@nauth-toolkit/core 0.1.13 → 0.1.17

package/dist/services/password.service.js

@@ -38,18 +38,63 @@ const argon2 = __importStar(require("argon2"));
 const common_passwords_1 = require("../utils/common-passwords");
 const nauth_exception_1 = require("../exceptions/nauth.exception");
 const error_codes_enum_1 = require("../enums/error-codes.enum");
+/**
+ * Default password hashing configuration
+ * Based on OWASP recommendations for 2025
+ */
 const DEFAULT_ARGON2_CONFIG = {
-    type: argon2.argon2id,
-    memoryCost: 65536,
-    timeCost: 3,
-    parallelism: 2,
-    hashLength: 32,
+    type: argon2.argon2id, // Hybrid mode (best security)
+    memoryCost: 65536, // 64 MB memory usage
+    timeCost: 3, // 3 iterations
+    parallelism: 2, // 2 parallel threads
+    hashLength: 32, // 256-bit hash output
 };
+/**
+ * Password Service
+ *
+ * Handles all password-related operations including:
+ * - Hashing passwords with Argon2id
+ * - Verifying passwords against hashes
+ * - Validating password policy compliance
+ * - Checking password history to prevent reuse
+ *
+ * Security Features:
+ * - Argon2id hashing (winner of Password Hashing Competition)
+ * - Configurable password policy
+ * - Common password detection (10,000+ passwords loaded from file)
+ * - Password history tracking
+ * - Protection against timing attacks
+ *
+ * SECURITY FIX #8: Now loads 10K+ common passwords from bundled file
+ *
+ * @example
+ * ```typescript
+ * const passwordService = new PasswordService(config);
+ *
+ * // Hash a password
+ * const hash = await passwordService.hashPassword('SecurePass123!');
+ *
+ * // Verify a password
+ * const isValid = await passwordService.verifyPassword('SecurePass123!', hash);
+ *
+ * // Validate password policy
+ * const validation = await passwordService.validatePassword('weak');
+ * if (!validation.valid) {
+ *   logger.error('Password validation failed', { errors: validation.errors });
+ * }
+ * ```
+ */
 class PasswordService {
+    /** Password policy configuration */
     config;
+    /** Common passwords Set (10K+ passwords loaded at startup) */
     commonPasswords;
     constructor(passwordConfig) {
+        // ============================================================================
+        // MEDIUM SECURITY FIX #8: Load Comprehensive Password List (10K+ passwords)
+        // ============================================================================
         this.commonPasswords = (0, common_passwords_1.loadCommonPasswords)();
+        // Merge provided config with sensible defaults
         this.config = {
             minLength: passwordConfig?.minLength ?? 8,
             maxLength: passwordConfig?.maxLength ?? 128,
@@ -57,20 +102,39 @@ class PasswordService {
             requireLowercase: passwordConfig?.requireLowercase ?? true,
             requireNumbers: passwordConfig?.requireNumbers ?? true,
             requireSpecialChars: passwordConfig?.requireSpecialChars ?? true,
-            specialChars: passwordConfig?.specialChars ?? '!@#$%^&*()_+=[{}|;:,.<>?-]',
+            specialChars: passwordConfig?.specialChars ?? '!@#$%^&*()_+=[{}|;:,.<>?-]', // Move - to end to avoid range interpretation
             preventCommon: passwordConfig?.preventCommon ?? true,
             preventUserInfo: passwordConfig?.preventUserInfo ?? true,
             historyCount: passwordConfig?.historyCount ?? 5,
-            expiryDays: passwordConfig?.expiryDays ?? 0,
+            expiryDays: passwordConfig?.expiryDays ?? 0, // 0 = disabled
             passwordReset: {
                 codeLength: passwordConfig?.passwordReset?.codeLength ?? 6,
-                expiresIn: passwordConfig?.passwordReset?.expiresIn ?? 900,
+                expiresIn: passwordConfig?.passwordReset?.expiresIn ?? 900, // 15 minutes
                 rateLimitMax: passwordConfig?.passwordReset?.rateLimitMax ?? 3,
-                rateLimitWindow: passwordConfig?.passwordReset?.rateLimitWindow ?? 3600,
+                rateLimitWindow: passwordConfig?.passwordReset?.rateLimitWindow ?? 3600, // 1 hour
                 maxAttempts: passwordConfig?.passwordReset?.maxAttempts ?? 3,
             },
         };
     }
+    // ============================================================================
+    // Password Hashing
+    // ============================================================================
+    /**
+     * Hash a password using Argon2id algorithm
+     *
+     * Argon2id is the recommended password hashing algorithm as of 2025.
