@nauth-toolkit/core 0.1.87 → 0.1.88

package/dist/dto/logout-all-response.dto.js

@@ -7,7 +7,7 @@
  *
  * @example
  * ```typescript
- * const result = await authService.logoutAll({ sub: 'user-uuid' });
+ * const result = await authService.logoutAll({ forgetDevices: true });
  * // Returns: { revokedCount: 5 }
  * ```
  */

package/dist/dto/logout-all.dto.d.ts

@@ -4,7 +4,7 @@
  * Request DTO for logging out a user from all sessions (global logout).
  *
  * Security:
- * - User sub validated (UUID)
+ * - Uses authenticated user context for sub
  * - Prevents unauthorized logout attempts
  *
  * @example
@@ -18,23 +18,6 @@
  * Request DTO for logout all sessions
  */
 export declare class LogoutAllDTO {
-    /**
-     * User's unique identifier (UUID v4)
-     *
-     * Optional at controller level - filled from authenticated user's JWT.
-     * Validated only when provided (service layer will ensure it's set).
-     *
-     * Validation:
-     * - Must be a valid UUID v4 format when provided
-     * - Matches DB constraint: char(36) or uuid
-     *
-     * Sanitization:
-     * - Trimmed
-     * - Lowercased for consistency
-     *
-     * @example "a21b654c-2746-4168-acee-c175083a65cd"
-     */
-    sub?: string;
     /**
      * Whether to also forget/revoke all trusted devices
      *

package/dist/dto/logout-all.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout-all.dto.d.ts","sourceRoot":"","sources":["../../src/dto/logout-all.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;GAEG;AACH,qBAAa,YAAY;IACvB;;;;;;;;;;;;;;;OAeG;IAUH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;;;;;;OASG;IAQH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB"}
+{"version":3,"file":"logout-all.dto.d.ts","sourceRoot":"","sources":["../../src/dto/logout-all.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;GAEG;AACH,qBAAa,YAAY;IACvB;;;;;;;;;OASG;IAQH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB"}

package/dist/dto/logout-all.dto.js

@@ -5,7 +5,7 @@
  * Request DTO for logging out a user from all sessions (global logout).
  *
  * Security:
- * - User sub validated (UUID)
+ * - Uses authenticated user context for sub
  * - Prevents unauthorized logout attempts
  *
  * @example
@@ -32,23 +32,6 @@ const class_transformer_1 = require("class-transformer");
  * Request DTO for logout all sessions
  */
 class LogoutAllDTO {
-    /**
-     * User's unique identifier (UUID v4)
-     *
-     * Optional at controller level - filled from authenticated user's JWT.
-     * Validated only when provided (service layer will ensure it's set).
-     *
-     * Validation:
-     * - Must be a valid UUID v4 format when provided
-     * - Matches DB constraint: char(36) or uuid
-     *
-     * Sanitization:
-     * - Trimmed
-     * - Lowercased for consistency
-     *
-     * @example "a21b654c-2746-4168-acee-c175083a65cd"
-     */
-    sub;
     /**
      * Whether to also forget/revoke all trusted devices
      *
@@ -62,18 +45,6 @@ class LogoutAllDTO {
     forgetDevices;
 }
 exports.LogoutAllDTO = LogoutAllDTO;
-__decorate([
-    (0, class_validator_1.ValidateIf)((o) => o.sub !== undefined && o.sub !== null && o.sub !== ''),
-    (0, class_validator_1.IsUUID)('4', { message: 'User sub must be a valid UUID v4 format' }),
-    (0, class_transformer_1.Transform)(({ value }) => {
-        if (typeof value === 'string') {
-            return value.trim().toLowerCase();
-        }
-        return value;
-    }),
-    (0, class_validator_1.IsOptional)(),
-    __metadata("design:type", String)
-], LogoutAllDTO.prototype, "sub", void 0);
 __decorate([
     (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsBoolean)(),

