@nauth-toolkit/core 0.1.59 → 0.1.61

package/dist/dto/admin-reset-password.dto.js

@@ -0,0 +1,402 @@
+"use strict";
+/**
+ * Admin Reset Password Request DTO
+ *
+ * Request DTO for admin-initiated password reset workflow.
+ * Allows resetting a user's password by identifier (email, username, phone, or sub).
+ *
+ * Security:
+ * - Admin-only operation (should be protected by admin guard)
+ * - User identifier validated
+ * - Code + optional link delivery (like email verification)
+ * - Configurable expiry (default: 1 hour)
+ * - Optional immediate session revocation
+ * - No rate limiting (admin bypass)
+ *
+ * @example
+ * ```typescript
+ * // With link for consumer app custom UI
+ * await authService.adminResetPassword({
+ *   identifier: 'user@example.com',
+ *   baseUrl: 'https://myapp.com/reset-password',
+ *   deliveryMethod: 'email',
+ *   revokeSessions: true
+ * });
+ *
+ * // Code only (no link)
+ * await authService.adminResetPassword({
+ *   identifier: 'user@example.com',
+ *   deliveryMethod: 'email'
+ * });
+ * ```
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfirmAdminResetPasswordResponseDTO = exports.ConfirmAdminResetPasswordDTO = exports.AdminResetPasswordResponseDTO = exports.AdminResetPasswordDTO = void 0;
+const class_validator_1 = require("class-validator");
+const class_transformer_1 = require("class-transformer");
+/**
+ * Request DTO for admin password reset
+ */
+class AdminResetPasswordDTO {
+    /**
+     * User identifier (email, username, phone, or sub/UUID)
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 1 character
+     * - Max 255 characters
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased if email format detected
+     *
+     * @example "user@example.com" | "johndoe" | "+1234567890" | "uuid"
+     */
+    identifier;
+    /**
+     * Delivery method for reset code
+     *
+     * Validation:
+     * - Must be 'email' or 'sms'
+     * - Optional (defaults to 'email')
+     *
+     * @default 'email'
+     * @example 'email' | 'sms'
+     */
+    deliveryMethod;
+    /**
+     * Base URL for building reset link
+     *
+     * Validation:
+     * - Must be valid URL with http:// or https://
+     * - Max 2048 characters
+     * - Optional
+     *
+     * Sanitization:
+     * - Trimmed
+     *
+     * WHY: Allows consumer apps to build custom reset UI (e.g., myapp.com/reset-password?token=xxx)
+     * Like email verification, supports both code AND link delivery
+     *
+     * @example "https://myapp.com/reset-password"
+     */
+    baseUrl;
+    /**
+     * Code expiry in seconds
+     *
+     * Validation:
+     * - Must be number
+     * - Min 300 seconds (5 minutes)
+     * - Max 86400 seconds (24 hours)
+     * - Optional
+     *
+     * @default 3600 (1 hour - longer than user-initiated 15min)
+     * @example 3600
+     */
+    codeExpiresIn;
+    /**
+     * Revoke all active sessions immediately (before sending email)
+     *
+     * Validation:
+     * - Must be boolean
+     * - Optional
+     *
+     * WHY: Admin can lock user out immediately while sending reset email
+     * Different from confirmAdminResetPassword which always revokes on completion
+     *
+     * @default false
+     * @example true
+     */
+    revokeSessions;
+    /**
+     * Reason for admin-initiated reset (for audit trail)
+     *
+     * Validation:
+     * - Must be string
+     * - Max 500 characters
+     * - Optional
+     *
+     * Sanitization:
+     * - Trimmed
+     *
+     * @example "User reported account compromise"
+     */
+    reason;
+}
+exports.AdminResetPasswordDTO = AdminResetPasswordDTO;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Identifier must be a string' }),
+    (0, class_validator_1.IsNotEmpty)({ message: 'Identifier is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Identifier is required' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Identifier must not exceed 255 characters' }),
+    (0, class_transformer_1.Transform)(({ value }) => {
+        if (typeof value === 'string') {
+            const trimmed = value.trim();
+            // If it contains @, treat as email and lowercase
+            if (trimmed.includes('@')) {
+                return trimmed.toLowerCase();
+            }
+            return trimmed;
+        }
+        return value;
+    }),
+    __metadata("design:type", String)
+], AdminResetPasswordDTO.prototype, "identifier", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsIn)(['email', 'sms'], { message: 'Delivery method must be email or sms' }),
+    __metadata("design:type", String)
+], AdminResetPasswordDTO.prototype, "deliveryMethod", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUrl)({ require_protocol: true, protocols: ['http', 'https'] }, { message: 'Base URL must be valid URL with http:// or https://' }),
+    (0, class_validator_1.MaxLength)(2048, { message: 'Base URL must not exceed 2048 characters' }),
+    (0, class_transformer_1.Transform)(({ value }) => {
+        if (typeof value === 'string') {
+            return value.trim();
+        }
+        return value;
+    }),
+    __metadata("design:type", String)
+], AdminResetPasswordDTO.prototype, "baseUrl", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsNumber)({}, { message: 'Code expiry must be a number' }),
+    (0, class_validator_1.Min)(300, { message: 'Code expiry must be at least 300 seconds (5 minutes)' }),
+    (0, class_validator_1.Max)(86400, { message: 'Code expiry must not exceed 86400 seconds (24 hours)' }),
+    __metadata("design:type", Number)
+], AdminResetPasswordDTO.prototype, "codeExpiresIn", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)({ message: 'revokeSessions must be a boolean' }),
+    __metadata("design:type", Boolean)
+], AdminResetPasswordDTO.prototype, "revokeSessions", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)({ message: 'Reason must be a string' }),
+    (0, class_validator_1.MaxLength)(500, { message: 'Reason must not exceed 500 characters' }),
+    (0, class_transformer_1.Transform)(({ value }) => {
+        if (typeof value === 'string') {
+            return value.trim();
+        }
+        return value;
+    }),
+    __metadata("design:type", String)
+], AdminResetPasswordDTO.prototype, "reason", void 0);
+/**
+ * Admin Reset Password Response DTO
+ *
+ * Response DTO for admin-initiated password reset request.
+ *
+ * @example
+ * ```typescript
+ * {
+ *   success: true,
+ *   destination: 'u***r@example.com',
+ *   deliveryMedium: 'email',
+ *   expiresIn: 3600,
+ *   sessionsRevoked: 3
+ * }
+ * ```
+ */
+class AdminResetPasswordResponseDTO {
+    /**
+     * Success indicator
+     * Always true on successful request
+     */
+    success;
+    /**
+     * Masked destination where code was sent
+     * @example "u***r@example.com" | "***-***-5678"
+     */
+    destination;
+    /**
+     * Delivery medium used
+     * @example "email" | "sms"
+     */
+    deliveryMedium;
+    /**
+     * Code expiry in seconds
+     * @example 3600
+     */
+    expiresIn;
+    /**
+     * Number of sessions revoked (if revokeSessions was true)
+     * @example 3
+     */
+    sessionsRevoked;
+}
+exports.AdminResetPasswordResponseDTO = AdminResetPasswordResponseDTO;
+/**
+ * Confirm Admin Reset Password DTO
+ *
+ * User completes admin-initiated password reset with code OR token.
+ * Accepts either short code from email/SMS OR long token from link.
+ *
+ * Security:
+ * - One of code or token is required
+ * - Token-based: No attempt tracking (single use, long random)
+ * - Code-based: Attempt tracking (max 3 attempts)
+ * - Always revokes all sessions on completion
+ * - Always sets mustChangePassword flag
+ *
+ * @example
+ * ```typescript
+ * // With code (from email/SMS)
+ * await authService.confirmAdminResetPassword({
+ *   identifier: 'user@example.com',
+ *   code: '123456',
+ *   newPassword: 'NewSecurePass123!'
+ * });
+ *
+ * // With token (from link)
+ * await authService.confirmAdminResetPassword({
+ *   identifier: 'user@example.com',
+ *   token: '64-char-hex-token-from-link',
+ *   newPassword: 'NewSecurePass123!'
+ * });
+ * ```
+ */
+class ConfirmAdminResetPasswordDTO {
+    /**
+     * User identifier (email, username, phone, or sub/UUID)
+     *
+     * Validation:
+     * - Must be a string
+     * - Min 1 character
+     * - Max 255 characters
+     *
+     * Sanitization:
+     * - Trimmed
+     * - Lowercased if email format detected
+     *
+     * @example "user@example.com"
+     */
+    identifier;
+    /**
+     * Verification code from email/SMS (6-10 digits)
+     *
+     * Validation:
+     * - Must be string
+     * - Length 6-10 characters
+     * - Optional (token OR code required)
+     *
+     * Sanitization:
+     * - Trimmed
+     *
+     * WHY: Short code for manual entry, subject to attempt tracking
+     *
+     * @example "123456"
+     */
+    code;
+    /**
+     * Verification token from link (64-char hex)
+     *
+     * Validation:
+     * - Must be string
+     * - Optional (token OR code required)
+     *
+     * Sanitization:
+     * - Trimmed
+     *
+     * WHY: Long token from link, single-use, no attempt tracking needed
+     *
+     * @example "a1b2c3d4..."
+     */
+    token;
+    /**
+     * New password
+     *
+     * Validation:
+     * - Must be string
+     * - Min 8 characters (security requirement)
+     * - Max 128 characters (prevents DoS)
+     *
+     * Note: NOT trimmed (passwords can have leading/trailing spaces)
+     * Additional checks in service layer:
+     * - Password strength (if configured)
+     * - Password history (prevent reuse)
+     *
+     * @example "NewSecurePassword123!"
+     */
+    newPassword;
+}
+exports.ConfirmAdminResetPasswordDTO = ConfirmAdminResetPasswordDTO;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Identifier must be a string' }),
+    (0, class_validator_1.IsNotEmpty)({ message: 'Identifier is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Identifier is required' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Identifier must not exceed 255 characters' }),
+    (0, class_transformer_1.Transform)(({ value }) => {
+        if (typeof value === 'string') {
+            const trimmed = value.trim();
+            // If it contains @, treat as email and lowercase
+            if (trimmed.includes('@')) {
+                return trimmed.toLowerCase();
+            }
+            return trimmed;
+        }
+        return value;
+    }),
+    __metadata("design:type", String)
+], ConfirmAdminResetPasswordDTO.prototype, "identifier", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)({ message: 'Code must be a string' }),
+    (0, class_validator_1.Length)(6, 10, { message: 'Code must be between 6 and 10 characters' }),
+    (0, class_transformer_1.Transform)(({ value }) => {
+        if (typeof value === 'string') {
+            return value.trim();
+        }
+        return value;
+    }),
+    __metadata("design:type", String)
+], ConfirmAdminResetPasswordDTO.prototype, "code", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)({ message: 'Token must be a string' }),
+    (0, class_transformer_1.Transform)(({ value }) => {
+        if (typeof value === 'string') {
+            return value.trim();
+        }
+        return value;
+    }),
+    __metadata("design:type", String)
+], ConfirmAdminResetPasswordDTO.prototype, "token", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'New password must be a string' }),
+    (0, class_validator_1.IsNotEmpty)({ message: 'New password is required' }),
+    (0, class_validator_1.MinLength)(8, { message: 'Password must be at least 8 characters' }),
+    (0, class_validator_1.MaxLength)(128, { message: 'Password must not exceed 128 characters' }),
+    __metadata("design:type", String)
+], ConfirmAdminResetPasswordDTO.prototype, "newPassword", void 0);
+/**
+ * Confirm Admin Reset Password Response DTO
+ *
+ * Response DTO for successful admin password reset completion.
+ *
+ * @example
+ * ```typescript
+ * {
+ *   success: true
+ * }
+ * ```
+ */
+class ConfirmAdminResetPasswordResponseDTO {
+    /**
+     * Success indicator
+     * Always true on successful reset
+     */
+    success;
+}
+exports.ConfirmAdminResetPasswordResponseDTO = ConfirmAdminResetPasswordResponseDTO;
+//# sourceMappingURL=admin-reset-password.dto.js.map

