@nestjs/authentication 0.1.0 → 0.1.1

package/dist/account/password-reset.service.d.ts

@@ -1,4 +1,5 @@
 import { type OnModuleDestroy } from '@nestjs/common';
+import { AuthenticationScope } from '../context/authentication-scope.service.js';
 import { AuthenticationRegistry } from '../services/authentication-registry.service.js';
 import { AuthenticationStorage } from '../storage/authentication.storage.js';
 import { AuthenticationEvents } from '../events/authentication-events.service.js';
@@ -35,13 +36,14 @@ export declare class PasswordResetService implements OnModuleDestroy {
     private readonly tokens;
     private readonly signInService;
     private readonly events;
+    private readonly scope;
     private static readonly logger;
     private readonly options?;
     private readonly ttl;
     private readonly inFlight;
     constructor(storage: AuthenticationStorage, registry: AuthenticationRegistry, hasher: PasswordHasher, sessions: SessionService, tokens: TokenService, signInService: SignInService, options?: {
         passwordReset?: PasswordResetOptions;
-    }, events?: AuthenticationEvents);
+    }, events?: AuthenticationEvents, scope?: AuthenticationScope);
     /**
      * Starts a reset for `email`, if it belongs to an account: the link goes
      * to `PasswordResetHandler.send()`. Returns at once, before the account is
@@ -56,7 +58,11 @@ export declare class PasswordResetService implements OnModuleDestroy {
      * changed its address or password since the link was sent. `null` too,
      * before the token is looked up (so the link still works), for a password
      * `PasswordHasher` refuses: not a string, empty, or over 4 KiB. Check your
-     * own password rules before calling it.
+     * own password rules before calling it. With `signIn`, a request from
+     * another origin than the app's own and `session.trustedOrigins` gets a
+     * `ForbiddenException` first, as `SignInService.signIn()` does, so the link
+     * and the password stay as they were. Without `signIn`, the origin is not
+     * checked.
      */
     reset(token: string, password: string, { signIn }?: ResetPasswordOptions): Promise<PasswordResetResult | null>;
     onModuleDestroy(): Promise<void>;

package/dist/account/password-reset.service.js

@@ -12,6 +12,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 var PasswordResetService_1;
 import { Inject, Injectable, Logger, Optional } from '@nestjs/common';
+import { AuthenticationScope } from '../context/authentication-scope.service.js';
 import { AuthenticationRegistry } from '../services/authentication-registry.service.js';
 import { AuthenticationStorage } from '../storage/authentication.storage.js';
 import { AUTHENTICATION_MODULE_OPTIONS } from '../authentication.constants.js';
@@ -45,7 +46,7 @@ import { isMailableEmail, normalizeEmail } from './email.util.js';
  * the token: mail scanners and link previews follow GET links.
  */
 let PasswordResetService = PasswordResetService_1 = class PasswordResetService {
-    constructor(storage, registry, hasher, sessions, tokens, signInService, options, events = new AuthenticationEvents()) {
+    constructor(storage, registry, hasher, sessions, tokens, signInService, options, events = new AuthenticationEvents(), scope = new AuthenticationScope()) {
         this.storage = storage;
         this.registry = registry;
         this.hasher = hasher;
@@ -53,6 +54,7 @@ let PasswordResetService = PasswordResetService_1 = class PasswordResetService {
         this.tokens = tokens;
         this.signInService = signInService;
         this.events = events;
+        this.scope = scope;
         this.inFlight = new Set();
         this.options = options?.passwordReset;
         if (this.options) {
@@ -87,10 +89,19 @@ let PasswordResetService = PasswordResetService_1 = class PasswordResetService {
      * changed its address or password since the link was sent. `null` too,
      * before the token is looked up (so the link still works), for a password
      * `PasswordHasher` refuses: not a string, empty, or over 4 KiB. Check your
-     * own password rules before calling it.
+     * own password rules before calling it. With `signIn`, a request from
+     * another origin than the app's own and `session.trustedOrigins` gets a
+     * `ForbiddenException` first, as `SignInService.signIn()` does, so the link
+     * and the password stay as they were. Without `signIn`, the origin is not
+     * checked.
      */
     async reset(token, password, { signIn = false } = {}) {
         const { handler } = this.feature();
+        // Signing in would refuse this request at the end, after the link is spent and the password
+        // changed: refuse it before, whatever the token is.
+        if (signIn) {
+            this.signInService.refuseCrossOrigin(this.scope.exchange()?.request);
+        }
         if (typeof token !== 'string' || !TOKEN_PATTERN.test(token) || !isHashablePassword(password)) {
             return null;
         }
@@ -178,7 +189,8 @@ PasswordResetService = PasswordResetService_1 = __decorate([
         PasswordHasher,
         SessionService,
         TokenService,
-        SignInService, Object, AuthenticationEvents])
+        SignInService, Object, AuthenticationEvents,
+        AuthenticationScope])
 ], PasswordResetService);
 export { PasswordResetService };
 /**

