@os.io/nest-kit 0.0.1-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Wind Blade
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,111 @@
+<p align="center">
+  <img src="https://nestjs.com/img/logo-small.svg" width="120" alt="NestJS Logo" />
+  <br/>
+  <strong>+</strong>
+  <br/>
+  <img src="https://raw.githubusercontent.com/oxpo-io/nest-kit/main/docs/public/nest-kit-logo.svg" width="240" alt="@oxpo/nest-kit" />
+</p>
+
+<h1 align="center">@oxpo/nest-kit</h1>
+
+<p align="center">
+  <em>A modular, production-ready NestJS toolkit.</em>
+  <br />
+  <em>Bootstrap · Auth · SaaS · Infra</em>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/@oxpo/nest-kit">
+    <img src="https://img.shields.io/npm/v/@oxpo/nest-kit?logo=npm" alt="npm version" />
+  </a>
+  <a href="https://github.com/oxpo-io/nest-kit/actions">
+    <img src="https://img.shields.io/github/actions/workflow/status/oxpo-io/nest-kit/ci.yml?branch=main&logo=github" alt="CI" />
+  </a>
+  <a href="https://github.com/oxpo-io/nest-kit/blob/main/LICENSE">
+    <img src="https://img.shields.io/github/license/oxpo-io/nest-kit" alt="License" />
+  </a>
+  <a href="https://nodejs.org/">
+    <img src="https://img.shields.io/node/v/@oxpo/nest-kit" alt="Node version" />
+  </a>
+  <a href="https://www.typescriptlang.org/">
+    <img src="https://img.shields.io/badge/TypeScript-5.7-blue?logo=typescript" alt="TypeScript" />
+  </a>
+  <a href="https://nestjs.com/">
+    <img src="https://img.shields.io/badge/NestJS-11-e0234e?logo=nestjs" alt="NestJS" />
+  </a>
+</p>
+
+---
+
+## ✨ Module Groups
+
+| Import path                    | Directory            | Description                                  |
+| ------------------------------ | -------------------- | -------------------------------------------- |
+| `@oxpo/nest-kit` (or `./core`) | `packages/core`      | Shared types, utilities, base classes        |
+| `@oxpo/nest-kit/bootstrap`     | `packages/bootstrap` | One-liner setup for Swagger, Cache, TypeORM… |
+| `@oxpo/nest-kit/auth`          | `packages/auth`      | RBAC, OAuth 2.0, SSO, JWT, API Keys          |
+| `@oxpo/nest-kit/saas`          | `packages/saas`      | Orgs, Teams, Multi-tenancy, Subscriptions    |
+| `@oxpo/nest-kit/infra`         | `packages/infra`     | Infrastructure integrations                  |
+
+**Infra sub-modules** (import via sub-path):
+
+| Import path                         | Purpose                                         |
+| ----------------------------------- | ----------------------------------------------- |
+| `@oxpo/nest-kit/infra/logger`       | Structured logging (Pino, Winston)              |
+| `@oxpo/nest-kit/infra/notification` | Email (SES, SendGrid), SMS (Twilio), Push (FCM) |
+| `@oxpo/nest-kit/infra/storage`      | Unified file API: LocalFS, S3, GCS, Azure       |
+| `@oxpo/nest-kit/infra/stripe`       | Webhooks, subscriptions, checkout               |
+| `@oxpo/nest-kit/infra/audit-log`    | Audit trails, data change capture               |
+| `@oxpo/nest-kit/infra/metrics`      | Prometheus, OpenTelemetry, health checks        |
+
+## 📦 Installation
+
+```bash
+npm install @oxpo/nest-kit
+```
+
+Then import only what you need:
+
+```ts
+import { setupSwagger } from '@oxpo/nest-kit/bootstrap';
+import { RBACGuard } from '@oxpo/nest-kit/auth';
+```
+
+> **All modules are in early alpha.** APIs are subject to change.
+
+## 🚀 Quick Start
+
+```ts
+// main.ts
+import { NestFactory } from '@nestjs/core';
+import { AppModule } from './app.module';
+// import { setupSwagger } from '@oxpo/nest-kit/bootstrap';
+
+async function bootstrap() {
+  const app = await NestFactory.create(AppModule);
+  // setupSwagger(app, { title: 'My API', version: '1.0.0' });
+  await app.listen(3000);
+}
+bootstrap();
+```
+
+## 📖 Documentation
+
+Full documentation is available at:
+➡️ **https://oxpo-io.github.io/nest-kit** (coming soon)
+
+Or browse the [docs](./docs) folder locally.
+
+## 🤝 Contributing
+
+We welcome contributions! Please read our [contributing guide](./CONTRIBUTING.md).
+
+## 📄 License
+
+This project is [MIT licensed](./LICENSE).
+
+---
+
+<p align="center">
+  Made with ❤️ by <a href="https://github.com/oxpo-io">Wind Blade</a>
+</p>

