@nauth-toolkit/core 0.1.14 → 0.1.17

package/dist/dto/auth-response.dto.js

@@ -1,17 +1,166 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthResponseDTO = void 0;
+/**
+ * Unified Authentication Response DTO
+ *
+ * Used for ALL authentication operations:
+ * - Email/password login
+ * - User signup
+ * - Social authentication (Google, Apple, Facebook)
+ * - Token refresh
+ * - Challenge completions
+ *
+ * This provides a consistent interface regardless of authentication method,
+ * improving developer experience and code maintainability.
+ *
+ * When challenges are present, tokens will not be issued until all challenges
+ * are completed. This ensures proper verification and security enforcement.
+ *
+ * No validators needed - this is generated internally by the library.
+ *
+ * @example
+ * ```typescript
+ * // Successful auth with no challenges
+ * const loginResult = await authService.login(dto);
+ * // { accessToken: '...', refreshToken: '...', user: {...} }
+ *
+ * // Auth with pending challenge
+ * const signupResult = await authService.signup(dto);
+ * // { challengeName: 'VERIFY_EMAIL', session: '...', challengeParameters: {...} }
+ * ```
+ */
 class AuthResponseDTO {
+    /**
+     * JWT access token for API authentication
+     * Short-lived (typically 15 minutes)
+     *
+     * NOTE: Only present when authentication is complete (no pending challenges)
+     */
     accessToken;
+    /**
+     * JWT refresh token for obtaining new access tokens
+     * Long-lived (typically 30 days)
+     *
+     * NOTE: Only present when authentication is complete (no pending challenges)
+     */
     refreshToken;
+    /**
+     * Access token expiration timestamp
+     * Unix timestamp in seconds
+     *
+     * @example 1730000000 (represents a specific date/time)
+     *
+     * NOTE: Only present when authentication is complete (no pending challenges)
+     */
     accessTokenExpiresAt;
+    /**
+     * Refresh token expiration timestamp
+     * Unix timestamp in seconds
+     *
+     * @example 1732592000 (30 days after access token)
+     *
+     * NOTE: Only present when authentication is complete (no pending challenges)
+     */
     refreshTokenExpiresAt;
+    /**
+     * Whether the current device is already trusted
+     *
+     * When true, the device has a valid trusted device token and UI should NOT show
+     * "trust device" popup.
+     *
+     * When false and rememberDevices === 'user_opt_in', UI can show popup after login
+     * to allow user to opt-in for device trust.
+     *
+     * When rememberDevices === 'always', this will always be true after successful login.
+     *
+     * NOTE: Only present when authentication is complete (no pending challenges)
+     */
     trusted;
+    /**
+     * Device token for trusted device feature (UUID v4)
+     *
+     * Server-generated UUID token for identifying trusted devices.
+     * Only returned when rememberDevices is not 'never' and device is trusted.
+     *
+     * Delivery by mode:
+     * - **cookies mode**: Token set as `nauth_device_token` httpOnly cookie (not in response body)
+     * - **json/hybrid mode**: Token returned in response body for mobile apps
+     *
+     * Mobile apps should:
+     * - Store token in secure storage (iOS Keychain / Android EncryptedSharedPreferences)
+     * - Send token in `X-Device-Token` header on subsequent logins
+     * - Token persists across app restarts and survives logout
+     *
+     * Web apps:
+     * - Token automatically handled via httpOnly cookie (cookies mode)
+     * - No manual handling required
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     *
+     * NOTE: Only present when authentication is complete (no pending challenges)
+     * WARNING: For JSON mode, ensure secure storage - token in response body can be intercepted
+     */
     deviceToken;
+    /**
+     * User information
+     * Standardized across all authentication methods
+     *
+     * NOTE: Only present when authentication is complete (no pending challenges)
+     */
     user;
+    // ============================================================================
+    // Challenge System (Similar to AWS Cognito)
+    // ============================================================================
+    /**
+     * Challenge that must be completed before authentication is granted
+     *
+     * When present, the user must complete this challenge using the
+     * challenge completion endpoint before they can access the system.
+     *
+     * Tokens (accessToken, refreshToken) will NOT be present when a challenge exists.
+     *
+     * @example 'VERIFY_EMAIL' | 'VERIFY_PHONE' | 'MFA_REQUIRED'
+     */
     challengeName;
+    /**
+     * Temporary session identifier for challenge completion (UUID v4)
+     *
+     * This is NOT a JWT token - it's a temporary identifier that must be
+     * submitted when completing the challenge. It expires after a short time
+     * (typically 15 minutes) or after successful challenge completion.
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     *
+     * NOTE: Only present when challengeName is set
+     */
     session;
+    /**
+     * Challenge-specific parameters
+     *
+     * Contains information needed to complete the challenge, such as:
+     * - Masked email/phone for delivery confirmation
+     * - Challenge type details
+     * - Instructions for the user
+     *
+     * NOTE: Only present when challengeName is set
+     *
+     * @example
+     * ```typescript
+     * {
+     *   email: 'user@example.com',
+     *   codeDeliveryDestination: 'u***@example.com'
+     * }
+     * ```
+     */
     challengeParameters;
+    /**
+     * User's unique identifier (UUID v4)
+     * Present in both successful auth and challenge responses
+     * Helps the client track which user is authenticating
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     userSub;
 }
 exports.AuthResponseDTO = AuthResponseDTO;

