@nestjs/authentication 0.0.1

package/dist/events/authentication-events.service.js

@@ -0,0 +1,39 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@nestjs/common';
+import { Subject } from 'rxjs';
+import { channelFor } from './authentication.channels.js';
+/**
+ * The audit trail of sign-ins, sign-outs, second-factor changes, password
+ * resets, email verifications and refused magic links. Each event is also
+ * published on its `node:diagnostics_channel` channel
+ * (`nestjs:authentication:<type>`), for tooling that runs outside Nest.
+ * Listeners cannot change the outcome: a throwing channel subscriber is
+ * reported on the next tick, not in the sign-in that emitted.
+ */
+let AuthenticationEvents = class AuthenticationEvents {
+    constructor() {
+        this.subject = new Subject();
+        /** Every event of this application, in order. */
+        this.events$ = this.subject.asObservable();
+    }
+    /** @internal Called by the module's services. */
+    emit(event) {
+        const target = channelFor(event.type);
+        if (target.hasSubscribers) {
+            target.publish(event);
+        }
+        this.subject.next(event);
+    }
+    onApplicationShutdown() {
+        this.subject.complete();
+    }
+};
+AuthenticationEvents = __decorate([
+    Injectable()
+], AuthenticationEvents);
+export { AuthenticationEvents };

package/dist/events/authentication.channels.d.ts

@@ -0,0 +1,4 @@
+import { type Channel } from 'node:diagnostics_channel';
+import type { AuthenticationEvent } from './authentication-events.interface.js';
+/** `nestjs:authentication:<type>`, one `node:diagnostics_channel` channel per event. */
+export declare function channelFor(type: AuthenticationEvent['type']): Channel;

package/dist/events/authentication.channels.js

@@ -0,0 +1,11 @@
+import { channel } from 'node:diagnostics_channel';
+const channels = new Map();
+/** `nestjs:authentication:<type>`, one `node:diagnostics_channel` channel per event. */
+export function channelFor(type) {
+    let found = channels.get(type);
+    if (!found) {
+        found = channel(`nestjs:authentication:${type}`);
+        channels.set(type, found);
+    }
+    return found;
+}

package/dist/events/index.d.ts

@@ -0,0 +1,3 @@
+export * from './authentication-events.interface.js';
+export * from './authentication-events.service.js';
+export * from './authentication.channels.js';

package/dist/events/index.js

@@ -0,0 +1,3 @@
+export * from './authentication-events.interface.js';
+export * from './authentication-events.service.js';
+export * from './authentication.channels.js';

