@os.io/nest-kit 0.0.1-alpha.0

package/dist/auth/strategies/magic-link/magic-link.strategy.d.ts

@@ -0,0 +1,31 @@
+import type { ExecutionContext } from '@nestjs/common';
+import { AuthMethod, type IAuthResult, type ICacheService } from '../../interfaces';
+import type { IUserService } from '../../interfaces';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * Passwordless email login via magic links.
+ *
+ * Flow:
+ *   1. User enters their email → a token is generated and stored in cache
+ *   2. Email is sent with a link containing the token
+ *   3. User clicks the link → token is validated → user is signed in
+ */
+export declare class MagicLinkStrategy extends BaseStrategy {
+    private readonly cache;
+    private readonly userService;
+    private readonly jwtService;
+    readonly type = AuthMethod.MAGIC_LINK;
+    readonly name = "magic-link";
+    constructor(cache: ICacheService, userService: IUserService, jwtService: JwtService);
+    /**
+     * Request a magic link for the given email.
+     * Returns the raw token (in production, send this via email).
+     */
+    requestLink(email: string, expiresIn?: number, tokenBytes?: number): Promise<string>;
+    /**
+     * Authenticate using a magic-link token.
+     */
+    authenticate(payload: Record<string, unknown>, _context?: ExecutionContext): Promise<IAuthResult>;
+}
+//# sourceMappingURL=magic-link.strategy.d.ts.map

package/dist/auth/strategies/magic-link/magic-link.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.strategy.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/magic-link/magic-link.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD;;;;;;;GAOG;AACH,qBACa,iBAAkB,SAAQ,YAAY;IAM/C,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAR7B,QAAQ,CAAC,IAAI,yBAAyB;IACtC,QAAQ,CAAC,IAAI,gBAAgB;gBAIV,KAAK,EAAE,aAAa,EAEpB,WAAW,EAAE,YAAY,EACzB,UAAU,EAAE,UAAU;IAKzC;;;OAGG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,SAAM,EAAE,UAAU,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAMnF;;OAEG;IACY,YAAY,CACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC;CAwCxB"}

package/dist/auth/strategies/magic-link/magic-link.strategy.js

@@ -0,0 +1,88 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { AuthMethod } from '../../interfaces';
+import { CACHE_SERVICE, MAGIC_LINK_PREFIX, USER_SERVICE } from '../../auth.constants';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+import { randomBytes } from 'node:crypto';
+/**
+ * Passwordless email login via magic links.
+ *
+ * Flow:
+ *   1. User enters their email → a token is generated and stored in cache
+ *   2. Email is sent with a link containing the token
+ *   3. User clicks the link → token is validated → user is signed in
+ */
+let MagicLinkStrategy = class MagicLinkStrategy extends BaseStrategy {
+    cache;
+    userService;
+    jwtService;
+    type = AuthMethod.MAGIC_LINK;
+    name = 'magic-link';
+    constructor(cache, userService, jwtService) {
+        super();
+        this.cache = cache;
+        this.userService = userService;
+        this.jwtService = jwtService;
+    }
+    /**
+     * Request a magic link for the given email.
+     * Returns the raw token (in production, send this via email).
+     */
+    async requestLink(email, expiresIn = 900, tokenBytes = 32) {
+        const token = randomBytes(tokenBytes).toString('hex');
+        await this.cache.set(`${MAGIC_LINK_PREFIX}${token}`, { email, used: false }, expiresIn);
+        return token;
+    }
+    /**
+     * Authenticate using a magic-link token.
+     */
+    async authenticate(payload, _context) {
+        const token = payload.token;
+        if (!token) {
+            throw new Error('Magic link token is required');
+        }
+        const data = await this.cache.get(`${MAGIC_LINK_PREFIX}${token}`);
+        if (!data) {
+            throw new Error('Invalid or expired magic link');
+        }
+        if (data.used) {
+            throw new Error('Magic link has already been used');
+        }
+        // Mark as used immediately (prevent replay)
+        await this.cache.set(`${MAGIC_LINK_PREFIX}${token}`, { ...data, used: true }, 60);
+        const existingUser = await this.userService.findByEmail(data.email);
+        let finalUser;
+        let isNewUser = false;
+        if (!existingUser) {
+            finalUser = await this.userService.create({ email: data.email });
+            isNewUser = true;
+        }
+        else {
+            finalUser = existingUser;
+        }
+        finalUser.roles = await this.userService.getRoles(finalUser.id);
+        finalUser.permissions = await this.userService.getPermissions(finalUser.id);
+        const tokens = await this.jwtService.signTokens(finalUser);
+        return { user: finalUser, tokens, isNewUser };
+    }
+};
+MagicLinkStrategy = __decorate([
+    Injectable(),
+    __param(0, Inject(CACHE_SERVICE)),
+    __param(1, Inject(USER_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, JwtService])
+], MagicLinkStrategy);
+export { MagicLinkStrategy };
+//# sourceMappingURL=magic-link.strategy.js.map

