@nestjs/authentication 0.1.0 → 0.1.2

package/SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security issues to `support@nestjs.com` rather than in a public issue or pull request.
+
+A good report includes:
+
+- the version of `@nestjs/authentication` you found it in, and of Node.js,
+- the steps or a short script that reproduce it,
+- what an attacker could do with it.
+
+Please give us a chance to release a fix before you disclose the issue publicly.

package/dist/account/email-verification.service.d.ts

@@ -14,6 +14,7 @@ export declare class EmailVerificationService {
     private readonly storage;
     private readonly registry;
     private readonly events;
+    private static readonly logger;
     private readonly options?;
     private readonly ttl;
     constructor(storage: AuthenticationStorage, registry: AuthenticationRegistry, options?: {
@@ -34,7 +35,8 @@ export declare class EmailVerificationService {
      * Burns the token and asks `EmailVerificationHandler.markVerified()` to
      * record the address, if it is still the user's. Resolves the verified
      * address, or `null` for unknown, used or expired tokens and for an
-     * address the user has since changed.
+     * address the user has since changed. When `markVerified()` throws, the
+     * link works again until it expires, and the error is rethrown.
      */
     verify(token: string): Promise<{
         userId: string;

package/dist/account/email-verification.service.js

@@ -10,7 +10,8 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Inject, Injectable, Optional } from '@nestjs/common';
+var EmailVerificationService_1;
+import { Inject, Injectable, Logger, Optional } from '@nestjs/common';
 import { AuthenticationRegistry } from '../services/authentication-registry.service.js';
 import { AuthenticationStorage } from '../storage/authentication.storage.js';
 import { AUTHENTICATION_MODULE_OPTIONS } from '../authentication.constants.js';
@@ -26,7 +27,7 @@ import { requireUrlOption } from '../utils/options.util.js';
  * Point the link at a page that POSTs the token back: mail scanners and link
  * previews follow GET links, and would use it up.
  */
-let EmailVerificationService = class EmailVerificationService {
+let EmailVerificationService = EmailVerificationService_1 = class EmailVerificationService {
     constructor(storage, registry, options, events = new AuthenticationEvents()) {
         this.storage = storage;
         this.registry = registry;
@@ -70,7 +71,8 @@ let EmailVerificationService = class EmailVerificationService {
      * Burns the token and asks `EmailVerificationHandler.markVerified()` to
      * record the address, if it is still the user's. Resolves the verified
      * address, or `null` for unknown, used or expired tokens and for an
-     * address the user has since changed.
+     * address the user has since changed. When `markVerified()` throws, the
+     * link works again until it expires, and the error is rethrown.
      */
     async verify(token) {
         const { handler } = this.feature();
@@ -81,7 +83,17 @@ let EmailVerificationService = class EmailVerificationService {
         if (!record || hasExpired(record.expiresAt, this.now())) {
             return null;
         }
-        if (!(await handler.markVerified(record.userId, record.email))) {
+        let verified;
+        try {
+            verified = await handler.markVerified(record.userId, record.email);
+        }
+        catch (error) {
+            // Give the link back, so the user can try it again rather than ask for another email. Marking
+            // an address verified twice changes nothing, and one the user changed since gets `false`.
+            await this.storage.emailTokens.saveEmailToken(record).catch((saveError) => EmailVerificationService_1.logger.error('Could not give back an email verification link', saveError instanceof Error ? saveError.stack : saveError));
+            throw error;
+        }
+        if (!verified) {
             return null;
         }
         await this.storage.emailTokens.deleteUserEmailTokens(record.userId, 'email-verification');
@@ -101,7 +113,8 @@ let EmailVerificationService = class EmailVerificationService {
         return this.options?.now?.() ?? Date.now();
     }
 };
-EmailVerificationService = __decorate([
+EmailVerificationService.logger = new Logger('EmailVerificationService');
+EmailVerificationService = EmailVerificationService_1 = __decorate([
     Injectable(),
     __param(2, Optional()),
     __param(2, Inject(AUTHENTICATION_MODULE_OPTIONS)),

package/dist/account/password-reset.service.d.ts

@@ -1,4 +1,5 @@
 import { type OnModuleDestroy } from '@nestjs/common';
+import { AuthenticationScope } from '../context/authentication-scope.service.js';
 import { AuthenticationRegistry } from '../services/authentication-registry.service.js';
 import { AuthenticationStorage } from '../storage/authentication.storage.js';
 import { AuthenticationEvents } from '../events/authentication-events.service.js';
@@ -35,13 +36,14 @@ export declare class PasswordResetService implements OnModuleDestroy {
     private readonly tokens;
     private readonly signInService;
     private readonly events;
+    private readonly scope;
     private static readonly logger;
     private readonly options?;
     private readonly ttl;
     private readonly inFlight;
     constructor(storage: AuthenticationStorage, registry: AuthenticationRegistry, hasher: PasswordHasher, sessions: SessionService, tokens: TokenService, signInService: SignInService, options?: {
         passwordReset?: PasswordResetOptions;
-    }, events?: AuthenticationEvents);
+    }, events?: AuthenticationEvents, scope?: AuthenticationScope);
     /**
      * Starts a reset for `email`, if it belongs to an account: the link goes
      * to `PasswordResetHandler.send()`. Returns at once, before the account is
@@ -56,11 +58,22 @@ export declare class PasswordResetService implements OnModuleDestroy {
      * changed its address or password since the link was sent. `null` too,
      * before the token is looked up (so the link still works), for a password
      * `PasswordHasher` refuses: not a string, empty, or over 4 KiB. Check your
-     * own password rules before calling it.
+     * own password rules before calling it. With `signIn`, a request from
+     * another origin than the app's own and `session.trustedOrigins` gets a
+     * `ForbiddenException` first, as `SignInService.signIn()` does, so the link
+     * and the password stay as they were. Without `signIn`, the origin is not
+     * checked. When a step throws before the new password is stored (the
+     * lookup, the hash, ending sign-ins, `updatePassword()`), the link works
+     * again until it expires, and the error is rethrown.
      */
     reset(token: string, password: string, { signIn }?: ResetPasswordOptions): Promise<PasswordResetResult | null>;
     onModuleDestroy(): Promise<void>;
     private issue;
+    /**
+     * Checks the link's account and stores the new password's hash. `null` for an account that is gone
+     * or changed its address or password since the link was sent.
+     */
+    private setPassword;
     /** Ends every session and refresh-token family (with refresh tokens on) of the user. */
     private revokeSignIns;
     /** The options and the handler; the module refuses to start with one and not the other. */

