@nauth-toolkit/core 0.2.7 → 0.3.1

package/dist/services/api-key.service.js

@@ -0,0 +1,378 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyService = void 0;
+const crypto_1 = require("crypto");
+const nauth_exception_1 = require("../exceptions/nauth.exception");
+const error_codes_enum_1 = require("../enums/error-codes.enum");
+const auth_audit_event_type_enum_1 = require("../enums/auth-audit-event-type.enum");
+const ip_match_1 = require("../utils/ip-match");
+/**
+ * API Key Service
+ *
+ * Manages the lifecycle of API keys (create/list/update/revoke/delete) and validates
+ * keys presented on requests. Keys authenticate as their owning user.
+ *
+ * Security:
+ * - Only a SHA-256 hash of the full key is stored; the plaintext is returned once at creation.
+ * - Lookup uses a non-secret, indexed `lookupId`; the secret is compared in constant time.
+ * - Per-key IP allowlists (optional) restrict which source IPs may use a key.
+ *
+ * @remarks
+ * This service does NOT enforce endpoint authorization. Route protection (which endpoints
+ * accept API keys) is the responsibility of the framework adapter (guard/middleware).
+ */
+class ApiKeyService {
+    apiKeyRepository;
+    userRepository;
+    config;
+    logger;
+    auditService;
+    constructor(apiKeyRepository, userRepository, config, logger, auditService) {
+        this.apiKeyRepository = apiKeyRepository;
+        this.userRepository = userRepository;
+        this.config = config;
+        this.logger = logger;
+        this.auditService = auditService;
+        this.logger?.log?.('ApiKeyService initialized');
+    }
+    /**
+     * Create a new API key.
+     *
+     * @param params - Creation parameters (owning userId is required)
+     * @returns The plaintext key (shown once) plus sanitized metadata
+     * @throws {NAuthException} API_KEY_CREATION_DISABLED, API_KEY_LIMIT_REACHED,
+     *   API_KEY_EXPIRY_REQUIRED, API_KEY_INDEFINITE_NOT_ALLOWED, API_KEY_EXPIRY_TOO_LONG,
+     *   VALIDATION_FAILED (invalid IP allowlist), USER_NOT_FOUND
+     */
+    async createKey(params) {
+        const cfg = this.config.apiKeys ?? {};
+        // Creation-rights gate: only admins may create keys unless user creation is enabled.
+        if (!params.createdByAdmin && cfg.allowUserCreation !== true) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_CREATION_DISABLED, 'API key creation is disabled for users. Contact an administrator.');
+        }
+        const user = await this.userRepository.findOne({ where: { id: params.userId } });
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USER_NOT_FOUND, 'User not found');
+        }
+        // Enforce per-user active key limit.
+        const maxKeys = cfg.maxKeysPerUser ?? 10;
+        const activeCount = await this.apiKeyRepository.count({ where: { userId: params.userId, isActive: true } });
+        if (activeCount >= maxKeys) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_LIMIT_REACHED, `Maximum of ${maxKeys} active API keys reached.`, {
+                maxKeysPerUser: maxKeys,
+            });
+        }
+        const expiresAt = this.resolveExpiry(params.expiresInDays);
+        const allowedIps = this.normalizeAllowedIps(params.allowedIps);
+        // Generate the key material.
+        const keyId = (0, crypto_1.randomUUID)();
+        const lookupId = (0, crypto_1.randomBytes)(8).toString('hex'); // 16 non-secret hex chars
+        const secret = (0, crypto_1.randomBytes)(32).toString('base64url');
+        const prefix = cfg.keyPrefix ?? 'nauth';
+        const fullKey = `${prefix}_${lookupId}.${secret}`;
+        const keyHash = this.hashKey(fullKey);
+        const entity = this.apiKeyRepository.create({
+            keyId,
+            userId: params.userId,
+            lookupId,
+            keyHash,
+            name: params.name ?? null,
+            lastFour: secret.slice(-4),
+            allowedIps: allowedIps.length > 0 ? allowedIps : null,
+            expiresAt,
+            isActive: true,
+            createdByAdmin: params.createdByAdmin === true,
+            usageCount: 0,
+        });
+        const saved = await this.apiKeyRepository.save(entity);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_CREATED, params.userId, 'SUCCESS', {
+            keyId,
+            createdByAdmin: entity.createdByAdmin,
+            hasExpiry: expiresAt !== null,
+            ipRestricted: allowedIps.length > 0,
+        });
+        return { key: fullKey, apiKey: this.toResponse(saved) };
+    }
+    /**
+     * Update a key's mutable fields (name and IP allowlist).
