@neohm/nestend 4.1.1 → 5.0.1

package/dist/auth/strategy/jwt.strategy.js

@@ -13,28 +13,44 @@ exports.JwtStrategy = void 0;
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 const passport_jwt_1 = require("passport-jwt");
-const cache_service_1 = require("../../common/services/cache.service");
+const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
+const user_entity_1 = require("../entities/user.entity");
+const token_service_1 = require("../services/token.service");
+const auth_config_1 = require("../utilities/auth.config");
 let JwtStrategy = class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy, 'jwt') {
-    constructor(cacheService) {
+    constructor(tokenService, config) {
         super({
             jwtFromRequest: passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
             ignoreExpiration: false,
-            secretOrKey: process.env.ACCESS_TOKEN_SECRET,
+            secretOrKey: config.signingKey('access', 'user'),
+            algorithms: ['HS256'],
+            audience: 'user',
+            issuer: config.issuer,
         });
-        this.cacheService = cacheService;
+        this.tokenService = tokenService;
     }
     async validate(payload) {
-        if (payload.jti) {
-            const isRevoked = await this.cacheService.getRaw(`blocklist:${payload.jti}`);
-            if (isRevoked)
-                throw new common_1.UnauthorizedException('Token has been revoked');
-        }
-        return { userId: payload.sub, email: payload.email };
+        const session = await this.tokenService.checkSession('user', payload);
+        if (!session)
+            throw new common_1.UnauthorizedException('Session is no longer valid');
+        if (session.tenantId &&
+            !(await tenant_entity_1.TenantEntity.existsBy({ id: session.tenantId, is_active: true })))
+            throw new common_1.UnauthorizedException('Session is no longer valid');
+        const user = await user_entity_1.UserEntity.findOne({ where: { id: payload.sub } });
+        if (!user?.active)
+            throw new common_1.UnauthorizedException('Session is no longer valid');
+        return {
+            userId: user.id,
+            email: user.email,
+            sessionIdentifier: session.sessionIdentifier,
+            passwordChangeRequired: user.password_change_required,
+        };
     }
 };
 exports.JwtStrategy = JwtStrategy;
 exports.JwtStrategy = JwtStrategy = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [cache_service_1.CacheService])
+    __metadata("design:paramtypes", [token_service_1.TokenService,
+        auth_config_1.AuthConfig])
 ], JwtStrategy);
 //# sourceMappingURL=jwt.strategy.js.map

package/dist/auth/strategy/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/auth/strategy/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,+CAAoD;AACpD,+CAAoD;AACpD,uEAAmE;AAI5D,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,EAAE,KAAK,CAAC;IAChE,YAA6B,YAA0B;QACrD,KAAK,CAAC;YACJ,cAAc,EAAE,yBAAU,CAAC,2BAA2B,EAAE;YACxD,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB;SAC7C,CAAC,CAAC;QALwB,iBAAY,GAAZ,YAAY,CAAc;IAMvD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAmB;QAChC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAC9C,aAAa,OAAO,CAAC,GAAG,EAAE,CAC3B,CAAC;YACF,IAAI,SAAS;gBAAE,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAlBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAEgC,4BAAY;GAD5C,WAAW,CAkBvB"}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/auth/strategy/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,+CAAoD;AACpD,+CAAoD;AACpD,uEAAmE;AACnE,yDAAqD;AACrD,6DAAyD;AAEzD,0DAAsD;AAQ/C,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,EAAE,KAAK,CAAC;IAChE,YACmB,YAA0B,EAC3C,MAAkB;QAElB,KAAK,CAAC;YACJ,cAAc,EAAE,yBAAU,CAAC,2BAA2B,EAAE;YACxD,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;YAChD,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;QAVc,iBAAY,GAAZ,YAAY,CAAc;IAW7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAmB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAC5E,IACE,OAAO,CAAC,QAAQ;YAChB,CAAC,CAAC,MAAM,4BAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEzE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAEhE,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,EAAE,MAAM;YACf,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;QAEhE,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,sBAAsB,EAAE,IAAI,CAAC,wBAAwB;SACtD,CAAC;IACJ,CAAC;CACF,CAAA;AAnCY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAGsB,4BAAY;QACnC,wBAAU;GAHT,WAAW,CAmCvB"}

package/dist/auth/types/api.key.types.d.ts

@@ -19,8 +19,12 @@ export interface ApiKeyContextValue {
 export interface ApiKeyAccess {
     tenant: TenantEntity;
 }
-export type ApiKeyDetail = ApiKeyEntity & {
+export type ApiKeyDetail = Omit<ApiKeyEntity, 'key_hash'> & {
     scopes: ScopeEntity[];
     key?: string;
 };
+export interface KeyScopeGrant {
+    id: string;
+    scope_id: string;
+}
 //# sourceMappingURL=api.key.types.d.ts.map

package/dist/auth/types/api.key.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/api.key.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAE9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;CACtB;AAGD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAC;IAErB,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAGD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;CACtB;AAOD,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG;IACxC,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC"}
+{"version":3,"file":"api.key.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/api.key.types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IAEpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,IAAI,CAAC;IAEjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAE9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;CACtB;AAGD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,YAAY,CAAC;IAErB,MAAM,CAAC,EAAE,YAAY,CAAC;IAEtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAGD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;CACtB;AAOD,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG;IAC1D,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAGF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/auth/types/auth.types.d.ts

