@os.io/nest-kit 0.0.1-alpha.0 → 0.0.1-alpha.2

package/dist/auth/authorization/rbac/rbac.decorator.d.ts

@@ -1,18 +0,0 @@
-/**
- * Require specific roles to access a route.
- * Works with the RbacGuard.
- *
- * By default, a user needs **at least one** of the listed roles.
- * Pass `{ requireAll: true }` in options to require all roles.
- *
- * @example
- * ```typescript
- * @Roles('admin')
- * @Roles('admin', 'moderator')
- * @Roles('admin', 'super-admin', { requireAll: true })
- * ```
- */
-export declare const Roles: (...args: (string | {
-    requireAll: boolean;
-})[]) => import("@nestjs/common").CustomDecorator<string>;
-//# sourceMappingURL=rbac.decorator.d.ts.map

package/dist/auth/authorization/rbac/rbac.decorator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac.decorator.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.decorator.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,CAAC,MAAM,GAAG;IAAE,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC,EAAE,qDAOlE,CAAC"}

package/dist/auth/authorization/rbac/rbac.decorator.js

@@ -1,25 +0,0 @@
-import { SetMetadata } from '@nestjs/common';
-import { METADATA_ROLES } from '../../auth.constants';
-/**
- * Require specific roles to access a route.
- * Works with the RbacGuard.
- *
- * By default, a user needs **at least one** of the listed roles.
- * Pass `{ requireAll: true }` in options to require all roles.
- *
- * @example
- * ```typescript
- * @Roles('admin')
- * @Roles('admin', 'moderator')
- * @Roles('admin', 'super-admin', { requireAll: true })
- * ```
- */
-export const Roles = (...args) => {
-    const last = args[args.length - 1];
-    const opts = typeof last === 'object' ? args.pop() : undefined;
-    return SetMetadata(METADATA_ROLES, {
-        roles: args,
-        requireAll: opts?.requireAll ?? false,
-    });
-};
-//# sourceMappingURL=rbac.decorator.js.map

package/dist/auth/authorization/rbac/rbac.decorator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac.decorator.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,IAA0C,EAAE,EAAE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,GAAG,EAA8B,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,OAAO,WAAW,CAAC,cAAc,EAAE;QACjC,KAAK,EAAE,IAAgB;QACvB,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,KAAK;KACtC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/auth/authorization/rbac/rbac.guard.d.ts

@@ -1,19 +0,0 @@
-import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { RbacService } from './rbac.service';
-/**
- * Guard that enforces Role-Based Access Control.
- *
- * Reads the required roles from the `@Roles()` decorator on the route
- * handler (or controller) and checks them against the authenticated user.
- *
- * This guard is independent — you can use it with or without PBAC on
- * different routes in the same application.
- */
-export declare class RbacGuard implements CanActivate {
-    private readonly reflector;
-    private readonly rbacService;
-    constructor(reflector: Reflector, rbacService: RbacService);
-    canActivate(context: ExecutionContext): Promise<boolean>;
-}
-//# sourceMappingURL=rbac.guard.d.ts.map

package/dist/auth/authorization/rbac/rbac.guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac.guard.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C;;;;;;;;GAQG;AACH,qBACa,SAAU,YAAW,WAAW;IAEzC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW;IAGrC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAmB/D"}

package/dist/auth/authorization/rbac/rbac.guard.js

@@ -1,50 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { Injectable } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { RbacService } from './rbac.service';
-import { METADATA_ROLES } from '../../auth.constants';
-/**
- * Guard that enforces Role-Based Access Control.
- *
- * Reads the required roles from the `@Roles()` decorator on the route
- * handler (or controller) and checks them against the authenticated user.
- *
- * This guard is independent — you can use it with or without PBAC on
- * different routes in the same application.
- */
-let RbacGuard = class RbacGuard {
-    reflector;
-    rbacService;
-    constructor(reflector, rbacService) {
-        this.reflector = reflector;
-        this.rbacService = rbacService;
-    }
-    async canActivate(context) {
-        const meta = this.reflector.getAllAndOverride(METADATA_ROLES, [context.getHandler(), context.getClass()]);
-        if (!meta || !meta.roles || meta.roles.length === 0) {
-            return true;
-        }
-        const request = context
-            .switchToHttp()
-            .getRequest();
-        const user = request.user;
-        if (!user)
-            return false;
-        return this.rbacService.hasRoles(user, meta.roles, meta.requireAll);
-    }
-};
-RbacGuard = __decorate([
-    Injectable(),
-    __metadata("design:paramtypes", [Reflector,
-        RbacService])
-], RbacGuard);
-export { RbacGuard };
-//# sourceMappingURL=rbac.guard.js.map

