@neohm/nestend 2.0.4 → 3.0.0

package/dist/auth/es6.classes.js

@@ -2,10 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.es6Classes = void 0;
 const auth_controller_1 = require("./controllers/auth.controller");
+const admin_auth_controller_1 = require("./controllers/admin.auth.controller");
 const api_key_service_1 = require("./services/api.key.service");
-const auth_context_service_1 = require("./services/auth.context.service");
 const auth_service_1 = require("./services/auth.service");
+const admin_auth_service_1 = require("./services/admin.auth.service");
 const google_auth_service_1 = require("./services/google.auth.service");
+const admin_login_dto_1 = require("./dtos/admin.login.dto");
 const change_password_dto_1 = require("./dtos/change.password.dto");
 const google_login_dto_1 = require("./dtos/google.login.dto");
 const login_dto_1 = require("./dtos/login.dto");
@@ -22,11 +24,35 @@ const user_details_subscriber_1 = require("./subscribers/user.details.subscriber
 const user_role_subscriber_1 = require("./subscribers/user.role.subscriber");
 const user_subscriber_1 = require("./subscribers/user.subscriber");
 exports.es6Classes = {
-    controllers: [auth_controller_1.AuthController],
-    services: [api_key_service_1.ApiKeyService, auth_context_service_1.AuthContextService, auth_service_1.AuthService, google_auth_service_1.GoogleAuthService],
+    controllers: [auth_controller_1.AuthController, admin_auth_controller_1.AdminAuthController],
+    services: [
+        api_key_service_1.ApiKeyService,
+        auth_service_1.AuthService,
+        admin_auth_service_1.AdminAuthService,
+        google_auth_service_1.GoogleAuthService,
+    ],
     libraries: [],
-    dtos: [change_password_dto_1.ChangePasswordDto, google_login_dto_1.GoogleLoginDto, login_dto_1.LoginDto, refresh_token_dto_1.RefreshTokenDto, register_dto_1.RegisterDto],
-    jobs: [system_refresh_token_job_1.SystemRefreshTokenJob, system_role_job_1.SystemRoleJob, user_details_job_1.UserDetailsJob, user_job_1.UserJob, user_role_job_1.UserRoleJob],
-    subscribers: [system_refresh_token_subscriber_1.SystemRefreshTokenSubscriber, system_role_subscriber_1.SystemRoleSubscriber, user_details_subscriber_1.UserDetailsSubscriber, user_role_subscriber_1.UserRoleSubscriber, user_subscriber_1.UserSubscriber],
+    dtos: [
+        admin_login_dto_1.AdminLoginDto,
+        change_password_dto_1.ChangePasswordDto,
+        google_login_dto_1.GoogleLoginDto,
+        login_dto_1.LoginDto,
+        refresh_token_dto_1.RefreshTokenDto,
+        register_dto_1.RegisterDto,
+    ],
+    jobs: [
+        system_refresh_token_job_1.SystemRefreshTokenJob,
+        system_role_job_1.SystemRoleJob,
+        user_details_job_1.UserDetailsJob,
+        user_job_1.UserJob,
+        user_role_job_1.UserRoleJob,
+    ],
+    subscribers: [
+        system_refresh_token_subscriber_1.SystemRefreshTokenSubscriber,
+        system_role_subscriber_1.SystemRoleSubscriber,
+        user_details_subscriber_1.UserDetailsSubscriber,
+        user_role_subscriber_1.UserRoleSubscriber,
+        user_subscriber_1.UserSubscriber,
+    ],
 };
 //# sourceMappingURL=es6.classes.js.map

