@neohm/nestend 4.1.1 → 5.0.1

package/dist/auth/jobs/purge.expired.auth.records.job.js

@@ -0,0 +1,72 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var PurgeExpiredAuthRecordsJob_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PurgeExpiredAuthRecordsJob = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const common_job_1 = require("../../common/jobs/common.job");
+const queue_service_1 = require("../../common/services/queue.service");
+const email_verification_token_entity_1 = require("../entities/email.verification.token.entity");
+const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
+const system_refresh_token_entity_1 = require("../entities/system.refresh.token.entity");
+const auth_default_enum_1 = require("../enums/auth.default.enum");
+const auth_config_1 = require("../utilities/auth.config");
+let PurgeExpiredAuthRecordsJob = PurgeExpiredAuthRecordsJob_1 = class PurgeExpiredAuthRecordsJob extends common_job_1.CommonJob {
+    constructor(queueService, dataSource, config) {
+        super(String(auth_default_enum_1.AuthDefault.PURGE_EXPIRED_RECORDS_JOB));
+        this.queueService = queueService;
+        this.dataSource = dataSource;
+        this.config = config;
+        this.schedulable = true;
+    }
+    async handle() {
+        const days = this.config.recordRetentionDays;
+        if (days <= 0)
+            return;
+        const before = new Date(Date.now() - days * 86_400_000);
+        let removed = 0;
+        for (const target of PurgeExpiredAuthRecordsJob_1.targets)
+            removed += await this.purge(target, before);
+        if (removed)
+            this.logger.log(`Purged ${removed} expired auth record(s).`);
+    }
+    async purge(target, before) {
+        const table = this.dataSource.getMetadata(target).tableName;
+        const limit = Number(auth_default_enum_1.AuthDefault.PURGE_BATCH_SIZE);
+        let total = 0;
+        for (;;) {
+            const result = await this.dataSource
+                .createQueryBuilder()
+                .delete()
+                .from(target)
+                .where(`id IN (SELECT id FROM ${table} WHERE expires_at < :before LIMIT :limit)`, { before, limit })
+                .execute();
+            const affected = result.affected ?? 0;
+            total += affected;
+            if (affected < limit)
+                return total;
+        }
+    }
+};
+exports.PurgeExpiredAuthRecordsJob = PurgeExpiredAuthRecordsJob;
+PurgeExpiredAuthRecordsJob.targets = [
+    system_auth_session_entity_1.SystemAuthSessionEntity,
+    system_refresh_token_entity_1.SystemRefreshTokenEntity,
+    email_verification_token_entity_1.EmailVerificationTokenEntity,
+];
+exports.PurgeExpiredAuthRecordsJob = PurgeExpiredAuthRecordsJob = PurgeExpiredAuthRecordsJob_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [queue_service_1.QueueService,
+        typeorm_1.DataSource,
+        auth_config_1.AuthConfig])
+], PurgeExpiredAuthRecordsJob);
+//# sourceMappingURL=purge.expired.auth.records.job.js.map

package/dist/auth/jobs/purge.expired.auth.records.job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"purge.expired.auth.records.job.js","sourceRoot":"","sources":["../../../src/auth/jobs/purge.expired.auth.records.job.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA4C;AAC5C,qCAAkE;AAClE,6DAAyD;AACzD,uEAAmE;AACnE,iGAA2F;AAC3F,uFAAiF;AACjF,yFAAmF;AACnF,kEAAyD;AACzD,0DAAsD;AAS/C,IAAM,0BAA0B,kCAAhC,MAAM,0BAA2B,SAAQ,sBAAS;IASvD,YACqB,YAA0B,EAC5B,UAAsB,EACtB,MAAkB;QAEnC,KAAK,CAAC,MAAM,CAAC,+BAAW,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAJlC,iBAAY,GAAZ,YAAY,CAAc;QAC5B,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAY;QAX9B,gBAAW,GAAG,IAAI,CAAC;IAc1B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC7C,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO;QAEtB,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,UAAU,CAAC,CAAC;QACxD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,4BAA0B,CAAC,OAAO;YACrD,OAAO,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,OAAO,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IAGO,KAAK,CAAC,KAAK,CACjB,MAAmC,EACnC,MAAY;QAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,+BAAW,CAAC,gBAAgB,CAAC,CAAC;QACnD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU;iBACjC,kBAAkB,EAAE;iBACpB,MAAM,EAAE;iBACR,IAAI,CAAC,MAAM,CAAC;iBACZ,KAAK,CACJ,yBAAyB,KAAK,2CAA2C,EACzE,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB;iBACA,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YACtC,KAAK,IAAI,QAAQ,CAAC;YAClB,IAAI,QAAQ,GAAG,KAAK;gBAAE,OAAO,KAAK,CAAC;QACrC,CAAC;IACH,CAAC;;AAlDU,gEAA0B;AAGrB,kCAAO,GAAkC;IACvD,oDAAuB;IACvB,sDAAwB;IACxB,8DAA4B;CAC7B,AAJsB,CAIrB;qCAPS,0BAA0B;IADtC,IAAA,mBAAU,GAAE;qCAWwB,4BAAY;QAChB,oBAAU;QACd,wBAAU;GAZ1B,0BAA0B,CAmDtC"}