package/dist/guards/authentication.guard.d.ts

@@ -0,0 +1,57 @@
+import { type CanActivate, type ExecutionContext } from '@nestjs/common';
+import { HttpAdapterHost, Reflector } from '@nestjs/core';
+import { AuthenticationRegistry } from '../services/authentication-registry.service.js';
+import { AUTHENTICATION_GUARD_BRAND } from '../authentication.constants.js';
+/**
+ * Runs the registered providers in order and records the first result on
+ * the call.
+ *
+ * | Route | No credentials | Valid | Invalid |
+ * | --- | --- | --- | --- |
+ * | default | 401 | pass | 401 |
+ * | `@Authenticate({ optional: true })` | pass, user `null` | pass | 401 |
+ * | `@Public()` | providers not called | not called | not called |
+ *
+ * A result with `mfa: 'pending'` (second factor outstanding) does not count
+ * as signed in: 401 `mfa_required` where a user is required, anonymous on
+ * optional routes. `@Authenticate({ mfa: true })` needs `mfa: 'verified'`,
+ * and `@Authenticate({ verifiedEmail: true })` a verified address (403).
+ *
+ * Providers run once per call: the raw result is cached on the request, the
+ * GraphQL operation's context, or per ws message. With
+ * `@Authenticate({ providers })`, a cached result from another provider is
+ * ignored.
+ *
+ * Where Nest runs no global guard, neither does this one: on GraphQL field
+ * resolvers (`@ResolveField`), unless the GraphQL module sets
+ * `fieldResolverEnhancers: ['guards']`, and on the message handlers of a
+ * hybrid app, unless it connects them with
+ * `app.connectMicroservice(options, { inheritAppConfig: true })`. There,
+ * route options are not enforced.
+ */
+export declare class AuthenticationGuard implements CanActivate {
+    private readonly reflector;
+    private readonly adapterHost;
+    private readonly registry;
+    /**
+     * How `@nestjs/authorization` recognizes this guard, subclasses included,
+     * whatever their names: it fails at startup when this guard would run
+     * after its own.
+     */
+    static readonly [AUTHENTICATION_GUARD_BRAND] = true;
+    constructor(reflector: Reflector, adapterHost: HttpAdapterHost, registry: AuthenticationRegistry);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    /** Class options with the method's merged over them, field by field. */
+    private route;
+    private authenticate;
+    /**
+     * A ws socket keeps its last user (`client.user`) for code that reads it on
+     * messages that run no provider (`@Public()`): a message refused for its
+     * credentials says the connection has none now, its session revoked or its
+     * token expired. `@nestjs/authorization` asks for each message's own user
+     * instead (`userOf` in auth-state.util.ts).
+     */
+    private forgetConnection;
+    private challenges;
+    private fail;
+}