package/dist/dto/auth-response.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-response.dto.js","sourceRoot":"","sources":["../../src/dto/auth-response.dto.ts"],"names":[],"mappings":";;;AA+BA,MAAa,eAAe;IAO1B,WAAW,CAAU;IAQrB,YAAY,CAAU;IAUtB,oBAAoB,CAAU;IAU9B,qBAAqB,CAAU;IAe/B,OAAO,CAAW;IA0BlB,WAAW,CAAU;IAQrB,IAAI,CAkDF;IAgBF,aAAa,CAAiB;IAa9B,OAAO,CAAU;IAoBjB,mBAAmB,CAA2B;IAS9C,OAAO,CAAU;CAClB;AAjMD,0CAiMC"}
+{"version":3,"file":"auth-response.dto.js","sourceRoot":"","sources":["../../src/dto/auth-response.dto.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAa,eAAe;IAC1B;;;;;OAKG;IACH,WAAW,CAAU;IAErB;;;;;OAKG;IACH,YAAY,CAAU;IAEtB;;;;;;;OAOG;IACH,oBAAoB,CAAU;IAE9B;;;;;;;OAOG;IACH,qBAAqB,CAAU;IAE/B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAW;IAElB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,WAAW,CAAU;IAErB;;;;;OAKG;IACH,IAAI,CAkDF;IAEF,+EAA+E;IAC/E,4CAA4C;IAC5C,+EAA+E;IAE/E;;;;;;;;;OASG;IACH,aAAa,CAAiB;IAE9B;;;;;;;;;;OAUG;IACH,OAAO,CAAU;IAEjB;;;;;;;;;;;;;;;;;OAiBG;IACH,mBAAmB,CAA2B;IAE9C;;;;;;OAMG;IACH,OAAO,CAAU;CAClB;AAjMD,0CAiMC"}

