@nauth-toolkit/core 0.1.31 → 0.1.33

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (69) hide show
  1. package/dist/dto/admin-signup-social.dto.d.ts +257 -0
  2. package/dist/dto/admin-signup-social.dto.d.ts.map +1 -0
  3. package/dist/dto/admin-signup-social.dto.js +389 -0
  4. package/dist/dto/admin-signup-social.dto.js.map +1 -0
  5. package/dist/dto/delete-user.dto.d.ts +71 -0
  6. package/dist/dto/delete-user.dto.d.ts.map +1 -0
  7. package/dist/dto/delete-user.dto.js +82 -0
  8. package/dist/dto/delete-user.dto.js.map +1 -0
  9. package/dist/dto/disable-user.dto.d.ts +61 -0
  10. package/dist/dto/disable-user.dto.d.ts.map +1 -0
  11. package/dist/dto/disable-user.dto.js +86 -0
  12. package/dist/dto/disable-user.dto.js.map +1 -0
  13. package/dist/dto/enable-user.dto.d.ts +44 -0
  14. package/dist/dto/enable-user.dto.d.ts.map +1 -0
  15. package/dist/dto/enable-user.dto.js +63 -0
  16. package/dist/dto/enable-user.dto.js.map +1 -0
  17. package/dist/dto/get-users.dto.d.ts +154 -0
  18. package/dist/dto/get-users.dto.d.ts.map +1 -0
  19. package/dist/dto/get-users.dto.js +250 -0
  20. package/dist/dto/get-users.dto.js.map +1 -0
  21. package/dist/dto/index.d.ts +5 -0
  22. package/dist/dto/index.d.ts.map +1 -1
  23. package/dist/dto/index.js +5 -0
  24. package/dist/dto/index.js.map +1 -1
  25. package/dist/dto/user-response.dto.d.ts +5 -0
  26. package/dist/dto/user-response.dto.d.ts.map +1 -1
  27. package/dist/dto/user-response.dto.js +6 -0
  28. package/dist/dto/user-response.dto.js.map +1 -1
  29. package/dist/dto/verify-email.dto.d.ts +10 -0
  30. package/dist/dto/verify-email.dto.d.ts.map +1 -1
  31. package/dist/dto/verify-email.dto.js +16 -0
  32. package/dist/dto/verify-email.dto.js.map +1 -1
  33. package/dist/entities/user.entity.d.ts +18 -2
  34. package/dist/entities/user.entity.d.ts.map +1 -1
  35. package/dist/entities/user.entity.js +18 -2
  36. package/dist/entities/user.entity.js.map +1 -1
  37. package/dist/enums/auth-audit-event-type.enum.d.ts +5 -0
  38. package/dist/enums/auth-audit-event-type.enum.d.ts.map +1 -1
  39. package/dist/enums/auth-audit-event-type.enum.js +5 -0
  40. package/dist/enums/auth-audit-event-type.enum.js.map +1 -1
  41. package/dist/enums/error-codes.enum.d.ts +13 -0
  42. package/dist/enums/error-codes.enum.d.ts.map +1 -1
  43. package/dist/enums/error-codes.enum.js +13 -0
  44. package/dist/enums/error-codes.enum.js.map +1 -1
  45. package/dist/index.d.ts +1 -1
  46. package/dist/index.js +1 -1
  47. package/dist/services/auth.service.d.ts +172 -2
  48. package/dist/services/auth.service.d.ts.map +1 -1
  49. package/dist/services/auth.service.js +862 -2
  50. package/dist/services/auth.service.js.map +1 -1
  51. package/dist/services/email-verification.service.d.ts.map +1 -1
  52. package/dist/services/email-verification.service.js +7 -7
  53. package/dist/services/email-verification.service.js.map +1 -1
  54. package/dist/services/social-auth-base.service.d.ts +5 -1
  55. package/dist/services/social-auth-base.service.d.ts.map +1 -1
  56. package/dist/services/social-auth-base.service.js +62 -2
  57. package/dist/services/social-auth-base.service.js.map +1 -1
  58. package/dist/services/social-auth.service.d.ts +2 -1
  59. package/dist/services/social-auth.service.d.ts.map +1 -1
  60. package/dist/services/social-auth.service.js +5 -1
  61. package/dist/services/social-auth.service.js.map +1 -1
  62. package/dist/{handlers → services}/social-redirect.handler.d.ts.map +1 -1
  63. package/dist/{handlers → services}/social-redirect.handler.js.map +1 -1
  64. package/dist/utils/setup/init-services.d.ts.map +1 -1
  65. package/dist/utils/setup/init-services.js +2 -1
  66. package/dist/utils/setup/init-services.js.map +1 -1
  67. package/package.json +1 -1
  68. /package/dist/{handlers → services}/social-redirect.handler.d.ts +0 -0
  69. /package/dist/{handlers → services}/social-redirect.handler.js +0 -0
@@ -0,0 +1,257 @@
1
+ import { UserResponseDto } from './user-response.dto';
2
+ /**
3
+ * DTO for administrative social user import with override capabilities
4
+ *
5
+ * Allows administrators to import existing social users from external platforms
6
+ * (e.g., Cognito, Auth0) into nauth with:
7
+ * - Automatic email verification (like normal social signup)
8
+ * - Optional phone verification bypass
9
+ * - Optional password for hybrid social+password accounts
10
+ * - Social account linkage (provider + providerId)
11
+ * - Automatic user flag updates (hasSocialAuth)
12
+ *
13
+ * Use case: Migrating users from external authentication platforms while
14
+ * preserving their social login connections for transparent future logins.