package/dist/account/password-reset.service.js

@@ -12,6 +12,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 var PasswordResetService_1;
 import { Inject, Injectable, Logger, Optional } from '@nestjs/common';
+import { AuthenticationScope } from '../context/authentication-scope.service.js';
 import { AuthenticationRegistry } from '../services/authentication-registry.service.js';
 import { AuthenticationStorage } from '../storage/authentication.storage.js';
 import { AUTHENTICATION_MODULE_OPTIONS } from '../authentication.constants.js';
@@ -45,7 +46,7 @@ import { isMailableEmail, normalizeEmail } from './email.util.js';
  * the token: mail scanners and link previews follow GET links.
  */
 let PasswordResetService = PasswordResetService_1 = class PasswordResetService {
-    constructor(storage, registry, hasher, sessions, tokens, signInService, options, events = new AuthenticationEvents()) {
+    constructor(storage, registry, hasher, sessions, tokens, signInService, options, events = new AuthenticationEvents(), scope = new AuthenticationScope()) {
         this.storage = storage;
         this.registry = registry;
         this.hasher = hasher;
@@ -53,6 +54,7 @@ let PasswordResetService = PasswordResetService_1 = class PasswordResetService {
         this.tokens = tokens;
         this.signInService = signInService;
         this.events = events;
+        this.scope = scope;
         this.inFlight = new Set();
         this.options = options?.passwordReset;
         if (this.options) {
@@ -87,10 +89,21 @@ let PasswordResetService = PasswordResetService_1 = class PasswordResetService {
      * changed its address or password since the link was sent. `null` too,
      * before the token is looked up (so the link still works), for a password
      * `PasswordHasher` refuses: not a string, empty, or over 4 KiB. Check your
-     * own password rules before calling it.
+     * own password rules before calling it. With `signIn`, a request from
+     * another origin than the app's own and `session.trustedOrigins` gets a
+     * `ForbiddenException` first, as `SignInService.signIn()` does, so the link
+     * and the password stay as they were. Without `signIn`, the origin is not
+     * checked. When a step throws before the new password is stored (the
+     * lookup, the hash, ending sign-ins, `updatePassword()`), the link works
+     * again until it expires, and the error is rethrown.
      */
     async reset(token, password, { signIn = false } = {}) {
         const { handler } = this.feature();
+        // Signing in would refuse this request at the end, after the link is spent and the password
+        // changed: refuse it before, whatever the token is.
+        if (signIn) {
+            this.signInService.refuseCrossOrigin(this.scope.exchange()?.request);
+        }
         if (typeof token !== 'string' || !TOKEN_PATTERN.test(token) || !isHashablePassword(password)) {
             return null;
         }
@@ -98,20 +111,21 @@ let PasswordResetService = PasswordResetService_1 = class PasswordResetService {
         if (!record || hasExpired(record.expiresAt, this.now())) {
             return null;
         }
-        const found = await handler.findUser(normalizeEmail(record.email));
-        const account = found && checked(found);
-        if (!account ||
-            account.id !== record.userId ||
-            account.email !== record.email ||
-            !safeEqual(fingerprint(account.passwordHash), record.fingerprint ?? '')) {
+        let account;
+        try {
+            account = await this.setPassword(handler, record, password);
+        }
+        catch (error) {
+            // A step failed before the new password was stored, as far as this request can tell: give the
+            // link back, so the customer can try it again rather than ask for another email. Safe even if
+            // updatePassword() stored the hash and then threw: the link is bound to the fingerprint of the
+            // password it replaces, so once that changed, it sets nothing.
+            await this.storage.emailTokens.saveEmailToken(record).catch((saveError) => PasswordResetService_1.logger.error('Could not give back a password reset link', saveError instanceof Error ? saveError.stack : saveError));
+            throw error;
+        }
+        if (!account) {
             return null;
         }
-        const passwordHash = await this.hasher.hash(password);
-        // Sign-ins end before the new password is stored, so a store that fails leaves the old password
-        // without its sessions rather than the new one next to them; and again after, for any sign-in
-        // that started in between.
-        await this.revokeSignIns(account.id);
-        await handler.updatePassword(account.id, passwordHash);
         await this.storage.emailTokens.deleteUserEmailTokens(account.id, 'password-reset');
         await this.revokeSignIns(account.id);
         // The link reached the address, and the password is the owner's now.
@@ -150,6 +164,27 @@ let PasswordResetService = PasswordResetService_1 = class PasswordResetService {
         url.searchParams.set('token', token);
         await handler.send({ userId: account.id, email: account.email, url: url.toString(), expiresAt });
     }
+    /**
+     * Checks the link's account and stores the new password's hash. `null` for an account that is gone
+     * or changed its address or password since the link was sent.
+     */
+    async setPassword(handler, record, password) {
+        const found = await handler.findUser(normalizeEmail(record.email));
+        const account = found && checked(found);
+        if (!account ||
+            account.id !== record.userId ||
+            account.email !== record.email ||
+            !safeEqual(fingerprint(account.passwordHash), record.fingerprint ?? '')) {
+            return null;
+        }
+        const passwordHash = await this.hasher.hash(password);
+        // Sign-ins end before the new password is stored, so a store that fails leaves the old password
+        // without its sessions rather than the new one next to them; and again after, for any sign-in
+        // that started in between.
+        await this.revokeSignIns(account.id);
+        await handler.updatePassword(account.id, passwordHash);
+        return account;
+    }
     /** Ends every session and refresh-token family (with refresh tokens on) of the user. */
     async revokeSignIns(userId) {
         await this.sessions.revokeAll(userId);
@@ -178,7 +213,8 @@ PasswordResetService = PasswordResetService_1 = __decorate([
         PasswordHasher,
         SessionService,
         TokenService,
-        SignInService, Object, AuthenticationEvents])
+        SignInService, Object, AuthenticationEvents,
+        AuthenticationScope])
 ], PasswordResetService);
 export { PasswordResetService };
 /**

package/dist/errors/magic-link.error.d.ts

@@ -1,9 +1,10 @@
 import { AuthenticationError } from './authentication.error.js';
 /**
  * A link was presented in a browser other than the one that requested it
- * (see `magicLink.bindToBrowser`). The one refusal `consume()` tells
- * apart: the customer can act on it (open the link where they asked for
- * it, or request a new one here), and it is decided before the link is
+ * (see `magicLink.bindToBrowser`), or in that browser after it requested
+ * five newer ones. The one refusal `consume()` tells apart: the customer
+ * can act on it (open the latest link where they asked for it, or request
+ * a new one here), and it is decided before the link is
  * looked up, so it reveals nothing about the token. Unknown, used, expired
  * and refused links share one answer, `null`.
  *

