@neohm/nestend 4.1.0 → 5.0.0

package/dist/admin/utilities/tenant.role.policy.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantRolePolicy = void 0;
+const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
+const role_tier_enum_1 = require("../../auth/enums/role.tier.enum");
+const tenant_role_enum_1 = require("../../auth/enums/tenant.role.enum");
+const RESERVED = new Set(Object.values(tenant_role_enum_1.TenantRole));
+class TenantRolePolicy {
+    static isReserved(identifier) {
+        return !!identifier && RESERVED.has(identifier);
+    }
+    static isPrivileged(identifier) {
+        if (!identifier)
+            return false;
+        return (RESERVED.has(identifier) || identifier.endsWith(`.${role_tier_enum_1.RoleTier.MANAGER}`));
+    }
+    static newPrivilegedGrants(roles, heldRoleIds = []) {
+        const held = new Set(heldRoleIds);
+        return roles.filter((role) => !held.has(role.id) && TenantRolePolicy.isPrivileged(role.identifier));
+    }
+    static tenantUserSaveRole(input) {
+        if (input.grantsPrivileged)
+            return global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_SUPER_ADMIN;
+        if (input.emailChanged && input.holdsPrivileged)
+            return global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_SUPER_ADMIN;
+        return global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_ADMIN;
+    }
+    static emailChanged(current, next) {
+        if (next === undefined || next === null)
+            return false;
+        return (current ?? '').toLowerCase() !== next.toLowerCase();
+    }
+}
+exports.TenantRolePolicy = TenantRolePolicy;
+//# sourceMappingURL=tenant.role.policy.js.map

package/dist/admin/utilities/tenant.role.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.role.policy.js","sourceRoot":"","sources":["../../../src/admin/utilities/tenant.role.policy.ts"],"names":[],"mappings":";;;AAAA,sFAA4E;AAC5E,oEAA2D;AAC3D,wEAA+D;AAE/D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,6BAAU,CAAC,CAAC,CAAC;AAG5D,MAAa,gBAAgB;IAE3B,MAAM,CAAC,UAAU,CAAC,UAAqC;QACrD,OAAO,CAAC,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAGD,MAAM,CAAC,YAAY,CAAC,UAAqC;QACvD,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,CACL,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,yBAAQ,CAAC,OAAO,EAAE,CAAC,CACxE,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,mBAAmB,CACxB,KAAU,EACV,cAAgC,EAAE;QAElC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,CACjB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAC/E,CAAC;IACJ,CAAC;IAOD,MAAM,CAAC,kBAAkB,CAAC,KAIzB;QACC,IAAI,KAAK,CAAC,gBAAgB;YAAE,OAAO,0CAAgB,CAAC,kBAAkB,CAAC;QACvE,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe;YAC7C,OAAO,0CAAgB,CAAC,kBAAkB,CAAC;QAC7C,OAAO,0CAAgB,CAAC,YAAY,CAAC;IACvC,CAAC;IAGD,MAAM,CAAC,YAAY,CACjB,OAAkC,EAClC,IAA+B;QAE/B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;CACF;AAjDD,4CAiDC"}

package/dist/admin/validators/admin.patterns.d.ts

@@ -0,0 +1,5 @@
+export declare const TEMPLATE_IDENTIFIER_PATTERN: RegExp;
+export declare const TEMPLATE_PATH_PATTERN: RegExp;
+export declare const CATALOGUE_IDENTIFIER_PATTERN: RegExp;
+export declare const USERNAME_PATTERN: RegExp;
+//# sourceMappingURL=admin.patterns.d.ts.map

package/dist/admin/validators/admin.patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.patterns.d.ts","sourceRoot":"","sources":["../../../src/admin/validators/admin.patterns.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,2BAA2B,QAAkC,CAAC;AAG3E,eAAO,MAAM,qBAAqB,QACK,CAAC;AAGxC,eAAO,MAAM,4BAA4B,QAAoC,CAAC;AAG9E,eAAO,MAAM,gBAAgB,QAAsB,CAAC"}

package/dist/admin/validators/admin.patterns.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.USERNAME_PATTERN = exports.CATALOGUE_IDENTIFIER_PATTERN = exports.TEMPLATE_PATH_PATTERN = exports.TEMPLATE_IDENTIFIER_PATTERN = void 0;
+exports.TEMPLATE_IDENTIFIER_PATTERN = /^[a-z0-9_-]+(\.[a-z0-9_-]+)*$/;
+exports.TEMPLATE_PATH_PATTERN = /^((?!\.{1,2}\/)[A-Za-z0-9._-]+\/)*$/;
+exports.CATALOGUE_IDENTIFIER_PATTERN = /^[a-z0-9_-]+([.:][a-z0-9_-]+)*$/;
+exports.USERNAME_PATTERN = /^[A-Za-z0-9._-]+$/;
+//# sourceMappingURL=admin.patterns.js.map

package/dist/admin/validators/admin.patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.patterns.js","sourceRoot":"","sources":["../../../src/admin/validators/admin.patterns.ts"],"names":[],"mappings":";;;AACa,QAAA,2BAA2B,GAAG,+BAA+B,CAAC;AAG9D,QAAA,qBAAqB,GAChC,qCAAqC,CAAC;AAG3B,QAAA,4BAA4B,GAAG,iCAAiC,CAAC;AAGjE,QAAA,gBAAgB,GAAG,mBAAmB,CAAC"}

