@nauth-toolkit/nestjs 0.1.14 → 0.1.17

package/dist/guards/csrf.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.guard.d.ts","sourceRoot":"","sources":["../../src/guards/csrf.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAU,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAA4D,MAAM,qBAAqB,CAAC;AAG5G,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAuBvD,qBACa,SAAU,YAAW,WAAW;IAGzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,SAAS;IAGvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA0EhD"}
+{"version":3,"file":"csrf.guard.d.ts","sourceRoot":"","sources":["../../src/guards/csrf.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAU,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAA4D,MAAM,qBAAqB,CAAC;AAG5G,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,SAAU,YAAW,WAAW;IAGzC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,WAAW,EACxB,SAAS,EAAE,SAAS;IAGvC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CA0EhD"}

package/dist/guards/csrf.guard.js

@@ -19,6 +19,27 @@ const core_2 = require("@nauth-toolkit/core");
 const public_decorator_1 = require("../decorators/public.decorator");
 const token_delivery_decorator_1 = require("../decorators/token-delivery.decorator");
 const csrf_service_1 = require("../services/csrf.service");
+/**
+ * CSRF Guard
+ *
+ * Validates CSRF tokens for state-changing requests when using cookie-based token delivery.
+ * CSRF protection prevents Cross-Site Request Forgery attacks.
+ *
+ * Security Rules:
+ * - Only enforces for cookie-based token delivery (cookies or hybrid with web origins)
+ * - Skips safe HTTP methods (GET, HEAD, OPTIONS)
+ * - Skips excluded paths from configuration
+ * - Validates CSRF token from header matches cookie value
+ *
+ * @example
+ * ```typescript
+ * // Applied globally via AuthModule when tokenDelivery.method === 'cookies' or 'hybrid'
+ * // Or applied per-route:
+ * @UseGuards(CsrfGuard)
+ * @Post('sensitive-action')
+ * async sensitiveAction() { ... }
+ * ```
+ */
 let CsrfGuard = class CsrfGuard {
     config;
     csrfService;
@@ -29,17 +50,21 @@ let CsrfGuard = class CsrfGuard {
         this.reflector = reflector;
     }
     canActivate(context) {
+        // Only operate in HTTP context
         if (context.getType() !== 'http') {
             return true;
         }
         const request = context.switchToHttp().getRequest();
         const csrfConfig = this.config.security?.csrf;
+        // Skip if CSRF config is not provided
         if (!csrfConfig) {
             return true;
         }
+        // Skip for safe HTTP methods (GET, HEAD, OPTIONS)
         if (['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
             return true;
         }
+        // Skip if route is marked as public
         const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
             context.getHandler(),
             context.getClass(),
@@ -47,9 +72,11 @@ let CsrfGuard = class CsrfGuard {
         if (isPublic) {
             return true;
         }
+        // Skip excluded paths
         if (csrfConfig.excludedPaths?.some((path) => request.url.startsWith(path))) {
             return true;
         }
+        // Determine token delivery method
         const deliveryConfig = this.config.tokenDelivery;
         const routeMode = this.reflector.get(token_delivery_decorator_1.TOKEN_DELIVERY_KEY, context.getHandler());
         const method = deliveryConfig?.method || 'json';
@@ -66,9 +93,11 @@ let CsrfGuard = class CsrfGuard {
         else {
             effective = 'json';
         }
+        // Only enforce CSRF for cookie-based token delivery
         if (effective !== 'cookies') {
-            return true;
+            return true; // JSON mode doesn't need CSRF (Bearer tokens are CSRF-safe)
         }
+        // Validate CSRF token
         const cookieName = this.csrfService.getCookieName();
         const headerName = this.csrfService.getHeaderName();
         const csrfToken = request.headers[headerName.toLowerCase()];

