@neohm/nestend 4.1.1 → 5.0.0

package/dist/auth/entities/tenant.invitation.entity.js

@@ -42,7 +42,11 @@ __decorate([
     __metadata("design:type", String)
 ], TenantInvitationEntity.prototype, "user_id", void 0);
 __decorate([
-    (0, typeorm_1.ManyToOne)(() => user_entity_1.UserEntity),
+    (0, typeorm_1.Column)({ type: 'uuid', nullable: true, select: false }),
+    __metadata("design:type", String)
+], TenantInvitationEntity.prototype, "created_user_id", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => user_entity_1.UserEntity, { onDelete: 'SET NULL' }),
     (0, typeorm_1.JoinColumn)({ name: 'user_id' }),
     __metadata("design:type", user_entity_1.UserEntity)
 ], TenantInvitationEntity.prototype, "user", void 0);

package/dist/auth/entities/tenant.invitation.entity.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.invitation.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/tenant.invitation.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAAgE;AAChE,qFAAgF;AAChF,0FAAgF;AAChF,+CAA2C;AAOpC,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,yCAAkB;CAyB7D,CAAA;AAzBY,wDAAsB;AAGjC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;qDACd;AAId;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;wDACP;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,sDAAsB,CAAC,OAAO,EAAE,CAAC;;sDACtC;AAG/B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACpB,IAAI;0DAAC;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BAClB,IAAI;4DAAC;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACzB;AAKhB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;IAC3B,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;8BAC1B,wBAAU;oDAAC;iCAxBN,sBAAsB;IADlC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;GAC9B,sBAAsB,CAyBlC"}
+{"version":3,"file":"tenant.invitation.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/tenant.invitation.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAAgE;AAChE,qFAAgF;AAChF,0FAAgF;AAChF,+CAA2C;AAOpC,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,yCAAkB;CA6B7D,CAAA;AA7BY,wDAAsB;AAGjC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;qDACd;AAId;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;wDACP;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,sDAAsB,CAAC,OAAO,EAAE,CAAC;;sDACtC;AAG/B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACpB,IAAI;0DAAC;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BAClB,IAAI;4DAAC;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACzB;AAIhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;;+DAChC;AAKxB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,wBAAU,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACrD,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;8BAC1B,wBAAU;oDAAC;iCA5BN,sBAAsB;IADlC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;GAC9B,sBAAsB,CA6BlC"}

package/dist/auth/entities/user.entity.d.ts

@@ -11,6 +11,7 @@ export declare class UserEntity extends RootEntity {
     user_type: UserType;
     has_global_access: boolean;
     password_change_required: boolean;
+    one_time_password_expires_at: Date;
     full_name: string;
     email: string;
     country: string;

package/dist/auth/entities/user.entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.entity.d.ts","sourceRoot":"","sources":["../../../src/auth/entities/user.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,GAAG,EAKJ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,qBACa,UAAW,SAAQ,UAAU;IAKxC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;IAWtE,MAAM,EAAE,OAAO,CAAC;IAIhB,SAAS,EAAE,QAAQ,CAAC;IAIpB,iBAAiB,EAAE,OAAO,CAAC;IAI3B,wBAAwB,EAAE,OAAO,CAAC;IAGlC,SAAS,EAAE,MAAM,CAAC;IAGlB,KAAK,EAAE,MAAM,CAAC;IAGd,OAAO,EAAE,MAAM,CAAC;IAGhB,YAAY,EAAE,MAAM,CAAC;IAGrB,OAAO,EAAE,MAAM,CAAC;IAGhB,QAAQ,EAAE,MAAM,CAAC;IAGjB,aAAa,EAAE,IAAI,CAAC;IAGpB,iBAAiB,EAAE,IAAI,CAAC;IAGxB,mBAAmB,EAAE,IAAI,CAAC;IAG1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAOhC,eAAe,EAAE,MAAM,CAAC;IAKxB,YAAY,EAAE,YAAY,CAAC;IAG3B,SAAS,EAAE,cAAc,EAAE,CAAC;IAM5B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAMhC,OAAO,EAAE,iBAAiB,CAAC;CAC5B"}
+{"version":3,"file":"user.entity.d.ts","sourceRoot":"","sources":["../../../src/auth/entities/user.entity.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,GAAG,EAKJ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,qBACa,UAAW,SAAQ,UAAU;IAKxC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,GAAG,CAAC;IAWtE,MAAM,EAAE,OAAO,CAAC;IAIhB,SAAS,EAAE,QAAQ,CAAC;IAIpB,iBAAiB,EAAE,OAAO,CAAC;IAI3B,wBAAwB,EAAE,OAAO,CAAC;IAIlC,4BAA4B,EAAE,IAAI,CAAC;IAGnC,SAAS,EAAE,MAAM,CAAC;IAGlB,KAAK,EAAE,MAAM,CAAC;IAGd,OAAO,EAAE,MAAM,CAAC;IAGhB,YAAY,EAAE,MAAM,CAAC;IAGrB,OAAO,EAAE,MAAM,CAAC;IAGhB,QAAQ,EAAE,MAAM,CAAC;IAGjB,aAAa,EAAE,IAAI,CAAC;IAGpB,iBAAiB,EAAE,IAAI,CAAC;IAGxB,mBAAmB,EAAE,IAAI,CAAC;IAG1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAOhC,eAAe,EAAE,MAAM,CAAC;IAKxB,YAAY,EAAE,YAAY,CAAC;IAG3B,SAAS,EAAE,cAAc,EAAE,CAAC;IAM5B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAMhC,OAAO,EAAE,iBAAiB,CAAC;CAC5B"}

package/dist/auth/entities/user.entity.js

@@ -42,6 +42,10 @@ __decorate([
     (0, typeorm_1.Column)({ type: 'boolean', default: false }),
     __metadata("design:type", Boolean)
 ], UserEntity.prototype, "password_change_required", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Date)
+], UserEntity.prototype, "one_time_password_expires_at", void 0);
 __decorate([
     (0, typeorm_1.Column)({ type: 'text' }),
     __metadata("design:type", String)
@@ -87,7 +91,7 @@ __decorate([
     __metadata("design:type", String)
 ], UserEntity.prototype, "organization_id", void 0);
 __decorate([
-    (0, typeorm_1.ManyToOne)(() => tenant_entity_1.TenantEntity, { onDelete: 'CASCADE' }),
+    (0, typeorm_1.ManyToOne)(() => tenant_entity_1.TenantEntity, { onDelete: 'SET NULL' }),
     (0, typeorm_1.JoinColumn)({ name: 'organization_id' }),
     __metadata("design:type", tenant_entity_1.TenantEntity)
 ], UserEntity.prototype, "organization", void 0);

