@pvh-afl/core 1.1.20 → 1.1.22

package/dist/auth/auth.module.d.ts

@@ -0,0 +1,58 @@
+import { DynamicModule, InjectionToken, OptionalFactoryDependency, Type } from '@nestjs/common';
+import { AuthModuleOptions } from './auth.types';
+/**
+ * Authentication module.
+ *
+ * Provides {@link AuthTokenService} for issuing tokens and {@link JwtAuthGuard}
+ * for requiring one. Registered global so a guard applied in any module can
+ * resolve its dependencies without that module importing this one.
+ *
+ * @example
+ * ```typescript
+ * AuthModule.forRoot({
+ *   privateKey: process.env.AUTH_JWT_PRIVATE_KEY!,
+ *   publicKey: process.env.AUTH_JWT_PUBLIC_KEY!,
+ *   issuer: process.env.AUTH_JWT_ISSUER!,
+ *   audience: process.env.AUTH_JWT_AUDIENCE!,
+ *   ttlSeconds: Number(process.env.AUTH_JWT_TTL ?? 1800),
+ * })
+ * ```
+ */
+/**
+ * Options for {@link AuthModule.forRootAsync}.
+ *
+ * Use this when the settings come from a provider — typically `ConfigService`,
+ * so authentication is configured from the brand config file alongside every
+ * other integration rather than read from `process.env` at module definition.
+ */
+export interface AuthModuleAsyncOptions {
+    imports?: Type<unknown>[];
+    inject?: Array<InjectionToken | OptionalFactoryDependency>;
+    /**
+     * `any[]` rather than `unknown[]`: parameters are contravariant under
+     * `strictFunctionTypes`, so a factory declared as `(config: ConfigService)`
+     * would not be assignable to one declared as `(...args: unknown[])`. This
+     * mirrors how Nest types its own async module options.
+     */
+    useFactory: (...args: any[]) => AuthModuleOptions | Promise<AuthModuleOptions>;
+}
+export declare class AuthModule {
+    /**
+     * Configure from values resolved by a provider.
+     *
+     * The factory runs during application init, so a missing key still fails at
+     * startup rather than at the first request.
+     *
+     * @example
+     * ```typescript
+     * AuthModule.forRootAsync({
+     *   imports: [ConfigModule],
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => config.getAuthConfig('tommy'),
+     * })
+     * ```
+     */
+    static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule;
+    static forRoot(options: AuthModuleOptions): DynamicModule;
+}
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/auth/auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,cAAc,EAEd,yBAAyB,EAEzB,IAAI,EACL,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAgB,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAK/D;;;;;;;;;;;;;;;;;GAiBG;AACH;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,yBAAyB,CAAC,CAAC;IAC3D;;;;;OAKG;IAEH,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAChF;AAED,qBACa,UAAU;IACrB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAqBnE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa;CAmB1D"}