package/dist/auth/authorization/rbac/rbac.guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac.guard.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAiC,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;;GAQG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAED;IACA;IAFnB,YACmB,SAAoB,EACpB,WAAwB;QADxB,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAG1C,cAAc,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO;aACpB,YAAY,EAAE;aACd,UAAU,EAAmD,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAE1B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,CAAC;CACF,CAAA;AAzBY,SAAS;IADrB,UAAU,EAAE;qCAGmB,SAAS;QACP,WAAW;GAHhC,SAAS,CAyBrB"}

package/dist/auth/authorization/rbac/rbac.service.d.ts

@@ -1,43 +0,0 @@
-import type { IAuthUser, ICacheService } from '../../interfaces';
-/**
- * Service that resolves and caches role → permissions mappings.
- *
- * Cache key convention: `rbac:roles:<userId>` → string[]
- *                       `rbac:perms:<role>`    → string[]
- */
-export declare class RbacService {
-    private readonly cache;
-    constructor(cache: ICacheService);
-    /**
-     * Check if a user has at least one of the required roles.
-     *
-     * @param user       Authenticated user
-     * @param roles      List of role names required (at least one must match)
-     * @param requireAll If true, the user must have ALL specified roles
-     */
-    hasRoles(user: IAuthUser, roles: string[], requireAll?: boolean): Promise<boolean>;
-    /**
-     * Check if a user has a specific permission (derived from their roles).
-     *
-     * @param user       Authenticated user
-     * @param permission Permission identifier
-     */
-    hasPermission(user: IAuthUser, permission: string): Promise<boolean>;
-    /**
-     * Fetch roles for a user, using cache when possible.
-     */
-    getUserRoles(userId: string): Promise<string[]>;
-    /**
-     * Fetch permissions for a role, using cache when possible.
-     */
-    getRolePermissions(role: string): Promise<string[]>;
-    /**
-     * Invalidate the role cache for a user.
-     */
-    invalidateUser(userId: string): Promise<void>;
-    /**
-     * Invalidate the permission cache for a role.
-     */
-    invalidateRole(role: string): Promise<void>;
-}
-//# sourceMappingURL=rbac.service.d.ts.map

package/dist/auth/authorization/rbac/rbac.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac.service.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjE;;;;;GAKG;AACH,qBACa,WAAW;IAGpB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,aAAa;IAGvC;;;;;;OAMG;IACG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAUtF;;;;;OAKG;IACG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW1E;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOrD;;OAEG;IACG,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOzD;;OAEG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD;;OAEG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlD"}