package/dist/auth/entities/user.entity.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/user.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAQiB;AACjB,mEAA+D;AAC/D,uEAAmE;AACnE,4DAAmD;AAM5C,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,wBAAU;IAKxC,MAAM,CAAC,aAAa,CAAC,KAAwB;QAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzB,CAAC,CAAC,IAAA,aAAG,EAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,mBAAmB,EAAE;gBAClD,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;aAClD,CAAC;YACJ,CAAC,CAAC,IAAA,aAAG,EAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,YAAY,EAAE;gBAC3C,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;aAC3B,CAAC,CAAC;IACT,CAAC;CAyEF,CAAA;AAtFY,gCAAU;AAgBrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;0CAC3B;AAIhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAQ,CAAC,WAAW,EAAE,CAAC;;6CACvC;AAIpB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;qDACjB;AAI3B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;4DACV;AAGlC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;6CACP;AAGlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;yCACd;AAGd;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;2CACZ;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;gDACP;AAGrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;2CACZ;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;;4CAC1B;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACjB,IAAI;iDAAC;AAGpB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACb,IAAI;qDAAC;AAGxB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACX,IAAI;uDAAC;AAG1B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;8CACM;AAOhC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACjB;AAKxB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,4BAAY,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtD,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;8BAC1B,4BAAY;gDAAC;AAG3B;IADC,IAAA,mBAAS,EAAC,gBAAgB,EAAE,CAAC,SAAyB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;;6CAC/C;AAM5B;IAJC,IAAA,mBAAS,EACR,kBAAkB,EAClB,CAAC,UAA4B,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAClD;;+CAC+B;AAMhC;IAJC,IAAA,kBAAQ,EACP,mBAAmB,EACnB,CAAC,WAA8B,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CACrD;;2CAC0B;qBArFhB,UAAU;IADtB,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;GACjB,UAAU,CAsFtB"}
+{"version":3,"file":"user.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/user.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAQiB;AACjB,mEAA+D;AAC/D,uEAAmE;AACnE,4DAAmD;AAM5C,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,wBAAU;IAKxC,MAAM,CAAC,aAAa,CAAC,KAAwB;QAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzB,CAAC,CAAC,IAAA,aAAG,EAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,mBAAmB,EAAE;gBAClD,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;aAClD,CAAC;YACJ,CAAC,CAAC,IAAA,aAAG,EAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,YAAY,EAAE;gBAC3C,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE;aAC3B,CAAC,CAAC;IACT,CAAC;CA6EF,CAAA;AA1FY,gCAAU;AAgBrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;0CAC3B;AAIhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAQ,CAAC,WAAW,EAAE,CAAC;;6CACvC;AAIpB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;qDACjB;AAI3B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;4DACV;AAIlC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;8BAClB,IAAI;gEAAC;AAGnC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;6CACP;AAGlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;yCACd;AAGd;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;2CACZ;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;gDACP;AAGrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;2CACZ;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;;4CAC1B;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACjB,IAAI;iDAAC;AAGpB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACb,IAAI;qDAAC;AAGxB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACX,IAAI;uDAAC;AAG1B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;8CACM;AAOhC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDACjB;AAKxB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,4BAAY,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvD,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;8BAC1B,4BAAY;gDAAC;AAG3B;IADC,IAAA,mBAAS,EAAC,gBAAgB,EAAE,CAAC,SAAyB,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;;6CAC/C;AAM5B;IAJC,IAAA,mBAAS,EACR,kBAAkB,EAClB,CAAC,UAA4B,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAClD;;+CAC+B;AAMhC;IAJC,IAAA,kBAAQ,EACP,mBAAmB,EACnB,CAAC,WAA8B,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CACrD;;2CAC0B;qBAzFhB,UAAU;IADtB,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;GACjB,UAAU,CA0FtB"}

package/dist/auth/enums/auth.default.enum.d.ts

@@ -1,6 +1,30 @@
 export declare enum AuthDefault {
-    BCRYPT_SALT_ROUNDS = 10,
+    BCRYPT_SALT_ROUNDS = 12,
+    BCRYPT_MIN_ROUNDS = 10,
+    BCRYPT_MAX_ROUNDS = 15,
+    PASSWORD_MAX_BYTES = 72,
+    PASSWORD_MIN_LENGTH = 8,
+    LOGIN_PASSWORD_MAX_LENGTH = 1024,
     ONE_TIME_PASSWORD_LENGTH = 12,
-    ONE_TIME_PASSWORD_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789"
+    ONE_TIME_PASSWORD_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789",
+    ONE_TIME_PASSWORD_TTL_HOURS = 72,
+    TOKEN_ISSUER = "neohm",
+    ACCESS_TOKEN_EXPIRY = "1h",
+    REFRESH_TOKEN_EXPIRY = "30d",
+    IMPERSONATION_TOKEN_EXPIRY = "15m",
+    EMAIL_VERIFICATION_TOKEN_EXPIRY = "24h",
+    SECRET_MIN_LENGTH = 32,
+    SECRET_MIN_DISTINCT_CHARS = 10,
+    THROTTLE_IP_LIMIT = 30,
+    THROTTLE_REFRESH_IP_LIMIT = 120,
+    THROTTLE_ACCOUNT_LIMIT = 10,
+    THROTTLE_WINDOW = "15m",
+    THROTTLE_KEY_PREFIX = "auth:throttle",
+    RECORD_RETENTION_DAYS = 7,
+    PURGE_BATCH_SIZE = 5000,
+    PURGE_EXPIRED_RECORDS_JOB = "auth.purge.expired.records.job"
 }
+export declare const AuthPattern: {
+    readonly SECRET_PLACEHOLDER: RegExp;
+};
 //# sourceMappingURL=auth.default.enum.d.ts.map

package/dist/auth/enums/auth.default.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.default.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/auth.default.enum.ts"],"names":[],"mappings":"AACA,oBAAY,WAAW;IAErB,kBAAkB,KAAK;IAEvB,wBAAwB,KAAK;IAE7B,0BAA0B,6DAA6D;CACxF"}
+{"version":3,"file":"auth.default.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/auth.default.enum.ts"],"names":[],"mappings":"AACA,oBAAY,WAAW;IAErB,kBAAkB,KAAK;IACvB,iBAAiB,KAAK;IACtB,iBAAiB,KAAK;IAEtB,kBAAkB,KAAK;IACvB,mBAAmB,IAAI;IAEvB,yBAAyB,OAAO;IAEhC,wBAAwB,KAAK;IAE7B,0BAA0B,6DAA6D;IACvF,2BAA2B,KAAK;IAEhC,YAAY,UAAU;IACtB,mBAAmB,OAAO;IAC1B,oBAAoB,QAAQ;IAC5B,0BAA0B,QAAQ;IAClC,+BAA+B,QAAQ;IACvC,iBAAiB,KAAK;IACtB,yBAAyB,KAAK;IAC9B,iBAAiB,KAAK;IACtB,yBAAyB,MAAM;IAC/B,sBAAsB,KAAK;IAC3B,eAAe,QAAQ;IAEvB,mBAAmB,kBAAkB;IAErC,qBAAqB,IAAI;IACzB,gBAAgB,OAAO;IACvB,yBAAyB,mCAAmC;CAC7D;AAED,eAAO,MAAM,WAAW;;CAId,CAAC"}