package/dist/dto/logout-all.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout-all.dto.js","sourceRoot":"","sources":["../../src/dto/logout-all.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;AAEH,qDAA4E;AAC5E,yDAA8C;AAE9C;;GAEG;AACH,MAAa,YAAY;IACvB;;;;;;;;;;;;;;;OAeG;IAUH,GAAG,CAAU;IAEb;;;;;;;;;OASG;IAQH,aAAa,CAAW;CACzB;AA9CD,oCA8CC;AApBC;IATC,IAAA,4BAAU,EAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC;IACxE,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACD,IAAA,4BAAU,GAAE;;yCACA;AAmBb;IAPC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;IACX,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACnD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;mDACsB"}
+{"version":3,"file":"logout-all.dto.js","sourceRoot":"","sources":["../../src/dto/logout-all.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;AAEH,qDAAwD;AACxD,yDAA8C;AAE9C;;GAEG;AACH,MAAa,YAAY;IACvB;;;;;;;;;OASG;IAQH,aAAa,CAAW;CACzB;AAnBD,oCAmBC;AADC;IAPC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;IACX,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACnD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;mDACsB"}

package/dist/dto/logout-session.dto.d.ts

@@ -4,16 +4,11 @@
  * @example
  * ```typescript
  * const dto = new LogoutSessionDTO();
- * dto.sub = 'user-uuid-123';
  * dto.sessionId = '456';
  * await authService.logoutSession(dto);
  * ```
  */
 export declare class LogoutSessionDTO {
-    /**
-     * User sub (UUID) - must match the session owner
-     */
-    sub: string;
     /**
      * Session ID to revoke
      */

package/dist/dto/logout-session.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout-session.dto.d.ts","sourceRoot":"","sources":["../../src/dto/logout-session.dto.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,qBAAa,gBAAgB;IAC3B;;OAEG;IAIH,GAAG,EAAG,MAAM,CAAC;IAEb;;OAEG;IAGH,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"logout-session.dto.d.ts","sourceRoot":"","sources":["../../src/dto/logout-session.dto.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,qBAAa,gBAAgB;IAC3B;;OAEG;IAGH,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/dto/logout-session.dto.js

@@ -11,35 +11,23 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LogoutSessionDTO = void 0;
 const class_validator_1 = require("class-validator");
-const class_transformer_1 = require("class-transformer");
 /**
  * DTO for logging out a specific session
  *
  * @example
  * ```typescript
  * const dto = new LogoutSessionDTO();
- * dto.sub = 'user-uuid-123';
  * dto.sessionId = '456';
  * await authService.logoutSession(dto);
  * ```
  */
 class LogoutSessionDTO {
-    /**
-     * User sub (UUID) - must match the session owner
-     */
-    sub;
     /**
      * Session ID to revoke
      */
     sessionId;
 }
 exports.LogoutSessionDTO = LogoutSessionDTO;
-__decorate([
-    (0, class_validator_1.IsUUID)('4'),
-    (0, class_validator_1.IsNotEmpty)(),
-    (0, class_transformer_1.Transform)(({ value }) => value?.trim().toLowerCase()),
-    __metadata("design:type", String)
-], LogoutSessionDTO.prototype, "sub", void 0);
 __decorate([
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),

package/dist/dto/logout-session.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout-session.dto.js","sourceRoot":"","sources":["../../src/dto/logout-session.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA+D;AAC/D,yDAA8C;AAE9C;;;;;;;;;;GAUG;AACH,MAAa,gBAAgB;IAC3B;;OAEG;IAIH,GAAG,CAAU;IAEb;;OAEG;IAGH,SAAS,CAAU;CACpB;AAfD,4CAeC;AARC;IAHC,IAAA,wBAAM,EAAC,GAAG,CAAC;IACX,IAAA,4BAAU,GAAE;IACZ,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;;6CACzC;AAOb;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;mDACM"}
+{"version":3,"file":"logout-session.dto.js","sourceRoot":"","sources":["../../src/dto/logout-session.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAuD;AAEvD;;;;;;;;;GASG;AACH,MAAa,gBAAgB;IAC3B;;OAEG;IAGH,SAAS,CAAU;CACpB;AAPD,4CAOC;AADC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;mDACM"}