@@ -6,7 +6,11 @@ import type { TenantEntity } from '../../tenant/entities/tenant.entity';
 export interface RequestUser {
     userId: string;
     email: string;
+    sessionIdentifier?: string;
+    passwordChangeRequired?: boolean;
 }
+export type TokenType = 'access' | 'refresh';
+export type TokenAudience = 'user' | 'admin';
 export interface AuthenticatedAccess {
     user: UserEntity;
     roles: SystemRoleEntity[];
@@ -18,20 +22,56 @@ export interface AdminAuthenticatedAccess {
 }
 export interface JwtPayload {
     sub: string;
-    email: string;
-    jti?: string;
-    sid?: string;
-    tid?: string;
+    sid: string;
+    jti: string;
+    typ: TokenType;
+    aud?: TokenAudience;
+    iss?: string;
     iat?: number;
     exp?: number;
+    email?: string;
 }
 export interface JwtRefreshPayload {
     sub: string;
-    email: string;
-    jti?: string;
+    jti: string;
+    typ: TokenType;
+    aud?: TokenAudience;
+    iss?: string;
     iat?: number;
     exp?: number;
+    email?: string;
+}
+export interface ResolvedSession {
+    payload: JwtPayload;
+    sessionIdentifier: string;
+    tenantId: string | null;
+}
+export interface IssueSessionOptions {
+    context?: TokenIssueContext;
+    withRefreshToken?: boolean;
+    accessTtlSeconds?: number;
+}
+export interface IssuedSession {
+    access_token: string;
+    refresh_token?: string;
+    session_identifier: string;
+    expires_at: Date;
+}
+export interface RotatedRefreshToken {
+    user_id: string;
+    tenant_id: string | null;
+    session_identifier: string | null;
 }
+export interface ThrottleConfig {
+    enabled: boolean;
+    failOpen: boolean;
+    ipLimit: number;
+    refreshIpLimit: number;
+    ipWindowSeconds: number;
+    accountLimit: number;
+    accountWindowSeconds: number;
+}
+export type ThrottleAction = 'login' | 'admin.login' | 'impersonation.login' | 'register' | 'refresh' | 'google' | 'email.verification';
 export interface AuthTokenPair {
     access_token: string;
     refresh_token: string;
@@ -49,6 +89,12 @@ export interface OrganizationSession extends AuthTokenPair {
     tenant_id: string;
     tenant_name: string;
 }
+export interface ImpersonationSession {
+    access_token: string;
+    expires_at: Date;
+    tenant_id: string;
+    tenant_name: string;
+}
 export type OrganizationSummary = Pick<TenantEntity, 'id' | 'name' | 'slug' | 'logo_url'>;
 export interface PendingInvitation {
     id: string;
@@ -82,4 +128,17 @@ export interface AdminAuthContextValue {
     adminUser: Record<string, any>;
     sessionIdentifier?: string;
 }
+export interface EmailVerificationJobData {
+    user_id: string;
+    user_email: string;
+    full_name: string;
+    token_encrypted: string;
+    expires_at: string;
+}
+export type RefreshRejection = 'unknown' | 'expired' | 'revoked' | 'reused';
+export interface ThrottleSubject {
+    ip?: string;
+    account?: string;
+}
+export type AuthEnv = Record<string, string | undefined>;
 //# sourceMappingURL=auth.types.d.ts.map

package/dist/auth/types/auth.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAExE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,YAAY,EACZ,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CACpC,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAE1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAGxE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,CAAC;AAG7C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAGD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAGD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAE5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAGD,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,MAAM,cAAc,GACtB,OAAO,GACP,aAAa,GACb,qBAAqB,GACrB,UAAU,GACV,SAAS,GACT,QAAQ,GACR,oBAAoB,CAAC;AAEzB,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,IAAI,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,YAAY,EACZ,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CACpC,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAE1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAElB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAG5E,MAAM,WAAW,eAAe;IAE9B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC"}

package/dist/auth/types/google.auth.types.d.ts

@@ -1,3 +1,4 @@
+import type { UserEntity } from '../entities/user.entity';
 export interface GoogleTokenInfo {
     iss: string;
     aud: string;
@@ -9,5 +10,8 @@ export interface GoogleTokenInfo {
     given_name?: string;
     family_name?: string;
     picture?: string;
+    hd?: string;
 }
+export type GoogleLinkDecision = 'sign-in' | 'link' | 'takeover' | 'refuse-inactive' | 'refuse-mismatch' | 'refuse-system';
+export type GoogleLinkCandidate = Pick<UserEntity, 'active' | 'email_verified_at' | 'attributes' | 'user_type'>;
 //# sourceMappingURL=google.auth.types.d.ts.map

package/dist/auth/types/google.auth.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/google.auth.types.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"google.auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/google.auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAK1D,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAGD,MAAM,MAAM,kBAAkB,GAE1B,SAAS,GAET,MAAM,GAEN,UAAU,GACV,iBAAiB,GAEjB,iBAAiB,GAEjB,eAAe,CAAC;AAGpB,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACV,QAAQ,GAAG,mBAAmB,GAAG,YAAY,GAAG,WAAW,CAC5D,CAAC"}