package/dist/dto/admin-reset-password.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-reset-password.dto.js","sourceRoot":"","sources":["../../src/dto/admin-reset-password.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;;;;;;;;;;;;AAEH,qDAayB;AACzB,yDAA8C;AAE9C;;GAEG;AACH,MAAa,qBAAqB;IAChC;;;;;;;;;;;;;OAaG;IAgBH,UAAU,CAAU;IAEpB;;;;;;;;;OASG;IAGH,cAAc,CAAmB;IAEjC;;;;;;;;;;;;;;;OAeG;IAaH,OAAO,CAAU;IAEjB;;;;;;;;;;;OAWG;IAKH,aAAa,CAAU;IAEvB;;;;;;;;;;;;OAYG;IAGH,cAAc,CAAW;IAEzB;;;;;;;;;;;;OAYG;IAUH,MAAM,CAAU;CACjB;AAtID,sDAsIC;AAxGC;IAfC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpD,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACjD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACnD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACxE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAsB,EAAE,EAAE;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,iDAAiD;YACjD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;yDACkB;AAcpB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,sBAAI,EAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC;;6DAC3C;AA8BjC;IAZC,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,EACJ,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACxD,EAAE,OAAO,EAAE,qDAAqD,EAAE,CACnE;IACA,IAAA,2BAAS,EAAC,IAAI,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IACxE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAsB,EAAE,EAAE;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;sDACe;AAkBjB;IAJC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACzD,IAAA,qBAAG,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;IAC7E,IAAA,qBAAG,EAAC,KAAK,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;;4DACzD;AAiBvB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;;6DAClC;AAwBzB;IATC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IAChD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IACpE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAsB,EAAE,EAAE;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;qDACc;AAGlB;;;;;;;;;;;;;;;GAeG;AACH,MAAa,6BAA6B;IACxC;;;OAGG;IACH,OAAO,CAAW;IAElB;;;OAGG;IACH,WAAW,CAAU;IAErB;;;OAGG;IACH,cAAc,CAAmB;IAEjC;;;OAGG;IACH,SAAS,CAAU;IAEnB;;;OAGG;IACH,eAAe,CAAU;CAC1B;AA9BD,sEA8BC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAa,4BAA4B;IACvC;;;;;;;;;;;;;OAaG;IAgBH,UAAU,CAAU;IAEpB;;;;;;;;;;;;;;OAcG;IAUH,IAAI,CAAU;IAEd;;;;;;;;;;;;;OAaG;IASH,KAAK,CAAU;IAEf;;;;;;;;;;;;;;OAcG;IAKH,WAAW,CAAU;CACtB;AAtGD,oEAsGC;AAxEC;IAfC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpD,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACjD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACnD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACxE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAsB,EAAE,EAAE;QAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC7B,iDAAiD;YACjD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;gEACkB;AA0BpB;IATC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAC9C,IAAA,wBAAM,EAAC,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC;IACtE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;0DACY;AAwBd;IARC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IAC/C,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;2DACa;AAqBf;IAJC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IACtD,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IACnD,IAAA,2BAAS,EAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IACnE,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;;iEAClD;AAGvB;;;;;;;;;;;GAWG;AACH,MAAa,oCAAoC;IAC/C;;;OAGG;IACH,OAAO,CAAW;CACnB;AAND,oFAMC"}