package/dist/guards/csrf.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.guard.js","sourceRoot":"","sources":["../../src/guards/csrf.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAmF;AACnF,uCAAyC;AACzC,8CAA4G;AAC5G,qEAA+D;AAC/D,qFAA2F;AAC3F,2DAAuD;AAwBhD,IAAM,SAAS,GAAf,MAAM,SAAS;IAGD;IACA;IACA;IAJnB,YAEmB,MAAmB,EACnB,WAAwB,EACxB,SAAoB;QAFpB,WAAM,GAAN,MAAM,CAAa;QACnB,gBAAW,GAAX,WAAW,CAAa;QACxB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,WAAW,CAAC,OAAyB;QAEnC,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;QAG9C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgB,6CAAkB,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,cAAc,EAAE,MAAM,IAAI,MAAM,CAAC;QAChD,IAAI,SAAS,GAAuB,MAAM,CAAC;QAE3C,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,SAAS,GAAG,IAAA,gCAAyB,EAAC,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;QAGD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAuB,CAAC;QAClF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,CAAuB,CAAC;QAEvE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,kBAAkB,EAAE,iCAAiC,UAAU,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,kBAAkB,EAAE,iCAAiC,UAAU,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAlFY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,cAAc,CAAC,CAAA;6CAEO,0BAAW;QACb,gBAAS;GAL5B,SAAS,CAkFrB"}
+{"version":3,"file":"csrf.guard.js","sourceRoot":"","sources":["../../src/guards/csrf.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAmF;AACnF,uCAAyC;AACzC,8CAA4G;AAC5G,qEAA+D;AAC/D,qFAA2F;AAC3F,2DAAuD;AAEvD;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAGD;IACA;IACA;IAJnB,YAEmB,MAAmB,EACnB,WAAwB,EACxB,SAAoB;QAFpB,WAAM,GAAN,MAAM,CAAa;QACnB,gBAAW,GAAX,WAAW,CAAa;QACxB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,+BAA+B;QAC/B,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC;QAE9C,sCAAsC;QACtC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oCAAoC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sBAAsB;QACtB,IAAI,UAAU,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kCAAkC;QAClC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgB,6CAAkB,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,cAAc,EAAE,MAAM,IAAI,MAAM,CAAC;QAChD,IAAI,SAAS,GAAuB,MAAM,CAAC;QAE3C,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,SAAS,GAAG,IAAA,gCAAyB,EAAC,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,SAAS,GAAG,SAAS,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,CAAC;QACrB,CAAC;QAED,oDAAoD;QACpD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,CAAC,4DAA4D;QAC3E,CAAC;QAED,sBAAsB;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAuB,CAAC;QAClF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,CAAuB,CAAC;QAEvE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,kBAAkB,EAAE,iCAAiC,UAAU,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,kBAAkB,EAAE,iCAAiC,UAAU,EAAE,CAAC,CAAC;QAC5G,CAAC;QAED,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAc,CAAC,oBAAa,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAlFY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,cAAc,CAAC,CAAA;6CAEO,0BAAW;QACb,gBAAS;GAL5B,SAAS,CAkFrB"}

package/dist/index.d.ts

@@ -1,16 +1,50 @@
+/**
+ * @nauth-toolkit/nestjs
+ *
+ * NestJS adapter for nauth-toolkit.
+ * This package provides NestJS-specific integrations while re-exporting
+ * all core functionality for seamless backward compatibility.
+ */
 export * from '@nauth-toolkit/core';
+/**
+ * NestJS Module - Main entry point for integrating NAuth into NestJS apps
+ */
 export { AuthModule, NAuthModuleConfig } from './auth.module';
+/**
+ * NestJS Guards - Route protection and authentication
+ */
 export { AuthGuard } from './guards/auth.guard';
 export { CsrfGuard } from './guards/csrf.guard';
+/**
+ * NestJS Interceptors - Request/response processing
+ */
 export { ClientInfoInterceptor } from './interceptors/client-info.interceptor';
 export { CookieTokenInterceptor } from './interceptors/cookie-token.interceptor';
+/**
+ * NestJS Decorators - Parameter decorators and metadata
+ */
 export { CurrentUser } from './decorators/current-user.decorator';
 export { Public, IS_PUBLIC_KEY } from './decorators/public.decorator';
 export { ClientInfo } from './decorators/client-info.decorator';
 export { TokenDelivery, TOKEN_DELIVERY_KEY, RouteDelivery } from './decorators/token-delivery.decorator';
+/**
+ * NestJS Filters - Exception handling
+ */
 export { NAuthHttpExceptionFilter } from './filters/nauth-http-exception.filter';
+/**
+ * NestJS Providers - Logger adapters and utilities
+ */
 export { NestJsLoggerAdapter } from './providers/nestjs-logger.adapter';
+/**
+ * NestJS Services - CSRF protection
+ */
 export { CsrfService } from './services/csrf.service';
+/**
+ * NestJS DTOs - Data Transfer Objects with class-validator
+ */
 export * from './dto';
+/**
+ * Factory Functions - Simplified adapter creation
+ */
 export { createDatabaseStorageAdapter, createRedisStorageAdapter, createRedisClusterAdapter, } from './factories/storage-adapter.factory';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,cAAc,qBAAqB,CAAC;AASpC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAK9D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAKhD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAKjF,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAKzG,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAKjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAKtD,cAAc,OAAO,CAAC;AAKtB,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,cAAc,qBAAqB,CAAC;AAMpC;;GAEG;AACH,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAE9D;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;GAEG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEjF;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AAEzG;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AAEjF;;GAEG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE;;GAEG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD;;GAEG;AACH,cAAc,OAAO,CAAC;AAEtB;;GAEG;AACH,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,qCAAqC,CAAC"}