+     * The secret and expiry are immutable — rotate/extend by deleting and recreating.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND, VALIDATION_FAILED
+     */
+    async updateKey(params) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId: params.keyId, userId: params.userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        if (params.name !== undefined) {
+            key.name = params.name ?? null;
+        }
+        if (params.allowedIps !== undefined) {
+            const allowedIps = this.normalizeAllowedIps(params.allowedIps);
+            key.allowedIps = allowedIps.length > 0 ? allowedIps : null;
+        }
+        const saved = await this.apiKeyRepository.save(key);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_UPDATED, params.userId, 'INFO', { keyId: params.keyId });
+        return this.toResponse(saved);
+    }
+    /**
+     * List all keys owned by a user (sanitized; never includes secrets).
+     */
+    async listKeys(userId) {
+        const keys = await this.apiKeyRepository.find({
+            where: { userId },
+            order: { createdAt: 'DESC' },
+        });
+        return keys.map((k) => this.toResponse(k));
+    }
+    /**
+     * Revoke (soft-delete) a key. The record is retained for audit history.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND
+     */
+    async revokeKey(params) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId: params.keyId, userId: params.userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        if (key.isActive) {
+            key.isActive = false;
+            key.revokedAt = new Date();
+            key.revokeReason = params.reason ?? 'user_revoked';
+            await this.apiKeyRepository.save(key);
+        }
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_REVOKED, params.userId, 'INFO', { keyId: params.keyId });
+        return { success: true };
+    }
+    /**
+     * Permanently delete a key.
+     *
+     * @throws {NAuthException} API_KEY_NOT_FOUND
+     */
+    async deleteKey(params) {
+        const key = await this.apiKeyRepository.findOne({ where: { keyId: params.keyId, userId: params.userId } });
+        if (!key) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_NOT_FOUND, 'API key not found');
+        }
+        await this.apiKeyRepository.remove(key);
+        await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_DELETED, params.userId, 'INFO', { keyId: params.keyId });
+        return { success: true };
+    }
+    /**
+     * Validate a presented API key and resolve its owner.
+     *
+     * On any failure this throws a precise {@link NAuthException} (access denied) — callers
+     * MUST NOT fall back to other credentials.
+     *
+     * @param rawKey - The full plaintext key from the request header
+     * @param callerIp - Source IP of the request (for IP-allowlist enforcement + usage tracking)
+     * @returns The owning user's identifiers on success
+     * @throws {NAuthException} API_KEY_INVALID, API_KEY_EXPIRED, API_KEY_IP_NOT_ALLOWED
+     */
+    async validateKey(rawKey, callerIp) {
+        const lookupId = this.parseLookupId(rawKey);
+        if (!lookupId) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, null, 'FAILURE', { reason: 'malformed' });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        const key = await this.apiKeyRepository.findOne({ where: { lookupId } });
+        if (!key || !key.isActive || !this.hashesEqual(key.keyHash, this.hashKey(rawKey))) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key?.userId ?? null, 'FAILURE', { reason: 'invalid' });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        if (key.isExpired()) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'FAILURE', {
+                keyId: key.keyId,
+                reason: 'expired',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRED, 'API key has expired');
+        }
+        if (!key.isIpAllowed(callerIp, ip_match_1.ipMatchesEntry)) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'SUSPICIOUS', {
+                keyId: key.keyId,
+                reason: 'ip_not_allowed',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_IP_NOT_ALLOWED, 'API key not permitted from this IP address');
+        }
+        // Resolve the owner's external id (sub) so callers can load the shared auth context.
