAttributes(userId, {
+     *   email: 'new@example.com',
+     *   retainVerification: true
+     * });
+     * ```
+     */
     retainVerification;
 }
 exports.UserUpdateDTO = UserUpdateDTO;
@@ -93,6 +225,7 @@ __decorate([
     }),
     (0, class_transformer_1.Transform)(({ value }) => {
         if (typeof value === 'string') {
+            // Remove all whitespace and keep only digits and +
             return value.replace(/\s/g, '');
         }
         return value;

package/dist/dto/user-update.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-update.dto.js","sourceRoot":"","sources":["../../src/dto/user-update.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkH;AAClH,yDAA8C;AAC9C,8DAAsE;AAsBtE,MAAa,aAAa;IA2BxB,QAAQ,CAAU;IA2BlB,SAAS,CAAU;IA2BnB,QAAQ,CAAU;IAsBlB,KAAK,CAAU;IAgCf,KAAK,CAAU;IAWf,QAAQ,CAA2B;IAwBnC,kBAAkB,CAAmB;IA0BrC,kBAAkB,CAAW;CAC9B;AArMD,sCAqMC;AA1KC;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAClD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACtE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,sEAAsE;KAChF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;+CACgB;AA2BlB;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACpE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACxE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,uEAAuE;KACjF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;gDACiB;AA2BnB;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACnD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IACvE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,sEAAsE;KAChF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;+CACgB;AAsBlB;IATC,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAChD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;4CACa;AAgCf;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC/C,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACjE,IAAA,yBAAO,EAAC,mBAAmB,EAAE;QAC5B,OAAO,EAAE,kEAAkE;KAC5E,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAE9B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;4CACa;AAWf;IADC,IAAA,4BAAU,GAAE;;+CACsB;AAwBnC;IALC,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,CAAC,2BAAS,CAAC,IAAI,EAAE,2BAAS,CAAC,GAAG,EAAE,2BAAS,CAAC,KAAK,EAAE,2BAAS,CAAC,OAAO,CAAC,EAAE;QAC3E,OAAO,EAAE,gEAAgE;KAC1E,CAAC;IACD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;;yDAC5C;AA0BrC;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;;yDAClC"}
+{"version":3,"file":"user-update.dto.js","sourceRoot":"","sources":["../../src/dto/user-update.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkH;AAClH,yDAA8C;AAC9C,8DAAsE;AAEtE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,aAAa;IACxB;;;;;;;;;;;;OAYG;IAcH,QAAQ,CAAU;IAElB;;;;;;;;;;;OAWG;IAcH,SAAS,CAAU;IAEnB;;;;;;;;;;;OAWG;IAcH,QAAQ,CAAU;IAElB;;;;;;;;;;OAUG;IAUH,KAAK,CAAU;IAEf;;;;;;;;;;;;;;;;OAgBG;IAcH,KAAK,CAAU;IAEf;;;;;;;OAOG;IAEH,QAAQ,CAA2B;IAEnC;;;;;;;;;;;;;;;;OAgBG;IAMH,kBAAkB,CAAmB;IAErC;;;;;;;;;;;;;;;;;;;;;OAqBG;IAGH,kBAAkB,CAAW;CAC9B;AArMD,sCAqMC;AA1KC;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAClD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACtE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,sEAAsE;KAChF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;+CACgB;AA2BlB;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACpE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACxE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,uEAAuE;KACjF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;gDACiB;AA2BnB;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACnD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IACvE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,sEAAsE;KAChF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;+CACgB;AAsBlB;IATC,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAChD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;4CACa;AAgCf;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC/C,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACjE,IAAA,yBAAO,EAAC,mBAAmB,EAAE;QAC5B,OAAO,EAAE,kEAAkE;KAC5E,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,mDAAmD;YACnD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;4CACa;AAWf;IADC,IAAA,4BAAU,GAAE;;+CACsB;AAwBnC;IALC,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,CAAC,2BAAS,CAAC,IAAI,EAAE,2BAAS,CAAC,GAAG,EAAE,2BAAS,CAAC,KAAK,EAAE,2BAAS,CAAC,OAAO,CAAC,EAAE;QAC3E,OAAO,EAAE,gEAAgE;KAC1E,CAAC;IACD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;;yDAC5C;AA0BrC;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;;yDAClC"}