package/dist/auth/middlewares/admin.jwt.middleware.d.ts

@@ -1,11 +1,10 @@
 import { NestMiddleware } from '@nestjs/common';
-import { JwtService } from '@nestjs/jwt';
 import { NextFunction, Request, Response } from 'express';
+import { TokenService } from '../services/token.service';
 export declare class AdminJwtMiddleware implements NestMiddleware {
-    private readonly jwtService;
-    constructor(jwtService: JwtService);
+    private readonly tokenService;
+    constructor(tokenService: TokenService);
     use(request: Request, _response: Response, next: NextFunction): Promise<void>;
     private resolveContext;
-    private extractToken;
 }
 //# sourceMappingURL=admin.jwt.middleware.d.ts.map

package/dist/auth/middlewares/admin.jwt.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.jwt.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/admin.jwt.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkB1D,qBACa,kBAAmB,YAAW,cAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IAE7C,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;YAcF,cAAc;IA4B5B,OAAO,CAAC,YAAY;CAOrB"}
+{"version":3,"file":"admin.jwt.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/admin.jwt.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAG1D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAUzD,qBACa,kBAAmB,YAAW,cAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,YAAY;IAEjD,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;YAYF,cAAc;CAiB7B"}

package/dist/auth/middlewares/admin.jwt.middleware.js

@@ -11,12 +11,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AdminJwtMiddleware = void 0;
 const common_1 = require("@nestjs/common");
-const jwt_1 = require("@nestjs/jwt");
-const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
 const admin_auth_1 = require("../helpers/admin.auth");
+const token_service_1 = require("../services/token.service");
+const request_credentials_1 = require("../utilities/request.credentials");
 let AdminJwtMiddleware = class AdminJwtMiddleware {
-    constructor(jwtService) {
-        this.jwtService = jwtService;
+    constructor(tokenService) {
+        this.tokenService = tokenService;
     }
     async use(request, _response, next) {
         const context = await this.resolveContext(request);
@@ -27,42 +27,23 @@ let AdminJwtMiddleware = class AdminJwtMiddleware {
         next();
     }
     async resolveContext(request) {
-        const token = this.extractToken(request);
+        const token = request_credentials_1.RequestCredentials.bearerToken(request);
         if (!token)
             return null;
         try {
-            const payload = await this.jwtService.verifyAsync(token, {
-                secret: process.env.ACCESS_TOKEN_SECRET,
-            });
-            if (!payload.sid)
+            const session = await this.tokenService.resolveSession('admin', token);
+            if (!session)
                 return null;
-            const session = await system_auth_session_entity_1.SystemAuthSessionEntity.findOne({
-                where: { session_identifier: payload.sid, is_admin: true },
-            });
-            const active = !!session &&
-                !session.invalidated_at &&
-                session.expires_at.getTime() > Date.now();
-            if (!active)
-                return null;
-            return await admin_auth_1.AdminAuth.loadAdminUserContext(payload.sub, payload.sid);
+            return await admin_auth_1.AdminAuth.loadAdminUserContext(session.payload.sub, session.sessionIdentifier);
         }
         catch {
             return null;
         }
     }
-    extractToken(request) {
-        const header = request.headers['authorization'];
-        if (!header)
-            return undefined;
-        const [scheme, value] = header.split(' ');
-        if (scheme?.toLowerCase() !== 'bearer' || !value)
-            return undefined;
-        return value.trim();
-    }
 };
 exports.AdminJwtMiddleware = AdminJwtMiddleware;
 exports.AdminJwtMiddleware = AdminJwtMiddleware = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [jwt_1.JwtService])
+    __metadata("design:paramtypes", [token_service_1.TokenService])
 ], AdminJwtMiddleware);
 //# sourceMappingURL=admin.jwt.middleware.js.map