15
+ *
16
+ * Security:
17
+ * - All fields validated against DB constraints
18
+ * - Input sanitization applied automatically
19
+ * - Email/username uniqueness checked in service layer
20
+ * - Provider+providerId uniqueness enforced (one social account per provider per user)
21
+ * - Audit trail records admin-imported social accounts
22
+ *
23
+ * Warning: This endpoint should be protected by admin authentication.
24
+ * The service does not enforce authorization - it is the responsibility
25
+ * of the framework adapter (NestJS/Express/Fastify) to protect the endpoint.
26
+ *
27
+ * @example
28
+ * ```typescript
29
+ * // Import social-only user from Cognito
30
+ * const dto: AdminSignupSocialDTO = {
31
+ * email: 'user@example.com',
32
+ * provider: 'google',
33
+ * providerId: 'google_12345',
34
+ * providerEmail: 'user@gmail.com',
35
+ * socialMetadata: { sub: 'google_12345', given_name: 'John' },
36
+ * };
37
+ *
38
+ * // Import hybrid user with password + social
39
+ * const dto: AdminSignupSocialDTO = {
40
+ * email: 'user@example.com',
41
+ * password: 'SecurePass123!',
42
+ * provider: 'apple',
43
+ * providerId: 'apple_67890',
44
+ * };
45
+ * ```
46
+ */
47
+ export declare class AdminSignupSocialDTO {
48
+ /**
49
+ * User email address
50
+ *
51
+ * Validation:
52
+ * - Valid email format (RFC 5322)
53
+ * - Max 255 characters (matches DB limit)
54
+ *
55
+ * Sanitization:
56
+ * - Trimmed and lowercased
57
+ */
58
+ email: string;
59
+ /**
60
+ * Optional first name
61
+ *
62
+ * Validation:
63
+ * - 1-100 characters
64
+ * - Letters, spaces, hyphens, and apostrophes only
65
+ * - Max 100 characters (DB limit)
66
+ *
67
+ * Sanitization:
68
+ * - Trimmed
69
+ * - Title case preserved
70
+ */
71
+ firstName?: string;
72
+ /**
73
+ * Bypass phone verification requirement
74
+ *
75
+ * If true, user's phone is marked as verified without sending verification SMS.
76
+ * If false (default), user must verify phone through normal flow.
77
+ *
78
+ * Default: false
79
+ */
80
+ isPhoneVerified?: boolean;
81
+ /**
82
+ * Optional last name
83
+ *
84
+ * Validation:
85
+ * - 1-100 characters
86
+ * - Letters, spaces, hyphens, and apostrophes only
87
+ * - Max 100 characters (DB limit)
88
+ *
89
+ * Sanitization:
90
+ * - Trimmed
91
+ * - Title case preserved
92
+ */
93
+ lastName?: string;
94
+ /**
95
+ * Optional metadata (custom fields)
96
+ *
97
+ * Security:
98
+ * - Validated in service layer if used
99
+ * - Max depth/size limits should be enforced
100
+ */
101
+ metadata?: Record<string, unknown>;
102
+ /**
103
+ * Force password change on first login
104
+ *
105
+ * If true, user will be required to change password on next login.