package/dist/guards/authentication.guard.js

@@ -0,0 +1,171 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var _a;
+import { Injectable } from '@nestjs/common';
+import { HttpAdapterHost, Reflector } from '@nestjs/core';
+import { hasVerifiedEmail } from '../account/email.util.js';
+import { getRawResult, setAuthState, setRawResult } from '../utils/auth-state.util.js';
+import { AuthenticationRegistry } from '../services/authentication-registry.service.js';
+import { AUTHENTICATION_GUARD_BRAND, AUTHENTICATION_METADATA } from '../authentication.constants.js';
+import { AuthenticationError } from '../errors/authentication.error.js';
+import { refusal } from '../utils/transport-errors.util.js';
+/** Which provider produced a result, for `@Authenticate({ providers })` on a cached result. */
+const producedBy = new WeakMap();
+const MFA_REQUIRED = { message: 'Second factor required', code: 'mfa_required' };
+const EMAIL_UNVERIFIED = { status: 403, message: 'Email address not verified', code: 'email_unverified' };
+/**
+ * Runs the registered providers in order and records the first result on
+ * the call.
+ *
+ * | Route | No credentials | Valid | Invalid |
+ * | --- | --- | --- | --- |
+ * | default | 401 | pass | 401 |
+ * | `@Authenticate({ optional: true })` | pass, user `null` | pass | 401 |
+ * | `@Public()` | providers not called | not called | not called |
+ *
+ * A result with `mfa: 'pending'` (second factor outstanding) does not count
+ * as signed in: 401 `mfa_required` where a user is required, anonymous on
+ * optional routes. `@Authenticate({ mfa: true })` needs `mfa: 'verified'`,
+ * and `@Authenticate({ verifiedEmail: true })` a verified address (403).
+ *
+ * Providers run once per call: the raw result is cached on the request, the
+ * GraphQL operation's context, or per ws message. With
+ * `@Authenticate({ providers })`, a cached result from another provider is
+ * ignored.
+ *
+ * Where Nest runs no global guard, neither does this one: on GraphQL field
+ * resolvers (`@ResolveField`), unless the GraphQL module sets
+ * `fieldResolverEnhancers: ['guards']`, and on the message handlers of a
+ * hybrid app, unless it connects them with
+ * `app.connectMicroservice(options, { inheritAppConfig: true })`. There,
+ * route options are not enforced.
+ */
+let AuthenticationGuard = class AuthenticationGuard {
+    constructor(reflector, adapterHost, registry) {
+        this.reflector = reflector;
+        this.adapterHost = adapterHost;
+        this.registry = registry;
+    }
+    async canActivate(context) {
+        const route = this.route(context);
+        if (route.public) {
+            // Nothing is written for http/graphql/rpc (another resolver of the same
+            // GraphQL operation may need the user); ws marks just this message.
+            if (context.getType() === 'ws') {
+                setAuthState(context, null, { perCallOnly: true });
+            }
+            return true;
+        }
+        const only = route.providers;
+        const all = this.registry.providers;
+        const providers = only ? all.filter((p) => only.some((type) => p instanceof type)) : all;
+        let raw = getRawResult(context);
+        if (only && raw && !providers.includes(producedBy.get(raw))) {
+            raw = undefined;
+        }
+        if (raw === undefined) {
+            raw = await this.authenticate(context, providers, !only);
+            // A restricted run does not speak for the other routes sharing the carrier.
+            if (!only) {
+                setRawResult(context, raw);
+            }
+        }
+        const pending = raw?.mfa === 'pending';
+        const result = pending ? null : raw;
+        if (!result) {
+            if (route.optional) {
+                setAuthState(context, null);
+                return true;
+            }
+            if (!only) {
+                this.forgetConnection(context);
+            }
+            if (pending) {
+                return this.fail(context, MFA_REQUIRED);
+            }
+            return this.fail(context, {}, this.challenges(context, providers));
+        }
+        if (route.mfa && result.mfa !== 'verified') {
+            return this.fail(context, MFA_REQUIRED);
+        }
+        if (route.verifiedEmail) {
+            const handler = this.registry.handler('emailVerification');
+            const verified = handler?.isVerified ? await handler.isVerified(result.user) : hasVerifiedEmail(result.user);
+            if (!verified) {
+                return this.fail(context, EMAIL_UNVERIFIED);
+            }
+        }
+        setAuthState(context, result);
+        return true;
+    }
+    /** Class options with the method's merged over them, field by field. */
+    route(context) {
+        return {
+            ...this.reflector.get(AUTHENTICATION_METADATA, context.getClass()),
+            ...this.reflector.get(AUTHENTICATION_METADATA, context.getHandler()),
+        };
+    }
+    async authenticate(context, providers, everyProvider) {
+        for (const provider of providers) {
+            try {
+                const result = await provider.authenticate(context);
+                if (result?.user) {
+                    producedBy.set(result, provider);
+                    return result;
+                }
+            }
+            catch (error) {
+                if (error instanceof AuthenticationError) {
+                    if (everyProvider || error.status === 401) {
+                        this.forgetConnection(context);
+                    }
+                    const { status, message, code } = error;
+                    return this.fail(context, { status, message, code, cause: error }, error.challenge);
+                }
+                throw error; // a store outage is a 500, not a 401
+            }
+        }
+        return null;
+    }
+    /**
+     * A ws socket keeps its last user (`client.user`) for code that reads it on
+     * messages that run no provider (`@Public()`): a message refused for its
+     * credentials says the connection has none now, its session revoked or its
+     * token expired. `@nestjs/authorization` asks for each message's own user
+     * instead (`userOf` in auth-state.util.ts).
+     */
+    forgetConnection(context) {
+        if (context.getType() === 'ws') {
+            setAuthState(context, null);
+        }
+    }
+    challenges(context, providers) {
+        // Once each: a JWT and an API key provider in one realm accept the same `Bearer realm="…"`.
+        const list = new Set(providers.map((p) => p.challenge?.(context)).filter((c) => !!c));
+        return [...list].join(', ') || undefined;
+    }
+    async fail(context, reason, challenge) {
+        throw await refusal(context, reason, { challenge, adapterHost: this.adapterHost });
+    }
+};
+_a = AUTHENTICATION_GUARD_BRAND;
+/**
+ * How `@nestjs/authorization` recognizes this guard, subclasses included,
+ * whatever their names: it fails at startup when this guard would run
+ * after its own.
+ */
+AuthenticationGuard[_a] = true;
+AuthenticationGuard = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [Reflector,
+        HttpAdapterHost,
+        AuthenticationRegistry])
+], AuthenticationGuard);
+export { AuthenticationGuard };