package/dist/errors/magic-link.error.js

@@ -1,9 +1,10 @@
 import { AuthenticationError } from './authentication.error.js';
 /**
  * A link was presented in a browser other than the one that requested it
- * (see `magicLink.bindToBrowser`). The one refusal `consume()` tells
- * apart: the customer can act on it (open the link where they asked for
- * it, or request a new one here), and it is decided before the link is
+ * (see `magicLink.bindToBrowser`), or in that browser after it requested
+ * five newer ones. The one refusal `consume()` tells apart: the customer
+ * can act on it (open the latest link where they asked for it, or request
+ * a new one here), and it is decided before the link is
  * looked up, so it reveals nothing about the token. Unknown, used, expired
  * and refused links share one answer, `null`.
  *
@@ -13,7 +14,7 @@ import { AuthenticationError } from './authentication.error.js';
  */
 export class MagicLinkError extends AuthenticationError {
     constructor() {
-        super('Open the link in the browser you requested it from, or request a new one here', { code: 'not_this_browser' });
+        super('Open the latest link in the browser you requested it from, or request a new one here', { code: 'not_this_browser' });
         /** Why the link was refused: the only reason apps are told. */
         this.reason = 'not-this-browser';
         this.name = 'MagicLinkError';

package/dist/interfaces/email-token-store.interface.d.ts

@@ -37,7 +37,9 @@ export interface EmailTokenStore {
     /**
      * Saves a new token (a fresh random id: a plain insert), then keeps the
      * store bounded: deletes tokens whose `expiresAt` is at or before this
-     * one's `createdAt`, and past a cap, those that expire first.
+     * one's `createdAt`, and past a cap, those that expire first. The services
+     * also save back a record `consumeEmailToken()` just returned, when a step
+     * after it failed: its id is free again, so that is a plain insert too.
      */
     saveEmailToken(record: EmailTokenRecord): Promise<void>;
     /**

package/dist/interfaces/magic-link.interface.d.ts

@@ -23,7 +23,8 @@ export interface MagicLinkOptions {
      * Whether a link works only in the browser that requested it. Default
      * `true`: `create()` sets a transaction cookie, and `consume()` refuses a
      * link the browser holds no cookie for (`magic-link-refused`,
-     * `not-this-browser`). Without it, anyone can request a link for their
+     * `not-this-browser`). The cookie keeps the last five links the browser
+     * requested: a "resend" does not void the link before it. Without it, anyone can request a link for their
      * own address and get someone else to open it, which signs that person's
      * browser in to the attacker's account (login CSRF). `false` trades that
      * for links that work on another device than the one that asked for them

package/dist/interfaces/oidc.interface.d.ts

@@ -45,9 +45,37 @@ export interface OidcOptions extends OidcClientOptions {
      * The public URL of your callback route, the redirect URI you register
      * with each provider. `:provider` is replaced by the provider's name:
      * `https://app.example.com/auth/oidc/:provider/callback`.
+     *
+     * An app served under several domains passes a function of the request
+     * instead, called on the login and again on the callback: both must
+     * answer the same URL, or the provider refuses the code. Check the host
+     * against your own list of domains rather than echoing the header, and
+     * register every URL it can answer with each provider. The transaction
+     * cookie is bound to the host that set it, so a login finishes on the
+     * domain where it started.
      */
-    callbackUrl: string;
-    providers: Record<string, OidcProviderConfig>;
+    callbackUrl: string | ((request: OidcRequest) => string | Promise<string>);
+    /**
+     * The providers users can sign in with, by name: the `:provider` of your
+     * routes, and the `provider` of each profile they sign in with.
+     *
+     * Providers that aren't known at startup (one OIDC client per customer,
+     * created at runtime) come from a function of the name instead, called on
+     * the login and again on the callback: return the provider's config, or
+     * `undefined` (or `null`) for a name you don't serve, which answers 404.
+     * A rotated secret is used from the next call on. Each config it returns
+     * gets the checks the object form gets at startup. Caching your lookup is
+     * yours to do; discovery documents and key sets are cached by issuer and
+     * by URI, whatever the name.
+     *
+     * Identities are linked by (provider, subject), so a name must stand for
+     * one client of one provider: put the customer in the name (`acme`),
+     * rather than reusing one name for every customer's own provider. A
+     * provider a customer brings vouches for whatever addresses it likes, as
+     * verified ones too: link by email only to that customer's accounts, and
+     * check an issuer they enter against the providers you support.
+     */
+    providers: Record<string, OidcProviderConfig> | ((name: string) => OidcProviderConfig | null | undefined | Promise<OidcProviderConfig | null | undefined>);
     /** Where to land after sign-in when the login had no `redirectTo`. Default `/`. */
     redirectAfterLogin?: string;
     /** Lifetime of a login between the redirect to the provider and the callback. Default `'10m'`. */

package/dist/magic-link/magic-link.service.d.ts

@@ -18,7 +18,9 @@ import type { MagicLinkOptions, MagicLinkRequest, CreatedMagicLink } from '../in
  * site's page must not start a link here), and sets an `HttpOnly`,
  * `SameSite=Lax` cookie, `__Host-magic_link_tx`, holding a secret that no
  * link carries; the store keys the link by the token and that secret
- * together, so `consume()` finds it only with the cookie. The `__Host-`
+ * together, so `consume()` finds it only with the cookie. The cookie holds
+ * the secrets of the last five links the browser requested, so a "resend"
+ * leaves the link before it usable there. The `__Host-`
  * prefix keeps sibling subdomains from planting one. So the link's page
  * must be on the same site as the API, as the session cookie requires
  * anyway, and a link forwarded to another browser or device, or read from
@@ -62,7 +64,10 @@ export declare class MagicLinkService {
      * instead, before anything is looked up or burned: the module answers it
      * with a 401 that tells the customer where to open the link. Each
      * refusal is a `magic-link-refused` event with its reason. Outside an
-     * HTTP handler, pass the `request` that carries the cookie.
+     * HTTP handler, pass the `request` that carries the cookie. A request from
+     * another origin than the app's own and `session.trustedOrigins` gets a
+     * `ForbiddenException` first, as `SignInService.signIn()` does, so the
+     * link and the cookie stay as they were.
      */
     consume(token: string, { request }?: {
         request?: MagicLinkRequest;
@@ -73,6 +78,7 @@ export declare class MagicLinkService {
     private feature;
     /** The generic answer: which refusal it was is told only by the event. */
     private refuse;
+    private pendingCookie;
     private txCookie;
     private setCookie;
     private now;