package/dist/auth/strategies/magic-link/magic-link.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-link.strategy.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/magic-link/magic-link.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAEpF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;GAOG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,YAAY;IAM9B;IAEA;IACA;IARV,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC;IAC7B,IAAI,GAAG,YAAY,CAAC;IAE7B,YAEmB,KAAoB,EAEpB,WAAyB,EACzB,UAAsB;QAEvC,KAAK,EAAE,CAAC;QALS,UAAK,GAAL,KAAK,CAAe;QAEpB,gBAAW,GAAX,WAAW,CAAc;QACzB,eAAU,GAAV,UAAU,CAAY;IAGzC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG,EAAE,UAAU,GAAG,EAAE;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,iBAAiB,GAAG,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QACxF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,YAAY,CACzB,OAAgC,EAChC,QAA2B;QAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAe,CAAC;QAEtC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAC/B,GAAG,iBAAiB,GAAG,KAAK,EAAE,CAC/B,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,4CAA4C;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,iBAAiB,GAAG,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAElF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,SAA+C,CAAC;QACpD,IAAI,SAAS,GAAG,KAAK,CAAC;QAEtB,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,YAAY,CAAC;QAC3B,CAAC;QAED,SAAS,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAChE,SAAS,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAE5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAE3D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;CACF,CAAA;AAtEY,iBAAiB;IAD7B,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;qDAEQ,UAAU;GAT9B,iBAAiB,CAsE7B"}

package/dist/auth/strategies/oauth/index.d.ts

@@ -0,0 +1,3 @@
+export { OAuthProviderRegistry } from './oauth-provider-registry';
+export { OAuthStrategy } from './oauth.strategy';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/strategies/oauth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/strategies/oauth/index.js

@@ -0,0 +1,3 @@
+export { OAuthProviderRegistry } from './oauth-provider-registry';
+export { OAuthStrategy } from './oauth.strategy';
+//# sourceMappingURL=index.js.map

package/dist/auth/strategies/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/oauth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/strategies/oauth/oauth-provider-registry.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthProviderConfig } from '../../auth.options';
+/**
+ * Registry of OAuth provider configurations.
+ * Populated at runtime from AuthModuleOptions.oauth.
+ */
+export declare class OAuthProviderRegistry {
+    private providers;
+    register(provider: string, config: OAuthProviderConfig): void;
+    get(provider: string): OAuthProviderConfig | undefined;
+    has(provider: string): boolean;
+    all(): Map<string, OAuthProviderConfig>;
+}
+//# sourceMappingURL=oauth-provider-registry.d.ts.map

package/dist/auth/strategies/oauth/oauth-provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider-registry.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/oauth/oauth-provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE9D;;;GAGG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,SAAS,CAA0C;IAE3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,IAAI;IAI7D,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAItD,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAI9B,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC;CAGxC"}