package/dist/dto/challenge-response.dto.d.ts

@@ -1,36 +1,191 @@
+/**
+ * Challenge Response DTOs for Unified Challenge System
+ *
+ * Discriminated union types for responding to authentication challenges.
+ * Each challenge type has specific required parameters.
+ *
+ * @module ChallengeResponseDTO
+ */
+/**
+ * Base interface for all challenge responses
+ */
 export interface BaseChallengeResponse {
+    /** Challenge session token */
     session: string;
 }
+/**
+ * Response for email verification challenge
+ *
+ * @example
+ * ```typescript
+ * const response: VerifyEmailResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'VERIFY_EMAIL',
+ *   code: '123456'
+ * };
+ * ```
+ */
 export interface VerifyEmailResponse extends BaseChallengeResponse {
     type: 'VERIFY_EMAIL';
+    /** 6-digit verification code sent to email */
     code: string;
 }
+/**
+ * Response for collecting phone number (first step)
+ *
+ * @example
+ * ```typescript
+ * const response: CollectPhoneResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'VERIFY_PHONE',
+ *   phone: '+1234567890'
+ * };
+ * ```
+ */
 export interface CollectPhoneResponse extends BaseChallengeResponse {
     type: 'VERIFY_PHONE';
+    /** Phone number in E.164 format */
     phone: string;
 }
+/**
+ * Response for verifying phone with code (second step)
+ *
+ * @example
+ * ```typescript
+ * const response: VerifyPhoneResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'VERIFY_PHONE',
+ *   code: '123456'
+ * };
+ * ```
+ */
 export interface VerifyPhoneResponse extends BaseChallengeResponse {
     type: 'VERIFY_PHONE';
+    /** 6-digit verification code sent to phone */
     code: string;
 }
+/**
+ * Response for MFA verification with code (SMS/TOTP/Backup)
+ *
+ * @example
+ * ```typescript
+ * const response: VerifyMFACodeResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'MFA_REQUIRED',
+ *   method: 'totp',
+ *   code: '123456'
+ * };
+ * ```
+ */
 export interface VerifyMFACodeResponse extends BaseChallengeResponse {
     type: 'MFA_REQUIRED';
+    /** MFA method being used */
     method: 'sms' | 'totp' | 'backup';
+    /** Verification code */
     code: string;
 }
+/**
+ * Response for MFA verification with passkey
+ *
+ * @example
+ * ```typescript
+ * const response: VerifyMFAPasskeyResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'MFA_REQUIRED',
+ *   method: 'passkey',
+ *   credential: { id: '...', rawId: '...', response: {...} }
+ * };
+ * ```
+ */
 export interface VerifyMFAPasskeyResponse extends BaseChallengeResponse {
     type: 'MFA_REQUIRED';
+    /** Passkey method */
     method: 'passkey';
+    /** WebAuthn credential from navigator.credentials.get() */
     credential: Record<string, unknown>;
 }
+/**
+ * Response for forced password change challenge
+ *
+ * @example
+ * ```typescript
+ * const response: ForceChangePasswordResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'FORCE_CHANGE_PASSWORD',
+ *   newPassword: 'NewSecurePassword123!'
+ * };
+ * ```
+ */
 export interface ForceChangePasswordResponse extends BaseChallengeResponse {
     type: 'FORCE_CHANGE_PASSWORD';
+    /** New password meeting security requirements */
     newPassword: string;
 }
+/**
+ * Response for MFA setup during challenge
+ *
+ * @example
+ * ```typescript
+ * // SMS setup
+ * const smsResponse: MFASetupResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'MFA_SETUP_REQUIRED',
+ *   method: 'sms',
+ *   setupData: { phone: '+1234567890', code: '123456' }
+ * };
+ *
+ * // TOTP setup
+ * const totpResponse: MFASetupResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'MFA_SETUP_REQUIRED',
+ *   method: 'totp',
+ *   setupData: { code: '123456' }
+ * };
+ *
+ * // Passkey setup
+ * const passkeyResponse: MFASetupResponse = {
+ *   session: 'challenge-session-token',
+ *   type: 'MFA_SETUP_REQUIRED',
+ *   method: 'passkey',
+ *   setupData: { credential: {...} }
+ * };
+ * ```
+ */
 export interface MFASetupResponse extends BaseChallengeResponse {
     type: 'MFA_SETUP_REQUIRED';
+    /** MFA method being set up */
     method: 'sms' | 'email' | 'totp' | 'passkey';
+    /**
+     * Method-specific setup data
+     * - SMS: { phone: string, code: string }
+     * - TOTP: { code: string }
+     * - Passkey: { credential: Record<string, unknown> }
+     */
     setupData: Record<string, unknown>;
 }
+/**
+ * Discriminated union of all challenge response types
+ *
+ * Use this type for the unified respondToChallenge() API.
+ * TypeScript will narrow the type based on the 'type' discriminator.
+ *
+ * @example
+ * ```typescript
+ * async function handleChallenge(response: ChallengeResponseData) {
+ *   switch (response.type) {
+ *     case 'VERIFY_EMAIL':
+ *       // TypeScript knows response.code is available
+ *       break;
+ *     case 'MFA_REQUIRED':
+ *       if (response.method === 'passkey') {
+ *         // TypeScript knows response.credential is available
+ *       } else {
+ *         // TypeScript knows response.code is available
+ *       }
+ *       break;
+ *   }
+ * }
+ * ```
+ */
 export type ChallengeResponseData = VerifyEmailResponse | CollectPhoneResponse | VerifyPhoneResponse | VerifyMFACodeResponse | VerifyMFAPasskeyResponse | ForceChangePasswordResponse | MFASetupResponse;
 //# sourceMappingURL=challenge-response.dto.d.ts.map