package/dist/index.js

@@ -1,4 +1,11 @@
 "use strict";
+/**
+ * @nauth-toolkit/nestjs
+ *
+ * NestJS adapter for nauth-toolkit.
+ * This package provides NestJS-specific integrations while re-exporting
+ * all core functionality for seamless backward compatibility.
+ */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -15,17 +22,41 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRedisClusterAdapter = exports.createRedisStorageAdapter = exports.createDatabaseStorageAdapter = exports.CsrfService = exports.NestJsLoggerAdapter = exports.NAuthHttpExceptionFilter = exports.TOKEN_DELIVERY_KEY = exports.TokenDelivery = exports.ClientInfo = exports.IS_PUBLIC_KEY = exports.Public = exports.CurrentUser = exports.CookieTokenInterceptor = exports.ClientInfoInterceptor = exports.CsrfGuard = exports.AuthGuard = exports.AuthModule = void 0;
+// ============================================================================
+// Re-export Public API from Core
+// ============================================================================
+// Note: Internal services (ChallengeService, AuthChallengeHelperService, etc.)
+// are NOT re-exported. They are only available via '@nauth-toolkit/core/internal'
+// for framework adapter development.
+//
+// Consumer applications should use the public services:
+// - AuthService, MFAService, SocialAuthService, etc.
 __exportStar(require("@nauth-toolkit/core"), exports);
+// ============================================================================
+// NestJS-Specific Exports
+// ============================================================================
+/**
+ * NestJS Module - Main entry point for integrating NAuth into NestJS apps
+ */
 var auth_module_1 = require("./auth.module");
 Object.defineProperty(exports, "AuthModule", { enumerable: true, get: function () { return auth_module_1.AuthModule; } });
+/**
+ * NestJS Guards - Route protection and authentication
+ */
 var auth_guard_1 = require("./guards/auth.guard");
 Object.defineProperty(exports, "AuthGuard", { enumerable: true, get: function () { return auth_guard_1.AuthGuard; } });
 var csrf_guard_1 = require("./guards/csrf.guard");
 Object.defineProperty(exports, "CsrfGuard", { enumerable: true, get: function () { return csrf_guard_1.CsrfGuard; } });
+/**
+ * NestJS Interceptors - Request/response processing
+ */
 var client_info_interceptor_1 = require("./interceptors/client-info.interceptor");
 Object.defineProperty(exports, "ClientInfoInterceptor", { enumerable: true, get: function () { return client_info_interceptor_1.ClientInfoInterceptor; } });
 var cookie_token_interceptor_1 = require("./interceptors/cookie-token.interceptor");
 Object.defineProperty(exports, "CookieTokenInterceptor", { enumerable: true, get: function () { return cookie_token_interceptor_1.CookieTokenInterceptor; } });
+/**
+ * NestJS Decorators - Parameter decorators and metadata
+ */
 var current_user_decorator_1 = require("./decorators/current-user.decorator");
 Object.defineProperty(exports, "CurrentUser", { enumerable: true, get: function () { return current_user_decorator_1.CurrentUser; } });
 var public_decorator_1 = require("./decorators/public.decorator");
@@ -36,13 +67,28 @@ Object.defineProperty(exports, "ClientInfo", { enumerable: true, get: function (
 var token_delivery_decorator_1 = require("./decorators/token-delivery.decorator");
 Object.defineProperty(exports, "TokenDelivery", { enumerable: true, get: function () { return token_delivery_decorator_1.TokenDelivery; } });
 Object.defineProperty(exports, "TOKEN_DELIVERY_KEY", { enumerable: true, get: function () { return token_delivery_decorator_1.TOKEN_DELIVERY_KEY; } });
+/**
+ * NestJS Filters - Exception handling
+ */
 var nauth_http_exception_filter_1 = require("./filters/nauth-http-exception.filter");
 Object.defineProperty(exports, "NAuthHttpExceptionFilter", { enumerable: true, get: function () { return nauth_http_exception_filter_1.NAuthHttpExceptionFilter; } });
+/**
+ * NestJS Providers - Logger adapters and utilities
+ */
 var nestjs_logger_adapter_1 = require("./providers/nestjs-logger.adapter");
 Object.defineProperty(exports, "NestJsLoggerAdapter", { enumerable: true, get: function () { return nestjs_logger_adapter_1.NestJsLoggerAdapter; } });
+/**
+ * NestJS Services - CSRF protection
+ */
 var csrf_service_1 = require("./services/csrf.service");
 Object.defineProperty(exports, "CsrfService", { enumerable: true, get: function () { return csrf_service_1.CsrfService; } });
+/**
+ * NestJS DTOs - Data Transfer Objects with class-validator
+ */
 __exportStar(require("./dto"), exports);
+/**
+ * Factory Functions - Simplified adapter creation
+ */
 var storage_adapter_factory_1 = require("./factories/storage-adapter.factory");
 Object.defineProperty(exports, "createDatabaseStorageAdapter", { enumerable: true, get: function () { return storage_adapter_factory_1.createDatabaseStorageAdapter; } });
 Object.defineProperty(exports, "createRedisStorageAdapter", { enumerable: true, get: function () { return storage_adapter_factory_1.createRedisStorageAdapter; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiBA,sDAAoC;AASpC,6CAA8D;AAArD,yGAAA,UAAU,OAAA;AAKnB,kDAAgD;AAAvC,uGAAA,SAAS,OAAA;AAClB,kDAAgD;AAAvC,uGAAA,SAAS,OAAA;AAKlB,kFAA+E;AAAtE,gIAAA,qBAAqB,OAAA;AAC9B,oFAAiF;AAAxE,kIAAA,sBAAsB,OAAA;AAK/B,8EAAkE;AAAzD,qHAAA,WAAW,OAAA;AACpB,kEAAsE;AAA7D,0GAAA,MAAM,OAAA;AAAE,iHAAA,aAAa,OAAA;AAC9B,4EAAgE;AAAvD,mHAAA,UAAU,OAAA;AACnB,kFAAyG;AAAhG,yHAAA,aAAa,OAAA;AAAE,8HAAA,kBAAkB,OAAA;AAK1C,qFAAiF;AAAxE,uIAAA,wBAAwB,OAAA;AAKjC,2EAAwE;AAA/D,4HAAA,mBAAmB,OAAA;AAK5B,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AAKpB,wCAAsB;AAKtB,+EAI6C;AAH3C,uIAAA,4BAA4B,OAAA;AAC5B,oIAAA,yBAAyB,OAAA;AACzB,oIAAA,yBAAyB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;;;;;;;;;;;;;AAEH,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAC/E,+EAA+E;AAC/E,kFAAkF;AAClF,qCAAqC;AACrC,EAAE;AACF,wDAAwD;AACxD,qDAAqD;AACrD,sDAAoC;AAEpC,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;GAEG;AACH,6CAA8D;AAArD,yGAAA,UAAU,OAAA;AAEnB;;GAEG;AACH,kDAAgD;AAAvC,uGAAA,SAAS,OAAA;AAClB,kDAAgD;AAAvC,uGAAA,SAAS,OAAA;AAElB;;GAEG;AACH,kFAA+E;AAAtE,gIAAA,qBAAqB,OAAA;AAC9B,oFAAiF;AAAxE,kIAAA,sBAAsB,OAAA;AAE/B;;GAEG;AACH,8EAAkE;AAAzD,qHAAA,WAAW,OAAA;AACpB,kEAAsE;AAA7D,0GAAA,MAAM,OAAA;AAAE,iHAAA,aAAa,OAAA;AAC9B,4EAAgE;AAAvD,mHAAA,UAAU,OAAA;AACnB,kFAAyG;AAAhG,yHAAA,aAAa,OAAA;AAAE,8HAAA,kBAAkB,OAAA;AAE1C;;GAEG;AACH,qFAAiF;AAAxE,uIAAA,wBAAwB,OAAA;AAEjC;;GAEG;AACH,2EAAwE;AAA/D,4HAAA,mBAAmB,OAAA;AAE5B;;GAEG;AACH,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AAEpB;;GAEG;AACH,wCAAsB;AAEtB;;GAEG;AACH,+EAI6C;AAH3C,uIAAA,4BAA4B,OAAA;AAC5B,oIAAA,yBAAyB,OAAA;AACzB,oIAAA,yBAAyB,OAAA"}