package/dist/dto/logout.dto.d.ts

@@ -5,7 +5,7 @@
  *
  * Security:
  * - Session ID is automatically extracted from JWT token context (via ClientInfoService)
- * - User sub validated (UUID) - optional, for additional verification
+ * - Uses authenticated user context for sub
  * - Prevents unauthorized logout attempts
  *
  * @example
@@ -19,23 +19,6 @@
  * Request DTO for logout
  */
 export declare class LogoutDTO {
-    /**
-     * User's unique identifier (UUID v4) - Optional
-     *
-     * If provided, validates that the authenticated user matches this sub.
-     * Session ID is automatically extracted from JWT token context.
-     *
-     * Validation:
-     * - Must be a valid UUID v4 format if provided
-     * - Matches DB constraint: char(36) or uuid
-     *
-     * Sanitization:
-     * - Trimmed
-     * - Lowercased for consistency
-     *
-     * @example "a21b654c-2746-4168-acee-c175083a65cd"
-     */
-    sub?: string;
     /**
      * If true, also removes trusted device
      *

package/dist/dto/logout.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.dto.d.ts","sourceRoot":"","sources":["../../src/dto/logout.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH;;GAEG;AACH,qBAAa,SAAS;IACpB;;;;;;;;;;;;;;;OAeG;IASH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IAGH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"logout.dto.d.ts","sourceRoot":"","sources":["../../src/dto/logout.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;GAEG;AACH,qBAAa,SAAS;IACpB;;;;;;;;OAQG;IAGH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB"}

package/dist/dto/logout.dto.js

@@ -6,7 +6,7 @@
  *
  * Security:
  * - Session ID is automatically extracted from JWT token context (via ClientInfoService)
- * - User sub validated (UUID) - optional, for additional verification
+ * - Uses authenticated user context for sub
  * - Prevents unauthorized logout attempts
  *
  * @example
@@ -28,28 +28,10 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LogoutDTO = void 0;
 const class_validator_1 = require("class-validator");
-const class_transformer_1 = require("class-transformer");
 /**
  * Request DTO for logout
  */
 class LogoutDTO {
-    /**
-     * User's unique identifier (UUID v4) - Optional
-     *
-     * If provided, validates that the authenticated user matches this sub.
-     * Session ID is automatically extracted from JWT token context.
-     *
-     * Validation:
-     * - Must be a valid UUID v4 format if provided
-     * - Matches DB constraint: char(36) or uuid
-     *
-     * Sanitization:
-     * - Trimmed
-     * - Lowercased for consistency
-     *
-     * @example "a21b654c-2746-4168-acee-c175083a65cd"
-     */
-    sub;
     /**
      * If true, also removes trusted device
      *
@@ -62,17 +44,6 @@ class LogoutDTO {
     forgetMe;
 }
 exports.LogoutDTO = LogoutDTO;
-__decorate([
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsUUID)('4', { message: 'User sub must be a valid UUID v4 format' }),
-    (0, class_transformer_1.Transform)(({ value }) => {
-        if (typeof value === 'string') {
-            return value.trim().toLowerCase();
-        }
-        return value;
-    }),
-    __metadata("design:type", String)
-], LogoutDTO.prototype, "sub", void 0);
 __decorate([
     (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsBoolean)({ message: 'forgetMe must be a boolean' }),

package/dist/dto/logout.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.dto.js","sourceRoot":"","sources":["../../src/dto/logout.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;AAEH,qDAAgE;AAChE,yDAA8C;AAE9C;;GAEG;AACH,MAAa,SAAS;IACpB;;;;;;;;;;;;;;;OAeG;IASH,GAAG,CAAU;IAEb;;;;;;;;OAQG;IAGH,QAAQ,CAAW;CACpB;AAvCD,8BAuCC;AAdC;IARC,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;sCACW;AAab;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;;2CAClC"}
+{"version":3,"file":"logout.dto.js","sourceRoot":"","sources":["../../src/dto/logout.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;AAEH,qDAAwD;AAExD;;GAEG;AACH,MAAa,SAAS;IACpB;;;;;;;;OAQG;IAGH,QAAQ,CAAW;CACpB;AAbD,8BAaC;AADC;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;;2CAClC"}