106
+ * Only relevant if password is provided (hybrid social+password account).
107
+ *
108
+ * Default: false
109
+ */
110
+ mustChangePassword?: boolean;
111
+ /**
112
+ * Optional password for hybrid social+password accounts
113
+ *
114
+ * Validation:
115
+ * - Min 8 characters
116
+ * - Max 128 characters (prevents DoS via bcrypt)
117
+ * - Additional policy checks in service layer
118
+ *
119
+ * Note: NOT trimmed (passwords can have leading/trailing spaces)
120
+ *
121
+ * Security: If not provided, user will be social-only (no password login).
122
+ * Password can be set later via setPasswordForSocialUser().
123
+ */
124
+ password?: string;
125
+ /**
126
+ * Optional phone number
127
+ *
128
+ * Validation:
129
+ * - E.164 format (international standard)
130
+ * - MUST start with + (required for security)
131
+ * - Max 20 characters (DB limit)
132
+ * - Example: +14155552671, +61444567890
133
+ *
134
+ * Sanitization:
135
+ * - Whitespace removed
136
+ * - Only digits and leading + preserved
137
+ *
138
+ * Security:
139
+ * - Strict E.164 validation prevents SQL injection
140
+ * - Max length prevents oversized inputs
141
+ */
142
+ phone?: string;
143
+ /**
144
+ * Social provider name
145
+ *
146
+ * The OAuth provider that the user authenticated with.
147
+ * Must match one of the supported providers.
148
+ *
149
+ * Validation:
150
+ * - Must be 'google', 'apple', or 'facebook'
151
+ * - Required field
152
+ */
153
+ provider: 'google' | 'apple' | 'facebook';
154
+ /**
155
+ * Provider's email address
156
+ *
157
+ * The email address associated with the user's social account.
158
+ * May differ from primary email if user has multiple email addresses.
159
+ * Used for audit trails and account linking verification.
160
+ *
161
+ * Validation:
162
+ * - Valid email format
163
+ * - Max 255 characters
164
+ *
165
+ * Optional: Some providers (like Apple with private relay) may not expose email.
166
+ */
167
+ providerEmail?: string;
168
+ /**
169
+ * Provider's unique user identifier
170
+ *
171
+ * The unique ID assigned by the OAuth provider (e.g., Google sub, Apple user ID).
172
+ * Used to link the social account to the user record.
173
+ *
174
+ * Validation:
175
+ * - Required field
176
+ * - Max 255 characters (DB limit)
177
+ * - Unique per provider (enforced at DB level)
178
+ *
179
+ * Security: provider+providerId combination must be unique across all users.
180
+ */
181
+ providerId: string;
182
+ /**
183
+ * Raw OAuth profile data from provider
184
+ *
185
+ * Stores the complete OAuth profile response from the provider.
186
+ * Useful for debugging, audit trails, and extracting additional user attributes.
187
+ *
188
+ * Security:
189
+ * - Stored as JSON in database
190
+ * - Not exposed in public APIs
191
+ * - Used internally for troubleshooting
192
+ *
193
+ * @example
194
+ * ```json
195
+ * {
196
+ * "sub": "google_12345",
197
+ * "email": "user@gmail.com",
198
+ * "given_name": "John",
199
+ * "family_name": "Doe",
200
+ * "picture": "https://...",
201
+ * "locale": "en"
202
+ * }
203
+ * ```
204
+ */
205
+ socialMetadata?: Record<string, unknown>;
206
+ /**
207
+ * Optional username
208
+ *
209
+ * Validation:
210
+ * - 3-50 characters
211
+ * - Alphanumeric, underscores, and hyphens only
212
+ * - Max 255 characters (DB limit)
213
+ *
214
+ * Sanitization:
215
+ * - Trimmed
216
+ * - Lowercased
217
+ */
218
+ username?: string;
219
+ }
220
+ /**
221
+ * Response DTO for admin social signup
222
+ *
223
+ * Returns the created user object (sanitized, excludes sensitive fields like passwordHash)
224
+ * and social account information for confirmation.
225
+ */
226
+ export declare class AdminSignupSocialResponseDTO {
227
+ /**
228
+ * Social account information
229
+ *
230
+ * Confirms the social account linkage for the imported user.
