@nestjs/authentication 0.0.1 → 0.1.1

package/dist/session/session.service.js

@@ -10,7 +10,8 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Inject, Injectable, Optional } from '@nestjs/common';
+var SessionService_1;
+import { Inject, Injectable, Logger, Optional } from '@nestjs/common';
 import { firstHeader } from '../utils/auth-state.util.js';
 import { AUTHENTICATION_MODULE_OPTIONS } from '../authentication.constants.js';
 import { isCrossOriginWrite, normalizeOrigin } from '../utils/cross-origin.util.js';
@@ -29,10 +30,12 @@ import { assertCookieAttributes, defaultCookieName, readCookie, serializeCookie
  * - `create()`, `validate()` and `rotate()` are the low-level operations
  *   behind `SignInService`, which also reads and writes the cookie.
  */
-let SessionService = class SessionService {
+let SessionService = SessionService_1 = class SessionService {
     constructor(storage, options, events = new AuthenticationEvents()) {
         this.storage = storage;
         this.events = events;
+        /** Touches failed since the last successful one: a spell of failures logs one warning, not one per request. */
+        this.failedTouches = 0;
         this.options = options?.session ?? {};
         this.absoluteTtl = durationOr(this.options.absoluteTtl, '7d');
         // A pending session never outlives a verified one would.
@@ -70,7 +73,11 @@ let SessionService = class SessionService {
             ...(metadata && { metadata }),
         });
     }
-    /** The live session for a token, sliding its idle timeout. */
+    /**
+     * The live session for a token, sliding its idle timeout. Sliding is
+     * best-effort: when the store fails to record the activity, the session
+     * is still returned, as read (see `SessionStore.touchSession()`).
+     */
     async validate(token) {
         if (!token || !TOKEN_PATTERN.test(token)) {
             return null;
@@ -90,8 +97,7 @@ let SessionService = class SessionService {
             return null;
         }
         if (now - record.lastActiveAt.getTime() >= this.touchInterval) {
-            record.lastActiveAt = new Date(now);
-            await this.storage.sessions.touchSession(record.id, record.lastActiveAt);
+            await this.touch(record, new Date(now));
         }
         return record;
     }
@@ -103,10 +109,11 @@ let SessionService = class SessionService {
      * `absoluteTtl` from its creation, in place of its `mfa.pendingTtl`.
      * Resolves `null` when the session was gone by the time it was replaced:
      * revoked (a sign-out everywhere, a password reset) or rotated by another
-     * request, which leaves no new session behind.
+     * request, which leaves no new session behind. The session's `extra` is
+     * not carried over.
      */
     async rotate(session, changes = {}) {
-        const { id: _, ...rest } = session;
+        const { id: _, extra: _extra, ...rest } = session;
         const verifying = session.mfa === 'pending' && changes.mfa === 'verified';
         // The new session first, then the old one, which must still be there to delete: if a revocation
         // took it meanwhile (deleting the user's sessions, this new one included, or not yet), or another
@@ -182,6 +189,33 @@ let SessionService = class SessionService {
     async discard(sessionId) {
         await this.storage.sessions.deleteSession(sessionId);
     }
+    /**
+     * Records activity, best-effort: the session was read live, so a failed write (a lock timeout,
+     * a read-only replica) does not fail the request, and the session keeps the idle deadline the
+     * store still has. Every failure is published as `session-touch-failed`; the log gets one warning
+     * per spell of failures (the first), then one line once a touch succeeds again, with how many
+     * failed in between.
+     */
+    async touch(record, lastActiveAt) {
+        try {
+            await this.storage.sessions.touchSession(record.id, lastActiveAt);
+        }
+        catch (error) {
+            if (this.failedTouches++ === 0) {
+                SessionService_1.logger.warn(`Recording activity on a session of user ${record.userId} failed, so its idle timeout did not move: ` +
+                    (error instanceof Error ? error.message : String(error)) +
+                    '. Further failures are not logged until a touch succeeds again.');
+            }
+            // Published on every failure, logged or not, so metrics and alerting count them all.
+            this.events.emit({ type: 'session-touch-failed', userId: record.userId, sessionId: record.id, error });
+            return;
+        }
+        record.lastActiveAt = lastActiveAt;
+        if (this.failedTouches > 0) {
+            SessionService_1.logger.log(`Recording session activity works again; ${this.failedTouches} ${this.failedTouches === 1 ? 'touch' : 'touches'} failed meanwhile.`);
+            this.failedTouches = 0;
+        }
+    }
     isLive(record, now) {
         if (hasExpired(record.expiresAt, now)) {
             return false;
@@ -199,7 +233,8 @@ let SessionService = class SessionService {
         return this.options.now?.() ?? Date.now();
     }
 };
-SessionService = __decorate([
+SessionService.logger = new Logger('SessionService');
+SessionService = SessionService_1 = __decorate([
     Injectable(),
     __param(1, Optional()),
     __param(1, Inject(AUTHENTICATION_MODULE_OPTIONS)),