package/dist/auth/auth.constants.d.ts

@@ -0,0 +1,19 @@
+export declare const AUTH_MODULE_OPTIONS = "AUTH_MODULE_OPTIONS";
+export declare const CACHE_SERVICE = "CACHE_SERVICE";
+export declare const USER_SERVICE = "USER_SERVICE";
+export declare const AUTH_STRATEGIES = "AUTH_STRATEGIES";
+export declare const AUTH_METHODS_CONFIG = "AUTH_METHODS_CONFIG";
+export declare const RBAC_OPTIONS = "RBAC_OPTIONS";
+export declare const PBAC_OPTIONS = "PBAC_OPTIONS";
+export declare const METADATA_PUBLIC = "auth:public";
+export declare const METADATA_ROLES = "auth:roles";
+export declare const METADATA_PERMISSIONS = "auth:permissions";
+export declare const METADATA_POLICY = "auth:policy";
+export declare const METADATA_AUTH_METHODS = "auth:methods";
+export declare const TOKEN_BLACKLIST_PREFIX = "tok_blk:";
+export declare const REFRESH_TOKEN_FAMILY_PREFIX = "rt_fam:";
+export declare const DEVICE_SESSION_PREFIX = "dev_sess:";
+export declare const OTP_PREFIX = "otp:";
+export declare const MAGIC_LINK_PREFIX = "magic:";
+export declare const LOGIN_ATTEMPT_PREFIX = "login_attempt:";
+//# sourceMappingURL=auth.constants.d.ts.map

package/dist/auth/auth.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.constants.d.ts","sourceRoot":"","sources":["../../packages/auth/auth.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,eAAO,MAAM,eAAe,oBAAoB,CAAC;AAEjD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAE3C,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,eAAO,MAAM,cAAc,eAAe,CAAC;AAE3C,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,eAAO,MAAM,2BAA2B,YAAY,CAAC;AAErD,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,eAAO,MAAM,UAAU,SAAS,CAAC;AAEjC,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,eAAO,MAAM,oBAAoB,mBAAmB,CAAC"}

package/dist/auth/auth.constants.js

@@ -0,0 +1,19 @@
+export const AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
+export const CACHE_SERVICE = 'CACHE_SERVICE';
+export const USER_SERVICE = 'USER_SERVICE';
+export const AUTH_STRATEGIES = 'AUTH_STRATEGIES';
+export const AUTH_METHODS_CONFIG = 'AUTH_METHODS_CONFIG';
+export const RBAC_OPTIONS = 'RBAC_OPTIONS';
+export const PBAC_OPTIONS = 'PBAC_OPTIONS';
+export const METADATA_PUBLIC = 'auth:public';
+export const METADATA_ROLES = 'auth:roles';
+export const METADATA_PERMISSIONS = 'auth:permissions';
+export const METADATA_POLICY = 'auth:policy';
+export const METADATA_AUTH_METHODS = 'auth:methods';
+export const TOKEN_BLACKLIST_PREFIX = 'tok_blk:';
+export const REFRESH_TOKEN_FAMILY_PREFIX = 'rt_fam:';
+export const DEVICE_SESSION_PREFIX = 'dev_sess:';
+export const OTP_PREFIX = 'otp:';
+export const MAGIC_LINK_PREFIX = 'magic:';
+export const LOGIN_ATTEMPT_PREFIX = 'login_attempt:';
+//# sourceMappingURL=auth.constants.js.map