package/dist/admin/validators/admin.validators.d.ts

@@ -0,0 +1,5 @@
+import { ValidationOptions } from 'class-validator';
+export declare function jsonByteSize(value: unknown): number;
+export declare function MaxJsonSize(maxBytes?: number, options?: ValidationOptions): (target: object, propertyName: string) => void;
+export declare function IsFutureDate(options?: ValidationOptions): (target: object, propertyName: string) => void;
+//# sourceMappingURL=admin.validators.d.ts.map

package/dist/admin/validators/admin.validators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.validators.d.ts","sourceRoot":"","sources":["../../../src/admin/validators/admin.validators.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAIvE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMnD;AAGD,wBAAgB,WAAW,CACzB,QAAQ,GAAE,MAAkC,EAC5C,OAAO,CAAC,EAAE,iBAAiB,IAEV,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,IAAI,CAiB7D;AAGD,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,iBAAiB,IACrC,QAAQ,MAAM,EAAE,cAAc,MAAM,KAAG,IAAI,CAkB7D"}

package/dist/admin/validators/admin.validators.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jsonByteSize = jsonByteSize;
+exports.MaxJsonSize = MaxJsonSize;
+exports.IsFutureDate = IsFutureDate;
+const class_validator_1 = require("class-validator");
+const admin_default_enum_1 = require("../enums/admin.default.enum");
+function jsonByteSize(value) {
+    try {
+        return Buffer.byteLength(JSON.stringify(value) ?? '', 'utf8');
+    }
+    catch {
+        return Infinity;
+    }
+}
+function MaxJsonSize(maxBytes = admin_default_enum_1.AdminLimit.MAX_JSON_BYTES, options) {
+    return function (target, propertyName) {
+        (0, class_validator_1.registerDecorator)({
+            name: 'maxJsonSize',
+            target: target.constructor,
+            propertyName,
+            constraints: [maxBytes],
+            options,
+            validator: {
+                validate(value) {
+                    return value === undefined || jsonByteSize(value) <= maxBytes;
+                },
+                defaultMessage() {
+                    return `${propertyName} must serialise to at most ${maxBytes} bytes`;
+                },
+            },
+        });
+    };
+}
+function IsFutureDate(options) {
+    return function (target, propertyName) {
+        (0, class_validator_1.registerDecorator)({
+            name: 'isFutureDate',
+            target: target.constructor,
+            propertyName,
+            options,
+            validator: {
+                validate(value) {
+                    if (typeof value !== 'string')
+                        return false;
+                    const time = new Date(value).getTime();
+                    return !Number.isNaN(time) && time > Date.now();
+                },
+                defaultMessage() {
+                    return `${propertyName} must be in the future`;
+                },
+            },
+        });
+    };
+}
+//# sourceMappingURL=admin.validators.js.map

package/dist/admin/validators/admin.validators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.validators.js","sourceRoot":"","sources":["../../../src/admin/validators/admin.validators.ts"],"names":[],"mappings":";;AAIA,oCAMC;AAGD,kCAqBC;AAGD,oCAmBC;AAxDD,qDAAuE;AACvE,oEAAyD;AAGzD,SAAgB,YAAY,CAAC,KAAc;IACzC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAGD,SAAgB,WAAW,CACzB,WAAmB,+BAAU,CAAC,cAAc,EAC5C,OAA2B;IAE3B,OAAO,UAAU,MAAc,EAAE,YAAoB;QACnD,IAAA,mCAAiB,EAAC;YAChB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,YAAY;YACZ,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,OAAO;YACP,SAAS,EAAE;gBACT,QAAQ,CAAC,KAAc;oBACrB,OAAO,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;gBAChE,CAAC;gBACD,cAAc;oBACZ,OAAO,GAAG,YAAY,8BAA8B,QAAQ,QAAQ,CAAC;gBACvE,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,YAAY,CAAC,OAA2B;IACtD,OAAO,UAAU,MAAc,EAAE,YAAoB;QACnD,IAAA,mCAAiB,EAAC;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,YAAY;YACZ,OAAO;YACP,SAAS,EAAE;gBACT,QAAQ,CAAC,KAAc;oBACrB,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,OAAO,KAAK,CAAC;oBAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;oBACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClD,CAAC;gBACD,cAAc;oBACZ,OAAO,GAAG,YAAY,wBAAwB,CAAC;gBACjD,CAAC;aACF;SACF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/auth.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAId,MAAM,gBAAgB,CAAC;AAoBxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAwJ5D,qBAMa,UAAU;IACrB,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAShE"}
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAId,MAAM,gBAAgB,CAAC;AAwBxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAwO5D,qBAMa,UAAU;IACrB,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAE,iBAAsB,GAAG,aAAa;CAShE"}