package/dist/dto/index.d.ts

@@ -59,6 +59,7 @@ export * from './logout-session-response.dto';
 export * from './set-must-change-password.dto';
 export * from './set-must-change-password-response.dto';
 export * from './admin-set-password.dto';
+export * from './admin-reset-password.dto';
 export * from './trust-device-response.dto';
 export * from './is-trusted-device-response.dto';
 export * from './validate-access-token.dto';

package/dist/dto/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dto/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,kCAAkC,CAAC;AACjD,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,0BAA0B,CAAC;AAEzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sCAAsC,CAAC;AAErD,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dto/index.ts"],"names":[],"mappings":"AACA,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,mCAAmC,CAAC;AAClD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,mBAAmB,CAAC;AAClC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,kCAAkC,CAAC;AACjD,cAAc,sBAAsB,CAAC;AACrC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yCAAyC,CAAC;AACxD,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAE3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sCAAsC,CAAC;AAErD,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC"}

package/dist/dto/index.js

@@ -76,6 +76,7 @@ __exportStar(require("./logout-session-response.dto"), exports);
 __exportStar(require("./set-must-change-password.dto"), exports);
 __exportStar(require("./set-must-change-password-response.dto"), exports);
 __exportStar(require("./admin-set-password.dto"), exports);
+__exportStar(require("./admin-reset-password.dto"), exports);
 // Note: trust-device.dto.ts removed - trustDevice() no longer takes parameters
 __exportStar(require("./trust-device-response.dto"), exports);
 __exportStar(require("./is-trusted-device-response.dto"), exports);

package/dist/dto/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dto/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iBAAiB;AACjB,+CAA6B;AAC7B,qDAAmC;AACnC,4DAA0C;AAC1C,oDAAkC;AAClC,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,8CAA4B;AAC5B,wDAAsC;AACtC,gEAA8C;AAC9C,iEAA+C;AAC/C,sDAAoC;AACpC,oDAAkC;AAClC,uEAAqD;AACrD,uEAAqD;AACrD,qDAAmC;AACnC,qDAAmC;AACnC,4DAA0C;AAC1C,uDAAqC;AACrC,wDAAsC;AACtC,gEAA8C;AAC9C,sDAAoC;AACpC,sDAAoC;AACpC,uDAAqC;AACrC,2DAAyC;AACzC,0DAAwC;AACxC,uDAAqC;AACrC,gEAA8C;AAC9C,2DAAyC;AACzC,oEAAkD;AAClD,8DAA4C;AAC5C,uDAAqC;AACrC,yDAAuC;AACvC,qDAAmC;AACnC,gEAA8C;AAC9C,uDAAqC;AACrC,0DAAwC;AACxC,6DAA2C;AAC3C,kDAAgC;AAChC,wDAAsC;AACtC,wDAAsC;AACtC,gEAA8C;AAC9C,gEAA8C;AAC9C,kEAAgD;AAChD,gEAA8C;AAC9C,oDAAkC;AAClC,6DAA2C;AAC3C,0DAAwC;AACxC,uDAAqC;AACrC,0DAAwC;AACxC,+CAA6B;AAC7B,wDAAsC;AACtC,mDAAiC;AACjC,4DAA0C;AAC1C,0DAAwC;AACxC,mEAAiD;AACjD,uDAAqC;AACrC,gEAA8C;AAC9C,iEAA+C;AAC/C,0EAAwD;AACxD,2DAAyC;AACzC,+EAA+E;AAC/E,8DAA4C;AAC5C,mEAAiD;AACjD,8DAA4C;AAC5C,uEAAqD;AAErD,oDAAkC;AAClC,wDAAsC;AAEtC,+DAA+D;AAC/D,+CAA+C;AAC/C,mCAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dto/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iBAAiB;AACjB,+CAA6B;AAC7B,qDAAmC;AACnC,4DAA0C;AAC1C,oDAAkC;AAClC,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,8CAA4B;AAC5B,wDAAsC;AACtC,gEAA8C;AAC9C,iEAA+C;AAC/C,sDAAoC;AACpC,oDAAkC;AAClC,uEAAqD;AACrD,uEAAqD;AACrD,qDAAmC;AACnC,qDAAmC;AACnC,4DAA0C;AAC1C,uDAAqC;AACrC,wDAAsC;AACtC,gEAA8C;AAC9C,sDAAoC;AACpC,sDAAoC;AACpC,uDAAqC;AACrC,2DAAyC;AACzC,0DAAwC;AACxC,uDAAqC;AACrC,gEAA8C;AAC9C,2DAAyC;AACzC,oEAAkD;AAClD,8DAA4C;AAC5C,uDAAqC;AACrC,yDAAuC;AACvC,qDAAmC;AACnC,gEAA8C;AAC9C,uDAAqC;AACrC,0DAAwC;AACxC,6DAA2C;AAC3C,kDAAgC;AAChC,wDAAsC;AACtC,wDAAsC;AACtC,gEAA8C;AAC9C,gEAA8C;AAC9C,kEAAgD;AAChD,gEAA8C;AAC9C,oDAAkC;AAClC,6DAA2C;AAC3C,0DAAwC;AACxC,uDAAqC;AACrC,0DAAwC;AACxC,+CAA6B;AAC7B,wDAAsC;AACtC,mDAAiC;AACjC,4DAA0C;AAC1C,0DAAwC;AACxC,mEAAiD;AACjD,uDAAqC;AACrC,gEAA8C;AAC9C,iEAA+C;AAC/C,0EAAwD;AACxD,2DAAyC;AACzC,6DAA2C;AAC3C,+EAA+E;AAC/E,8DAA4C;AAC5C,mEAAiD;AACjD,8DAA4C;AAC5C,uEAAqD;AAErD,oDAAkC;AAClC,wDAAsC;AAEtC,+DAA+D;AAC/D,+CAA+C;AAC/C,mCAAmC"}

