@os.io/nest-kit 0.0.1-alpha.0

package/dist/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../packages/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAqC,MAAM,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEnF,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAG9D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;AAGjC,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB;;OAEG;IACH,MAAM,CAAC,OAAO,CAAC,OAA0B,EAAE,iBAA6B,EAAE;QACxE,OAAO,YAAU,CAAC,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,cAAc,GAAG,YAAU,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,iBAAiB,GAAG,YAAU,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,aAAa,GAAG,YAAU,CAAC,mBAAmB,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,YAAU,CAAC,oBAAoB,EAAE,CAAC;QACzD,MAAM,yBAAyB,GAAG,YAAU,CAAC,+BAA+B,EAAE,CAAC;QAE/E,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,SAAS,EAAE;gBACT,GAAG,cAAc;gBACjB,GAAG,iBAAiB;gBACpB,GAAG,aAAa;gBAChB,GAAG,cAAc;gBACjB,yBAAyB;gBACzB,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;aAClC;YACD,OAAO,EAAE,YAAU,CAAC,UAAU,EAAE;SACjC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,WAAW,CACxB,OAA0B,EAC1B,cAA0B;QAE1B,MAAM,SAAS,GAAe;YAC5B,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE;YACnD,GAAG,YAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAC5C,GAAG,YAAU,CAAC,mBAAmB,EAAE;YACnC,GAAG,YAAU,CAAC,oBAAoB,EAAE;YACpC,YAAU,CAAC,+BAA+B,EAAE;YAC5C,GAAG,cAAc;SAClB,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CACT,0EAA0E;gBACxE,0CAA0C,CAC7C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,IAAI;YAC9B,SAAS;YACT,OAAO,EAAE,YAAU,CAAC,UAAU,EAAE;SACjC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,oBAAoB,CAAC,OAA+B;QACjE,OAAO;YACL;gBACE,OAAO,EAAE,mBAAmB;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,uBAAuB,CAAC,KAAc;QACnD,MAAM,SAAS,GAAe,EAAE,CAAC;QAEjC,6DAA6D;QAC7D,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,mBAAmB;YAC5B,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;oBAClC,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;gBAC9E,CAAC;gBACD,OAAO,IAAI,mBAAmB,CAC5B,IAAI,CAAC,CAAC,CAAiB,EACvB,IAAI,CAAC,CAAC,CAAoB,EAC1B,IAAI,CAAC,CAAC,CAAe,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,CAAW;gBAC7E,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,CAAW;SAChF,CAAC,CAAC;QAEH,uCAAuC;QACvC,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,aAAa;YACtB,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;oBACnB,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,QAAQ,GAAG,IAAI,qBAAqB,EAAE,CAAC;gBAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAgC,CAAC;gBAC3D,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;wBAC5C,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAY,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAiB,EAAE,IAAI,CAAC,CAAC,CAAe,EAAE,QAAQ,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;gBAC5D,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;SAC/D,CAAC,CAAC;QAEH,sCAAsC;QACtC,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBAClB,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBACvE,CAAC;gBACD,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAiB,EAAE,IAAI,CAAC,CAAC,CAAe,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;gBAC5D,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;SAC/D,CAAC,CAAC;QAEH,2CAA2C;QAC3C,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC5E,CAAC;gBACD,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAe,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,UAAU,CAAW;gBAC9C,CAAC,CAAE,CAAC,mBAAmB,EAAE,UAAU,CAAW;SACjD,CAAC,CAAC;QAEH,4CAA4C;QAC5C,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC7E,CAAC;gBACD,OAAO,IAAI,iBAAiB,CAC1B,IAAI,CAAC,CAAC,CAAkB,EACxB,IAAI,CAAC,CAAC,CAAiB,EACvB,IAAI,CAAC,CAAC,CAAe,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAW;gBAC3E,CAAC,CAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAW;SAC9E,CAAC,CAAC;QAEH,qCAAqC;QACrC,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBACjB,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO,IAAI,WAAW,CACpB,IAAI,CAAC,CAAC,CAAkB,EACxB,IAAI,CAAC,CAAC,CAAiB,EACvB,IAAI,CAAC,CAAC,CAAe,CACtB,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAW;gBAC3E,CAAC,CAAE,CAAC,mBAAmB,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAW;SAC9E,CAAC,CAAC;QAEH,yCAAyC;QACzC,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAiB,EAAE,IAAI,CAAC,CAAC,CAAe,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;gBAC5D,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;SAC/D,CAAC,CAAC;QAEH,wCAAwC;QACxC,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,cAAc;YACvB,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpB,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACzE,CAAC;gBACD,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAiB,EAAE,IAAI,CAAC,CAAC,CAAe,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;gBAC5D,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;SAC/D,CAAC,CAAC;QAEH,qCAAqC;QACrC,SAAS,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,WAAW;YACpB,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAsB,CAAC;gBAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;oBACjB,OAAO,YAAU,CAAC,sBAAsB,CAAC,YAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtE,CAAC;gBACD,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAiB,EAAE,IAAI,CAAC,CAAC,CAAe,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,EAAE,KAAK;gBACX,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;gBAC5D,CAAC,CAAE,CAAC,mBAAmB,EAAE,YAAY,EAAE,UAAU,CAAW;SAC/D,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,mBAAmB;QAChC,OAAO;YACL,WAAW;YACX,SAAS;YACT,eAAe;YACf,UAAU;YACV,qBAAqB;YACrB,oBAAoB;YACpB,eAAe;SAChB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,oBAAoB;QACjC,OAAO;YACL,SAAS;YACT;gBACE,OAAO,EAAE,WAAW;gBACpB,UAAU,EAAE,CAAC,KAAoB,EAAE,EAAE;oBACnC,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;gBAChC,CAAC;gBACD,MAAM,EAAE,CAAC,aAAa,CAAC;aACxB;YACD;gBACE,OAAO,EAAE,SAAS;gBAClB,UAAU,EAAE,CAAC,SAAkB,EAAE,WAAwB,EAAE,EAAE;oBAC3D,OAAO,IAAI,SAAS,CAAC,SAAkB,EAAE,WAAW,CAAC,CAAC;gBACxD,CAAC;gBACD,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;aACnC;YACD;gBACE,OAAO,EAAE,WAAW;gBACpB,UAAU,EAAE,CAAC,KAAoB,EAAE,EAAE;oBACnC,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;gBAChC,CAAC;gBACD,MAAM,EAAE,CAAC,aAAa,CAAC;aACxB;SACF,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,+BAA+B;QAC5C,OAAO;YACL,OAAO,EAAE,eAAe;YACxB,UAAU,EAAE,CACV,WAA0B,EAC1B,KAAoB,EACpB,IAAmB,EACnB,SAAwB,EACxB,SAAwB,EACxB,GAAkB,EAClB,OAAsB,EACtB,MAAqB,EACrB,GAAkB,EAClB,EAAE;gBACF,MAAM,GAAG,GAAG;oBACV,WAAW;oBACX,KAAK;oBACL,IAAI;oBACJ,SAAS;oBACT,SAAS;oBACT,GAAG;oBACH,OAAO;oBACP,MAAM;oBACN,GAAG;iBACe,CAAC;gBACrB,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAiC,CAAC,SAAS,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,EAAE;gBACN,mBAAmB;gBACnB,aAAa;gBACb,YAAY;gBACZ,iBAAiB;gBACjB,iBAAiB;gBACjB,WAAW;gBACX,eAAe;gBACf,cAAc;gBACd,WAAW;aACZ;SACF,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,UAAU;QACvB,OAAO;YACL,WAAW;YACX,SAAS;YACT,WAAW;YACX,SAAS;YACT,WAAW;YACX,SAAS;YACT,eAAe;YACf,UAAU;YACV,qBAAqB;YACrB,oBAAoB;YACpB,eAAe;YACf,mBAAmB;YACnB,aAAa;YACb,qBAAqB;YACrB,YAAY;YACZ,iBAAiB;YACjB,iBAAiB;YACjB,WAAW;YACX,eAAe;YACf,cAAc;YACd,WAAW;SACZ,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,sBAAsB,CAAC,IAAY;QAChD,MAAM,CAAC,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACjC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,MAAc;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AA/VY,UAAU;IADtB,MAAM,CAAC,EAAE,CAAC;GACE,UAAU,CA+VtB;;AAED,MAAM,gBAAgB;IACpB,SAAS,GAAG,IAAI,CAAC;IACjB,KAAK,GAAG,UAAU,CAAC;IACnB,IAAI,GAAG,EAAW,CAAC;IACnB,IAAI,GAAG,UAAU,CAAC;IAElB,YAAY;QACV,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,kBAAkB,CAAC,CAAC;IAC7D,CAAC;CACF"}