package/dist/auth/middlewares/admin.jwt.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.jwt.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/admin.jwt.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAC5D,qCAAyC;AAEzC,uFAAiF;AAEjF,sDAAkD;AAgB3C,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAKnD,IAAI,OAAO,EAAE,CAAC;YACZ,sBAAS,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAGO,KAAK,CAAC,cAAc,CAC1B,OAAgB;QAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAa,KAAK,EAAE;gBACnE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,OAAO,GAAG,MAAM,oDAAuB,CAAC,OAAO,CAAC;gBACpD,KAAK,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC3D,CAAC,CAAC;YACH,MAAM,MAAM,GACV,CAAC,CAAC,OAAO;gBACT,CAAC,OAAO,CAAC,cAAc;gBACvB,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEzB,OAAO,MAAM,sBAAS,CAAC,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YAEP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAAgB;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAA;AAxDY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAE8B,gBAAU;GADxC,kBAAkB,CAwD9B"}
+{"version":3,"file":"admin.jwt.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/admin.jwt.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAG5D,sDAAkD;AAClD,6DAAyD;AACzD,0EAAsE;AAU/D,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YAA6B,YAA0B;QAA1B,iBAAY,GAAZ,YAAY,CAAc;IAAG,CAAC;IAE3D,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAGnD,IAAI,OAAO,EAAE,CAAC;YACZ,sBAAS,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAGO,KAAK,CAAC,cAAc,CAC1B,OAAgB;QAEhB,MAAM,KAAK,GAAG,wCAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACvE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO,MAAM,sBAAS,CAAC,oBAAoB,CACzC,OAAO,CAAC,OAAO,CAAC,GAAG,EACnB,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AApCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAEgC,4BAAY;GAD5C,kBAAkB,CAoC9B"}

package/dist/auth/middlewares/api.key.middleware.d.ts

@@ -1,11 +1,12 @@
 import { NestMiddleware } from '@nestjs/common';
 import { NextFunction, Request, Response } from 'express';
 import { ApiKeyService } from '../services/api.key.service';
+import { AuthConfig } from '../utilities/auth.config';
 export declare class ApiKeyMiddleware implements NestMiddleware {
     private readonly apiKeyService;
-    constructor(apiKeyService: ApiKeyService);
+    private readonly config;
+    constructor(apiKeyService: ApiKeyService, config: AuthConfig);
     use(request: Request, _response: Response, next: NextFunction): Promise<void>;
     private resolveContext;
-    private extractKey;
 }
 //# sourceMappingURL=api.key.middleware.d.ts.map

package/dist/auth/middlewares/api.key.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/api.key.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAiB5D,qBACa,gBAAiB,YAAW,cAAc;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAEnD,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;YAcF,cAAc;IAgB5B,OAAO,CAAC,UAAU;CAYnB"}
+{"version":3,"file":"api.key.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/api.key.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG5D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAWtD,qBACa,gBAAiB,YAAW,cAAc;IAEnD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,UAAU;IAG/B,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;YAWF,cAAc;CAsB7B"}

package/dist/auth/middlewares/api.key.middleware.js

@@ -11,12 +11,14 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiKeyMiddleware = void 0;
 const common_1 = require("@nestjs/common");
-const api_key_default_enum_1 = require("../enums/api.key.default.enum");
 const api_key_service_1 = require("../services/api.key.service");
 const api_key_context_1 = require("../helpers/api.key.context");
+const auth_config_1 = require("../utilities/auth.config");
+const request_credentials_1 = require("../utilities/request.credentials");
 let ApiKeyMiddleware = class ApiKeyMiddleware {
-    constructor(apiKeyService) {
+    constructor(apiKeyService, config) {
         this.apiKeyService = apiKeyService;
+        this.config = config;
     }
     async use(request, _response, next) {
         const context = await this.resolveContext(request);
@@ -27,33 +29,28 @@ let ApiKeyMiddleware = class ApiKeyMiddleware {
         next();
     }
     async resolveContext(request) {
-        const rawKey = this.extractKey(request);
+        const rawKey = request_credentials_1.RequestCredentials.apiKey(request, this.config.apiKeyHeaderName);
         if (!rawKey)
             return null;
-        const apiKey = await this.apiKeyService.validateApiKey(rawKey);
-        if (!apiKey)
+        try {
+            const apiKey = await this.apiKeyService.validateApiKey(rawKey);
+            if (!apiKey)
+                return null;
+            return {
+                apiKey,
+                tenant: apiKey.tenant ?? undefined,
+                scopes: await this.apiKeyService.effectiveScopes(apiKey),
+            };
+        }
+        catch {
             return null;
-        return {
-            apiKey,
-            tenant: apiKey.tenant ?? undefined,
-            scopes: await this.apiKeyService.grantedScopes(apiKey.id),
-        };
-    }
-    extractKey(request) {
-        const headerName = process.env.API_KEY_HEADER_NAME || api_key_default_enum_1.ApiKeyDefault.HEADER_NAME;
-        const headerKey = request.headers[headerName];
-        if (headerKey)
-            return Array.isArray(headerKey) ? headerKey[0] : headerKey;
-        const authorization = request.headers.authorization;
-        if (authorization?.toLowerCase().startsWith('apikey ')) {
-            return authorization.slice('apikey '.length).trim();
         }
-        return null;
     }
 };
 exports.ApiKeyMiddleware = ApiKeyMiddleware;
 exports.ApiKeyMiddleware = ApiKeyMiddleware = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [api_key_service_1.ApiKeyService])
+    __metadata("design:paramtypes", [api_key_service_1.ApiKeyService,
+        auth_config_1.AuthConfig])
 ], ApiKeyMiddleware);
 //# sourceMappingURL=api.key.middleware.js.map