package/dist/interceptors/client-info.interceptor.d.ts

@@ -2,12 +2,49 @@ import { NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
 import { Observable } from 'rxjs';
 import { NAuthConfig } from '@nauth-toolkit/core';
 import { GeoLocationService } from '@nauth-toolkit/core/internal';
+/**
+ * Client Info Interceptor
+ *
+ * Automatically extracts client information (IP address, user agent, device info)
+ * from incoming HTTP requests and stores it in async local storage (CLS).
+ *
+ * This interceptor runs globally when configured in AuthModule, ensuring that
+ * all authentication services have transparent access to client metadata without
+ * needing to pass it as parameters.
+ *
+ * Benefits:
+ * - Transparent IP/user agent handling (like AWS Cognito)
+ * - Handles proxies and load balancers automatically
+ * - No parameters needed - services read from context automatically
+ * - Works across async boundaries
+ * - Type-safe and consistent
+ *
+ * @example
+ * // In your controller (no IP/UA parameters needed!)
+ * @Post('login')
+ * async login(@Body() dto: LoginDTO) {
+ *   return this.authService.login(dto); // IP extracted internally!
+ * }
+ *
+ * // In AuthService (reads from context automatically)
+ * async login(dto: LoginDTO) {
+ *   const clientInfo = this.clientInfoService.get(); // From context!
+ *   // Use clientInfo.ipAddress, clientInfo.userAgent, etc.
+ * }
+ */
 export declare class ClientInfoInterceptor implements NestInterceptor {
     private readonly config?;
     private readonly geoLocationService?;
     private readonly clientInfoService;
     constructor(config?: NAuthConfig | undefined, geoLocationService?: GeoLocationService | undefined);
     intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+    /**
+     * Extract and store client information in context
+     *
+     * @param context - Execution context
+     * @param next - Call handler
+     * @returns Observable
+     */
     private extractAndStoreClientInfo;
 }
 //# sourceMappingURL=client-info.interceptor.d.ts.map