package/dist/auth/auth.options.d.ts

@@ -0,0 +1,179 @@
+import type { Provider, DynamicModule, Type } from '@nestjs/common';
+import type { AuthMethod } from './interfaces';
+export interface CredentialsOptions {
+    /** Enable email login (default true) */
+    email?: boolean;
+    /** Enable username login (default false) */
+    username?: boolean;
+    /** Require email verification before login (default false) */
+    requireEmailVerification?: boolean;
+}
+export interface OAuthProviderConfig {
+    clientId: string;
+    clientSecret: string;
+    callbackUrl: string;
+    scopes?: string[];
+    additionalParams?: Record<string, string>;
+}
+export interface OAuthOptions {
+    google?: OAuthProviderConfig;
+    github?: OAuthProviderConfig;
+    facebook?: OAuthProviderConfig;
+    apple?: OAuthProviderConfig;
+    microsoft?: OAuthProviderConfig;
+    discord?: OAuthProviderConfig;
+    custom?: Record<string, OAuthProviderConfig>;
+}
+export interface TOTPOptions {
+    /** Issuer name shown in authenticator apps (default "NestKit") */
+    issuer?: string;
+    /** Number of backup codes to generate (default 8) */
+    backupCodeCount?: number;
+    /** Algorithm: 'sha1' | 'sha256' | 'sha512' (default 'sha1') */
+    algorithm?: 'sha1' | 'sha256' | 'sha512';
+    /** Number of digits (default 6) */
+    digits?: number;
+    /** TOTP step window (seconds, default 30) */
+    period?: number;
+}
+export interface AnonymousOptions {
+    /** Prefix for anonymous user IDs (default "anon_") */
+    idPrefix?: string;
+    /** Whether anonymous sessions can be persisted (default true) */
+    allowConversion?: boolean;
+}
+export interface MagicLinkOptions {
+    /** Token expiry in seconds (default 900 / 15 min) */
+    tokenExpiresIn?: number;
+    /** Token length in bytes (default 32) */
+    tokenBytes?: number;
+}
+export interface OTPOptions {
+    /** OTP code length (default 6) */
+    digits?: number;
+    /** OTP expiry in seconds (default 300 / 5 min) */
+    expiresIn?: number;
+    /** Max allowed attempts before code is invalidated (default 3) */
+    maxAttempts?: number;
+}
+export interface PasskeyOptions {
+    /** Relying Party name (default "NestKit") */
+    rpName?: string;
+    /** Relying Party ID (default request hostname) */
+    rpId?: string;
+    /** Origin URL(s) allowed (default [request origin]) */
+    origins?: string[];
+    /** Timeout for WebAuthn ceremonies (ms, default 60000) */
+    timeout?: number;
+}
+export interface OneTapOptions {
+    google?: {
+        clientId: string;
+    };
+    apple?: {
+        clientId: string;
+        keyId: string;
+        teamId: string;
+        privateKey: string;
+    };
+}
+export interface SSOOptions {
+    /** SAML providers */
+    saml?: Record<string, SamlProviderConfig>;
+    /** OIDC providers */
+    oidc?: Record<string, OidcProviderConfig>;
+}
+export interface SamlProviderConfig {
+    entryPoint: string;
+    issuer: string;
+    cert?: string;
+    privateKey?: string;
+    callbackUrl: string;
+}
+export interface OidcProviderConfig {
+    issuerUrl: string;
+    clientId: string;
+    clientSecret: string;
+    callbackUrl: string;
+    scopes?: string[];
+}
+export interface RBACOptions {
+    /** Key in JWT payload that holds roles (default "roles") */
+    rolesClaim?: string;
+    /** Whether to require at least one role on protected routes (default true) */
+    requireRole?: boolean;
+}
+export interface PBACOptions {
+    /** Policy evaluation mode (default "deny-unless-permit") */
+    defaultEffect?: 'deny-unless-permit' | 'permit-unless-deny';
+}
+export interface SessionOptions {
+    /** Access token TTL (default "15m") */
+    accessTokenExpiresIn?: string;
+    /** Refresh token TTL (default "7d") */
+    refreshTokenExpiresIn?: string;
+    /** JWT signing algorithm (default "HS256") */
+    algorithm?: 'HS256' | 'RS256' | 'ES256';
+    /** Custom issuer claim */
+    issuer?: string;
+    /** Custom audience claim */
+    audience?: string;
+    /** Blacklist TTL (seconds, default = refresh token TTL) */
+    blacklistTtl?: number;
+    /** Enable refresh token rotation (default true) */
+    rotation?: boolean;
+    /** Enable multi-device tracking (default false) */
+    multiDevice?: boolean;
+}
+export interface ThrottleOptions {
+    /** Max login attempts per window (default 5) */
+    maxAttempts?: number;
+    /** Window duration in seconds (default 900 / 15 min) */
+    windowSeconds?: number;
+}
+export interface AuthModuleOptions {
+    /** JWT secret (required for HS256, ignored for RS256/ES256) */
+    jwtSecret?: string;
+    /** Private key PEM (required for RS256/ES256) */
+    jwtPrivateKey?: string;
+    /** Public key PEM (required for RS256/ES256) */
+    jwtPublicKey?: string;
+    /** Bcrypt cost rounds (default 12) */
+    passwordRounds?: number;
+    /** Injection token for your cache-service provider (default 'CACHE_SERVICE') */
+    cacheServiceToken?: string;
+    /**
+     * Injection token for your user-service provider (default 'USER_SERVICE').
+     * The token must resolve to an object implementing IUserService.
+     */
+    userServiceToken?: string;
+    /** Additional NestJS providers to register (e.g. your own services) */
+    extraProviders?: Provider[];
+    credentials?: boolean | CredentialsOptions;
+    oauth?: boolean | OAuthOptions;
+    totp?: boolean | TOTPOptions;
+    anonymous?: boolean | AnonymousOptions;
+    magicLink?: boolean | MagicLinkOptions;
+    otp?: boolean | OTPOptions;
+    passkey?: boolean | PasskeyOptions;
+    onetap?: boolean | OneTapOptions;
+    sso?: boolean | SSOOptions;
+    /**
+     * Override the default authentication method for routes.
+     * If not set, AuthGuard uses the first enabled strategy.
+     */
+    defaultAuthMethod?: AuthMethod;
+    rbac?: boolean | RBACOptions;
+    pbac?: boolean | PBACOptions;
+    session?: SessionOptions;
+    throttle?: ThrottleOptions;
+    global?: boolean;
+}
+export interface AuthModuleAsyncOptions {
+    useFactory: (...args: unknown[]) => Promise<AuthModuleOptions> | AuthModuleOptions;
+    inject?: (Type<unknown> | string | symbol)[];
+    imports?: DynamicModule['imports'];
+    extraProviders?: Provider[];
+    global?: boolean;
+}
+//# sourceMappingURL=auth.options.d.ts.map