package/dist/auth/middlewares/api.key.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/api.key.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAE5D,wEAA8D;AAC9D,iEAA4D;AAC5D,gEAA2D;AAiBpD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAA6B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;IAAG,CAAC;IAE7D,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAKnD,IAAI,OAAO,EAAE,CAAC;YACZ,+BAAa,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAGO,KAAK,CAAC,cAAc,CAC1B,OAAgB;QAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,OAAO;YACL,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;YAClC,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,OAAgB;QACjC,MAAM,UAAU,GACd,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,oCAAa,CAAC,WAAW,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,aAAa,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvD,OAAO,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAjDY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAEiC,+BAAa;GAD9C,gBAAgB,CAiD5B"}
+{"version":3,"file":"api.key.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/api.key.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAE5D,iEAA4D;AAC5D,gEAA2D;AAE3D,0DAAsD;AACtD,0EAAsE;AAW/D,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YACmB,aAA4B,EAC5B,MAAkB;QADlB,kBAAa,GAAb,aAAa,CAAe;QAC5B,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAGnD,IAAI,OAAO,EAAE,CAAC;YACZ,+BAAa,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,OAAgB;QAEhB,MAAM,MAAM,GAAG,wCAAkB,CAAC,MAAM,CACtC,OAAO,EACP,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC7B,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEzB,OAAO;gBACL,MAAM;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;gBAClC,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC;aACzD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AA3CY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAGuB,+BAAa;QACpB,wBAAU;GAH1B,gBAAgB,CA2C5B"}

package/dist/auth/middlewares/jwt.middleware.d.ts

@@ -1,11 +1,10 @@
 import { NestMiddleware } from '@nestjs/common';
-import { JwtService } from '@nestjs/jwt';
 import { NextFunction, Request, Response } from 'express';
+import { TokenService } from '../services/token.service';
 export declare class JwtMiddleware implements NestMiddleware {
-    private readonly jwtService;
-    constructor(jwtService: JwtService);
+    private readonly tokenService;
+    constructor(tokenService: TokenService);
     use(request: Request, _response: Response, next: NextFunction): Promise<void>;
     private resolveContext;
-    private extractToken;
 }
 //# sourceMappingURL=jwt.middleware.d.ts.map

package/dist/auth/middlewares/jwt.middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/jwt.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkB1D,qBACa,aAAc,YAAW,cAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IAE7C,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;YAcF,cAAc;IAiC5B,OAAO,CAAC,YAAY;CAOrB"}
+{"version":3,"file":"jwt.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middlewares/jwt.middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAI1D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAUzD,qBACa,aAAc,YAAW,cAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,YAAY;IAEjD,GAAG,CACP,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,QAAQ,EACnB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,IAAI,CAAC;YAYF,cAAc;CA8B7B"}

package/dist/auth/middlewares/jwt.middleware.js

@@ -11,12 +11,13 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JwtMiddleware = void 0;
 const common_1 = require("@nestjs/common");
-const jwt_1 = require("@nestjs/jwt");
-const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
+const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
 const auth_1 = require("../helpers/auth");
+const token_service_1 = require("../services/token.service");
+const request_credentials_1 = require("../utilities/request.credentials");
 let JwtMiddleware = class JwtMiddleware {
-    constructor(jwtService) {
-        this.jwtService = jwtService;
+    constructor(tokenService) {
+        this.tokenService = tokenService;
     }
     async use(request, _response, next) {
         const context = await this.resolveContext(request);
@@ -27,42 +28,29 @@ let JwtMiddleware = class JwtMiddleware {
         next();
     }
     async resolveContext(request) {
-        const token = this.extractToken(request);
+        const token = request_credentials_1.RequestCredentials.bearerToken(request);
         if (!token)
             return null;
         try {
-            const payload = await this.jwtService.verifyAsync(token, {
-                secret: process.env.ACCESS_TOKEN_SECRET,
-            });
-            if (!payload.sid)
+            const session = await this.tokenService.resolveSession('user', token);
+            if (!session)
                 return null;
-            const session = await system_auth_session_entity_1.SystemAuthSessionEntity.findOne({
-                where: { session_identifier: payload.sid, is_admin: false },
-            });
-            const active = !!session &&
-                !session.invalidated_at &&
-                session.expires_at.getTime() > Date.now();
-            if (!active)
+            if (session.tenantId &&
+                !(await tenant_entity_1.TenantEntity.existsBy({
+                    id: session.tenantId,
+                    is_active: true,
+                })))
                 return null;
-            return await auth_1.Auth.loadUserContext(payload.sub, payload.sid, session.tenant_id ?? undefined);
+            return await auth_1.Auth.loadUserContext(session.payload.sub, session.sessionIdentifier, session.tenantId ?? undefined);
         }
         catch {
             return null;
         }
     }
-    extractToken(request) {
-        const header = request.headers['authorization'];
-        if (!header)
-            return undefined;
-        const [scheme, value] = header.split(' ');
-        if (scheme?.toLowerCase() !== 'bearer' || !value)
-            return undefined;
-        return value.trim();
-    }
 };
 exports.JwtMiddleware = JwtMiddleware;
 exports.JwtMiddleware = JwtMiddleware = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [jwt_1.JwtService])
+    __metadata("design:paramtypes", [token_service_1.TokenService])
 ], JwtMiddleware);
 //# sourceMappingURL=jwt.middleware.js.map