package/dist/auth/enums/auth.default.enum.js

@@ -1,10 +1,34 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthDefault = void 0;
+exports.AuthPattern = exports.AuthDefault = void 0;
 var AuthDefault;
 (function (AuthDefault) {
-    AuthDefault[AuthDefault["BCRYPT_SALT_ROUNDS"] = 10] = "BCRYPT_SALT_ROUNDS";
+    AuthDefault[AuthDefault["BCRYPT_SALT_ROUNDS"] = 12] = "BCRYPT_SALT_ROUNDS";
+    AuthDefault[AuthDefault["BCRYPT_MIN_ROUNDS"] = 10] = "BCRYPT_MIN_ROUNDS";
+    AuthDefault[AuthDefault["BCRYPT_MAX_ROUNDS"] = 15] = "BCRYPT_MAX_ROUNDS";
+    AuthDefault[AuthDefault["PASSWORD_MAX_BYTES"] = 72] = "PASSWORD_MAX_BYTES";
+    AuthDefault[AuthDefault["PASSWORD_MIN_LENGTH"] = 8] = "PASSWORD_MIN_LENGTH";
+    AuthDefault[AuthDefault["LOGIN_PASSWORD_MAX_LENGTH"] = 1024] = "LOGIN_PASSWORD_MAX_LENGTH";
     AuthDefault[AuthDefault["ONE_TIME_PASSWORD_LENGTH"] = 12] = "ONE_TIME_PASSWORD_LENGTH";
     AuthDefault["ONE_TIME_PASSWORD_ALPHABET"] = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnpqrstuvwxyz23456789";
+    AuthDefault[AuthDefault["ONE_TIME_PASSWORD_TTL_HOURS"] = 72] = "ONE_TIME_PASSWORD_TTL_HOURS";
+    AuthDefault["TOKEN_ISSUER"] = "neohm";
+    AuthDefault["ACCESS_TOKEN_EXPIRY"] = "1h";
+    AuthDefault["REFRESH_TOKEN_EXPIRY"] = "30d";
+    AuthDefault["IMPERSONATION_TOKEN_EXPIRY"] = "15m";
+    AuthDefault["EMAIL_VERIFICATION_TOKEN_EXPIRY"] = "24h";
+    AuthDefault[AuthDefault["SECRET_MIN_LENGTH"] = 32] = "SECRET_MIN_LENGTH";
+    AuthDefault[AuthDefault["SECRET_MIN_DISTINCT_CHARS"] = 10] = "SECRET_MIN_DISTINCT_CHARS";
+    AuthDefault[AuthDefault["THROTTLE_IP_LIMIT"] = 30] = "THROTTLE_IP_LIMIT";
+    AuthDefault[AuthDefault["THROTTLE_REFRESH_IP_LIMIT"] = 120] = "THROTTLE_REFRESH_IP_LIMIT";
+    AuthDefault[AuthDefault["THROTTLE_ACCOUNT_LIMIT"] = 10] = "THROTTLE_ACCOUNT_LIMIT";
+    AuthDefault["THROTTLE_WINDOW"] = "15m";
+    AuthDefault["THROTTLE_KEY_PREFIX"] = "auth:throttle";
+    AuthDefault[AuthDefault["RECORD_RETENTION_DAYS"] = 7] = "RECORD_RETENTION_DAYS";
+    AuthDefault[AuthDefault["PURGE_BATCH_SIZE"] = 5000] = "PURGE_BATCH_SIZE";
+    AuthDefault["PURGE_EXPIRED_RECORDS_JOB"] = "auth.purge.expired.records.job";
 })(AuthDefault || (exports.AuthDefault = AuthDefault = {}));
+exports.AuthPattern = {
+    SECRET_PLACEHOLDER: /change[_-]?me|placeholder|your[_-]?secret|my[_-]?super[_-]?secret|^secret$|example/i,
+};
 //# sourceMappingURL=auth.default.enum.js.map

package/dist/auth/enums/auth.default.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.default.enum.js","sourceRoot":"","sources":["../../../src/auth/enums/auth.default.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,WAOX;AAPD,WAAY,WAAW;IAErB,0EAAuB,CAAA;IAEvB,sFAA6B,CAAA;IAE7B,sGAAuF,CAAA;AACzF,CAAC,EAPW,WAAW,2BAAX,WAAW,QAOtB"}
+{"version":3,"file":"auth.default.enum.js","sourceRoot":"","sources":["../../../src/auth/enums/auth.default.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,WAiCX;AAjCD,WAAY,WAAW;IAErB,0EAAuB,CAAA;IACvB,wEAAsB,CAAA;IACtB,wEAAsB,CAAA;IAEtB,0EAAuB,CAAA;IACvB,2EAAuB,CAAA;IAEvB,0FAAgC,CAAA;IAEhC,sFAA6B,CAAA;IAE7B,sGAAuF,CAAA;IACvF,4FAAgC,CAAA;IAEhC,qCAAsB,CAAA;IACtB,yCAA0B,CAAA;IAC1B,2CAA4B,CAAA;IAC5B,iDAAkC,CAAA;IAClC,sDAAuC,CAAA;IACvC,wEAAsB,CAAA;IACtB,wFAA8B,CAAA;IAC9B,wEAAsB,CAAA;IACtB,yFAA+B,CAAA;IAC/B,kFAA2B,CAAA;IAC3B,sCAAuB,CAAA;IAEvB,oDAAqC,CAAA;IAErC,+EAAyB,CAAA;IACzB,wEAAuB,CAAA;IACvB,2EAA4D,CAAA;AAC9D,CAAC,EAjCW,WAAW,2BAAX,WAAW,QAiCtB;AAEY,QAAA,WAAW,GAAG;IAEzB,kBAAkB,EAChB,qFAAqF;CAC/E,CAAC"}

package/dist/auth/enums/auth.message.enum.d.ts

@@ -0,0 +1,8 @@
+export declare enum AuthMessage {
+    INVALID_CREDENTIALS = "Invalid email or password",
+    INVALID_ADMIN_CREDENTIALS = "Invalid credentials",
+    INVALID_REFRESH = "Invalid refresh token",
+    INVALID_VERIFICATION_TOKEN = "This verification link is invalid or has expired.",
+    TOO_MANY_ATTEMPTS = "Too many attempts. Try again later."
+}
+//# sourceMappingURL=auth.message.enum.d.ts.map