package/dist/auth/strategies/oauth/oauth-provider-registry.js

@@ -0,0 +1,20 @@
+/**
+ * Registry of OAuth provider configurations.
+ * Populated at runtime from AuthModuleOptions.oauth.
+ */
+export class OAuthProviderRegistry {
+    providers = new Map();
+    register(provider, config) {
+        this.providers.set(provider.toLowerCase(), config);
+    }
+    get(provider) {
+        return this.providers.get(provider.toLowerCase());
+    }
+    has(provider) {
+        return this.providers.has(provider.toLowerCase());
+    }
+    all() {
+        return new Map(this.providers);
+    }
+}
+//# sourceMappingURL=oauth-provider-registry.js.map

package/dist/auth/strategies/oauth/oauth-provider-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-provider-registry.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/oauth/oauth-provider-registry.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACxB,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IAE3D,QAAQ,CAAC,QAAgB,EAAE,MAA2B;QACpD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,GAAG,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,CAAC,QAAgB;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,GAAG;QACD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/auth/strategies/oauth/oauth.strategy.d.ts

@@ -0,0 +1,23 @@
+import type { ExecutionContext } from '@nestjs/common';
+import { AuthMethod, type IAuthResult } from '../../interfaces';
+import type { IUserService } from '../../interfaces';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+import { OAuthProviderRegistry } from './oauth-provider-registry';
+/**
+ * OAuth 2.0 authentication strategy supporting Google, GitHub, Facebook,
+ * Apple, Microsoft, Discord, and custom providers.
+ *
+ * The consumer must provide a handler to exchange the authorization code
+ * for user info (or pass an access token directly).
+ */
+export declare class OAuthStrategy extends BaseStrategy {
+    private readonly userService;
+    private readonly jwtService;
+    readonly registry: OAuthProviderRegistry;
+    readonly type = AuthMethod.OAUTH;
+    readonly name = "oauth";
+    constructor(userService: IUserService, jwtService: JwtService, registry: OAuthProviderRegistry);
+    authenticate(payload: Record<string, unknown>, _context?: ExecutionContext): Promise<IAuthResult>;
+}
+//# sourceMappingURL=oauth.strategy.d.ts.map

package/dist/auth/strategies/oauth/oauth.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.strategy.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/oauth/oauth.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;GAMG;AACH,qBACa,aAAc,SAAQ,YAAY;IAM3C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;aACX,QAAQ,EAAE,qBAAqB;IAPjD,QAAQ,CAAC,IAAI,oBAAoB;IACjC,QAAQ,CAAC,IAAI,WAAW;gBAIL,WAAW,EAAE,YAAY,EACzB,UAAU,EAAE,UAAU,EACvB,QAAQ,EAAE,qBAAqB;IAKlC,YAAY,CACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC;CA0CxB"}

package/dist/auth/strategies/oauth/oauth.strategy.js

@@ -0,0 +1,79 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { AuthMethod } from '../../interfaces';
+import { USER_SERVICE } from '../../auth.constants';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+import { OAuthProviderRegistry } from './oauth-provider-registry';
+/**
+ * OAuth 2.0 authentication strategy supporting Google, GitHub, Facebook,
+ * Apple, Microsoft, Discord, and custom providers.
+ *
+ * The consumer must provide a handler to exchange the authorization code
+ * for user info (or pass an access token directly).
+ */
+let OAuthStrategy = class OAuthStrategy extends BaseStrategy {
+    userService;
+    jwtService;
+    registry;
+    type = AuthMethod.OAUTH;
+    name = 'oauth';
+    constructor(userService, jwtService, registry) {
+        super();
+        this.userService = userService;
+        this.jwtService = jwtService;
+        this.registry = registry;
+    }
+    async authenticate(payload, _context) {
+        const provider = payload.provider;
+        const code = payload.code;
+        const accessToken = payload.accessToken;
+        if (!provider) {
+            throw new Error('OAuth provider is required');
+        }
+        if (!code && !accessToken) {
+            throw new Error('Either authorization code or access token is required');
+        }
+        if (!this.registry.has(provider)) {
+            throw new Error(`Unsupported OAuth provider: ${provider}`);
+        }
+        // In production, exchange the code for an access token and fetch user info
+        // from the provider's userinfo endpoint. The exact implementation depends
+        // on the provider. Here we delegate to the consumer via a custom handler.
+        //
+        // The consumer should override this by providing their own OAuth handler.
+        const socialId = `${provider}:${(payload.sub || payload.id)}`;
+        const email = payload.email;
+        const name = payload.name;
+        let user = await this.userService.findBySocialId(provider, socialId);
+        if (!user) {
+            user = await this.userService.create({
+                email,
+                username: name,
+            });
+        }
+        user.roles = await this.userService.getRoles(user.id);
+        user.permissions = await this.userService.getPermissions(user.id);
+        const tokens = await this.jwtService.signTokens(user);
+        return { user, tokens, isNewUser: !user.email };
+    }
+};
+OAuthStrategy = __decorate([
+    Injectable(),
+    __param(0, Inject(USER_SERVICE)),
+    __metadata("design:paramtypes", [Object, JwtService,
+        OAuthProviderRegistry])
+], OAuthStrategy);
+export { OAuthStrategy };
+//# sourceMappingURL=oauth.strategy.js.map