package/dist/auth/auth.module.js

@@ -0,0 +1,87 @@
+"use strict";
+var AuthModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const jwt_1 = require("@nestjs/jwt");
+const auth_types_1 = require("./auth.types");
+const jwt_service_1 = require("./jwt.service");
+const jwt_auth_guard_1 = require("./jwt-auth.guard");
+const optional_jwt_auth_guard_1 = require("./optional-jwt-auth.guard");
+let AuthModule = AuthModule_1 = class AuthModule {
+    /**
+     * Configure from values resolved by a provider.
+     *
+     * The factory runs during application init, so a missing key still fails at
+     * startup rather than at the first request.
+     *
+     * @example
+     * ```typescript
+     * AuthModule.forRootAsync({
+     *   imports: [ConfigModule],
+     *   inject: [ConfigService],
+     *   useFactory: (config: ConfigService) => config.getAuthConfig('tommy'),
+     * })
+     * ```
+     */
+    static forRootAsync(options) {
+        const optionsProvider = {
+            provide: auth_types_1.AUTH_OPTIONS,
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            useFactory: async (...args) => {
+                const resolved = await options.useFactory(...args);
+                assertUsableOptions(resolved);
+                return resolved;
+            },
+            inject: options.inject ?? [],
+        };
+        return {
+            module: AuthModule_1,
+            global: true,
+            imports: [jwt_1.JwtModule.register({}), ...(options.imports ?? [])],
+            providers: [optionsProvider, jwt_service_1.AuthTokenService, jwt_auth_guard_1.JwtAuthGuard, optional_jwt_auth_guard_1.OptionalJwtAuthGuard],
+            exports: [jwt_service_1.AuthTokenService, jwt_auth_guard_1.JwtAuthGuard, optional_jwt_auth_guard_1.OptionalJwtAuthGuard],
+        };
+    }
+    static forRoot(options) {
+        assertUsableOptions(options);
+        return {
+            module: AuthModule_1,
+            global: true,
+            // Keys are passed per call in AuthTokenService rather than registered
+            // here, so the pinned algorithm and the key travel together and cannot
+            // drift apart.
+            imports: [jwt_1.JwtModule.register({})],
+            providers: [
+                { provide: auth_types_1.AUTH_OPTIONS, useValue: options },
+                jwt_service_1.AuthTokenService,
+                jwt_auth_guard_1.JwtAuthGuard,
+                optional_jwt_auth_guard_1.OptionalJwtAuthGuard,
+            ],
+            exports: [jwt_service_1.AuthTokenService, jwt_auth_guard_1.JwtAuthGuard, optional_jwt_auth_guard_1.OptionalJwtAuthGuard],
+        };
+    }
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = AuthModule_1 = tslib_1.__decorate([
+    (0, common_1.Module)({})
+], AuthModule);
+/**
+ * Fail at startup rather than at the first request.
+ *
+ * A missing key would otherwise surface as every token failing to verify, which
+ * looks like a client bug and is slow to trace back to configuration. An empty
+ * environment variable is the likely cause, so it is worth catching loudly.
+ */
+function assertUsableOptions(options) {
+    const missing = ['privateKey', 'publicKey', 'issuer', 'audience'].filter((key) => {
+        const value = options?.[key];
+        return typeof value !== 'string' || value.trim() === '';
+    });
+    if (missing.length > 0) {
+        throw new Error(`AuthModule.forRoot() is missing required options: ${missing.join(', ')}. ` +
+            'Check the AUTH_JWT_* environment variables.');
+    }
+}
+//# sourceMappingURL=auth.module.js.map