+        const owner = await this.userRepository.findOne({
+            where: { id: key.userId },
+            select: { id: true, sub: true, isActive: true },
+        });
+        if (!owner || !owner.isActive) {
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_AUTH_FAILED, key.userId, 'FAILURE', {
+                keyId: key.keyId,
+                reason: 'owner_inactive',
+            });
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INVALID, 'Invalid API key');
+        }
+        await this.recordUsage(key, callerIp ?? null);
+        return { keyId: key.keyId, userId: key.userId, sub: owner.sub };
+    }
+    // ==========================================================================
+    // Internal helpers
+    // ==========================================================================
+    /**
+     * Resolve the mandatory, config-bounded expiry.
+     */
+    resolveExpiry(expiresInDays) {
+        const cfg = this.config.apiKeys ?? {};
+        if (expiresInDays === undefined) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRY_REQUIRED, 'An expiry must be specified when creating an API key (a number of days, or null for never).');
+        }
+        if (expiresInDays === null) {
+            if (cfg.allowIndefinite === false) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_INDEFINITE_NOT_ALLOWED, 'Non-expiring API keys are not allowed. Specify an expiry in days.');
+            }
+            return null;
+        }
+        if (!Number.isInteger(expiresInDays) || expiresInDays < 1) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'expiresInDays must be a positive integer or null.');
+        }
+        if (typeof cfg.maxExpiryDays === 'number' && expiresInDays > cfg.maxExpiryDays) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.API_KEY_EXPIRY_TOO_LONG, `Expiry exceeds the maximum of ${cfg.maxExpiryDays} days.`, { maxExpiryDays: cfg.maxExpiryDays });
+        }
+        const expiresAt = new Date();
+        expiresAt.setDate(expiresAt.getDate() + expiresInDays);
+        return expiresAt;
+    }
+    /**
+     * Validate and normalize an IP allowlist per configuration.
+     */
+    normalizeAllowedIps(allowedIps) {
+        const cfg = this.config.apiKeys ?? {};
+        const ipCfg = cfg.ipRestrictions ?? {};
+        // When IP restrictions are disabled, allowlists are ignored entirely.
+        if (ipCfg.enabled === false) {
+            if (allowedIps && allowedIps.length > 0) {
+                this.logger?.debug?.('[ApiKey] IP restrictions disabled - ignoring provided allowedIps');
+            }
+            return [];
+        }
+        const normalized = (allowedIps ?? []).map((e) => e.trim()).filter((e) => e.length > 0);
+        if (ipCfg.requireForNewKeys === true && normalized.length === 0) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'An IP allowlist is required for new API keys (apiKeys.ipRestrictions.requireForNewKeys).');
+        }
+        const maxIps = ipCfg.maxIpsPerKey ?? 20;
+        if (normalized.length > maxIps) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, `An API key may have at most ${maxIps} IP entries.`, {
+                maxIpsPerKey: maxIps,
+            });
+        }
+        const invalid = normalized.filter((e) => !(0, ip_match_1.isValidIpOrCidr)(e));
+        if (invalid.length > 0) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'allowedIps contains invalid IP or CIDR entries.', {
+                invalid,
+            });
+        }
+        return normalized;
+    }
+    /**
+     * Compute the SHA-256 hex hash of a full key string.
+     */
+    hashKey(rawKey) {
+        return (0, crypto_1.createHash)('sha256').update(rawKey).digest('hex');
+    }
+    /**
+     * Constant-time comparison of two equal-length hex hashes.
+     */
+    hashesEqual(a, b) {
+        if (a.length !== b.length) {
+            return false;
+        }
+        try {
+            return (0, crypto_1.timingSafeEqual)(Buffer.from(a), Buffer.from(b));
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Extract the non-secret lookup id from a raw key of the form `prefix_lookupId.secret`.