package/dist/session/sign-in.service.d.ts

@@ -19,8 +19,9 @@ import { SessionService } from './session.service.js';
  *   (login CSRF: signing the victim's browser in to the attacker's
  *   account), by the same rule as `app.enableCsrfProtection()`;
  * - the browser's previous session is deleted (session fixation defence);
- * - users with a confirmed authenticator get an `mfa: 'pending'` session,
- *   which is not signed in anywhere until `completeMfa()` verifies a code.
+ * - with `mfa` configured, users with a confirmed authenticator get an
+ *   `mfa: 'pending'` session, which is not signed in anywhere until
+ *   `completeMfa()` verifies a code.
  */
 export declare class SignInService {
     private readonly sessions;
@@ -71,9 +72,9 @@ export declare class SignInService {
      */
     signOut(): Promise<boolean>;
     /**
-     * Ends every session and refresh-token family of the user, and clears
-     * this browser's cookie if it was one of them. API keys live in your own
-     * table: revoke those yourself.
+     * Ends every session and, with refresh tokens on (`accessToken`), every
+     * refresh-token family of the user, and clears this browser's cookie if it
+     * was one of them. API keys live in your own table: revoke those yourself.
      */
     signOutEverywhere(userId: string): Promise<void>;
     /**

package/dist/session/sign-in.service.js

@@ -31,8 +31,9 @@ import { SessionService } from './session.service.js';
  *   (login CSRF: signing the victim's browser in to the attacker's
  *   account), by the same rule as `app.enableCsrfProtection()`;
  * - the browser's previous session is deleted (session fixation defence);
- * - users with a confirmed authenticator get an `mfa: 'pending'` session,
- *   which is not signed in anywhere until `completeMfa()` verifies a code.
+ * - with `mfa` configured, users with a confirmed authenticator get an
+ *   `mfa: 'pending'` session, which is not signed in anywhere until
+ *   `completeMfa()` verifies a code.
  */
 let SignInService = class SignInService {
     constructor(sessions, mfa, tokens, scope = new AuthenticationScope(), adapterHost, events = new AuthenticationEvents()) {
@@ -162,9 +163,9 @@ let SignInService = class SignInService {
         return true;
     }
     /**
-     * Ends every session and refresh-token family of the user, and clears
-     * this browser's cookie if it was one of them. API keys live in your own
-     * table: revoke those yourself.
+     * Ends every session and, with refresh tokens on (`accessToken`), every
+     * refresh-token family of the user, and clears this browser's cookie if it
+     * was one of them. API keys live in your own table: revoke those yourself.
      */
     async signOutEverywhere(userId) {
         const exchange = this.scope.exchange();