package/dist/guards/index.d.ts

@@ -0,0 +1 @@
+export * from './authentication.guard.js';

package/dist/guards/index.js

@@ -0,0 +1 @@
+export * from './authentication.guard.js';

package/dist/index.d.ts

@@ -0,0 +1,52 @@
+export { AuthenticationModule } from './authentication.module.js';
+export type { AuthenticationModuleAsyncOptions } from './authentication.module-definition.js';
+export { AUTHENTICATION_MODULE_OPTIONS } from './authentication.constants.js';
+export { AuthenticationRegistry } from './services/index.js';
+export { AuthenticationStorage } from './storage/index.js';
+export { AuthenticationGuard } from './guards/index.js';
+export { Authenticate, CurrentSession, CurrentUser, Public } from './decorators/index.js';
+export { AuthenticationContext } from './context/index.js';
+export { WsAuthenticator } from './services/index.js';
+export { AuthenticationProvider } from './providers/index.js';
+export { ApiKeyProvider } from './providers/index.js';
+export { AuthenticationError, JwtError, MagicLinkError, MfaAlreadyEnrolledError, RefreshTokenError, } from './errors/index.js';
+export { AuthenticationEvents, type AuthenticationEmailVerifiedEvent, type AuthenticationEvent, type AuthenticationMagicLinkRefusedEvent, type AuthenticationMfaDisabledEvent, type AuthenticationMfaEnabledEvent, type AuthenticationMfaFailedEvent, type AuthenticationMfaVerifiedEvent, type AuthenticationPasswordResetEvent, type AuthenticationPasswordResetRequestedEvent, type AuthenticationRecoveryCodesGeneratedEvent, type AuthenticationRefreshTokenReusedEvent, type AuthenticationSignInEvent, type AuthenticationSignOutEvent, } from './events/index.js';
+export type { ApiKeyProviderOptions, ApiKeyRecord, ApiKeySession, AuthenticateOptions, AuthenticationErrorOptions, AuthenticationHandlerName, AuthenticationHandlers, AuthenticationModuleOptions, AuthenticationOptionsFactory, AuthenticationResult, AuthenticationStorageContract, AuthenticationStorageRegisterOptions, AuthenticationStorageSources, CreatedMagicLink, CredentialProvider, Duration, EmailTokenPurpose, EmailTokenRecord, EmailTokenStore, EmailVerificationLink, EmailVerificationOptions, GeneratedApiKey, IssuedSession, IssueTokensOptions, JwksClientOptions, JwsAlgorithm, JwtBearerProviderOptions, JwtClaims, JwtSignerOptions, JwtVerifierOptions, MagicLink, MagicLinkAccount, MagicLinkOptions, MagicLinkRecord, MagicLinkRequest, MagicLinkStore, MfaOptions, MfaState, MfaStore, OAuthTokens, OidcOptions, OidcProfile, OidcProviderConfig, OidcRedirect, OidcRequest, OidcResolveContext, OidcStartOptions, OidcStateStore, OidcTransaction, PasswordHasherOptions, PasswordResetAccount, PasswordResetLink, PasswordResetOptions, PasswordResetResult, RefreshTokenOptions, RefreshTokenRecord, RefreshTokenStore, RegisterHandlerOptions, RegisterProviderOptions, ResetPasswordOptions, SessionOptions, SessionRecord, SessionStore, SignInOptions, TokenPair, TotpRecord, } from './interfaces/index.js';
+export { SessionCookieProvider } from './session/session-cookie.provider.js';
+export { InMemorySessionStore } from './session/in-memory-session.store.js';
+export { SessionService } from './session/session.service.js';
+export { SignInService } from './session/sign-in.service.js';
+export { PasswordHasher } from './services/index.js';
+export { InMemoryMfaStore } from './mfa/in-memory-mfa.store.js';
+export { MfaService } from './mfa/mfa.service.js';
+export { JwksClient } from './jwt/jwks.client.js';
+export { JwtBearerProvider } from './jwt/jwt-bearer.provider.js';
+export { JwtSigner } from './jwt/jwt-signer.service.js';
+export { JwtVerifier } from './jwt/jwt-verifier.service.js';
+export { InMemoryRefreshTokenStore } from './jwt/in-memory-refresh-token.store.js';
+export { TokenService } from './jwt/token.service.js';
+export { MagicLinkHandler } from './magic-link/magic-link.handler.js';
+export { MagicLinkService } from './magic-link/magic-link.service.js';
+export { InMemoryMagicLinkStore } from './magic-link/in-memory-magic-link.store.js';
+export { InMemoryEmailTokenStore } from './account/in-memory-email-token.store.js';
+export { EmailVerificationHandler } from './account/email-verification.handler.js';
+export { EmailVerificationService } from './account/email-verification.service.js';
+export { PasswordResetHandler } from './account/password-reset.handler.js';
+export { PasswordResetService } from './account/password-reset.service.js';
+export { OidcAccountResolver } from './oidc/oidc-account.resolver.js';
+export { OidcService } from './oidc/oidc.service.js';
+export { InMemoryOidcStateStore } from './oidc/in-memory-oidc-state.store.js';
+export { github, google, microsoft } from './oidc/oidc.presets.js';
+/**
+ * Augment once per app to type `@CurrentUser('key')`,
+ * `AuthenticationContext.user` and `AuthenticationContext.session`:
+ *
+ * @example
+ * declare module '@nestjs/authentication' {
+ *   interface AuthenticationTypes {
+ *     user: User;
+ *   }
+ * }
+ */
+export interface AuthenticationTypes {
+}