package/dist/errors/magic-link.error.d.ts

@@ -1,9 +1,10 @@
 import { AuthenticationError } from './authentication.error.js';
 /**
  * A link was presented in a browser other than the one that requested it
- * (see `magicLink.bindToBrowser`). The one refusal `consume()` tells
- * apart: the customer can act on it (open the link where they asked for
- * it, or request a new one here), and it is decided before the link is
+ * (see `magicLink.bindToBrowser`), or in that browser after it requested
+ * five newer ones. The one refusal `consume()` tells apart: the customer
+ * can act on it (open the latest link where they asked for it, or request
+ * a new one here), and it is decided before the link is
  * looked up, so it reveals nothing about the token. Unknown, used, expired
  * and refused links share one answer, `null`.
  *

package/dist/errors/magic-link.error.js

@@ -1,9 +1,10 @@
 import { AuthenticationError } from './authentication.error.js';
 /**
  * A link was presented in a browser other than the one that requested it
- * (see `magicLink.bindToBrowser`). The one refusal `consume()` tells
- * apart: the customer can act on it (open the link where they asked for
- * it, or request a new one here), and it is decided before the link is
+ * (see `magicLink.bindToBrowser`), or in that browser after it requested
+ * five newer ones. The one refusal `consume()` tells apart: the customer
+ * can act on it (open the latest link where they asked for it, or request
+ * a new one here), and it is decided before the link is
  * looked up, so it reveals nothing about the token. Unknown, used, expired
  * and refused links share one answer, `null`.
  *
@@ -13,7 +14,7 @@ import { AuthenticationError } from './authentication.error.js';
  */
 export class MagicLinkError extends AuthenticationError {
     constructor() {
-        super('Open the link in the browser you requested it from, or request a new one here', { code: 'not_this_browser' });
+        super('Open the latest link in the browser you requested it from, or request a new one here', { code: 'not_this_browser' });
         /** Why the link was refused: the only reason apps are told. */
         this.reason = 'not-this-browser';
         this.name = 'MagicLinkError';

package/dist/interfaces/magic-link.interface.d.ts

@@ -23,7 +23,8 @@ export interface MagicLinkOptions {
      * Whether a link works only in the browser that requested it. Default
      * `true`: `create()` sets a transaction cookie, and `consume()` refuses a
      * link the browser holds no cookie for (`magic-link-refused`,
-     * `not-this-browser`). Without it, anyone can request a link for their
+     * `not-this-browser`). The cookie keeps the last five links the browser
+     * requested: a "resend" does not void the link before it. Without it, anyone can request a link for their
      * own address and get someone else to open it, which signs that person's
      * browser in to the attacker's account (login CSRF). `false` trades that
      * for links that work on another device than the one that asked for them

package/dist/interfaces/oidc.interface.d.ts

@@ -45,8 +45,16 @@ export interface OidcOptions extends OidcClientOptions {
      * The public URL of your callback route, the redirect URI you register
      * with each provider. `:provider` is replaced by the provider's name:
      * `https://app.example.com/auth/oidc/:provider/callback`.
+     *
+     * An app served under several domains passes a function of the request
+     * instead, called on the login and again on the callback: both must
+     * answer the same URL, or the provider refuses the code. Check the host
+     * against your own list of domains rather than echoing the header, and
+     * register every URL it can answer with each provider. The transaction
+     * cookie is bound to the host that set it, so a login finishes on the
+     * domain where it started.
      */
-    callbackUrl: string;
+    callbackUrl: string | ((request: OidcRequest) => string | Promise<string>);
     providers: Record<string, OidcProviderConfig>;
     /** Where to land after sign-in when the login had no `redirectTo`. Default `/`. */
     redirectAfterLogin?: string;