package/dist/auth/strategies/oauth/oauth.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.strategy.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/oauth/oauth.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;GAMG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,YAAY;IAM1B;IACA;IACD;IAPT,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IACxB,IAAI,GAAG,OAAO,CAAC;IAExB,YAEmB,WAAyB,EACzB,UAAsB,EACvB,QAA+B;QAE/C,KAAK,EAAE,CAAC;QAJS,gBAAW,GAAX,WAAW,CAAc;QACzB,eAAU,GAAV,UAAU,CAAY;QACvB,aAAQ,GAAR,QAAQ,CAAuB;IAGjD,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,OAAgC,EAChC,QAA2B;QAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,IAA0B,CAAC;QAChD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAiC,CAAC;QAE9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,EAAE;QACF,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,EAAE,CAAW,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAA0B,CAAC;QAEhD,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAErE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACnC,KAAK;gBACL,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AA1DY,aAAa;IADzB,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;6CAEQ,UAAU;QACb,qBAAqB;GARtC,aAAa,CA0DzB"}

package/dist/auth/strategies/onetap/onetap.strategy.d.ts

@@ -0,0 +1,24 @@
+import type { ExecutionContext } from '@nestjs/common';
+import { AuthMethod, type IAuthResult } from '../../interfaces';
+import type { IUserService } from '../../interfaces';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * Google & Apple OneTap sign-in strategy.
+ *
+ * OneTap provides a streamlined sign-in experience where users
+ * authenticate with a single tap using their Google or Apple ID.
+ */
+export declare class OneTapStrategy extends BaseStrategy {
+    private readonly userService;
+    private readonly jwtService;
+    readonly type = AuthMethod.ONETAP;
+    readonly name = "onetap";
+    constructor(userService: IUserService, jwtService: JwtService);
+    /**
+     * Authenticate using a OneTap credential token.
+     * Expects `provider` ('google' | 'apple') and `credential` (ID token).
+     */
+    authenticate(payload: Record<string, unknown>, _context?: ExecutionContext): Promise<IAuthResult>;
+}
+//# sourceMappingURL=onetap.strategy.d.ts.map

package/dist/auth/strategies/onetap/onetap.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onetap.strategy.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/onetap/onetap.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;GAKG;AACH,qBACa,cAAe,SAAQ,YAAY;IAM5C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAN7B,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,IAAI,YAAY;gBAIN,WAAW,EAAE,YAAY,EACzB,UAAU,EAAE,UAAU;IAKzC;;;OAGG;IACY,YAAY,CACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC;CAyCxB"}