package/dist/entities/verification-token.entity.d.ts

@@ -30,9 +30,10 @@ export declare class BaseVerificationToken {
      * Token type
      * - 'email': Email verification
      * - 'phone': Phone verification
-     * - 'password_reset': Password reset
+     * - 'password_reset': Password reset (user-initiated)
+     * - 'admin_password_reset': Password reset (admin-initiated)
      */
-    type: 'email' | 'phone' | 'password_reset';
+    type: 'email' | 'phone' | 'password_reset' | 'admin_password_reset';
     /**
      * Verification token (hashed for security)
      * Used for magic links and password reset

package/dist/entities/verification-token.entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verification-token.entity.d.ts","sourceRoot":"","sources":["../../src/entities/verification-token.entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;IAChC;;OAEG;IACH,EAAE,EAAG,MAAM,CAAC;IAEZ;;;OAGG;IACH,MAAM,EAAG,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC;;;;;OAKG;IACH,IAAI,EAAG,OAAO,GAAG,OAAO,GAAG,gBAAgB,CAAC;IAE5C;;;OAGG;IACH,KAAK,EAAG,MAAM,CAAC;IAEf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB;;;OAGG;IACH,SAAS,EAAG,IAAI,CAAC;IAEjB;;;OAGG;IACH,QAAQ,EAAG,MAAM,CAAC;IAElB;;;OAGG;IACH,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE1C;;OAEG;IACH,SAAS,EAAG,IAAI,CAAC;IAEjB;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;;;;;;;;OAWG;IACH,MAAM,IAAI,OAAO;IAIjB;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;CAGlD"}
+{"version":3,"file":"verification-token.entity.d.ts","sourceRoot":"","sources":["../../src/entities/verification-token.entity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,qBAAa,qBAAqB;IAChC;;OAEG;IACH,EAAE,EAAG,MAAM,CAAC;IAEZ;;;OAGG;IACH,MAAM,EAAG,MAAM,CAAC;IAEhB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEnC;;;;;;OAMG;IACH,IAAI,EAAG,OAAO,GAAG,OAAO,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;IAErE;;;OAGG;IACH,KAAK,EAAG,MAAM,CAAC;IAEf;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAErB;;;OAGG;IACH,SAAS,EAAG,IAAI,CAAC;IAEjB;;;OAGG;IACH,QAAQ,EAAG,MAAM,CAAC;IAElB;;;OAGG;IACH,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAErB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE1C;;OAEG;IACH,SAAS,EAAG,IAAI,CAAC;IAEjB;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;;;;;;;;OAWG;IACH,MAAM,IAAI,OAAO;IAIjB;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO;CAGlD"}

package/dist/entities/verification-token.entity.js

@@ -33,7 +33,8 @@ class BaseVerificationToken {
      * Token type
      * - 'email': Email verification
      * - 'phone': Phone verification
-     * - 'password_reset': Password reset
+     * - 'password_reset': Password reset (user-initiated)
+     * - 'admin_password_reset': Password reset (admin-initiated)
      */
     type;
     /**

package/dist/entities/verification-token.entity.js.map

@@ -1 +1 @@
-{"version":3,"file":"verification-token.entity.js","sourceRoot":"","sources":["../../src/entities/verification-token.entity.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;GAUG;AACH,MAAa,qBAAqB;IAChC;;OAEG;IACH,EAAE,CAAU;IAEZ;;;OAGG;IACH,MAAM,CAAU;IAEhB;;;;;OAKG;IACH,kBAAkB,CAAiB;IAEnC;;;;;OAKG;IACH,IAAI,CAAwC;IAE5C;;;OAGG;IACH,KAAK,CAAU;IAEf;;;OAGG;IACH,IAAI,CAAiB;IAErB;;;OAGG;IACH,SAAS,CAAQ;IAEjB;;;OAGG;IACH,QAAQ,CAAU;IAElB;;;OAGG;IACH,MAAM,CAAe;IAErB;;;OAGG;IACH,SAAS,CAAiB;IAE1B;;;OAGG;IACH,SAAS,CAAiB;IAE1B;;;OAGG;IACH,QAAQ,CAAkC;IAE1C;;OAEG;IACH,SAAS,CAAQ;IAEjB;;;;;;;;;;;OAWG;IACH,SAAS;QACP,OAAO,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IAC3D,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,WAAmB;QACrC,OAAO,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IACtC,CAAC;CACF;AAjID,sDAiIC"}
+{"version":3,"file":"verification-token.entity.js","sourceRoot":"","sources":["../../src/entities/verification-token.entity.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;GAUG;AACH,MAAa,qBAAqB;IAChC;;OAEG;IACH,EAAE,CAAU;IAEZ;;;OAGG;IACH,MAAM,CAAU;IAEhB;;;;;OAKG;IACH,kBAAkB,CAAiB;IAEnC;;;;;;OAMG;IACH,IAAI,CAAiE;IAErE;;;OAGG;IACH,KAAK,CAAU;IAEf;;;OAGG;IACH,IAAI,CAAiB;IAErB;;;OAGG;IACH,SAAS,CAAQ;IAEjB;;;OAGG;IACH,QAAQ,CAAU;IAElB;;;OAGG;IACH,MAAM,CAAe;IAErB;;;OAGG;IACH,SAAS,CAAiB;IAE1B;;;OAGG;IACH,SAAS,CAAiB;IAE1B;;;OAGG;IACH,QAAQ,CAAkC;IAE1C;;OAEG;IACH,SAAS,CAAQ;IAEjB;;;;;;;;;;;OAWG;IACH,SAAS;QACP,OAAO,IAAI,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IAC3D,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,WAAmB;QACrC,OAAO,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IACtC,CAAC;CACF;AAlID,sDAkIC"}

package/dist/enums/auth-audit-event-type.enum.d.ts

@@ -95,6 +95,18 @@ export declare enum AuthAuditEventType {
      * Force password change completed
      */
     PASSWORD_FORCE_CHANGE_COMPLETED = "PASSWORD_FORCE_CHANGE_COMPLETED",
+    /**
+     * Admin initiated password reset (code sent to user)
+     */
+    ADMIN_PASSWORD_RESET_INITIATED = "ADMIN_PASSWORD_RESET_INITIATED",
+    /**
+     * Admin-initiated password reset completed successfully
+     */
+    ADMIN_PASSWORD_RESET_COMPLETED = "ADMIN_PASSWORD_RESET_COMPLETED",
+    /**
+     * Admin-initiated password reset failed (invalid code, expired, etc.)
+     */
+    ADMIN_PASSWORD_RESET_FAILED = "ADMIN_PASSWORD_RESET_FAILED",
     /**
      * MFA enabled for user account
      */