package/dist/auth/utilities/access.revocation.d.ts

@@ -1,6 +1,8 @@
 import { EntityManager } from 'typeorm';
 export declare class AccessRevocation {
-    static revokeAll(manager: EntityManager, userId: string, isAdmin: boolean): Promise<void>;
+    static revokeAll(manager: EntityManager, userId: string, isAdmin: boolean, options?: {
+        exceptSession?: string;
+    }): Promise<void>;
     static revokeOrganization(manager: EntityManager, tenantId: string): Promise<void>;
     static revokeTenant(manager: EntityManager, userId: string, tenantId: string): Promise<void>;
 }

package/dist/auth/utilities/access.revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.revocation.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,SAAS,CAAC;AAgBhD,qBAAa,gBAAgB;WACd,SAAS,CACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC;WAiBH,kBAAkB,CAC7B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAkBH,YAAY,CACvB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;CAgBjB"}
+{"version":3,"file":"access.revocation.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAe,MAAM,SAAS,CAAC;AASrD,qBAAa,gBAAgB;WAMd,SAAS,CACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACvC,OAAO,CAAC,IAAI,CAAC;WAmCH,kBAAkB,CAC7B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAkBH,YAAY,CACvB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;CAgBjB"}

package/dist/auth/utilities/access.revocation.js

@@ -5,10 +5,26 @@ const typeorm_1 = require("typeorm");
 const system_auth_session_entity_1 = require("../entities/system.auth.session.entity");
 const system_refresh_token_entity_1 = require("../entities/system.refresh.token.entity");
 class AccessRevocation {
-    static async revokeAll(manager, userId, isAdmin) {
+    static async revokeAll(manager, userId, isAdmin, options = {}) {
         const now = new Date();
-        await manager.update(system_auth_session_entity_1.SystemAuthSessionEntity, { user_id: userId, is_admin: isAdmin, invalidated_at: (0, typeorm_1.IsNull)() }, { invalidated_at: now });
-        await manager.update(system_refresh_token_entity_1.SystemRefreshTokenEntity, { user_id: userId, is_admin: isAdmin, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: now });
+        const keep = options.exceptSession;
+        await manager.update(system_auth_session_entity_1.SystemAuthSessionEntity, {
+            user_id: userId,
+            is_admin: isAdmin,
+            invalidated_at: (0, typeorm_1.IsNull)(),
+            ...(keep ? { session_identifier: (0, typeorm_1.Not)(keep) } : {}),
+        }, { invalidated_at: now });
+        const tokens = manager
+            .createQueryBuilder()
+            .update(system_refresh_token_entity_1.SystemRefreshTokenEntity)
+            .set({ revoked_at: now })
+            .where('user_id = :userId AND is_admin = :isAdmin AND revoked_at IS NULL', {
+            userId,
+            isAdmin,
+        });
+        if (keep)
+            tokens.andWhere('(session_identifier IS NULL OR session_identifier <> :keep)', { keep });
+        await tokens.execute();
     }
     static async revokeOrganization(manager, tenantId) {
         const now = new Date();

package/dist/auth/utilities/access.revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.revocation.js","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAChD,uFAAiF;AACjF,yFAAmF;AAcnF,MAAa,gBAAgB;IAC3B,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,OAAsB,EACtB,MAAc,EACd,OAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EAChE,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC5D,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAC7B,OAAsB,EACtB,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAEvD,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtC,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAExE,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtC,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;CACF;AA/DD,4CA+DC"}
+{"version":3,"file":"access.revocation.js","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":";;;AAAA,qCAAqD;AACrD,uFAAiF;AACjF,yFAAmF;AAOnF,MAAa,gBAAgB;IAM3B,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,OAAsB,EACtB,MAAc,EACd,OAAgB,EAChB,UAAsC,EAAE;QAExC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;QAEnC,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB;YACE,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,OAAO;YACjB,cAAc,EAAE,IAAA,gBAAM,GAAE;YACxB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,EACD,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,MAAM,GAAG,OAAO;aACnB,kBAAkB,EAAE;aACpB,MAAM,CAAC,sDAAwB,CAAC;aAChC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;aACxB,KAAK,CACJ,kEAAkE,EAClE;YACE,MAAM;YACN,OAAO;SACR,CACF,CAAC;QACJ,IAAI,IAAI;YACN,MAAM,CAAC,QAAQ,CACb,6DAA6D,EAC7D,EAAE,IAAI,EAAE,CACT,CAAC;QACJ,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAC7B,OAAsB,EACtB,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAEvD,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtC,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAExE,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtC,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;CACF;AAvFD,4CAuFC"}

package/dist/auth/utilities/auth.config.d.ts

@@ -0,0 +1,23 @@
+import type { AuthEnv, TokenAudience, TokenType, ThrottleConfig } from '../types/auth.types';
+export declare class AuthConfig {
+    private static instance;
+    readonly issuer: string;
+    readonly accessTokenTtlSeconds: number;
+    readonly refreshTokenTtlSeconds: number;
+    readonly impersonationTokenTtlSeconds: number;
+    readonly bcryptRounds: number;
+    readonly oneTimePasswordTtlHours: number;
+    readonly emailVerificationTtlSeconds: number;
+    readonly emailVerificationUrl: string | null;
+    readonly apiKeyHeaderName: string;
+    readonly apiKeyRevealEnabled: boolean;
+    readonly recordRetentionDays: number;
+    readonly throttle: ThrottleConfig;
+    private readonly keys;
+    private constructor();
+    static fromEnv(env?: AuthEnv): AuthConfig;
+    static current(): AuthConfig;
+    signingKey(type: TokenType, audience: TokenAudience): Buffer;
+    oneTimePasswordExpiry(from?: Date): Date;
+}
+//# sourceMappingURL=auth.config.d.ts.map