package/dist/auth/auth.module.js

@@ -13,11 +13,14 @@ const jwt_1 = require("@nestjs/jwt");
 const passport_1 = require("@nestjs/passport");
 const typeorm_1 = require("@nestjs/typeorm");
 const common_module_1 = require("../common/common.module");
+const queue_module_1 = require("../common/queue.module");
 const notification_module_1 = require("../notification/notification.module");
 const tenant_user_invited_mail_job_1 = require("../notification/jobs/tenant.user.invited.mail.job");
+const email_verification_mail_job_1 = require("../notification/jobs/email.verification.mail.job");
 const audit_service_1 = require("../common/services/audit.service");
 const cache_service_1 = require("../common/services/cache.service");
 const encryption_service_1 = require("../common/services/encryption.service");
+const queue_service_1 = require("../common/services/queue.service");
 const api_key_guard_1 = require("./guards/api.key.guard");
 const jwt_auth_guard_1 = require("./guards/jwt.auth.guard");
 const jwt_refresh_guard_1 = require("./guards/jwt.refresh.guard");
@@ -27,47 +30,93 @@ const jwt_middleware_1 = require("./middlewares/jwt.middleware");
 const admin_jwt_middleware_1 = require("./middlewares/admin.jwt.middleware");
 const api_key_middleware_1 = require("./middlewares/api.key.middleware");
 const es6_classes_1 = require("./es6.classes");
-const [ApiKeyService, ScopeService, AuthService, AdminAuthService, GoogleAuthService, RoleService, ImpersonationService, TenantMembershipService, TenantInvitationService,] = es6_classes_1.es6Classes.services;
+const auth_config_1 = require("./utilities/auth.config");
+const [ApiKeyService, ScopeService, AuthService, AdminAuthService, GoogleAuthService, RoleService, ImpersonationService, TenantMembershipService, TenantInvitationService, TokenService, LoginThrottleService, EmailVerificationService,] = es6_classes_1.es6Classes.services;
+const [PurgeExpiredAuthRecordsJob] = es6_classes_1.es6Classes.jobs;
 function createAuthImports(options) {
     return [
         common_module_1.CommonModule,
+        queue_module_1.QueueModule,
         options ? notification_module_1.NotificationModule.register(options) : notification_module_1.NotificationModule,
         passport_1.PassportModule.register({ defaultStrategy: 'jwt' }),
         jwt_1.JwtModule.registerAsync({
-            useFactory: () => ({
-                secret: process.env.ACCESS_TOKEN_SECRET,
-                signOptions: {
-                    expiresIn: process.env
-                        .ACCESS_TOKEN_EXPIRY,
-                },
-            }),
+            useFactory: () => {
+                const config = auth_config_1.AuthConfig.current();
+                return {
+                    secret: config.signingKey('access', 'user'),
+                    signOptions: {
+                        algorithm: 'HS256',
+                        expiresIn: config.accessTokenTtlSeconds,
+                    },
+                    verifyOptions: {
+                        algorithms: ['HS256'],
+                        audience: 'user',
+                        issuer: config.issuer,
+                    },
+                };
+            },
         }),
     ];
 }
 function createAuthProviders(options = {}) {
     return [
+        { provide: auth_config_1.AuthConfig, useFactory: () => auth_config_1.AuthConfig.current() },
         {
-            provide: AuthService,
-            useFactory: (jwtService, cacheService, dataSource, scopeService) => new AuthService(jwtService, cacheService, dataSource, scopeService),
+            provide: TokenService,
+            useFactory: (jwtService, dataSource, config) => new TokenService(jwtService, dataSource, config),
             inject: [
                 jwt_1.JwtService,
-                cache_service_1.CacheService,
+                (0, typeorm_1.getDataSourceToken)(options.dataSourceName),
+                auth_config_1.AuthConfig,
+            ],
+        },
+        {
+            provide: LoginThrottleService,
+            useFactory: (cacheService, config) => new LoginThrottleService(cacheService, config),
+            inject: [cache_service_1.CacheService, auth_config_1.AuthConfig],
+        },
+        {
+            provide: PurgeExpiredAuthRecordsJob,
+            useFactory: (queueService, dataSource, config) => new PurgeExpiredAuthRecordsJob(queueService, dataSource, config),
+            inject: [
+                queue_service_1.QueueService,
+                (0, typeorm_1.getDataSourceToken)(options.dataSourceName),
+                auth_config_1.AuthConfig,
+            ],
+        },
+        {
+            provide: EmailVerificationService,
+            useFactory: (dataSource, encryptionService, mailJob, config) => new EmailVerificationService(dataSource, encryptionService, mailJob, config),
+            inject: [
+                (0, typeorm_1.getDataSourceToken)(options.dataSourceName),
+                encryption_service_1.EncryptionService,
+                email_verification_mail_job_1.EmailVerificationMailJob,
+                auth_config_1.AuthConfig,
+            ],
+        },
+        {
+            provide: AuthService,
+            useFactory: (tokenService, dataSource, scopeService, config) => new AuthService(tokenService, dataSource, scopeService, config),
+            inject: [
+                TokenService,
                 (0, typeorm_1.getDataSourceToken)(options.dataSourceName),
                 ScopeService,
+                auth_config_1.AuthConfig,
             ],
         },
         {
             provide: AdminAuthService,
-            useFactory: (jwtService, dataSource) => new AdminAuthService(jwtService, dataSource),
-            inject: [jwt_1.JwtService, (0, typeorm_1.getDataSourceToken)(options.dataSourceName)],
+            useFactory: (tokenService, dataSource) => new AdminAuthService(tokenService, dataSource),
+            inject: [TokenService, (0, typeorm_1.getDataSourceToken)(options.dataSourceName)],
         },
         {
             provide: ApiKeyService,
-            useFactory: (dataSource, encryptionService, scopeService) => new ApiKeyService(dataSource, encryptionService, scopeService),
+            useFactory: (dataSource, encryptionService, scopeService, config) => new ApiKeyService(dataSource, encryptionService, scopeService, config),
             inject: [
                 (0, typeorm_1.getDataSourceToken)(options.dataSourceName),
                 encryption_service_1.EncryptionService,
                 ScopeService,
+                auth_config_1.AuthConfig,
             ],
         },
         {
@@ -115,6 +164,11 @@ function createAuthProviders(options = {}) {
     ];
 }
 const authExports = [
+    auth_config_1.AuthConfig,
+    TokenService,
+    LoginThrottleService,
+    EmailVerificationService,
+    PurgeExpiredAuthRecordsJob,
     AuthService,
     AdminAuthService,
     ImpersonationService,