package/dist/auth/middlewares/jwt.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/jwt.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAC5D,qCAAyC;AAEzC,uFAAiF;AAEjF,0CAAuC;AAgBhC,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAKnD,IAAI,OAAO,EAAE,CAAC;YACZ,WAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAGO,KAAK,CAAC,cAAc,CAC1B,OAAgB;QAEhB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAa,KAAK,EAAE;gBACnE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YAE9B,MAAM,OAAO,GAAG,MAAM,oDAAuB,CAAC,OAAO,CAAC;gBACpD,KAAK,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC5D,CAAC,CAAC;YACH,MAAM,MAAM,GACV,CAAC,CAAC,OAAO;gBACT,CAAC,OAAO,CAAC,cAAc;gBACvB,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAGzB,OAAO,MAAM,WAAI,CAAC,eAAe,CAC/B,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,SAAS,IAAI,SAAS,CAC/B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YAEP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,OAAgB;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAA;AA7DY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAE8B,gBAAU;GADxC,aAAa,CA6DzB"}
+{"version":3,"file":"jwt.middleware.js","sourceRoot":"","sources":["../../../src/auth/middlewares/jwt.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAE5D,uEAAmE;AAEnE,0CAAuC;AACvC,6DAAyD;AACzD,0EAAsE;AAU/D,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,YAA6B,YAA0B;QAA1B,iBAAY,GAAZ,YAAY,CAAc;IAAG,CAAC;IAE3D,KAAK,CAAC,GAAG,CACP,OAAgB,EAChB,SAAmB,EACnB,IAAkB;QAElB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAGnD,IAAI,OAAO,EAAE,CAAC;YACZ,WAAI,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC;IAGO,KAAK,CAAC,cAAc,CAC1B,OAAgB;QAEhB,MAAM,KAAK,GAAG,wCAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAG1B,IACE,OAAO,CAAC,QAAQ;gBAChB,CAAC,CAAC,MAAM,4BAAY,CAAC,QAAQ,CAAC;oBAC5B,EAAE,EAAE,OAAO,CAAC,QAAQ;oBACpB,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC;gBAEH,OAAO,IAAI,CAAC;YAGd,OAAO,MAAM,WAAI,CAAC,eAAe,CAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,EACnB,OAAO,CAAC,iBAAiB,EACzB,OAAO,CAAC,QAAQ,IAAI,SAAS,CAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAjDY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAEgC,4BAAY;GAD5C,aAAa,CAiDzB"}

package/dist/auth/processors/change.admin.password.data.processor.d.ts

@@ -0,0 +1,13 @@
+import { CommonDataProcessor } from '../../common/libraries/common.data.processor';
+import { ChangePasswordDto } from '../dtos/change.password.dto';
+export declare class ChangeAdminPasswordDataProcessor extends CommonDataProcessor {
+    private readonly adminUserId;
+    private readonly currentSession?;
+    protected payload: ChangePasswordDto;
+    private adminUser;
+    constructor(adminUserId: string, currentSession?: string);
+    process(payload: ChangePasswordDto): Promise<void>;
+    private validate;
+    private set;
+}
+//# sourceMappingURL=change.admin.password.data.processor.d.ts.map

package/dist/auth/processors/change.admin.password.data.processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change.admin.password.data.processor.d.ts","sourceRoot":"","sources":["../../../src/auth/processors/change.admin.password.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAShE,qBAAa,gCAAiC,SAAQ,mBAAmB;IAKrE,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IALlC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,OAAO,CAAC,SAAS,CAAgC;gBAG9B,WAAW,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM;IAKpC,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;YAM1C,QAAQ;YA2CR,GAAG;CAYlB"}