package/dist/auth/utilities/auth.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.config.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/auth.config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,OAAO,EACP,aAAa,EACb,SAAS,EACT,cAAc,EACf,MAAM,qBAAqB,CAAC;AAO7B,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAA2B;IAElD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAA4B;IACnD,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,4BAA4B,EAAE,MAAM,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAElC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAElD,OAAO;IAuJP,MAAM,CAAC,OAAO,CAAC,GAAG,GAAE,OAAqB,GAAG,UAAU;IAKtD,MAAM,CAAC,OAAO,IAAI,UAAU;IAK5B,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM;IAK5D,qBAAqB,CAAC,IAAI,OAAa,GAAG,IAAI;CAG/C"}

package/dist/auth/utilities/auth.config.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthConfig = void 0;
+const crypto_1 = require("crypto");
+const auth_default_enum_1 = require("../enums/auth.default.enum");
+const api_key_default_enum_1 = require("../enums/api.key.default.enum");
+const duration_1 = require("./duration");
+class AuthConfig {
+    constructor(env) {
+        this.issuer = auth_default_enum_1.AuthDefault.TOKEN_ISSUER;
+        this.keys = new Map();
+        const errors = [];
+        const attempt = (read, fallback) => {
+            try {
+                return read();
+            }
+            catch (error) {
+                errors.push(error.message);
+                return fallback;
+            }
+        };
+        const access = attempt(() => secret(env, 'ACCESS_TOKEN_SECRET'), '');
+        const refresh = attempt(() => secret(env, 'REFRESH_TOKEN_SECRET'), '');
+        if (access && access === refresh)
+            errors.push('ACCESS_TOKEN_SECRET and REFRESH_TOKEN_SECRET must differ');
+        const seconds = (name, fallback) => attempt(() => durationSeconds(env, name, fallback), 1);
+        this.accessTokenTtlSeconds = seconds('ACCESS_TOKEN_EXPIRY', auth_default_enum_1.AuthDefault.ACCESS_TOKEN_EXPIRY);
+        this.refreshTokenTtlSeconds = seconds('REFRESH_TOKEN_EXPIRY', auth_default_enum_1.AuthDefault.REFRESH_TOKEN_EXPIRY);
+        this.impersonationTokenTtlSeconds = seconds('IMPERSONATION_TOKEN_EXPIRY', auth_default_enum_1.AuthDefault.IMPERSONATION_TOKEN_EXPIRY);
+        this.emailVerificationTtlSeconds = seconds('EMAIL_VERIFICATION_TOKEN_EXPIRY', auth_default_enum_1.AuthDefault.EMAIL_VERIFICATION_TOKEN_EXPIRY);
+        if (this.refreshTokenTtlSeconds < this.accessTokenTtlSeconds)
+            errors.push('REFRESH_TOKEN_EXPIRY must not be shorter than ACCESS_TOKEN_EXPIRY');
+        this.bcryptRounds = attempt(() => integer(env, 'BCRYPT_SALT_ROUNDS', auth_default_enum_1.AuthDefault.BCRYPT_SALT_ROUNDS, {
+            min: Number(auth_default_enum_1.AuthDefault.BCRYPT_MIN_ROUNDS),
+            max: Number(auth_default_enum_1.AuthDefault.BCRYPT_MAX_ROUNDS),
+        }), auth_default_enum_1.AuthDefault.BCRYPT_SALT_ROUNDS);
+        this.oneTimePasswordTtlHours = attempt(() => integer(env, 'ONE_TIME_PASSWORD_TTL_HOURS', auth_default_enum_1.AuthDefault.ONE_TIME_PASSWORD_TTL_HOURS, { min: 1 }), auth_default_enum_1.AuthDefault.ONE_TIME_PASSWORD_TTL_HOURS);
+        this.emailVerificationUrl = env.EMAIL_VERIFICATION_URL?.trim() || null;
+        this.apiKeyHeaderName = (env.API_KEY_HEADER_NAME?.trim() || api_key_default_enum_1.ApiKeyDefault.HEADER_NAME).toLowerCase();
+        this.apiKeyRevealEnabled = attempt(() => boolean(env, 'API_KEY_REVEAL_ENABLED', false), false);
+        this.recordRetentionDays = attempt(() => integer(env, 'AUTH_RECORD_RETENTION_DAYS', auth_default_enum_1.AuthDefault.RECORD_RETENTION_DAYS, { min: 0 }), auth_default_enum_1.AuthDefault.RECORD_RETENTION_DAYS);