package/dist/interceptors/client-info.interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-info.interceptor.d.ts","sourceRoot":"","sources":["../../src/interceptors/client-info.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,UAAU,EAAY,MAAM,MAAM,CAAC;AAE5C,OAAO,EAKL,WAAW,EAEZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAgClE,qBACa,qBAAsB,YAAW,eAAe;IAMzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAExB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAPtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;gBAK1C,MAAM,CAAC,EAAE,WAAW,YAAA,EAEpB,kBAAkB,CAAC,EAAE,kBAAkB,YAAA;IAG1D,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;IAoB5E,OAAO,CAAC,yBAAyB;CAkIlC"}
+{"version":3,"file":"client-info.interceptor.d.ts","sourceRoot":"","sources":["../../src/interceptors/client-info.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAoB,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,UAAU,EAAY,MAAM,MAAM,CAAC;AAE5C,OAAO,EAKL,WAAW,EAEZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBACa,qBAAsB,YAAW,eAAe;IAMzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAExB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAPtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA2B;gBAK1C,MAAM,CAAC,EAAE,WAAW,YAAA,EAEpB,kBAAkB,CAAC,EAAE,kBAAkB,YAAA;IAG1D,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;IAa5E;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;CAkIlC"}

package/dist/interceptors/client-info.interceptor.js

@@ -18,6 +18,36 @@ const rxjs_1 = require("rxjs");
 const operators_1 = require("rxjs/operators");
 const core_1 = require("@nauth-toolkit/core");
 const internal_1 = require("@nauth-toolkit/core/internal");
+/**
+ * Client Info Interceptor
+ *
+ * Automatically extracts client information (IP address, user agent, device info)
+ * from incoming HTTP requests and stores it in async local storage (CLS).
+ *
+ * This interceptor runs globally when configured in AuthModule, ensuring that
+ * all authentication services have transparent access to client metadata without
+ * needing to pass it as parameters.
+ *
+ * Benefits:
+ * - Transparent IP/user agent handling (like AWS Cognito)
+ * - Handles proxies and load balancers automatically
+ * - No parameters needed - services read from context automatically
+ * - Works across async boundaries
+ * - Type-safe and consistent
+ *
+ * @example
+ * // In your controller (no IP/UA parameters needed!)
+ * @Post('login')
+ * async login(@Body() dto: LoginDTO) {
+ *   return this.authService.login(dto); // IP extracted internally!
+ * }
+ *
+ * // In AuthService (reads from context automatically)
+ * async login(dto: LoginDTO) {
+ *   const clientInfo = this.clientInfoService.get(); // From context!
+ *   // Use clientInfo.ipAddress, clientInfo.userAgent, etc.
+ * }
+ */
 let ClientInfoInterceptor = class ClientInfoInterceptor {
     config;
     geoLocationService;
@@ -27,6 +57,7 @@ let ClientInfoInterceptor = class ClientInfoInterceptor {
         this.geoLocationService = geoLocationService;
     }
     intercept(context, next) {
+        // Initialize context storage for this request (platform-agnostic)
         return new rxjs_1.Observable((subscriber) => {
             core_1.ContextStorage.run(() => {
                 this.extractAndStoreClientInfo(context, next).subscribe({
@@ -37,49 +68,101 @@ let ClientInfoInterceptor = class ClientInfoInterceptor {
             });
         });
     }
+    /**
+     * Extract and store client information in context
+     *
+     * @param context - Execution context
+     * @param next - Call handler
+     * @returns Observable
+     */
     extractAndStoreClientInfo(context, next) {
         const request = context.switchToHttp().getRequest();
         const response = context.switchToHttp().getResponse();
+        // Extract client information
         const headers = request.headers || {};
         const userAgent = headers['user-agent'];
         const userAgentString = typeof userAgent === 'string' ? userAgent : 'unknown';
+        // Parse user agent to extract platform and browser using ClientInfoService
         const parsedUA = this.clientInfoService.parseUserAgent(userAgentString);
+        // Extract device token from cookie (web) or header (mobile)
+        // Security: Never accept device token from request body (prevent client manipulation)
         const deviceTokenCookieName = this.config ? (0, core_1.getDeviceTokenCookieName)(this.config) : 'nauth_device_token';
         const deviceTokenCookie = request.cookies?.[deviceTokenCookieName];
         const deviceTokenHeader = headers['x-device-token'] || headers['X-Device-Token'];
         const deviceToken = (typeof deviceTokenCookie === 'string' ? deviceTokenCookie : undefined) ||
             (typeof deviceTokenHeader === 'string' ? deviceTokenHeader : undefined) ||
             (deviceTokenHeader ? String(deviceTokenHeader) : undefined);
+        // Extract sessionId and userId from token (set by AuthGuard after validation)
+        // sessionId and sub (userId) are strings in JWT payload, convert to number for database
         const sessionIdFromToken = request?.token?.sessionId;
         const sessionIdNumber = sessionIdFromToken ? parseInt(sessionIdFromToken, 10) : undefined;
         const userIdFromToken = request?.token?.sub;
         const userIdNumber = userIdFromToken ? parseInt(userIdFromToken, 10) : undefined;
         const clientInfo = {