package/dist/auth/authorization/rbac/rbac.service.js

@@ -1,95 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { Inject, Injectable } from '@nestjs/common';
-import { CACHE_SERVICE } from '../../auth.constants';
-/**
- * Service that resolves and caches role → permissions mappings.
- *
- * Cache key convention: `rbac:roles:<userId>` → string[]
- *                       `rbac:perms:<role>`    → string[]
- */
-let RbacService = class RbacService {
-    cache;
-    constructor(cache) {
-        this.cache = cache;
-    }
-    /**
-     * Check if a user has at least one of the required roles.
-     *
-     * @param user       Authenticated user
-     * @param roles      List of role names required (at least one must match)
-     * @param requireAll If true, the user must have ALL specified roles
-     */
-    async hasRoles(user, roles, requireAll = false) {
-        if (!roles.length)
-            return true;
-        const userRoles = user.roles ?? (await this.getUserRoles(user.id));
-        return requireAll
-            ? roles.every((r) => userRoles.includes(r))
-            : roles.some((r) => userRoles.includes(r));
-    }
-    /**
-     * Check if a user has a specific permission (derived from their roles).
-     *
-     * @param user       Authenticated user
-     * @param permission Permission identifier
-     */
-    async hasPermission(user, permission) {
-        const userRoles = user.roles ?? (await this.getUserRoles(user.id));
-        for (const role of userRoles) {
-            const perms = await this.getRolePermissions(role);
-            if (perms.includes(permission))
-                return true;
-        }
-        return false;
-    }
-    /**
-     * Fetch roles for a user, using cache when possible.
-     */
-    async getUserRoles(userId) {
-        const cacheKey = `rbac:roles:${userId}`;
-        const cached = await this.cache.get(cacheKey);
-        if (cached)
-            return cached;
-        return [];
-    }
-    /**
-     * Fetch permissions for a role, using cache when possible.
-     */
-    async getRolePermissions(role) {
-        const cacheKey = `rbac:perms:${role}`;
-        const cached = await this.cache.get(cacheKey);
-        if (cached)
-            return cached;
-        return [];
-    }
-    /**
-     * Invalidate the role cache for a user.
-     */
-    async invalidateUser(userId) {
-        await this.cache.del(`rbac:roles:${userId}`);
-    }
-    /**
-     * Invalidate the permission cache for a role.
-     */
-    async invalidateRole(role) {
-        await this.cache.del(`rbac:perms:${role}`);
-    }
-};
-RbacService = __decorate([
-    Injectable(),
-    __param(0, Inject(CACHE_SERVICE)),
-    __metadata("design:paramtypes", [Object])
-], RbacService);
-export { RbacService };
-//# sourceMappingURL=rbac.service.js.map

package/dist/auth/authorization/rbac/rbac.service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rbac.service.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;GAKG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAGH;IAFnB,YAEmB,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;IACpC,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAe,EAAE,KAAe,EAAE,UAAU,GAAG,KAAK;QACjE,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnE,OAAO,UAAU;YACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,IAAe,EAAE,UAAkB;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,QAAQ,GAAG,cAAc,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAY;QACnC,MAAM,QAAQ,GAAG,cAAc,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAzEY,WAAW;IADvB,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;;GAFb,WAAW,CAyEvB"}

package/dist/auth/decorators/current-user.decorator.d.ts

@@ -1,17 +0,0 @@
-import type { IAuthUser } from '../interfaces';
-/**
- * Parameter decorator that extracts the authenticated user from the request.
- *
- * @example
- * ```typescript
- * // Returns the full IAuthUser object
- * @Get('me')
- * getProfile(@CurrentUser() user: IAuthUser) { … }
- *
- * // Returns only the email
- * @Get('email')
- * getEmail(@CurrentUser('email') email: string) { … }
- * ```
- */
-export declare const CurrentUser: (...dataOrPipes: (keyof IAuthUser | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>> | undefined)[]) => ParameterDecorator;
-//# sourceMappingURL=current-user.decorator.d.ts.map

package/dist/auth/decorators/current-user.decorator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"current-user.decorator.d.ts","sourceRoot":"","sources":["../../../packages/auth/decorators/current-user.decorator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,8MAOvB,CAAC"}

package/dist/auth/decorators/current-user.decorator.js

@@ -1,23 +0,0 @@
-import { createParamDecorator } from '@nestjs/common';
-/**
- * Parameter decorator that extracts the authenticated user from the request.
- *
- * @example
- * ```typescript
- * // Returns the full IAuthUser object
- * @Get('me')
- * getProfile(@CurrentUser() user: IAuthUser) { … }
- *
- * // Returns only the email
- * @Get('email')
- * getEmail(@CurrentUser('email') email: string) { … }
- * ```
- */
-export const CurrentUser = createParamDecorator((key, ctx) => {
-    const request = ctx.switchToHttp().getRequest();
-    const user = request.user;
-    if (!user)
-        return undefined;
-    return key ? user[key] : user;
-});
-//# sourceMappingURL=current-user.decorator.js.map

package/dist/auth/decorators/current-user.decorator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../../packages/auth/decorators/current-user.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAyB,MAAM,gBAAgB,CAAC;AAG7E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAC7C,CAAC,GAAgC,EAAE,GAAqB,EAAW,EAAE;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwB,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC,CACF,CAAC"}

package/dist/auth/decorators/index.d.ts

@@ -1,3 +0,0 @@
-export { CurrentUser } from './current-user.decorator';
-export { Public } from './public.decorator';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/decorators/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../packages/auth/decorators/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/auth/decorators/index.js