+        this.throttle = {
+            enabled: attempt(() => boolean(env, 'AUTH_THROTTLE_ENABLED', true), true),
+            failOpen: attempt(() => boolean(env, 'AUTH_THROTTLE_FAIL_OPEN', true), true),
+            ipLimit: attempt(() => integer(env, 'AUTH_THROTTLE_IP_LIMIT', auth_default_enum_1.AuthDefault.THROTTLE_IP_LIMIT, {
+                min: 1,
+            }), 1),
+            refreshIpLimit: attempt(() => integer(env, 'AUTH_THROTTLE_REFRESH_IP_LIMIT', auth_default_enum_1.AuthDefault.THROTTLE_REFRESH_IP_LIMIT, { min: 1 }), 1),
+            ipWindowSeconds: seconds('AUTH_THROTTLE_IP_WINDOW', auth_default_enum_1.AuthDefault.THROTTLE_WINDOW),
+            accountLimit: attempt(() => integer(env, 'AUTH_THROTTLE_ACCOUNT_LIMIT', auth_default_enum_1.AuthDefault.THROTTLE_ACCOUNT_LIMIT, { min: 1 }), 1),
+            accountWindowSeconds: seconds('AUTH_THROTTLE_ACCOUNT_WINDOW', auth_default_enum_1.AuthDefault.THROTTLE_WINDOW),
+        };
+        if (errors.length)
+            throw new Error(`Invalid auth configuration:\n- ${errors.join('\n- ')}`);
+        for (const [type, master] of [
+            ['access', access],
+            ['refresh', refresh],
+        ])
+            for (const audience of ['user', 'admin'])
+                this.keys.set(`${type}:${audience}`, Buffer.from((0, crypto_1.hkdfSync)('sha256', master, this.issuer, `${this.issuer}:${type}:${audience}`, 32)));
+    }
+    static fromEnv(env = process.env) {
+        return new AuthConfig(env);
+    }
+    static current() {
+        return (AuthConfig.instance ??= AuthConfig.fromEnv());
+    }
+    signingKey(type, audience) {
+        return this.keys.get(`${type}:${audience}`);
+    }
+    oneTimePasswordExpiry(from = new Date()) {
+        return new Date(from.getTime() + this.oneTimePasswordTtlHours * 3_600_000);
+    }
+}
+exports.AuthConfig = AuthConfig;
+AuthConfig.instance = null;
+function secret(env, name) {
+    const value = env[name];
+    if (!value)
+        throw new Error(`${name} is not set`);
+    if (value.length < auth_default_enum_1.AuthDefault.SECRET_MIN_LENGTH)
+        throw new Error(`${name} must be at least ${auth_default_enum_1.AuthDefault.SECRET_MIN_LENGTH} characters`);
+    if (auth_default_enum_1.AuthPattern.SECRET_PLACEHOLDER.test(value))
+        throw new Error(`${name} still holds a placeholder value`);
+    if (new Set(value).size < auth_default_enum_1.AuthDefault.SECRET_MIN_DISTINCT_CHARS)
+        throw new Error(`${name} is not random enough`);
+    return value;
+}
+function durationSeconds(env, name, fallback) {
+    const raw = env[name]?.trim() || fallback;
+    try {
+        return duration_1.Duration.toSeconds(raw);
+    }
+    catch (error) {
+        throw new Error(`${name}: ${error.message}`);
+    }
+}
+function integer(env, name, fallback, bounds = {}) {
+    const raw = env[name]?.trim();
+    if (!raw)
+        return fallback;
+    if (!/^\d+$/.test(raw))
+        throw new Error(`${name} must be an integer`);
+    const value = Number(raw);
+    if (bounds.min !== undefined && value < bounds.min)
+        throw new Error(`${name} must be at least ${bounds.min}`);
+    if (bounds.max !== undefined && value > bounds.max)
+        throw new Error(`${name} must be at most ${bounds.max}`);
+    return value;
+}
+function boolean(env, name, fallback) {
+    const raw = env[name]?.trim().toLowerCase();
+    if (!raw)
+        return fallback;
+    if (raw === 'true' || raw === '1')
+        return true;
+    if (raw === 'false' || raw === '0')
+        return false;
+    throw new Error(`${name} must be true or false`);
+}
+//# sourceMappingURL=auth.config.js.map