package/dist/auth/es6.classes.js.map

@@ -1 +1 @@
-{"version":3,"file":"es6.classes.js","sourceRoot":"","sources":["../../src/auth/es6.classes.ts"],"names":[],"mappings":";;;AAAA,mEAA+D;AAC/D,gEAA2D;AAC3D,0EAAqE;AACrE,0DAAsD;AACtD,wEAAmE;AACnE,oEAA+D;AAC/D,8DAAyD;AACzD,gDAA4C;AAC5C,gEAA2D;AAC3D,sDAAkD;AAClD,8EAAwE;AACxE,4DAAuD;AACvD,8DAAyD;AACzD,8CAA0C;AAC1C,wDAAmD;AACnD,mGAA6F;AAC7F,iFAA4E;AAC5E,mFAA8E;AAC9E,6EAAwE;AACxE,mEAA+D;AAElD,QAAA,UAAU,GAAG;IACxB,WAAW,EAAE,CAAC,gCAAc,CAAC;IAC7B,QAAQ,EAAE,CAAC,+BAAa,EAAE,yCAAkB,EAAE,0BAAW,EAAE,uCAAiB,CAAU;IACtF,SAAS,EAAE,EAAE;IACb,IAAI,EAAE,CAAC,uCAAiB,EAAE,iCAAc,EAAE,oBAAQ,EAAE,mCAAe,EAAE,0BAAW,CAAC;IACjF,IAAI,EAAE,CAAC,gDAAqB,EAAE,+BAAa,EAAE,iCAAc,EAAE,kBAAO,EAAE,2BAAW,CAAC;IAClF,WAAW,EAAE,CAAC,8DAA4B,EAAE,6CAAoB,EAAE,+CAAqB,EAAE,yCAAkB,EAAE,gCAAc,CAAC;CAC7H,CAAC"}
+{"version":3,"file":"es6.classes.js","sourceRoot":"","sources":["../../src/auth/es6.classes.ts"],"names":[],"mappings":";;;AAAA,mEAA+D;AAC/D,+EAA0E;AAC1E,gEAA2D;AAC3D,0DAAsD;AACtD,sEAAiE;AACjE,wEAAmE;AACnE,4DAAuD;AACvD,oEAA+D;AAC/D,8DAAyD;AACzD,gDAA4C;AAC5C,gEAA2D;AAC3D,sDAAkD;AAClD,8EAAwE;AACxE,4DAAuD;AACvD,8DAAyD;AACzD,8CAA0C;AAC1C,wDAAmD;AACnD,mGAA6F;AAC7F,iFAA4E;AAC5E,mFAA8E;AAC9E,6EAAwE;AACxE,mEAA+D;AAElD,QAAA,UAAU,GAAG;IACxB,WAAW,EAAE,CAAC,gCAAc,EAAE,2CAAmB,CAAC;IAClD,QAAQ,EAAE;QACR,+BAAa;QACb,0BAAW;QACX,qCAAgB;QAChB,uCAAiB;KACT;IACV,SAAS,EAAE,EAAE;IACb,IAAI,EAAE;QACJ,+BAAa;QACb,uCAAiB;QACjB,iCAAc;QACd,oBAAQ;QACR,mCAAe;QACf,0BAAW;KACZ;IACD,IAAI,EAAE;QACJ,gDAAqB;QACrB,+BAAa;QACb,iCAAc;QACd,kBAAO;QACP,2BAAW;KACZ;IACD,WAAW,EAAE;QACX,8DAA4B;QAC5B,6CAAoB;QACpB,+CAAqB;QACrB,yCAAkB;QAClB,gCAAc;KACf;CACF,CAAC"}

package/dist/auth/helpers/admin.auth.d.ts

@@ -0,0 +1,6 @@
+export declare class AdminAuth {
+    static setAdminUserContext(adminUserId: string, sessionIdentifier?: string): Promise<void>;
+    static adminUser(): Record<string, any> | undefined;
+    static session(): string | undefined;
+}
+//# sourceMappingURL=admin.auth.d.ts.map

package/dist/auth/helpers/admin.auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.auth.d.ts","sourceRoot":"","sources":["../../../src/auth/helpers/admin.auth.ts"],"names":[],"mappings":"AAgBA,qBAAa,SAAS;WACP,mBAAmB,CAC9B,WAAW,EAAE,MAAM,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,IAAI,CAAC;IAehB,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAInD,MAAM,CAAC,OAAO,IAAI,MAAM,GAAG,SAAS;CAGrC"}

package/dist/auth/helpers/admin.auth.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminAuth = void 0;
+const async_hooks_1 = require("async_hooks");
+const admin_user_entity_1 = require("../entities/admin.user.entity");
+const storage = new async_hooks_1.AsyncLocalStorage();
+class AdminAuth {
+    static async setAdminUserContext(adminUserId, sessionIdentifier) {
+        const adminUser = await admin_user_entity_1.AdminUserEntity.findOne({
+            where: { id: adminUserId },
+        });
+        if (!adminUser)
+            return;
+        const adminUserObject = { ...adminUser };
+        delete adminUserObject.password;
+        delete adminUserObject.created_at;
+        delete adminUserObject.updated_at;
+        delete adminUserObject.deleted_at;
+        storage.enterWith({ adminUser: adminUserObject, sessionIdentifier });
+    }
+    static adminUser() {
+        return storage.getStore()?.adminUser;
+    }
+    static session() {
+        return storage.getStore()?.sessionIdentifier;
+    }
+}
+exports.AdminAuth = AdminAuth;
+//# sourceMappingURL=admin.auth.js.map