package/dist/magic-link/magic-link.service.js

@@ -37,6 +37,24 @@ function linkId(token, binding) {
 function hintOf(token) {
     return sha256(`nestjs-authentication magic-link hint ${token}`).slice(0, 12);
 }
+/**
+ * How many links a browser holds the secrets of: a "resend" leaves the
+ * links it requested before usable there, up to this many.
+ */
+const PENDING_LINKS = 5;
+const HINT_PATTERN = /^[\w-]{12}$/;
+/** The links in the cookie, newest first: `<hint>.<secret>`, joined by `~`. Anything else is dropped. */
+function readPending(value) {
+    return (value ?? '')
+        .split('~')
+        .map((pair) => pair.split('.'))
+        .filter(([hint, secret, ...rest]) => HINT_PATTERN.test(hint) && TOKEN_PATTERN.test(secret ?? '') && !rest.length)
+        .slice(0, PENDING_LINKS)
+        .map(([hint, secret]) => ({ hint, secret }));
+}
+function writePending(links) {
+    return links.map(({ hint, secret }) => `${hint}.${secret}`).join('~');
+}
 /**
  * Passwordless sign-in links: 256-bit single-use tokens, stored hashed,
  * short-lived, and bound to the browser that requested them.
@@ -49,7 +67,9 @@ function hintOf(token) {
  * site's page must not start a link here), and sets an `HttpOnly`,
  * `SameSite=Lax` cookie, `__Host-magic_link_tx`, holding a secret that no
  * link carries; the store keys the link by the token and that secret
- * together, so `consume()` finds it only with the cookie. The `__Host-`
+ * together, so `consume()` finds it only with the cookie. The cookie holds
+ * the secrets of the last five links the browser requested, so a "resend"
+ * leaves the link before it usable there. The `__Host-`
  * prefix keeps sibling subdomains from planting one. So the link's page
  * must be on the same site as the API, as the session cookie requires
  * anyway, and a link forwarded to another browser or device, or read from
@@ -106,7 +126,10 @@ let MagicLinkService = class MagicLinkService {
         });
         let cookie;
         if (binding) {
-            cookie = this.txCookie(`${hintOf(token)}.${binding}`, this.ttl / 1000);
+            // The links this browser requested before stay usable here, the oldest dropped past the cap.
+            const hint = hintOf(token);
+            const before = readPending(this.pendingCookie(this.scope.exchange()?.request)).filter((link) => link.hint !== hint);
+            cookie = this.txCookie(writePending([{ hint, secret: binding }, ...before].slice(0, PENDING_LINKS)), this.ttl / 1000);
             this.setCookie(cookie);
         }
         const url = new URL(options.url);
@@ -123,31 +146,41 @@ let MagicLinkService = class MagicLinkService {
      * instead, before anything is looked up or burned: the module answers it
      * with a 401 that tells the customer where to open the link. Each
      * refusal is a `magic-link-refused` event with its reason. Outside an
-     * HTTP handler, pass the `request` that carries the cookie.
+     * HTTP handler, pass the `request` that carries the cookie. A request from
+     * another origin than the app's own and `session.trustedOrigins` gets a
+     * `ForbiddenException` first, as `SignInService.signIn()` does, so the
+     * link and the cookie stay as they were.
      */
     async consume(token, { request } = {}) {
         const { handler } = this.feature();
+        // Signing in would refuse this request at the end, after the link is spent and the cookie
+        // settled: refuse it before, whatever the token is.
+        this.signIn.refuseCrossOrigin(this.scope.exchange()?.request);
         if (typeof token !== 'string' || !TOKEN_PATTERN.test(token)) {
             return this.refuse('unknown');
         }
         let binding;
+        let pending = [];
+        let link;
         if (this.bindToBrowser) {
-            const req = request ?? this.scope.exchange()?.request;
-            const [hint, secret] = (readCookie(firstHeader(req?.headers, 'cookie'), this.txCookieName) ?? '').split('.');
-            // The hint names the link this browser requested; anyone holding the link can compute it, so it
+            pending = readPending(this.pendingCookie(request ?? this.scope.exchange()?.request));
+            // The hint names a link this browser requested; anyone holding the link can compute it, so it
             // only tells a link opened elsewhere from a bad one. The secret, which no link carries, is what
             // the link is stored under: a leaked or forwarded link finds nothing without it. On a refusal
-            // here the cookie stays (it may be for a link this browser did request), and nothing is looked
+            // here the cookie stays (it holds the links this browser did request), and nothing is looked
             // up: a link was presented, not proved.
-            if (!hint || !secret || !TOKEN_PATTERN.test(secret) || !safeEqual(hint, hintOf(token))) {
+            const hint = hintOf(token);
+            link = pending.find((candidate) => safeEqual(candidate.hint, hint));
+            if (!link) {
                 this.events.emit({ type: 'magic-link-refused', reason: 'not-this-browser' });
                 throw new MagicLinkError();
             }
-            binding = secret;
+            binding = link.secret;
         }
         const record = await this.storage.magicLinks.consumeMagicLink(linkId(token, binding));
-        // This browser's link is settled either way: the cookie goes.
-        this.setCookie(this.txCookie('', 0));
+        // This link is settled either way: its secret goes, and the cookie with it when it held no other.
+        const rest = writePending(pending.filter((candidate) => candidate !== link));
+        this.setCookie(this.txCookie(rest, rest ? this.ttl / 1000 : 0));
         if (!record) {
             return this.refuse('unknown');
         }
@@ -185,6 +218,9 @@ let MagicLinkService = class MagicLinkService {
         this.events.emit({ type: 'magic-link-refused', reason, ...(email && { email }) });
         return null;
     }
+    pendingCookie(request) {
+        return readCookie(firstHeader(request?.headers, 'cookie'), this.txCookieName);
+    }
     txCookie(value, maxAge) {
         return serializeCookie(this.txCookieName, value, { ...this.options?.cookie, sameSite: 'lax', maxAge });
     }