package/dist/auth/utilities/auth.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.config.js","sourceRoot":"","sources":["../../../src/auth/utilities/auth.config.ts"],"names":[],"mappings":";;;AAAA,mCAAkC;AAClC,kEAAsE;AACtE,wEAA8D;AAO9D,yCAAsC;AAMtC,MAAa,UAAU;IAkBrB,YAAoB,GAAY;QAfvB,WAAM,GAAW,+BAAW,CAAC,YAAY,CAAC;QAalC,SAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGhD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,CAAI,IAAa,EAAE,QAAW,EAAK,EAAE;YACnD,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC;gBACtC,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,MAAM,IAAI,MAAM,KAAK,OAAO;YAC9B,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAE1E,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,QAAgB,EAAE,EAAE,CACjD,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAEzD,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAClC,qBAAqB,EACrB,+BAAW,CAAC,mBAAmB,CAChC,CAAC;QACF,IAAI,CAAC,sBAAsB,GAAG,OAAO,CACnC,sBAAsB,EACtB,+BAAW,CAAC,oBAAoB,CACjC,CAAC;QACF,IAAI,CAAC,4BAA4B,GAAG,OAAO,CACzC,4BAA4B,EAC5B,+BAAW,CAAC,0BAA0B,CACvC,CAAC;QACF,IAAI,CAAC,2BAA2B,GAAG,OAAO,CACxC,iCAAiC,EACjC,+BAAW,CAAC,+BAA+B,CAC5C,CAAC;QACF,IAAI,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,qBAAqB;YAC1D,MAAM,CAAC,IAAI,CACT,mEAAmE,CACpE,CAAC;QAEJ,IAAI,CAAC,YAAY,GAAG,OAAO,CACzB,GAAG,EAAE,CACH,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,+BAAW,CAAC,kBAAkB,EAAE;YACjE,GAAG,EAAE,MAAM,CAAC,+BAAW,CAAC,iBAAiB,CAAC;YAC1C,GAAG,EAAE,MAAM,CAAC,+BAAW,CAAC,iBAAiB,CAAC;SAC3C,CAAC,EACJ,+BAAW,CAAC,kBAAkB,CAC/B,CAAC;QACF,IAAI,CAAC,uBAAuB,GAAG,OAAO,CACpC,GAAG,EAAE,CACH,OAAO,CACL,GAAG,EACH,6BAA6B,EAC7B,+BAAW,CAAC,2BAA2B,EACvC,EAAE,GAAG,EAAE,CAAC,EAAE,CACX,EACH,+BAAW,CAAC,2BAA2B,CACxC,CAAC;QACF,IAAI,CAAC,oBAAoB,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAEvE,IAAI,CAAC,gBAAgB,GAAG,CACtB,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,oCAAa,CAAC,WAAW,CAC7D,CAAC,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAChC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,wBAAwB,EAAE,KAAK,CAAC,EACnD,KAAK,CACN,CAAC;QAEF,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAChC,GAAG,EAAE,CACH,OAAO,CACL,GAAG,EACH,4BAA4B,EAC5B,+BAAW,CAAC,qBAAqB,EACjC,EAAE,GAAG,EAAE,CAAC,EAAE,CACX,EACH,+BAAW,CAAC,qBAAqB,CAClC,CAAC;QAEF,IAAI,CAAC,QAAQ,GAAG;YACd,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;YACzE,QAAQ,EAAE,OAAO,CACf,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,yBAAyB,EAAE,IAAI,CAAC,EACnD,IAAI,CACL;YACD,OAAO,EAAE,OAAO,CACd,GAAG,EAAE,CACH,OAAO,CACL,GAAG,EACH,wBAAwB,EACxB,+BAAW,CAAC,iBAAiB,EAC7B;gBACE,GAAG,EAAE,CAAC;aACP,CACF,EACH,CAAC,CACF;YACD,cAAc,EAAE,OAAO,CACrB,GAAG,EAAE,CACH,OAAO,CACL,GAAG,EACH,gCAAgC,EAChC,+BAAW,CAAC,yBAAyB,EACrC,EAAE,GAAG,EAAE,CAAC,EAAE,CACX,EACH,CAAC,CACF;YACD,eAAe,EAAE,OAAO,CACtB,yBAAyB,EACzB,+BAAW,CAAC,eAAe,CAC5B;YACD,YAAY,EAAE,OAAO,CACnB,GAAG,EAAE,CACH,OAAO,CACL,GAAG,EACH,6BAA6B,EAC7B,+BAAW,CAAC,sBAAsB,EAClC,EAAE,GAAG,EAAE,CAAC,EAAE,CACX,EACH,CAAC,CACF;YACD,oBAAoB,EAAE,OAAO,CAC3B,8BAA8B,EAC9B,+BAAW,CAAC,eAAe,CAC5B;SACF,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM;YACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAG3E,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI;YAC3B,CAAC,QAAQ,EAAE,MAAM,CAAC;YAClB,CAAC,SAAS,EAAE,OAAO,CAAC;SACZ;YACR,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,CAAU;gBAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CACX,GAAG,IAAI,IAAI,QAAQ,EAAE,EACrB,MAAM,CAAC,IAAI,CACT,IAAA,iBAAQ,EACN,QAAQ,EACR,MAAM,EACN,IAAI,CAAC,MAAM,EACX,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,QAAQ,EAAE,EACpC,EAAE,CACH,CACF,CACF,CAAC;IACR,CAAC;IAGD,MAAM,CAAC,OAAO,CAAC,MAAe,OAAO,CAAC,GAAG;QACvC,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAGD,MAAM,CAAC,OAAO;QACZ,OAAO,CAAC,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IAGD,UAAU,CAAC,IAAe,EAAE,QAAuB;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAE,CAAC;IAC/C,CAAC;IAGD,qBAAqB,CAAC,IAAI,GAAG,IAAI,IAAI,EAAE;QACrC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC;IAC7E,CAAC;;AA1LH,gCA2LC;AA1LgB,mBAAQ,GAAsB,IAAI,AAA1B,CAA2B;AA4LpD,SAAS,MAAM,CAAC,GAAY,EAAE,IAAY;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,GAAG,+BAAW,CAAC,iBAAiB;QAC9C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,qBAAqB,+BAAW,CAAC,iBAAiB,aAAa,CACvE,CAAC;IACJ,IAAI,+BAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;IAC7D,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,+BAAW,CAAC,yBAAyB;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,GAAY,EAAE,IAAY,EAAE,QAAgB;IACnE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,mBAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACd,GAAY,EACZ,IAAY,EACZ,QAAgB,EAChB,SAAyC,EAAE;IAE3C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qBAAqB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,GAAY,EAAE,IAAY,EAAE,QAAiB;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;AACnD,CAAC"}