package/dist/dto/remove-devices.dto.d.ts

@@ -1,35 +1,23 @@
 /**
  * DTO for removing MFA devices
  *
- * Used to remove all MFA devices of a specific method type for a user.
+ * Used to remove all MFA devices of a specific method type for the current authenticated user.
  * Automatically disables MFA if this was the last device.
+ * User sub is obtained from authenticated context automatically.
  *
  * @example
  * ```typescript
  * const result = await mfaService.removeDevices({
- *   userSub: 'user-uuid',
  *   methodType: 'totp'
  * });
  * ```
  */
 /**
  * DTO for removing MFA devices
+ *
+ * User self-service DTO - no userSub field. Service gets user from authenticated context.
  */
 export declare class RemoveDevicesDTO {
-    /**
-     * User's unique identifier (UUID v4)
-     *
-     * Validation:
-     * - Must be a valid UUID v4 format
-     * - Matches DB constraint: char(36) or uuid
-     *
-     * Sanitization:
-     * - Trimmed
-     * - Lowercased for consistency
-     *
-     * @example "a21b654c-2746-4168-acee-c175083a65cd"
-     */
-    userSub: string;
     /**
      * MFA method type to remove
      *

package/dist/dto/remove-devices.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-devices.dto.d.ts","sourceRoot":"","sources":["../../src/dto/remove-devices.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;GAEG;AACH,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;;OAYG;IAQH,OAAO,EAAG,MAAM,CAAC;IAEjB;;;;;;;;;;;OAWG;IAYH,UAAU,EAAG,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,wBAAwB;IACnC;;OAEG;IACH,YAAY,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACH,WAAW,EAAG,OAAO,CAAC;CACvB"}
+{"version":3,"file":"remove-devices.dto.d.ts","sourceRoot":"","sources":["../../src/dto/remove-devices.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;;;GAIG;AACH,qBAAa,gBAAgB;IAE3B;;;;;;;;;;;OAWG;IAYH,UAAU,EAAG,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,wBAAwB;IACnC;;OAEG;IACH,YAAY,EAAG,MAAM,CAAC;IAEtB;;OAEG;IACH,WAAW,EAAG,OAAO,CAAC;CACvB"}

package/dist/dto/remove-devices.dto.js

@@ -2,13 +2,13 @@
 /**
  * DTO for removing MFA devices
  *
- * Used to remove all MFA devices of a specific method type for a user.
+ * Used to remove all MFA devices of a specific method type for the current authenticated user.
  * Automatically disables MFA if this was the last device.
+ * User sub is obtained from authenticated context automatically.
  *
  * @example
  * ```typescript
  * const result = await mfaService.removeDevices({
- *   userSub: 'user-uuid',
  *   methodType: 'totp'
  * });
  * ```
@@ -29,22 +29,10 @@ const class_transformer_1 = require("class-transformer");
 const mfa_method_enum_1 = require("../enums/mfa-method.enum");
 /**
  * DTO for removing MFA devices
+ *
+ * User self-service DTO - no userSub field. Service gets user from authenticated context.
  */
 class RemoveDevicesDTO {
-    /**
-     * User's unique identifier (UUID v4)
-     *
-     * Validation:
-     * - Must be a valid UUID v4 format
-     * - Matches DB constraint: char(36) or uuid
-     *
-     * Sanitization:
-     * - Trimmed
-     * - Lowercased for consistency
-     *
-     * @example "a21b654c-2746-4168-acee-c175083a65cd"
-     */
-    userSub;
     /**
      * MFA method type to remove
      *
@@ -60,16 +48,6 @@ class RemoveDevicesDTO {
     methodType;
 }
 exports.RemoveDevicesDTO = RemoveDevicesDTO;
-__decorate([
-    (0, class_validator_1.IsUUID)('4', { message: 'User sub must be a valid UUID v4 format' }),
-    (0, class_transformer_1.Transform)(({ value }) => {
-        if (typeof value === 'string') {
-            return value.trim().toLowerCase();
-        }
-        return value;
-    }),
-    __metadata("design:type", String)
-], RemoveDevicesDTO.prototype, "userSub", void 0);
 __decorate([
     (0, class_validator_1.IsString)({ message: 'Method type must be a string' }),
     (0, class_validator_1.IsEnum)([mfa_method_enum_1.MFAMethod.TOTP, mfa_method_enum_1.MFAMethod.SMS, mfa_method_enum_1.MFAMethod.EMAIL, mfa_method_enum_1.MFAMethod.PASSKEY], {