package/dist/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAOwB;AACxB,qCAAwC;AACxC,6CAA+D;AAC/D,+CAAiD;AACjD,qDAAgD;AAChD,uEAAiE;AAyC1D,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,YAAY,CAAC,OAA+B;QACjD,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,yBAAY;YACrB,8DAA8D;YAC9D,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;gBACnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBACnD,mBAAmB,CAAC,QAAQ,CAAC,CAAC;gBAC9B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC7D,SAAS,EAAE,CAAC,eAAe,EAAE,8BAAgB,EAAE,6BAAY,EAAE,8CAAoB,CAAC;YAClF,OAAO,EAAE,CAAC,8BAAgB,EAAE,6BAAY,EAAE,8CAAoB,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,OAA0B;QACvC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAE7B,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,sEAAsE;YACtE,uEAAuE;YACvE,eAAe;YACf,OAAO,EAAE,CAAC,eAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACjC,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,yBAAY,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAC5C,8BAAgB;gBAChB,6BAAY;gBACZ,8CAAoB;aACrB;YACD,OAAO,EAAE,CAAC,8BAAgB,EAAE,6BAAY,EAAE,8CAAoB,CAAC;SAChE,CAAC;IACJ,CAAC;CACF,CAAA;AAxDY,gCAAU;qBAAV,UAAU;IADtB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAwDtB;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,OAA0B;IACrD,MAAM,OAAO,GACX,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,CACjD,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACf,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,qDAAqD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACzE,6CAA6C,CAChD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/auth/auth.types.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Authentication types.
+ *
+ * The JWT issued here is an authentication gate only. It proves *which customer*
+ * is calling; it carries no Shopify credential and grants no capability of its
+ * own. Shopify remains the source of truth for identity — the token is minted
+ * only after Shopify has validated a customer access token.
+ */
+/**
+ * Configuration for {@link AuthModule.forRoot}.
+ */
+export interface AuthModuleOptions {
+    /** RSA private key (PEM) used to sign tokens. Keep in a secret manager. */
+    privateKey: string;
+    /** RSA public key (PEM) used to verify tokens. Safe to distribute. */
+    publicKey: string;
+    /** `iss` claim, and the only issuer accepted on verify. */
+    issuer: string;
+    /** `aud` claim, and the only audience accepted on verify. */
+    audience: string;
+    /**
+     * Access token lifetime in seconds. Kept short because there is no
+     * server-side revocation — a stolen token is usable until it expires.
+     *
+     * @default 1800 (30 minutes)
+     */
+    ttlSeconds?: number;
+    /**
+     * Refresh token lifetime in seconds.
+     *
+     * This is the absolute length of a session: refresh tokens are **not** rotated,
+     * so the customer logs in again when this elapses regardless of activity.
+     *
+     * Not rotating is deliberate. Rotation only adds safety when the server can
+     * remember which token is current and spot an old one being replayed, and that
+     * needs stored state. Without it, rotation would instead let a stolen refresh
+     * token be renewed indefinitely. A fixed expiry means a stolen token dies at a
+     * known time.
+     *
+     * Raising this widens the window in which a stolen refresh token works, and
+     * there is no way to cut that short.
+     *
+     * @default 604800 (7 days)
+     */
+    refreshTtlSeconds?: number;
+}
+/**
+ * Which kind of token this is.
+ *
+ * Carried in every token and checked on every verify, so the two cannot be
+ * swapped. Without it a refresh token — deliberately long-lived — would be
+ * accepted as an access token and quietly bypass the short access window.
+ */
+export declare const TokenType: {
+    readonly ACCESS: "access";
+    readonly REFRESH: "refresh";
+};
+export type TokenType = (typeof TokenType)[keyof typeof TokenType];
+/**
+ * The claims carried in a token we issue.
+ *
+ * Everything here is readable by anyone holding the token — base64url is
+ * encoding, not encryption. Nothing secret goes in, which is why the phone
+ * number is stored as a hash rather than in the clear.
+ */
+export interface CustomerJwtPayload {
+    /** Issuer. */
+    iss: string;
+    /** Audience. */
+    aud: string;
+    /** Access or refresh. Enforced on verify so the two cannot be interchanged. */
+    typ: TokenType;
+    /**
+     * The authenticated customer, as a Shopify GID.
+     * Read from Shopify's response at issue time — never from client input.
+     */
+    sub: string;
+    /**
+     * SHA-256 of the customer's normalised mobile number, or undefined when
+     * Shopify holds no phone number for them.
+     *
+     * Enough to verify that a `mobile` value in a request belongs to the caller,
+     * without putting the number itself in a readable token.
+     */
+    phone_hash?: string;
+    /** Issued at (seconds since epoch). */
+    iat: number;
+    /** Expires at (seconds since epoch). */
+    exp: number;
+}
+/**
+ * What the guard attaches to the request after a token verifies.
+ *
+ * Handlers and resolvers must read identity from here — never from the request
+ * body, query string or GraphQL arguments.
+ */
+export interface AuthUser {
+    /** Shopify customer GID, from the token's `sub`. */
+    customerId: string;
+    /** SHA-256 of the caller's normalised mobile, when Shopify has one. */
+    phoneHash?: string;
+}
+/** Error codes returned to callers. Stable — clients branch on these. */
+export declare const AuthErrorCode: {
+    /** No `Authorization` header, or not a Bearer token. */
+    readonly TOKEN_MISSING: "TOKEN_MISSING";
+    /** Signature, issuer, audience or shape rejected. */
+    readonly TOKEN_INVALID: "TOKEN_INVALID";
+    /** Well-formed and correctly signed, but past `exp`. Refresh and retry. */
+    readonly TOKEN_EXPIRED: "TOKEN_EXPIRED";
+    /** Authenticated, but the request names a resource belonging to someone else. */
+    readonly FORBIDDEN: "FORBIDDEN";
+    /**
+     * A refresh token was sent where an access token belongs, or the reverse.
+     * Signals a client bug rather than an expired session.
+     */
+    readonly TOKEN_WRONG_TYPE: "TOKEN_WRONG_TYPE";
+};
+export type AuthErrorCode = (typeof AuthErrorCode)[keyof typeof AuthErrorCode];
+/** DI token for the resolved {@link AuthModuleOptions}. */
+export declare const AUTH_OPTIONS: unique symbol;
+//# sourceMappingURL=auth.types.d.ts.map