package/dist/auth/helpers/admin.auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.auth.js","sourceRoot":"","sources":["../../../src/auth/helpers/admin.auth.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAChD,qEAAgE;AAOhE,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAyB,CAAC;AAQ/D,MAAa,SAAS;IACpB,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,WAAmB,EACnB,iBAA0B;QAE1B,MAAM,SAAS,GAAG,MAAM,mCAAe,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,eAAe,GAAwB,EAAE,GAAG,SAAS,EAAE,CAAC;QAC9D,OAAO,eAAe,CAAC,QAAQ,CAAC;QAChC,OAAO,eAAe,CAAC,UAAU,CAAC;QAClC,OAAO,eAAe,CAAC,UAAU,CAAC;QAClC,OAAO,eAAe,CAAC,UAAU,CAAC;QAElC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,CAAC,SAAS;QACd,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,OAAO;QACZ,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC;IAC/C,CAAC;CACF;AA1BD,8BA0BC"}

package/dist/auth/helpers/api.key.context.d.ts

@@ -0,0 +1,6 @@
+import { ApiKeyEntity } from '../entities/api.key.entity';
+export declare class ApiKeyContext {
+    static set(apiKey: ApiKeyEntity): void;
+    static apiKey(): ApiKeyEntity | undefined;
+}
+//# sourceMappingURL=api.key.context.d.ts.map

package/dist/auth/helpers/api.key.context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.key.context.d.ts","sourceRoot":"","sources":["../../../src/auth/helpers/api.key.context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAU1D,qBAAa,aAAa;IACxB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAItC,MAAM,CAAC,MAAM,IAAI,YAAY,GAAG,SAAS;CAG1C"}

package/dist/auth/helpers/api.key.context.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyContext = void 0;
+const async_hooks_1 = require("async_hooks");
+const storage = new async_hooks_1.AsyncLocalStorage();
+class ApiKeyContext {
+    static set(apiKey) {
+        storage.enterWith(apiKey);
+    }
+    static apiKey() {
+        return storage.getStore();
+    }
+}
+exports.ApiKeyContext = ApiKeyContext;
+//# sourceMappingURL=api.key.context.js.map

package/dist/auth/helpers/api.key.context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.key.context.js","sourceRoot":"","sources":["../../../src/auth/helpers/api.key.context.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAGhD,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAgB,CAAC;AAQtD,MAAa,aAAa;IACxB,MAAM,CAAC,GAAG,CAAC,MAAoB;QAC7B,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,MAAM;QACX,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;CACF;AARD,sCAQC"}

package/dist/auth/helpers/auth.d.ts

@@ -0,0 +1,6 @@
+export declare class Auth {
+    static setUserContext(userId: string, sessionIdentifier?: string): Promise<void>;
+    static user(): Record<string, any> | undefined;
+    static session(): string | undefined;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/helpers/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/auth/helpers/auth.ts"],"names":[],"mappings":"AAgBA,qBAAa,IAAI;WACF,cAAc,CACzB,MAAM,EAAE,MAAM,EACd,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,IAAI,CAAC;IAahB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAI9C,MAAM,CAAC,OAAO,IAAI,MAAM,GAAG,SAAS;CAGrC"}

package/dist/auth/helpers/auth.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auth = void 0;
+const async_hooks_1 = require("async_hooks");
+const user_entity_1 = require("../entities/user.entity");
+const storage = new async_hooks_1.AsyncLocalStorage();
+class Auth {
+    static async setUserContext(userId, sessionIdentifier) {
+        const user = await user_entity_1.UserEntity.findOne({ where: { id: userId } });
+        if (!user)
+            return;
+        const userObject = { ...user };
+        delete userObject.password;
+        delete userObject.created_at;
+        delete userObject.updated_at;
+        delete userObject.deleted_at;
+        storage.enterWith({ user: userObject, sessionIdentifier });
+    }
+    static user() {
+        return storage.getStore()?.user;
+    }
+    static session() {
+        return storage.getStore()?.sessionIdentifier;
+    }
+}
+exports.Auth = Auth;
+//# sourceMappingURL=auth.js.map