package/dist/auth/enums/auth.message.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.message.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/auth.message.enum.ts"],"names":[],"mappings":"AACA,oBAAY,WAAW;IACrB,mBAAmB,8BAA8B;IACjD,yBAAyB,wBAAwB;IACjD,eAAe,0BAA0B;IACzC,0BAA0B,sDAAsD;IAChF,iBAAiB,wCAAwC;CAC1D"}

package/dist/auth/enums/auth.message.enum.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthMessage = void 0;
+var AuthMessage;
+(function (AuthMessage) {
+    AuthMessage["INVALID_CREDENTIALS"] = "Invalid email or password";
+    AuthMessage["INVALID_ADMIN_CREDENTIALS"] = "Invalid credentials";
+    AuthMessage["INVALID_REFRESH"] = "Invalid refresh token";
+    AuthMessage["INVALID_VERIFICATION_TOKEN"] = "This verification link is invalid or has expired.";
+    AuthMessage["TOO_MANY_ATTEMPTS"] = "Too many attempts. Try again later.";
+})(AuthMessage || (exports.AuthMessage = AuthMessage = {}));
+//# sourceMappingURL=auth.message.enum.js.map

package/dist/auth/enums/auth.message.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.message.enum.js","sourceRoot":"","sources":["../../../src/auth/enums/auth.message.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,WAMX;AAND,WAAY,WAAW;IACrB,gEAAiD,CAAA;IACjD,gEAAiD,CAAA;IACjD,wDAAyC,CAAA;IACzC,+FAAgF,CAAA;IAChF,wEAAyD,CAAA;AAC3D,CAAC,EANW,WAAW,2BAAX,WAAW,QAMtB"}

package/dist/auth/enums/email.verification.default.enum.d.ts

@@ -0,0 +1,6 @@
+export declare enum EmailVerificationDefault {
+    TOKEN_BYTES = 32,
+    JOB_IDENTIFIER = "email.verification.job",
+    TEMPLATE_IDENTIFIER = "email-verification"
+}
+//# sourceMappingURL=email.verification.default.enum.d.ts.map

package/dist/auth/enums/email.verification.default.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.verification.default.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/email.verification.default.enum.ts"],"names":[],"mappings":"AACA,oBAAY,wBAAwB;IAElC,WAAW,KAAK;IAChB,cAAc,2BAA2B;IAEzC,mBAAmB,uBAAuB;CAC3C"}

package/dist/auth/enums/email.verification.default.enum.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailVerificationDefault = void 0;
+var EmailVerificationDefault;
+(function (EmailVerificationDefault) {
+    EmailVerificationDefault[EmailVerificationDefault["TOKEN_BYTES"] = 32] = "TOKEN_BYTES";
+    EmailVerificationDefault["JOB_IDENTIFIER"] = "email.verification.job";
+    EmailVerificationDefault["TEMPLATE_IDENTIFIER"] = "email-verification";
+})(EmailVerificationDefault || (exports.EmailVerificationDefault = EmailVerificationDefault = {}));
+//# sourceMappingURL=email.verification.default.enum.js.map

package/dist/auth/enums/email.verification.default.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.verification.default.enum.js","sourceRoot":"","sources":["../../../src/auth/enums/email.verification.default.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,wBAMX;AAND,WAAY,wBAAwB;IAElC,sFAAgB,CAAA;IAChB,qEAAyC,CAAA;IAEzC,sEAA0C,CAAA;AAC5C,CAAC,EANW,wBAAwB,wCAAxB,wBAAwB,QAMnC"}

package/dist/auth/enums/tenant.invitation.default.enum.d.ts

@@ -1,4 +1,8 @@
 export declare enum TenantInvitationDefault {
-    EXPIRY = "7d"
+    EXPIRY = "7d",
+    RESEND_LIMIT = 3,
+    RESEND_WINDOW_SECONDS = 3600,
+    DAILY_LIMIT = 100,
+    DAILY_WINDOW_SECONDS = 86400
 }
 //# sourceMappingURL=tenant.invitation.default.enum.d.ts.map

package/dist/auth/enums/tenant.invitation.default.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.invitation.default.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/tenant.invitation.default.enum.ts"],"names":[],"mappings":"AACA,oBAAY,uBAAuB;IAEjC,MAAM,OAAO;CACd"}
+{"version":3,"file":"tenant.invitation.default.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/tenant.invitation.default.enum.ts"],"names":[],"mappings":"AACA,oBAAY,uBAAuB;IAEjC,MAAM,OAAO;IAEb,YAAY,IAAI;IAChB,qBAAqB,OAAO;IAE5B,WAAW,MAAM;IACjB,oBAAoB,QAAQ;CAC7B"}

package/dist/auth/enums/tenant.invitation.default.enum.js

@@ -4,5 +4,9 @@ exports.TenantInvitationDefault = void 0;
 var TenantInvitationDefault;
 (function (TenantInvitationDefault) {
     TenantInvitationDefault["EXPIRY"] = "7d";
+    TenantInvitationDefault[TenantInvitationDefault["RESEND_LIMIT"] = 3] = "RESEND_LIMIT";
+    TenantInvitationDefault[TenantInvitationDefault["RESEND_WINDOW_SECONDS"] = 3600] = "RESEND_WINDOW_SECONDS";
+    TenantInvitationDefault[TenantInvitationDefault["DAILY_LIMIT"] = 100] = "DAILY_LIMIT";
+    TenantInvitationDefault[TenantInvitationDefault["DAILY_WINDOW_SECONDS"] = 86400] = "DAILY_WINDOW_SECONDS";
 })(TenantInvitationDefault || (exports.TenantInvitationDefault = TenantInvitationDefault = {}));
 //# sourceMappingURL=tenant.invitation.default.enum.js.map

package/dist/auth/enums/tenant.invitation.default.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.invitation.default.enum.js","sourceRoot":"","sources":["../../../src/auth/enums/tenant.invitation.default.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IAEjC,wCAAa,CAAA;AACf,CAAC,EAHW,uBAAuB,uCAAvB,uBAAuB,QAGlC"}
+{"version":3,"file":"tenant.invitation.default.enum.js","sourceRoot":"","sources":["../../../src/auth/enums/tenant.invitation.default.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,uBASX;AATD,WAAY,uBAAuB;IAEjC,wCAAa,CAAA;IAEb,qFAAgB,CAAA;IAChB,0GAA4B,CAAA;IAE5B,qFAAiB,CAAA;IACjB,yGAA4B,CAAA;AAC9B,CAAC,EATW,uBAAuB,uCAAvB,uBAAuB,QASlC"}