package/dist/dto/challenge-response.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"challenge-response.dto.d.ts","sourceRoot":"","sources":["../../src/dto/challenge-response.dto.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,qBAAqB;IAEpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAkBD,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,IAAI,EAAE,cAAc,CAAC;IAErB,IAAI,EAAE,MAAM,CAAC;CACd;AAkBD,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,IAAI,EAAE,cAAc,CAAC;IAErB,KAAK,EAAE,MAAM,CAAC;CACf;AAcD,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,IAAI,EAAE,cAAc,CAAC;IAErB,IAAI,EAAE,MAAM,CAAC;CACd;AAmBD,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,IAAI,EAAE,cAAc,CAAC;IAErB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAElC,IAAI,EAAE,MAAM,CAAC;CACd;AAeD,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACrE,IAAI,EAAE,cAAc,CAAC;IAErB,MAAM,EAAE,SAAS,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAkBD,MAAM,WAAW,2BAA4B,SAAQ,qBAAqB;IACxE,IAAI,EAAE,uBAAuB,CAAC;IAE9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAoCD,MAAM,WAAW,gBAAiB,SAAQ,qBAAqB;IAC7D,IAAI,EAAE,oBAAoB,CAAC;IAE3B,MAAM,EAAE,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IAO7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AA8BD,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,wBAAwB,GACxB,2BAA2B,GAC3B,gBAAgB,CAAC"}
+{"version":3,"file":"challenge-response.dto.d.ts","sourceRoot":"","sources":["../../src/dto/challenge-response.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,IAAI,EAAE,cAAc,CAAC;IACrB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,IAAI,EAAE,cAAc,CAAC;IACrB,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,IAAI,EAAE,cAAc,CAAC;IACrB,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;CACd;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAsB,SAAQ,qBAAqB;IAClE,IAAI,EAAE,cAAc,CAAC;IACrB,4BAA4B;IAC5B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAClC,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACrE,IAAI,EAAE,cAAc,CAAC;IACrB,qBAAqB;IACrB,MAAM,EAAE,SAAS,CAAC;IAClB,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,2BAA4B,SAAQ,qBAAqB;IACxE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,gBAAiB,SAAQ,qBAAqB;IAC7D,IAAI,EAAE,oBAAoB,CAAC;IAC3B,8BAA8B;IAC9B,MAAM,EAAE,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,oBAAoB,GACpB,mBAAmB,GACnB,qBAAqB,GACrB,wBAAwB,GACxB,2BAA2B,GAC3B,gBAAgB,CAAC"}

package/dist/dto/challenge-response.dto.js

@@ -1,3 +1,11 @@
 "use strict";
+/**
+ * Challenge Response DTOs for Unified Challenge System
+ *
+ * Discriminated union types for responding to authentication challenges.
+ * Each challenge type has specific required parameters.
+ *
+ * @module ChallengeResponseDTO
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=challenge-response.dto.js.map

package/dist/dto/challenge-response.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"challenge-response.dto.js","sourceRoot":"","sources":["../../src/dto/challenge-response.dto.ts"],"names":[],"mappings":""}
+{"version":3,"file":"challenge-response.dto.js","sourceRoot":"","sources":["../../src/dto/challenge-response.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG"}

package/dist/dto/change-password-request.dto.d.ts

@@ -1,5 +1,40 @@
+/**
+ * Change Password Request DTO
+ *
+ * Request DTO for changing a user's password (includes user sub).
+ *
+ * Security:
+ * - User sub validated (UUID)
+ * - Password validation enforced
+ * - Current password required for security
+ *
+ * @example
+ * ```typescript
+ * await authService.changePassword({
+ *   sub: 'user-uuid',
+ *   currentPassword: 'OldPass123!',
+ *   newPassword: 'NewPass456!'
+ * });
+ * ```
+ */
 import { ChangePasswordDTO } from './change-password.dto';
+/**
+ * Request DTO for changing password (includes user sub)
+ */
 export declare class ChangePasswordRequestDTO extends ChangePasswordDTO {
+    /**
+     * User's unique identifier (UUID v4)
+     *
+     * Validation:
+     * - Must be a valid UUID v4 format
+     * - Matches DB constraint: char(36) or uuid
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased for consistency
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     sub: string;
 }
 //# sourceMappingURL=change-password-request.dto.d.ts.map

package/dist/dto/change-password-request.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-password-request.dto.d.ts","sourceRoot":"","sources":["../../src/dto/change-password-request.dto.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK1D,qBAAa,wBAAyB,SAAQ,iBAAiB;IAqB7D,GAAG,EAAG,MAAM,CAAC;CACd"}
+{"version":3,"file":"change-password-request.dto.d.ts","sourceRoot":"","sources":["../../src/dto/change-password-request.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,iBAAiB;IAC7D;;;;;;;;;;;;OAYG;IAQH,GAAG,EAAG,MAAM,CAAC;CACd"}