package/dist/auth/auth.options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.options.d.ts","sourceRoot":"","sources":["../../packages/auth/auth.options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8DAA8D;IAC9D,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,WAAW;IAC1B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACzC,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yCAAyC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,WAAW,UAAU;IACzB,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1C,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAID,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,aAAa,CAAC,EAAE,oBAAoB,GAAG,oBAAoB,CAAC;CAC7D;AAID,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uCAAuC;IACvC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,8CAA8C;IAC9C,SAAS,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IACxC,0BAA0B;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mDAAmD;IACnD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAID,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wDAAwD;IACxD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IAGxB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,uEAAuE;IACvE,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC;IAG5B,WAAW,CAAC,EAAE,OAAO,GAAG,kBAAkB,CAAC;IAC3C,KAAK,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAC7B,SAAS,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACvC,SAAS,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACvC,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IACnC,MAAM,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACjC,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAG3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,UAAU,CAAC;IAG/B,IAAI,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAG7B,OAAO,CAAC,EAAE,cAAc,CAAC;IAGzB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAG3B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,GAAG,iBAAiB,CAAC;IACnF,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC7C,OAAO,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB"}

package/dist/auth/auth.options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth.options.js.map

package/dist/auth/auth.options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.options.js","sourceRoot":"","sources":["../../packages/auth/auth.options.ts"],"names":[],"mappings":""}