package/dist/dto/verify-email.dto.d.ts

@@ -1,29 +1,200 @@
+/**
+ * DTO for verifying email with code (6-digit OTP)
+ *
+ * Security:
+ * - Email must be valid format and match DB limits
+ * - Code must be exactly 6 digits (no more, no less)
+ * - All fields are required (no optional fields to prevent attacks)
+ * - Input sanitization applied automatically
+ */
 export declare class VerifyEmailWithCodeDTO {
+    /**
+     * User's email address
+     * Must match the email used during signup
+     *
+     * Validation:
+     * - Valid email format (RFC 5322)
+     * - Max 255 characters (matches DB column limit)
+     * - Automatically trimmed and lowercased
+     *
+     * Sanitization:
+     * - Removes leading/trailing whitespace
+     * - Converts to lowercase for case-insensitive matching
+     */
     email: string;
+    /**
+     * 6-digit verification code from email
+     *
+     * Validation:
+     * - Must be numeric string (digits only)
+     * - Exactly 6 characters long
+     * - Fixed length prevents timing attacks
+     *
+     * Sanitization:
+     * - Removes all whitespace (users might copy "123 456")
+     * - Removes non-digit characters
+     */
     code: string;
+    /**
+     * Challenge session ID (internal use)
+     * Optional - used internally to link verification to specific challenge session.
+     * Provides security by ensuring codes are only valid for the session they were created for.
+     *
+     * Validation:
+     * - Must be a positive integer if provided
+     * - Optional (for backward compatibility and direct verification flows)
+     */
     challengeSessionId?: number;
 }
+/**
+ * DTO for verifying email with URL token
+ *
+ * Security:
+ * - Token must be valid hex format
+ * - Exact length enforced (64 chars = 32 bytes SHA-256 hash)
+ * - No SQL injection or XSS possible
+ * - Input sanitization prevents malformed tokens
+ */
 export declare class VerifyEmailWithTokenDTO {
+    /**
+     * Verification token from email link
+     *
+     * Validation:
+     * - Exactly 64 hexadecimal characters (SHA-256 hash output)
+     * - Only 0-9 and a-f characters allowed
+     * - Case-insensitive
+     *
+     * Sanitization:
+     * - Removes whitespace
+     * - Converts to lowercase for consistent hashing
+     */
     token: string;
 }
+/**
+ * DTO for sending a verification email
+ *
+ * Security:
+ * - User sub validated as UUID v4
+ * - BaseURL validated as max length
+ * - Skip flag is boolean (prevents injection)
+ */
 export declare class SendVerificationEmailDTO {
+    /**
+     * User identifier (UUID v4)
+     *
+     * Validation:
+     * - Must be valid UUID v4 format
+     *
+     * Sanitization:
+     * - Trimmed and lowercased
+     */
     sub: string;
+    /**
+     * Base URL for verification link (optional)
+     *
+     * Validation:
+     * - Must be valid URL format (http:// or https://)
+     * - Max 2048 characters (typical URL length limit)
+     * - Optional field
+     *
+     * Sanitization:
+     * - Trimmed
+     */
     baseUrl?: string;
+    /**
+     * Skip the "already verified" check
+     * Used for MFA contexts where codes are needed even if email is verified
+     *
+     * Validation:
+     * - Must be boolean
+     * - Optional (defaults to false)
+     */
     skipAlreadyVerifiedCheck?: boolean;
+    /**
+     * Challenge session ID to link this verification token to
+     * Optional - for linking verification tokens to specific challenge sessions.
+     * Provides security by preventing old tokens from being used with new sessions.