+            //ipAddress: extractClientIp(request),
+            /**
+             * In development mode, assign a random known public IP address
+             * for better testability (to trigger geolocation flows, etc.).
+             * In production, default to 'unknown' if IP extraction fails.
+             */
             ipAddress: (0, core_1.extractClientIp)(request),
+            // process.env.NODE_ENV === 'development'
+            //   ? [
+            //       '203.97.24.118', // Invercargill, New Zealand
+            //       '194.103.82.33', // Umeå, Sweden
+            //       '80.12.134.67', // La Rochelle, France
+            //       '124.148.98.45', // Port Hedland, Australia
+            //       '200.68.114.22', // Mar del Plata, Argentina
+            //       '213.216.200.77', // Oulu, Finland
+            //       '206.248.142.91', // Timmins, Canada
+            //       '95.43.18.140', // Plovdiv, Bulgaria
+            //       '110.164.231.162', // Surat Thani, Thailand
+            //       '190.186.7.20', // Cochabamba, Bolivia
+            //     ][Math.floor(Math.random() * 10)]
+            //   : extractClientIp(request),
             userAgent: userAgentString,
-            deviceToken,
+            deviceToken, // Extracted from cookie or header only
+            // Use deviceName from request body if provided, otherwise parse from user agent
             deviceName: request.body?.deviceName || parsedUA.deviceName || undefined,
             deviceType: request.body?.deviceType || parsedUA.deviceType || undefined,
             platform: parsedUA.platform || undefined,
             browser: parsedUA.browser || undefined,
+            // Session ID from authenticated request (set by AuthGuard after token validation)
             sessionId: sessionIdNumber && !isNaN(sessionIdNumber) ? sessionIdNumber : undefined,
+            // User ID from authenticated request (set by AuthGuard after token validation)
             userId: userIdNumber && !isNaN(userIdNumber) ? userIdNumber : undefined,
+            // Geolocation populated below if GeoLocationService is available
             ipCountry: undefined,
             ipCity: undefined,
             ipLatitude: undefined,
             ipLongitude: undefined,
         };
+        // ============================================================================
+        // Populate Geolocation (Optional)
+        // ============================================================================
         if (this.geoLocationService && clientInfo.ipAddress) {
+            // Use RxJS operators to await geolocation lookup
+            // CRITICAL: Use catchError BEFORE switchMap to only catch geolocation errors,
+            // not errors from the controller (which would cause duplicate execution)
             return (0, rxjs_1.from)(this.geoLocationService.getIpGeolocation(clientInfo.ipAddress)).pipe((0, operators_1.catchError)(() => {
+                // Non-blocking: Silently fail - geolocation remains undefined
+                // Errors are already logged by GeoLocationService
+                // Return empty geo data to continue the request
                 return (0, rxjs_1.of)({ country: undefined, city: undefined, latitude: undefined, longitude: undefined });
             }), (0, operators_1.switchMap)((geo) => {
+                // Update clientInfo with geolocation (or undefined if lookup failed)
                 clientInfo.ipCountry = geo.country;
                 clientInfo.ipCity = geo.city;
                 clientInfo.ipLatitude = geo.latitude;
                 clientInfo.ipLongitude = geo.longitude;
+                // Store in async local storage for transparent access
                 core_1.ContextStorage.set('CLIENT_INFO', clientInfo);
+                // Store response object for services to access (e.g., for clearing cookies)
                 core_1.ContextStorage.set('HTTP_RESPONSE', response);
+                // Also attach to request object for @ClientInfo() decorator (backward compatibility)
                 request.clientInfo = clientInfo;
+                // Expose current session id for observability/debugging (set by AuthGuard after validation)
+                // This is safe metadata; tokens are never exposed. If unavailable, header is omitted.
                 const sessionId = request?.token?.sessionId;
                 if (sessionId && typeof response.setHeader === 'function') {
                     response.setHeader('X-Session-Id', sessionId);
@@ -87,9 +170,14 @@ let ClientInfoInterceptor = class ClientInfoInterceptor {
                 return next.handle();
             }));
         }
+        // Store in async local storage for transparent access
         core_1.ContextStorage.set('CLIENT_INFO', clientInfo);
+        // Store response object for services to access (e.g., for clearing cookies)
         core_1.ContextStorage.set('HTTP_RESPONSE', response);
+        // Also attach to request object for @ClientInfo() decorator (backward compatibility)
         request.clientInfo = clientInfo;
+        // Expose current session id for observability/debugging (set by AuthGuard after validation)
+        // This is safe metadata; tokens are never exposed. If unavailable, header is omitted.
         const sessionId = request?.token?.sessionId;
         if (sessionId && typeof response.setHeader === 'function') {
             response.setHeader('X-Session-Id', sessionId);