package/dist/auth/auth.service.d.ts

@@ -0,0 +1,57 @@
+import { type ExecutionContext } from '@nestjs/common';
+import type { IAuthResult, IAuthStrategy, ICacheService, ITokenPair } from './interfaces';
+import { AuthMethod } from './interfaces';
+import type { AuthModuleOptions } from './auth.options';
+import { JwtService } from './session/jwt.service';
+import { TokenBlacklistService } from './session/token-blacklist.service';
+import { DeviceSessionService } from './session/device-session.service';
+/**
+ * Central authentication orchestrator.
+ *
+ * Delegates to the appropriate strategy based on `AuthMethod`,
+ * manages token lifecycle, session tracking, and cache acceleration.
+ */
+export declare class AuthService {
+    private readonly options;
+    private readonly cache;
+    private readonly jwtService;
+    private readonly tokenBlacklist;
+    private readonly deviceSession;
+    private readonly strategyMap;
+    constructor(options: AuthModuleOptions, _strategies: IAuthStrategy[], cache: ICacheService, jwtService: JwtService, tokenBlacklist: TokenBlacklistService, deviceSession: DeviceSessionService);
+    /**
+     * Authenticate using the given method.
+     *
+     * @param method  Authentication method (e.g. 'credentials', 'oauth')
+     * @param payload Strategy-specific payload
+     * @param context Optional execution context
+     */
+    authenticate(method: AuthMethod, payload: Record<string, unknown>, context?: ExecutionContext): Promise<IAuthResult>;
+    /**
+     * Validate an access token and return its decoded payload.
+     * Uses cache for fast-path validation when available.
+     *
+     * @param token Raw JWT access token
+     */
+    validateToken(token: string): Promise<Record<string, unknown>>;
+    /**
+     * Refresh an expired access token using a refresh token.
+     * Implements refresh token rotation.
+     */
+    refreshToken(refreshToken: string, deviceId?: string): Promise<ITokenPair>;
+    /**
+     * Logout — blacklist the current access token and optionally
+     * remove a specific device session.
+     */
+    logout(accessToken: string, deviceId?: string): Promise<void>;
+    /**
+     * Logout from all devices — revoke all sessions for a user.
+     */
+    logoutAll(userId: string): Promise<void>;
+    /**
+     * Get all active sessions for a user (multi-device view).
+     */
+    getUserSessions(userId: string): Promise<import("./session").IDeviceInfo[]>;
+    private hash;
+}
+//# sourceMappingURL=auth.service.d.ts.map

package/dist/auth/auth.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../packages/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE;;;;;GAKG;AACH,qBACa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAIxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAXhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAwC;gBAIjD,OAAO,EAAE,iBAAiB,EAE3C,WAAW,EAAE,aAAa,EAAE,EAEX,KAAK,EAAE,aAAa,EACpB,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,qBAAqB,EACrC,aAAa,EAAE,oBAAoB;IAOtD;;;;;;OAMG;IACG,YAAY,CAChB,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,CAAC;IAsBvB;;;;;OAKG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAoBpE;;;OAGG;IACG,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA2ChF;;;OAGG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnE;;OAEG;IACG,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C;;OAEG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM;IAIpC,OAAO,CAAC,IAAI;CASb"}