package/dist/storage/authentication.storage.d.ts

@@ -8,32 +8,41 @@ import type { AuthenticationStorageSources, AuthenticationStorageContract, Authe
 /**
  * @internal What each feature reads or writes, audited against the code
  * paths: the production guard's rule.
- * Any feature that signs someone in reads `mfa`, configured or not: a user
- * may have enrolled an authenticator through another instance, and
- * `MfaService.isEnrolled()` is how a sign-in finds out. Any feature that
- * revokes a user's sign-ins reaches both `sessions` and `refreshTokens`.
+ * MFA is off unless `mfa` is configured: without it, `MfaService.isEnrolled()`
+ * answers `false` without reading the store, and its other methods throw.
+ * Refresh tokens exist only with `accessToken`, and not with
+ * `refreshToken: false`: otherwise `TokenService.issue()` starts no family
+ * and `revokeAll()` has nothing to revoke and reads nothing. Apps
+ * that sign users in from a shared user database must therefore agree: if
+ * one configures `mfa` (or `accessToken`), every one of them must, or a user
+ * who enrolled an authenticator through one signs in to another with a
+ * password alone (and a sign-out everywhere leaves token clients signed in).
+ * Removing `mfa` turns MFA off for everyone.
  */
 export declare const CONTRACTS_BY_FEATURE: {
     /**
      * A `SessionCookieProvider` in `providers`: `SessionService` (every
-     * request), `SignInService.signIn()` (`isEnrolled()`), `completeMfa()`,
-     * and `signOutEverywhere()`, which also revokes the user's refresh-token
-     * families.
+     * request), `SignInService.signIn()` and `signOutEverywhere()`.
      */
-    readonly sessionCookie: readonly ["sessions", "refreshTokens", "mfa"];
-    /** `accessToken`: `TokenService` (refresh-token families), whose `issue()` checks for an authenticator. */
-    readonly accessToken: readonly ["refreshTokens", "mfa"];
-    /** `mfa`: enrollment, codes, recovery codes and the lockout. */
+    readonly sessionCookie: readonly ["sessions"];
+    /**
+     * `accessToken` without `refreshToken: false`: the refresh-token families
+     * `TokenService` starts, which every sign-out everywhere revokes too.
+     * Access tokens alone keep no state.
+     */
+    readonly refreshToken: readonly ["refreshTokens"];
+    /** `mfa`: enrollment, codes, recovery codes and the lockout; every sign-in checks for an authenticator. */
     readonly mfa: readonly ["mfa"];
     /** `magicLinkHandler`: pending links, then `SignInService.signIn()`. */
-    readonly magicLink: readonly ["sessions", "mfa", "magicLinks"];
+    readonly magicLink: readonly ["sessions", "magicLinks"];
     /** `oidcAccountResolver`: logins in progress, the session that links an account, then `SignInService.signIn()`. */
-    readonly oidc: readonly ["sessions", "mfa", "oidcStates"];
+    readonly oidc: readonly ["sessions", "oidcStates"];
     /**
-     * `passwordResetHandler`: the links; `reset()` revokes every session and
-     * refresh-token family of the user, and with `signIn: true` signs in.
+     * `passwordResetHandler`: the links; `reset()` revokes every session (and
+     * refresh-token family, with refresh tokens on) of the user, and with
+     * `signIn: true` signs in.
      */
-    readonly passwordReset: readonly ["sessions", "refreshTokens", "mfa", "emailTokens"];
+    readonly passwordReset: readonly ["sessions", "emailTokens"];
     /** `emailVerificationHandler`: the links. */
     readonly emailVerification: readonly ["emailTokens"];
 };