package/dist/auth/auth.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../src/auth/auth.types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IAEnB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAElB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IAEf,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,SAAS;;;CAGZ,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IAEZ,gBAAgB;IAChB,GAAG,EAAE,MAAM,CAAC;IAEZ,+EAA+E;IAC/E,GAAG,EAAE,SAAS,CAAC;IAEf;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IAEZ;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IAEZ,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IAEnB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yEAAyE;AACzE,eAAO,MAAM,aAAa;IACxB,wDAAwD;;IAGxD,qDAAqD;;IAGrD,2EAA2E;;IAG3E,iFAAiF;;IAGjF;;;OAGG;;CAEK,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE/E,2DAA2D;AAC3D,eAAO,MAAM,YAAY,eAAyB,CAAC"}

package/dist/auth/auth.types.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Authentication types.
+ *
+ * The JWT issued here is an authentication gate only. It proves *which customer*
+ * is calling; it carries no Shopify credential and grants no capability of its
+ * own. Shopify remains the source of truth for identity — the token is minted
+ * only after Shopify has validated a customer access token.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_OPTIONS = exports.AuthErrorCode = exports.TokenType = void 0;
+/**
+ * Which kind of token this is.
+ *
+ * Carried in every token and checked on every verify, so the two cannot be
+ * swapped. Without it a refresh token — deliberately long-lived — would be
+ * accepted as an access token and quietly bypass the short access window.
+ */
+exports.TokenType = {
+    ACCESS: 'access',
+    REFRESH: 'refresh',
+};
+/** Error codes returned to callers. Stable — clients branch on these. */
+exports.AuthErrorCode = {
+    /** No `Authorization` header, or not a Bearer token. */
+    TOKEN_MISSING: 'TOKEN_MISSING',
+    /** Signature, issuer, audience or shape rejected. */
+    TOKEN_INVALID: 'TOKEN_INVALID',
+    /** Well-formed and correctly signed, but past `exp`. Refresh and retry. */
+    TOKEN_EXPIRED: 'TOKEN_EXPIRED',
+    /** Authenticated, but the request names a resource belonging to someone else. */
+    FORBIDDEN: 'FORBIDDEN',
+    /**
+     * A refresh token was sent where an access token belongs, or the reverse.
+     * Signals a client bug rather than an expired session.
+     */
+    TOKEN_WRONG_TYPE: 'TOKEN_WRONG_TYPE',
+};
+/** DI token for the resolved {@link AuthModuleOptions}. */
+exports.AUTH_OPTIONS = Symbol('AUTH_OPTIONS');
+//# sourceMappingURL=auth.types.js.map

package/dist/auth/auth.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.types.js","sourceRoot":"","sources":["../../src/auth/auth.types.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA8CH;;;;;;GAMG;AACU,QAAA,SAAS,GAAG;IACvB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAyDX,yEAAyE;AAC5D,QAAA,aAAa,GAAG;IAC3B,wDAAwD;IACxD,aAAa,EAAE,eAAe;IAE9B,qDAAqD;IACrD,aAAa,EAAE,eAAe;IAE9B,2EAA2E;IAC3E,aAAa,EAAE,eAAe;IAE9B,iFAAiF;IACjF,SAAS,EAAE,WAAW;IAEtB;;;OAGG;IACH,gBAAgB,EAAE,kBAAkB;CAC5B,CAAC;AAIX,2DAA2D;AAC9C,QAAA,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC"}