package/dist/auth/auth.service.js

@@ -0,0 +1,175 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { AUTH_MODULE_OPTIONS, AUTH_STRATEGIES, CACHE_SERVICE } from './auth.constants';
+import { JwtService } from './session/jwt.service';
+import { TokenBlacklistService } from './session/token-blacklist.service';
+import { DeviceSessionService } from './session/device-session.service';
+/**
+ * Central authentication orchestrator.
+ *
+ * Delegates to the appropriate strategy based on `AuthMethod`,
+ * manages token lifecycle, session tracking, and cache acceleration.
+ */
+let AuthService = class AuthService {
+    options;
+    cache;
+    jwtService;
+    tokenBlacklist;
+    deviceSession;
+    strategyMap = new Map();
+    constructor(options, _strategies, cache, jwtService, tokenBlacklist, deviceSession) {
+        this.options = options;
+        this.cache = cache;
+        this.jwtService = jwtService;
+        this.tokenBlacklist = tokenBlacklist;
+        this.deviceSession = deviceSession;
+        for (const strategy of _strategies) {
+            this.strategyMap.set(strategy.type, strategy);
+        }
+    }
+    /**
+     * Authenticate using the given method.
+     *
+     * @param method  Authentication method (e.g. 'credentials', 'oauth')
+     * @param payload Strategy-specific payload
+     * @param context Optional execution context
+     */
+    async authenticate(method, payload, context) {
+        const strategy = this.strategyMap.get(method);
+        if (!strategy) {
+            throw new Error(`Authentication method "${method}" is not enabled`);
+        }
+        const result = await strategy.authenticate(payload, context);
+        // Track device session if multi-device is enabled
+        if (this.options.session?.multiDevice) {
+            await this.deviceSession.register({
+                deviceId: payload.deviceId ?? 'default',
+                userId: result.user.id,
+                userAgent: payload.userAgent,
+                ip: payload.ip,
+                lastActivity: Date.now(),
+            });
+        }
+        return result;
+    }
+    /**
+     * Validate an access token and return its decoded payload.
+     * Uses cache for fast-path validation when available.
+     *
+     * @param token Raw JWT access token
+     */
+    async validateToken(token) {
+        // Fast-path: check cache first
+        const cacheKey = `auth:token:${this.hash(token)}`;
+        const cached = await this.cache.get(cacheKey);
+        if (cached)
+            return cached;
+        const payload = await this.jwtService.verifyAccess(token);
+        // Check blacklist
+        const jti = payload.jti;
+        if (jti && (await this.tokenBlacklist.isBlacklisted(jti))) {
+            throw new Error('Token has been revoked');
+        }
+        // Cache the validated payload for 30 seconds
+        await this.cache.set(cacheKey, payload, 30);
+        return payload;
+    }
+    /**
+     * Refresh an expired access token using a refresh token.
+     * Implements refresh token rotation.
+     */
+    async refreshToken(refreshToken, deviceId) {
+        const payload = await this.jwtService.verifyRefresh(refreshToken);
+        const userId = payload.sub;
+        // Check family revocation
+        if (this.options.session?.rotation !== false) {
+            const familyId = payload.family ?? payload.jti;
+            if (familyId && (await this.tokenBlacklist.isFamilyRevoked(familyId))) {
+                throw new Error('Refresh token family has been revoked');
+            }
+        }
+        // In rotation mode, blacklist the current refresh token
+        if (this.options.session?.rotation !== false && payload.jti) {
+            const exp = payload.exp;
+            const ttl = exp ? Math.max(1, exp - Math.floor(Date.now() / 1000)) : 86400;
+            await this.tokenBlacklist.blacklistAccess(payload.jti, ttl);
+        }
+        const user = {
+            id: userId,
+            email: payload.email,
+            username: payload.username,
+            roles: payload.roles,
+            permissions: payload.permissions,
+            isAnonymous: payload.isAnonymous ?? false,
+            isMfaVerified: payload.isMfaVerified ?? false,
+        };
+        const tokens = await this.jwtService.signTokens(user);
+        // Update device session timestamp
+        if (deviceId) {
+            const session = await this.deviceSession.getSession(userId, deviceId);
+            if (session) {
+                session.lastActivity = Date.now();
+                await this.deviceSession.register(session);
+            }
+        }
+        return tokens;
+    }
+    /**
+     * Logout — blacklist the current access token and optionally
+     * remove a specific device session.
+     */
+    async logout(accessToken, deviceId) {
+        const payload = this.jwtService.decode(accessToken);
+        const jti = payload?.jti ?? this.hash(accessToken);
+        const exp = payload?.exp;
+        const ttl = exp ? Math.max(1, exp - Math.floor(Date.now() / 1000)) : 3600;
+        await this.tokenBlacklist.blacklistAccess(jti, ttl);
+        const userId = payload?.sub;
+        if (userId && deviceId) {
+            await this.deviceSession.removeSession(userId, deviceId);
+        }
+    }
+    /**
+     * Logout from all devices — revoke all sessions for a user.
+     */
+    async logoutAll(userId) {
+        await this.deviceSession.removeAllUserSessions(userId);
+    }
+    /**
+     * Get all active sessions for a user (multi-device view).
+     */
+    async getUserSessions(userId) {
+        return this.deviceSession.getUserSessions(userId);
+    }
+    hash(value) {
+        let hash = 0;
+        for (let i = 0; i < value.length; i++) {
+            const char = value.charCodeAt(i);
+            hash = (hash << 5) - hash + char;
+            hash |= 0;
+        }
+        return Math.abs(hash).toString(16);
+    }
+};
+AuthService = __decorate([
+    Injectable(),
+    __param(0, Inject(AUTH_MODULE_OPTIONS)),
+    __param(1, Inject(AUTH_STRATEGIES)),
+    __param(2, Inject(CACHE_SERVICE)),
+    __metadata("design:paramtypes", [Object, Array, Object, JwtService,
+        TokenBlacklistService,
+        DeviceSessionService])
+], AuthService);
+export { AuthService };
+//# sourceMappingURL=auth.service.js.map