package/dist/auth/helpers/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/auth/helpers/auth.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAChD,yDAAqD;AAOrD,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAoB,CAAC;AAQ1D,MAAa,IAAI;IACf,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,MAAc,EACd,iBAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,UAAU,GAAwB,EAAE,GAAG,IAAI,EAAE,CAAC;QACpD,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC3B,OAAO,UAAU,CAAC,UAAU,CAAC;QAC7B,OAAO,UAAU,CAAC,UAAU,CAAC;QAC7B,OAAO,UAAU,CAAC,UAAU,CAAC;QAE7B,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,CAAC,IAAI;QACT,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,OAAO;QACZ,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC;IAC/C,CAAC;CACF;AAxBD,oBAwBC"}

package/dist/auth/middlewares/admin.jwt.middleware.d.ts

@@ -0,0 +1,10 @@
+import { NestMiddleware } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { NextFunction, Request, Response } from 'express';
+export declare class AdminJwtMiddleware implements NestMiddleware {
+    private readonly jwtService;
+    constructor(jwtService: JwtService);
+    use(request: Request, _response: Response, next: NextFunction): Promise<void>;
+    private extractToken;
+}
+//# sourceMappingURL=admin.jwt.middleware.d.ts.map

package/dist/auth/middlewares/admin.jwt.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.jwt.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/admin.jwt.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkB1D,qBACa,kBAAmB,YAAW,cAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IAE7C,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;IAyBhB,OAAO,CAAC,YAAY;CAOrB"}

package/dist/auth/middlewares/admin.jwt.middleware.js

@@ -0,0 +1,59 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminJwtMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
+const admin_auth_1 = require("../helpers/admin.auth");
+let AdminJwtMiddleware = class AdminJwtMiddleware {
+    constructor(jwtService) {
+        this.jwtService = jwtService;
+    }
+    async use(request, _response, next) {
+        const token = this.extractToken(request);
+        if (token) {
+            try {
+                const payload = await this.jwtService.verifyAsync(token, {
+                    secret: process.env.ACCESS_TOKEN_SECRET,
+                });
+                if (payload.sid) {
+                    const session = await system_auth_session_entity_1.SystemAuthSessionEntity.findOne({
+                        where: { session_identifier: payload.sid, is_admin: true },
+                    });
+                    const active = !!session &&
+                        !session.invalidated_at &&
+                        session.expires_at.getTime() > Date.now();
+                    if (active)
+                        await admin_auth_1.AdminAuth.setAdminUserContext(payload.sub, payload.sid);
+                }
+            }
+            catch {
+            }
+        }
+        next();
+    }
+    extractToken(request) {
+        const header = request.headers['authorization'];
+        if (!header)
+            return undefined;
+        const [scheme, value] = header.split(' ');
+        if (scheme?.toLowerCase() !== 'bearer' || !value)
+            return undefined;
+        return value.trim();
+    }
+};
+exports.AdminJwtMiddleware = AdminJwtMiddleware;
+exports.AdminJwtMiddleware = AdminJwtMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwt_1.JwtService])
+], AdminJwtMiddleware);
+//# sourceMappingURL=admin.jwt.middleware.js.map

package/dist/auth/middlewares/admin.jwt.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.jwt.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/admin.jwt.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAC5D,qCAAyC;AAEzC,uFAAiF;AAEjF,sDAAkD;AAgB3C,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAa,KAAK,EAAE;oBACnE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;iBACxC,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;oBAChB,MAAM,OAAO,GAAG,MAAM,oDAAuB,CAAC,OAAO,CAAC;wBACpD,KAAK,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;qBAC3D,CAAC,CAAC;oBACH,MAAM,MAAM,GACV,CAAC,CAAC,OAAO;wBACT,CAAC,OAAO,CAAC,cAAc;wBACvB,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC5C,IAAI,MAAM;wBACR,MAAM,sBAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAEO,YAAY,CAAC,OAAgB;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAA;AAvCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAE8B,gBAAU;GADxC,kBAAkB,CAuC9B"}

package/dist/auth/middlewares/api.key.middleware.d.ts

@@ -0,0 +1,10 @@
+import { NestMiddleware } from '@nestjs/common';
+import { NextFunction, Request, Response } from 'express';
+import { ApiKeyService } from '../services/api.key.service';
+export declare class ApiKeyMiddleware implements NestMiddleware {
+    private readonly apiKeyService;
+    constructor(apiKeyService: ApiKeyService);
+    use(request: Request, _response: Response, next: NextFunction): Promise<void>;
+    private extractKey;
+}
+//# sourceMappingURL=api.key.middleware.d.ts.map