package/dist/auth/auth.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAKwB;AACxB,qCAAoE;AACpE,+CAAkD;AAClD,6CAAqD;AAErD,2DAAuD;AACvD,6EAAyE;AACzE,oGAA6F;AAC7F,oEAAgE;AAChE,oEAAgE;AAChE,8EAA0E;AAC1E,0DAAqD;AACrD,4DAAuD;AACvD,kEAA6D;AAC7D,0EAAqE;AACrE,0DAAsD;AACtD,iEAA6D;AAC7D,6EAAwE;AACxE,yEAAoE;AACpE,+CAA2C;AAI3C,MAAM,CACJ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACxB,GAAG,wBAAU,CAAC,QAAQ,CAAC;AAIxB,SAAS,iBAAiB,CACxB,OAA2B;IAE3B,OAAO;QACL,4BAAY;QACZ,OAAO,CAAC,CAAC,CAAC,wCAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wCAAkB;QACnE,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAEnD,eAAS,CAAC,aAAa,CAAC;YACtB,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;gBACvC,WAAW,EAAE;oBACX,SAAS,EAAE,OAAO,CAAC,GAAG;yBACnB,mBAAkD;iBACtD;aACF,CAAC;SACH,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,UAA6B,EAAE;IAC1D,OAAO;QACL;YACE,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,CACV,UAAsB,EACtB,YAA0B,EAC1B,UAAsB,EACtB,YAA+C,EAC/C,EAAE,CAAC,IAAI,WAAW,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC;YACxE,MAAM,EAAE;gBACN,gBAAU;gBACV,4BAAY;gBACZ,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,YAAY;aACb;SACF;QACD;YACE,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,CAAC,UAAsB,EAAE,UAAsB,EAAE,EAAE,CAC7D,IAAI,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC;YAC9C,MAAM,EAAE,CAAC,gBAAU,EAAE,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACjE;QACD;YACE,OAAO,EAAE,aAAa;YACtB,UAAU,EAAE,CACV,UAAsB,EACtB,iBAAoC,EACpC,YAA+C,EAC/C,EAAE,CAAC,IAAI,aAAa,CAAC,UAAU,EAAE,iBAAiB,EAAE,YAAY,CAAC;YACnE,MAAM,EAAE;gBACN,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,sCAAiB;gBACjB,YAAY;aACb;SACF;QACD;YACE,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,CAAC,UAAsB,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC;YACpE,MAAM,EAAE,CAAC,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACrD;QACD;YACE,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,CAAC,UAAsB,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC;YACnE,MAAM,EAAE,CAAC,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACrD;QACD;YACE,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,CACV,WAA6C,EAC7C,YAA0B,EAC1B,UAAsB,EACtB,EAAE,CAAC,IAAI,oBAAoB,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;YACpE,MAAM,EAAE;gBACN,WAAW;gBACX,4BAAY;gBACZ,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;aAC3C;SACF;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,UAAU,EAAE,CACV,WAA6C,EAC7C,UAAsB,EACtB,EAAE,CAAC,IAAI,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC;YACzD,MAAM,EAAE,CAAC,WAAW,EAAE,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SAClE;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,UAAU,EAAE,CACV,WAA6C,EAC7C,UAAsB,EACtB,cAAwC,EACxC,EAAE,CAAC,IAAI,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC;YACzE,MAAM,EAAE;gBACN,WAAW;gBACX,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,uDAAwB;aACzB;SACF;QACD,iBAAiB;QACjB,0BAAW;QACX,yCAAkB;QAClB,6BAAY;QACZ,mCAAe;QACf,2BAAW;QACX,8BAAa;QACb,yCAAkB;QAClB,qCAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,WAAW;IACX,gBAAgB;IAChB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,6BAAY;IACZ,mCAAe;IACf,2BAAW;IACX,8BAAa;IACb,yCAAkB;IAClB,qCAAgB;IAChB,eAAS;IACT,yBAAc;CACf,CAAC;AAYK,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,MAAM,CAAC,QAAQ,CAAC,UAA6B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;YACxC,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC;YACvC,OAAO,EAAE,WAAW;SACrB,CAAC;IACJ,CAAC;CACF,CAAA;AAVY,gCAAU;qBAAV,UAAU;IANtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,iBAAiB,EAAE;QAC5B,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;QACxC,SAAS,EAAE,mBAAmB,EAAE;QAChC,OAAO,EAAE,WAAW;KACrB,CAAC;GACW,UAAU,CAUtB"}
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAKwB;AACxB,qCAAoD;AACpD,+CAAkD;AAClD,6CAAqD;AAErD,2DAAuD;AACvD,yDAAqD;AACrD,6EAAyE;AACzE,oGAA6F;AAC7F,kGAA4F;AAC5F,oEAAgE;AAChE,oEAAgE;AAChE,8EAA0E;AAC1E,oEAAgE;AAChE,0DAAqD;AACrD,4DAAuD;AACvD,kEAA6D;AAC7D,0EAAqE;AACrE,0DAAsD;AACtD,iEAA6D;AAC7D,6EAAwE;AACxE,yEAAoE;AACpE,+CAA2C;AAC3C,yDAAqD;AAIrD,MAAM,CACJ,aAAa,EACb,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,YAAY,EACZ,oBAAoB,EACpB,wBAAwB,EACzB,GAAG,wBAAU,CAAC,QAAQ,CAAC;AACxB,MAAM,CAAC,0BAA0B,CAAC,GAAG,wBAAU,CAAC,IAAI,CAAC;AAIrD,SAAS,iBAAiB,CACxB,OAA2B;IAE3B,OAAO;QACL,4BAAY;QAEZ,0BAAW;QACX,OAAO,CAAC,CAAC,CAAC,wCAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wCAAkB;QACnE,yBAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAGnD,eAAS,CAAC,aAAa,CAAC;YACtB,UAAU,EAAE,GAAG,EAAE;gBACf,MAAM,MAAM,GAAG,wBAAU,CAAC,OAAO,EAAE,CAAC;gBACpC,OAAO;oBACL,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;oBAC3C,WAAW,EAAE;wBACX,SAAS,EAAE,OAAO;wBAClB,SAAS,EAAE,MAAM,CAAC,qBAAqB;qBACxC;oBACD,aAAa,EAAE;wBACb,UAAU,EAAE,CAAC,OAAO,CAAC;wBACrB,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,MAAM,CAAC,MAAM;qBACtB;iBACF,CAAC;YACJ,CAAC;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,UAA6B,EAAE;IAC1D,OAAO;QAEL,EAAE,OAAO,EAAE,wBAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,wBAAU,CAAC,OAAO,EAAE,EAAE;QAC/D;YACE,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,CACV,UAAsB,EACtB,UAAsB,EACtB,MAAkB,EAClB,EAAE,CAAC,IAAI,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC;YACrD,MAAM,EAAE;gBACN,gBAAU;gBACV,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,wBAAU;aACX;SACF;QACD;YACE,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,CAAC,YAA0B,EAAE,MAAkB,EAAE,EAAE,CAC7D,IAAI,oBAAoB,CAAC,YAAY,EAAE,MAAM,CAAC;YAChD,MAAM,EAAE,CAAC,4BAAY,EAAE,wBAAU,CAAC;SACnC;QACD;YACE,OAAO,EAAE,0BAA0B;YACnC,UAAU,EAAE,CACV,YAA0B,EAC1B,UAAsB,EACtB,MAAkB,EAClB,EAAE,CAAC,IAAI,0BAA0B,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC;YACrE,MAAM,EAAE;gBACN,4BAAY;gBACZ,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,wBAAU;aACX;SACF;QACD;YACE,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,CACV,UAAsB,EACtB,iBAAoC,EACpC,OAAiC,EACjC,MAAkB,EAClB,EAAE,CACF,IAAI,wBAAwB,CAC1B,UAAU,EACV,iBAAiB,EACjB,OAAO,EACP,MAAM,CACP;YACH,MAAM,EAAE;gBACN,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,sCAAiB;gBACjB,sDAAwB;gBACxB,wBAAU;aACX;SACF;QACD;YACE,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,CACV,YAA+C,EAC/C,UAAsB,EACtB,YAA+C,EAC/C,MAAkB,EAClB,EAAE,CAAC,IAAI,WAAW,CAAC,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC;YACpE,MAAM,EAAE;gBACN,YAAY;gBACZ,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,YAAY;gBACZ,wBAAU;aACX;SACF;QACD;YACE,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,CACV,YAA+C,EAC/C,UAAsB,EACtB,EAAE,CAAC,IAAI,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC;YACnD,MAAM,EAAE,CAAC,YAAY,EAAE,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACnE;QACD;YACE,OAAO,EAAE,aAAa;YACtB,UAAU,EAAE,CACV,UAAsB,EACtB,iBAAoC,EACpC,YAA+C,EAC/C,MAAkB,EAClB,EAAE,CACF,IAAI,aAAa,CAAC,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC;YACxE,MAAM,EAAE;gBACN,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,sCAAiB;gBACjB,YAAY;gBACZ,wBAAU;aACX;SACF;QACD;YACE,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,CAAC,UAAsB,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC;YACpE,MAAM,EAAE,CAAC,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACrD;QACD;YACE,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,CAAC,UAAsB,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC;YACnE,MAAM,EAAE,CAAC,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SACrD;QACD;YACE,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,CACV,WAA6C,EAC7C,YAA0B,EAC1B,UAAsB,EACtB,EAAE,CAAC,IAAI,oBAAoB,CAAC,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC;YACpE,MAAM,EAAE;gBACN,WAAW;gBACX,4BAAY;gBACZ,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;aAC3C;SACF;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,UAAU,EAAE,CACV,WAA6C,EAC7C,UAAsB,EACtB,EAAE,CAAC,IAAI,uBAAuB,CAAC,WAAW,EAAE,UAAU,CAAC;YACzD,MAAM,EAAE,CAAC,WAAW,EAAE,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC;SAClE;QACD;YACE,OAAO,EAAE,uBAAuB;YAChC,UAAU,EAAE,CACV,WAA6C,EAC7C,UAAsB,EACtB,cAAwC,EACxC,EAAE,CAAC,IAAI,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC;YACzE,MAAM,EAAE;gBACN,WAAW;gBACX,IAAA,4BAAkB,EAAC,OAAO,CAAC,cAAc,CAAC;gBAC1C,uDAAwB;aACzB;SACF;QACD,iBAAiB;QACjB,0BAAW;QACX,yCAAkB;QAClB,6BAAY;QACZ,mCAAe;QACf,2BAAW;QACX,8BAAa;QACb,yCAAkB;QAClB,qCAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,wBAAU;IACV,YAAY;IACZ,oBAAoB;IACpB,wBAAwB;IACxB,0BAA0B;IAC1B,WAAW;IACX,gBAAgB;IAChB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,6BAAY;IACZ,mCAAe;IACf,2BAAW;IACX,8BAAa;IACb,yCAAkB;IAClB,qCAAgB;IAChB,eAAS;IACT,yBAAc;CACf,CAAC;AAYK,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB,MAAM,CAAC,QAAQ,CAAC,UAA6B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC;YACnC,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;YACxC,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC;YACvC,OAAO,EAAE,WAAW;SACrB,CAAC;IACJ,CAAC;CACF,CAAA;AAVY,gCAAU;qBAAV,UAAU;IANtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,iBAAiB,EAAE;QAC5B,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;QACxC,SAAS,EAAE,mBAAmB,EAAE;QAChC,OAAO,EAAE,WAAW;KACrB,CAAC;GACW,UAAU,CAUtB"}