package/dist/magic-link/magic-link.service.d.ts

@@ -18,7 +18,9 @@ import type { MagicLinkOptions, MagicLinkRequest, CreatedMagicLink } from '../in
  * site's page must not start a link here), and sets an `HttpOnly`,
  * `SameSite=Lax` cookie, `__Host-magic_link_tx`, holding a secret that no
  * link carries; the store keys the link by the token and that secret
- * together, so `consume()` finds it only with the cookie. The `__Host-`
+ * together, so `consume()` finds it only with the cookie. The cookie holds
+ * the secrets of the last five links the browser requested, so a "resend"
+ * leaves the link before it usable there. The `__Host-`
  * prefix keeps sibling subdomains from planting one. So the link's page
  * must be on the same site as the API, as the session cookie requires
  * anyway, and a link forwarded to another browser or device, or read from
@@ -73,6 +75,7 @@ export declare class MagicLinkService {
     private feature;
     /** The generic answer: which refusal it was is told only by the event. */
     private refuse;
+    private pendingCookie;
     private txCookie;
     private setCookie;
     private now;

package/dist/magic-link/magic-link.service.js

@@ -37,6 +37,24 @@ function linkId(token, binding) {
 function hintOf(token) {
     return sha256(`nestjs-authentication magic-link hint ${token}`).slice(0, 12);
 }
+/**
+ * How many links a browser holds the secrets of: a "resend" leaves the
+ * links it requested before usable there, up to this many.
+ */
+const PENDING_LINKS = 5;
+const HINT_PATTERN = /^[\w-]{12}$/;
+/** The links in the cookie, newest first: `<hint>.<secret>`, joined by `~`. Anything else is dropped. */
+function readPending(value) {
+    return (value ?? '')
+        .split('~')
+        .map((pair) => pair.split('.'))
+        .filter(([hint, secret, ...rest]) => HINT_PATTERN.test(hint) && TOKEN_PATTERN.test(secret ?? '') && !rest.length)
+        .slice(0, PENDING_LINKS)
+        .map(([hint, secret]) => ({ hint, secret }));
+}
+function writePending(links) {
+    return links.map(({ hint, secret }) => `${hint}.${secret}`).join('~');
+}
 /**
  * Passwordless sign-in links: 256-bit single-use tokens, stored hashed,
  * short-lived, and bound to the browser that requested them.
@@ -49,7 +67,9 @@ function hintOf(token) {
  * site's page must not start a link here), and sets an `HttpOnly`,
  * `SameSite=Lax` cookie, `__Host-magic_link_tx`, holding a secret that no
  * link carries; the store keys the link by the token and that secret
- * together, so `consume()` finds it only with the cookie. The `__Host-`
+ * together, so `consume()` finds it only with the cookie. The cookie holds
+ * the secrets of the last five links the browser requested, so a "resend"
+ * leaves the link before it usable there. The `__Host-`
  * prefix keeps sibling subdomains from planting one. So the link's page
  * must be on the same site as the API, as the session cookie requires
  * anyway, and a link forwarded to another browser or device, or read from
@@ -106,7 +126,10 @@ let MagicLinkService = class MagicLinkService {
         });
         let cookie;
         if (binding) {
-            cookie = this.txCookie(`${hintOf(token)}.${binding}`, this.ttl / 1000);
+            // The links this browser requested before stay usable here, the oldest dropped past the cap.
+            const hint = hintOf(token);
+            const before = readPending(this.pendingCookie(this.scope.exchange()?.request)).filter((link) => link.hint !== hint);
+            cookie = this.txCookie(writePending([{ hint, secret: binding }, ...before].slice(0, PENDING_LINKS)), this.ttl / 1000);
             this.setCookie(cookie);
         }
         const url = new URL(options.url);
@@ -131,23 +154,27 @@ let MagicLinkService = class MagicLinkService {
             return this.refuse('unknown');
         }
         let binding;
+        let pending = [];
+        let link;
         if (this.bindToBrowser) {
-            const req = request ?? this.scope.exchange()?.request;
-            const [hint, secret] = (readCookie(firstHeader(req?.headers, 'cookie'), this.txCookieName) ?? '').split('.');
-            // The hint names the link this browser requested; anyone holding the link can compute it, so it
+            pending = readPending(this.pendingCookie(request ?? this.scope.exchange()?.request));
+            // The hint names a link this browser requested; anyone holding the link can compute it, so it
             // only tells a link opened elsewhere from a bad one. The secret, which no link carries, is what
             // the link is stored under: a leaked or forwarded link finds nothing without it. On a refusal
-            // here the cookie stays (it may be for a link this browser did request), and nothing is looked
+            // here the cookie stays (it holds the links this browser did request), and nothing is looked
             // up: a link was presented, not proved.
-            if (!hint || !secret || !TOKEN_PATTERN.test(secret) || !safeEqual(hint, hintOf(token))) {
+            const hint = hintOf(token);
+            link = pending.find((candidate) => safeEqual(candidate.hint, hint));
+            if (!link) {
                 this.events.emit({ type: 'magic-link-refused', reason: 'not-this-browser' });
                 throw new MagicLinkError();
             }
-            binding = secret;
+            binding = link.secret;
         }
         const record = await this.storage.magicLinks.consumeMagicLink(linkId(token, binding));
-        // This browser's link is settled either way: the cookie goes.
-        this.setCookie(this.txCookie('', 0));
+        // This link is settled either way: its secret goes, and the cookie with it when it held no other.
+        const rest = writePending(pending.filter((candidate) => candidate !== link));
+        this.setCookie(this.txCookie(rest, rest ? this.ttl / 1000 : 0));
         if (!record) {
             return this.refuse('unknown');
         }
@@ -185,6 +212,9 @@ let MagicLinkService = class MagicLinkService {
         this.events.emit({ type: 'magic-link-refused', reason, ...(email && { email }) });
         return null;
     }
+    pendingCookie(request) {
+        return readCookie(firstHeader(request?.headers, 'cookie'), this.txCookieName);
+    }
     txCookie(value, maxAge) {
         return serializeCookie(this.txCookieName, value, { ...this.options?.cookie, sameSite: 'lax', maxAge });
     }