+     */
+    parseLookupId(rawKey) {
+        if (typeof rawKey !== 'string') {
+            return null;
+        }
+        const dotIndex = rawKey.indexOf('.');
+        if (dotIndex <= 0) {
+            return null;
+        }
+        const head = rawKey.slice(0, dotIndex); // prefix_lookupId
+        const underscoreIndex = head.lastIndexOf('_');
+        if (underscoreIndex < 0 || underscoreIndex === head.length - 1) {
+            return null;
+        }
+        return head.slice(underscoreIndex + 1);
+    }
+    /**
+     * Update last-used metadata, throttled to avoid a write on every request.
+     * Never throws — usage tracking must not block authentication.
+     */
+    async recordUsage(key, callerIp) {
+        const cfg = this.config.apiKeys ?? {};
+        const throttleMs = (cfg.lastUsedThrottleSeconds ?? 60) * 1000;
+        const now = Date.now();
+        const last = key.lastUsedAt ? key.lastUsedAt.getTime() : 0;
+        if (last !== 0 && now - last < throttleMs) {
+            return; // Within throttle window - skip write and audit noise.
+        }
+        try {
+            const update = {
+                lastUsedAt: new Date(now),
+            };
+            if (cfg.trackUsageIp !== false) {
+                update.lastUsedIp = callerIp;
+            }
+            await this.apiKeyRepository.update({ id: key.id }, update);
+            // Atomic increment avoids lost updates under concurrent use (read-modify-write race).
+            await this.apiKeyRepository.increment({ id: key.id }, 'usageCount', 1);
+            await this.audit(auth_audit_event_type_enum_1.AuthAuditEventType.API_KEY_USED, key.userId, 'SUCCESS', { keyId: key.keyId });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger?.debug?.(`[ApiKey] Failed to record usage for key ${key.keyId}: ${message}`);
+        }
+    }
+    /**
+     * Build a sanitized response DTO from an entity.
+     */
+    toResponse(key) {
+        return {
+            keyId: key.keyId,
+            name: key.name ?? null,
+            lastFour: key.lastFour ?? null,
+            allowedIps: key.allowedIps ?? null,
+            expiresAt: key.expiresAt ?? null,
+            isActive: key.isActive,
+            createdByAdmin: key.createdByAdmin,
+            lastUsedAt: key.lastUsedAt ?? null,
+            lastUsedIp: key.lastUsedIp ?? null,
+            usageCount: key.usageCount ?? 0,
+            createdAt: key.createdAt,
+        };
+    }
+    /**
+     * Record an audit event (no-op when audit logging is disabled). Never throws.
+     */
+    async audit(eventType, userId, eventStatus, metadata) {
+        if (!this.auditService) {
+            return;
+        }
+        try {
+            await this.auditService.recordEvent({
+                userId: userId ?? undefined,
+                eventType,
+                eventStatus,
+                authMethod: 'api-key',
+                metadata,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            this.logger?.debug?.(`[ApiKey] Failed to record audit event ${eventType}: ${message}`);
+        }
+    }
+}
+exports.ApiKeyService = ApiKeyService;
+//# sourceMappingURL=api-key.service.js.map

package/dist/services/api-key.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.service.js","sourceRoot":"","sources":["../../src/services/api-key.service.ts"],"names":[],"mappings":";;;AACA,mCAA8E;AAK9E,mEAA+D;AAC/D,gEAA0D;AAC1D,oFAAyE;AACzE,gDAAoE;AAuCpE;;;;;;;;;;;;;;GAcG;AACH,MAAa,aAAa;IAEL;IACA;IACA;IACA;IACA;IALnB,YACmB,gBAAwC,EACxC,cAAoC,EACpC,MAAmB,EACnB,MAAmB,EACnB,YAAuC;QAJvC,qBAAgB,GAAhB,gBAAgB,CAAwB;QACxC,mBAAc,GAAd,cAAc,CAAsB;QACpC,WAAM,GAAN,MAAM,CAAa;QACnB,WAAM,GAAN,MAAM,CAAa;QACnB,iBAAY,GAAZ,YAAY,CAA2B;QAExD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,MAA0B;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAEtC,qFAAqF;QACrF,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC7D,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,yBAAyB,EACvC,mEAAmE,CACpE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QAC3E,CAAC;QAED,qCAAqC;QACrC,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QACzC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5G,IAAI,WAAW,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,qBAAqB,EAAE,cAAc,OAAO,2BAA2B,EAAE;gBAC9G,cAAc,EAAE,OAAO;aACxB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAE/D,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B;QAC3E,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,MAAM,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1C,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ;YACR,OAAO;YACP,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;YACzB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1B,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YACrD,SAAS;YACT,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI;YAC9C,UAAU,EAAE,CAAC;SACd,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEvD,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE;YAC7E,KAAK;YACL,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,SAAS,EAAE,SAAS,KAAK,IAAI;YAC7B,YAAY,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;SACpC,CAAC,CAAC;QAEH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