package/dist/auth/es6.classes.d.ts

@@ -14,6 +14,10 @@ import { GoogleAuthService } from './services/google.auth.service';
 import { ImpersonationService } from './services/impersonation.service';
 import { TenantInvitationService } from './services/tenant.invitation.service';
 import { TenantMembershipService } from './services/tenant.membership.service';
+import { TokenService } from './services/token.service';
+import { LoginThrottleService } from './services/login.throttle.service';
+import { EmailVerificationService } from './services/email.verification.service';
+import { PurgeExpiredAuthRecordsJob } from './jobs/purge.expired.auth.records.job';
 import { TenantInvitationDataProcessor } from './processors/tenant.invitation.data.processor';
 import { TenantInvitationListProcessor } from './processors/tenant.invitation.list.processor';
 import { TenantMemberListProcessor } from './processors/tenant.member.list.processor';
@@ -24,12 +28,13 @@ import { LoginDto } from './dtos/login.dto';
 import { MemberRolesDto } from './dtos/member.roles.dto';
 import { RefreshTokenDto } from './dtos/refresh.token.dto';
 import { TenantInvitationListDto } from './dtos/tenant.invitation.list.dto';
+import { VerifyEmailDto } from './dtos/verify.email.dto';
 export declare const es6Classes: {
     controllers: (typeof AuthController | typeof AdminAuthController | typeof ImpersonationController | typeof TenantInvitationController | typeof TenantMemberController | typeof UserInvitationController | typeof UserOrganizationController)[];
-    services: readonly [typeof ApiKeyService, typeof ScopeService, typeof AuthService, typeof AdminAuthService, typeof GoogleAuthService, typeof RoleService, typeof ImpersonationService, typeof TenantMembershipService, typeof TenantInvitationService];
+    services: readonly [typeof ApiKeyService, typeof ScopeService, typeof AuthService, typeof AdminAuthService, typeof GoogleAuthService, typeof RoleService, typeof ImpersonationService, typeof TenantMembershipService, typeof TenantInvitationService, typeof TokenService, typeof LoginThrottleService, typeof EmailVerificationService];
     libraries: (typeof TenantInvitationDataProcessor | typeof TenantInvitationListProcessor | typeof TenantMemberListProcessor)[];
-    dtos: (typeof RefreshTokenDto | typeof LoginDto | typeof GoogleLoginDto | typeof ChangePasswordDto | typeof AdminLoginDto | typeof TenantInvitationListDto | typeof MemberRolesDto)[];
-    jobs: any[];
+    dtos: (typeof RefreshTokenDto | typeof LoginDto | typeof GoogleLoginDto | typeof ChangePasswordDto | typeof VerifyEmailDto | typeof AdminLoginDto | typeof TenantInvitationListDto | typeof MemberRolesDto)[];
+    jobs: readonly [typeof PurgeExpiredAuthRecordsJob];
     subscribers: any[];
 };
 //# sourceMappingURL=es6.classes.d.ts.map

package/dist/auth/es6.classes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"es6.classes.d.ts","sourceRoot":"","sources":["../../src/auth/es6.classes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAG5E,eAAO,MAAM,UAAU;;;;;;;CA0CtB,CAAC"}
+{"version":3,"file":"es6.classes.d.ts","sourceRoot":"","sources":["../../src/auth/es6.classes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAG3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAE5E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,eAAO,MAAM,UAAU;;;;;;;CA8CtB,CAAC"}

package/dist/auth/es6.classes.js

@@ -17,6 +17,10 @@ const google_auth_service_1 = require("./services/google.auth.service");
 const impersonation_service_1 = require("./services/impersonation.service");
 const tenant_invitation_service_1 = require("./services/tenant.invitation.service");
 const tenant_membership_service_1 = require("./services/tenant.membership.service");
+const token_service_1 = require("./services/token.service");
+const login_throttle_service_1 = require("./services/login.throttle.service");
+const email_verification_service_1 = require("./services/email.verification.service");
+const purge_expired_auth_records_job_1 = require("./jobs/purge.expired.auth.records.job");
 const tenant_invitation_data_processor_1 = require("./processors/tenant.invitation.data.processor");
 const tenant_invitation_list_processor_1 = require("./processors/tenant.invitation.list.processor");
 const tenant_member_list_processor_1 = require("./processors/tenant.member.list.processor");
@@ -32,6 +36,7 @@ const register_dto_1 = require("./dtos/register.dto");
 const switch_organization_dto_1 = require("./dtos/switch.organization.dto");
 const tenant_invitation_list_dto_1 = require("./dtos/tenant.invitation.list.dto");
 const tenant_member_list_dto_1 = require("./dtos/tenant.member.list.dto");
+const verify_email_dto_1 = require("./dtos/verify.email.dto");
 exports.es6Classes = {
     controllers: [
         auth_controller_1.AuthController,
@@ -52,6 +57,9 @@ exports.es6Classes = {
         impersonation_service_1.ImpersonationService,
         tenant_membership_service_1.TenantMembershipService,
         tenant_invitation_service_1.TenantInvitationService,
+        token_service_1.TokenService,
+        login_throttle_service_1.LoginThrottleService,
+        email_verification_service_1.EmailVerificationService,
     ],
     libraries: [
         tenant_invitation_data_processor_1.TenantInvitationDataProcessor,
@@ -71,8 +79,9 @@ exports.es6Classes = {
         switch_organization_dto_1.SwitchOrganizationDto,
         tenant_invitation_list_dto_1.TenantInvitationListDto,
         tenant_member_list_dto_1.TenantMemberListDto,
+        verify_email_dto_1.VerifyEmailDto,
     ],
-    jobs: [],
+    jobs: [purge_expired_auth_records_job_1.PurgeExpiredAuthRecordsJob],
     subscribers: [],
 };
 //# sourceMappingURL=es6.classes.js.map