package/dist/index.js

@@ -0,0 +1,52 @@
+// Module
+export { AuthenticationModule } from './authentication.module.js';
+export { AUTHENTICATION_MODULE_OPTIONS } from './authentication.constants.js';
+// Registration: credential providers and feature handlers are providers of your modules that register here
+export { AuthenticationRegistry } from './services/index.js';
+// Storage: the contracts below are interfaces your providers implement, registered here
+export { AuthenticationStorage } from './storage/index.js';
+// Routes and the current user
+export { AuthenticationGuard } from './guards/index.js';
+export { Authenticate, CurrentSession, CurrentUser, Public } from './decorators/index.js';
+export { AuthenticationContext } from './context/index.js';
+export { WsAuthenticator } from './services/index.js';
+// Writing a credential provider
+export { AuthenticationProvider } from './providers/index.js';
+// API keys
+export { ApiKeyProvider } from './providers/index.js';
+// Errors: `AuthenticationError` is the base class of every error the package throws to apps
+export { AuthenticationError, JwtError, MagicLinkError, MfaAlreadyEnrolledError, RefreshTokenError, } from './errors/index.js';
+// Audit events (also on `nestjs:authentication:<type>` diagnostics channels)
+export { AuthenticationEvents, } from './events/index.js';
+// Sessions
+export { SessionCookieProvider } from './session/session-cookie.provider.js';
+export { InMemorySessionStore } from './session/in-memory-session.store.js';
+export { SessionService } from './session/session.service.js';
+export { SignInService } from './session/sign-in.service.js';
+// Passwords
+export { PasswordHasher } from './services/index.js';
+// Second factor (TOTP and recovery codes)
+export { InMemoryMfaStore } from './mfa/in-memory-mfa.store.js';
+export { MfaService } from './mfa/mfa.service.js';
+// JWTs, access and refresh tokens
+export { JwksClient } from './jwt/jwks.client.js';
+export { JwtBearerProvider } from './jwt/jwt-bearer.provider.js';
+export { JwtSigner } from './jwt/jwt-signer.service.js';
+export { JwtVerifier } from './jwt/jwt-verifier.service.js';
+export { InMemoryRefreshTokenStore } from './jwt/in-memory-refresh-token.store.js';
+export { TokenService } from './jwt/token.service.js';
+// Magic links
+export { MagicLinkHandler } from './magic-link/magic-link.handler.js';
+export { MagicLinkService } from './magic-link/magic-link.service.js';
+export { InMemoryMagicLinkStore } from './magic-link/in-memory-magic-link.store.js';
+// Password reset and email verification
+export { InMemoryEmailTokenStore } from './account/in-memory-email-token.store.js';
+export { EmailVerificationHandler } from './account/email-verification.handler.js';
+export { EmailVerificationService } from './account/email-verification.service.js';
+export { PasswordResetHandler } from './account/password-reset.handler.js';
+export { PasswordResetService } from './account/password-reset.service.js';
+// OAuth 2.0 / OpenID Connect
+export { OidcAccountResolver } from './oidc/oidc-account.resolver.js';
+export { OidcService } from './oidc/oidc.service.js';
+export { InMemoryOidcStateStore } from './oidc/in-memory-oidc-state.store.js';
+export { github, google, microsoft } from './oidc/oidc.presets.js';