231
+ */
232
+ socialAccount: {
233
+ /**
234
+ * Social provider name
235
+ */
236
+ provider: string;
237
+ /**
238
+ * Provider's unique user identifier
239
+ */
240
+ providerId: string;
241
+ /**
242
+ * Provider's email address (if available)
243
+ */
244
+ providerEmail: string | null;
245
+ };
246
+ /**
247
+ * Created user object (sanitized)
248
+ *
249
+ * Uses UserResponseDto which excludes sensitive fields:
250
+ * - No passwordHash
251
+ * - No internal database ID (uses 'sub' UUID instead)
252
+ * - No MFA secrets
253
+ * - No internal tracking fields
254
+ */
255
+ user: UserResponseDto;
256
+ }
257
+ //# sourceMappingURL=admin-signup-social.dto.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"admin-signup-social.dto.d.ts","sourceRoot":"","sources":["../../src/dto/admin-signup-social.dto.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,qBAAa,oBAAoB;IAC/B;;;;;;;;;OASG;IASH,KAAK,EAAG,MAAM,CAAC;IAEf;;;;;;;;;;;OAWG;IAcH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;OAOG;IAGH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B;;;;;;;;;;;OAWG;IAcH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;OAMG;IAEH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnC;;;;;;;OAOG;IAGH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;OAYG;IAKH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;;;;;;;;;;;;OAgBG;IAcH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;;;;;;;OASG;IAIH,QAAQ,EAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IAE3C;;;;;;;;;;;;OAYG;IAWH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;;;;OAYG;IASH,UAAU,EAAG,MAAM,CAAC;IAEpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEzC;;;;;;;;;;;OAWG;IAcH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,qBAAa,4BAA4B;IACvC;;;;OAIG;IACH,aAAa,EAAG;QACd;;WAEG;QACH,QAAQ,EAAE,MAAM,CAAC;QACjB;;WAEG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;WAEG;QACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;IAEF;;;;;;;;OAQG;IACH,IAAI,EAAG,eAAe,CAAC;CACxB"}
@@ -0,0 +1,389 @@
1
+ "use strict";
2
+ var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
3
+ var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
4
+ if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
5
+ else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
6
+ return c > 3 && r && Object.defineProperty(target, key, r), r;
7
+ };
8
+ var __metadata = (this && this.__metadata) || function (k, v) {
9
+ if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
10
+ };
11
+ Object.defineProperty(exports, "__esModule", { value: true });
12
+ exports.AdminSignupSocialResponseDTO = exports.AdminSignupSocialDTO = void 0;
13
+ const class_validator_1 = require("class-validator");
14
+ const class_transformer_1 = require("class-transformer");
15
+ /**
16
+ * DTO for administrative social user import with override capabilities
17
+ *
18
+ * Allows administrators to import existing social users from external platforms
19
+ * (e.g., Cognito, Auth0) into nauth with:
20
+ * - Automatic email verification (like normal social signup)
21
+ * - Optional phone verification bypass
22
+ * - Optional password for hybrid social+password accounts
23
+ * - Social account linkage (provider + providerId)
24
+ * - Automatic user flag updates (hasSocialAuth)
25
+ *
26
+ * Use case: Migrating users from external authentication platforms while
27
+ * preserving their social login connections for transparent future logins.
28
+ *
29
+ * Security:
30
+ * - All fields validated against DB constraints
31
+ * - Input sanitization applied automatically
32
+ * - Email/username uniqueness checked in service layer
33
+ * - Provider+providerId uniqueness enforced (one social account per provider per user)
34
+ * - Audit trail records admin-imported social accounts
35
+ *
36
+ * Warning: This endpoint should be protected by admin authentication.
37
+ * The service does not enforce authorization - it is the responsibility
38
+ * of the framework adapter (NestJS/Express/Fastify) to protect the endpoint.