package/dist/auth/auth.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.constants.js","sourceRoot":"","sources":["../../packages/auth/auth.constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC;AAE7C,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAC;AAEpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,SAAS,CAAC;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC;AAEjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC"}

package/dist/auth/auth.guard.d.ts

@@ -0,0 +1,20 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AuthService } from './auth.service';
+/**
+ * Global authentication guard.
+ *
+ * Extracts the JWT from the `Authorization: Bearer <token>` header,
+ * validates it via `AuthService.validateToken()`, and attaches the
+ * decoded user to `request.user`.
+ *
+ * Skip authentication on routes or controllers decorated with `@Public()`.
+ */
+export declare class AuthGuard implements CanActivate {
+    private readonly reflector;
+    private readonly authService;
+    constructor(reflector: Reflector, authService: AuthService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private extractToken;
+}
+//# sourceMappingURL=auth.guard.d.ts.map

package/dist/auth/auth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.guard.d.ts","sourceRoot":"","sources":["../../packages/auth/auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAyB,MAAM,gBAAgB,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C;;;;;;;;GAQG;AACH,qBACa,SAAU,YAAW,WAAW;IAEzC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW;IAGrC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAwC9D,OAAO,CAAC,YAAY;CAqBrB"}

package/dist/auth/auth.guard.js

@@ -0,0 +1,84 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AuthService } from './auth.service';
+import { METADATA_PUBLIC } from './auth.constants';
+/**
+ * Global authentication guard.
+ *
+ * Extracts the JWT from the `Authorization: Bearer <token>` header,
+ * validates it via `AuthService.validateToken()`, and attaches the
+ * decoded user to `request.user`.
+ *
+ * Skip authentication on routes or controllers decorated with `@Public()`.
+ */
+let AuthGuard = class AuthGuard {
+    reflector;
+    authService;
+    constructor(reflector, authService) {
+        this.reflector = reflector;
+        this.authService = authService;
+    }
+    async canActivate(context) {
+        // Skip if marked as public
+        const isPublic = this.reflector.getAllAndOverride(METADATA_PUBLIC, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic)
+            return true;
+        const request = context.switchToHttp().getRequest();
+        const token = this.extractToken(request);
+        if (!token) {
+            throw new UnauthorizedException('Missing authentication token');
+        }
+        try {
+            const payload = await this.authService.validateToken(token);
+            request.user = {
+                id: payload.sub,
+                email: payload.email,
+                username: payload.username,
+                roles: payload.roles ?? [],
+                permissions: payload.permissions ?? [],
+                isAnonymous: payload.isAnonymous ?? false,
+                isMfaVerified: payload.isMfaVerified ?? false,
+            };
+            request.accessToken = token;
+        }
+        catch (error) {
+            throw new UnauthorizedException(error instanceof Error ? error.message : 'Invalid token');
+        }
+        return true;
+    }
+    extractToken(request) {
+        // Authorization header
+        const authHeader = request.headers?.authorization;
+        if (authHeader?.startsWith('Bearer ')) {
+            return authHeader.slice(7);
+        }
+        // Cookie fallback
+        const cookie = request.cookies?.['access_token'];
+        if (cookie)
+            return cookie;
+        // Query param fallback (for WebSocket / SSE)
+        const query = request.query?.['token'];
+        if (query)
+            return query;
+        return undefined;
+    }
+};
+AuthGuard = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [Reflector,
+        AuthService])
+], AuthGuard);
+export { AuthGuard };
+//# sourceMappingURL=auth.guard.js.map

package/dist/auth/auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.guard.js","sourceRoot":"","sources":["../../packages/auth/auth.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAiC,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAClG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;GAQG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAED;IACA;IAFnB,YACmB,SAAoB,EACpB,WAAwB;QADxB,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,eAAe,EAAE;YAC1E,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAM7C,CAAC;QACL,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAEzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC5D,OAAO,CAAC,IAAI,GAAG;gBACb,EAAE,EAAE,OAAO,CAAC,GAAa;gBACzB,KAAK,EAAE,OAAO,CAAC,KAA2B;gBAC1C,QAAQ,EAAE,OAAO,CAAC,QAA8B;gBAChD,KAAK,EAAG,OAAO,CAAC,KAAkB,IAAI,EAAE;gBACxC,WAAW,EAAG,OAAO,CAAC,WAAwB,IAAI,EAAE;gBACpD,WAAW,EAAG,OAAO,CAAC,WAAuB,IAAI,KAAK;gBACtD,aAAa,EAAG,OAAO,CAAC,aAAyB,IAAI,KAAK;aAC3D,CAAC;YACF,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC5F,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,OAIpB;QACC,uBAAuB;QACvB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;QAClD,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,kBAAkB;QAClB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,6CAA6C;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AAnEY,SAAS;IADrB,UAAU,EAAE;qCAGmB,SAAS;QACP,WAAW;GAHhC,SAAS,CAmErB"}