package/dist/auth/strategies/onetap/onetap.strategy.js

@@ -0,0 +1,77 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { AuthMethod } from '../../interfaces';
+import { USER_SERVICE } from '../../auth.constants';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * Google & Apple OneTap sign-in strategy.
+ *
+ * OneTap provides a streamlined sign-in experience where users
+ * authenticate with a single tap using their Google or Apple ID.
+ */
+let OneTapStrategy = class OneTapStrategy extends BaseStrategy {
+    userService;
+    jwtService;
+    type = AuthMethod.ONETAP;
+    name = 'onetap';
+    constructor(userService, jwtService) {
+        super();
+        this.userService = userService;
+        this.jwtService = jwtService;
+    }
+    /**
+     * Authenticate using a OneTap credential token.
+     * Expects `provider` ('google' | 'apple') and `credential` (ID token).
+     */
+    async authenticate(payload, _context) {
+        const provider = payload.provider;
+        const credential = payload.credential;
+        if (!provider || !credential) {
+            throw new Error('provider and credential are required');
+        }
+        if (!['google', 'apple'].includes(provider)) {
+            throw new Error(`Unsupported OneTap provider: ${provider}`);
+        }
+        // In production, verify the credential (ID token) using the provider's
+        // public keys (JWKS). Extract email, name, sub from the decoded token.
+        //
+        // For Google: use google-auth-library or manually verify the JWT
+        // For Apple: fetch Apple's public keys and verify the JWT
+        //
+        // const payload = await verifyGoogleIdToken(credential, clientId);
+        const sub = payload.sub;
+        const email = payload.email;
+        const name = payload.name;
+        const socialId = `${provider}:${sub}`;
+        let user = await this.userService.findBySocialId(provider, socialId);
+        if (!user) {
+            user = await this.userService.create({
+                email,
+                username: name,
+            });
+        }
+        user.roles = await this.userService.getRoles(user.id);
+        user.permissions = await this.userService.getPermissions(user.id);
+        const tokens = await this.jwtService.signTokens(user);
+        return { user, tokens, isNewUser: !user.email };
+    }
+};
+OneTapStrategy = __decorate([
+    Injectable(),
+    __param(0, Inject(USER_SERVICE)),
+    __metadata("design:paramtypes", [Object, JwtService])
+], OneTapStrategy);
+export { OneTapStrategy };
+//# sourceMappingURL=onetap.strategy.js.map

package/dist/auth/strategies/onetap/onetap.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onetap.strategy.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/onetap/onetap.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;GAKG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,YAAY;IAM3B;IACA;IANV,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC;IACzB,IAAI,GAAG,QAAQ,CAAC;IAEzB,YAEmB,WAAyB,EACzB,UAAsB;QAEvC,KAAK,EAAE,CAAC;QAHS,gBAAW,GAAX,WAAW,CAAc;QACzB,eAAU,GAAV,UAAU,CAAY;IAGzC,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,YAAY,CACzB,OAAgC,EAChC,QAA2B;QAE3B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;QAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAoB,CAAC;QAEhD,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,uEAAuE;QACvE,uEAAuE;QACvE,EAAE;QACF,iEAAiE;QACjE,0DAA0D;QAC1D,EAAE;QACF,mEAAmE;QAEnE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAa,CAAC;QAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,IAAI,GAAG,OAAO,CAAC,IAA0B,CAAC;QAEhD,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAErE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACnC,KAAK;gBACL,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AA5DY,cAAc;IAD1B,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;6CAEQ,UAAU;GAP9B,cAAc,CA4D1B"}