package/dist/interceptors/client-info.interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-info.interceptor.js","sourceRoot":"","sources":["../../src/interceptors/client-info.interceptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8G;AAC9G,+BAA4C;AAC5C,8CAAuD;AACvD,8CAO6B;AAC7B,2DAAkE;AAiC3D,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAMb;IAEA;IAPF,iBAAiB,GAAG,IAAI,wBAAiB,EAAE,CAAC;IAE7D,YAGmB,MAAoB,EAEpB,kBAAuC;QAFvC,WAAM,GAAN,MAAM,CAAc;QAEpB,uBAAkB,GAAlB,kBAAkB,CAAqB;IACvD,CAAC;IAEJ,SAAS,CAAC,OAAyB,EAAE,IAAiB;QAEpD,OAAO,IAAI,iBAAU,CAAC,CAAC,UAAU,EAAE,EAAE;YACnC,qBAAc,CAAC,GAAG,CAAC,GAAG,EAAE;gBACtB,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC;oBACtD,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;oBACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;oBACrC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE;iBACtC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IASO,yBAAyB,CAAC,OAAyB,EAAE,IAAiB;QAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;QAGtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,eAAe,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAG9E,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAIxE,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,+BAAwB,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACzG,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjF,MAAM,WAAW,GACf,CAAC,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,CAAC,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAI9D,MAAM,kBAAkB,GAAuB,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;QACzE,MAAM,eAAe,GAAuB,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,MAAM,eAAe,GAAuB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;QAChE,MAAM,YAAY,GAAuB,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAErG,MAAM,UAAU,GAAgB;YAO9B,SAAS,EAAE,IAAA,sBAAe,EAAC,OAAO,CAAC;YAgBnC,SAAS,EAAE,eAAe;YAC1B,WAAW;YAEX,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,SAAS;YACxE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,SAAS;YACxE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,SAAS;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,SAAS;YAEtC,SAAS,EAAE,eAAe,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAEnF,MAAM,EAAE,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;YAEvE,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE,SAAS;SACvB,CAAC;QAKF,IAAI,IAAI,CAAC,kBAAkB,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YAIpD,OAAO,IAAA,WAAI,EAAC,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAC9E,IAAA,sBAAU,EAAC,GAAG,EAAE;gBAId,OAAO,IAAA,SAAE,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,CAAC,CAAC,EACF,IAAA,qBAAS,EAAC,CAAC,GAAG,EAAE,EAAE;gBAEhB,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC;gBACnC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC;gBAC7B,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC;gBACrC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC;gBAGvC,qBAAc,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;gBAG9C,qBAAc,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBAG9C,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;gBAIhC,MAAM,SAAS,GAAuB,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;gBAChE,IAAI,SAAS,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBAC1D,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBAChD,CAAC;gBAED,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAGD,qBAAc,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAG9C,qBAAc,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAG9C,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;QAIhC,MAAM,SAAS,GAAuB,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;QAChE,IAAI,SAAS,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YAC1D,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;CACF,CAAA;AAjKY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,cAAc,CAAC,CAAA;IAEtB,WAAA,IAAA,iBAAQ,GAAE,CAAA;6CAC2B,6BAAkB;GAR/C,qBAAqB,CAiKjC"}
+{"version":3,"file":"client-info.interceptor.js","sourceRoot":"","sources":["../../src/interceptors/client-info.interceptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8G;AAC9G,+BAA4C;AAC5C,8CAAuD;AACvD,8CAO6B;AAC7B,2DAAkE;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAMb;IAEA;IAPF,iBAAiB,GAAG,IAAI,wBAAiB,EAAE,CAAC;IAE7D,YAGmB,MAAoB,EAEpB,kBAAuC;QAFvC,WAAM,GAAN,MAAM,CAAc;QAEpB,uBAAkB,GAAlB,kBAAkB,CAAqB;IACvD,CAAC;IAEJ,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,kEAAkE;QAClE,OAAO,IAAI,iBAAU,CAAC,CAAC,UAAU,EAAE,EAAE;YACnC,qBAAc,CAAC,GAAG,CAAC,GAAG,EAAE;gBACtB,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC;oBACtD,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;oBACvC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;oBACrC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE;iBACtC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,yBAAyB,CAAC,OAAyB,EAAE,IAAiB;QAC5E,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;QAEtD,6BAA6B;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,eAAe,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9E,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QAExE,4DAA4D;QAC5D,sFAAsF;QACtF,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,+BAAwB,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACzG,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjF,MAAM,WAAW,GACf,CAAC,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,CAAC,OAAO,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YACvE,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAE9D,8EAA8E;QAC9E,wFAAwF;QACxF,MAAM,kBAAkB,GAAuB,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;QACzE,MAAM,eAAe,GAAuB,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,MAAM,eAAe,GAAuB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;QAChE,MAAM,YAAY,GAAuB,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAErG,MAAM,UAAU,GAAgB;YAC9B,sCAAsC;YACtC;;;;eAIG;YACH,SAAS,EAAE,IAAA,sBAAe,EAAC,OAAO,CAAC;YACnC,yCAAyC;YACzC,QAAQ;YACR,sDAAsD;YACtD,yCAAyC;YACzC,+CAA+C;YAC/C,oDAAoD;YACpD,qDAAqD;YACrD,2CAA2C;YAC3C,6CAA6C;YAC7C,6CAA6C;YAC7C,oDAAoD;YACpD,+CAA+C;YAC/C,wCAAwC;YACxC,gCAAgC;YAEhC,SAAS,EAAE,eAAe;YAC1B,WAAW,EAAE,uCAAuC;YACpD,gFAAgF;YAChF,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,SAAS;YACxE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,QAAQ,CAAC,UAAU,IAAI,SAAS;YACxE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,SAAS;YACxC,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,SAAS;YACtC,kFAAkF;YAClF,SAAS,EAAE,eAAe,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YACnF,+EAA+E;YAC/E,MAAM,EAAE,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;YACvE,iEAAiE;YACjE,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE,SAAS;SACvB,CAAC;QAEF,+EAA+E;QAC/E,kCAAkC;QAClC,+EAA+E;QAC/E,IAAI,IAAI,CAAC,kBAAkB,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACpD,iDAAiD;YACjD,8EAA8E;YAC9E,yEAAyE;YACzE,OAAO,IAAA,WAAI,EAAC,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAC9E,IAAA,sBAAU,EAAC,GAAG,EAAE;gBACd,8DAA8D;gBAC9D,kDAAkD;gBAClD,gDAAgD;gBAChD,OAAO,IAAA,SAAE,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YAChG,CAAC,CAAC,EACF,IAAA,qBAAS,EAAC,CAAC,GAAG,EAAE,EAAE;gBAChB,qEAAqE;gBACrE,UAAU,CAAC,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC;gBACnC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC;gBAC7B,UAAU,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC;gBACrC,UAAU,CAAC,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC;gBAEvC,sDAAsD;gBACtD,qBAAc,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;gBAE9C,4EAA4E;gBAC5E,qBAAc,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;gBAE9C,qFAAqF;gBACrF,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;gBAEhC,4FAA4F;gBAC5F,sFAAsF;gBACtF,MAAM,SAAS,GAAuB,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;gBAChE,IAAI,SAAS,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBAC1D,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBAChD,CAAC;gBAED,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,CAAC,CAAC,CACH,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,qBAAc,CAAC,GAAG,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAE9C,4EAA4E;QAC5E,qBAAc,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAE9C,qFAAqF;QACrF,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;QAEhC,4FAA4F;QAC5F,sFAAsF;QACtF,MAAM,SAAS,GAAuB,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC;QAChE,IAAI,SAAS,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YAC1D,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;CACF,CAAA;AAjKY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,cAAc,CAAC,CAAA;IAEtB,WAAA,IAAA,iBAAQ,GAAE,CAAA;6CAC2B,6BAAkB;GAR/C,qBAAqB,CAiKjC"}