package/dist/dto/change-password-request.dto.js

@@ -1,4 +1,23 @@
 "use strict";
+/**
+ * Change Password Request DTO
+ *
+ * Request DTO for changing a user's password (includes user sub).
+ *
+ * Security:
+ * - User sub validated (UUID)
+ * - Password validation enforced
+ * - Current password required for security
+ *
+ * @example
+ * ```typescript
+ * await authService.changePassword({
+ *   sub: 'user-uuid',
+ *   currentPassword: 'OldPass123!',
+ *   newPassword: 'NewPass456!'
+ * });
+ * ```
+ */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -13,7 +32,23 @@ exports.ChangePasswordRequestDTO = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const change_password_dto_1 = require("./change-password.dto");
+/**
+ * Request DTO for changing password (includes user sub)
+ */
 class ChangePasswordRequestDTO extends change_password_dto_1.ChangePasswordDTO {
+    /**
+     * User's unique identifier (UUID v4)
+     *
+     * Validation:
+     * - Must be a valid UUID v4 format
+     * - Matches DB constraint: char(36) or uuid
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased for consistency
+     *
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
+     */
     sub;
 }
 exports.ChangePasswordRequestDTO = ChangePasswordRequestDTO;

package/dist/dto/change-password-request.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-password-request.dto.js","sourceRoot":"","sources":["../../src/dto/change-password-request.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAoBA,qDAAyC;AACzC,yDAA8C;AAC9C,+DAA0D;AAK1D,MAAa,wBAAyB,SAAQ,uCAAiB;IAqB7D,GAAG,CAAU;CACd;AAtBD,4DAsBC;AADC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;qDACW"}
+{"version":3,"file":"change-password-request.dto.js","sourceRoot":"","sources":["../../src/dto/change-password-request.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;;;;;AAEH,qDAAyC;AACzC,yDAA8C;AAC9C,+DAA0D;AAE1D;;GAEG;AACH,MAAa,wBAAyB,SAAQ,uCAAiB;IAC7D;;;;;;;;;;;;OAYG;IAQH,GAAG,CAAU;CACd;AAtBD,4DAsBC;AADC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;qDACW"}

package/dist/dto/change-password-response.dto.d.ts

@@ -1,4 +1,29 @@
+/**
+ * Change Password Response DTO
+ *
+ * Response DTO for changing password.
+ * No validators needed - this is generated internally by the library.
+ *
+ * @example
+ * ```typescript
+ * await authService.changePassword({
+ *   sub: 'user-uuid',
+ *   oldPassword: 'OldPass123!',
+ *   newPassword: 'NewPass456!'
+ * });
+ * // Returns: { success: true }
+ * ```
+ */
+/**
+ * Response DTO for change password
+ */
 export declare class ChangePasswordResponseDTO {
+    /**
+     * Success indicator
+     * Always true on successful password change
+     *
+     * @example true
+     */
     success: boolean;
 }
 //# sourceMappingURL=change-password-response.dto.d.ts.map

package/dist/dto/change-password-response.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-password-response.dto.d.ts","sourceRoot":"","sources":["../../src/dto/change-password-response.dto.ts"],"names":[],"mappings":"AAoBA,qBAAa,yBAAyB;IAOpC,OAAO,EAAG,OAAO,CAAC;CACnB"}
+{"version":3,"file":"change-password-response.dto.d.ts","sourceRoot":"","sources":["../../src/dto/change-password-response.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;GAEG;AACH,qBAAa,yBAAyB;IACpC;;;;;OAKG;IACH,OAAO,EAAG,OAAO,CAAC;CACnB"}

package/dist/dto/change-password-response.dto.js

@@ -1,7 +1,32 @@
 "use strict";
+/**
+ * Change Password Response DTO
+ *
+ * Response DTO for changing password.
+ * No validators needed - this is generated internally by the library.
+ *
+ * @example
+ * ```typescript
+ * await authService.changePassword({
+ *   sub: 'user-uuid',
+ *   oldPassword: 'OldPass123!',
+ *   newPassword: 'NewPass456!'
+ * });
+ * // Returns: { success: true }
+ * ```
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ChangePasswordResponseDTO = void 0;
+/**
+ * Response DTO for change password
+ */
 class ChangePasswordResponseDTO {
+    /**
+     * Success indicator
+     * Always true on successful password change
+     *
+     * @example true
+     */
     success;
 }
 exports.ChangePasswordResponseDTO = ChangePasswordResponseDTO;