+     * It combines Argon2i (resistant to side-channel attacks) and Argon2d
+     * (resistant to GPU cracking attacks).
+     *
+     * @param password - Plain text password to hash
+     * @returns Hashed password string (includes salt and algorithm parameters)
+     *
+     * @example
+     * ```typescript
+     * const hash = await passwordService.hashPassword('MySecurePassword123!');
+     * // Returns: $argon2id$v=19$m=65536,t=3,p=4$...
+     * ```
+     */
     async hashPassword(password) {
         try {
             return await argon2.hash(password, DEFAULT_ARGON2_CONFIG);
@@ -80,22 +144,73 @@ class PasswordService {
             throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, `Failed to hash password: ${errorMessage}`);
         }
     }
+    /**
+     * Verify a password against its hash
+     *
+     * This method is resistant to timing attacks by using constant-time
+     * comparison internally via Argon2's verify function.
+     *
+     * @param password - Plain text password to verify
+     * @param hash - Hashed password to compare against
+     * @returns True if password matches hash, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const isValid = await passwordService.verifyPassword(
+     *   'MyPassword123!',
+     *   '$argon2id$v=19$m=65536,t=3,p=4$...'
+     * );
+     * ```
+     */
     async verifyPassword(password, hash) {
         try {
             return await argon2.verify(hash, password);
         }
         catch {
+            // If verification fails due to invalid hash format, return false
+            // rather than throwing (could be malformed data)
             return false;
         }
     }
+    // ============================================================================
+    // Password Validation
+    // ============================================================================
+    /**
+     * Validate a password against configured policy rules
+     *
+     * Checks multiple security criteria:
+     * - Length requirements (min/max)
+     * - Character complexity (uppercase, lowercase, numbers, special chars)
+     * - Common password detection
+     * - User information leakage (username/email in password)
+     *
+     * @param password - Password to validate
+     * @param userInfo - Optional user information to check against (email, username)
+     * @returns Validation result with any errors
+     *
+     * @example
+     * ```typescript
+     * const result = await passwordService.validatePassword('weak', {
+     *   email: 'user@example.com',
+     *   username: 'john'
+     * });
+     *
+     * if (!result.valid) {
+     *   logger.error('Password validation failed', { errors: result.errors });
+     *   // ['Password must be at least 8 characters', ...]
+     * }
+     * ```
+     */
     async validatePassword(password, userInfo) {
         const errors = [];
+        // Check length requirements
         if (password.length < this.config.minLength) {
             errors.push(`Password must be at least ${this.config.minLength} characters long`);
         }
         if (password.length > this.config.maxLength) {
             errors.push(`Password must not exceed ${this.config.maxLength} characters`);
         }
+        // Check character complexity requirements
         if (this.config.requireUppercase && !/[A-Z]/.test(password)) {
             errors.push('Password must contain at least one uppercase letter');
         }
@@ -106,16 +221,20 @@ class PasswordService {
             errors.push('Password must contain at least one number');
         }
         if (this.config.requireSpecialChars) {
+            // Use a more robust approach to check for special characters
             const hasSpecialChar = this.config.specialChars.split('').some((char) => password.includes(char));
             if (!hasSpecialChar) {
                 errors.push(`Password must contain at least one special character ${this.config.specialChars}`);
             }
         }
+        // Check against common passwords (10K+ passwords loaded from file)
+        // TODO: this is not truly functional, need to work on it later
         if (this.config.preventCommon) {
             if (this.commonPasswords.has(password.toLowerCase())) {
                 errors.push('Password is too common and easy to guess');
             }
         }
+        // Check for user information in password
         if (this.config.preventUserInfo && userInfo) {
             const passwordLower = password.toLowerCase();
             if (userInfo.email) {
@@ -136,7 +255,30 @@ class PasswordService {
             errors,
         };
     }
+    /**
+     * Check if a password has been used before (password history check)
+     *
+     * Prevents users from reusing recent passwords, which is a security
+     * best practice to limit the impact of compromised passwords.