package/dist/auth/processors/change.admin.password.data.processor.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChangeAdminPasswordDataProcessor = void 0;
+const common_data_processor_1 = require("../../common/libraries/common.data.processor");
+const admin_user_entity_1 = require("../entities/admin.user.entity");
+const access_revocation_1 = require("../utilities/access.revocation");
+const auth_utilities_1 = require("../utilities/auth.utilities");
+class ChangeAdminPasswordDataProcessor extends common_data_processor_1.CommonDataProcessor {
+    constructor(adminUserId, currentSession) {
+        super();
+        this.adminUserId = adminUserId;
+        this.currentSession = currentSession;
+        this.adminUser = null;
+    }
+    async process(payload) {
+        this.payload = payload;
+        await this.validate();
+        return this.set();
+    }
+    async validate() {
+        const adminUser = await admin_user_entity_1.AdminUserEntity.getRepository()
+            .createQueryBuilder('admin_user')
+            .addSelect('admin_user.password')
+            .where('admin_user.id = :id', { id: this.adminUserId })
+            .getOne();
+        if (!adminUser || !adminUser.active) {
+            this.setColumnError('current_password', 'Admin user no longer exists');
+            this.raiseExceptionOnValidationFailure();
+            return;
+        }
+        if (!adminUser.password) {
+            this.setColumnError('current_password', 'This account has no password; ask a super admin to set one');
+            this.raiseExceptionOnValidationFailure();
+            return;
+        }
+        const matches = await auth_utilities_1.AuthUtility.comparePassword(this.payload.current_password, adminUser.password);
+        if (!matches)
+            this.setColumnError('current_password', 'Current password is incorrect');
+        if (this.payload.current_password === this.payload.new_password)
+            this.setColumnError('new_password', 'New password must differ from the current one');
+        const policyError = auth_utilities_1.AuthUtility.passwordPolicyError(this.payload.new_password);
+        if (policyError)
+            this.setColumnError('new_password', policyError);
+        this.adminUser = adminUser;
+        this.raiseExceptionOnValidationFailure();
+    }
+    async set() {
+        if (!this.adminUser)
+            return;
+        const adminUserId = this.adminUser.id;
+        const password = await auth_utilities_1.AuthUtility.hashPassword(this.payload.new_password);
+        await admin_user_entity_1.AdminUserEntity.getRepository().manager.transaction(async (trx) => {
+            await trx.update(admin_user_entity_1.AdminUserEntity, { id: adminUserId }, { password });
+            await access_revocation_1.AccessRevocation.revokeAll(trx, adminUserId, true, {
+                exceptSession: this.currentSession,
+            });
+        });
+    }
+}
+exports.ChangeAdminPasswordDataProcessor = ChangeAdminPasswordDataProcessor;
+//# sourceMappingURL=change.admin.password.data.processor.js.map

package/dist/auth/processors/change.admin.password.data.processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change.admin.password.data.processor.js","sourceRoot":"","sources":["../../../src/auth/processors/change.admin.password.data.processor.ts"],"names":[],"mappings":";;;AAAA,wFAAmF;AACnF,qEAAgE;AAEhE,sEAAkE;AAClE,gEAA0D;AAO1D,MAAa,gCAAiC,SAAQ,2CAAmB;IAIvE,YACmB,WAAmB,EACnB,cAAuB;QAExC,KAAK,EAAE,CAAC;QAHS,gBAAW,GAAX,WAAW,CAAQ;QACnB,mBAAc,GAAd,cAAc,CAAS;QAJlC,cAAS,GAA2B,IAAI,CAAC;IAOjD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA0B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,SAAS,GAAG,MAAM,mCAAe,CAAC,aAAa,EAAE;aACpD,kBAAkB,CAAC,YAAY,CAAC;aAChC,SAAS,CAAC,qBAAqB,CAAC;aAChC,KAAK,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;aACtD,MAAM,EAAE,CAAC;QAEZ,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;YACvE,IAAI,CAAC,iCAAiC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,cAAc,CACjB,kBAAkB,EAClB,4DAA4D,CAC7D,CAAC;YACF,IAAI,CAAC,iCAAiC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,eAAe,CAC/C,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAC7B,SAAS,CAAC,QAAQ,CACnB,CAAC;QACF,IAAI,CAAC,OAAO;YACV,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;QAE3E,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY;YAC7D,IAAI,CAAC,cAAc,CACjB,cAAc,EACd,+CAA+C,CAChD,CAAC;QAEJ,MAAM,WAAW,GAAG,4BAAW,CAAC,mBAAmB,CACjD,IAAI,CAAC,OAAO,CAAC,YAAY,CAC1B,CAAC;QACF,IAAI,WAAW;YAAE,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAElE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,4BAAW,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAE3E,MAAM,mCAAe,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACtE,MAAM,GAAG,CAAC,MAAM,CAAC,mCAAe,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrE,MAAM,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE;gBACvD,aAAa,EAAE,IAAI,CAAC,cAAc;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAxED,4EAwEC"}