package/dist/enums/auth-audit-event-type.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-audit-event-type.enum.d.ts","sourceRoot":"","sources":["../../src/enums/auth-audit-event-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,oBAAY,kBAAkB;IAK5B;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAE/B;;OAEG;IACH,aAAa,kBAAkB;IAE/B;;OAEG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,aAAa,kBAAkB;IAM/B;;OAEG;IACH,eAAe,oBAAoB;IAEnC;;OAEG;IACH,eAAe,oBAAoB;IAEnC;;;;;OAKG;IACH,cAAc,mBAAmB;IAMjC;;OAEG;IACH,gBAAgB,qBAAqB;IAErC;;OAEG;IACH,wBAAwB,6BAA6B;IAErD;;OAEG;IACH,wBAAwB,6BAA6B;IAErD;;OAEG;IACH,yBAAyB,8BAA8B;IAEvD;;OAEG;IACH,+BAA+B,oCAAoC;IAMnE;;OAEG;IACH,WAAW,gBAAgB;IAE3B;;OAEG;IACH,YAAY,iBAAiB;IAE7B;;OAEG;IACH,gBAAgB,qBAAqB;IAErC;;OAEG;IACH,kBAAkB,uBAAuB;IAEzC;;OAEG;IACH,kBAAkB,uBAAuB;IAEzC;;OAEG;IACH,wBAAwB,6BAA6B;IAErD;;OAEG;IACH,uBAAuB,4BAA4B;IAEnD;;OAEG;IACH,qBAAqB,0BAA0B;IAE/C;;OAEG;IACH,qBAAqB,0BAA0B;IAE/C;;OAEG;IACH,0BAA0B,+BAA+B;IAEzD;;OAEG;IACH,oBAAoB,yBAAyB;IAE7C;;OAEG;IACH,4BAA4B,iCAAiC;IAE7D;;OAEG;IACH,cAAc,mBAAmB;IAEjC;;OAEG;IACH,gBAAgB,qBAAqB;IAMrC;;;;;OAKG;IACH,0BAA0B,+BAA+B;IAEzD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAEjD;;;;OAIG;IACH,qBAAqB,0BAA0B;IAM/C;;OAEG;IACH,cAAc,mBAAmB;IAEjC;;OAEG;IACH,4BAA4B,iCAAiC;IAE7D;;OAEG;IACH,yBAAyB,8BAA8B;IAEvD;;OAEG;IACH,cAAc,mBAAmB;IAEjC;;OAEG;IACH,4BAA4B,iCAAiC;IAE7D;;OAEG;IACH,yBAAyB,8BAA8B;IAMvD;;OAEG;IACH,eAAe,oBAAoB;IAEnC;;OAEG;IACH,iBAAiB,sBAAsB;IAEvC;;OAEG;IACH,mBAAmB,wBAAwB;IAE3C;;OAEG;IACH,cAAc,mBAAmB;IAEjC;;OAEG;IACH,gBAAgB,qBAAqB;IAErC;;OAEG;IACH,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IAEnC;;OAEG;IACH,eAAe,oBAAoB;IAMnC;;OAEG;IACH,eAAe,oBAAoB;IAEnC;;OAEG;IACH,aAAa,kBAAkB;IAE/B;;OAEG;IACH,aAAa,kBAAkB;IAE/B;;OAEG;IACH,gBAAgB,qBAAqB;IAMrC;;OAEG;IACH,YAAY,iBAAiB;IAE7B;;OAEG;IACH,qBAAqB,0BAA0B;IAE/C;;OAEG;IACH,uBAAuB,4BAA4B;IAMnD;;OAEG;IACH,iBAAiB,sBAAsB;IAEvC;;OAEG;IACH,mBAAmB,wBAAwB;IAE3C;;OAEG;IACH,wBAAwB,6BAA6B;IAMrD;;OAEG;IACH,mBAAmB,wBAAwB;CAC5C"}
+{"version":3,"file":"auth-audit-event-type.enum.d.ts","sourceRoot":"","sources":["../../src/enums/auth-audit-event-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,oBAAY,kBAAkB;IAK5B;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAE/B;;OAEG;IACH,aAAa,kBAAkB;IAE/B;;OAEG;IACH,YAAY,iBAAiB;IAE7B;;;;;OAKG;IACH,aAAa,kBAAkB;IAM/B;;OAEG;IACH,eAAe,oBAAoB;IAEnC;;OAEG;IACH,eAAe,oBAAoB;IAEnC;;;;;OAKG;IACH,cAAc,mBAAmB;IAMjC;;OAEG;IACH,gBAAgB,qBAAqB;IAErC;;OAEG;IACH,wBAAwB,6BAA6B;IAErD;;OAEG;IACH,wBAAwB,6BAA6B;IAErD;;OAEG;IACH,yBAAyB,8BAA8B;IAEvD;;OAEG;IACH,+BAA+B,oCAAoC;IAEnE;;OAEG;IACH,8BAA8B,mCAAmC;IAEjE;;OAEG;IACH,8BAA8B,mCAAmC;IAEjE;;OAEG;IACH,2BAA2B,gCAAgC;IAM3D;;OAEG;IACH,WAAW,gBAAgB;IAE3B;;OAEG;IACH,YAAY,iBAAiB;IAE7B;;OAEG;IACH,gBAAgB,qBAAqB;IAErC;;OAEG;IACH,kBAAkB,uBAAuB;IAEzC;;OAEG;IACH,kBAAkB,uBAAuB;IAEzC;;OAEG;IACH,wBAAwB,6BAA6B;IAErD;;OAEG;IACH,uBAAuB,4BAA4B;IAEnD;;OAEG;IACH,qBAAqB,0BAA0B;IAE/C;;OAEG;IACH,qBAAqB,0BAA0B;IAE/C;;OAEG;IACH,0BAA0B,+BAA+B;IAEzD;;OAEG;IACH,oBAAoB,yBAAyB;IAE7C;;OAEG;IACH,4BAA4B,iCAAiC;IAE7D;;OAEG;IACH,cAAc,mBAAmB;IAEjC;;OAEG;IACH,gBAAgB,qBAAqB;IAMrC;;;;;OAKG;IACH,0BAA0B,+BAA+B;IAEzD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAEjD;;;;OAIG;IACH,qBAAqB,0BAA0B;IAM/C;;OAEG;IACH,cAAc,mBAAmB;IAEjC;;OAEG;IACH,4BAA4B,iCAAiC;IAE7D;;OAEG;IACH,yBAAyB,8BAA8B;IAEvD;;OAEG;IACH,cAAc,mBAAmB;IAEjC;;OAEG;IACH,4BAA4B,iCAAiC;IAE7D;;OAEG;IACH,yBAAyB,8BAA8B;IAMvD;;OAEG;IACH,eAAe,oBAAoB;IAEnC;;OAEG;IACH,iBAAiB,sBAAsB;IAEvC;;OAEG;IACH,mBAAmB,wBAAwB;IAE3C;;OAEG;IACH,cAAc,mBAAmB;IAEjC;;OAEG;IACH,gBAAgB,qBAAqB;IAErC;;OAEG;IACH,gBAAgB,qBAAqB;IACrC,eAAe,oBAAoB;IAEnC;;OAEG;IACH,eAAe,oBAAoB;IAMnC;;OAEG;IACH,eAAe,oBAAoB;IAEnC;;OAEG;IACH,aAAa,kBAAkB;IAE/B;;OAEG;IACH,aAAa,kBAAkB;IAE/B;;OAEG;IACH,gBAAgB,qBAAqB;IAMrC;;OAEG;IACH,YAAY,iBAAiB;IAE7B;;OAEG;IACH,qBAAqB,0BAA0B;IAE/C;;OAEG;IACH,uBAAuB,4BAA4B;IAMnD;;OAEG;IACH,iBAAiB,sBAAsB;IAEvC;;OAEG;IACH,mBAAmB,wBAAwB;IAE3C;;OAEG;IACH,wBAAwB,6BAA6B;IAMrD;;OAEG;IACH,mBAAmB,wBAAwB;CAC5C"}