package/dist/auth/utilities/auth.utilities.d.ts

@@ -2,8 +2,12 @@ export declare class AuthUtility {
     private static dummyHash;
     static hashPassword(plain: string): Promise<string>;
     static comparePassword(plain: string, hashed: string): Promise<boolean>;
+    static needsRehash(hashed: string): boolean;
     static compareAgainstDummy(plain: string): Promise<false>;
+    static passwordPolicyError(plain: unknown): string | null;
+    static normalizeEmail(email: string): string;
     static generateOneTimePassword(): string;
+    static oneTimePasswordExpiry(): Date;
     static parseExpiryMs(expiry: string): number;
 }
 //# sourceMappingURL=auth.utilities.d.ts.map

package/dist/auth/utilities/auth.utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.utilities.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":"AAIA,qBAAa,WAAW;IAMtB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAgC;IAGxD,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAW1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAO/D,MAAM,CAAC,uBAAuB,IAAI,MAAM;IAQxC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAqB7C"}
+{"version":3,"file":"auth.utilities.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":"AAMA,qBAAa,WAAW;IAEtB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAgC;IAGxD,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKvE,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;WAS9B,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAU/D,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAYzD,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAK5C,MAAM,CAAC,uBAAuB,IAAI,MAAM;IASxC,MAAM,CAAC,qBAAqB,IAAI,IAAI;IAKpC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAG7C"}

package/dist/auth/utilities/auth.utilities.js

@@ -4,39 +4,49 @@ exports.AuthUtility = void 0;
 const bcrypt_1 = require("bcrypt");
 const crypto_1 = require("crypto");
 const auth_default_enum_1 = require("../enums/auth.default.enum");
+const auth_config_1 = require("./auth.config");
+const duration_1 = require("./duration");
 class AuthUtility {
     static hashPassword(plain) {
-        return (0, bcrypt_1.hash)(plain, auth_default_enum_1.AuthDefault.BCRYPT_SALT_ROUNDS);
+        return (0, bcrypt_1.hash)(plain, auth_config_1.AuthConfig.current().bcryptRounds);
     }
     static comparePassword(plain, hashed) {
         return (0, bcrypt_1.compare)(plain, hashed);
     }
+    static needsRehash(hashed) {
+        try {
+            return (0, bcrypt_1.getRounds)(hashed) < auth_config_1.AuthConfig.current().bcryptRounds;
+        }
+        catch {
+            return false;
+        }
+    }
     static async compareAgainstDummy(plain) {
         AuthUtility.dummyHash ??= AuthUtility.hashPassword((0, crypto_1.randomUUID)());
         await (0, bcrypt_1.compare)(plain, await AuthUtility.dummyHash);
         return false;
     }
+    static passwordPolicyError(plain) {
+        if (typeof plain !== 'string')
+            return 'Password must be a string';
+        if (plain.length < Number(auth_default_enum_1.AuthDefault.PASSWORD_MIN_LENGTH))
+            return `Password must be at least ${auth_default_enum_1.AuthDefault.PASSWORD_MIN_LENGTH} characters`;
+        if (Buffer.byteLength(plain, 'utf8') > Number(auth_default_enum_1.AuthDefault.PASSWORD_MAX_BYTES))
+            return `Password must not exceed ${auth_default_enum_1.AuthDefault.PASSWORD_MAX_BYTES} bytes`;
+        return null;
+    }
+    static normalizeEmail(email) {
+        return email.trim().toLowerCase();
+    }
     static generateOneTimePassword() {
         const alphabet = String(auth_default_enum_1.AuthDefault.ONE_TIME_PASSWORD_ALPHABET);
         return Array.from({ length: Number(auth_default_enum_1.AuthDefault.ONE_TIME_PASSWORD_LENGTH) }, () => alphabet[(0, crypto_1.randomInt)(alphabet.length)]).join('');
     }
+    static oneTimePasswordExpiry() {
+        return auth_config_1.AuthConfig.current().oneTimePasswordExpiry();
+    }
     static parseExpiryMs(expiry) {
-        const unit = expiry.slice(-1);
-        const value = parseInt(expiry.slice(0, -1), 10);
-        if (isNaN(value))
-            throw new Error(`Invalid token expiry format: "${expiry}"`);
-        switch (unit) {
-            case 's':
-                return value * 1000;
-            case 'm':
-                return value * 60 * 1000;
-            case 'h':
-                return value * 60 * 60 * 1000;
-            case 'd':
-                return value * 24 * 60 * 60 * 1000;
-            default:
-                throw new Error(`Unknown expiry unit "${unit}" in "${expiry}". Use s, m, h, or d.`);
-        }
+        return duration_1.Duration.toMs(expiry);
     }
 }
 exports.AuthUtility = AuthUtility;