package/dist/dto/remove-devices.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"remove-devices.dto.js","sourceRoot":"","sources":["../../src/dto/remove-devices.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;AAEH,qDAAsE;AACtE,yDAA8C;AAC9C,8DAAqD;AAErD;;GAEG;AACH,MAAa,gBAAgB;IAC3B;;;;;;;;;;;;OAYG;IAQH,OAAO,CAAU;IAEjB;;;;;;;;;;;OAWG;IAYH,UAAU,CAAU;CACrB;AA/CD,4CA+CC;AA1BC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;iDACe;AAyBjB;IAXC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACrD,IAAA,wBAAM,EAAC,CAAC,2BAAS,CAAC,IAAI,EAAE,2BAAS,CAAC,GAAG,EAAE,2BAAS,CAAC,KAAK,EAAE,2BAAS,CAAC,OAAO,CAAC,EAAE;QAC3E,OAAO,EAAE,uDAAuD;KACjE,CAAC;IACD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACvE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;oDACkB;AAGtB;;GAEG;AACH,MAAa,wBAAwB;IACnC;;OAEG;IACH,YAAY,CAAU;IAEtB;;OAEG;IACH,WAAW,CAAW;CACvB;AAVD,4DAUC"}
+{"version":3,"file":"remove-devices.dto.js","sourceRoot":"","sources":["../../src/dto/remove-devices.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;AAEH,qDAA8D;AAC9D,yDAA8C;AAC9C,8DAAqD;AAErD;;;;GAIG;AACH,MAAa,gBAAgB;IAE3B;;;;;;;;;;;OAWG;IAYH,UAAU,CAAU;CACrB;AA1BD,4CA0BC;AADC;IAXC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACrD,IAAA,wBAAM,EAAC,CAAC,2BAAS,CAAC,IAAI,EAAE,2BAAS,CAAC,GAAG,EAAE,2BAAS,CAAC,KAAK,EAAE,2BAAS,CAAC,OAAO,CAAC,EAAE;QAC3E,OAAO,EAAE,uDAAuD;KACjE,CAAC;IACD,IAAA,2BAAS,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACvE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;oDACkB;AAGtB;;GAEG;AACH,MAAa,wBAAwB;IACnC;;OAEG;IACH,YAAY,CAAU;IAEtB;;OAEG;IACH,WAAW,CAAW;CACvB;AAVD,4DAUC"}