+     *
+     * @param password - Plain text password to check
+     * @param passwordHistory - Array of previous password hashes
+     * @returns True if password was used before, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const isReused = await passwordService.isPasswordInHistory(
+     *   'NewPassword123!',
+     *   user.passwordHistory // Last 5 passwords
+     * );
+     *
+     * if (isReused) {
+     *   throw new Error('Cannot reuse recent passwords');
+     * }
+     * ```
+     */
     async isPasswordInHistory(password, passwordHistory) {
+        // Check if password matches any of the historical passwords
         for (const oldHash of passwordHistory) {
             const matches = await this.verifyPassword(password, oldHash);
             if (matches) {
@@ -145,8 +287,24 @@ class PasswordService {
         }
         return false;
     }
+    /**
+     * Add a password hash to history, maintaining the configured limit
+     *
+     * @param currentHistory - Current password history array
+     * @param newHash - New password hash to add
+     * @returns Updated history array with new hash
+     *
+     * @example
+     * ```typescript
+     * user.passwordHistory = passwordService.addToHistory(
+     *   user.passwordHistory,
+     *   newPasswordHash
+     * );
+     * ```
+     */
     addToHistory(currentHistory, newHash) {
         const history = [...currentHistory, newHash];
+        // Keep only the most recent N passwords (configured limit)
         if (history.length > this.config.historyCount) {
             return history.slice(-this.config.historyCount);
         }

package/dist/services/password.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.service.js","sourceRoot":"","sources":["../../src/services/password.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAEjC,gEAAgE;AAChE,mEAA+D;AAC/D,gEAA0D;AAiB1D,MAAM,qBAAqB,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC,QAAQ;IACrB,UAAU,EAAE,KAAK;IACjB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;IACd,UAAU,EAAE,EAAE;CACN,CAAC;AAqCX,MAAa,eAAe;IAET,MAAM,CAA2B;IAGjC,eAAe,CAAc;IAE9C,YAAY,cAA+B;QAIzC,IAAI,CAAC,eAAe,GAAG,IAAA,sCAAmB,GAAE,CAAC;QAG7C,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,cAAc,EAAE,SAAS,IAAI,CAAC;YACzC,SAAS,EAAE,cAAc,EAAE,SAAS,IAAI,GAAG;YAC3C,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,IAAI;YAC1D,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,IAAI;YAC1D,cAAc,EAAE,cAAc,EAAE,cAAc,IAAI,IAAI;YACtD,mBAAmB,EAAE,cAAc,EAAE,mBAAmB,IAAI,IAAI;YAChE,YAAY,EAAE,cAAc,EAAE,YAAY,IAAI,4BAA4B;YAC1E,aAAa,EAAE,cAAc,EAAE,aAAa,IAAI,IAAI;YACpD,eAAe,EAAE,cAAc,EAAE,eAAe,IAAI,IAAI;YACxD,YAAY,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC;YAC/C,UAAU,EAAE,cAAc,EAAE,UAAU,IAAI,CAAC;YAC3C,aAAa,EAAE;gBACb,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC;gBAC1D,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,IAAI,GAAG;gBAC1D,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;gBAC9D,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,IAAI,IAAI;gBACvE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,IAAI,CAAC;aAC7D;SACF,CAAC;IACJ,CAAC;IAsBD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,cAAc,EAAE,4BAA4B,YAAY,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAoBD,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YAGP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAgCD,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,QAAgD;QAEhD,MAAM,MAAM,GAAa,EAAE,CAAC;QAG5B,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,CAAC,SAAS,kBAAkB,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC9E,CAAC;QAGD,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAEpC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wDAAwD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAID,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAGD,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,QAAQ,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YAE7C,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjE,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACtD,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;SACP,CAAC;IACJ,CAAC;IAwBD,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAyB;QAEnE,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAiBD,YAAY,CAAC,cAAwB,EAAE,OAAe;QACpD,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,EAAE,OAAO,CAAC,CAAC;QAG7C,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA3PD,0CA2PC"}