package/dist/enums/auth-audit-event-type.enum.js

@@ -108,6 +108,18 @@ var AuthAuditEventType;
      * Force password change completed
      */
     AuthAuditEventType["PASSWORD_FORCE_CHANGE_COMPLETED"] = "PASSWORD_FORCE_CHANGE_COMPLETED";
+    /**
+     * Admin initiated password reset (code sent to user)
+     */
+    AuthAuditEventType["ADMIN_PASSWORD_RESET_INITIATED"] = "ADMIN_PASSWORD_RESET_INITIATED";
+    /**
+     * Admin-initiated password reset completed successfully
+     */
+    AuthAuditEventType["ADMIN_PASSWORD_RESET_COMPLETED"] = "ADMIN_PASSWORD_RESET_COMPLETED";
+    /**
+     * Admin-initiated password reset failed (invalid code, expired, etc.)
+     */
+    AuthAuditEventType["ADMIN_PASSWORD_RESET_FAILED"] = "ADMIN_PASSWORD_RESET_FAILED";
     // ============================================================================
     // Multi-Factor Authentication (MFA) Events
     // ============================================================================

package/dist/enums/auth-audit-event-type.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-audit-event-type.enum.js","sourceRoot":"","sources":["../../src/enums/auth-audit-event-type.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,IAAY,kBA2UX;AA3UD,WAAY,kBAAkB;IAC5B,+EAA+E;IAC/E,eAAe;IACf,+EAA+E;IAE/E;;;;;;;;;;OAUG;IACH,qDAA+B,CAAA;IAE/B;;OAEG;IACH,qDAA+B,CAAA;IAE/B;;OAEG;IACH,mDAA6B,CAAA;IAE7B;;;;;OAKG;IACH,qDAA+B,CAAA;IAE/B,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAE/E;;OAEG;IACH,yDAAmC,CAAA;IAEnC;;OAEG;IACH,yDAAmC,CAAA;IAEnC;;;;;OAKG;IACH,uDAAiC,CAAA;IAEjC,+EAA+E;IAC/E,kBAAkB;IAClB,+EAA+E;IAE/E;;OAEG;IACH,2DAAqC,CAAA;IAErC;;OAEG;IACH,2EAAqD,CAAA;IAErD;;OAEG;IACH,2EAAqD,CAAA;IAErD;;OAEG;IACH,6EAAuD,CAAA;IAEvD;;OAEG;IACH,yFAAmE,CAAA;IAEnE,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;OAEG;IACH,iDAA2B,CAAA;IAE3B;;OAEG;IACH,mDAA6B,CAAA;IAE7B;;OAEG;IACH,2DAAqC,CAAA;IAErC;;OAEG;IACH,+DAAyC,CAAA;IAEzC;;OAEG;IACH,+DAAyC,CAAA;IAEzC;;OAEG;IACH,2EAAqD,CAAA;IAErD;;OAEG;IACH,yEAAmD,CAAA;IAEnD;;OAEG;IACH,qEAA+C,CAAA;IAE/C;;OAEG;IACH,qEAA+C,CAAA;IAE/C;;OAEG;IACH,+EAAyD,CAAA;IAEzD;;OAEG;IACH,mEAA6C,CAAA;IAE7C;;OAEG;IACH,mFAA6D,CAAA;IAE7D;;OAEG;IACH,uDAAiC,CAAA;IAEjC;;OAEG;IACH,2DAAqC,CAAA;IAErC,+EAA+E;IAC/E,mCAAmC;IACnC,+EAA+E;IAE/E;;;;;OAKG;IACH,+EAAyD,CAAA;IAEzD;;;;OAIG;IACH,uEAAiD,CAAA;IAEjD;;;;OAIG;IACH,qEAA+C,CAAA;IAE/C,+EAA+E;IAC/E,sBAAsB;IACtB,+EAA+E;IAE/E;;OAEG;IACH,uDAAiC,CAAA;IAEjC;;OAEG;IACH,mFAA6D,CAAA;IAE7D;;OAEG;IACH,6EAAuD,CAAA;IAEvD;;OAEG;IACH,uDAAiC,CAAA;IAEjC;;OAEG;IACH,mFAA6D,CAAA;IAE7D;;OAEG;IACH,6EAAuD,CAAA;IAEvD,+EAA+E;IAC/E,4BAA4B;IAC5B,+EAA+E;IAE/E;;OAEG;IACH,yDAAmC,CAAA;IAEnC;;OAEG;IACH,6DAAuC,CAAA;IAEvC;;OAEG;IACH,iEAA2C,CAAA;IAE3C;;OAEG;IACH,uDAAiC,CAAA;IAEjC;;OAEG;IACH,2DAAqC,CAAA;IAErC;;OAEG;IACH,2DAAqC,CAAA;IACrC,yDAAmC,CAAA;IAEnC;;OAEG;IACH,yDAAmC,CAAA;IAEnC,+EAA+E;IAC/E,wBAAwB;IACxB,+EAA+E;IAE/E;;OAEG;IACH,yDAAmC,CAAA;IAEnC;;OAEG;IACH,qDAA+B,CAAA;IAE/B;;OAEG;IACH,qDAA+B,CAAA;IAE/B;;OAEG;IACH,2DAAqC,CAAA;IAErC,+EAA+E;IAC/E,+BAA+B;IAC/B,+EAA+E;IAE/E;;OAEG;IACH,mDAA6B,CAAA;IAE7B;;OAEG;IACH,qEAA+C,CAAA;IAE/C;;OAEG;IACH,yEAAmD,CAAA;IAEnD,+EAA+E;IAC/E,wBAAwB;IACxB,+EAA+E;IAE/E;;OAEG;IACH,6DAAuC,CAAA;IAEvC;;OAEG;IACH,iEAA2C,CAAA;IAE3C;;OAEG;IACH,2EAAqD,CAAA;IAErD,+EAA+E;IAC/E,kBAAkB;IAClB,+EAA+E;IAE/E;;OAEG;IACH,iEAA2C,CAAA;AAC7C,CAAC,EA3UW,kBAAkB,kCAAlB,kBAAkB,QA2U7B"}