package/dist/auth/es6.classes.js.map

@@ -1 +1 @@
-{"version":3,"file":"es6.classes.js","sourceRoot":"","sources":["../../src/auth/es6.classes.ts"],"names":[],"mappings":";;;AAAA,mEAA+D;AAC/D,+EAA0E;AAC1E,qFAAiF;AACjF,6FAAwF;AACxF,qFAAgF;AAChF,yFAAoF;AACpF,6FAAwF;AACxF,gEAA2D;AAC3D,4DAAwD;AACxD,0DAAsD;AACtD,0DAAsD;AACtD,sEAAiE;AACjE,wEAAmE;AACnE,4EAAwE;AACxE,oFAA+E;AAC/E,oFAA+E;AAC/E,oGAA8F;AAC9F,oGAA8F;AAC9F,4FAAsF;AACtF,4DAAuD;AACvD,oEAA+D;AAC/D,8DAAyD;AACzD,4EAAuE;AACvE,0EAAoE;AACpE,gDAA4C;AAC5C,8DAAyD;AACzD,gEAA2D;AAC3D,sDAAkD;AAClD,4EAAuE;AACvE,kFAA4E;AAC5E,0EAAoE;AAEvD,QAAA,UAAU,GAAG;IACxB,WAAW,EAAE;QACX,gCAAc;QACd,2CAAmB;QACnB,kDAAuB;QACvB,yDAA0B;QAC1B,iDAAsB;QACtB,qDAAwB;QACxB,yDAA0B;KAC3B;IACD,QAAQ,EAAE;QACR,+BAAa;QACb,4BAAY;QACZ,0BAAW;QACX,qCAAgB;QAChB,uCAAiB;QACjB,0BAAW;QACX,4CAAoB;QACpB,mDAAuB;QACvB,mDAAuB;KACf;IACV,SAAS,EAAE;QACT,gEAA6B;QAC7B,gEAA6B;QAC7B,wDAAyB;KAC1B;IACD,IAAI,EAAE;QACJ,+BAAa;QACb,uCAAiB;QACjB,iCAAc;QACd,+CAAqB;QACrB,4CAAmB;QACnB,oBAAQ;QACR,iCAAc;QACd,mCAAe;QACf,0BAAW;QACX,+CAAqB;QACrB,oDAAuB;QACvB,4CAAmB;KACpB;IACD,IAAI,EAAE,EAAE;IACR,WAAW,EAAE,EAAE;CAChB,CAAC"}
+{"version":3,"file":"es6.classes.js","sourceRoot":"","sources":["../../src/auth/es6.classes.ts"],"names":[],"mappings":";;;AAAA,mEAA+D;AAC/D,+EAA0E;AAC1E,qFAAiF;AACjF,6FAAwF;AACxF,qFAAgF;AAChF,yFAAoF;AACpF,6FAAwF;AACxF,gEAA2D;AAC3D,4DAAwD;AACxD,0DAAsD;AACtD,0DAAsD;AACtD,sEAAiE;AACjE,wEAAmE;AACnE,4EAAwE;AACxE,oFAA+E;AAC/E,oFAA+E;AAC/E,4DAAwD;AACxD,8EAAyE;AACzE,sFAAiF;AACjF,0FAAmF;AACnF,oGAA8F;AAC9F,oGAA8F;AAC9F,4FAAsF;AACtF,4DAAuD;AACvD,oEAA+D;AAC/D,8DAAyD;AACzD,4EAAuE;AACvE,0EAAoE;AACpE,gDAA4C;AAC5C,8DAAyD;AACzD,gEAA2D;AAC3D,sDAAkD;AAClD,4EAAuE;AACvE,kFAA4E;AAC5E,0EAAoE;AACpE,8DAAyD;AAE5C,QAAA,UAAU,GAAG;IACxB,WAAW,EAAE;QACX,gCAAc;QACd,2CAAmB;QACnB,kDAAuB;QACvB,yDAA0B;QAC1B,iDAAsB;QACtB,qDAAwB;QACxB,yDAA0B;KAC3B;IACD,QAAQ,EAAE;QACR,+BAAa;QACb,4BAAY;QACZ,0BAAW;QACX,qCAAgB;QAChB,uCAAiB;QACjB,0BAAW;QACX,4CAAoB;QACpB,mDAAuB;QACvB,mDAAuB;QACvB,4BAAY;QACZ,6CAAoB;QACpB,qDAAwB;KAChB;IACV,SAAS,EAAE;QACT,gEAA6B;QAC7B,gEAA6B;QAC7B,wDAAyB;KAC1B;IACD,IAAI,EAAE;QACJ,+BAAa;QACb,uCAAiB;QACjB,iCAAc;QACd,+CAAqB;QACrB,4CAAmB;QACnB,oBAAQ;QACR,iCAAc;QACd,mCAAe;QACf,0BAAW;QACX,+CAAqB;QACrB,oDAAuB;QACvB,4CAAmB;QACnB,iCAAc;KACf;IACD,IAAI,EAAE,CAAC,2DAA0B,CAAU;IAC3C,WAAW,EAAE,EAAE;CAChB,CAAC"}

package/dist/auth/guards/api.key.guard.d.ts

@@ -1,11 +1,12 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { ApiKeyService } from '../services/api.key.service';
+import { AuthConfig } from '../utilities/auth.config';
 export declare class ApiKeyGuard implements CanActivate {
     private readonly apiKeyService;
     private readonly reflector;
-    constructor(apiKeyService: ApiKeyService, reflector: Reflector);
+    private readonly config;
+    constructor(apiKeyService: ApiKeyService, reflector: Reflector, config: AuthConfig);
     canActivate(context: ExecutionContext): Promise<boolean>;
-    private extractKey;
 }
 //# sourceMappingURL=api.key.guard.d.ts.map

package/dist/auth/guards/api.key.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/api.key.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAMzC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAS5D,qBACa,WAAY,YAAW,WAAW;IAE3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS;IAGjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgC9D,OAAO,CAAC,UAAU;CAYnB"}
+{"version":3,"file":"api.key.guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/api.key.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAQzC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAUtD,qBACa,WAAY,YAAW,WAAW;IAE3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,UAAU;IAG/B,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAuC/D"}

package/dist/auth/guards/api.key.guard.js

@@ -14,56 +14,45 @@ const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const access_exception_1 = require("../../global/exceptions/access.exception");
 const api_key_scopes_decorator_1 = require("../decorators/api.key.scopes.decorator");
-const api_key_default_enum_1 = require("../enums/api.key.default.enum");
 const public_decorator_1 = require("../decorators/public.decorator");
 const api_key_service_1 = require("../services/api.key.service");
+const auth_config_1 = require("../utilities/auth.config");
+const request_credentials_1 = require("../utilities/request.credentials");
 let ApiKeyGuard = class ApiKeyGuard {
-    constructor(apiKeyService, reflector) {
+    constructor(apiKeyService, reflector, config) {
         this.apiKeyService = apiKeyService;
         this.reflector = reflector;
+        this.config = config;
     }
     async canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass(),
-        ]);
-        if (isPublic)
+        const targets = [context.getHandler(), context.getClass()];
+        if (this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, targets))
             return true;
         const request = context.switchToHttp().getRequest();
-        const rawKey = this.extractKey(request);
+        const rawKey = request_credentials_1.RequestCredentials.apiKey(request, this.config.apiKeyHeaderName);
         if (!rawKey)
             throw new common_1.UnauthorizedException('API key is missing.');
         const apiKey = await this.apiKeyService.validateApiKey(rawKey);
         if (!apiKey)
             throw new common_1.UnauthorizedException('API key is invalid, revoked or expired.');
-        const requiredScopes = this.reflector.getAllAndOverride(api_key_scopes_decorator_1.API_KEY_SCOPES_KEY, [
-            context.getHandler(),
-            context.getClass(),
-        ]) ?? [];
-        for (const scope of requiredScopes) {
-            if (!(await this.apiKeyService.hasScope(apiKey, scope))) {
-                throw new access_exception_1.AccessException(`API key is missing the "${scope}" scope.`);
-            }
-        }
-        request.apiKey = apiKey;
+        const requiredScopes = this.reflector.getAllAndOverride(api_key_scopes_decorator_1.API_KEY_SCOPES_KEY, targets) ??
+            [];
+        const anyScope = this.reflector.getAllAndOverride(api_key_scopes_decorator_1.API_KEY_ANY_SCOPE_KEY, targets);
+        if (!requiredScopes.length && !anyScope)
+            throw new access_exception_1.AccessException('This route accepts no API key scope.');
+        const scopes = await this.apiKeyService.effectiveScopes(apiKey);
+        const missing = requiredScopes.find((scope) => !api_key_service_1.ApiKeyService.grants(scopes, scope));
+        if (missing)
+            throw new access_exception_1.AccessException(`API key is missing the "${missing}" scope.`);
+        Object.assign(request, { apiKey, apiKeyScopes: scopes });
         return true;
     }
-    extractKey(request) {
-        const headerName = process.env.API_KEY_HEADER_NAME || api_key_default_enum_1.ApiKeyDefault.HEADER_NAME;
-        const headerKey = request.headers[headerName];
-        if (headerKey)
-            return Array.isArray(headerKey) ? headerKey[0] : headerKey;
-        const authorization = request.headers.authorization;
-        if (authorization?.toLowerCase().startsWith('apikey ')) {
-            return authorization.slice('apikey '.length).trim();
-        }
-        return null;
-    }
 };
 exports.ApiKeyGuard = ApiKeyGuard;
 exports.ApiKeyGuard = ApiKeyGuard = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [api_key_service_1.ApiKeyService,
-        core_1.Reflector])
+        core_1.Reflector,
+        auth_config_1.AuthConfig])
 ], ApiKeyGuard);
 //# sourceMappingURL=api.key.guard.js.map