package/dist/auth/current-user.decorator.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Injects the authenticated caller, as established by {@link JwtAuthGuard}.
+ *
+ * Only valid on handlers that carry the guard — without it there is no verified
+ * user and this resolves to undefined.
+ *
+ * @example
+ * ```typescript
+ * @UseGuards(JwtAuthGuard)
+ * @Get()
+ * async getItems(@CurrentUser() user: AuthUser) {
+ *   return this.service.getItems(user.customerId);
+ * }
+ * ```
+ */
+export declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;
+//# sourceMappingURL=current-user.decorator.d.ts.map

package/dist/auth/current-user.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.d.ts","sourceRoot":"","sources":["../../src/auth/current-user.decorator.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,mDAGvB,CAAC"}

package/dist/auth/current-user.decorator.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentUser = void 0;
+const common_1 = require("@nestjs/common");
+const utils_1 = require("./utils");
+/**
+ * Injects the authenticated caller, as established by {@link JwtAuthGuard}.
+ *
+ * Only valid on handlers that carry the guard — without it there is no verified
+ * user and this resolves to undefined.
+ *
+ * @example
+ * ```typescript
+ * @UseGuards(JwtAuthGuard)
+ * @Get()
+ * async getItems(@CurrentUser() user: AuthUser) {
+ *   return this.service.getItems(user.customerId);
+ * }
+ * ```
+ */
+exports.CurrentUser = (0, common_1.createParamDecorator)((_data, context) => (0, utils_1.getRequest)(context).user);
+//# sourceMappingURL=current-user.decorator.js.map

package/dist/auth/current-user.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../src/auth/current-user.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAAwE;AAExE,mCAAqC;AAErC;;;;;;;;;;;;;;GAcG;AACU,QAAA,WAAW,GAAG,IAAA,6BAAoB,EAC7C,CAAC,KAAc,EAAE,OAAyB,EAAY,EAAE,CACtD,IAAA,kBAAU,EAAC,OAAO,CAAC,CAAC,IAAgB,CACvC,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,10 @@
+export * from './auth.types';
+export * from './auth.module';
+export * from './jwt.service';
+export * from './jwt-auth.guard';
+export * from './optional-jwt-auth.guard';
+export * from './current-user.decorator';
+export * from './ownership';
+export { getRequest, bearer, normalizeGid, normalizePhone, sha256, hashPhone, } from './utils';
+export type { AuthRequest } from './utils';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,MAAM,EACN,YAAY,EACZ,cAAc,EACd,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashPhone = exports.sha256 = exports.normalizePhone = exports.normalizeGid = exports.bearer = exports.getRequest = void 0;
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./auth.types"), exports);
+tslib_1.__exportStar(require("./auth.module"), exports);
+tslib_1.__exportStar(require("./jwt.service"), exports);
+tslib_1.__exportStar(require("./jwt-auth.guard"), exports);
+tslib_1.__exportStar(require("./optional-jwt-auth.guard"), exports);
+tslib_1.__exportStar(require("./current-user.decorator"), exports);
+tslib_1.__exportStar(require("./ownership"), exports);
+var utils_1 = require("./utils");
+Object.defineProperty(exports, "getRequest", { enumerable: true, get: function () { return utils_1.getRequest; } });
+Object.defineProperty(exports, "bearer", { enumerable: true, get: function () { return utils_1.bearer; } });
+Object.defineProperty(exports, "normalizeGid", { enumerable: true, get: function () { return utils_1.normalizeGid; } });
+Object.defineProperty(exports, "normalizePhone", { enumerable: true, get: function () { return utils_1.normalizePhone; } });
+Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return utils_1.sha256; } });
+Object.defineProperty(exports, "hashPhone", { enumerable: true, get: function () { return utils_1.hashPhone; } });
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;;AAAA,uDAA6B;AAC7B,wDAA8B;AAC9B,wDAA8B;AAC9B,2DAAiC;AACjC,oEAA0C;AAC1C,mEAAyC;AACzC,sDAA4B;AAC5B,iCAOiB;AANf,mGAAA,UAAU,OAAA;AACV,+FAAA,MAAM,OAAA;AACN,qGAAA,YAAY,OAAA;AACZ,uGAAA,cAAc,OAAA;AACd,+FAAA,MAAM,OAAA;AACN,kGAAA,SAAS,OAAA"}