package/dist/oidc/oidc.service.d.ts

@@ -82,6 +82,7 @@ export declare class OidcService {
     private feature;
     /** A fully signed-in session (second factor done, if any) on this request. */
     private currentSession;
+    /** `oidc.callbackUrl` for this request, with the provider's name in it. */
     private callbackUrl;
     private txCookie;
     private now;

package/dist/oidc/oidc.service.js

@@ -79,7 +79,9 @@ let OidcService = class OidcService {
         this.clients = new Map();
         this.options = options?.oidc;
         if (this.options) {
-            assertCallbackUrl(this.options.callbackUrl);
+            if (typeof this.options.callbackUrl !== 'function') {
+                assertCallbackUrl(this.options.callbackUrl);
+            }
             assertProviderCredentials(this.options.providers);
         }
         this.transactionTtl = durationOr(this.options?.transactionTtl, '10m');
@@ -120,7 +122,7 @@ let OidcService = class OidcService {
             linking = { userId: session.userId, sessionId: session.id };
         }
         const { url, transaction, binding } = await this.client(provider)
-            .authorizationRequest(this.callbackUrl(provider), safeRedirectPath(redirectTo), this.transactionTtl)
+            .authorizationRequest(await this.callbackUrl(provider, req), safeRedirectPath(redirectTo), this.transactionTtl)
             .catch(toHttp);
         await this.storage.oidcStates.saveOidcState({ ...transaction, ...(linking && { link: linking }) });
         return this.redirect(exchange?.response, url, [this.txCookie(binding, this.transactionTtl / 1000)]);
@@ -146,7 +148,10 @@ let OidcService = class OidcService {
         if (!transaction || transaction.provider !== provider || hasExpired(transaction.expiresAt, this.now())) {
             throw new BadRequestException('unknown or expired login');
         }
-        const result = await this.client(provider).callback(query, transaction, this.callbackUrl(provider)).catch(toHttp);
+        // Asked again rather than stored with the login: the cookie keeps the callback on the login's host,
+        // and a function that answers otherwise gets the code refused by the provider, not accepted.
+        const callbackUrl = await this.callbackUrl(provider, req);
+        const result = await this.client(provider).callback(query, transaction, callbackUrl).catch(toHttp);
         const location = transaction.redirectTo ?? options.redirectAfterLogin ?? '/';
         if (transaction.link) {
             // The session that asked to link must still be the one on this browser.
@@ -194,8 +199,14 @@ let OidcService = class OidcService {
         const session = await this.sessions.validate(this.sessions.tokenFrom(request));
         return session && session.mfa !== 'pending' ? session : null;
     }
-    callbackUrl(provider) {
-        return this.feature().options.callbackUrl.replaceAll(':provider', encodeURIComponent(provider));
+    /** `oidc.callbackUrl` for this request, with the provider's name in it. */
+    async callbackUrl(provider, request) {
+        const { callbackUrl } = this.feature().options;
+        const url = typeof callbackUrl === 'function' ? await callbackUrl(request) : callbackUrl;