+{"version":3,"file":"password.service.js","sourceRoot":"","sources":["../../src/services/password.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAEjC,gEAAgE;AAChE,mEAA+D;AAC/D,gEAA0D;AAa1D;;;GAGG;AACH,MAAM,qBAAqB,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,8BAA8B;IACrD,UAAU,EAAE,KAAK,EAAE,qBAAqB;IACxC,QAAQ,EAAE,CAAC,EAAE,eAAe;IAC5B,WAAW,EAAE,CAAC,EAAE,qBAAqB;IACrC,UAAU,EAAE,EAAE,EAAE,sBAAsB;CAC9B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAa,eAAe;IAC1B,oCAAoC;IACnB,MAAM,CAA2B;IAElD,8DAA8D;IAC7C,eAAe,CAAc;IAE9C,YAAY,cAA+B;QACzC,+EAA+E;QAC/E,4EAA4E;QAC5E,+EAA+E;QAC/E,IAAI,CAAC,eAAe,GAAG,IAAA,sCAAmB,GAAE,CAAC;QAE7C,+CAA+C;QAC/C,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,cAAc,EAAE,SAAS,IAAI,CAAC;YACzC,SAAS,EAAE,cAAc,EAAE,SAAS,IAAI,GAAG;YAC3C,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,IAAI;YAC1D,gBAAgB,EAAE,cAAc,EAAE,gBAAgB,IAAI,IAAI;YAC1D,cAAc,EAAE,cAAc,EAAE,cAAc,IAAI,IAAI;YACtD,mBAAmB,EAAE,cAAc,EAAE,mBAAmB,IAAI,IAAI;YAChE,YAAY,EAAE,cAAc,EAAE,YAAY,IAAI,4BAA4B,EAAE,8CAA8C;YAC1H,aAAa,EAAE,cAAc,EAAE,aAAa,IAAI,IAAI;YACpD,eAAe,EAAE,cAAc,EAAE,eAAe,IAAI,IAAI;YACxD,YAAY,EAAE,cAAc,EAAE,YAAY,IAAI,CAAC;YAC/C,UAAU,EAAE,cAAc,EAAE,UAAU,IAAI,CAAC,EAAE,eAAe;YAC5D,aAAa,EAAE;gBACb,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC;gBAC1D,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,IAAI,GAAG,EAAE,aAAa;gBACzE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;gBAC9D,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,IAAI,IAAI,EAAE,SAAS;gBAClF,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,IAAI,CAAC;aAC7D;SACF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,mBAAmB;IACnB,+EAA+E;IAE/E;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC9E,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,cAAc,EAAE,4BAA4B,YAAY,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,IAAY;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,iDAAiD;YACjD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,sBAAsB;IACtB,+EAA+E;IAE/E;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,KAAK,CAAC,gBAAgB,CACpB,QAAgB,EAChB,QAAgD;QAEhD,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,4BAA4B;QAC5B,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,6BAA6B,IAAI,CAAC,MAAM,CAAC,SAAS,kBAAkB,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,SAAS,aAAa,CAAC,CAAC;QAC9E,CAAC;QAED,0CAA0C;QAC1C,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACpC,6DAA6D;YAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wDAAwD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,QAAQ,EAAE,CAAC;YAC5C,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YAE7C,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjE,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACtD,IAAI,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAyB;QACnE,4DAA4D;QAC5D,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,cAAwB,EAAE,OAAe;QACpD,MAAM,OAAO,GAAG,CAAC,GAAG,cAAc,EAAE,OAAO,CAAC,CAAC;QAE7C,2DAA2D;QAC3D,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA3PD,0CA2PC"}

package/dist/services/phone-verification.service.d.ts

@@ -8,6 +8,27 @@ import { InternalAuthAuditService as AuthAuditService } from './auth-audit.servi
 import { NAuthLogger } from '../utils/nauth-logger';
 import { SendVerificationSMSDTO, SendVerificationSMSResponseDTO, VerifyPhoneWithCodeDTO, VerifyPhoneResponseDTO, ResendVerificationSMSDTO, ResendVerificationSMSResponseDTO } from '../dto/verify-phone.dto';
 import { VerifyPhoneWithCodeBySubDTO } from '../dto/verify-phone-by-sub.dto';
+/**
+ * Phone Verification Service (Core)
+ *
+ * Database-agnostic phone verification workflow with provider-driven SMS delivery.
+ *
+ * WHY: Keeps core business logic independent of database and SMS vendors. Databases are
+ * injected via repository tokens and SMS via an `SMSProvider` adapter so consumers
+ * can plug in Postgres, MySQL, or any SMS provider without code changes.
+ *
+ * @example
+ * ```typescript
+ * // Send OTP
+ * const tokenId = await phoneVerificationService.sendVerificationSMS('user-sub');
+ *
+ * // Verify by sub
+ * await phoneVerificationService.verifyPhoneWithCodeBySub('user-sub', '123456');
+ *
+ * // Resend
+ * await phoneVerificationService.resendVerificationSMS('user-sub');
+ * ```
+ */
 export declare class PhoneVerificationService {
     private readonly verificationTokenRepo;
     private readonly userRepo;
@@ -18,15 +39,69 @@ export declare class PhoneVerificationService {
     private readonly logger;
     private readonly auditService?;
     constructor(verificationTokenRepo: Repository<BaseVerificationToken>, userRepo: Repository<BaseUser>, smsProvider: SMSProvider, storageAdapter: StorageAdapter, config: NAuthConfig, clientInfoService: ClientInfoService, logger: NAuthLogger, auditService?: AuthAuditService | undefined);
+    /**
+     * Send verification SMS to user identified by `sub`.
