@nestjs/authentication 0.1.3 → 0.1.5

package/dist/context/authentication-scope.service.d.ts

@@ -36,7 +36,9 @@ export declare class AuthenticationScope {
      * GraphQL resolver whose context carries `req` (and `res`), or an
      * `@nestjs/mcp` call that arrived over HTTP (its context, the second of
      * its arguments, carries `request`). An MCP call has no response of its own
-     * to set cookies on: the MCP SDK writes the HTTP response.
+     * to set cookies on: the MCP SDK writes the HTTP response. An `@nestjs/ai`
+     * agent function called in an HTTP request carries it the same way, and has
+     * no response either: the route that runs the agent owns it.
      */
     exchange(): HttpExchange | undefined;
 }

package/dist/context/authentication-scope.service.js

@@ -43,7 +43,9 @@ let AuthenticationScope = class AuthenticationScope {
      * GraphQL resolver whose context carries `req` (and `res`), or an
      * `@nestjs/mcp` call that arrived over HTTP (its context, the second of
      * its arguments, carries `request`). An MCP call has no response of its own
-     * to set cookies on: the MCP SDK writes the HTTP response.
+     * to set cookies on: the MCP SDK writes the HTTP response. An `@nestjs/ai`
+     * agent function called in an HTTP request carries it the same way, and has
+     * no response either: the route that runs the agent owns it.
      */
     exchange() {
         const context = this.current?.context;
@@ -56,7 +58,8 @@ let AuthenticationScope = class AuthenticationScope {
                 const gql = context.getArgByIndex(2);
                 return gql?.req ? { request: gql.req, response: gql.res } : undefined;
             }
-            case 'mcp': {
+            case 'mcp':
+            case 'ai': {
                 const request = context.getArgByIndex(1)?.request;
                 return request?.headers ? { request } : undefined;
             }

package/dist/interfaces/session-store.interface.d.ts

@@ -70,9 +70,17 @@ export interface SessionStore {
     deleteSession(id: string): Promise<boolean>;
     /**
      * The user's sessions, in any order (`[]` when none), expired ones included.
-     * Without `extra`: they feed "your sessions" pages.
+     * Without `extra`: they feed "your sessions" pages, and
+     * `SessionService.revokeAll()` reads them back after it deletes, so read
+     * what was just written and deleted: the primary, not a replica that lags.
      */
     listUserSessions(userId: string): Promise<SessionRecord[]>;
-    /** Deletes every session of the user ("sign out everywhere"). */
+    /**
+     * Deletes every session of the user ("sign out everywhere"): a plain
+     * `DELETE … WHERE user_id = ?`. It may miss a session a rotation writes
+     * while it runs (at Read Committed, its snapshot predates the new row), so
+     * `SessionService.revokeAll()` reads the user's sessions back with
+     * `listUserSessions()` and deletes again until none is left.
+     */
     deleteUserSessions(userId: string): Promise<void>;
 }

package/dist/mfa/mfa.service.js

@@ -238,7 +238,9 @@ let MfaService = MfaService_1 = class MfaService {
         const issuer = this.options?.issuer ?? 'NestJS';
         const label = `${encodeURIComponent(issuer)}:${encodeURIComponent(accountName)}`;
         const params = new URLSearchParams({ secret, issuer, algorithm: 'SHA1', digits: String(DIGITS), period: String(PERIOD) });
-        return `otpauth://totp/${label}?${params}`;
+        // The key URI format encodes as RFC 3986, where `+` is a plus sign: a space is `%20`, as in the label.
+        // URLSearchParams writes a space as `+`, and a literal `+` as `%2B`, so each `+` left is a space.
+        return `otpauth://totp/${label}?${params.toString().replaceAll('+', '%20')}`;
     }
     /** `opened` is undefined when the secret could not be decrypted: fail closed, not counted against the user. */
     async check(userId, opened, code) {