39
+ *
40
+ * @example
41
+ * ```typescript
42
+ * // Import social-only user from Cognito
43
+ * const dto: AdminSignupSocialDTO = {
44
+ * email: 'user@example.com',
45
+ * provider: 'google',
46
+ * providerId: 'google_12345',
47
+ * providerEmail: 'user@gmail.com',
48
+ * socialMetadata: { sub: 'google_12345', given_name: 'John' },
49
+ * };
50
+ *
51
+ * // Import hybrid user with password + social
52
+ * const dto: AdminSignupSocialDTO = {
53
+ * email: 'user@example.com',
54
+ * password: 'SecurePass123!',
55
+ * provider: 'apple',
56
+ * providerId: 'apple_67890',
57
+ * };
58
+ * ```
59
+ */
60
+ class AdminSignupSocialDTO {
61
+ /**
62
+ * User email address
63
+ *
64
+ * Validation:
65
+ * - Valid email format (RFC 5322)
66
+ * - Max 255 characters (matches DB limit)
67
+ *
68
+ * Sanitization:
69
+ * - Trimmed and lowercased
70
+ */
71
+ email;
72
+ /**
73
+ * Optional first name
74
+ *
75
+ * Validation:
76
+ * - 1-100 characters
77
+ * - Letters, spaces, hyphens, and apostrophes only
78
+ * - Max 100 characters (DB limit)
79
+ *
80
+ * Sanitization:
81
+ * - Trimmed
82
+ * - Title case preserved
83
+ */
84
+ firstName;
85
+ /**
86
+ * Bypass phone verification requirement
87
+ *
88
+ * If true, user's phone is marked as verified without sending verification SMS.
89
+ * If false (default), user must verify phone through normal flow.
90
+ *
91
+ * Default: false
92
+ */
93
+ isPhoneVerified;
94
+ /**
95
+ * Optional last name
96
+ *
97
+ * Validation:
98
+ * - 1-100 characters
99
+ * - Letters, spaces, hyphens, and apostrophes only
100
+ * - Max 100 characters (DB limit)
101
+ *
102
+ * Sanitization:
103
+ * - Trimmed
104
+ * - Title case preserved
105
+ */
106
+ lastName;
107
+ /**
108
+ * Optional metadata (custom fields)
109
+ *
110
+ * Security:
111
+ * - Validated in service layer if used
112
+ * - Max depth/size limits should be enforced
113
+ */
114
+ metadata;
115
+ /**
116
+ * Force password change on first login
117
+ *
118
+ * If true, user will be required to change password on next login.
119
+ * Only relevant if password is provided (hybrid social+password account).
120
+ *
121
+ * Default: false
122
+ */
123
+ mustChangePassword;
124
+ /**
125
+ * Optional password for hybrid social+password accounts
126
+ *
127
+ * Validation:
128
+ * - Min 8 characters
129
+ * - Max 128 characters (prevents DoS via bcrypt)
130
+ * - Additional policy checks in service layer
131
+ *
132
+ * Note: NOT trimmed (passwords can have leading/trailing spaces)
133
+ *
134
+ * Security: If not provided, user will be social-only (no password login).
135
+ * Password can be set later via setPasswordForSocialUser().
136
+ */
137
+ password;
138
+ /**
139
+ * Optional phone number
140
+ *
141
+ * Validation:
142
+ * - E.164 format (international standard)
143
+ * - MUST start with + (required for security)
144
+ * - Max 20 characters (DB limit)
145
+ * - Example: +14155552671, +61444567890
146
+ *
147
+ * Sanitization:
148
+ * - Whitespace removed
149
+ * - Only digits and leading + preserved
150
+ *
151
+ * Security:
152
+ * - Strict E.164 validation prevents SQL injection
153
+ * - Max length prevents oversized inputs
154
+ */
155
+ phone;
156
+ /**
157
+ * Social provider name
158
+ *
159
+ * The OAuth provider that the user authenticated with.
160
+ * Must match one of the supported providers.
161
+ *
162
+ * Validation:
163
+ * - Must be 'google', 'apple', or 'facebook'
164
+ * - Required field
165
+ */
166
+ provider;
167
+ /**
168
+ * Provider's email address
169
+ *
170
+ * The email address associated with the user's social account.
171
+ * May differ from primary email if user has multiple email addresses.
172
+ * Used for audit trails and account linking verification.
173
+ *
174
+ * Validation:
175
+ * - Valid email format
176
+ * - Max 255 characters
177
+ *
178
+ * Optional: Some providers (like Apple with private relay) may not expose email.
179
+ */
180
+ providerEmail;
181
+ /**
182
+ * Provider's unique user identifier
183
+ *
184
+ * The unique ID assigned by the OAuth provider (e.g., Google sub, Apple user ID).