package/dist/auth/middlewares/api.key.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.key.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/api.key.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAe5D,qBACa,gBAAiB,YAAW,cAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAEnD,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;IAShB,OAAO,CAAC,UAAU;CAYnB"}

package/dist/auth/middlewares/api.key.middleware.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const api_key_default_enum_1 = require("../enums/api.key.default.enum");
+const api_key_service_1 = require("../services/api.key.service");
+const api_key_context_1 = require("../helpers/api.key.context");
+let ApiKeyMiddleware = class ApiKeyMiddleware {
+    constructor(apiKeyService) {
+        this.apiKeyService = apiKeyService;
+    }
+    async use(request, _response, next) {
+        const rawKey = this.extractKey(request);
+        if (rawKey) {
+            const apiKey = await this.apiKeyService.validateApiKey(rawKey);
+            if (apiKey)
+                api_key_context_1.ApiKeyContext.set(apiKey);
+        }
+        next();
+    }
+    extractKey(request) {
+        const headerName = process.env.API_KEY_HEADER_NAME || api_key_default_enum_1.ApiKeyDefault.HEADER_NAME;
+        const headerKey = request.headers[headerName];
+        if (headerKey)
+            return Array.isArray(headerKey) ? headerKey[0] : headerKey;
+        const authorization = request.headers.authorization;
+        if (authorization?.toLowerCase().startsWith('apikey ')) {
+            return authorization.slice('apikey '.length).trim();
+        }
+        return null;
+    }
+};
+exports.ApiKeyMiddleware = ApiKeyMiddleware;
+exports.ApiKeyMiddleware = ApiKeyMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [api_key_service_1.ApiKeyService])
+], ApiKeyMiddleware);
+//# sourceMappingURL=api.key.middleware.js.map

package/dist/auth/middlewares/api.key.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.key.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/api.key.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAE5D,wEAA8D;AAC9D,iEAA4D;AAC5D,gEAA2D;AAepD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAA6B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;IAAG,CAAC;IAE7D,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,MAAM;gBAAE,+BAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAEO,UAAU,CAAC,OAAgB;QACjC,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oCAAa,CAAC,WAAW,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,aAAa,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA5BY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAEiC,+BAAa;GAD9C,gBAAgB,CA4B5B"}

package/dist/auth/middlewares/jwt.middleware.d.ts

@@ -0,0 +1,10 @@
+import { NestMiddleware } from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { NextFunction, Request, Response } from 'express';
+export declare class JwtMiddleware implements NestMiddleware {
+    private readonly jwtService;
+    constructor(jwtService: JwtService);
+    use(request: Request, _response: Response, next: NextFunction): Promise<void>;
+    private extractToken;
+}
+//# sourceMappingURL=jwt.middleware.d.ts.map

package/dist/auth/middlewares/jwt.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/jwt.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkB1D,qBACa,aAAc,YAAW,cAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IAE7C,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;IAwBhB,OAAO,CAAC,YAAY;CAOrB"}

package/dist/auth/middlewares/jwt.middleware.js

@@ -0,0 +1,59 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
+const auth_1 = require("../helpers/auth");
+let JwtMiddleware = class JwtMiddleware {
+    constructor(jwtService) {
+        this.jwtService = jwtService;
+    }
+    async use(request, _response, next) {
+        const token = this.extractToken(request);
+        if (token) {
+            try {
+                const payload = await this.jwtService.verifyAsync(token, {
+                    secret: process.env.ACCESS_TOKEN_SECRET,
+                });
+                if (payload.sid) {
+                    const session = await system_auth_session_entity_1.SystemAuthSessionEntity.findOne({
+                        where: { session_identifier: payload.sid, is_admin: false },
+                    });
+                    const active = !!session &&
+                        !session.invalidated_at &&
+                        session.expires_at.getTime() > Date.now();
+                    if (active)
+                        await auth_1.Auth.setUserContext(payload.sub, payload.sid);
+                }
+            }
+            catch {
+            }
+        }
+        next();
+    }
+    extractToken(request) {
+        const header = request.headers['authorization'];
+        if (!header)
+            return undefined;
+        const [scheme, value] = header.split(' ');
+        if (scheme?.toLowerCase() !== 'bearer' || !value)
+            return undefined;
+        return value.trim();
+    }
+};
+exports.JwtMiddleware = JwtMiddleware;
+exports.JwtMiddleware = JwtMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwt_1.JwtService])
+], JwtMiddleware);
+//# sourceMappingURL=jwt.middleware.js.map