package/dist/oidc/oidc.client.d.ts

@@ -1,5 +1,32 @@
+import { JwksClient } from '../jwt/jwks.client.js';
 import type { OAuthTokens, OidcProfile, OidcProviderConfig } from '../interfaces/oidc-provider.interface.js';
 import type { OidcTransaction, OidcClientOptions } from '../interfaces/oidc.interface.js';
+interface Endpoints {
+    issuer?: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    authorization_response_iss_parameter_supported?: boolean;
+}
+/**
+ * What the clients of one `OidcService` share: discovery documents, by
+ * issuer, and key sets, by URI. Neither depends on the client id or secret,
+ * so a client made anew for each login (`oidc.providers` as a function)
+ * still fetches them once per TTL, and the key set's cooldown still holds.
+ */
+export declare class OidcMetadataCache {
+    private readonly options;
+    private readonly documents;
+    private readonly keySets;
+    constructor(options?: OidcClientOptions);
+    /** The discovery document of `issuer`, as published: the endpoints a config overrides are its own to merge. */
+    document(issuer: string): Promise<Endpoints>;
+    /** The key set at `uri`, an https URL. */
+    jwks(uri: string): JwksClient;
+    private discover;
+    private now;
+}
 /**
  * One OAuth 2.0 / OpenID Connect provider: authorization code flow with
  * PKCE (S256), `state` and `nonce`.
@@ -13,10 +40,9 @@ export declare class OidcClient {
     readonly name: string;
     private readonly config;
     private readonly options;
-    private discovery?;
-    private jwks?;
+    private readonly metadata;
     readonly kind: 'oidc' | 'oauth2';
-    constructor(name: string, config: OidcProviderConfig, options?: OidcClientOptions);
+    constructor(name: string, config: OidcProviderConfig, options?: OidcClientOptions, metadata?: OidcMetadataCache);
     /**
      * The provider's authorization URL, the transaction to store, and the
      * browser binding for the transaction cookie. `state` is the SHA-256 of
@@ -37,8 +63,8 @@ export declare class OidcClient {
     private verifyIdToken;
     private exchange;
     private endpoints;
-    private discover;
     private getJson;
     private request;
     private now;
 }
+export {};

package/dist/oidc/oidc.client.js

@@ -8,8 +8,10 @@ import { OidcError } from '../errors/oidc.error.js';
 const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
 /**
  * Only https, except loopback http (local IdPs and tests). The URLs come from the provider's
- * discovery document or the app's configuration, never from the user: a bad one is a
- * misconfiguration (`unavailable`, a 502), not a failed sign-in.
+ * discovery document or the app's configuration, never from the request: a bad one is a
+ * misconfiguration (`unavailable`, a 502), not a failed sign-in. Nor does this keep a fetch off
+ * the app's own network: an issuer that customers enter themselves is the app's to check
+ * against the providers it supports, before it stores it.
  */
 function assertSecureUrl(value, what) {
     let url;
@@ -24,6 +26,66 @@ function assertSecureUrl(value, what) {
     }
     return url.toString();
 }
+/** A request to the provider: no redirects, a 10 s timeout, and a network failure as an outage. */
+async function send(options, url, init) {
+    try {
+        return await (options.fetch ?? fetch)(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(10_000) });
+    }
+    catch (error) {
+        throw new OidcError(`${new URL(url).host} is unreachable (${error.message})`, 'unavailable');
+    }
+}
+/**
+ * What the clients of one `OidcService` share: discovery documents, by
+ * issuer, and key sets, by URI. Neither depends on the client id or secret,
+ * so a client made anew for each login (`oidc.providers` as a function)
+ * still fetches them once per TTL, and the key set's cooldown still holds.
+ */
+export class OidcMetadataCache {
+    constructor(options = {}) {
+        this.options = options;
+        this.documents = new Map();
+        this.keySets = new Map();
+    }
+    /** The discovery document of `issuer`, as published: the endpoints a config overrides are its own to merge. */
+    document(issuer) {
+        const ttl = durationOr(this.options.discoveryTtl, '1h');
+        let cached = this.documents.get(issuer);
+        if (!cached || this.now() - cached.at >= ttl) {
+            const entry = { value: this.discover(issuer), at: this.now() };
+            this.documents.set(issuer, entry);
+            // Retry next time, unless a later fetch has taken its place.
+            entry.value.catch(() => this.documents.get(issuer) === entry && this.documents.delete(issuer));
+            cached = entry;
+        }
+        return cached.value;
+    }
+    /** The key set at `uri`, an https URL. */
+    jwks(uri) {
+        let jwks = this.keySets.get(uri);
+        if (!jwks) {
+            jwks = new JwksClient(uri, { ...this.options.jwks, fetch: this.options.fetch, now: this.options.now });
+            this.keySets.set(uri, jwks);
+        }
+        return jwks;
+    }
+    async discover(issuer) {
+        const url = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
+        const response = await send(this.options, assertSecureUrl(url, 'issuer'), { headers: { accept: 'application/json' } });
+        if (!response.ok) {
+            throw new OidcError(`discovery failed (${response.status})`, 'unavailable');
+        }
+        const doc = (await response.json().catch(() => ({})));
+        // OIDC Discovery §4.3: the document must name exactly the issuer we asked.
+        if (doc.issuer !== issuer) {
+            throw new OidcError('discovery issuer mismatch', 'unavailable');
+        }
+        return doc;
+    }
+    now() {
+        return this.options.now?.() ?? Date.now();
+    }
+}
 /**
  * One OAuth 2.0 / OpenID Connect provider: authorization code flow with
  * PKCE (S256), `state` and `nonce`.
@@ -34,10 +96,11 @@ function assertSecureUrl(value, what) {
  * userinfo's `sub` matches the ID token's (OIDC Core §5.3.2).
  */
 export class OidcClient {
-    constructor(name, config, options = {}) {
+    constructor(name, config, options = {}, metadata = new OidcMetadataCache(options)) {
         this.name = name;
         this.config = config;
         this.options = options;
+        this.metadata = metadata;
         this.kind = config.kind ?? 'oidc';
         if (this.kind === 'oidc' && !config.issuer) {
             throw new Error(`OIDC provider '${name}' needs an issuer`);
@@ -138,13 +201,8 @@ export class OidcClient {
         };
     }
     async verifyIdToken(endpoints, idToken, nonce) {
-        this.jwks ??= new JwksClient(assertSecureUrl(endpoints.jwks_uri, 'jwks_uri'), {
-            ...this.options.jwks,
-            fetch: this.options.fetch,
-            now: this.options.now,
-        });
         const verifier = new JwtVerifier({
-            jwks: this.jwks,
+            jwks: this.metadata.jwks(assertSecureUrl(endpoints.jwks_uri, 'jwks_uri')),
             algorithms: this.config.idTokenAlgorithms ?? ['RS256', 'ES256'],
             issuer: endpoints.issuer,
             audience: this.config.clientId,
@@ -229,26 +287,7 @@ export class OidcClient {
                 }),
             };
         }
-        const ttl = durationOr(this.options.discoveryTtl, '1h');
-        if (!this.discovery || this.now() - this.discovery.at >= ttl) {
-            const value = this.discover();
-            this.discovery = { value, at: this.now() };
-            value.catch(() => (this.discovery = undefined)); // retry next time
-        }
-        return this.discovery.value;
-    }
-    async discover() {
-        const issuer = this.config.issuer;
-        const url = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
-        const response = await this.request(assertSecureUrl(url, 'issuer'), { headers: { accept: 'application/json' } });
-        if (!response.ok) {
-            throw new OidcError(`discovery failed (${response.status})`, 'unavailable');
-        }
-        const doc = (await response.json().catch(() => ({})));
-        // OIDC Discovery §4.3: the document must name exactly the issuer we asked.
-        if (doc.issuer !== issuer) {
-            throw new OidcError('discovery issuer mismatch', 'unavailable');
-        }
+        const doc = await this.metadata.document(this.config.issuer);
         return {
             ...doc,
             authorization_endpoint: assertSecureUrl(this.config.authorizationEndpoint ?? doc.authorization_endpoint, 'authorization_endpoint'),
@@ -272,13 +311,8 @@ export class OidcClient {
         }
         return response.json();
     }
-    async request(url, init) {
-        try {
-            return await (this.options.fetch ?? fetch)(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(10_000) });
-        }
-        catch (error) {
-            throw new OidcError(`${new URL(url).host} is unreachable (${error.message})`, 'unavailable');
-        }
+    request(url, init) {
+        return send(this.options, url, init);
     }
     now() {
         return this.options.now?.() ?? Date.now();