185
+ * Used to link the social account to the user record.
186
+ *
187
+ * Validation:
188
+ * - Required field
189
+ * - Max 255 characters (DB limit)
190
+ * - Unique per provider (enforced at DB level)
191
+ *
192
+ * Security: provider+providerId combination must be unique across all users.
193
+ */
194
+ providerId;
195
+ /**
196
+ * Raw OAuth profile data from provider
197
+ *
198
+ * Stores the complete OAuth profile response from the provider.
199
+ * Useful for debugging, audit trails, and extracting additional user attributes.
200
+ *
201
+ * Security:
202
+ * - Stored as JSON in database
203
+ * - Not exposed in public APIs
204
+ * - Used internally for troubleshooting
205
+ *
206
+ * @example
207
+ * ```json
208
+ * {
209
+ * "sub": "google_12345",
210
+ * "email": "user@gmail.com",
211
+ * "given_name": "John",
212
+ * "family_name": "Doe",
213
+ * "picture": "https://...",
214
+ * "locale": "en"
215
+ * }
216
+ * ```
217
+ */
218
+ socialMetadata;
219
+ /**
220
+ * Optional username
221
+ *
222
+ * Validation:
223
+ * - 3-50 characters
224
+ * - Alphanumeric, underscores, and hyphens only
225
+ * - Max 255 characters (DB limit)
226
+ *
227
+ * Sanitization:
228
+ * - Trimmed
229
+ * - Lowercased
230
+ */
231
+ username;
232
+ }
233
+ exports.AdminSignupSocialDTO = AdminSignupSocialDTO;
234
+ __decorate([
235
+ (0, class_validator_1.IsEmail)({}, { message: 'Invalid email format' }),
236
+ (0, class_validator_1.MaxLength)(255, { message: 'Email must not exceed 255 characters' }),
237
+ (0, class_transformer_1.Transform)(({ value }) => {
238
+ if (typeof value === 'string') {
239
+ return value.trim().toLowerCase();
240
+ }
241
+ return value;
242
+ }),
243
+ __metadata("design:type", String)
244
+ ], AdminSignupSocialDTO.prototype, "email", void 0);
245
+ __decorate([
246
+ (0, class_validator_1.IsOptional)(),
247
+ (0, class_validator_1.IsString)({ message: 'First name must be a string' }),
248
+ (0, class_validator_1.MinLength)(1, { message: 'First name must be at least 1 character' }),
249
+ (0, class_validator_1.MaxLength)(100, { message: 'First name must not exceed 100 characters' }),
250
+ (0, class_validator_1.Matches)(/^[a-zA-Z\s\-']+$/, {
251
+ message: 'First name can only contain letters, spaces, hyphens, and apostrophes',
252
+ }),
253
+ (0, class_transformer_1.Transform)(({ value }) => {
254
+ if (typeof value === 'string') {
255
+ return value.trim();
256
+ }
257
+ return value;
258
+ }),
259
+ __metadata("design:type", String)
260
+ ], AdminSignupSocialDTO.prototype, "firstName", void 0);
261
+ __decorate([
262
+ (0, class_validator_1.IsOptional)(),
263
+ (0, class_validator_1.IsBoolean)({ message: 'isPhoneVerified must be a boolean' }),
264
+ __metadata("design:type", Boolean)
265
+ ], AdminSignupSocialDTO.prototype, "isPhoneVerified", void 0);
266
+ __decorate([
267
+ (0, class_validator_1.IsOptional)(),
268
+ (0, class_validator_1.IsString)({ message: 'Last name must be a string' }),
269
+ (0, class_validator_1.MinLength)(1, { message: 'Last name must be at least 1 character' }),
270
+ (0, class_validator_1.MaxLength)(100, { message: 'Last name must not exceed 100 characters' }),
271
+ (0, class_validator_1.Matches)(/^[a-zA-Z\s\-']+$/, {
272
+ message: 'Last name can only contain letters, spaces, hyphens, and apostrophes',
273
+ }),
274
+ (0, class_transformer_1.Transform)(({ value }) => {
275
+ if (typeof value === 'string') {
276
+ return value.trim();
277
+ }
278
+ return value;
279
+ }),
280
+ __metadata("design:type", String)
281
+ ], AdminSignupSocialDTO.prototype, "lastName", void 0);
282
+ __decorate([
283
+ (0, class_validator_1.IsOptional)(),
284
+ __metadata("design:type", Object)
285
+ ], AdminSignupSocialDTO.prototype, "metadata", void 0);
286
+ __decorate([
287
+ (0, class_validator_1.IsOptional)(),
288
+ (0, class_validator_1.IsBoolean)({ message: 'mustChangePassword must be a boolean' }),