package/dist/auth/auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../packages/auth/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAyB,MAAM,gBAAgB,CAAC;AAG3E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE;;;;;GAKG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAKH;IAIA;IACA;IACA;IACA;IAXF,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEpE,YAEmB,OAA0B,EAE3C,WAA4B,EAEX,KAAoB,EACpB,UAAsB,EACtB,cAAqC,EACrC,aAAmC;QAPnC,YAAO,GAAP,OAAO,CAAmB;QAI1B,UAAK,GAAL,KAAK,CAAe;QACpB,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAAuB;QACrC,kBAAa,GAAb,aAAa,CAAsB;QAEpD,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,MAAkB,EAClB,OAAgC,EAChC,OAA0B;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,kBAAkB,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE7D,kDAAkD;QAClD,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAChC,QAAQ,EAAG,OAAO,CAAC,QAAmB,IAAI,SAAS;gBACnD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;gBACtB,SAAS,EAAE,OAAO,CAAC,SAA+B;gBAClD,EAAE,EAAE,OAAO,CAAC,EAAwB;gBACpC,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;aACzB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,QAAQ,CAAC,CAAC;QACvE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAE1D,kBAAkB;QAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAyB,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,6CAA6C;QAC7C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAE5C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,YAAoB,EAAE,QAAiB;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAa,CAAC;QAErC,0BAA0B;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;YAC/C,IAAI,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,QAAkB,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,KAAK,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAyB,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAC3E,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAa,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG;YACX,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,OAAO,CAAC,KAA2B;YAC1C,QAAQ,EAAE,OAAO,CAAC,QAA8B;YAChD,KAAK,EAAE,OAAO,CAAC,KAA6B;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAmC;YACxD,WAAW,EAAG,OAAO,CAAC,WAAuB,IAAI,KAAK;YACtD,aAAa,EAAG,OAAO,CAAC,aAAyB,IAAI,KAAK;SAC3D,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtD,kCAAkC;QAClC,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACtE,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,QAAiB;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,GAAG,GAAI,OAAO,EAAE,GAAc,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,OAAO,EAAE,GAAyB,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE1E,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,OAAO,EAAE,GAAyB,CAAC;QAClD,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAEO,IAAI,CAAC,KAAa;QACxB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;YACjC,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;CACF,CAAA;AAtKY,WAAW;IADvB,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAE3B,WAAA,MAAM,CAAC,eAAe,CAAC,CAAA;IAEvB,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;4DAEO,UAAU;QACN,qBAAqB;QACtB,oBAAoB;GAZ3C,WAAW,CAsKvB"}

package/dist/auth/authorization/index.d.ts

@@ -0,0 +1,3 @@
+export * from './rbac';
+export * from './pbac';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../packages/auth/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,QAAQ,CAAC"}

package/dist/auth/authorization/index.js

@@ -0,0 +1,3 @@
+export * from './rbac';
+export * from './pbac';
+//# sourceMappingURL=index.js.map

package/dist/auth/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../packages/auth/authorization/index.ts"],"names":[],"mappings":"AAAA,cAAc,QAAQ,CAAC;AACvB,cAAc,QAAQ,CAAC"}

package/dist/auth/authorization/pbac/index.d.ts

@@ -0,0 +1,6 @@
+export { PbacService } from './pbac.service';
+export { PbacGuard } from './pbac.guard';
+export { RequirePolicy } from './pbac.decorator';
+export type { PolicyDecoratorOptions } from './pbac.decorator';
+export type { PolicyStatement, PolicyDocument, PolicyContext, PolicyEffect } from './pbac.types';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/authorization/pbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC"}

package/dist/auth/authorization/pbac/index.js

@@ -0,0 +1,4 @@
+export { PbacService } from './pbac.service';
+export { PbacGuard } from './pbac.guard';
+export { RequirePolicy } from './pbac.decorator';
+//# sourceMappingURL=index.js.map

package/dist/auth/authorization/pbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/authorization/pbac/pbac.decorator.d.ts