+        if (typeof callbackUrl === 'function') {
+            assertCallbackUrl(url, 'the `oidc.callbackUrl` function must return');
+        }
+        return url.replaceAll(':provider', encodeURIComponent(provider));
     }
     txCookie(value, maxAge) {
         return serializeCookie(this.txCookieName, value, { ...this.options?.cookie, sameSite: 'lax', maxAge });
@@ -216,8 +227,11 @@ OidcService = __decorate([
         HttpAdapterHost])
 ], OidcService);
 export { OidcService };
-/** `oidc.callbackUrl`, checked at startup: an absolute http(s) URL. */
-function assertCallbackUrl(value) {
+/**
+ * `oidc.callbackUrl`, checked at startup (or each URL its function returns,
+ * when it returns it): an absolute http(s) URL.
+ */
+function assertCallbackUrl(value, must = '`oidc.callbackUrl` must be') {
     let url;
     try {
         url = typeof value === 'string' ? new URL(value.replaceAll(':provider', 'provider')) : undefined;
@@ -226,7 +240,7 @@ function assertCallbackUrl(value) {
         url = undefined;
     }
     if (!url || (url.protocol !== 'https:' && url.protocol !== 'http:')) {
-        throw new Error('OidcService: `oidc.callbackUrl` must be the absolute URL of your callback route, with `:provider` where the ' +
+        throw new Error(`OidcService: ${must} the absolute URL of your callback route, with \`:provider\` where the ` +
             `provider's name goes, e.g. 'https://app.example.com/auth/oidc/:provider/callback'. Got ${JSON.stringify(value)}.`);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/authentication",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Nest - modern, fast, powerful node.js web framework (@authentication)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -46,39 +46,39 @@
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-socket": "0.2.11",
     "@nestjs/apollo": "14.0.1",
-    "@nestjs/authorization": "0.0.1",
+    "@nestjs/authorization": "0.1.0",
     "@nestjs/common": "12.1.2",
     "@nestjs/core": "12.1.2",
     "@nestjs/drizzle": "0.0.1",
     "@nestjs/graphql": "14.0.1",
-    "@nestjs/idempotency": "0.0.1",
+    "@nestjs/idempotency": "0.0.2",
     "@nestjs/mail": "0.0.1",
     "@nestjs/microservices": "12.1.2",
     "@nestjs/platform-express": "12.1.2",
     "@nestjs/platform-fastify": "12.1.2",
     "@nestjs/platform-ws": "12.1.2",
-    "@nestjs/resilience": "0.0.1",
+    "@nestjs/resilience": "0.0.2",
     "@nestjs/testing": "12.1.2",
     "@nestjs/throttler": "6.7.1",
     "@nestjs/websockets": "12.1.2",
-    "@types/node": "24.19.1",
+    "@types/node": "24.19.2",
     "@types/pg": "8.23.1",
     "@types/supertest": "7.2.1",
     "@types/ws": "8.18.2",
-    "drizzle-orm": "0.45.3",
+    "drizzle-orm": "0.45.4",
     "graphql": "16.14.2",
     "husky": "9.1.7",
     "lint-staged": "17.6.0",
     "oxlint": "1.87.0",
     "pg": "8.23.1",
-    "prettier": "3.9.9",
+    "prettier": "3.9.10",
     "reflect-metadata": "0.2.2",
     "release-it": "21.1.1",
     "rxjs": "7.8.2",
     "supertest": "7.3.1",
     "typeorm": "1.1.2",
     "typescript": "7.0.2",
-    "vite": "8.3.3",
+    "vite": "8.3.4",
     "vitest": "5.0.3",
     "ws": "8.22.0"
   },