+     *
+     * Validation:
+     * - Must be a positive integer
+     * - Optional (for backward compatibility and non-challenge flows like password reset)
+     */
     challengeSessionId?: number;
 }
+/**
+ * Response DTO for sendVerificationEmail
+ */
 export declare class SendVerificationEmailResponseDTO {
+    /**
+     * Verification token ID (internal integer)
+     */
     tokenId: number;
 }
+/**
+ * DTO for requesting a verification email resend
+ *
+ * Supports both overload patterns:
+ * 1. Resend by user sub (string)
+ * 2. Resend by email address (object with email property)
+ *
+ * Security:
+ * - Either sub or email must be provided (conditional validation)
+ * - Rate limiting applied in service layer
+ * - Input sanitization prevents abuse
+ */
 export declare class ResendVerificationEmailDTO {
+    /**
+     * User identifier (UUID v4) - optional if email provided
+     *
+     * Validation:
+     * - Must be valid UUID v4 format if provided
+     * - Required if email is not provided
+     *
+     * Sanitization:
+     * - Trimmed and lowercased
+     */
     sub?: string;
+    /**
+     * User's email address - optional if sub provided
+     *
+     * Validation:
+     * - Valid email format if provided
+     * - Max 255 characters (DB limit)
+     * - Required if sub is not provided
+     *
+     * Sanitization:
+     * - Trimmed and lowercased
+     */
     email?: string;
+    /**
+     * Base URL for verification link (optional)
+     *
+     * Validation:
+     * - Must be valid URL format (http:// or https://)
+     * - Max 2048 characters
+     * - Optional field
+     *
+     * Sanitization:
+     * - Trimmed
+     */
     baseUrl?: string;
 }
+/**
+ * Response DTO for resendVerificationEmail
+ */
 export declare class ResendVerificationEmailResponseDTO {
+    /**
+     * Verification token ID (internal integer)
+     */
     tokenId: number;
 }
+/**
+ * Response DTO for verifyEmailWithCode and verifyEmailWithToken
+ */
 export declare class VerifyEmailResponseDTO {
+    /**
+     * Success message
+     */
     message: string;
 }
 //# sourceMappingURL=verify-email.dto.d.ts.map

package/dist/dto/verify-email.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-email.dto.d.ts","sourceRoot":"","sources":["../../src/dto/verify-email.dto.ts"],"names":[],"mappings":"AAyBA,qBAAa,sBAAsB;IAsBjC,KAAK,EAAG,MAAM,CAAC;IAwBf,IAAI,EAAG,MAAM,CAAC;IAcd,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAWD,qBAAa,uBAAuB;IAwBlC,KAAK,EAAG,MAAM,CAAC;CAChB;AAUD,qBAAa,wBAAwB;IAiBnC,GAAG,EAAG,MAAM,CAAC;IAyBb,OAAO,CAAC,EAAE,MAAM,CAAC;IAYjB,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAcnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,qBAAa,gCAAgC;IAI3C,OAAO,EAAG,MAAM,CAAC;CAClB;AAcD,qBAAa,0BAA0B;IAmBrC,GAAG,CAAC,EAAE,MAAM,CAAC;IAsBb,KAAK,CAAC,EAAE,MAAM,CAAC;IAyBf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,qBAAa,kCAAkC;IAI7C,OAAO,EAAG,MAAM,CAAC;CAClB;AAKD,qBAAa,sBAAsB;IAIjC,OAAO,EAAG,MAAM,CAAC;CAClB"}
+{"version":3,"file":"verify-email.dto.d.ts","sourceRoot":"","sources":["../../src/dto/verify-email.dto.ts"],"names":[],"mappings":"AAgBA;;;;;;;;GAQG;AACH,qBAAa,sBAAsB;IACjC;;;;;;;;;;;;OAYG;IASH,KAAK,EAAG,MAAM,CAAC;IAEf;;;;;;;;;;;OAWG;IAWH,IAAI,EAAG,MAAM,CAAC;IAEd;;;;;;;;OAQG;IAIH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,qBAAa,uBAAuB;IAClC;;;;;;;;;;;OAWG;IAYH,KAAK,EAAG,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACnC;;;;;;;;OAQG;IAQH,GAAG,EAAG,MAAM,CAAC;IAEb;;;;;;;;;;OAUG;IAaH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;;;OAOG;IAGH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAEnC;;;;;;;;OAQG;IAIH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,qBAAa,gCAAgC;IAC3C;;OAEG;IACH,OAAO,EAAG,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,0BAA0B;IACrC;;;;;;;;;OASG;IASH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;OAUG;IAUH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;;;;OAUG;IAaH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,qBAAa,kCAAkC;IAC7C;;OAEG;IACH,OAAO,EAAG,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,qBAAa,sBAAsB;IACjC;;OAEG;IACH,OAAO,EAAG,MAAM,CAAC;CAClB"}