package/dist/auth/utilities/auth.utilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.utilities.js","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":";;;AAAA,mCAAuC;AACvC,mCAA+C;AAC/C,kEAAyD;AAEzD,MAAa,WAAW;IAStB,MAAM,CAAC,YAAY,CAAC,KAAa;QAC/B,OAAO,IAAA,aAAI,EAAC,KAAK,EAAE,+BAAW,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC;IAGD,MAAM,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IASD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,WAAW,CAAC,SAAS,KAAK,WAAW,CAAC,YAAY,CAAC,IAAA,mBAAU,GAAE,CAAC,CAAC;QACjE,MAAM,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,MAAM,CAAC,uBAAuB;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,+BAAW,CAAC,0BAA0B,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,MAAM,EAAE,MAAM,CAAC,+BAAW,CAAC,wBAAwB,CAAC,EAAE,EACxD,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAA,kBAAS,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC3C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,KAAK,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,GAAG,CAAC,CAAC;QAC9D,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3B,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAChC,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACrC;gBACE,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,SAAS,MAAM,uBAAuB,CACnE,CAAC;QACN,CAAC;IACH,CAAC;;AA5DH,kCA6DC;AAvDgB,qBAAS,GAA2B,IAAI,CAAC"}
+{"version":3,"file":"auth.utilities.js","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":";;;AAAA,mCAAkD;AAClD,mCAA+C;AAC/C,kEAAyD;AACzD,+CAA2C;AAC3C,yCAAsC;AAEtC,MAAa,WAAW;IAKtB,MAAM,CAAC,YAAY,CAAC,KAAa;QAC/B,OAAO,IAAA,aAAI,EAAC,KAAK,EAAE,wBAAU,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IAGD,MAAM,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAGD,MAAM,CAAC,WAAW,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,OAAO,IAAA,kBAAS,EAAC,MAAM,CAAC,GAAG,wBAAU,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,WAAW,CAAC,SAAS,KAAK,WAAW,CAAC,YAAY,CAAC,IAAA,mBAAU,GAAE,CAAC,CAAC;QACjE,MAAM,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAMD,MAAM,CAAC,mBAAmB,CAAC,KAAc;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,2BAA2B,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,+BAAW,CAAC,mBAAmB,CAAC;YACxD,OAAO,6BAA6B,+BAAW,CAAC,mBAAmB,aAAa,CAAC;QACnF,IACE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,+BAAW,CAAC,kBAAkB,CAAC;YAEzE,OAAO,4BAA4B,+BAAW,CAAC,kBAAkB,QAAQ,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,CAAC,cAAc,CAAC,KAAa;QACjC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACpC,CAAC;IAGD,MAAM,CAAC,uBAAuB;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,+BAAW,CAAC,0BAA0B,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,MAAM,EAAE,MAAM,CAAC,+BAAW,CAAC,wBAAwB,CAAC,EAAE,EACxD,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAA,kBAAS,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC3C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAGD,MAAM,CAAC,qBAAqB;QAC1B,OAAO,wBAAU,CAAC,OAAO,EAAE,CAAC,qBAAqB,EAAE,CAAC;IACtD,CAAC;IAGD,MAAM,CAAC,aAAa,CAAC,MAAc;QACjC,OAAO,mBAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;;AAnEH,kCAoEC;AAlEgB,qBAAS,GAA2B,IAAI,CAAC"}

package/dist/auth/utilities/duration.d.ts

@@ -0,0 +1,6 @@
+export declare class Duration {
+    static toMs(value: string | number): number;
+    static toSeconds(value: string | number): number;
+    private static positive;
+}
+//# sourceMappingURL=duration.d.ts.map

package/dist/auth/utilities/duration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/duration.ts"],"names":[],"mappings":"AAsCA,qBAAa,QAAQ;IACnB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAgB3C,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAIhD,OAAO,CAAC,MAAM,CAAC,QAAQ;CAKxB"}

package/dist/auth/utilities/duration.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Duration = void 0;
+const UNIT_MS = {
+    ms: 1,
+    msec: 1,
+    msecs: 1,
+    millisecond: 1,
+    milliseconds: 1,
+    s: 1000,
+    sec: 1000,
+    secs: 1000,
+    second: 1000,
+    seconds: 1000,
+    m: 60_000,
+    min: 60_000,
+    mins: 60_000,
+    minute: 60_000,
+    minutes: 60_000,
+    h: 3_600_000,
+    hr: 3_600_000,
+    hrs: 3_600_000,
+    hour: 3_600_000,
+    hours: 3_600_000,
+    d: 86_400_000,
+    day: 86_400_000,
+    days: 86_400_000,
+    w: 604_800_000,
+    week: 604_800_000,
+    weeks: 604_800_000,
+};
+const PATTERN = /^\s*(\d+(?:\.\d+)?)\s*([a-z]*)\s*$/i;
+class Duration {
+    static toMs(value) {
+        if (typeof value === 'number')
+            return Duration.positive(value * 1000, value);
+        const match = PATTERN.exec(String(value ?? ''));
+        if (!match)
+            throw new Error(`Invalid duration "${String(value)}"`);
+        const unit = match[2].toLowerCase();
+        const factor = unit ? UNIT_MS[unit] : 1000;
+        if (!factor)
+            throw new Error(`Unknown duration unit "${match[2]}" in "${value}"`);
+        return Duration.positive(Math.round(Number(match[1]) * factor), value);
+    }
+    static toSeconds(value) {
+        return Math.ceil(Duration.toMs(value) / 1000);
+    }
+    static positive(ms, raw) {
+        if (!Number.isFinite(ms) || ms <= 0)
+            throw new Error(`Duration must be positive: "${String(raw)}"`);
+        return ms;
+    }
+}
+exports.Duration = Duration;
+//# sourceMappingURL=duration.js.map