package/dist/interceptors/cookie-token.interceptor.d.ts

@@ -4,6 +4,22 @@ import { Observable } from 'rxjs';
 import { NAuthConfig } from '@nauth-toolkit/core';
 import { JwtService } from '@nauth-toolkit/core/internal';
 import { CsrfService } from '../services/csrf.service';
+/**
+ * Cookie Token Interceptor
+ *
+ * Automatically sets JWT tokens as httpOnly cookies for HTTP responses when
+ * token delivery mode is configured as 'cookies' or 'hybrid'.
+ *
+ * Security defaults:
+ * - Cookie names prefixed with 'nauth_' to avoid conflicts: 'nauth_access_token', 'nauth_refresh_token'
+ * - httpOnly: true (always)
+ * - secure: true (configurable via cookieOptions.secure)
+ * - sameSite: 'strict' (configurable via cookieOptions.sameSite)
+ * - path: '/' (configurable via cookieOptions.path)
+ *
+ * This interceptor is transport-aware and only applies to HTTP requests.
+ * It does nothing in other contexts (e.g., WebSocket, GraphQL).
+ */
 export declare class CookieTokenInterceptor implements NestInterceptor {
     private readonly config;
     private readonly jwtService;

package/dist/interceptors/cookie-token.interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookie-token.interceptor.d.ts","sourceRoot":"","sources":["../../src/interceptors/cookie-token.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAU,MAAM,gBAAgB,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,OAAO,EAEL,WAAW,EAQZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAkBvD,qBACa,sBAAuB,YAAW,eAAe;IAG1D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAHZ,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,WAAW,YAAA;IAG5C,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;CAuN7E"}
+{"version":3,"file":"cookie-token.interceptor.d.ts","sourceRoot":"","sources":["../../src/interceptors/cookie-token.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAU,MAAM,gBAAgB,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,OAAO,EAEL,WAAW,EAQZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;;;;;;;;;;;;GAeG;AACH,qBACa,sBAAuB,YAAW,eAAe;IAG1D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAHZ,MAAM,EAAE,WAAW,EACnB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,WAAW,YAAA;IAG5C,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;CAuN7E"}