package/dist/storage/authentication.storage.js

@@ -22,32 +22,41 @@ import { AUTHENTICATION_STORAGE_REQUIREMENTS } from '../authentication.constants
 /**
  * @internal What each feature reads or writes, audited against the code
  * paths: the production guard's rule.
- * Any feature that signs someone in reads `mfa`, configured or not: a user
- * may have enrolled an authenticator through another instance, and
- * `MfaService.isEnrolled()` is how a sign-in finds out. Any feature that
- * revokes a user's sign-ins reaches both `sessions` and `refreshTokens`.
+ * MFA is off unless `mfa` is configured: without it, `MfaService.isEnrolled()`
+ * answers `false` without reading the store, and its other methods throw.
+ * Refresh tokens exist only with `accessToken`, and not with
+ * `refreshToken: false`: otherwise `TokenService.issue()` starts no family
+ * and `revokeAll()` has nothing to revoke and reads nothing. Apps
+ * that sign users in from a shared user database must therefore agree: if
+ * one configures `mfa` (or `accessToken`), every one of them must, or a user
+ * who enrolled an authenticator through one signs in to another with a
+ * password alone (and a sign-out everywhere leaves token clients signed in).
+ * Removing `mfa` turns MFA off for everyone.
  */
 export const CONTRACTS_BY_FEATURE = {
     /**
      * A `SessionCookieProvider` in `providers`: `SessionService` (every
-     * request), `SignInService.signIn()` (`isEnrolled()`), `completeMfa()`,
-     * and `signOutEverywhere()`, which also revokes the user's refresh-token
-     * families.
+     * request), `SignInService.signIn()` and `signOutEverywhere()`.
      */
-    sessionCookie: ['sessions', 'refreshTokens', 'mfa'],
-    /** `accessToken`: `TokenService` (refresh-token families), whose `issue()` checks for an authenticator. */
-    accessToken: ['refreshTokens', 'mfa'],
-    /** `mfa`: enrollment, codes, recovery codes and the lockout. */
+    sessionCookie: ['sessions'],
+    /**
+     * `accessToken` without `refreshToken: false`: the refresh-token families
+     * `TokenService` starts, which every sign-out everywhere revokes too.
+     * Access tokens alone keep no state.
+     */
+    refreshToken: ['refreshTokens'],
+    /** `mfa`: enrollment, codes, recovery codes and the lockout; every sign-in checks for an authenticator. */
     mfa: ['mfa'],
     /** `magicLinkHandler`: pending links, then `SignInService.signIn()`. */
-    magicLink: ['sessions', 'mfa', 'magicLinks'],
+    magicLink: ['sessions', 'magicLinks'],
     /** `oidcAccountResolver`: logins in progress, the session that links an account, then `SignInService.signIn()`. */
-    oidc: ['sessions', 'mfa', 'oidcStates'],
+    oidc: ['sessions', 'oidcStates'],
     /**
-     * `passwordResetHandler`: the links; `reset()` revokes every session and
-     * refresh-token family of the user, and with `signIn: true` signs in.
+     * `passwordResetHandler`: the links; `reset()` revokes every session (and
+     * refresh-token family, with refresh tokens on) of the user, and with
+     * `signIn: true` signs in.
      */
-    passwordReset: ['sessions', 'refreshTokens', 'mfa', 'emailTokens'],
+    passwordReset: ['sessions', 'emailTokens'],
     /** `emailVerificationHandler`: the links. */
     emailVerification: ['emailTokens'],
 };

package/dist/testing/index.js

@@ -70,8 +70,8 @@ export function authenticationStoreContract(create, options = {}) {
         for (const record of [full, bare, other]) {
             await store.createSession(record);
         }
-        same(await store.getSession(full.id), full, 'getSession() returns every field as saved');
-        same(await store.getSession(bare.id), bare, 'optional fields come back absent, not null');
+        same(stored(await store.getSession(full.id)), full, 'getSession() returns every field as saved');
+        same(stored(await store.getSession(bare.id)), bare, 'optional fields come back absent, not null');
         same(await store.getSession(id()), undefined, 'getSession() of an unknown id');
         same(sortIds(await store.listUserSessions(u1)), [full.id, bare.id].sort(), "listUserSessions() returns the user's sessions");
         same(await store.listUserSessions(uid()), [], 'listUserSessions() of a user without sessions');
@@ -81,13 +81,13 @@ export function authenticationStoreContract(create, options = {}) {
         same(await store.deleteSession(id()), false, 'deleteSession() of an unknown id resolves false');
         await store.deleteUserSessions(u1);
         same(await store.listUserSessions(u1), [], "deleteUserSessions() deletes the user's sessions");
-        same(await store.getSession(other.id), other, "deleteUserSessions() leaves other users' sessions alone");
+        same(stored(await store.getSession(other.id)), other, "deleteUserSessions() leaves other users' sessions alone");
     });
     add('sessions', 'touchSession() moves lastActiveAt forward only, and never recreates a deleted session', async ({ sessions: store }) => {
         const record = session(uid(), { mfa: 'verified', metadata: { device: 'phone' } });
         await store.createSession(record);
         await store.touchSession(record.id, at(5_000));
-        same(await store.getSession(record.id), { ...record, lastActiveAt: at(5_000) }, 'touchSession() changes lastActiveAt, nothing else');
+        same(stored(await store.getSession(record.id)), { ...record, lastActiveAt: at(5_000) }, 'touchSession() changes lastActiveAt, nothing else');
         await store.touchSession(record.id, at(1_000));
         same((await store.getSession(record.id))?.lastActiveAt, at(5_000), 'touchSession() never moves lastActiveAt back');
         await store.deleteSession(record.id);
@@ -102,7 +102,7 @@ export function authenticationStoreContract(create, options = {}) {
         await store.createSession(idle);
         await store.createSession(expired);
         await store.createSession(session(user, { createdAt: at(2_000), lastActiveAt: at(2_000) }));
-        same(await store.getSession(idle.id), idle, 'a session idle for a long time, but within its absolute expiry, is kept');
+        same(stored(await store.getSession(idle.id)), idle, 'a session idle for a long time, but within its absolute expiry, is kept');
         const left = await store.getSession(expired.id);
         assert.ok(left === undefined || left.expiresAt <= at(2_000), 'a pruned session is gone, or still past its expiry');
     });
@@ -514,6 +514,14 @@ function emailToken(overrides = {}) {
     return { id: id(), purpose: 'password-reset', userId: uid(), email: `${uid()}@example.com`, createdAt: at(0), expiresAt: at(60_000), ...overrides };
 }
 const sortIds = (records) => records.map((record) => record.id).sort();
+/** A session as stored: without the `extra` a store may read along with it. */
+function stored(record) {
+    if (!record) {
+        return record;
+    }
+    const { extra: _, ...rest } = record;
+    return rest;
+}
 /** Deep equality where a missing key and an `undefined` one are the same, and `null` is not `undefined`. */
 function same(actual, expected, message) {
     assert.deepStrictEqual(normalize(actual), normalize(expected), message);