package/dist/auth/auth.module.d.ts

@@ -0,0 +1,26 @@
+import { type DynamicModule, type Provider } from '@nestjs/common';
+import type { AuthModuleOptions, AuthModuleAsyncOptions } from './auth.options';
+export declare class AuthModule {
+    /**
+     * Configure the auth module synchronously.
+     */
+    static forRoot(options: AuthModuleOptions, extraProviders?: Provider[]): DynamicModule;
+    /**
+     * Configure the auth module asynchronously.
+     */
+    static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule;
+    private static buildModule;
+    private static createAsyncProviders;
+    /**
+     * Conditionally register strategy classes based on config.
+     * Only enabled strategies are registered as providers.
+     */
+    private static createStrategyProviders;
+    private static createCoreProviders;
+    private static createAuthzProviders;
+    private static createEnabledStrategiesProvider;
+    private static getExports;
+    private static createDisabledStrategy;
+    private static nameFor;
+}
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/auth/auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../packages/auth/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAkB,MAAM,gBAAgB,CAAC;AACnF,OAAO,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA6BhF,qBACa,UAAU;IACrB;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,cAAc,GAAE,QAAQ,EAAO,GAAG,aAAa;IAI1F;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAuBnE,OAAO,CAAC,MAAM,CAAC,WAAW;IA4B1B,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAUnC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAgKtC,OAAO,CAAC,MAAM,CAAC,mBAAmB;IAYlC,OAAO,CAAC,MAAM,CAAC,oBAAoB;IA2BnC,OAAO,CAAC,MAAM,CAAC,+BAA+B;IAyC9C,OAAO,CAAC,MAAM,CAAC,UAAU;IA0BzB,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAMrC,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}