package/dist/interceptors/authentication-scope.interceptor.d.ts

@@ -0,0 +1,20 @@
+import { type CallHandler, type ExecutionContext, type NestInterceptor } from '@nestjs/common';
+import { HttpAdapterHost } from '@nestjs/core';
+import { Observable } from 'rxjs';
+import { AuthenticationScope } from '../context/authentication-scope.service.js';
+/**
+ * @internal Opens the scope with what the guard recorded, around the
+ * subscription to `next.handle()`, not just the call: an inner interceptor
+ * may call its own `next.handle()` only when it is subscribed, and again per
+ * attempt (`@nestjs/resilience` retries), and the handler runs in the async
+ * context of that call. Subscribing inside `run()` covers every such call,
+ * pipes, the handler and everything they await. An `AuthenticationError`
+ * escaping the handler becomes the transport's error for its status (a 401,
+ * or a 409).
+ */
+export declare class AuthenticationScopeInterceptor implements NestInterceptor {
+    private readonly scope;
+    private readonly adapterHost;
+    constructor(scope: AuthenticationScope, adapterHost: HttpAdapterHost);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}

package/dist/interceptors/authentication-scope.interceptor.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@nestjs/common';
+import { HttpAdapterHost } from '@nestjs/core';
+import { catchError, from, mergeMap, Observable, throwError } from 'rxjs';
+import { getAuthState } from '../utils/auth-state.util.js';
+import { AuthenticationError } from '../errors/authentication.error.js';
+import { refusal } from '../utils/transport-errors.util.js';
+import { AuthenticationScope, runCall } from '../context/authentication-scope.service.js';
+/**
+ * @internal Opens the scope with what the guard recorded, around the
+ * subscription to `next.handle()`, not just the call: an inner interceptor
+ * may call its own `next.handle()` only when it is subscribed, and again per
+ * attempt (`@nestjs/resilience` retries), and the handler runs in the async
+ * context of that call. Subscribing inside `run()` covers every such call,
+ * pipes, the handler and everything they await. An `AuthenticationError`
+ * escaping the handler becomes the transport's error for its status (a 401,
+ * or a 409).
+ */
+let AuthenticationScopeInterceptor = class AuthenticationScopeInterceptor {
+    constructor(scope, adapterHost) {
+        this.scope = scope;
+        this.adapterHost = adapterHost;
+    }
+    intercept(context, next) {
+        const scope = { result: getAuthState(context) ?? null, context };
+        return new Observable((subscriber) => this.scope.run(scope, () => runCall(scope, () => next.handle().subscribe(subscriber)))).pipe(catchError((error) => {
+            if (!(error instanceof AuthenticationError)) {
+                return throwError(() => error);
+            }
+            const mapped = refusal(context, { status: error.status, message: error.message, code: error.code, cause: error }, { challenge: error.challenge, adapterHost: this.adapterHost });
+            return from(mapped).pipe(mergeMap((exception) => throwError(() => exception)));
+        }));
+    }
+};
+AuthenticationScopeInterceptor = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [AuthenticationScope,
+        HttpAdapterHost])
+], AuthenticationScopeInterceptor);
+export { AuthenticationScopeInterceptor };