package/dist/auth/strategies/otp/otp.strategy.d.ts

@@ -0,0 +1,31 @@
+import type { ExecutionContext } from '@nestjs/common';
+import { AuthMethod, type IAuthResult, type ICacheService } from '../../interfaces';
+import type { IUserService } from '../../interfaces';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * One-Time Password (OTP) authentication via email or phone.
+ *
+ * Flow:
+ *   1. User enters email/phone → a numeric code is generated and stored in cache
+ *   2. Code is dispatched via email or SMS (consumer's responsibility)
+ *   3. User submits code → validated → signed in
+ */
+export declare class OtpStrategy extends BaseStrategy {
+    private readonly cache;
+    private readonly userService;
+    private readonly jwtService;
+    readonly type = AuthMethod.OTP;
+    readonly name = "otp";
+    constructor(cache: ICacheService, userService: IUserService, jwtService: JwtService);
+    /**
+     * Request an OTP code for the given email or phone.
+     * Returns the plaintext code (in production, dispatch via email/SMS).
+     */
+    requestOtp(identifier: string, digits?: number, expiresIn?: number): Promise<string>;
+    /**
+     * Authenticate using an email/phone + OTP code.
+     */
+    authenticate(payload: Record<string, unknown>, _context?: ExecutionContext): Promise<IAuthResult>;
+}
+//# sourceMappingURL=otp.strategy.d.ts.map

package/dist/auth/strategies/otp/otp.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.strategy.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/otp/otp.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAGrD;;;;;;;GAOG;AACH,qBACa,WAAY,SAAQ,YAAY;IAMzC,OAAO,CAAC,QAAQ,CAAC,KAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAR7B,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,IAAI,SAAS;gBAIH,KAAK,EAAE,aAAa,EAEpB,WAAW,EAAE,YAAY,EACzB,UAAU,EAAE,UAAU;IAKzC;;;OAGG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,SAAI,EAAE,SAAS,SAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWlF;;OAEG;IACY,YAAY,CACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC;CA8CxB"}

package/dist/auth/strategies/otp/otp.strategy.js

@@ -0,0 +1,93 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { AuthMethod } from '../../interfaces';
+import { CACHE_SERVICE, OTP_PREFIX, USER_SERVICE } from '../../auth.constants';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+import { randomInt } from 'node:crypto';
+/**
+ * One-Time Password (OTP) authentication via email or phone.
+ *
+ * Flow:
+ *   1. User enters email/phone → a numeric code is generated and stored in cache
+ *   2. Code is dispatched via email or SMS (consumer's responsibility)
+ *   3. User submits code → validated → signed in
+ */
+let OtpStrategy = class OtpStrategy extends BaseStrategy {
+    cache;
+    userService;
+    jwtService;
+    type = AuthMethod.OTP;
+    name = 'otp';
+    constructor(cache, userService, jwtService) {
+        super();
+        this.cache = cache;
+        this.userService = userService;
+        this.jwtService = jwtService;
+    }
+    /**
+     * Request an OTP code for the given email or phone.
+     * Returns the plaintext code (in production, dispatch via email/SMS).
+     */
+    async requestOtp(identifier, digits = 6, expiresIn = 300) {
+        const min = Math.pow(10, digits - 1);
+        const max = Math.pow(10, digits) - 1;
+        const code = randomInt(min, max).toString();
+        const data = { code, attempts: 0, identifier };
+        await this.cache.set(`${OTP_PREFIX}${identifier}`, data, expiresIn);
+        return code;
+    }
+    /**
+     * Authenticate using an email/phone + OTP code.
+     */
+    async authenticate(payload, _context) {
+        const identifier = payload.identifier;
+        const code = payload.code;
+        if (!identifier || !code) {
+            throw new Error('identifier and code are required');
+        }
+        const data = await this.cache.get(`${OTP_PREFIX}${identifier}`);
+        if (!data) {
+            throw new Error('OTP not found or expired');
+        }
+        if (data.attempts >= 3) {
+            await this.cache.del(`${OTP_PREFIX}${identifier}`);
+            throw new Error('Too many failed OTP attempts');
+        }
+        if (data.code !== code) {
+            data.attempts += 1;
+            await this.cache.set(`${OTP_PREFIX}${identifier}`, data, 300);
+            throw new Error('Invalid OTP code');
+        }
+        // Code is valid — clean up
+        await this.cache.del(`${OTP_PREFIX}${identifier}`);
+        const isEmail = identifier.includes('@');
+        let user = isEmail ? await this.userService.findByEmail(identifier) : null;
+        if (!user) {
+            user = await this.userService.create(isEmail ? { email: identifier } : { phone: identifier });
+        }
+        user.roles = await this.userService.getRoles(user.id);
+        user.permissions = await this.userService.getPermissions(user.id);
+        const tokens = await this.jwtService.signTokens(user);
+        return { user, tokens, isNewUser: !user.email };
+    }
+};
+OtpStrategy = __decorate([
+    Injectable(),
+    __param(0, Inject(CACHE_SERVICE)),
+    __param(1, Inject(USER_SERVICE)),
+    __metadata("design:paramtypes", [Object, Object, JwtService])
+], OtpStrategy);
+export { OtpStrategy };
+//# sourceMappingURL=otp.strategy.js.map