package/dist/auth/guards/api.key.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.guard.js","sourceRoot":"","sources":["../../../src/auth/guards/api.key.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AAEzC,+EAA2E;AAC3E,qFAA4E;AAC5E,wEAA8D;AAC9D,qEAA+D;AAC/D,iEAA4D;AAUrD,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,YACmB,aAA4B,EAC5B,SAAoB;QADpB,kBAAa,GAAb,aAAa,CAAe;QAC5B,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QAEJ,MAAM,cAAc,GAClB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,6CAAkB,EAAE;YAC7D,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,IAAI,EAAE,CAAC;QACX,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,kCAAe,CAAC,2BAA2B,KAAK,UAAU,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAEA,OAAgC,CAAC,MAAM,GAAG,MAAM,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,UAAU,CAAC,OAAgB;QACjC,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oCAAa,CAAC,WAAW,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,aAAa,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAlDY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAGuB,+BAAa;QACjB,gBAAS;GAH5B,WAAW,CAkDvB"}
+{"version":3,"file":"api.key.guard.js","sourceRoot":"","sources":["../../../src/auth/guards/api.key.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AAEzC,+EAA2E;AAC3E,qFAGgD;AAChD,qEAA+D;AAC/D,iEAA4D;AAC5D,0DAAsD;AACtD,0EAAsE;AAU/D,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,YACmB,aAA4B,EAC5B,SAAoB,EACpB,MAAkB;QAFlB,kBAAa,GAAb,aAAa,CAAe;QAC5B,cAAS,GAAT,SAAS,CAAW;QACpB,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE,OAAO,CAAC;YACnE,OAAO,IAAI,CAAC;QAEd,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,MAAM,GAAG,wCAAkB,CAAC,MAAM,CACtC,OAAO,EACP,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,8BAAqB,CAC7B,yCAAyC,CAC1C,CAAC;QAEJ,MAAM,cAAc,GAClB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,6CAAkB,EAAE,OAAO,CAAC;YACvE,EAAE,CAAC;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC/C,gDAAqB,EACrB,OAAO,CACR,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,MAAM,IAAI,CAAC,QAAQ;YACrC,MAAM,IAAI,kCAAe,CAAC,sCAAsC,CAAC,CAAC;QAGpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,+BAAa,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAChD,CAAC;QACF,IAAI,OAAO;YACT,MAAM,IAAI,kCAAe,CAAC,2BAA2B,OAAO,UAAU,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA9CY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAGuB,+BAAa;QACjB,gBAAS;QACZ,wBAAU;GAJ1B,WAAW,CA8CvB"}

package/dist/auth/guards/jwt.auth.guard.d.ts

@@ -4,7 +4,7 @@ declare const JwtAuthGuard_base: import("@nestjs/passport").Type<import("@nestjs
 export declare class JwtAuthGuard extends JwtAuthGuard_base {
     private readonly reflector;
     constructor(reflector: Reflector);
-    canActivate(context: ExecutionContext): boolean | Promise<boolean> | import("rxjs").Observable<boolean>;
+    canActivate(context: ExecutionContext): Promise<boolean>;
 }
 export {};
 //# sourceMappingURL=jwt.auth.guard.d.ts.map

package/dist/auth/guards/jwt.auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/jwt.auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAc,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;;AAIzC,qBACa,YAAa,SAAQ,iBAAgB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAIjD,WAAW,CAAC,OAAO,EAAE,gBAAgB;CAQtC"}
+{"version":3,"file":"jwt.auth.guard.d.ts","sourceRoot":"","sources":["../../../src/auth/guards/jwt.auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAc,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;;AAYzC,qBACa,YAAa,SAAQ,iBAAgB;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAI3C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAsB/D"}

package/dist/auth/guards/jwt.auth.guard.js

@@ -13,20 +13,27 @@ exports.JwtAuthGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const passport_1 = require("@nestjs/passport");
+const access_exception_1 = require("../../global/exceptions/access.exception");
+const allow_pending_password_change_decorator_1 = require("../decorators/allow.pending.password.change.decorator");
 const public_decorator_1 = require("../decorators/public.decorator");
 let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)('jwt') {
     constructor(reflector) {
         super();
         this.reflector = reflector;
     }
-    canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass(),
-        ]);
-        if (isPublic)
+    async canActivate(context) {
+        const targets = [context.getHandler(), context.getClass()];
+        if (this.reflector.getAllAndOverride(public_decorator_1.IS_PUBLIC_KEY, targets))
             return true;
-        return super.canActivate(context);
+        if (!(await super.canActivate(context)))
+            return false;
+        const user = context
+            .switchToHttp()
+            .getRequest().user;
+        if (user?.passwordChangeRequired &&
+            !this.reflector.getAllAndOverride(allow_pending_password_change_decorator_1.ALLOW_PENDING_PASSWORD_CHANGE_KEY, targets))
+            throw new access_exception_1.AccessException('Change your one-time password before continuing.');
+        return true;
     }
 };
 exports.JwtAuthGuard = JwtAuthGuard;