+     * Applies rate limits and resend delay, stores hashed token + OTP, and sends via SMS provider.
+     *
+     * @param dto - Request DTO containing sub and skipAlreadyVerifiedCheck
+     * @returns Response DTO with verification token ID
+     * @throws {NAuthException} RATE_LIMIT_SMS | NOT_FOUND | PHONE_REQUIRED | ALREADY_VERIFIED | RATE_LIMIT_RESEND
+     */
     sendVerificationSMS(dto: SendVerificationSMSDTO): Promise<SendVerificationSMSResponseDTO>;
+    /**
+     * Verify phone by phone number and code.
+     * Handles duplicate phone numbers by selecting the token whose user matches the phone provided.
+     *
+     * @param dto - Request DTO containing phone and code
+     * @returns Response DTO with success message
+     * @throws {NAuthException} VERIFICATION_CODE_INVALID | VERIFICATION_CODE_EXPIRED | VERIFICATION_TOO_MANY_ATTEMPTS
+     */
     verifyPhoneWithCode(dto: VerifyPhoneWithCodeDTO): Promise<VerifyPhoneResponseDTO>;
+    /**
+     * Verify phone by user sub and code.
+     *
+     * @param dto - Request DTO containing sub and code
+     * @returns Response DTO with success message
+     */
     verifyPhoneWithCodeBySub(dto: VerifyPhoneWithCodeBySubDTO): Promise<VerifyPhoneResponseDTO>;
+    /**
+     * Resend verification SMS
+     * Supports both sub and phone-based resend
+     *
+     * @param dto - Request DTO containing sub or phone
+     * @returns Response DTO with verification token ID
+     */
     resendVerificationSMS(dto: ResendVerificationSMSDTO): Promise<ResendVerificationSMSResponseDTO>;
+    /**
+     * Resend verification SMS by user sub (private helper)
+     *
+     * @param sub - External user identifier
+     * @returns New verification token id
+     */
     private resendVerificationSMSBySub;
+    /**
+     * Resend verification SMS by phone number (private helper)
+     *
+     * @param phone - Phone number
+     * @returns New verification token id
+     */
     private resendVerificationSMSForPhone;
+    /**
+     * Generate N-digit OTP code (default 6)
+     */
     private generateCode;
+    /**
+     * Generate secure random token
+     */
     private generateToken;
+    /**
+     * Hash token with SHA-256
+     */
     private hashToken;
+    /**
+     * Mask phone number for logging (preserves last 4 digits)
+     * @private
+     */
     private maskPhone;
 }
 //# sourceMappingURL=phone-verification.service.d.ts.map

package/dist/services/phone-verification.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"phone-verification.service.d.ts","sourceRoot":"","sources":["../../src/services/phone-verification.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAU,MAAM,SAAS,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAIpF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,gCAAgC,EACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAwB7E,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAPb,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,CAAC,EACxD,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,WAAW,EACnB,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,WAAW,EACnB,YAAY,CAAC,EAAE,gBAAgB,YAAA;IAW5C,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC;IAsLzF,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAoLjF,wBAAwB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA+O3F,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,gCAAgC,CAAC;YAmBvF,0BAA0B;YA2C1B,6BAA6B;IAkB3C,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,SAAS;CAIlB"}
+{"version":3,"file":"phone-verification.service.d.ts","sourceRoot":"","sources":["../../src/services/phone-verification.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAU,MAAM,SAAS,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,IAAI,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAIpF,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,gCAAgC,EACjC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAG7E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAPb,qBAAqB,EAAE,UAAU,CAAC,qBAAqB,CAAC,EACxD,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,EAC9B,WAAW,EAAE,WAAW,EACxB,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,WAAW,EACnB,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,WAAW,EACnB,YAAY,CAAC,EAAE,gBAAgB,YAAA;IAGlD;;;;;;;OAOG;IACG,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA8K/F;;;;;;;OAOG;IACG,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA8KvF;;;;;OAKG;IACG,wBAAwB,CAAC,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAwOjG;;;;;;OAMG;IACG,qBAAqB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,gCAAgC,CAAC;IAarG;;;;;OAKG;YACW,0BAA0B;IAqCxC;;;;;OAKG;YACW,6BAA6B;IAe3C;;OAEG;IACH,OAAO,CAAC,YAAY;IAOpB;;OAEG;IACH,OAAO,CAAC,aAAa;IAIrB;;OAEG;IACH,OAAO,CAAC,SAAS;IAIjB;;;OAGG;IACH,OAAO,CAAC,SAAS;CAIlB"}