package/dist/auth/controllers/admin.auth.controller.d.ts

@@ -1,11 +1,14 @@
 import type { Request } from 'express';
 import { AdminAuthService } from '../services/admin.auth.service';
+import { LoginThrottleService } from '../services/login.throttle.service';
 import { AdminAuthenticatedAccess, AuthTokenPair } from '../types/auth.types';
 import { AdminLoginDto } from '../dtos/admin.login.dto';
 import { RefreshTokenDto } from '../dtos/refresh.token.dto';
+import { ChangePasswordDto } from '../dtos/change.password.dto';
 export declare class AdminAuthController {
     private readonly adminAuthService;
-    constructor(adminAuthService: AdminAuthService);
+    private readonly throttle;
+    constructor(adminAuthService: AdminAuthService, throttle: LoginThrottleService);
     me(): Promise<{
         user: AdminAuthenticatedAccess['user'];
         roles: AdminAuthenticatedAccess['roles'];
@@ -15,6 +18,8 @@ export declare class AdminAuthController {
     logout(dto: RefreshTokenDto): Promise<{
         success: true;
     }>;
-    private contextOf;
+    changePassword(dto: ChangePasswordDto): Promise<{
+        success: true;
+    }>;
 }
 //# sourceMappingURL=admin.auth.controller.d.ts.map

package/dist/auth/controllers/admin.auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.auth.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/admin.auth.controller.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EACL,wBAAwB,EACxB,aAAa,EAEd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,qBAEa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAAhB,gBAAgB,EAAE,gBAAgB;IAOzD,EAAE,IAAI,OAAO,CAAC;QAClB,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;KAC1C,CAAC;IAUI,KAAK,CACD,GAAG,EAAE,aAAa,EACnB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAUnB,OAAO,CACH,GAAG,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAcnB,MAAM,CAAS,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAKtE,OAAO,CAAC,SAAS;CAMlB"}
+{"version":3,"file":"admin.auth.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/admin.auth.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAUhE,qBAIa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,gBAAgB,EAAE,gBAAgB,EAClC,QAAQ,EAAE,oBAAoB;IAQ3C,EAAE,IAAI,OAAO,CAAC;QAClB,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,EAAE,wBAAwB,CAAC,OAAO,CAAC,CAAC;KAC1C,CAAC;IAWI,KAAK,CACD,GAAG,EAAE,aAAa,EACnB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAkBnB,OAAO,CACH,GAAG,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAenB,MAAM,CAAS,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAahE,cAAc,CACV,GAAG,EAAE,iBAAiB,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;CAQ9B"}