package/dist/utils/transport-errors.util.d.ts

@@ -1,33 +1,44 @@
 import { type ExecutionContext } from '@nestjs/common';
 import type { HttpAdapterHost } from '@nestjs/core';
+import type { AuthenticationError } from '../errors/authentication.error.js';
 export interface Refusal {
     /** Default 401. 403 for a user the route refuses (an unverified address), 409 for a conflict (`MfaAlreadyEnrolledError`). */
     status?: 401 | 403 | 409;
-    /** Default `Unauthorized`. */
+    /**
+     * Without one, Nest's bare body (`new UnauthorizedException()`): the status
+     * phrase as `message`, and no `error`.
+     */
     message?: string;
-    /** Machine-readable reason (`mfa_required`), in the body's `error` field. */
+    /** Machine-readable reason (`mfa_required`): Nest's `errorCode`, and the body's `error` when there is a message. */
     code?: string;
+    /** Machine-readable data the app chose to send (`AuthenticationError`'s `details`): the body's `details`. */
+    details?: Record<string, unknown>;
     /** The error behind the refusal, kept as the exception's `cause` for logs. */
     cause?: unknown;
 }
+/** The refusal for an `AuthenticationError` a provider or a handler threw. */
+export declare function refusalOf(error: AuthenticationError): Refusal;
 /**
  * The one place this package's refusals become responses, for the guard and
  * for `AuthenticationError`s thrown by handlers: the error each transport's
  * exception filter understands, for the refusal's status.
  *
  * - HTTP and GraphQL: Nest's own `UnauthorizedException` (or
- *   `ForbiddenException` for a 403, `ConflictException` for a 409), so the body is Nest's own:
- *   `{"message":"Unauthorized","statusCode":401}`, or with a message,
- *   `{"message":"Refresh token reused","error":"Unauthorized","statusCode":401}`.
- *   A `code` replaces `error`. Over HTTP, `challenge` becomes the
- *   `WWW-Authenticate` header of a 401.
+ *   `ForbiddenException` for a 403, `ConflictException` for a 409), with
+ *   Nest's own body: `{"message":"Unauthorized","statusCode":401}`, or with a
+ *   message, `{"message":"Refresh token reused","error":"Unauthorized","statusCode":401}`.
+ *   A `code` is Nest's `errorCode` (on the exception, and in the body), and
+ *   the description in `error` when there is a message; `details` follow.
+ *   Over HTTP, `challenge` becomes the `WWW-Authenticate` header of a 401.
  * - ws and rpc: a `WsException` / `RpcException` carrying
- *   `{ statusCode, message }` (plus `status: 'error'` for ws, and `error`
- *   with a `code`). Those filters report `HttpException`s as "Internal
- *   server error", hence their own classes, loaded only when the packages
- *   are installed.
+ *   `{ statusCode, message }` (plus `status: 'error'` for ws, and `error`,
+ *   `errorCode` and `details` as above). Those filters report
+ *   `HttpException`s as "Internal server error", hence their own classes,
+ *   loaded only when the packages are installed.
+ *
+ * Nothing else reaches the body: `cause` stays on the exception, for logs.
  */
-export declare function refusal(context: ExecutionContext, { status, message, code, cause }?: Refusal, { challenge, adapterHost }?: {
+export declare function refusal(context: ExecutionContext, { status, message, code, details, cause }?: Refusal, { challenge, adapterHost }?: {
     challenge?: string;
     adapterHost?: HttpAdapterHost;
 }): Promise<Error>;