package/dist/auth/strategies/otp/otp.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.strategy.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/otp/otp.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAwC,MAAM,kBAAkB,CAAC;AAEpF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;GAOG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,YAAY;IAMxB;IAEA;IACA;IARV,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,KAAK,CAAC;IAEtB,YAEmB,KAAoB,EAEpB,WAAyB,EACzB,UAAsB;QAEvC,KAAK,EAAE,CAAC;QALS,UAAK,GAAL,KAAK,CAAe;QAEpB,gBAAW,GAAX,WAAW,CAAc;QACzB,eAAU,GAAV,UAAU,CAAY;IAGzC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB,EAAE,MAAM,GAAG,CAAC,EAAE,SAAS,GAAG,GAAG;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAE5C,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAEpE,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,YAAY,CACzB,OAAgC,EAChC,QAA2B;QAE3B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAoB,CAAC;QAChD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAc,CAAC;QAEpC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAI9B,GAAG,UAAU,GAAG,UAAU,EAAE,CAAC,CAAC;QAEjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,UAAU,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YACnB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,GAAG,UAAU,EAAE,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAjFY,WAAW;IADvB,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;qDAEQ,UAAU;GAT9B,WAAW,CAiFvB"}

package/dist/auth/strategies/passkey/passkey.strategy.d.ts

@@ -0,0 +1,32 @@
+import type { ExecutionContext } from '@nestjs/common';
+import { AuthMethod, type IAuthResult } from '../../interfaces';
+import type { IUserService } from '../../interfaces';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * WebAuthn / FIDO2 Passkey authentication strategy.
+ *
+ * Provides credential registration and assertion ceremonies
+ * using the `@simplewebauthn/server` package (loaded dynamically).
+ */
+export declare class PasskeyStrategy extends BaseStrategy {
+    private readonly userService;
+    private readonly jwtService;
+    readonly type = AuthMethod.PASSKEY;
+    readonly name = "passkey";
+    constructor(userService: IUserService, jwtService: JwtService);
+    /**
+     * Authenticate using a WebAuthn assertion response.
+     */
+    authenticate(payload: Record<string, unknown>, _context?: ExecutionContext): Promise<IAuthResult>;
+    /**
+     * Generate registration options for the WebAuthn ceremony.
+     */
+    generateRegistrationOptions(userId: string, userName: string, rpName?: string, rpId?: string): Promise<Record<string, unknown>>;
+    /**
+     * Verify a registration response and return the credential.
+     */
+    verifyRegistrationResponse(credential: Record<string, unknown>, expectedChallenge: string, expectedOrigin: string, expectedRpId: string): Promise<Record<string, unknown>>;
+    private loadWebAuthn;
+}
+//# sourceMappingURL=passkey.strategy.d.ts.map

package/dist/auth/strategies/passkey/passkey.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.strategy.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/passkey/passkey.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;GAKG;AACH,qBACa,eAAgB,SAAQ,YAAY;IAM7C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAN7B,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,IAAI,aAAa;gBAIP,WAAW,EAAE,YAAY,EACzB,UAAU,EAAE,UAAU;IAKzC;;OAEG;IACY,YAAY,CACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC;IA6BvB;;OAEG;IACG,2BAA2B,CAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,SAAY,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAcnC;;OAEG;IACG,0BAA0B,CAC9B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,iBAAiB,EAAE,MAAM,EACzB,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAYrB,YAAY;CAS3B"}