+{"version":3,"file":"auth-audit-event-type.enum.js","sourceRoot":"","sources":["../../src/enums/auth-audit-event-type.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,IAAY,kBA0VX;AA1VD,WAAY,kBAAkB;IAC5B,+EAA+E;IAC/E,eAAe;IACf,+EAA+E;IAE/E;;;;;;;;;;OAUG;IACH,qDAA+B,CAAA;IAE/B;;OAEG;IACH,qDAA+B,CAAA;IAE/B;;OAEG;IACH,mDAA6B,CAAA;IAE7B;;;;;OAKG;IACH,qDAA+B,CAAA;IAE/B,+EAA+E;IAC/E,iBAAiB;IACjB,+EAA+E;IAE/E;;OAEG;IACH,yDAAmC,CAAA;IAEnC;;OAEG;IACH,yDAAmC,CAAA;IAEnC;;;;;OAKG;IACH,uDAAiC,CAAA;IAEjC,+EAA+E;IAC/E,kBAAkB;IAClB,+EAA+E;IAE/E;;OAEG;IACH,2DAAqC,CAAA;IAErC;;OAEG;IACH,2EAAqD,CAAA;IAErD;;OAEG;IACH,2EAAqD,CAAA;IAErD;;OAEG;IACH,6EAAuD,CAAA;IAEvD;;OAEG;IACH,yFAAmE,CAAA;IAEnE;;OAEG;IACH,uFAAiE,CAAA;IAEjE;;OAEG;IACH,uFAAiE,CAAA;IAEjE;;OAEG;IACH,iFAA2D,CAAA;IAE3D,+EAA+E;IAC/E,2CAA2C;IAC3C,+EAA+E;IAE/E;;OAEG;IACH,iDAA2B,CAAA;IAE3B;;OAEG;IACH,mDAA6B,CAAA;IAE7B;;OAEG;IACH,2DAAqC,CAAA;IAErC;;OAEG;IACH,+DAAyC,CAAA;IAEzC;;OAEG;IACH,+DAAyC,CAAA;IAEzC;;OAEG;IACH,2EAAqD,CAAA;IAErD;;OAEG;IACH,yEAAmD,CAAA;IAEnD;;OAEG;IACH,qEAA+C,CAAA;IAE/C;;OAEG;IACH,qEAA+C,CAAA;IAE/C;;OAEG;IACH,+EAAyD,CAAA;IAEzD;;OAEG;IACH,mEAA6C,CAAA;IAE7C;;OAEG;IACH,mFAA6D,CAAA;IAE7D;;OAEG;IACH,uDAAiC,CAAA;IAEjC;;OAEG;IACH,2DAAqC,CAAA;IAErC,+EAA+E;IAC/E,mCAAmC;IACnC,+EAA+E;IAE/E;;;;;OAKG;IACH,+EAAyD,CAAA;IAEzD;;;;OAIG;IACH,uEAAiD,CAAA;IAEjD;;;;OAIG;IACH,qEAA+C,CAAA;IAE/C,+EAA+E;IAC/E,sBAAsB;IACtB,+EAA+E;IAE/E;;OAEG;IACH,uDAAiC,CAAA;IAEjC;;OAEG;IACH,mFAA6D,CAAA;IAE7D;;OAEG;IACH,6EAAuD,CAAA;IAEvD;;OAEG;IACH,uDAAiC,CAAA;IAEjC;;OAEG;IACH,mFAA6D,CAAA;IAE7D;;OAEG;IACH,6EAAuD,CAAA;IAEvD,+EAA+E;IAC/E,4BAA4B;IAC5B,+EAA+E;IAE/E;;OAEG;IACH,yDAAmC,CAAA;IAEnC;;OAEG;IACH,6DAAuC,CAAA;IAEvC;;OAEG;IACH,iEAA2C,CAAA;IAE3C;;OAEG;IACH,uDAAiC,CAAA;IAEjC;;OAEG;IACH,2DAAqC,CAAA;IAErC;;OAEG;IACH,2DAAqC,CAAA;IACrC,yDAAmC,CAAA;IAEnC;;OAEG;IACH,yDAAmC,CAAA;IAEnC,+EAA+E;IAC/E,wBAAwB;IACxB,+EAA+E;IAE/E;;OAEG;IACH,yDAAmC,CAAA;IAEnC;;OAEG;IACH,qDAA+B,CAAA;IAE/B;;OAEG;IACH,qDAA+B,CAAA;IAE/B;;OAEG;IACH,2DAAqC,CAAA;IAErC,+EAA+E;IAC/E,+BAA+B;IAC/B,+EAA+E;IAE/E;;OAEG;IACH,mDAA6B,CAAA;IAE7B;;OAEG;IACH,qEAA+C,CAAA;IAE/C;;OAEG;IACH,yEAAmD,CAAA;IAEnD,+EAA+E;IAC/E,wBAAwB;IACxB,+EAA+E;IAE/E;;OAEG;IACH,6DAAuC,CAAA;IAEvC;;OAEG;IACH,iEAA2C,CAAA;IAE3C;;OAEG;IACH,2EAAqD,CAAA;IAErD,+EAA+E;IAC/E,kBAAkB;IAClB,+EAA+E;IAE/E;;OAEG;IACH,iEAA2C,CAAA;AAC7C,CAAC,EA1VW,kBAAkB,kCAAlB,kBAAkB,QA0V7B"}

package/dist/handlers/csrf.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.handler.d.ts","sourceRoot":"","sources":["../../src/handlers/csrf.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAiC,WAAW,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKrE;;;;GAIG;AACH,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAFP,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,WAAW,EACnB,MAAM,CAAC,EAAE,WAAW,YAAA;IAGvC;;;;OAIG;IACU,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC3G;;OAEG;YACW,sBAAsB;IAsCpC;;;;;OAKG;YACW,aAAa;CA0C5B"}
+{"version":3,"file":"csrf.handler.d.ts","sourceRoot":"","sources":["../../src/handlers/csrf.handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,WAAW,EAAiC,WAAW,EAAE,MAAM,UAAU,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAKrE;;;;GAIG;AACH,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAFP,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,WAAW,EACnB,MAAM,CAAC,EAAE,WAAW,YAAA;IAGvC;;;;OAIG;IACU,MAAM,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IA8C3G;;OAEG;YACW,sBAAsB;IAsCpC;;;;;OAKG;YACW,aAAa;CA0C5B"}