package/dist/oidc/oidc.service.d.ts

@@ -5,7 +5,6 @@ import { AuthenticationStorage } from '../storage/authentication.storage.js';
 import { SessionService } from '../session/session.service.js';
 import { SignInService } from '../session/sign-in.service.js';
 import type { OidcOptions, OidcRequest, OidcRedirect, OidcStartOptions } from '../interfaces/oidc.interface.js';
-import { OidcClient } from './oidc.client.js';
 /**
  * OpenID Connect sign-in, behind two routes of your own: a login route that
  * redirects to the provider, and the callback route it sends the browser
@@ -53,14 +52,13 @@ export declare class OidcService {
     private readonly sessions;
     private readonly scope;
     private readonly adapterHost?;
-    private readonly clients;
+    private readonly metadata;
     private readonly options?;
     private readonly transactionTtl;
     private readonly txCookieName;
     constructor(storage: AuthenticationStorage, registry: AuthenticationRegistry, signIn: SignInService, sessions: SessionService, options?: {
         oidc?: OidcOptions;
     }, scope?: AuthenticationScope, adapterHost?: HttpAdapterHost | undefined);
-    client(name: string): OidcClient;
     /**
      * Starts a login: stores the transaction, sets its cookie, and returns
      * the provider's authorization URL. 404 for a provider that isn't
@@ -82,6 +80,14 @@ export declare class OidcService {
     private feature;
     /** A fully signed-in session (second factor done, if any) on this request. */
     private currentSession;
+    /**
+     * The client of the provider named `name`, made for this call from its
+     * config: a secret the `oidc.providers` function rotates is the one the
+     * next call uses. 404 for a provider that isn't configured, or that the
+     * function doesn't serve.
+     */
+    private client;
+    /** `oidc.callbackUrl` for this request, with the provider's name in it. */
     private callbackUrl;
     private txCookie;
     private now;