package/dist/interceptors/index.d.ts

@@ -0,0 +1 @@
+export * from './authentication-scope.interceptor.js';

package/dist/interceptors/index.js

@@ -0,0 +1 @@
+export * from './authentication-scope.interceptor.js';

package/dist/interfaces/api-key.interface.d.ts

@@ -0,0 +1,41 @@
+export interface ApiKeyProviderOptions {
+    /**
+     * Starts every key, e.g. `cat` for `cat_<id>_<secret>`: 1-16 lowercase
+     * letters and digits, starting with a letter. Secret scanners find leaked
+     * keys by it; register it with yours (GitHub push protection, for one).
+     */
+    prefix: string;
+    /** `realm` in the `WWW-Authenticate` challenge. Default `api`. */
+    realm?: string;
+    /** Clock in epoch milliseconds, for tests. */
+    now?: () => number;
+}
+/** A new key, from `ApiKeyProvider.generate()`. */
+export interface GeneratedApiKey {
+    /** The whole key. Show it to its owner once, and store only `id` and `hash`. */
+    key: string;
+    /** The public part, which `findKey()` looks up: the key's row in your table. */
+    id: string;
+    /** SHA-256 of `key`, base64url. */
+    hash: string;
+}
+/** A key as your table has it, returned by `ApiKeyProvider.findKey()`. */
+export interface ApiKeyRecord<TUser> {
+    /** The `hash` that `generate()` returned. */
+    hash: string;
+    /** Who the key acts as. */
+    user: TUser;
+    /** Refused from this moment on. */
+    expiresAt?: Date | null;
+}
+/**
+ * `@CurrentSession()` and `AuthenticationContext.session` for a request
+ * signed in with an API key.
+ */
+export interface ApiKeySession {
+    /** Tells this session from a `SessionRecord` or `JwtClaims`. */
+    method: 'api-key';
+    /** The key's public id. */
+    keyId: string;
+    expiresAt?: Date;
+}

package/dist/interfaces/api-key.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/authenticate-options.interface.d.ts

@@ -0,0 +1,31 @@
+import type { ProviderClass } from '../providers/authentication.provider.js';
+export interface AuthenticateOptions {
+    /**
+     * Let anonymous callers through; `@CurrentUser()` is then `null`.
+     * Credentials that are present are still verified, and bad ones get a
+     * 401: silently ignoring an expired token would hide the signal to
+     * refresh it.
+     */
+    optional?: boolean;
+    /**
+     * Require a verified second factor (step-up): a session that completed
+     * MFA, or a JWT whose `amr` claim contains `mfa`, `otp` or `hwk`.
+     */
+    mfa?: boolean;
+    /**
+     * Require a user whose email address is verified: 403 `email_unverified`
+     * otherwise. Checked with `EmailVerificationHandler.isVerified(user)`, or
+     * `user.emailVerified === true` without a handler.
+     */
+    verifiedEmail?: boolean;
+    /**
+     * Only these providers may authenticate the route: classes, matched with
+     * `instanceof`, so a base class such as `SessionCookieProvider` covers its
+     * subclasses. Credentials of any other provider count as none.
+     */
+    providers?: ProviderClass[];
+}
+/** @internal What the guard reads: the class options, with the method's merged over them. */
+export interface RouteAuthentication extends AuthenticateOptions {
+    public?: boolean;
+}

package/dist/interfaces/authenticate-options.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/authentication-error-options.interface.d.ts