package/dist/auth/processors/change.password.data.processor.d.ts

@@ -2,9 +2,10 @@ import { CommonDataProcessor } from '../../common/libraries/common.data.processo
 import { ChangePasswordDto } from '../dtos/change.password.dto';
 export declare class ChangePasswordDataProcessor extends CommonDataProcessor {
     private readonly userId;
+    private readonly currentSession?;
     protected payload: ChangePasswordDto;
     private user;
-    constructor(userId: string);
+    constructor(userId: string, currentSession?: string);
     process(payload: ChangePasswordDto): Promise<void>;
     private validate;
     private create;

package/dist/auth/processors/change.password.data.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change.password.data.processor.d.ts","sourceRoot":"","sources":["../../../src/auth/processors/change.password.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAQhE,qBAAa,2BAA4B,SAAQ,mBAAmB;IAItD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHnC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,OAAO,CAAC,IAAI,CAA2B;gBAEV,MAAM,EAAE,MAAM;IAIrC,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;YAM1C,QAAQ;YA+BR,MAAM;CAQrB"}
+{"version":3,"file":"change.password.data.processor.d.ts","sourceRoot":"","sources":["../../../src/auth/processors/change.password.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAUhE,qBAAa,2BAA4B,SAAQ,mBAAmB;IAKhE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IALlC,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACrC,OAAO,CAAC,IAAI,CAA2B;gBAGpB,MAAM,EAAE,MAAM,EACd,cAAc,CAAC,EAAE,MAAM;IAKpC,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;YAM1C,QAAQ;YA4CR,MAAM;CA0BrB"}

package/dist/auth/processors/change.password.data.processor.js

@@ -3,11 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ChangePasswordDataProcessor = void 0;
 const common_data_processor_1 = require("../../common/libraries/common.data.processor");
 const user_entity_1 = require("../entities/user.entity");
+const access_revocation_1 = require("../utilities/access.revocation");
 const auth_utilities_1 = require("../utilities/auth.utilities");
 class ChangePasswordDataProcessor extends common_data_processor_1.CommonDataProcessor {
-    constructor(userId) {
+    constructor(userId, currentSession) {
         super();
         this.userId = userId;
+        this.currentSession = currentSession;
         this.user = null;
     }
     async process(payload) {
@@ -26,6 +28,11 @@ class ChangePasswordDataProcessor extends common_data_processor_1.CommonDataProc
             this.raiseExceptionOnValidationFailure();
             return;
         }
+        if (!user.password) {
+            this.setColumnError('current_password', 'This account has no password; set one through a password reset');
+            this.raiseExceptionOnValidationFailure();
+            return;
+        }
         const matches = await auth_utilities_1.AuthUtility.comparePassword(this.payload.current_password, user.password);
         if (!matches) {
             this.setColumnError('current_password', 'Current password is incorrect');
@@ -33,15 +40,31 @@ class ChangePasswordDataProcessor extends common_data_processor_1.CommonDataProc
         if (this.payload.current_password === this.payload.new_password) {
             this.setColumnError('new_password', 'New password must differ from the current one');
         }
+        const policyError = auth_utilities_1.AuthUtility.passwordPolicyError(this.payload.new_password);
+        if (policyError)
+            this.setColumnError('new_password', policyError);
         this.user = user;
         this.raiseExceptionOnValidationFailure();
     }
     async create() {
         if (!this.user)
             return;
-        this.user.password = await auth_utilities_1.AuthUtility.hashPassword(this.payload.new_password);
-        this.user.password_change_required = false;
-        await this.user.save();
+        const user = this.user;
+        const replacesMailedOtp = user.password_change_required && !!user.one_time_password_expires_at;
+        const password = await auth_utilities_1.AuthUtility.hashPassword(this.payload.new_password);
+        await user_entity_1.UserEntity.getRepository().manager.transaction(async (trx) => {
+            await trx.update(user_entity_1.UserEntity, { id: user.id }, {
+                password,
+                password_change_required: false,
+                one_time_password_expires_at: null,
+                ...(replacesMailedOtp && !user.email_verified_at
+                    ? { email_verified_at: new Date() }
+                    : {}),
+            });
+            await access_revocation_1.AccessRevocation.revokeAll(trx, user.id, false, {
+                exceptSession: this.currentSession,
+            });
+        });
     }
 }
 exports.ChangePasswordDataProcessor = ChangePasswordDataProcessor;