package/dist/dto/set-mfa-exemption.dto.d.ts

@@ -7,7 +7,7 @@
  * @example
  * ```typescript
  * const result = await mfaService.setMFAExemption({
- *   identifier: 'user@example.com', // email, username, phone, or user sub (UUID)
+ *   sub: 'a21b654c-2746-4168-acee-c175083a65cd', // User sub (UUID v4)
  *   exempt: true,
  *   reason: 'Business partner requires MFA bypass',
  *   grantedBy: 'admin@example.com'
@@ -21,20 +21,19 @@
  */
 export declare class SetMFAExemptionDTO {
     /**
-     * Target user identifier
+     * User's unique identifier (UUID v4)
      *
-     * Can be any supported identifier:
-     * - user sub (UUID)
-     * - email
-     * - username
-     * - phone (E.164)
+     * Validation:
+     * - Must be a valid UUID v4 format
+     * - Matches DB constraint: char(36) or uuid
      *
      * Sanitization:
      * - Trimmed
+     * - Lowercased for consistency
      *
-     * @example "user@example.com"
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
      */
-    identifier: string;
+    sub: string;
     /**
      * Whether to grant exemption (true) or revoke exemption (false)
      */

package/dist/dto/set-mfa-exemption.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-mfa-exemption.dto.d.ts","sourceRoot":"","sources":["../../src/dto/set-mfa-exemption.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;;;GAIG;AACH,qBAAa,kBAAkB;IAC7B;;;;;;;;;;;;;OAaG;IASH,UAAU,EAAG,MAAM,CAAC;IAEpB;;OAEG;IAEH,MAAM,EAAG,OAAO,CAAC;IAEjB;;;;;;;;OAQG;IAUH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB;;;;;;;;OAQG;IAUH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,SAAS,EAAG,OAAO,CAAC;IAEpB;;OAEG;IACH,eAAe,EAAG,MAAM,GAAG,IAAI,CAAC;IAEhC;;OAEG;IACH,kBAAkB,EAAG,IAAI,GAAG,IAAI,CAAC;CAClC"}
+{"version":3,"file":"set-mfa-exemption.dto.d.ts","sourceRoot":"","sources":["../../src/dto/set-mfa-exemption.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;;;GAIG;AACH,qBAAa,kBAAkB;IAC7B;;;;;;;;;;;;OAYG;IAQH,GAAG,EAAG,MAAM,CAAC;IAEb;;OAEG;IAEH,MAAM,EAAG,OAAO,CAAC;IAEjB;;;;;;;;OAQG;IAUH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB;;;;;;;;OAQG;IAUH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,qBAAa,0BAA0B;IACrC;;OAEG;IACH,SAAS,EAAG,OAAO,CAAC;IAEpB;;OAEG;IACH,eAAe,EAAG,MAAM,GAAG,IAAI,CAAC;IAEhC;;OAEG;IACH,kBAAkB,EAAG,IAAI,GAAG,IAAI,CAAC;CAClC"}

package/dist/dto/set-mfa-exemption.dto.js

@@ -8,7 +8,7 @@
  * @example
  * ```typescript
  * const result = await mfaService.setMFAExemption({
- *   identifier: 'user@example.com', // email, username, phone, or user sub (UUID)
+ *   sub: 'a21b654c-2746-4168-acee-c175083a65cd', // User sub (UUID v4)
  *   exempt: true,
  *   reason: 'Business partner requires MFA bypass',
  *   grantedBy: 'admin@example.com'
@@ -35,20 +35,19 @@ const class_transformer_1 = require("class-transformer");
  */
 class SetMFAExemptionDTO {
     /**
-     * Target user identifier
+     * User's unique identifier (UUID v4)
      *
-     * Can be any supported identifier:
-     * - user sub (UUID)
-     * - email
-     * - username
-     * - phone (E.164)
+     * Validation:
+     * - Must be a valid UUID v4 format
+     * - Matches DB constraint: char(36) or uuid
      *
      * Sanitization:
      * - Trimmed
+     * - Lowercased for consistency
      *
-     * @example "user@example.com"
+     * @example "a21b654c-2746-4168-acee-c175083a65cd"
      */
-    identifier;
+    sub;
     /**
      * Whether to grant exemption (true) or revoke exemption (false)
      */
@@ -76,16 +75,15 @@ class SetMFAExemptionDTO {
 }
 exports.SetMFAExemptionDTO = SetMFAExemptionDTO;
 __decorate([
-    (0, class_validator_1.IsString)({ message: 'Identifier must be a string' }),
-    (0, class_validator_1.MaxLength)(255, { message: 'Identifier must not exceed 255 characters' }),
+    (0, class_validator_1.IsUUID)('4', { message: 'User sub must be a valid UUID v4 format' }),
     (0, class_transformer_1.Transform)(({ value }) => {
         if (typeof value === 'string') {
-            return value.trim();
+            return value.trim().toLowerCase();
         }
         return value;
     }),
     __metadata("design:type", String)
-], SetMFAExemptionDTO.prototype, "identifier", void 0);
+], SetMFAExemptionDTO.prototype, "sub", void 0);
 __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Exempt must be a boolean' }),
     __metadata("design:type", Boolean)