@@ -0,0 +1,8 @@
+export interface AuthenticationErrorOptions {
+    /** `WWW-Authenticate` challenge sent with the 401 over HTTP, e.g. `ApiKey header="x-api-key"`. */
+    challenge?: string;
+    /** Machine-readable reason, sent as the body's `error` field (`mfa_required`). */
+    code?: string;
+    /** The error behind this one, for logs. */
+    cause?: unknown;
+}

package/dist/interfaces/authentication-error-options.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/interfaces/authentication-module-options.interface.d.ts

@@ -0,0 +1,58 @@
+import type { EmailVerificationOptions } from './email-verification.interface.js';
+import type { PasswordResetOptions } from './password-reset.interface.js';
+import type { JwtSignerOptions } from './jwt-options.interface.js';
+import type { RefreshTokenOptions } from './refresh-token-options.interface.js';
+import type { MagicLinkOptions } from './magic-link.interface.js';
+import type { MfaOptions } from './mfa-options.interface.js';
+import type { OidcOptions } from './oidc.interface.js';
+import type { PasswordHasherOptions } from './password-hasher-options.interface.js';
+import type { SessionOptions } from './session.interface.js';
+/**
+ * Configuration values: what `forRoot()` takes, and what `forRootAsync()`'s
+ * factory returns. Injectable as `AUTHENTICATION_MODULE_OPTIONS`. Classes
+ * are never options: credential providers and feature handlers are
+ * providers of your own modules that register themselves with
+ * `AuthenticationRegistry`, and stores with `AuthenticationStorage`.
+ */
+export interface AuthenticationModuleOptions {
+    session?: SessionOptions;
+    password?: PasswordHasherOptions;
+    /** Enables TOTP enrollment. Requires `encryption`. */
+    mfa?: MfaOptions;
+    /** Goes with a registered `MagicLinkHandler` (`'magicLink'`): each fails at startup without the other. */
+    magicLink?: MagicLinkOptions;
+    /**
+     * The access tokens `TokenService` issues, and that `JwtBearerProvider`
+     * verifies unless it is given its own `key` or `jwks`.
+     */
+    accessToken?: JwtSignerOptions;
+    refreshToken?: RefreshTokenOptions;
+    /** Goes with a registered `OidcAccountResolver` (`'oidc'`): each fails at startup without the other. */
+    oidc?: OidcOptions;
+    /** Goes with a registered `PasswordResetHandler` (`'passwordReset'`): each fails at startup without the other. */
+    passwordReset?: PasswordResetOptions;
+    /** Goes with a registered `EmailVerificationHandler` (`'emailVerification'`): each fails at startup without the other. */
+    emailVerification?: EmailVerificationOptions;
+    /**
+     * Lets the app run in production while a contract it uses has no
+     * registered store, on the in-memory default (one instance, state lost on
+     * restart). Default `false`: startup fails, naming the contracts the
+     * configured features use without a store, and so does the first read of
+     * any other contract without one. Storage itself is never an option:
+     * providers register it with `AuthenticationStorage.registerSource()`.
+     */
+    allowInMemoryStorage?: boolean;
+}
+/** The two switches that decide what the module registers, at the top level of `forRoot()` and `forRootAsync()`. */
+export interface AuthenticationModuleExtras {
+    /** Default `true`. */
+    isGlobal?: boolean;
+    /** Registers `AuthenticationGuard` as a global guard. Default `true`. */
+    globalGuard?: boolean;
+}
+/** What `forRoot()` takes: the values, and the two switches. */
+export type AuthenticationModuleForRootOptions = AuthenticationModuleOptions & AuthenticationModuleExtras;
+/** What a `forRootAsync({ useClass })` or `useExisting` class implements. */
+export interface AuthenticationOptionsFactory {
+    createAuthenticationOptions(): AuthenticationModuleOptions | Promise<AuthenticationModuleOptions>;
+}

package/dist/interfaces/authentication-module-options.interface.js

@@ -0,0 +1 @@
+export {};