package/dist/auth/middlewares/jwt.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/jwt.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAC5D,qCAAyC;AAEzC,uFAAiF;AAEjF,0CAAuC;AAgBhC,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAa,KAAK,EAAE;oBACnE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;iBACxC,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;oBAChB,MAAM,OAAO,GAAG,MAAM,oDAAuB,CAAC,OAAO,CAAC;wBACpD,KAAK,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE;qBAC5D,CAAC,CAAC;oBACH,MAAM,MAAM,GACV,CAAC,CAAC,OAAO;wBACT,CAAC,OAAO,CAAC,cAAc;wBACvB,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC5C,IAAI,MAAM;wBAAE,MAAM,WAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAEO,YAAY,CAAC,OAAgB;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAA;AAtCY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAE8B,gBAAU;GADxC,aAAa,CAsCzB"}

package/dist/auth/services/admin.auth.service.d.ts

@@ -0,0 +1,19 @@
+import { JwtService } from '@nestjs/jwt';
+import { DataSource } from 'typeorm';
+import { AdminUserEntity } from '../entities/admin.user.entity';
+import { AdminAuthenticatedAccess, AuthTokenPair, IssueTokensUser, TokenIssueContext } from '../types/auth.types';
+export declare class AdminAuthService {
+    private readonly jwtService;
+    private readonly dataSource;
+    constructor(jwtService: JwtService, dataSource: DataSource);
+    validateRole(roleIdentifier?: string): Promise<AdminAuthenticatedAccess>;
+    validateCredentials(emailOrUsername: string, password: string): Promise<AdminUserEntity>;
+    issueTokens(user: IssueTokensUser, context?: TokenIssueContext): Promise<AuthTokenPair>;
+    refresh(rawRefreshToken: string, context?: TokenIssueContext): Promise<AuthTokenPair>;
+    revokeOne(rawRefreshToken: string): Promise<void>;
+    logout(rawRefreshToken: string): Promise<void>;
+    private hashToken;
+    private get refreshTokenRepo();
+    private get sessionRepo();
+}
+//# sourceMappingURL=admin.auth.service.d.ts.map

package/dist/auth/services/admin.auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.auth.service.d.ts","sourceRoot":"","sources":["../../../src/auth/services/admin.auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAsB,MAAM,SAAS,CAAC;AAIzD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,eAAe,EACf,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAI7B,qBACa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,UAAU,EAAE,UAAU,EACtB,UAAU,EAAE,UAAU;IASnC,YAAY,CAChB,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,wBAAwB,CAAC;IA6B9B,mBAAmB,CACvB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC;IAsBrB,WAAW,CACf,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,aAAa,CAAC;IAuDnB,OAAO,CACX,eAAe,EAAE,MAAM,EACvB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,aAAa,CAAC;IAiCnB,SAAS,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAajD,MAAM,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpD,OAAO,CAAC,SAAS;IAIjB,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,KAAK,WAAW,GAEtB;CACF"}