package/dist/auth/jwt-auth.guard.d.ts

@@ -0,0 +1,21 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { AuthTokenService } from './jwt.service';
+/**
+ * Requires a valid authentication token, and attaches the caller to the request.
+ *
+ * Apply with `@UseGuards(JwtAuthGuard)` on endpoints that read or change one
+ * customer's data. Endpoints that serve public data carry no guard.
+ *
+ * On success `request.user` holds an {@link AuthUser}, which handlers read via
+ * `@CurrentUser()`. Identity must come from there and never from the request
+ * body, query string or GraphQL arguments — a caller controls those.
+ *
+ * Note that this guard answers only "who is calling". It does not check that
+ * the records a request names belong to that caller; see `ownership.ts`.
+ */
+export declare class JwtAuthGuard implements CanActivate {
+    private readonly tokens;
+    constructor(tokens: AuthTokenService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=jwt-auth.guard.d.ts.map

package/dist/auth/jwt-auth.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.d.ts","sourceRoot":"","sources":["../../src/auth/jwt-auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,gBAAgB,EAIjB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;GAYG;AACH,qBACa,YAAa,YAAW,WAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;IAE/C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAwD/D"}

package/dist/auth/jwt-auth.guard.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const logger_1 = require("../common/logger");
+const auth_types_1 = require("./auth.types");
+const jwt_service_1 = require("./jwt.service");
+const utils_1 = require("./utils");
+/**
+ * Requires a valid authentication token, and attaches the caller to the request.
+ *
+ * Apply with `@UseGuards(JwtAuthGuard)` on endpoints that read or change one
+ * customer's data. Endpoints that serve public data carry no guard.
+ *
+ * On success `request.user` holds an {@link AuthUser}, which handlers read via
+ * `@CurrentUser()`. Identity must come from there and never from the request
+ * body, query string or GraphQL arguments — a caller controls those.
+ *
+ * Note that this guard answers only "who is calling". It does not check that
+ * the records a request names belong to that caller; see `ownership.ts`.
+ */
+let JwtAuthGuard = class JwtAuthGuard {
+    tokens;
+    constructor(tokens) {
+        this.tokens = tokens;
+    }
+    async canActivate(context) {
+        const request = (0, utils_1.getRequest)(context);
+        const token = (0, utils_1.bearer)(request);
+        if (!token) {
+            throw new common_1.UnauthorizedException({
+                code: auth_types_1.AuthErrorCode.TOKEN_MISSING,
+                message: 'Authentication required',
+            });
+        }
+        try {
+            request.user = await this.tokens.verifyAccess(token);
+            return true;
+        }
+        catch (error) {
+            if (error instanceof jwt_service_1.TokenExpiredError) {
+                // Expected and routine — the client refreshes and retries, so this is
+                // not worth logging on every occurrence.
+                throw new common_1.UnauthorizedException({
+                    code: auth_types_1.AuthErrorCode.TOKEN_EXPIRED,
+                    message: 'Token has expired',
+                });
+            }
+            if (error instanceof jwt_service_1.TokenWrongTypeError) {
+                // Almost certainly a client bug: the refresh token was sent on a normal
+                // request. Distinguished from TOKEN_INVALID so it is obvious in a log.
+                logger_1.logger.warn('Wrong token type on a protected route', {
+                    reason: error.message,
+                    path: typeof request.url === 'string' ? request.url : undefined,
+                });
+                throw new common_1.UnauthorizedException({
+                    code: auth_types_1.AuthErrorCode.TOKEN_WRONG_TYPE,
+                    message: 'Invalid token',
+                });
+            }
+            if (error instanceof jwt_service_1.TokenInvalidError) {
+                // A bad signature, wrong issuer or malformed token is not something a
+                // healthy client produces. Log it — a rise here is worth noticing —
+                // but keep the reason out of the response so probing gains nothing.
+                logger_1.logger.warn('Rejected authentication token', {
+                    reason: error.message,
+                    path: typeof request.url === 'string' ? request.url : undefined,
+                });
+                throw new common_1.UnauthorizedException({
+                    code: auth_types_1.AuthErrorCode.TOKEN_INVALID,
+                    message: 'Invalid token',
+                });
+            }
+            throw error;
+        }
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__metadata("design:paramtypes", [jwt_service_1.AuthTokenService])
+], JwtAuthGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map