package/dist/dto/change-password-response.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"change-password-response.dto.js","sourceRoot":"","sources":["../../src/dto/change-password-response.dto.ts"],"names":[],"mappings":";;;AAoBA,MAAa,yBAAyB;IAOpC,OAAO,CAAW;CACnB;AARD,8DAQC"}
+{"version":3,"file":"change-password-response.dto.js","sourceRoot":"","sources":["../../src/dto/change-password-response.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAEH;;GAEG;AACH,MAAa,yBAAyB;IACpC;;;;;OAKG;IACH,OAAO,CAAW;CACnB;AARD,8DAQC"}

package/dist/dto/change-password.dto.d.ts

@@ -1,5 +1,50 @@
+/**
+ * Change Password DTO
+ *
+ * Used for authenticated password changes.
+ * User must provide their current password for security verification.
+ *
+ * Security:
+ * - Old password verified before allowing change
+ * - New password validated for minimum strength
+ * - Password history checked (configurable)
+ * - Max length prevents DoS via bcrypt
+ *
+ * @example
+ * ```typescript
+ * POST /auth/change-password
+ * Authorization: Bearer <access-token>
+ * {
+ *   "oldPassword": "currentPassword123",
+ *   "newPassword": "newSecurePassword456"
+ * }
+ * ```
+ */
 export declare class ChangePasswordDTO {
+    /**
+     * Current password
+     *
+     * Validation:
+     * - Must be a string
+     *
+     * Note: NOT trimmed (passwords can have leading/trailing spaces)
+     */
     oldPassword: string;
+    /**
+     * New password
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 8 characters (security requirement)
+     * - Max 128 characters (prevents DoS via bcrypt)
+     *
+     * Note: NOT trimmed (passwords can have leading/trailing spaces)
+     *
+     * Additional checks in service layer:
+     * - Password history (prevent reuse of recent passwords)
+     * - Password strength (if configured)
+     * - Not same as old password
+     */
     newPassword: string;
 }
 //# sourceMappingURL=change-password.dto.d.ts.map

package/dist/dto/change-password.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-password.dto.d.ts","sourceRoot":"","sources":["../../src/dto/change-password.dto.ts"],"names":[],"mappings":"AAyBA,qBAAa,iBAAiB;IAU5B,WAAW,EAAG,MAAM,CAAC;IAoBrB,WAAW,EAAG,MAAM,CAAC;CACtB"}
+{"version":3,"file":"change-password.dto.d.ts","sourceRoot":"","sources":["../../src/dto/change-password.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,qBAAa,iBAAiB;IAC5B;;;;;;;OAOG;IAEH,WAAW,EAAG,MAAM,CAAC;IAErB;;;;;;;;;;;;;;OAcG;IAIH,WAAW,EAAG,MAAM,CAAC;CACtB"}

package/dist/dto/change-password.dto.js

@@ -1,4 +1,26 @@
 "use strict";
+/**
+ * Change Password DTO
+ *
+ * Used for authenticated password changes.
+ * User must provide their current password for security verification.
+ *
+ * Security:
+ * - Old password verified before allowing change
+ * - New password validated for minimum strength
+ * - Password history checked (configurable)
+ * - Max length prevents DoS via bcrypt
+ *
+ * @example
+ * ```typescript
+ * POST /auth/change-password
+ * Authorization: Bearer <access-token>
+ * {
+ *   "oldPassword": "currentPassword123",
+ *   "newPassword": "newSecurePassword456"
+ * }
+ * ```
+ */
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -12,7 +34,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ChangePasswordDTO = void 0;
 const class_validator_1 = require("class-validator");
 class ChangePasswordDTO {
+    /**
+     * Current password
+     *
+     * Validation:
+     * - Must be a string
+     *
+     * Note: NOT trimmed (passwords can have leading/trailing spaces)
+     */
     oldPassword;
+    /**
+     * New password
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 8 characters (security requirement)
+     * - Max 128 characters (prevents DoS via bcrypt)
+     *
+     * Note: NOT trimmed (passwords can have leading/trailing spaces)
+     *
+     * Additional checks in service layer:
+     * - Password history (prevent reuse of recent passwords)
+     * - Password strength (if configured)
+     * - Not same as old password
+     */
     newPassword;
 }
 exports.ChangePasswordDTO = ChangePasswordDTO;