package/dist/utils/transport-errors.util.js

@@ -10,25 +10,42 @@ function load(pkg, name) {
     return pending;
 }
 const DEFAULT_MESSAGE = 'Unauthorized';
+const PHRASES = { 401: 'Unauthorized', 403: 'Forbidden', 409: 'Conflict' };
+/** The refusal for an `AuthenticationError` a provider or a handler threw. */
+export function refusalOf(error) {
+    const { status, message, code, details } = error;
+    return { status, message, code, details, cause: error };
+}
 /**
  * The one place this package's refusals become responses, for the guard and
  * for `AuthenticationError`s thrown by handlers: the error each transport's
  * exception filter understands, for the refusal's status.
  *
  * - HTTP and GraphQL: Nest's own `UnauthorizedException` (or
- *   `ForbiddenException` for a 403, `ConflictException` for a 409), so the body is Nest's own:
- *   `{"message":"Unauthorized","statusCode":401}`, or with a message,
- *   `{"message":"Refresh token reused","error":"Unauthorized","statusCode":401}`.
- *   A `code` replaces `error`. Over HTTP, `challenge` becomes the
- *   `WWW-Authenticate` header of a 401.
+ *   `ForbiddenException` for a 403, `ConflictException` for a 409), with
+ *   Nest's own body: `{"message":"Unauthorized","statusCode":401}`, or with a
+ *   message, `{"message":"Refresh token reused","error":"Unauthorized","statusCode":401}`.
+ *   A `code` is Nest's `errorCode` (on the exception, and in the body), and
+ *   the description in `error` when there is a message; `details` follow.
+ *   Over HTTP, `challenge` becomes the `WWW-Authenticate` header of a 401.
  * - ws and rpc: a `WsException` / `RpcException` carrying
- *   `{ statusCode, message }` (plus `status: 'error'` for ws, and `error`
- *   with a `code`). Those filters report `HttpException`s as "Internal
- *   server error", hence their own classes, loaded only when the packages
- *   are installed.
+ *   `{ statusCode, message }` (plus `status: 'error'` for ws, and `error`,
+ *   `errorCode` and `details` as above). Those filters report
+ *   `HttpException`s as "Internal server error", hence their own classes,
+ *   loaded only when the packages are installed.
+ *
+ * Nothing else reaches the body: `cause` stays on the exception, for logs.
  */
-export async function refusal(context, { status = 401, message = DEFAULT_MESSAGE, code, cause } = {}, { challenge, adapterHost } = {}) {
-    const payload = { statusCode: status, ...(code && { error: code }), message };
+export async function refusal(context, { status = 401, message, code, details, cause } = {}, { challenge, adapterHost } = {}) {
+    // The default message without a code gives the body of a bare `new UnauthorizedException()`.
+    const bare = message === undefined || (status === 401 && message === DEFAULT_MESSAGE && !code);
+    const payload = {
+        statusCode: status,
+        ...(!bare && code && { error: code }),
+        message: message ?? PHRASES[status],
+        ...(code && { errorCode: code }),
+        ...(details !== undefined && { details }),
+    };
     switch (context.getType()) {
         case 'ws': {
             const WsException = await load('@nestjs/websockets', 'WsException');
@@ -50,17 +67,12 @@ export async function refusal(context, { status = 401, message = DEFAULT_MESSAGE
             }
             break;
     }
-    const options = { cause, ...(code && { description: code }) };
-    if (status === 409) {