package/dist/auth/controllers/admin.auth.controller.js

@@ -15,33 +15,41 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AdminAuthController = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const strict_validation_pipe_1 = require("../../common/pipes/strict.validation.pipe");
 const admin_auth_service_1 = require("../services/admin.auth.service");
+const login_throttle_service_1 = require("../services/login.throttle.service");
 const admin_login_dto_1 = require("../dtos/admin.login.dto");
 const refresh_token_dto_1 = require("../dtos/refresh.token.dto");
+const change_password_dto_1 = require("../dtos/change.password.dto");
+const change_admin_password_data_processor_1 = require("../processors/change.admin.password.data.processor");
+const admin_auth_1 = require("../helpers/admin.auth");
+const public_decorator_1 = require("../decorators/public.decorator");
+const request_credentials_1 = require("../utilities/request.credentials");
 let AdminAuthController = class AdminAuthController {
-    constructor(adminAuthService) {
+    constructor(adminAuthService, throttle) {
         this.adminAuthService = adminAuthService;
+        this.throttle = throttle;
     }
     async me() {
         const { user, roles } = await this.adminAuthService.validateRole();
         return { user, roles };
     }
     async login(dto, request) {
-        const user = await this.adminAuthService.validateCredentials(dto.email_or_username, dto.password);
-        return this.adminAuthService.issueTokens(user, this.contextOf(request));
+        const user = await this.throttle.protect('admin.login', { ip: request.ip, account: dto.email_or_username }, () => this.adminAuthService.validateCredentials(dto.email_or_username, dto.password));
+        return this.adminAuthService.issueTokens(user, request_credentials_1.RequestCredentials.issueContext(request));
     }
     async refresh(dto, request) {
-        return this.adminAuthService.refresh(dto.refresh_token, this.contextOf(request));
+        await this.throttle.assertAllowed('refresh', { ip: request.ip });
+        return this.adminAuthService.refresh(dto.refresh_token, request_credentials_1.RequestCredentials.issueContext(request));
     }
     async logout(dto) {
         await this.adminAuthService.logout(dto.refresh_token);
         return { success: true };
     }
-    contextOf(request) {
-        return {
-            ip_address: request.ip,
-            user_agent: request.headers['user-agent'],
-        };
+    async changePassword(dto) {
+        const { user } = await this.adminAuthService.validateRole();
+        await new change_admin_password_data_processor_1.ChangeAdminPasswordDataProcessor(user.id, admin_auth_1.AdminAuth.session()).process(dto);
+        return { success: true };
     }
 };
 exports.AdminAuthController = AdminAuthController;
@@ -59,6 +67,7 @@ __decorate([
     (0, common_1.Post)('login'),
     (0, swagger_1.ApiOperation)({
         summary: 'Authenticate an admin user and receive an access/refresh token pair.',
+        description: 'Rate-limited per IP and per account (429).',
     }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, common_1.Req)()),
@@ -80,16 +89,32 @@ __decorate([
     (0, common_1.HttpCode)(common_1.HttpStatus.OK),
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiOperation)({
-        summary: 'Revoke the supplied refresh token and invalidate the current session.',
+        summary: 'Invalidate the current session and revoke the supplied refresh token.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [refresh_token_dto_1.RefreshTokenDto]),
     __metadata("design:returntype", Promise)
 ], AdminAuthController.prototype, "logout", null);
+__decorate([
+    (0, common_1.Post)('change-password'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, swagger_1.ApiOperation)({
+        summary: `Change the authenticated admin's own password.`,
+        description: 'Every other admin session and refresh token is revoked; the current session stays signed in.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [change_password_dto_1.ChangePasswordDto]),
+    __metadata("design:returntype", Promise)
+], AdminAuthController.prototype, "changePassword", null);
 exports.AdminAuthController = AdminAuthController = __decorate([
     (0, swagger_1.ApiTags)('Admin Auth'),
     (0, common_1.Controller)('api/admin/auth'),
-    __metadata("design:paramtypes", [admin_auth_service_1.AdminAuthService])
+    (0, public_decorator_1.Public)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.StrictValidationPipe),
+    __metadata("design:paramtypes", [admin_auth_service_1.AdminAuthService,
+        login_throttle_service_1.LoginThrottleService])
 ], AdminAuthController);
 //# sourceMappingURL=admin.auth.controller.js.map

package/dist/auth/controllers/admin.auth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.auth.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/admin.auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CAAuE;AAEvE,uEAAkE;AAMlE,6DAAwD;AACxD,iEAA4D;AAIrD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAA6B,gBAAkC;QAAlC,qBAAgB,GAAhB,gBAAgB,CAAkB;IAAG,CAAC;IAO7D,AAAN,KAAK,CAAC,EAAE;QAIN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAOK,AAAN,KAAK,CAAC,KAAK,CACD,GAAkB,EACnB,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAC1D,GAAG,CAAC,iBAAiB,EACrB,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,OAAO,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1E,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CACH,GAAoB,EACrB,OAAgB;QAEvB,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAClC,GAAG,CAAC,aAAa,EACjB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAoB;QACvC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,SAAS,CAAC,OAAgB;QAChC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC;IACJ,CAAC;CACF,CAAA;AA9DY,kDAAmB;AAQxB;IALL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;KACnE,CAAC;;;;6CAOD;AAOK;IALL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,sEAAsE;KACzE,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,+BAAa;;gDAQ3B;AAIK;IAFL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IAE3E,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,mCAAe;;kDAO7B;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,uEAAuE;KAC1E,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,mCAAe;;iDAGxC;8BAtDU,mBAAmB;IAF/B,IAAA,iBAAO,EAAC,YAAY,CAAC;IACrB,IAAA,mBAAU,EAAC,gBAAgB,CAAC;qCAEoB,qCAAgB;GADpD,mBAAmB,CA8D/B"}
+{"version":3,"file":"admin.auth.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/admin.auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AAEvE,sFAAiF;AACjF,uEAAkE;AAClE,+EAA0E;AAE1E,6DAAwD;AACxD,iEAA4D;AAC5D,qEAAgE;AAChE,6GAAsG;AACtG,sDAAkD;AAClD,qEAAwD;AACxD,0EAAsE;AAU/D,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YACmB,gBAAkC,EAClC,QAA8B;QAD9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,aAAQ,GAAR,QAAQ,CAAsB;IAC9C,CAAC;IAOE,AAAN,KAAK,CAAC,EAAE;QAIN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK,CACD,GAAkB,EACnB,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACtC,aAAa,EACb,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,iBAAiB,EAAE,EAClD,GAAG,EAAE,CACH,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CACvC,GAAG,CAAC,iBAAiB,EACrB,GAAG,CAAC,QAAQ,CACb,CACJ,CAAC;QACF,OAAO,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACtC,IAAI,EACJ,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CACH,GAAoB,EACrB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAClC,GAAG,CAAC,aAAa,EACjB,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAoB;QACvC,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAUK,AAAN,KAAK,CAAC,cAAc,CACV,GAAsB;QAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QAC5D,MAAM,IAAI,uEAAgC,CACxC,IAAI,CAAC,EAAE,EACP,sBAAS,CAAC,OAAO,EAAE,CACpB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AAvFY,kDAAmB;AAWxB;IALL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;KACnE,CAAC;;;;6CAOD;AAQK;IANL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,sEAAsE;QACxE,WAAW,EAAE,4CAA4C;KAC1D,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,+BAAa;;gDAgB3B;AAIK;IAFL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IAE3E,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,mCAAe;;kDAQ7B;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,uEAAuE;KAC1E,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,mCAAe;;iDAGxC;AAUK;IARL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,8FAA8F;KACjG,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,uCAAiB;;yDAQ/B;8BAtFU,mBAAmB;IAJ/B,IAAA,iBAAO,EAAC,YAAY,CAAC;IACrB,IAAA,mBAAU,EAAC,gBAAgB,CAAC;IAC5B,IAAA,yBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAGQ,qCAAgB;QACxB,6CAAoB;GAHtC,mBAAmB,CAuF/B"}