package/dist/oidc/oidc.service.js

@@ -23,7 +23,7 @@ import { defaultCookieName, readCookie, serializeCookie } from '../session/cooki
 import { SessionService } from '../session/session.service.js';
 import { SignInService } from '../session/sign-in.service.js';
 import { OidcError } from '../errors/oidc.error.js';
-import { OidcClient } from './oidc.client.js';
+import { OidcClient, OidcMetadataCache } from './oidc.client.js';
 const header = (headers, name) => {
     const value = headers[name];
     return Array.isArray(value) ? value[0] : value;
@@ -76,28 +76,19 @@ let OidcService = class OidcService {
         this.sessions = sessions;
         this.scope = scope;
         this.adapterHost = adapterHost;
-        this.clients = new Map();
         this.options = options?.oidc;
         if (this.options) {
-            assertCallbackUrl(this.options.callbackUrl);
-            assertProviderCredentials(this.options.providers);
+            if (typeof this.options.callbackUrl !== 'function') {
+                assertCallbackUrl(this.options.callbackUrl);
+            }
+            if (typeof this.options.providers !== 'function') {
+                assertProviderCredentials(this.options.providers);
+            }
         }
+        this.metadata = new OidcMetadataCache(this.options);
         this.transactionTtl = durationOr(this.options?.transactionTtl, '10m');
         this.txCookieName = defaultCookieName('oidc_tx', this.options?.cookie);
     }
-    client(name) {
-        const { options } = this.feature();
-        const config = Object.hasOwn(options.providers, name) ? options.providers[name] : undefined;
-        if (!config) {
-            throw new NotFoundException();
-        }
-        let client = this.clients.get(name);
-        if (!client) {
-            client = new OidcClient(name, config, options);
-            this.clients.set(name, client);
-        }
-        return client;
-    }
     /**
      * Starts a login: stores the transaction, sets its cookie, and returns
      * the provider's authorization URL. 404 for a provider that isn't
@@ -119,8 +110,9 @@ let OidcService = class OidcService {
             }
             linking = { userId: session.userId, sessionId: session.id };
         }
-        const { url, transaction, binding } = await this.client(provider)
-            .authorizationRequest(this.callbackUrl(provider), safeRedirectPath(redirectTo), this.transactionTtl)
+        const client = await this.client(provider);
+        const { url, transaction, binding } = await client
+            .authorizationRequest(await this.callbackUrl(provider, req), safeRedirectPath(redirectTo), this.transactionTtl)
             .catch(toHttp);
         await this.storage.oidcStates.saveOidcState({ ...transaction, ...(linking && { link: linking }) });
         return this.redirect(exchange?.response, url, [this.txCookie(binding, this.transactionTtl / 1000)]);
@@ -146,7 +138,11 @@ let OidcService = class OidcService {
         if (!transaction || transaction.provider !== provider || hasExpired(transaction.expiresAt, this.now())) {
             throw new BadRequestException('unknown or expired login');
         }
-        const result = await this.client(provider).callback(query, transaction, this.callbackUrl(provider)).catch(toHttp);
+        // Asked again rather than stored with the login: the cookie keeps the callback on the login's host,
+        // and a function that answers otherwise gets the code refused by the provider, not accepted.
+        const callbackUrl = await this.callbackUrl(provider, req);
+        const client = await this.client(provider);
+        const result = await client.callback(query, transaction, callbackUrl).catch(toHttp);
         const location = transaction.redirectTo ?? options.redirectAfterLogin ?? '/';
         if (transaction.link) {
             // The session that asked to link must still be the one on this browser.
@@ -194,8 +190,37 @@ let OidcService = class OidcService {
         const session = await this.sessions.validate(this.sessions.tokenFrom(request));
         return session && session.mfa !== 'pending' ? session : null;
     }
-    callbackUrl(provider) {
-        return this.feature().options.callbackUrl.replaceAll(':provider', encodeURIComponent(provider));
+    /**
+     * The client of the provider named `name`, made for this call from its
+     * config: a secret the `oidc.providers` function rotates is the one the
+     * next call uses. 404 for a provider that isn't configured, or that the
+     * function doesn't serve.
+     */
+    async client(name) {
+        const { providers } = this.feature().options;
+        let config;
+        if (typeof providers === 'function') {
+            config = await providers(name);
+            if (config) {
+                assertResolvedCredentials(name, config);
+            }
+        }
+        else {
+            config = Object.hasOwn(providers, name) ? providers[name] : undefined;
+        }
+        if (!config) {
+            throw new NotFoundException();
+        }
+        return new OidcClient(name, config, this.options, this.metadata);
+    }
+    /** `oidc.callbackUrl` for this request, with the provider's name in it. */
+    async callbackUrl(provider, request) {
+        const { callbackUrl } = this.feature().options;
+        const url = typeof callbackUrl === 'function' ? await callbackUrl(request) : callbackUrl;
+        if (typeof callbackUrl === 'function') {
+            assertCallbackUrl(url, 'the `oidc.callbackUrl` function must return');
+        }
+        return url.replaceAll(':provider', encodeURIComponent(provider));
     }
     txCookie(value, maxAge) {
         return serializeCookie(this.txCookieName, value, { ...this.options?.cookie, sameSite: 'lax', maxAge });
@@ -216,8 +241,11 @@ OidcService = __decorate([
         HttpAdapterHost])
 ], OidcService);
 export { OidcService };
-/** `oidc.callbackUrl`, checked at startup: an absolute http(s) URL. */
-function assertCallbackUrl(value) {
+/**
+ * `oidc.callbackUrl`, checked at startup (or each URL its function returns,
+ * when it returns it): an absolute http(s) URL.
+ */
+function assertCallbackUrl(value, must = '`oidc.callbackUrl` must be') {
     let url;
     try {
         url = typeof value === 'string' ? new URL(value.replaceAll(':provider', 'provider')) : undefined;
@@ -226,10 +254,14 @@ function assertCallbackUrl(value) {
         url = undefined;
     }
     if (!url || (url.protocol !== 'https:' && url.protocol !== 'http:')) {
-        throw new Error('OidcService: `oidc.callbackUrl` must be the absolute URL of your callback route, with `:provider` where the ' +
+        throw new Error(`OidcService: ${must} the absolute URL of your callback route, with \`:provider\` where the ` +
             `provider's name goes, e.g. 'https://app.example.com/auth/oidc/:provider/callback'. Got ${JSON.stringify(value)}.`);
     }
 }
+const CREDENTIALS = {
+    clientId: 'the client id the provider issued',
+    clientSecret: "the client secret the provider issued; a public client sets `tokenEndpointAuthMethod: 'none'` instead",
+};
 /**
  * `oidc.providers.<name>.clientId`, and `clientSecret` unless the provider
  * is a public client (`tokenEndpointAuthMethod: 'none'`), checked at
@@ -237,11 +269,20 @@ function assertCallbackUrl(value) {
  * confidential client into a public one, and fail at the token exchange.
  */
 function assertProviderCredentials(providers) {
-    requireOption(providers, 'oidc.providers', 'the providers users can sign in with, by name');
+    requireOption(providers, 'oidc.providers', 'the providers users can sign in with, by name, or a function of the name');
     for (const [name, config] of Object.entries(providers)) {
-        requireOption(config?.clientId, `oidc.providers.${name}.clientId`, 'the client id the provider issued');
+        requireOption(config?.clientId, `oidc.providers.${name}.clientId`, CREDENTIALS.clientId);
         if (config.tokenEndpointAuthMethod !== 'none') {
-            requireOption(config.clientSecret, `oidc.providers.${name}.clientSecret`, "the client secret the provider issued; a public client sets `tokenEndpointAuthMethod: 'none'` instead");
+            requireOption(config.clientSecret, `oidc.providers.${name}.clientSecret`, CREDENTIALS.clientSecret);
+        }
+    }
+}
+/** The same checks, on each config the `oidc.providers` function returns. */
+function assertResolvedCredentials(name, config) {
+    for (const key of ['clientId', 'clientSecret']) {
+        if (!config[key] && (key === 'clientId' || config.tokenEndpointAuthMethod !== 'none')) {
+            throw new Error(`OidcService: the \`oidc.providers\` function returned the provider '${name}' without its \`${key}\` ` +
+                `(${CREDENTIALS[key]}).`);
         }
     }
 }

package/dist/services/password-hasher.service.d.ts

@@ -14,7 +14,9 @@ export declare function isHashablePassword(password: unknown): password is strin
  * The encoded hash is self-describing (`$scrypt$ln=17,r=8,p=1$salt$hash`),
  * so parameters can be raised later: `verify()` reads the parameters from
  * the stored hash and `needsRehash()` tells the sign-in code to store a
- * fresh hash while it has the plaintext.
+ * fresh hash while it has the plaintext. Until then, `verify()` makes up the
+ * work an older, cheaper hash saves, so it answers no sooner than for an
+ * unknown user.
  *
  * Passwords are NFKC-normalised (NIST SP 800-63B §5.1.1.2) so the same
  * password typed on different keyboards verifies. `hash()` refuses an empty
@@ -37,6 +39,11 @@ export declare class PasswordHasher {
      * is checked instead, so response time does not reveal which accounts
      * exist. The first such call makes the dummy hash, which costs the same
      * one derivation as every later check.
+     *
+     * A hash stored before the cost was raised is cheaper to check than the
+     * dummy, so its check is topped up to the configured work, right password
+     * or wrong. One stored before the cost was lowered takes its longer time
+     * until it is rehashed: that can't be hidden.
      */
     verify(password: string, encoded: string | null | undefined): Promise<boolean>;
     /** `true` when the stored hash uses weaker or different parameters than configured. */