package/dist/session/session.service.d.ts

@@ -60,8 +60,9 @@ export declare class SessionService {
      * `absoluteTtl` from its creation, in place of its `mfa.pendingTtl`.
      * Resolves `null` when the session was gone by the time it was replaced:
      * revoked (a sign-out everywhere, a password reset) or rotated by another
-     * request, which leaves no new session behind. The session's `extra` is
-     * not carried over.
+     * request, which leaves no new session behind. A rotation that wins while
+     * `revokeAll()` is under way still resolves its new session, which that
+     * `revokeAll()` then ends. The session's `extra` is not carried over.
      */
     rotate(session: SessionRecord, changes?: Pick<Partial<SessionRecord>, 'mfa' | 'metadata'>): Promise<IssuedSession | null>;
     /**
@@ -72,7 +73,12 @@ export declare class SessionService {
     revoke(sessionId: string, { userId }: {
         userId: string;
     }): Promise<boolean>;
-    /** Ends every session of a user, optionally keeping one (`except`: its id). */
+    /**
+     * Ends every session of a user, optionally keeping one (`except`: its id).
+     * Resolves once a read of the user's sessions finds none left but the kept
+     * one, and rejects when the store still lists others after five rounds of
+     * deletes.
+     */
     revokeAll(userId: string, { except }?: {
         except?: string;
     }): Promise<void>;

package/dist/session/session.service.js

@@ -20,6 +20,12 @@ import { durationOr, hasExpired } from '../utils/duration.util.js';
 import { AuthenticationEvents } from '../events/authentication-events.service.js';
 import { AuthenticationStorage } from '../storage/authentication.storage.js';
 import { assertCookieAttributes, defaultCookieName, readCookie, serializeCookie } from './cookies.util.js';
+/**
+ * The rounds of deletes `revokeAll()` makes before it gives up. A round past the first takes a
+ * rotation that won during the one before; more than a few take a store that keeps listing what it
+ * deleted.
+ */
+const REVOKE_ROUNDS = 5;
 /**
  * Server-side sessions: opaque 256-bit tokens in an `HttpOnly` cookie,
  * stored by their SHA-256.
@@ -109,15 +115,17 @@ let SessionService = SessionService_1 = class SessionService {
      * `absoluteTtl` from its creation, in place of its `mfa.pendingTtl`.
      * Resolves `null` when the session was gone by the time it was replaced:
      * revoked (a sign-out everywhere, a password reset) or rotated by another
-     * request, which leaves no new session behind. The session's `extra` is
-     * not carried over.
+     * request, which leaves no new session behind. A rotation that wins while
+     * `revokeAll()` is under way still resolves its new session, which that
+     * `revokeAll()` then ends. The session's `extra` is not carried over.
      */
     async rotate(session, changes = {}) {
         const { id: _, extra: _extra, ...rest } = session;
         const verifying = session.mfa === 'pending' && changes.mfa === 'verified';
         // The new session first, then the old one, which must still be there to delete: if a revocation
         // took it meanwhile (deleting the user's sessions, this new one included, or not yet), or another
-        // rotation did, this one lost, and its new session must not outlive the old.
+        // rotation did, this one lost, and its new session must not outlive the old. A revocation still
+        // under way when this one wins reads the user's sessions back, and ends the new one.
         const issued = await this.issue({
             ...rest,
             ...changes,
@@ -144,15 +152,44 @@ let SessionService = SessionService_1 = class SessionService {
         this.events.emit({ type: 'sign-out', userId, sessionId: record.id });
         return true;
     }
-    /** Ends every session of a user, optionally keeping one (`except`: its id). */
+    /**
+     * Ends every session of a user, optionally keeping one (`except`: its id).
+     * Resolves once a read of the user's sessions finds none left but the kept
+     * one, and rejects when the store still lists others after five rounds of
+     * deletes.
+     */
     async revokeAll(userId, { except } = {}) {
         const store = this.storage.sessions;
-        if (!except) {
-            return store.deleteUserSessions(userId);
+        const others = async () => (await store.listUserSessions(userId)).filter((session) => session.id !== except);
+        // A rotation writes its new session, then deletes the old one. One that does both while the
+        // delete below is under way wins (the old session was still there), and the delete can miss its
+        // new session: a list read before it was written, or one `DELETE … WHERE user_id = ?` at
+        // PostgreSQL's Read Committed, whose snapshot predates the new row and which skips the old one
+        // the rotation deleted meanwhile. That `DELETE` removes nothing, so its row count can't tell.
+        // Instead, a statement of its own reads the sessions back, and the deletes repeat until it finds
+        // none. A read that finds none has seen every rotation that won against this revocation: each
+        // wrote its new session before it deleted the old one, which was gone by the time of that read.
+        let left = except ? await others() : [];
+        if (except && left.length === 0) {
+            return;
         }
-        for (const session of await store.listUserSessions(userId)) {
-            if (session.id !== except) {
-                await store.deleteSession(session.id);
+        for (let round = 1;; round++) {
+            if (except) {
+                for (const session of left) {
+                    await store.deleteSession(session.id);
+                }
+            }
+            else {
+                await store.deleteUserSessions(userId);
+            }
+            left = await others();
+            if (left.length === 0) {
+                return;
+            }
+            if (round === REVOKE_ROUNDS) {
+                throw new Error(`SessionService.revokeAll(): ${left.length} ${left.length === 1 ? 'session' : 'sessions'} of user ${userId} ` +
+                    `still listed after ${REVOKE_ROUNDS} rounds of deletes. listUserSessions() must read what was just deleted ` +
+                    '(the primary, not a replica that lags), and deleteUserSessions() must delete every session of the user.');
             }
         }
     }