@@ -1,3 +0,0 @@
-export { CurrentUser } from './current-user.decorator';
-export { Public } from './public.decorator';
-//# sourceMappingURL=index.js.map

package/dist/auth/decorators/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../packages/auth/decorators/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/auth/decorators/public.decorator.d.ts

@@ -1,13 +0,0 @@
-/**
- * Mark a route handler or controller as publicly accessible
- * (bypasses the global AuthGuard).
- *
- * @example
- * ```typescript
- * @Public()
- * @Get('login')
- * login() { … }
- * ```
- */
-export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;
-//# sourceMappingURL=public.decorator.d.ts.map

package/dist/auth/decorators/public.decorator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"public.decorator.d.ts","sourceRoot":"","sources":["../../../packages/auth/decorators/public.decorator.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,wDAA2C,CAAC"}

package/dist/auth/decorators/public.decorator.js

@@ -1,15 +0,0 @@
-import { SetMetadata } from '@nestjs/common';
-import { METADATA_PUBLIC } from '../auth.constants';
-/**
- * Mark a route handler or controller as publicly accessible
- * (bypasses the global AuthGuard).
- *
- * @example
- * ```typescript
- * @Public()
- * @Get('login')
- * login() { … }
- * ```
- */
-export const Public = () => SetMetadata(METADATA_PUBLIC, true);
-//# sourceMappingURL=public.decorator.js.map

package/dist/auth/decorators/public.decorator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../../../packages/auth/decorators/public.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC"}

package/dist/auth/index.d.ts

@@ -1,63 +0,0 @@
-/**
- * @os.io/nest-kit/auth
- *
- * Authentication & Authorization toolkit for NestJS applications.
- *
- * ## Features
- *
- * - **Authentication**: Credentials (email/password), OAuth (Google, GitHub,
- *   Facebook, Apple, Microsoft, Discord, custom), TOTP 2FA, Anonymous sessions,
- *   Magic Link, OTP (email/phone), Passkey (WebAuthn/FIDO2), OneTap (Google
- *   & Apple), SSO (SAML & OpenID Connect).
- * - **Authorization**: RBAC (Role-Based) and PBAC (Policy-Based) — use either
- *   or both independently on different routes.
- * - **Session**: Stateless JWT with refresh-token rotation, multi-device tracking,
- *   per-device logout (Telegram-style).
- * - **Security**: bcrypt password hashing, rate limiting, token blacklisting
- *   via Redis/Valkey, token versioning.
- * - **Scalability**: Horizontal scaling via shared cache; asymmetric JWT
- *   (RS256/ES256) enables service-to-service token validation without
- *   centralised auth calls.
- *
- * ## Quick Start
- *
- * ```typescript
- * import { AuthModule } from '@os.io/nest-kit/auth';
- *
- * @Module({
- *   imports: [
- *     AuthModule.forRoot({
- *       jwtSecret: process.env.JWT_SECRET,
- *       credentials: true,
- *       rbac: true,
- *     }),
- *   ],
- *   providers: [
- *     { provide: 'USER_SERVICE', useClass: MyUserService },
- *     { provide: 'CACHE_SERVICE', useExisting: getCache() },
- *   ],
- * })
- * export class AppModule {}
- * ```
- *
- * @module
- * @packageDocumentation
- */
-export { AuthModule } from './auth.module';
-export { AuthService } from './auth.service';
-export { AuthGuard } from './auth.guard';
-export { AUTH_MODULE_OPTIONS, CACHE_SERVICE, USER_SERVICE, AUTH_STRATEGIES, METADATA_PUBLIC, METADATA_ROLES, METADATA_PERMISSIONS, METADATA_POLICY, } from './auth.constants';
-export type { AuthModuleOptions, AuthModuleAsyncOptions, CredentialsOptions, OAuthOptions, OAuthProviderConfig, TOTPOptions, AnonymousOptions, MagicLinkOptions, OTPOptions, PasskeyOptions, OneTapOptions, SSOOptions, SamlProviderConfig, OidcProviderConfig, RBACOptions, PBACOptions, SessionOptions, ThrottleOptions, } from './auth.options';
-export type { IAuthUser, IAuthRequest, ITokenPair, IAuthResult, IAuthStrategy, ICacheService, IUserService, } from './interfaces';
-export { AuthMethod } from './interfaces';
-export { CurrentUser, Public } from './decorators';
-export { JwtService, TokenBlacklistService, DeviceSessionService } from './session';
-export type { IDeviceInfo } from './session';
-export { PasswordService } from './password/password.service';
-export { ThrottleService } from './throttling/throttle.service';
-export { BaseStrategy, CredentialsStrategy, OAuthStrategy, OAuthProviderRegistry, TotpStrategy, AnonymousStrategy, MagicLinkStrategy, OtpStrategy, PasskeyStrategy, OneTapStrategy, SsoStrategy, } from './strategies';
-export { RbacService, RbacGuard, Roles } from './authorization/rbac';
-export { PbacService, PbacGuard, RequirePolicy } from './authorization/pbac';
-export type { PolicyDecoratorOptions } from './authorization/pbac';
-export type { PolicyStatement, PolicyDocument, PolicyContext, PolicyEffect, } from './authorization/pbac';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../packages/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACpF,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EACV,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,GACb,MAAM,sBAAsB,CAAC"}