289
+ __metadata("design:type", Boolean)
290
+ ], AdminSignupSocialDTO.prototype, "mustChangePassword", void 0);
291
+ __decorate([
292
+ (0, class_validator_1.IsOptional)(),
293
+ (0, class_validator_1.IsString)({ message: 'Password must be a string' }),
294
+ (0, class_validator_1.MinLength)(8, { message: 'Password must be at least 8 characters' }),
295
+ (0, class_validator_1.MaxLength)(128, { message: 'Password must not exceed 128 characters' }),
296
+ __metadata("design:type", String)
297
+ ], AdminSignupSocialDTO.prototype, "password", void 0);
298
+ __decorate([
299
+ (0, class_validator_1.IsOptional)(),
300
+ (0, class_validator_1.IsString)({ message: 'Phone must be a string' }),
301
+ (0, class_validator_1.MaxLength)(20, { message: 'Phone must not exceed 20 characters' }),
302
+ (0, class_validator_1.Matches)(/^\+[1-9]\d{1,14}$/, {
303
+ message: 'Phone must be in E.164 format with + prefix (e.g., +14155552671)',
304
+ }),
305
+ (0, class_transformer_1.Transform)(({ value }) => {
306
+ if (typeof value === 'string') {
307
+ // Remove all whitespace and keep only digits and +
308
+ return value.replace(/\s/g, '');
309
+ }
310
+ return value;
311
+ }),
312
+ __metadata("design:type", String)
313
+ ], AdminSignupSocialDTO.prototype, "phone", void 0);
314
+ __decorate([
315
+ (0, class_validator_1.IsEnum)(['google', 'apple', 'facebook'], {
316
+ message: 'Provider must be one of: google, apple, facebook',
317
+ }),
318
+ __metadata("design:type", String)
319
+ ], AdminSignupSocialDTO.prototype, "provider", void 0);
320
+ __decorate([
321
+ (0, class_validator_1.IsOptional)(),
322
+ (0, class_validator_1.IsString)({ message: 'Provider email must be a string' }),
323
+ (0, class_validator_1.IsEmail)({}, { message: 'Provider email must be valid email format' }),
324
+ (0, class_validator_1.MaxLength)(255, { message: 'Provider email must not exceed 255 characters' }),
325
+ (0, class_transformer_1.Transform)(({ value }) => {
326
+ if (typeof value === 'string') {
327
+ return value.trim().toLowerCase();
328
+ }
329
+ return value;
330
+ }),
331
+ __metadata("design:type", String)
332
+ ], AdminSignupSocialDTO.prototype, "providerEmail", void 0);
333
+ __decorate([
334
+ (0, class_validator_1.IsString)({ message: 'Provider ID must be a string' }),
335
+ (0, class_validator_1.MaxLength)(255, { message: 'Provider ID must not exceed 255 characters' }),
336
+ (0, class_transformer_1.Transform)(({ value }) => {
337
+ if (typeof value === 'string') {
338
+ return value.trim();
339
+ }
340
+ return value;
341
+ }),
342
+ __metadata("design:type", String)
343
+ ], AdminSignupSocialDTO.prototype, "providerId", void 0);
344
+ __decorate([
345
+ (0, class_validator_1.IsOptional)(),
346
+ __metadata("design:type", Object)
347
+ ], AdminSignupSocialDTO.prototype, "socialMetadata", void 0);
348
+ __decorate([
349
+ (0, class_validator_1.IsOptional)(),
350
+ (0, class_validator_1.IsString)({ message: 'Username must be a string' }),
351
+ (0, class_validator_1.MinLength)(3, { message: 'Username must be at least 3 characters' }),
352
+ (0, class_validator_1.MaxLength)(255, { message: 'Username must not exceed 255 characters' }),
353
+ (0, class_validator_1.Matches)(/^[a-zA-Z0-9_-]+$/, {
354
+ message: 'Username can only contain letters, numbers, underscores, and hyphens',
355
+ }),
356
+ (0, class_transformer_1.Transform)(({ value }) => {
357
+ if (typeof value === 'string') {
358
+ return value.trim().toLowerCase();
359
+ }
360
+ return value;
361
+ }),
362
+ __metadata("design:type", String)
363
+ ], AdminSignupSocialDTO.prototype, "username", void 0);
364
+ /**
365
+ * Response DTO for admin social signup
366
+ *
367
+ * Returns the created user object (sanitized, excludes sensitive fields like passwordHash)
368
+ * and social account information for confirmation.