package/dist/services/password-hasher.service.js

@@ -8,6 +8,8 @@ function scrypt(password, salt, keyLength, { logN, r, p }) {
     return new Promise((resolve, reject) => scryptCb(password, salt, keyLength, options, (err, key) => (err ? reject(err) : resolve(key))));
 }
 const b64 = (buf) => buf.toString('base64').replace(/=+$/, '');
+/** What a derivation costs: N·r·p, since OpenSSL runs the `p` lanes one after another. */
+const work = ({ logN, r, p }) => 2 ** logN * r * p;
 /**
  * @internal The bytes `PasswordHasher` derives from: the password NFKC-normalised, as UTF-8. Throws
  * for anything but a string, for an empty one (which no account should have), and past 4 KiB,
@@ -48,7 +50,9 @@ export function isHashablePassword(password) {
  * The encoded hash is self-describing (`$scrypt$ln=17,r=8,p=1$salt$hash`),
  * so parameters can be raised later: `verify()` reads the parameters from
  * the stored hash and `needsRehash()` tells the sign-in code to store a
- * fresh hash while it has the plaintext.
+ * fresh hash while it has the plaintext. Until then, `verify()` makes up the
+ * work an older, cheaper hash saves, so it answers no sooner than for an
+ * unknown user.
  *
  * Passwords are NFKC-normalised (NIST SP 800-63B §5.1.1.2) so the same
  * password typed on different keyboards verifies. `hash()` refuses an empty
@@ -86,6 +90,11 @@ export class PasswordHasher {
      * is checked instead, so response time does not reveal which accounts
      * exist. The first such call makes the dummy hash, which costs the same
      * one derivation as every later check.
+     *
+     * A hash stored before the cost was raised is cheaper to check than the
+     * dummy, so its check is topped up to the configured work, right password
+     * or wrong. One stored before the cost was lowered takes its longer time
+     * until it is rehashed: that can't be hidden.
      */
     async verify(password, encoded) {
         if (!encoded) {
@@ -116,6 +125,17 @@ export class PasswordHasher {
             return false;
         }
         const actual = await this.derive(input, parsed.salt, parsed.hash.length, parsed.params);
+        // A hash stored before the cost was raised takes less work than the dummy, which would tell an
+        // account from an unknown email: make up the difference in N·r·p with derivations at the
+        // configured r and p, halving N each time. Exact when only N changed, within 2·r·p otherwise.
+        let missing = work(this.params) - work(parsed.params);
+        for (let logN = this.params.logN - 1; logN >= 1 && missing > 0; logN--) {
+            const params = { ...this.params, logN };
+            if (work(params) <= missing) {
+                await this.derive(input, parsed.salt, this.keyLength, params);
+                missing -= work(params);
+            }
+        }
         return timingSafeEqual(actual, parsed.hash);
     }
     /** `true` when the stored hash uses weaker or different parameters than configured. */

package/dist/testing/index.js

@@ -414,6 +414,9 @@ export function authenticationStoreContract(create, options = {}) {
         }
         same(await store.consumeEmailToken(reset.id, 'email-verification'), undefined, 'a token of another purpose is refused');
         same(await store.consumeEmailToken(reset.id, 'password-reset'), reset, '…and left in place');
+        // What the services do when a step after the consume fails.
+        await store.saveEmailToken(reset);
+        same(await store.consumeEmailToken(reset.id, 'password-reset'), reset, 'a consumed token can be saved back, and works once more');
         const second = emailToken({ userId: u1 });
         await store.saveEmailToken(second);
         await store.deleteUserEmailTokens(u1, 'password-reset');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/authentication",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Nest - modern, fast, powerful node.js web framework (@authentication)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -41,45 +41,45 @@
   "devDependencies": {
     "@apollo/server": "5.5.1",
     "@as-integrations/express5": "1.1.2",
-    "@commitlint/cli": "21.2.3",
-    "@commitlint/config-angular": "21.2.3",
+    "@commitlint/cli": "21.2.4",
+    "@commitlint/config-angular": "21.2.4",
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-socket": "0.2.11",
     "@nestjs/apollo": "14.0.1",
-    "@nestjs/authorization": "0.0.1",
-    "@nestjs/common": "12.1.2",
-    "@nestjs/core": "12.1.2",
-    "@nestjs/drizzle": "0.0.1",
+    "@nestjs/authorization": "0.1.0",
+    "@nestjs/common": "12.2.0",
+    "@nestjs/core": "12.2.0",
+    "@nestjs/drizzle": "0.0.2",
     "@nestjs/graphql": "14.0.1",
-    "@nestjs/idempotency": "0.0.1",
+    "@nestjs/idempotency": "0.0.2",
     "@nestjs/mail": "0.0.1",
-    "@nestjs/microservices": "12.1.2",
-    "@nestjs/platform-express": "12.1.2",
-    "@nestjs/platform-fastify": "12.1.2",
-    "@nestjs/platform-ws": "12.1.2",
-    "@nestjs/resilience": "0.0.1",
-    "@nestjs/testing": "12.1.2",
+    "@nestjs/microservices": "12.2.0",
+    "@nestjs/platform-express": "12.2.0",
+    "@nestjs/platform-fastify": "12.2.0",
+    "@nestjs/platform-ws": "12.2.0",
+    "@nestjs/resilience": "0.0.2",
+    "@nestjs/testing": "12.2.0",
     "@nestjs/throttler": "6.7.1",
-    "@nestjs/websockets": "12.1.2",
-    "@types/node": "24.19.1",
+    "@nestjs/websockets": "12.2.0",
+    "@types/node": "24.19.2",
     "@types/pg": "8.23.1",
     "@types/supertest": "7.2.1",
     "@types/ws": "8.18.2",
-    "drizzle-orm": "0.45.3",
+    "drizzle-orm": "0.45.4",
     "graphql": "16.14.2",
     "husky": "9.1.7",
     "lint-staged": "17.6.0",
-    "oxlint": "1.87.0",
+    "oxlint": "1.89.0",
     "pg": "8.23.1",
-    "prettier": "3.9.9",
+    "prettier": "3.9.10",
     "reflect-metadata": "0.2.2",
     "release-it": "21.1.1",
     "rxjs": "7.8.2",
     "supertest": "7.3.1",
     "typeorm": "1.1.2",
     "typescript": "7.0.2",
-    "vite": "8.3.3",
-    "vitest": "5.0.3",
+    "vite": "8.3.5",
+    "vitest": "5.0.5",
     "ws": "8.22.0"
   },
   "peerDependencies": {