package/dist/auth/index.js

@@ -1,65 +0,0 @@
-/**
- * @os.io/nest-kit/auth
- *
- * Authentication & Authorization toolkit for NestJS applications.
- *
- * ## Features
- *
- * - **Authentication**: Credentials (email/password), OAuth (Google, GitHub,
- *   Facebook, Apple, Microsoft, Discord, custom), TOTP 2FA, Anonymous sessions,
- *   Magic Link, OTP (email/phone), Passkey (WebAuthn/FIDO2), OneTap (Google
- *   & Apple), SSO (SAML & OpenID Connect).
- * - **Authorization**: RBAC (Role-Based) and PBAC (Policy-Based) — use either
- *   or both independently on different routes.
- * - **Session**: Stateless JWT with refresh-token rotation, multi-device tracking,
- *   per-device logout (Telegram-style).
- * - **Security**: bcrypt password hashing, rate limiting, token blacklisting
- *   via Redis/Valkey, token versioning.
- * - **Scalability**: Horizontal scaling via shared cache; asymmetric JWT
- *   (RS256/ES256) enables service-to-service token validation without
- *   centralised auth calls.
- *
- * ## Quick Start
- *
- * ```typescript
- * import { AuthModule } from '@os.io/nest-kit/auth';
- *
- * @Module({
- *   imports: [
- *     AuthModule.forRoot({
- *       jwtSecret: process.env.JWT_SECRET,
- *       credentials: true,
- *       rbac: true,
- *     }),
- *   ],
- *   providers: [
- *     { provide: 'USER_SERVICE', useClass: MyUserService },
- *     { provide: 'CACHE_SERVICE', useExisting: getCache() },
- *   ],
- * })
- * export class AppModule {}
- * ```
- *
- * @module
- * @packageDocumentation
- */
-export { AuthModule } from './auth.module';
-export { AuthService } from './auth.service';
-export { AuthGuard } from './auth.guard';
-// ── Constants ──
-export { AUTH_MODULE_OPTIONS, CACHE_SERVICE, USER_SERVICE, AUTH_STRATEGIES, METADATA_PUBLIC, METADATA_ROLES, METADATA_PERMISSIONS, METADATA_POLICY, } from './auth.constants';
-export { AuthMethod } from './interfaces';
-// ── Decorators ──
-export { CurrentUser, Public } from './decorators';
-// ── Session ──
-export { JwtService, TokenBlacklistService, DeviceSessionService } from './session';
-// ── Password ──
-export { PasswordService } from './password/password.service';
-// ── Throttling ──
-export { ThrottleService } from './throttling/throttle.service';
-// ── Strategies ──
-export { BaseStrategy, CredentialsStrategy, OAuthStrategy, OAuthProviderRegistry, TotpStrategy, AnonymousStrategy, MagicLinkStrategy, OtpStrategy, PasskeyStrategy, OneTapStrategy, SsoStrategy, } from './strategies';
-// ── Authorization ──
-export { RbacService, RbacGuard, Roles } from './authorization/rbac';
-export { PbacService, PbacGuard, RequirePolicy } from './authorization/pbac';
-//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../packages/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAkC1B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,mBAAmB;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEnD,gBAAgB;AAChB,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAGpF,iBAAiB;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,mBAAmB;AACnB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,sBAAsB;AACtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/auth/interfaces/auth-request.interface.d.ts