@@ -0,0 +1,18 @@
+export interface PolicyDecoratorOptions {
+    /** Action being performed (e.g. 'document:read') */
+    action: string;
+    /** Resource being accessed (e.g. 'org:123:doc:456') */
+    resource: string | ((req: unknown) => string);
+}
+/**
+ * Require a policy check on a route handler.
+ * Works with the PbacGuard.
+ *
+ * @example
+ * ```typescript
+ * @RequirePolicy({ action: 'document:delete', resource: 'org:*' })
+ * @RequirePolicy({ action: 'document:read', resource: (req) => req.params.docId })
+ * ```
+ */
+export declare const RequirePolicy: (options: PolicyDecoratorOptions) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=pbac.decorator.d.ts.map

package/dist/auth/authorization/pbac/pbac.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbac.decorator.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.decorator.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,QAAQ,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;CAC/C;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,sBAAsB,qDACtB,CAAC"}

package/dist/auth/authorization/pbac/pbac.decorator.js

@@ -0,0 +1,14 @@
+import { SetMetadata } from '@nestjs/common';
+import { METADATA_POLICY } from '../../auth.constants';
+/**
+ * Require a policy check on a route handler.
+ * Works with the PbacGuard.
+ *
+ * @example
+ * ```typescript
+ * @RequirePolicy({ action: 'document:delete', resource: 'org:*' })
+ * @RequirePolicy({ action: 'document:read', resource: (req) => req.params.docId })
+ * ```
+ */
+export const RequirePolicy = (options) => SetMetadata(METADATA_POLICY, options);
+//# sourceMappingURL=pbac.decorator.js.map

package/dist/auth/authorization/pbac/pbac.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbac.decorator.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AASvD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAA+B,EAAE,EAAE,CAC/D,WAAW,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC"}

package/dist/auth/authorization/pbac/pbac.guard.d.ts

@@ -0,0 +1,19 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { PbacService } from './pbac.service';
+/**
+ * Guard that enforces Policy-Based Access Control.
+ *
+ * Reads the required policy from the `@RequirePolicy()` decorator
+ * and evaluates it against the user's assigned policies.
+ *
+ * This guard is independent — you can use it with or without RBAC on
+ * different routes in the same application.
+ */
+export declare class PbacGuard implements CanActivate {
+    private readonly reflector;
+    private readonly pbacService;
+    constructor(reflector: Reflector, pbacService: PbacService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=pbac.guard.d.ts.map

package/dist/auth/authorization/pbac/pbac.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbac.guard.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAM7C;;;;;;;;GAQG;AACH,qBACa,SAAU,YAAW,WAAW;IAEzC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW;IAGrC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAgC/D"}

package/dist/auth/authorization/pbac/pbac.guard.js

@@ -0,0 +1,60 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { PbacService } from './pbac.service';
+import { METADATA_POLICY } from '../../auth.constants';
+/**
+ * Guard that enforces Policy-Based Access Control.
+ *
+ * Reads the required policy from the `@RequirePolicy()` decorator
+ * and evaluates it against the user's assigned policies.
+ *
+ * This guard is independent — you can use it with or without RBAC on
+ * different routes in the same application.
+ */
+let PbacGuard = class PbacGuard {
+    reflector;
+    pbacService;
+    constructor(reflector, pbacService) {
+        this.reflector = reflector;
+        this.pbacService = pbacService;
+    }
+    async canActivate(context) {
+        const policyMeta = this.reflector.getAllAndOverride(METADATA_POLICY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (!policyMeta)
+            return true;
+        const request = context.switchToHttp().getRequest();
+        const user = request.user;
+        if (!user)
+            return false;
+        const action = policyMeta.action;
+        const resource = typeof policyMeta.resource === 'function'
+            ? policyMeta.resource(request)
+            : policyMeta.resource;
+        const policies = await this.pbacService.getUserPolicies(user.id);
+        const ctx = {
+            user: user,
+            resource: { id: resource, ...request.params },
+            environment: {},
+        };
+        return this.pbacService.evaluate(policies, action, resource, ctx);
+    }
+};
+PbacGuard = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [Reflector,
+        PbacService])
+], PbacGuard);
+export { PbacGuard };
+//# sourceMappingURL=pbac.guard.js.map

package/dist/auth/authorization/pbac/pbac.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbac.guard.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAiC,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAKvD;;;;;;;;GAQG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAED;IACA;IAFnB,YACmB,SAAoB,EACpB,WAAwB;QADxB,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAyB,eAAe,EAAE;YAC3F,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAE7B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAI7C,CAAC;QACL,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,MAAM,QAAQ,GACZ,OAAO,UAAU,CAAC,QAAQ,KAAK,UAAU;YACvC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC9B,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAE1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjE,MAAM,GAAG,GAAkB;YACzB,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE;YAC7C,WAAW,EAAE,EAAE;SAChB,CAAC;QAEF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;CACF,CAAA;AAtCY,SAAS;IADrB,UAAU,EAAE;qCAGmB,SAAS;QACP,WAAW;GAHhC,SAAS,CAsCrB"}