-        return new ConflictException(message, options);
-    }
-    if (status === 403) {
-        return new ForbiddenException(message, options);
-    }
-    // The default message gives the body of a bare `new UnauthorizedException()`.
-    return message === DEFAULT_MESSAGE && !code
-        ? new UnauthorizedException(undefined, options)
-        : new UnauthorizedException(message, options);
+    const Exception = status === 409 ? ConflictException : status === 403 ? ForbiddenException : UnauthorizedException;
+    // Nest builds the body: `error` is the code (the description) or the status phrase, then `errorCode`.
+    const options = { cause, ...(code && { errorCode: code, ...(!bare && { description: code }) }) };
+    const exception = new Exception(bare ? undefined : message, options);
+    // `details` are not Nest's: its body, with them.
+    return details === undefined ? exception : new Exception({ ...exception.getResponse(), details }, options);
 }
 function withCause(error, cause) {
     if (cause !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/authentication",
-  "version": "0.0.1",
+  "version": "0.1.1",
   "description": "Nest - modern, fast, powerful node.js web framework (@authentication)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -46,41 +46,41 @@
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-socket": "0.2.11",
     "@nestjs/apollo": "14.0.1",
-    "@nestjs/authorization": "file:../authorization/nestjs-authorization-0.0.1.tgz",
-    "@nestjs/common": "12.1.0",
-    "@nestjs/core": "12.1.0",
+    "@nestjs/authorization": "0.1.0",
+    "@nestjs/common": "12.1.2",
+    "@nestjs/core": "12.1.2",
     "@nestjs/drizzle": "0.0.1",
     "@nestjs/graphql": "14.0.1",
-    "@nestjs/idempotency": "0.0.1",
-    "@nestjs/mail": "file:../mail/nestjs-mail-0.0.1.tgz",
-    "@nestjs/microservices": "12.1.0",
-    "@nestjs/platform-express": "12.1.0",
-    "@nestjs/platform-fastify": "12.1.0",
-    "@nestjs/platform-ws": "12.1.0",
-    "@nestjs/resilience": "0.0.1",
-    "@nestjs/testing": "12.1.0",
-    "@nestjs/throttler": "6.7.0",
-    "@nestjs/websockets": "12.1.0",
-    "@types/node": "24.13.6",
+    "@nestjs/idempotency": "0.0.2",
+    "@nestjs/mail": "0.0.1",
+    "@nestjs/microservices": "12.1.2",
+    "@nestjs/platform-express": "12.1.2",
+    "@nestjs/platform-fastify": "12.1.2",
+    "@nestjs/platform-ws": "12.1.2",
+    "@nestjs/resilience": "0.0.2",
+    "@nestjs/testing": "12.1.2",
+    "@nestjs/throttler": "6.7.1",
+    "@nestjs/websockets": "12.1.2",
+    "@types/node": "24.19.2",
     "@types/pg": "8.23.1",
-    "@types/supertest": "6.0.3",
-    "@types/ws": "8.18.1",
-    "drizzle-orm": "0.45.3",
+    "@types/supertest": "7.2.1",
+    "@types/ws": "8.18.2",
+    "drizzle-orm": "0.45.4",
     "graphql": "16.14.2",
     "husky": "9.1.7",
-    "lint-staged": "17.5.1",
-    "oxlint": "1.85.0",
-    "pg": "8.23.0",
-    "prettier": "3.9.8",
+    "lint-staged": "17.6.0",
+    "oxlint": "1.87.0",
+    "pg": "8.23.1",
+    "prettier": "3.9.10",
     "reflect-metadata": "0.2.2",
-    "release-it": "21.1.0",
+    "release-it": "21.1.1",
     "rxjs": "7.8.2",
-    "supertest": "7.2.2",
-    "typeorm": "1.1.1",
+    "supertest": "7.3.1",
+    "typeorm": "1.1.2",
     "typescript": "7.0.2",
-    "vite": "8.3.0",
-    "vitest": "5.0.1",
-    "ws": "8.21.3"
+    "vite": "8.3.4",
+    "vitest": "5.0.3",
+    "ws": "8.22.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^12.0.0",