,MAA0B;QACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC;QACjC,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC/D,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEpD,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAC5C,KAAK,EAAE,EAAE,MAAM,EAAE;YACjB,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;SAC7B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAA0D;QACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;YACrB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,cAAc,CAAC;YACnD,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,MAAyC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3G,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAExC,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAErG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,QAAwB;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACnG,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,EAAE,MAAM,IAAI,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YAChH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC9E,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;QACjF,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,EAAE,yBAAc,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE;gBACjF,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,sBAAsB,EAAE,4CAA4C,CAAC,CAAC;QAC/G,CAAC;QAED,qFAAqF;QACrF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE;YACzB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE;gBAC9E,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;QAE9C,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAClE,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAE7E;;OAEG;IACK,aAAa,CAAC,aAAwC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAEtC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,uBAAuB,EACrC,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;gBAClC,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,8BAA8B,EAC5C,mEAAmE,CACpE,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QACjH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,aAAa,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC;YAC/E,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,uBAAuB,EACrC,iCAAiC,GAAG,CAAC,aAAa,QAAQ,EAC1D,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CACrC,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,UAAgC;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;QAEvC,sEAAsE;QACtE,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC5B,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kEAAkE,CAAC,CAAC;YAC3F,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvF,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,gCAAc,CACtB,gCAAa,CAAC,iBAAiB,EAC/B,0FAA0F,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;QACxC,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,+BAA+B,MAAM,cAAc,EAAE;gBAC7G,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,0BAAe,EAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,gCAAc,CAAC,gCAAa,CAAC,iBAAiB,EAAE,iDAAiD,EAAE;gBAC3G,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,MAAc;QAC5B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,CAAS,EAAE,CAAS;QACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAc;QAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB;QAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,eAAe,GAAG,CAAC,IAAI,eAAe,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,WAAW,CAAC,GAAe,EAAE,QAAuB;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,uBAAuB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3D,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,UAAU,EAAE,CAAC;YAC1C,OAAO,CAAC,uDAAuD;QACjE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAqD;gBAC/D,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;aAC1B,CAAC;YACF,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;gBAC/B,MAAM,CAAC,UAAU,GAAG,QAAQ,CAAC;YAC/B,CAAC;YACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3D,sFAAsF;YACtF,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YAEvE,MAAM,IAAI,CAAC,KAAK,CAAC,+CAAkB,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,2CAA2C,GAAG,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAe;QAChC,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;YAC9B,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;YAC/B,SAAS,EAAE,GAAG,CAAC,SAAS;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK,CACjB,SAA6B,EAC7B,MAAqB,EACrB,WAA0D,EAC1D,QAAkC;QAElC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC;gBAClC,MAAM,EAAE,MAAM,IAAI,SAAS;gBAC3B,SAAS;gBACT,WAAW;gBACX,UAAU,EAAE,SAAS;gBACrB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACzE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,yCAAyC,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;CACF;AApaD,sCAoaC"}

package/dist/services/telemetry.service.d.ts

@@ -0,0 +1,154 @@
+import { NAuthConfig } from '../interfaces/config.interface';
+import { StorageAdapter } from '../interfaces/storage-adapter.interface';
+import { NAuthLogger } from '../utils/nauth-logger';
+import { MFAService } from './mfa.service';
+import { SocialProviderRegistry } from './social-provider-registry.service';
+/**
+ * Anonymous telemetry payload — configuration shape only.