package/dist/auth/processors/change.password.data.processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"change.password.data.processor.js","sourceRoot":"","sources":["../../../src/auth/processors/change.password.data.processor.ts"],"names":[],"mappings":";;;AAAA,wFAAmF;AACnF,yDAAqD;AAErD,gEAA0D;AAO1D,MAAa,2BAA4B,SAAQ,2CAAmB;IAIlE,YAA6B,MAAc;QACzC,KAAK,EAAE,CAAC;QADmB,WAAM,GAAN,MAAM,CAAQ;QAFnC,SAAI,GAAsB,IAAI,CAAC;IAIvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA0B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,aAAa,EAAE;aAC1C,kBAAkB,CAAC,MAAM,CAAC;aAC1B,SAAS,CAAC,eAAe,CAAC;aAC1B,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC3C,MAAM,EAAE,CAAC;QAEZ,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;YACjE,IAAI,CAAC,iCAAiC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,eAAe,CAC/C,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAC7B,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAChE,IAAI,CAAC,cAAc,CACjB,cAAc,EACd,+CAA+C,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,4BAAW,CAAC,YAAY,CACjD,IAAI,CAAC,OAAO,CAAC,YAAY,CAC1B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,wBAAwB,GAAG,KAAK,CAAC;QAC3C,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AArDD,kEAqDC"}
+{"version":3,"file":"change.password.data.processor.js","sourceRoot":"","sources":["../../../src/auth/processors/change.password.data.processor.ts"],"names":[],"mappings":";;;AAAA,wFAAmF;AACnF,yDAAqD;AAErD,sEAAkE;AAClE,gEAA0D;AAQ1D,MAAa,2BAA4B,SAAQ,2CAAmB;IAIlE,YACmB,MAAc,EACd,cAAuB;QAExC,KAAK,EAAE,CAAC;QAHS,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAS;QAJlC,SAAI,GAAsB,IAAI,CAAC;IAOvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA0B;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,aAAa,EAAE;aAC1C,kBAAkB,CAAC,MAAM,CAAC;aAC1B,SAAS,CAAC,eAAe,CAAC;aAC1B,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;aAC3C,MAAM,EAAE,CAAC;QAEZ,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;YACjE,IAAI,CAAC,iCAAiC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,cAAc,CACjB,kBAAkB,EAClB,gEAAgE,CACjE,CAAC;YACF,IAAI,CAAC,iCAAiC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,4BAAW,CAAC,eAAe,CAC/C,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAC7B,IAAI,CAAC,QAAQ,CACd,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAChE,IAAI,CAAC,cAAc,CACjB,cAAc,EACd,+CAA+C,CAChD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,4BAAW,CAAC,mBAAmB,CACjD,IAAI,CAAC,OAAO,CAAC,YAAY,CAC1B,CAAC;QACF,IAAI,WAAW;YAAE,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAElE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,MAAM,iBAAiB,GACrB,IAAI,CAAC,wBAAwB,IAAI,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,4BAAW,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAE3E,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,GAAG,CAAC,MAAM,CACd,wBAAU,EACV,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf;gBACE,QAAQ;gBACR,wBAAwB,EAAE,KAAK;gBAC/B,4BAA4B,EAAE,IAAI;gBAClC,GAAG,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,iBAAiB;oBAC9C,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,IAAI,EAAE,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;aACR,CACF,CAAC;YACF,MAAM,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE;gBACpD,aAAa,EAAE,IAAI,CAAC,cAAc;aACnC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAvFD,kEAuFC"}

package/dist/auth/processors/google.user.data.processor.d.ts

@@ -1,10 +1,11 @@
 import { CommonDataProcessor } from '../../common/libraries/common.data.processor';
 import { UserEntity } from '../entities/user.entity';
-import { GoogleTokenInfo } from '../types/google.auth.types';
+import { GoogleLinkCandidate, GoogleLinkDecision, GoogleTokenInfo } from '../types/google.auth.types';
 export declare class GoogleUserDataProcessor extends CommonDataProcessor {
     protected payload: GoogleTokenInfo;
     process(payload: GoogleTokenInfo): Promise<UserEntity>;
-    private reuse;
+    static decide(user: GoogleLinkCandidate, sub: string): GoogleLinkDecision;
+    private link;
     private create;
 }
 //# sourceMappingURL=google.user.data.processor.d.ts.map

package/dist/auth/processors/google.user.data.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/auth/processors/google.user.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAQ7D,qBAAa,uBAAwB,SAAQ,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;IAE7B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAU5D,OAAO,CAAC,KAAK;YAMC,MAAM;CAiBrB"}
+{"version":3,"file":"google.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/auth/processors/google.user.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAGrD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EAChB,MAAM,4BAA4B,CAAC;AAUpC,qBAAa,uBAAwB,SAAQ,mBAAmB;IAC9D,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;IAE7B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;IAkC5D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM,GAAG,kBAAkB;YAW3D,IAAI;YA4BJ,MAAM;CAiBrB"}