369
+ */
370
+ class AdminSignupSocialResponseDTO {
371
+ /**
372
+ * Social account information
373
+ *
374
+ * Confirms the social account linkage for the imported user.
375
+ */
376
+ socialAccount;
377
+ /**
378
+ * Created user object (sanitized)
379
+ *
380
+ * Uses UserResponseDto which excludes sensitive fields:
381
+ * - No passwordHash
382
+ * - No internal database ID (uses 'sub' UUID instead)
383
+ * - No MFA secrets
384
+ * - No internal tracking fields
385
+ */
386
+ user;
387
+ }
388
+ exports.AdminSignupSocialResponseDTO = AdminSignupSocialResponseDTO;
389
+ //# sourceMappingURL=admin-signup-social.dto.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"admin-signup-social.dto.js","sourceRoot":"","sources":["../../src/dto/admin-signup-social.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkH;AAClH,yDAA8C;AAG9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAa,oBAAoB;IAC/B;;;;;;;;;OASG;IASH,KAAK,CAAU;IAEf;;;;;;;;;;;OAWG;IAcH,SAAS,CAAU;IAEnB;;;;;;;OAOG;IAGH,eAAe,CAAW;IAE1B;;;;;;;;;;;OAWG;IAcH,QAAQ,CAAU;IAElB;;;;;;OAMG;IAEH,QAAQ,CAA2B;IAEnC;;;;;;;OAOG;IAGH,kBAAkB,CAAW;IAE7B;;;;;;;;;;;;OAYG;IAKH,QAAQ,CAAU;IAElB;;;;;;;;;;;;;;;;OAgBG;IAcH,KAAK,CAAU;IAEf;;;;;;;;;OASG;IAIH,QAAQ,CAAmC;IAE3C;;;;;;;;;;;;OAYG;IAWH,aAAa,CAAU;IAEvB;;;;;;;;;;;;OAYG;IASH,UAAU,CAAU;IAEpB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEH,cAAc,CAA2B;IAEzC;;;;;;;;;;;OAWG;IAcH,QAAQ,CAAU;CACnB;AAnRD,oDAmRC;AAhQC;IARC,IAAA,yBAAO,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAChD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;mDACa;AA2Bf;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACpE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACxE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,uEAAuE;KACjF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;uDACiB;AAYnB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;6DAClC;AA2B1B;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;IACnD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IACvE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,sEAAsE;KAChF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;sDACgB;AAUlB;IADC,IAAA,4BAAU,GAAE;;sDACsB;AAYnC;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;;gEAClC;AAmB7B;IAJC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAClD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;;sDACrD;AAgClB;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC/C,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACjE,IAAA,yBAAO,EAAC,mBAAmB,EAAE;QAC5B,OAAO,EAAE,kEAAkE;KAC5E,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,mDAAmD;YACnD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;mDACa;AAef;IAHC,IAAA,wBAAM,EAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE;QACvC,OAAO,EAAE,kDAAkD;KAC5D,CAAC;;sDACyC;AAyB3C;IAVC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;IACxD,IAAA,yBAAO,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACrE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IAC5E,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;2DACqB;AAuBvB;IARC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACrD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;IACzE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;wDACkB;AA0BpB;IADC,IAAA,4BAAU,GAAE;;4DAC4B;AA2BzC;IAbC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAClD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACtE,IAAA,yBAAO,EAAC,kBAAkB,EAAE;QAC3B,OAAO,EAAE,sEAAsE;KAChF,CAAC;IACD,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;sDACgB;AAGpB;;;;;GAKG;AACH,MAAa,4BAA4B;IACvC;;;;OAIG;IACH,aAAa,CAaX;IAEF;;;;;;;;OAQG;IACH,IAAI,CAAmB;CACxB;AA/BD,oEA+BC"}