package/dist/auth/services/admin.auth.service.js

@@ -0,0 +1,160 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const typeorm_1 = require("typeorm");
+const crypto_1 = require("crypto");
+const system_refresh_token_entity_1 = require("../entities/system.refresh.token.entity");
+const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
+const admin_user_entity_1 = require("../entities/admin.user.entity");
+const system_admin_user_role_entity_1 = require("../entities/system.admin.user.role.entity");
+const access_exception_1 = require("../../global/exceptions/access.exception");
+const admin_auth_1 = require("../helpers/admin.auth");
+const auth_utilities_1 = require("../utilities/auth.utilities");
+let AdminAuthService = class AdminAuthService {
+    constructor(jwtService, dataSource) {
+        this.jwtService = jwtService;
+        this.dataSource = dataSource;
+    }
+    async validateRole(roleIdentifier) {
+        const user = admin_auth_1.AdminAuth.adminUser();
+        if (!user)
+            throw new access_exception_1.AccessException('Authentication required: no active session.');
+        const adminUserRoles = await system_admin_user_role_entity_1.SystemAdminUserRoleEntity.find({
+            where: { admin_user_id: user.id },
+            relations: { role: true },
+        });
+        const roles = adminUserRoles
+            .map((adminUserRole) => adminUserRole.role)
+            .filter((role) => !!role);
+        if (roleIdentifier &&
+            !roles.some((role) => role.identifier === roleIdentifier)) {
+            throw new access_exception_1.AccessException(`This action requires the "${roleIdentifier}" role.`);
+        }
+        return { user, roles };
+    }
+    async validateCredentials(emailOrUsername, password) {
+        const user = await this.dataSource
+            .getRepository(admin_user_entity_1.AdminUserEntity)
+            .createQueryBuilder('admin_user')
+            .addSelect('admin_user.password')
+            .where('admin_user.email = :value OR admin_user.username = :value', {
+            value: emailOrUsername,
+        })
+            .getOne();
+        if (!user || !user.password) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        const matches = await auth_utilities_1.AuthUtility.comparePassword(password, user.password);
+        if (!matches) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        delete user.password;
+        return user;
+    }
+    async issueTokens(user, context) {
+        const jti = (0, crypto_1.randomUUID)();
+        const accessExpiry = process.env.ACCESS_TOKEN_EXPIRY;
+        const refreshExpiry = process.env.REFRESH_TOKEN_EXPIRY;
+        const sessionIdentifier = this.hashToken(`${Date.now()}:${user.id}`);
+        const sessionExpiresAt = new Date(Date.now() + auth_utilities_1.AuthUtility.parseExpiryMs(accessExpiry));
+        await this.sessionRepo.save(this.sessionRepo.create({
+            user_id: user.id,
+            is_admin: true,
+            session_identifier: sessionIdentifier,
+            expires_at: sessionExpiresAt,
+            invalidated_at: null,
+        }));
+        const accessToken = await this.jwtService.signAsync({ sub: user.id, email: user.email, jti, sid: sessionIdentifier }, {
+            secret: process.env.ACCESS_TOKEN_SECRET,
+            expiresIn: accessExpiry,
+        });
+        const refreshToken = await this.jwtService.signAsync({ sub: user.id, email: user.email }, {
+            secret: process.env.REFRESH_TOKEN_SECRET,
+            expiresIn: refreshExpiry,
+        });
+        const tokenHash = this.hashToken(refreshToken);
+        const expiresAt = new Date(Date.now() + auth_utilities_1.AuthUtility.parseExpiryMs(refreshExpiry));
+        await this.refreshTokenRepo.save(this.refreshTokenRepo.create({
+            user_id: user.id,
+            is_admin: true,
+            token_hash: tokenHash,
+            expires_at: expiresAt,
+            revoked_at: null,
+            ip_address: context?.ip_address ?? null,
+            user_agent: context?.user_agent ?? null,
+        }));
+        return { access_token: accessToken, refresh_token: refreshToken };
+    }
+    async refresh(rawRefreshToken, context) {
+        let payload;
+        try {
+            payload = await this.jwtService.verifyAsync(rawRefreshToken, {
+                secret: process.env.REFRESH_TOKEN_SECRET,
+            });
+        }
+        catch {
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        }
+        const tokenHash = this.hashToken(rawRefreshToken);
+        const stored = await this.refreshTokenRepo.findOne({
+            where: {
+                user_id: payload.sub,
+                is_admin: true,
+                token_hash: tokenHash,
+                revoked_at: (0, typeorm_1.IsNull)(),
+            },
+        });
+        if (!stored)
+            throw new common_1.UnauthorizedException('Refresh token not found or already revoked');
+        if (stored.expires_at < new Date())
+            throw new common_1.UnauthorizedException('Refresh token has expired');
+        stored.revoked_at = new Date();
+        await this.refreshTokenRepo.save(stored);
+        return this.issueTokens({ id: payload.sub, email: payload.email }, context);
+    }
+    async revokeOne(rawRefreshToken) {
+        const tokenHash = this.hashToken(rawRefreshToken);
+        await this.refreshTokenRepo
+            .createQueryBuilder()
+            .update()
+            .set({ revoked_at: new Date() })
+            .where('token_hash = :hash AND is_admin = true AND revoked_at IS NULL', {
+            hash: tokenHash,
+        })
+            .execute();
+    }
+    async logout(rawRefreshToken) {
+        await this.revokeOne(rawRefreshToken);
+        const sessionIdentifier = admin_auth_1.AdminAuth.session();
+        if (sessionIdentifier) {
+            await this.sessionRepo.update({ session_identifier: sessionIdentifier, is_admin: true }, { invalidated_at: new Date() });
+        }
+    }
+    hashToken(token) {
+        return (0, crypto_1.createHash)('sha256').update(token).digest('hex');
+    }
+    get refreshTokenRepo() {
+        return this.dataSource.getRepository(system_refresh_token_entity_1.SystemRefreshTokenEntity);
+    }
+    get sessionRepo() {
+        return this.dataSource.getRepository(system_auth_session_entity_1.SystemAuthSessionEntity);
+    }
+};
+exports.AdminAuthService = AdminAuthService;
+exports.AdminAuthService = AdminAuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [jwt_1.JwtService,
+        typeorm_1.DataSource])
+], AdminAuthService);
+//# sourceMappingURL=admin.auth.service.js.map