package/dist/dto/set-mfa-exemption.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"set-mfa-exemption.dto.js","sourceRoot":"","sources":["../../src/dto/set-mfa-exemption.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;AAEH,qDAA6E;AAC7E,yDAA8C;AAE9C;;;;GAIG;AACH,MAAa,kBAAkB;IAC7B;;;;;;;;;;;;;OAaG;IASH,UAAU,CAAU;IAEpB;;OAEG;IAEH,MAAM,CAAW;IAEjB;;;;;;;;OAQG;IAUH,MAAM,CAAiB;IAEvB;;;;;;;;OAQG;IAUH,SAAS,CAAiB;CAC3B;AAtED,gDAsEC;AA/CC;IARC,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACxE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;sDACkB;AAMpB;IADC,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;;kDAClC;AAoBjB;IATC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IAChD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IACpE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;kDACqB;AAoBvB;IATC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACxE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;qDACwB;AAG5B;;GAEG;AACH,MAAa,0BAA0B;IACrC;;OAEG;IACH,SAAS,CAAW;IAEpB;;OAEG;IACH,eAAe,CAAiB;IAEhC;;OAEG;IACH,kBAAkB,CAAe;CAClC;AAfD,gEAeC"}
+{"version":3,"file":"set-mfa-exemption.dto.js","sourceRoot":"","sources":["../../src/dto/set-mfa-exemption.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;AAEH,qDAAqF;AACrF,yDAA8C;AAE9C;;;;GAIG;AACH,MAAa,kBAAkB;IAC7B;;;;;;;;;;;;OAYG;IAQH,GAAG,CAAU;IAEb;;OAEG;IAEH,MAAM,CAAW;IAEjB;;;;;;;;OAQG;IAUH,MAAM,CAAiB;IAEvB;;;;;;;;OAQG;IAUH,SAAS,CAAiB;CAC3B;AApED,gDAoEC;AA/CC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;+CACW;AAMb;IADC,IAAA,2BAAS,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;;kDAClC;AAoBjB;IATC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;IAChD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IACpE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;kDACqB;AAoBvB;IATC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACpD,IAAA,2BAAS,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACxE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;qDACwB;AAG5B;;GAEG;AACH,MAAa,0BAA0B;IACrC;;OAEG;IACH,SAAS,CAAW;IAEpB;;OAEG;IACH,eAAe,CAAiB;IAEhC;;OAEG;IACH,kBAAkB,CAAe;CAClC;AAfD,gEAeC"}

package/dist/dto/set-must-change-password.dto.d.ts

@@ -4,13 +4,13 @@
  * Request DTO for requiring a user to change their password on next login.
  *
  * Security:
- * - User ID validated (UUID)
+ * - User sub validated (UUID)
  * - Prevents unauthorized password change requirements
  *
  * @example
  * ```typescript
  * await authService.setMustChangePassword({
- *   userId: 'user-uuid'
+ *   sub: 'user-uuid'
  * });
  * ```
  */
@@ -31,6 +31,6 @@ export declare class SetMustChangePasswordDTO {
      *
      * @example "a21b654c-2746-4168-acee-c175083a65cd"
      */
-    userId: string;
+    sub: string;
 }
 //# sourceMappingURL=set-must-change-password.dto.d.ts.map

package/dist/dto/set-must-change-password.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-must-change-password.dto.d.ts","sourceRoot":"","sources":["../../src/dto/set-must-change-password.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;GAEG;AACH,qBAAa,wBAAwB;IACnC;;;;;;;;;;;;OAYG;IAQH,MAAM,EAAG,MAAM,CAAC;CACjB"}
+{"version":3,"file":"set-must-change-password.dto.d.ts","sourceRoot":"","sources":["../../src/dto/set-must-change-password.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH;;GAEG;AACH,qBAAa,wBAAwB;IACnC;;;;;;;;;;;;OAYG;IAQH,GAAG,EAAG,MAAM,CAAC;CACd"}