+ *
+ * Contains no personal data: no IP addresses, secrets, domains, emails,
+ * table names, or free-text configuration values. Documented publicly at
+ * https://nauth.dev/docs/concepts/telemetry
+ */
+export interface TelemetryPayload {
+    schemaVersion: 1;
+    instanceId: string;
+    event: 'boot' | 'heartbeat';
+    coreVersion: string;
+    nodeMajor: number;
+    platform: string;
+    arch: string;
+    nodeEnv: 'production' | 'development' | 'other';
+    framework: string;
+    config: {
+        tokenDeliveryMethod: 'json' | 'cookies' | 'hybrid';
+        mfa: {
+            enabled: boolean;
+            enforcement: 'OPTIONAL' | 'REQUIRED' | 'ADAPTIVE' | null;
+            gracePeriodSet: boolean;
+            allowedMethods: string[];
+        };
+        mfaProviders: string[];
+        socialProviders: string[];
+        storageAdapter: string;
+        signupVerificationMethod: string | null;
+        auditLogsEnabled: boolean;
+        recaptchaEnabled: boolean;
+        geoLocationConfigured: boolean;
+    };
+}
+/**
+ * Anonymous usage telemetry (opt-out)
+ *
+ * Sends a small, anonymous payload describing the *shape* of the nauth
+ * configuration (enums, booleans, and registered provider names — never
+ * values) once at boot and once per day thereafter. The data guides
+ * development priorities; see https://nauth.dev/docs/concepts/telemetry
+ * for the exact payload and rationale.
+ *
+ * **Performance guarantees:**
+ * - Never runs inside a request path — no middleware or handler involvement
+ * - The boot ping is deferred and fire-and-forget; `NAuth.create()` gains no awaits
+ * - The heartbeat timer is unref'd and never keeps the process alive
+ * - Network failures are swallowed at debug level; this service never throws
+ *
+ * **Disabled automatically** when any of the following holds:
+ * - `config.telemetry.enabled === false`
+ * - `NAUTH_TELEMETRY_DISABLED=1` or `DO_NOT_TRACK=1`
+ * - `CI=true` or `NODE_ENV=test`
+ *
+ * @example
+ * ```typescript
+ * const telemetry = new TelemetryService(config, storage, logger, 'express', mfaService, socialRegistry);
+ * telemetry.sendBootPing();
+ * telemetry.startHeartbeat();
+ * // ...on shutdown:
+ * telemetry.shutdown();
+ * ```
+ */
+export declare class TelemetryService {
+    private readonly config;
+    private readonly storageAdapter;
+    private readonly logger?;
+    private readonly framework;
+    private readonly mfaService?;
+    private readonly socialProviderRegistry?;
+    private heartbeatTimer?;
+    private cachedInstanceId?;
+    private disclosureShown;
+    constructor(config: NAuthConfig, storageAdapter: StorageAdapter, logger?: NAuthLogger | undefined, framework?: string, mfaService?: MFAService | undefined, socialProviderRegistry?: SocialProviderRegistry | undefined);
+    /**
+     * Whether telemetry is active for this process.
+     *
+     * Evaluates the config flag and all environment opt-outs
+     * (NAUTH_TELEMETRY_DISABLED, DO_NOT_TRACK, CI, NODE_ENV=test).
+     *
+     * @returns true when telemetry may be sent
+     */
+    isEnabled(): boolean;
+    /**
+     * Send the boot ping (fire-and-forget).
+     *
+     * On the first boot of an install (when the anonymous instance ID is
+     * created), a one-time disclosure notice is logged. Subsequent boots of
+     * the same install are silent. This method returns immediately and never
+     * throws; all work happens off the startup path.
+     */
+    sendBootPing(): void;
+    /**
+     * Start the daily heartbeat timer.
+     *
+     * The timer is unref'd so it never prevents process exit. A random jitter
+     * of up to one hour avoids synchronized pings from fleets that restart
+     * together. No-op when telemetry is disabled.