package/dist/auth/auth.module.js

@@ -0,0 +1,344 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AuthModule_1;
+import { Module, Logger } from '@nestjs/common';
+import { AUTH_MODULE_OPTIONS, AUTH_STRATEGIES, CACHE_SERVICE, USER_SERVICE, } from './auth.constants';
+import { AuthService } from './auth.service';
+import { AuthGuard } from './auth.guard';
+import { PasswordService } from './password/password.service';
+import { JwtService } from './session/jwt.service';
+import { TokenBlacklistService } from './session/token-blacklist.service';
+import { DeviceSessionService } from './session/device-session.service';
+import { ThrottleService } from './throttling/throttle.service';
+import { CredentialsStrategy } from './strategies/credentials/credentials.strategy';
+import { OAuthStrategy, OAuthProviderRegistry } from './strategies/oauth/index';
+import { TotpStrategy } from './strategies/totp/totp.strategy';
+import { AnonymousStrategy } from './strategies/anonymous/anonymous.strategy';
+import { MagicLinkStrategy } from './strategies/magic-link/magic-link.strategy';
+import { OtpStrategy } from './strategies/otp/otp.strategy';
+import { PasskeyStrategy } from './strategies/passkey/passkey.strategy';
+import { OneTapStrategy } from './strategies/onetap/onetap.strategy';
+import { SsoStrategy } from './strategies/sso/sso.strategy';
+import { RbacService, RbacGuard } from './authorization/rbac';
+import { PbacService, PbacGuard } from './authorization/pbac';
+const logger = new Logger('AuthModule');
+let AuthModule = AuthModule_1 = class AuthModule {
+    /**
+     * Configure the auth module synchronously.
+     */
+    static forRoot(options, extraProviders = []) {
+        return AuthModule_1.buildModule(options, extraProviders);
+    }
+    /**
+     * Configure the auth module asynchronously.
+     */
+    static forRootAsync(options) {
+        const asyncProviders = AuthModule_1.createAsyncProviders(options);
+        const strategyProviders = AuthModule_1.createStrategyProviders(true);
+        const coreProviders = AuthModule_1.createCoreProviders();
+        const authzProviders = AuthModule_1.createAuthzProviders();
+        const enabledStrategiesProvider = AuthModule_1.createEnabledStrategiesProvider();
+        return {
+            module: AuthModule_1,
+            global: options.global ?? true,
+            imports: options.imports ?? [],
+            providers: [
+                ...asyncProviders,
+                ...strategyProviders,
+                ...coreProviders,
+                ...authzProviders,
+                enabledStrategiesProvider,
+                ...(options.extraProviders ?? []),
+            ],
+            exports: AuthModule_1.getExports(),
+        };
+    }
+    static buildModule(options, extraProviders) {
+        const providers = [
+            { provide: AUTH_MODULE_OPTIONS, useValue: options },
+            ...AuthModule_1.createStrategyProviders(false),
+            ...AuthModule_1.createCoreProviders(),
+            ...AuthModule_1.createAuthzProviders(),
+            AuthModule_1.createEnabledStrategiesProvider(),
+            ...extraProviders,
+        ];
+        if (!options.cacheServiceToken) {
+            logger.warn('You must register a provider under the "CACHE_SERVICE" injection token. ' +
+                'See AuthModuleOptions.cacheServiceToken.');
+        }
+        return {
+            module: AuthModule_1,
+            global: options.global ?? true,
+            providers,
+            exports: AuthModule_1.getExports(),
+        };
+    }
+    static createAsyncProviders(options) {
+        return [
+            {
+                provide: AUTH_MODULE_OPTIONS,
+                useFactory: options.useFactory,
+                inject: options.inject ?? [],
+            },
+        ];
+    }
+    /**
+     * Conditionally register strategy classes based on config.
+     * Only enabled strategies are registered as providers.
+     */
+    static createStrategyProviders(async) {
+        const providers = [];
+        // Credentials — enabled by default (unless explicitly false)
+        providers.push({
+            provide: CredentialsStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (options.credentials === false) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('credentials'));
+                }
+                return new CredentialsStrategy(args[1], args[2], args[3]);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, USER_SERVICE, PasswordService, JwtService]
+                : [AUTH_MODULE_OPTIONS, USER_SERVICE, PasswordService, JwtService],
+        });
+        // OAuth — enabled when config provided
+        providers.push({
+            provide: OAuthStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (!options.oauth) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('oauth'));
+                }
+                const registry = new OAuthProviderRegistry();
+                const oauthOpts = options.oauth;
+                for (const [provider, cfg] of Object.entries(oauthOpts)) {
+                    if (typeof cfg === 'object' && cfg !== null) {
+                        registry.register(provider, cfg);
+                    }
+                }
+                return new OAuthStrategy(args[1], args[2], registry);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService]
+                : [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService],
+        });
+        // TOTP — enabled when config provided
+        providers.push({
+            provide: TotpStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (!options.totp) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('totp'));
+                }
+                return new TotpStrategy(args[1], args[2]);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService]
+                : [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService],
+        });
+        // Anonymous — enabled when config provided
+        providers.push({
+            provide: AnonymousStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (!options.anonymous) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('anonymous'));