@@ -1,18 +0,0 @@
-import type { IAuthUser } from './auth-user.interface';
-/**
- * Extended Express/NestJS request with authenticated user info.
- * Attached by AuthGuard after successful token validation.
- */
-export interface IAuthRequest {
-    /** Authenticated user entity */
-    user?: IAuthUser;
-    /** Raw access token from the request */
-    accessToken?: string;
-    /** Raw refresh token (if present in request) */
-    refreshToken?: string;
-    /** Device / session identifier for multi-device tracking */
-    deviceId?: string;
-    /** Session identifier */
-    sessionId?: string;
-}
-//# sourceMappingURL=auth-request.interface.d.ts.map

package/dist/auth/interfaces/auth-request.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-request.interface.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-request.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/auth/interfaces/auth-request.interface.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=auth-request.interface.js.map

package/dist/auth/interfaces/auth-request.interface.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-request.interface.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-request.interface.ts"],"names":[],"mappings":""}

package/dist/auth/interfaces/auth-result.interface.d.ts

@@ -1,28 +0,0 @@
-import type { IAuthUser } from './auth-user.interface';
-/**
- * Pair of access and refresh tokens returned from successful authentication.
- */
-export interface ITokenPair {
-    /** Short-lived JWT access token (Bearer) */
-    accessToken: string;
-    /** Long-lived refresh token for rotating sessions */
-    refreshToken: string;
-    /** Access token TTL in seconds */
-    expiresIn: number;
-}
-/**
- * Result returned by every authentication strategy on success.
- */
-export interface IAuthResult {
-    /** Authenticated user entity */
-    user: IAuthUser;
-    /** Token pair for subsequent requests */
-    tokens: ITokenPair;
-    /** Whether the user was just created (first sign-up) */
-    isNewUser?: boolean;
-    /** Whether the user must complete a second factor */
-    isMfaRequired?: boolean;
-    /** Server-generated session identifier */
-    sessionId?: string;
-}
-//# sourceMappingURL=auth-result.interface.d.ts.map

package/dist/auth/interfaces/auth-result.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-result.interface.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-result.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,UAAU,CAAC;IACnB,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/auth/interfaces/auth-result.interface.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=auth-result.interface.js.map

package/dist/auth/interfaces/auth-result.interface.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-result.interface.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-result.interface.ts"],"names":[],"mappings":""}

package/dist/auth/interfaces/auth-strategy.interface.d.ts

@@ -1,37 +0,0 @@
-import type { ExecutionContext } from '@nestjs/common';
-import type { IAuthResult } from './auth-result.interface';
-/**
- * Authentication method enum — each value maps to a strategy.
- */
-export declare enum AuthMethod {
-    CREDENTIALS = "credentials",
-    OAUTH = "oauth",
-    TOTP = "totp",
-    ANONYMOUS = "anonymous",
-    MAGIC_LINK = "magic-link",
-    OTP = "otp",
-    PASSKEY = "passkey",
-    ONETAP = "onetap",
-    SSO = "sso"
-}
-/**
- * Every authentication strategy must implement this interface.
- * Strategies are registered in the IoC container and discovered by AuthGuard.
- */
-export interface IAuthStrategy {
-    /** Unique strategy type identifier */
-    readonly type: AuthMethod;
-    /** Human-readable strategy name for logging / debugging */
-    readonly name: string;
-    /**
-     * Attempt to authenticate the request.
-     *
-     * @param payload  Strategy-specific authentication payload
-     *                 (e.g. { email, password } for credentials,
-     *                  { provider, code } for OAuth, …)
-     * @param context  Optional NestJS execution context for
-     *                 access to request / response objects
-     */
-    authenticate(payload: Record<string, unknown>, context?: ExecutionContext): Promise<IAuthResult>;
-}
-//# sourceMappingURL=auth-strategy.interface.d.ts.map