package/dist/auth/guards/jwt.auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.guard.js","sourceRoot":"","sources":["../../../src/auth/guards/jwt.auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA8D;AAC9D,uCAAyC;AACzC,+CAA6C;AAC7C,qEAA+D;AAGxD,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IAChD,YAA6B,SAAoB;QAC/C,KAAK,EAAE,CAAC;QADmB,cAAS,GAAT,SAAS,CAAW;IAEjD,CAAC;IAED,WAAW,CAAC,OAAyB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAbY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAE6B,gBAAS;GADtC,YAAY,CAaxB"}
+{"version":3,"file":"jwt.auth.guard.js","sourceRoot":"","sources":["../../../src/auth/guards/jwt.auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA8D;AAC9D,uCAAyC;AACzC,+CAA6C;AAC7C,+EAA2E;AAC3E,mHAA0G;AAC1G,qEAA+D;AASxD,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IAChD,YAA6B,SAAoB;QAC/C,KAAK,EAAE,CAAC;QADmB,cAAS,GAAT,SAAS,CAAW;IAEjD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,gCAAa,EAAE,OAAO,CAAC;YACnE,OAAO,IAAI,CAAC;QAEd,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtD,MAAM,IAAI,GAAG,OAAO;aACjB,YAAY,EAAE;aACd,UAAU,EAA0B,CAAC,IAAI,CAAC;QAC7C,IACE,IAAI,EAAE,sBAAsB;YAC5B,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC/B,2EAAiC,EACjC,OAAO,CACR;YAED,MAAM,IAAI,kCAAe,CACvB,kDAAkD,CACnD,CAAC;QACJ,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA3BY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAE6B,gBAAS;GADtC,YAAY,CA2BxB"}

package/dist/auth/helpers/admin.auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.auth.d.ts","sourceRoot":"","sources":["../../../src/auth/helpers/admin.auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAWjE,qBAAa,SAAS;WAMP,oBAAoB,CAC/B,WAAW,EAAE,MAAM,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAwBxC,MAAM,CAAC,cAAc,CAAC,CAAC,EACrB,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE,MAAM,CAAC,GAChB,CAAC;IASJ,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIzD,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAInD,MAAM,CAAC,OAAO,IAAI,MAAM,GAAG,SAAS;CAGrC"}
+{"version":3,"file":"admin.auth.d.ts","sourceRoot":"","sources":["../../../src/auth/helpers/admin.auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAWjE,qBAAa,SAAS;WAMP,oBAAoB,CAC/B,WAAW,EAAE,MAAM,EACnB,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAyBxC,MAAM,CAAC,cAAc,CAAC,CAAC,EACrB,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,EAAE,MAAM,CAAC,GAChB,CAAC;IASJ,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAIzD,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,SAAS;IAInD,MAAM,CAAC,OAAO,IAAI,MAAM,GAAG,SAAS;CAGrC"}

package/dist/auth/helpers/admin.auth.js

@@ -9,7 +9,7 @@ class AdminAuth {
         const adminUser = await admin_user_entity_1.AdminUserEntity.findOne({
             where: { id: adminUserId },
         });
-        if (!adminUser)
+        if (!adminUser?.active)
             return null;
         const adminUserObject = { ...adminUser };
         delete adminUserObject.password;

package/dist/auth/helpers/admin.auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.auth.js","sourceRoot":"","sources":["../../../src/auth/helpers/admin.auth.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAChD,qEAAgE;AAGhE,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAyB,CAAC;AAS/D,MAAa,SAAS;IAMpB,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAC/B,WAAmB,EACnB,iBAA0B;QAE1B,MAAM,SAAS,GAAG,MAAM,mCAAe,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,eAAe,GAAwB,EAAE,GAAG,SAAS,EAAE,CAAC;QAC9D,OAAO,eAAe,CAAC,QAAQ,CAAC;QAChC,OAAO,eAAe,CAAC,UAAU,CAAC;QAClC,OAAO,eAAe,CAAC,UAAU,CAAC;QAClC,OAAO,eAAe,CAAC,UAAU,CAAC;QAElC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;IAC3D,CAAC;IAWD,MAAM,CAAC,cAAc,CACnB,OAA8B,EAC9B,QAAiB;QAEjB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAOD,MAAM,CAAC,YAAY,CAAC,OAA8B;QAChD,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,SAAS;QACd,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,OAAO;QACZ,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC;IAC/C,CAAC;CACF;AAxDD,8BAwDC"}
+{"version":3,"file":"admin.auth.js","sourceRoot":"","sources":["../../../src/auth/helpers/admin.auth.ts"],"names":[],"mappings":";;;AAAA,6CAAgD;AAChD,qEAAgE;AAGhE,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAyB,CAAC;AAS/D,MAAa,SAAS;IAMpB,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAC/B,WAAmB,EACnB,iBAA0B;QAE1B,MAAM,SAAS,GAAG,MAAM,mCAAe,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,eAAe,GAAwB,EAAE,GAAG,SAAS,EAAE,CAAC;QAC9D,OAAO,eAAe,CAAC,QAAQ,CAAC;QAChC,OAAO,eAAe,CAAC,UAAU,CAAC;QAClC,OAAO,eAAe,CAAC,UAAU,CAAC;QAClC,OAAO,eAAe,CAAC,UAAU,CAAC;QAElC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;IAC3D,CAAC;IAWD,MAAM,CAAC,cAAc,CACnB,OAA8B,EAC9B,QAAiB;QAEjB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IAOD,MAAM,CAAC,YAAY,CAAC,OAA8B;QAChD,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,SAAS;QACd,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,OAAO;QACZ,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,iBAAiB,CAAC;IAC/C,CAAC;CACF;AAzDD,8BAyDC"}

package/dist/auth/jobs/purge.expired.auth.records.job.d.ts

@@ -0,0 +1,15 @@
+import { DataSource, EntityTarget, ObjectLiteral } from 'typeorm';
+import { CommonJob } from '../../common/jobs/common.job';
+import { QueueService } from '../../common/services/queue.service';
+import { AuthConfig } from '../utilities/auth.config';
+export declare class PurgeExpiredAuthRecordsJob extends CommonJob {
+    protected readonly queueService: QueueService;
+    private readonly dataSource;
+    private readonly config;
+    schedulable: boolean;
+    static readonly targets: EntityTarget<ObjectLiteral>[];
+    constructor(queueService: QueueService, dataSource: DataSource, config: AuthConfig);
+    handle(): Promise<void>;
+    private purge;
+}
+//# sourceMappingURL=purge.expired.auth.records.job.d.ts.map

package/dist/auth/jobs/purge.expired.auth.records.job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.expired.auth.records.job.d.ts","sourceRoot":"","sources":["../../../src/auth/jobs/purge.expired.auth.records.job.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAKnE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAQtD,qBACa,0BAA2B,SAAQ,SAAS;IAUrD,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXlB,WAAW,UAAQ;IAE1B,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,CAIpD;gBAGmB,YAAY,EAAE,YAAY,EAC5B,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,UAAU;IAK/B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YAYf,KAAK;CAsBpB"}