+                }
+                return new AnonymousStrategy(args[1]);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, JwtService]
+                : [AUTH_MODULE_OPTIONS, JwtService],
+        });
+        // Magic Link — enabled when config provided
+        providers.push({
+            provide: MagicLinkStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (!options.magicLink) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('magic-link'));
+                }
+                return new MagicLinkStrategy(args[1], args[2], args[3]);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, CACHE_SERVICE, USER_SERVICE, JwtService]
+                : [AUTH_MODULE_OPTIONS, CACHE_SERVICE, USER_SERVICE, JwtService],
+        });
+        // OTP — enabled when config provided
+        providers.push({
+            provide: OtpStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (!options.otp) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('otp'));
+                }
+                return new OtpStrategy(args[1], args[2], args[3]);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, CACHE_SERVICE, USER_SERVICE, JwtService]
+                : [AUTH_MODULE_OPTIONS, CACHE_SERVICE, USER_SERVICE, JwtService],
+        });
+        // Passkey — enabled when config provided
+        providers.push({
+            provide: PasskeyStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (!options.passkey) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('passkey'));
+                }
+                return new PasskeyStrategy(args[1], args[2]);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService]
+                : [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService],
+        });
+        // OneTap — enabled when config provided
+        providers.push({
+            provide: OneTapStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (!options.onetap) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('onetap'));
+                }
+                return new OneTapStrategy(args[1], args[2]);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService]
+                : [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService],
+        });
+        // SSO — enabled when config provided
+        providers.push({
+            provide: SsoStrategy,
+            useFactory: (...args) => {
+                const options = args[0];
+                if (!options.sso) {
+                    return AuthModule_1.createDisabledStrategy(AuthModule_1.nameFor('sso'));
+                }
+                return new SsoStrategy(args[1], args[2]);
+            },
+            inject: async
+                ? [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService]
+                : [AUTH_MODULE_OPTIONS, USER_SERVICE, JwtService],
+        });
+        return providers;
+    }
+    static createCoreProviders() {
+        return [
+            AuthService,
+            AuthGuard,
+            PasswordService,
+            JwtService,
+            TokenBlacklistService,
+            DeviceSessionService,
+            ThrottleService,
+        ];
+    }
+    static createAuthzProviders() {
+        return [
+            RbacGuard,
+            {
+                provide: RbacService,
+                useFactory: (cache) => {
+                    return new RbacService(cache);
+                },
+                inject: [CACHE_SERVICE],
+            },
+            {
+                provide: PbacGuard,
+                useFactory: (reflector, pbacService) => {
+                    return new PbacGuard(reflector, pbacService);
+                },
+                inject: ['Reflector', PbacService],
+            },
+            {
+                provide: PbacService,
+                useFactory: (cache) => {
+                    return new PbacService(cache);
+                },
+                inject: [CACHE_SERVICE],
+            },
+        ];
+    }
+    static createEnabledStrategiesProvider() {
+        return {
+            provide: AUTH_STRATEGIES,
+            useFactory: (credentials, oauth, totp, anonymous, magicLink, otp, passkey, onetap, sso) => {
+                const all = [
+                    credentials,
+                    oauth,
+                    totp,
+                    anonymous,
+                    magicLink,
+                    otp,
+                    passkey,
+                    onetap,
+                    sso,
+                ];
+                return all.filter((s) => !s._disabled);
+            },
+            inject: [
+                CredentialsStrategy,
+                OAuthStrategy,
+                TotpStrategy,
+                AnonymousStrategy,
+                MagicLinkStrategy,
+                OtpStrategy,
+                PasskeyStrategy,
+                OneTapStrategy,
+                SsoStrategy,
+            ],
+        };
+    }
+    static getExports() {
+        return [
+            AuthService,
+            AuthGuard,
+            RbacService,
+            RbacGuard,
+            PbacService,
+            PbacGuard,
+            PasswordService,
+            JwtService,
+            TokenBlacklistService,
+            DeviceSessionService,
+            ThrottleService,
+            CredentialsStrategy,
+            OAuthStrategy,
+            OAuthProviderRegistry,
+            TotpStrategy,
+            AnonymousStrategy,
+            MagicLinkStrategy,
+            OtpStrategy,
+            PasskeyStrategy,
+            OneTapStrategy,
+            SsoStrategy,
+        ];
+    }
+    static createDisabledStrategy(name) {
+        const s = new DisabledStrategy();
+        s._name = name;
+        return s;
+    }
+    static nameFor(method) {
+        return method;
+    }
+};
+AuthModule = AuthModule_1 = __decorate([
+    Module({})
+], AuthModule);
+export { AuthModule };
+class DisabledStrategy {
+    _disabled = true;
+    _name = 'disabled';
+    type = '';
+    name = 'disabled';
+    authenticate() {
+        throw new Error(`Strategy "${this._name}" is not enabled`);
+    }
+}
+//# sourceMappingURL=auth.module.js.map