package/dist/auth/services/admin.auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.auth.service.js","sourceRoot":"","sources":["../../../src/auth/services/admin.auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,qCAAyC;AACzC,qCAAyD;AACzD,mCAAgD;AAChD,yFAAmF;AACnF,uFAAiF;AACjF,qEAAgE;AAChE,6FAAsF;AACtF,+EAA2E;AAO3E,sDAAkD;AAClD,gEAA0D;AAGnD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YACmB,UAAsB,EACtB,UAAsB;QADtB,eAAU,GAAV,UAAU,CAAY;QACtB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAQJ,KAAK,CAAC,YAAY,CAChB,cAAuB;QAEvB,MAAM,IAAI,GAAG,sBAAS,CAAC,SAAS,EAAiC,CAAC;QAClE,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,kCAAe,CAAC,6CAA6C,CAAC,CAAC;QAE3E,MAAM,cAAc,GAAG,MAAM,yDAAyB,CAAC,IAAI,CAAC;YAC1D,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;YACjC,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,cAAc;aACzB,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC;aAC1C,MAAM,CAAC,CAAC,IAAI,EAAoC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE9D,IACE,cAAc;YACd,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,KAAK,cAAc,CAAC,EACzD,CAAC;YACD,MAAM,IAAI,kCAAe,CACvB,6BAA6B,cAAc,SAAS,CACrD,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,eAAuB,EACvB,QAAgB;QAEhB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU;aAC/B,aAAa,CAAC,mCAAe,CAAC;aAC9B,kBAAkB,CAAC,YAAY,CAAC;aAChC,SAAS,CAAC,qBAAqB,CAAC;aAChC,KAAK,CAAC,2DAA2D,EAAE;YAClE,KAAK,EAAE,eAAe;SACvB,CAAC;aACD,MAAM,EAAE,CAAC;QAEZ,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,OAAQ,IAA8B,CAAC,QAAQ,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CACf,IAAqB,EACrB,OAA2B;QAE3B,MAAM,GAAG,GAAG,IAAA,mBAAU,GAAE,CAAC;QACzB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QACrD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAEvD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,gBAAgB,GAAG,IAAI,IAAI,CAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,4BAAW,CAAC,aAAa,CAAC,YAAY,CAAC,CACrD,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACtB,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,kBAAkB,EAAE,iBAAiB;YACrC,UAAU,EAAE,gBAAgB;YAC5B,cAAc,EAAE,IAAI;SACrB,CAAC,CACH,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CACjD,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAChE;YACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;YACvC,SAAS,EAAE,YAAmB;SAC/B,CACF,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAClD,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EACnC;YACE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACxC,SAAS,EAAE,aAAoB;SAChC,CACF,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE,GAAG,4BAAW,CAAC,aAAa,CAAC,aAAa,CAAC,CACtD,CAAC;QAEF,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAC9B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC3B,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI;YACvC,UAAU,EAAE,OAAO,EAAE,UAAU,IAAI,IAAI;SACxC,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,eAAuB,EACvB,OAA2B;QAE3B,IAAI,OAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe,EAAE;gBAC3D,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE;gBACL,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,IAAA,gBAAM,GAAE;aACrB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,8BAAqB,CAC7B,4CAA4C,CAC7C,CAAC;QACJ,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE;YAChC,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAE/D,MAAM,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEzC,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,eAAuB;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,gBAAgB;aACxB,kBAAkB,EAAE;aACpB,MAAM,EAAE;aACR,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,+DAA+D,EAAE;YACtE,IAAI,EAAE,SAAS;SAChB,CAAC;aACD,OAAO,EAAE,CAAC;IACf,CAAC;IAGD,KAAK,CAAC,MAAM,CAAC,eAAuB;QAClC,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAEtC,MAAM,iBAAiB,GAAG,sBAAS,CAAC,OAAO,EAAE,CAAC;QAC9C,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAC3B,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,EACzD,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,EAAE,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAAa;QAC7B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,sDAAwB,CAAC,CAAC;IACjE,CAAC;IAED,IAAY,WAAW;QACrB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,oDAAuB,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AAtMY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAGoB,gBAAU;QACV,oBAAU;GAH9B,gBAAgB,CAsM5B"}