+     */
+    startHeartbeat(): void;
+    /**
+     * Stop the heartbeat timer. Safe to call multiple times.
+     */
+    shutdown(): void;
+    /**
+     * Resolve the anonymous instance ID, with layered persistence:
+     *
+     * 1. **Storage adapter** (Redis/database) — deployment-scoped: all processes
+     *    sharing the deployment converge on one ID via an NX (set-if-absent) write.
+     * 2. **Home-directory file** (`~/.nauth-toolkit/telemetry-instance-id`) — used
+     *    when the storage adapter is the non-persistent in-memory adapter, so
+     *    restarts on the same machine keep one ID instead of minting a new
+     *    "install" per boot.
+     * 3. **Per-process UUID** — last resort when both stores are unavailable
+     *    (e.g. read-only filesystem); never throws.
+     *
+     * `isNew` is true only when this process created the ID — used to show the
+     * disclosure notice exactly once per install.
+     */
+    private resolveInstanceId;
+    /**
+     * File-backed instance ID under the user's home directory. Returns a
+     * per-process UUID when the filesystem is unavailable or read-only.
+     */
+    private resolveInstanceIdFromFile;
+    /**
+     * Build the telemetry payload from the resolved configuration and the
+     * registered provider lists. Pure shape extraction — no values are read
+     * beyond enums, booleans, and provider identifiers.
+     */
+    private buildPayload;
+    /**
+     * Resolve the storage adapter class name for the payload.
+     *
+     * Lazy wrappers (used by the NestJS module and the core storage factory)
+     * would otherwise report 'LazyStorageAdapter' for every install; when the
+     * wrapper has an initialized inner adapter, its class name is reported
+     * instead. By the time the payload is built the instance-ID lookup has
+     * already gone through the adapter, so the inner adapter exists.
+     */
+    private storageAdapterName;
+    /**
+     * POST the payload to the telemetry endpoint with a hard timeout.
+     * All failures are swallowed (debug log only) — telemetry must be
+     * invisible when it fails.
+     */
+    private send;
+}
+//# sourceMappingURL=telemetry.service.d.ts.map

package/dist/services/telemetry.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.service.d.ts","sourceRoot":"","sources":["../../src/services/telemetry.service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAkB5E;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,YAAY,GAAG,aAAa,GAAG,OAAO,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QACN,mBAAmB,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;QACnD,GAAG,EAAE;YACH,OAAO,EAAE,OAAO,CAAC;YACjB,WAAW,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,IAAI,CAAC;YACzD,cAAc,EAAE,OAAO,CAAC;YACxB,cAAc,EAAE,MAAM,EAAE,CAAC;SAC1B,CAAC;QACF,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,cAAc,EAAE,MAAM,CAAC;QACvB,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC,gBAAgB,EAAE,OAAO,CAAC;QAC1B,gBAAgB,EAAE,OAAO,CAAC;QAC1B,qBAAqB,EAAE,OAAO,CAAC;KAChC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,qBAAa,gBAAgB;IAMzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC;IAV1C,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAClC,OAAO,CAAC,eAAe,CAAS;gBAGb,MAAM,EAAE,WAAW,EACnB,cAAc,EAAE,cAAc,EAC9B,MAAM,CAAC,EAAE,WAAW,YAAA,EACpB,SAAS,GAAE,MAAkB,EAC7B,UAAU,CAAC,EAAE,UAAU,YAAA,EACvB,sBAAsB,CAAC,EAAE,sBAAsB,YAAA;IAGlE;;;;;;;OAOG;IACH,SAAS,IAAI,OAAO;IAkBpB;;;;;;;OAOG;IACH,YAAY,IAAI,IAAI;IAqBpB;;;;;;OAMG;IACH,cAAc,IAAI,IAAI;IAgBtB;;OAEG;IACH,QAAQ,IAAI,IAAI;IAOhB;;;;;;;;;;;;;;OAcG;YACW,iBAAiB;IA2B/B;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAqBjC;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAmDpB;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAK1B;;;;OAIG;YACW,IAAI;CAmBnB"}