package/dist/utils/auth-state.util.d.ts

@@ -45,9 +45,9 @@ export declare function getRawResult(context: ExecutionContext): State | undefin
 export declare function getRequestHeaders(context: ExecutionContext): Headers | undefined;
 /**
  * The request behind a call, as far as authentication needs it: headers,
- * and the method for HTTP, GraphQL and MCP (a WebSocket handshake has none,
- * so it counts as a safe request). `undefined` for RPC, and for MCP over
- * stdio.
+ * and the method for HTTP, GraphQL, MCP and agent functions (a WebSocket
+ * handshake has none, so it counts as a safe request). `undefined` for RPC,
+ * for MCP over stdio, and for an agent function called in a job.
  */
 export declare function requestOf(context: ExecutionContext): {
     headers: Headers;

package/dist/utils/auth-state.util.js

@@ -29,13 +29,14 @@ function callKeys(context) {
     return keys;
 }
 /**
- * The context of an `@nestjs/mcp` call (a tool, resource or prompt), read from
- * its arguments, `[input, context]`, so this package needs no `@nestjs/mcp`
- * dependency. Its `request` is the HTTP platform's request (a plain
+ * The context of an `@nestjs/mcp` call (a tool, resource or prompt) or of an
+ * `@nestjs/ai` agent function call, read from its arguments, `[input,
+ * context]`, so this package needs neither dependency. Its `request` is the
+ * HTTP platform's request: the one an MCP call arrived in (a plain
  * `{ method, url, headers }` object for `@nestjs/mcp/testing`'s in-memory
- * client), absent over stdio.
+ * client), or the one the agent runs in. Absent over stdio, and in a job.
  */
-function mcpCallOf(context) {
+function callContextOf(context) {
     const call = context.getArgByIndex(1);
     return typeof call === 'object' && call !== null ? call : undefined;
 }
@@ -48,7 +49,9 @@ function mcpCallOf(context) {
  * request it arrived in, else (over stdio) its own context object. Each MCP
  * request travels in an HTTP request of its own, so the request is per call,
  * and it is the one the endpoint's route was authenticated on: a guard there
- * and on the call authenticate once.
+ * and on the call authenticate once. An agent function call (`ai`) is carried
+ * the same way: the HTTP request the agent runs in, which the route that runs
+ * it authenticated, else (in a job) its own context object.
  */
 function carrierOf(context) {
     switch (context.getType()) {
@@ -62,8 +65,9 @@ function carrierOf(context) {
         }
         case 'graphql':
             return context.getArgByIndex(2)?.req;
-        case 'mcp': {
-            const call = mcpCallOf(context);
+        case 'mcp':
+        case 'ai': {
+            const call = callContextOf(context);
             return call?.request ?? call;
         }
         default:
@@ -206,9 +210,9 @@ export function getRequestHeaders(context) {
 }
 /**
  * The request behind a call, as far as authentication needs it: headers,
- * and the method for HTTP, GraphQL and MCP (a WebSocket handshake has none,
- * so it counts as a safe request). `undefined` for RPC, and for MCP over
- * stdio.
+ * and the method for HTTP, GraphQL, MCP and agent functions (a WebSocket
+ * handshake has none, so it counts as a safe request). `undefined` for RPC,
+ * for MCP over stdio, and for an agent function called in a job.
  */
 export function requestOf(context) {
     switch (context.getType()) {
@@ -221,8 +225,9 @@ export function requestOf(context) {
         }
         case 'graphql':
             return context.getArgByIndex(2)?.req;
-        case 'mcp': {
-            const request = mcpCallOf(context)?.request;
+        case 'mcp':
+        case 'ai': {
+            const request = callContextOf(context)?.request;
             return request?.headers ? request : undefined;
         }
         default:

package/dist/utils/transport-errors.util.js

@@ -74,6 +74,10 @@ export async function refusal(context, { status = 401, message, code, details, c
             // MCP SDK writes the HTTP response, so no challenge goes with it: an MCP client learns where to sign in from
             // the endpoint's own 401 (`@nestjs/mcp`'s `auth` option).
             break;
+        case 'ai':
+            // Nest's own exception too, which `@nestjs/ai` gives the model as the function's error. The route that runs
+            // the agent owns the HTTP response, so no challenge goes with it.
+            break;
     }
     const Exception = status === 409 ? ConflictException : status === 403 ? ForbiddenException : UnauthorizedException;
     // Nest builds the body: `error` is the code (the description) or the status phrase, then `errorCode`.

package/package.json

@@ -1,7 +1,22 @@
 {
   "name": "@nestjs/authentication",
-  "version": "0.1.3",
-  "description": "Nest - modern, fast, powerful node.js web framework (@authentication)",
+  "version": "0.1.5",
+  "description": "Authentication for NestJS: sign-in with passwords, Google and magic links, server-side sessions, JWT bearer tokens, two-factor and API keys.",
+  "keywords": [
+    "nestjs",
+    "nest",
+    "authentication",
+    "auth",
+    "login",
+    "sign-in",
+    "session",
+    "jwt",
+    "oauth",
+    "magic-link",
+    "two-factor",
+    "2fa",
+    "api-keys"
+  ],
   "author": "Kamil Mysliwiec",
   "license": "MIT",
   "url": "https://github.com/nestjs/authentication#readme",
@@ -46,21 +61,21 @@
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-socket": "0.2.11",
     "@nestjs/apollo": "14.0.1",
-    "@nestjs/authorization": "0.1.0",
-    "@nestjs/common": "12.3.2",
-    "@nestjs/core": "12.3.2",
+    "@nestjs/authorization": "0.1.2",
+    "@nestjs/common": "12.3.3",
+    "@nestjs/core": "12.3.3",
     "@nestjs/drizzle": "0.0.2",
     "@nestjs/graphql": "14.0.1",
     "@nestjs/idempotency": "0.0.3",
     "@nestjs/mail": "0.0.1",
-    "@nestjs/microservices": "12.3.2",
-    "@nestjs/platform-express": "12.3.2",
-    "@nestjs/platform-fastify": "12.3.2",
-    "@nestjs/platform-ws": "12.3.2",
+    "@nestjs/microservices": "12.3.3",
+    "@nestjs/platform-express": "12.3.3",
+    "@nestjs/platform-fastify": "12.3.3",
+    "@nestjs/platform-ws": "12.3.3",
     "@nestjs/resilience": "0.0.3",
-    "@nestjs/testing": "12.3.2",
+    "@nestjs/testing": "12.3.3",
     "@nestjs/throttler": "6.7.1",
-    "@nestjs/websockets": "12.3.2",
+    "@nestjs/websockets": "12.3.3",
     "@types/node": "24.19.2",
     "@types/pg": "8.23.1",
     "@types/supertest": "7.2.1",
@@ -78,7 +93,7 @@
     "supertest": "7.3.1",
     "typeorm": "1.1.2",
     "typescript": "7.0.2",
-    "vite": "8.3.5",
+    "vite": "8.3.6",
     "vitest": "5.1.0",
     "ws": "8.22.1"
   },