package/dist/dto/set-must-change-password.dto.js

@@ -5,13 +5,13 @@
  * Request DTO for requiring a user to change their password on next login.
  *
  * Security:
- * - User ID validated (UUID)
+ * - User sub validated (UUID)
  * - Prevents unauthorized password change requirements
  *
  * @example
  * ```typescript
  * await authService.setMustChangePassword({
- *   userId: 'user-uuid'
+ *   sub: 'user-uuid'
  * });
  * ```
  */
@@ -45,11 +45,11 @@ class SetMustChangePasswordDTO {
      *
      * @example "a21b654c-2746-4168-acee-c175083a65cd"
      */
-    userId;
+    sub;
 }
 exports.SetMustChangePasswordDTO = SetMustChangePasswordDTO;
 __decorate([
-    (0, class_validator_1.IsUUID)('4', { message: 'User ID must be a valid UUID v4 format' }),
+    (0, class_validator_1.IsUUID)('4', { message: 'User sub must be a valid UUID v4 format' }),
     (0, class_transformer_1.Transform)(({ value }) => {
         if (typeof value === 'string') {
             return value.trim().toLowerCase();
@@ -57,5 +57,5 @@ __decorate([
         return value;
     }),
     __metadata("design:type", String)
-], SetMustChangePasswordDTO.prototype, "userId", void 0);
+], SetMustChangePasswordDTO.prototype, "sub", void 0);
 //# sourceMappingURL=set-must-change-password.dto.js.map

package/dist/dto/set-must-change-password.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"set-must-change-password.dto.js","sourceRoot":"","sources":["../../src/dto/set-must-change-password.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;AAEH,qDAAyC;AACzC,yDAA8C;AAE9C;;GAEG;AACH,MAAa,wBAAwB;IACnC;;;;;;;;;;;;OAYG;IAQH,MAAM,CAAU;CACjB;AAtBD,4DAsBC;AADC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;IAClE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;wDACc"}
+{"version":3,"file":"set-must-change-password.dto.js","sourceRoot":"","sources":["../../src/dto/set-must-change-password.dto.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;AAEH,qDAAyC;AACzC,yDAA8C;AAE9C;;GAEG;AACH,MAAa,wBAAwB;IACnC;;;;;;;;;;;;OAYG;IAQH,GAAG,CAAU;CACd;AAtBD,4DAsBC;AADC;IAPC,IAAA,wBAAM,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;IACnE,IAAA,6BAAS,EAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;;qDACW"}

package/dist/dto/set-preferred-method.dto.d.ts

@@ -1,35 +1,23 @@
 /**
  * DTO for setting preferred MFA method
  *
- * Used to set the preferred MFA method for a user.
+ * Used to set the preferred MFA method for the current authenticated user.
  * Updates the user's preferred method and device primary flags.
+ * User sub is obtained from authenticated context automatically.
  *
  * @example
  * ```typescript
  * await mfaService.setPreferredMethod({
- *   userSub: 'user-uuid',
  *   methodType: 'totp'
  * });
  * ```
  */
 /**
  * DTO for setting preferred MFA method
+ *
+ * User self-service DTO - no userSub field. Service gets user from authenticated context.
  */
 export declare class SetPreferredMethodDTO {
-    /**
-     * User's unique identifier (UUID v4)
-     *
-     * Validation:
-     * - Must be a valid UUID v4 format
-     * - Matches DB constraint: char(36) or uuid
-     *
-     * Sanitization:
-     * - Trimmed
-     * - Lowercased for consistency
-     *
-     * @example "a21b654c-2746-4168-acee-c175083a65cd"
-     */
-    userSub: string;
     /**
      * MFA method type to set as preferred
      *

package/dist/dto/set-preferred-method.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-preferred-method.dto.d.ts","sourceRoot":"","sources":["../../src/dto/set-preferred-method.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;GAEG;AACH,qBAAa,qBAAqB;IAChC;;;;;;;;;;;;OAYG;IAQH,OAAO,EAAG,MAAM,CAAC;IAEjB;;;;;;;;;;;OAWG;IAYH,UAAU,EAAG,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,OAAO,EAAG,MAAM,CAAC;CAClB"}
+{"version":3,"file":"set-preferred-method.dto.d.ts","sourceRoot":"","sources":["../../src/dto/set-preferred-method.dto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH;;;;GAIG;AACH,qBAAa,qBAAqB;IAChC;;;;;;;;;;;OAWG;IAYH,UAAU,EAAG,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,qBAAa,6BAA6B;IACxC;;OAEG;IACH,OAAO,EAAG,MAAM,CAAC;CAClB"}