package/dist/handlers/csrf.handler.js

@@ -16,7 +16,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CsrfHandler = void 0;
 const index_1 = require("../index");
 /** HTTP methods that don't require CSRF validation */
-const SAFE_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+const SAFE_METHODS = ['GET', 'HEAD'];
 /**
  * CsrfHandler
  *
@@ -43,6 +43,17 @@ class CsrfHandler {
             await next();
             return;
         }
+        // ============================================================================
+        // IMPORTANT: Never generate CSRF cookies on CORS preflight (OPTIONS)
+        // ============================================================================
+        // Browsers typically do NOT include cookies on preflight requests.
+        // If we generated a CSRF cookie here, we'd rotate the token between the time
+        // the client reads document.cookie (to set the header) and the actual request
+        // is sent, causing intermittent CSRF mismatches.
+        if (req.method === 'OPTIONS') {
+            await next();
+            return;
+        }
         // Safe methods: Generate token if missing
         if (SAFE_METHODS.includes(req.method)) {
             await this.generateTokenIfMissing(req, res);

package/dist/handlers/csrf.handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.handler.js","sourceRoot":"","sources":["../../src/handlers/csrf.handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,oCAAmF;AAInF,sDAAsD;AACtD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAa,WAAW;IAEH;IACA;IACA;IAHnB,YACmB,WAAwB,EACxB,MAAmB,EACnB,MAAoB;QAFpB,gBAAW,GAAX,WAAW,CAAa;QACxB,WAAM,GAAN,MAAM,CAAa;QACnB,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,GAAiB,EAAE,GAAkB,EAAE,IAAgC;QACzF,kDAAkD;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,IAAI,MAAM,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,0CAA0C;QAC1C,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC;QACtE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAiB,EAAE,GAAkB;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,aAAa,EAAE,CAAC;YAClB,+CAA+C;YAC/C,OAAO,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YACrC,OAAO;QACT,CAAC;QAED,qBAAqB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QAE/C,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAE9D,uBAAuB;QACvB,MAAM,aAAa,GAAG;YACpB,gFAAgF;YAChF,0FAA0F;YAC1F,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,IAAI,KAAK;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM,IAAI,IAAI;YAChE,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,IAAI,QAAQ,CAA8B;YACvG,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM;YACxD,IAAI,EAAE,GAAG;YACT,GAAG,iBAAiB;SACrB,CAAC;QAEF,aAAa;QACb,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAEhD,kEAAkE;QAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,8BAA8B,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CAAC,GAAiB;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QAEpD,gCAAgC;QAChC,IAAI,gBAAgB,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAClC,2BAA2B;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;YACjD,gBAAgB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAuB,CAAC;QACpG,CAAC;QAED,wBAAwB;QACxB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5C,iCAAiC;QACjC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,sBAAc,CAChD,qBAAa,CAAC,kBAAkB,EAChC,gCAAgC,UAAU,0DAA0D,UAAU,UAAU,CACzH,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,sBAAc,CAChD,qBAAa,CAAC,kBAAkB,EAChC,kEAAkE,CACnE,CAAC;YACF,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,CAAC;QAEtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,sBAAc,CAAC,qBAAa,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,mCAAmC,CAAC,CAAC;IAC5D,CAAC;CACF;AAvID,kCAuIC"}
+{"version":3,"file":"csrf.handler.js","sourceRoot":"","sources":["../../src/handlers/csrf.handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,oCAAmF;AAInF,sDAAsD;AACtD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAErC;;;;GAIG;AACH,MAAa,WAAW;IAEH;IACA;IACA;IAHnB,YACmB,WAAwB,EACxB,MAAmB,EACnB,MAAoB;QAFpB,gBAAW,GAAX,WAAW,CAAa;QACxB,WAAM,GAAN,MAAM,CAAa;QACnB,WAAM,GAAN,MAAM,CAAc;IACpC,CAAC;IAEJ;;;;OAIG;IACI,KAAK,CAAC,MAAM,CAAC,GAAiB,EAAE,GAAkB,EAAE,IAAgC;QACzF,kDAAkD;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,IAAI,MAAM,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,+EAA+E;QAC/E,qEAAqE;QACrE,+EAA+E;QAC/E,mEAAmE;QACnE,6EAA6E;QAC7E,8EAA8E;QAC9E,iDAAiD;QACjD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,0CAA0C;QAC1C,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,IAAI,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,sBAAsB;QACtB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAI,EAAE,CAAC;QACtE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAE9B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAiB,EAAE,GAAkB;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,aAAa,EAAE,CAAC;YAClB,+CAA+C;YAC/C,OAAO,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC;YACrC,OAAO;QACT,CAAC;QAED,qBAAqB;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QAE/C,wEAAwE;QACxE,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAE9D,uBAAuB;QACvB,MAAM,aAAa,GAAG;YACpB,gFAAgF;YAChF,0FAA0F;YAC1F,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,IAAI,KAAK;YAC7C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM,IAAI,IAAI;YAChE,QAAQ,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,IAAI,QAAQ,CAA8B;YACvG,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,MAAM;YACxD,IAAI,EAAE,GAAG;YACT,GAAG,iBAAiB;SACrB,CAAC;QAEF,aAAa;QACb,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAEhD,kEAAkE;QAClE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;QAEpD,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,8BAA8B,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,aAAa,CAAC,GAAiB;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QAEpD,gCAAgC;QAChC,IAAI,gBAAgB,GAAG,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAClC,2BAA2B;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;YACjD,gBAAgB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAuB,CAAC;QACpG,CAAC;QAED,wBAAwB;QACxB,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAE5C,iCAAiC;QACjC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,sBAAc,CAChD,qBAAa,CAAC,kBAAkB,EAChC,gCAAgC,UAAU,0DAA0D,UAAU,UAAU,CACzH,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,sBAAc,CAChD,qBAAa,CAAC,kBAAkB,EAChC,kEAAkE,CACnE,CAAC;YACF,OAAO;QACT,CAAC;QAED,yBAAyB;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,CAAC;QAEtF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,sBAAc,CAAC,qBAAa,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,mCAAmC,CAAC,CAAC;IAC5D,CAAC;CACF;AAnJD,kCAmJC"}

package/dist/interfaces/config.interface.d.ts

@@ -793,6 +793,31 @@ export interface PasswordConfig {
          */
         maxAttempts?: number;
     };
+    /**
+     * Admin password reset configuration
+     *
+     * Controls admin-initiated password reset verification code behavior.
+     * Admin resets have longer expiry (default 1 hour vs 15 min) and no rate limiting.
+     *
+     * Note: Defaults are applied in service layer when not provided.
+     */
+    adminPasswordReset?: {
+        /**
+         * Verification code length
+         * @default 6
+         */
+        codeLength?: number;
+        /**
+         * Code expiry in seconds
+         * @default 3600 (1 hour - longer than user-initiated 15 min)
+         */
+        expiresIn?: number;
+        /**
+         * Maximum code verification attempts per code
+         * @default 3
+         */
+        maxAttempts?: number;
+    };
 }
 export interface LockoutConfig {
     /**