package/dist/auth/controllers/auth.controller.d.ts

@@ -3,18 +3,23 @@ import { AuthService } from '../services/auth.service';
 import { GoogleAuthService } from '../services/google.auth.service';
 import { TenantMembershipService } from '../services/tenant.membership.service';
 import { TenantInvitationService } from '../services/tenant.invitation.service';
+import { LoginThrottleService } from '../services/login.throttle.service';
+import { EmailVerificationService } from '../services/email.verification.service';
 import { AuthTokenPair, CurrentUserProfile } from '../types/auth.types';
 import { LoginDto } from '../dtos/login.dto';
 import { GoogleLoginDto } from '../dtos/google.login.dto';
 import { RegisterDto } from '../dtos/register.dto';
 import { RefreshTokenDto } from '../dtos/refresh.token.dto';
 import { ChangePasswordDto } from '../dtos/change.password.dto';
+import { VerifyEmailDto } from '../dtos/verify.email.dto';
 export declare class AuthController {
     private readonly authService;
     private readonly googleAuthService;
     private readonly tenantMembershipService;
     private readonly tenantInvitationService;
-    constructor(authService: AuthService, googleAuthService: GoogleAuthService, tenantMembershipService: TenantMembershipService, tenantInvitationService: TenantInvitationService);
+    private readonly throttle;
+    private readonly emailVerificationService;
+    constructor(authService: AuthService, googleAuthService: GoogleAuthService, tenantMembershipService: TenantMembershipService, tenantInvitationService: TenantInvitationService, throttle: LoginThrottleService, emailVerificationService: EmailVerificationService);
     me(): Promise<CurrentUserProfile>;
     login(dto: LoginDto, request: Request): Promise<AuthTokenPair>;
     googleLogin(dto: GoogleLoginDto, request: Request): Promise<AuthTokenPair>;
@@ -26,7 +31,12 @@ export declare class AuthController {
     changePassword(dto: ChangePasswordDto): Promise<{
         success: true;
     }>;
+    requestEmailVerification(request: Request): Promise<{
+        success: true;
+    }>;
+    verifyEmail(dto: VerifyEmailDto, request: Request): Promise<{
+        success: true;
+    }>;
     private signIn;
-    private contextOf;
 }
 //# sourceMappingURL=auth.controller.d.ts.map

package/dist/auth/controllers/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,OAAO,EACL,aAAa,EACb,kBAAkB,EAEnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAKhE,qBAEa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBAHvB,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB,EACpC,uBAAuB,EAAE,uBAAuB,EAChD,uBAAuB,EAAE,uBAAuB;IAU7D,EAAE,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAuBjC,KAAK,CACD,GAAG,EAAE,QAAQ,EACd,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAanB,WAAW,CACP,GAAG,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAWnB,QAAQ,CACJ,GAAG,EAAE,WAAW,EACjB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAOnB,OAAO,CACH,GAAG,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAWnB,MAAM,CAAS,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAahE,cAAc,CACV,GAAG,EAAE,iBAAiB,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;YAMf,MAAM;IAUpB,OAAO,CAAC,SAAS;CAMlB"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS1D,qBAGa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,wBAAwB;gBALxB,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB,EACpC,uBAAuB,EAAE,uBAAuB,EAChD,uBAAuB,EAAE,uBAAuB,EAChD,QAAQ,EAAE,oBAAoB,EAC9B,wBAAwB,EAAE,wBAAwB;IAW/D,EAAE,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAwBjC,KAAK,CACD,GAAG,EAAE,QAAQ,EACd,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAiBnB,WAAW,CACP,GAAG,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAenB,QAAQ,CACJ,GAAG,EAAE,WAAW,EACjB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAiBnB,OAAO,CACH,GAAG,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAgBnB,MAAM,CAAS,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAchE,cAAc,CACV,GAAG,EAAE,iBAAiB,GAC7B,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAevB,wBAAwB,CACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAgBvB,WAAW,CACP,GAAG,EAAE,cAAc,EACpB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;YAQf,MAAM;CASrB"}