package/dist/auth/jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../src/auth/jwt-auth.guard.ts"],"names":[],"mappings":";;;;AAAA,2CAKwB;AACxB,6CAA0C;AAC1C,6CAA6C;AAC7C,+CAKuB;AACvB,mCAA6C;AAE7C;;;;;;;;;;;;GAYG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACM;IAA7B,YAA6B,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IAAG,CAAC;IAEzD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,IAAA,kBAAU,EAAC,OAAO,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAA,cAAM,EAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC;gBAC9B,IAAI,EAAE,0BAAa,CAAC,aAAa;gBACjC,OAAO,EAAE,yBAAyB;aACnC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,+BAAiB,EAAE,CAAC;gBACvC,sEAAsE;gBACtE,yCAAyC;gBACzC,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,0BAAa,CAAC,aAAa;oBACjC,OAAO,EAAE,mBAAmB;iBAC7B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK,YAAY,iCAAmB,EAAE,CAAC;gBACzC,wEAAwE;gBACxE,uEAAuE;gBACvE,eAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE;oBACnD,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,IAAI,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;iBAChE,CAAC,CAAC;gBAEH,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,0BAAa,CAAC,gBAAgB;oBACpC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,KAAK,YAAY,+BAAiB,EAAE,CAAC;gBACvC,sEAAsE;gBACtE,oEAAoE;gBACpE,oEAAoE;gBACpE,eAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;oBAC3C,MAAM,EAAE,KAAK,CAAC,OAAO;oBACrB,IAAI,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;iBAChE,CAAC,CAAC;gBAEH,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,0BAAa,CAAC,aAAa;oBACjC,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AA3DY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;6CAE0B,8BAAgB;GAD1C,YAAY,CA2DxB"}

package/dist/auth/jwt.service.d.ts

@@ -0,0 +1,93 @@
+import { JwtService as NestJwtService } from '@nestjs/jwt';
+import { AuthModuleOptions, AuthUser } from './auth.types';
+/** Thrown when a token is well-formed and correctly signed but has expired. */
+export declare class TokenExpiredError extends Error {
+}
+/** Thrown when a token fails any other check. */
+export declare class TokenInvalidError extends Error {
+}
+/** Thrown when a refresh token is used as an access token, or the reverse. */
+export declare class TokenWrongTypeError extends Error {
+}
+/** A freshly issued pair. */
+export interface TokenPair {
+    accessToken: string;
+    accessExpiresAt: Date;
+    refreshToken: string;
+    refreshExpiresAt: Date;
+}
+/**
+ * Signs and verifies the authentication tokens this service issues.
+ *
+ * Two kinds, distinguished by a `typ` claim that is checked on every verify:
+ *
+ * - **access** (30 min) — sent on every protected request.
+ * - **refresh** (7 days) — sent only to `/auth/refresh`, to mint a new access
+ *   token without going back to Shopify.
+ *
+ * The refresh token carries the same identity claims as an access token, which is
+ * what lets renewal be a purely local operation: no Shopify call, so renewal
+ * costs nothing against Shopify's rate limit.
+ *
+ * Fixed to RS256, and the algorithm is pinned on verify rather than read from the
+ * token. That is deliberate: the JWT spec allows `alg: none`, and a verifier that
+ * trusts the token's own header can also be tricked into validating an RS256
+ * token as HS256 using the public key as the HMAC secret. Both attacks fail
+ * against an explicit allow-list of one algorithm.
+ */
+export declare class AuthTokenService {
+    private readonly jwt;
+    private readonly options;
+    private readonly ttlSeconds;
+    private readonly refreshTtlSeconds;
+    constructor(jwt: NestJwtService, options: AuthModuleOptions);
+    /**
+     * Issue an access and refresh token for a customer whose identity Shopify has
+     * already confirmed.
+     *
+     * @param customerId - Shopify customer GID, taken from Shopify's response.
+     * @param phone - The customer's phone number as Shopify holds it, if any.
+     *   Stored as a hash so a `mobile` value in a later request can be checked
+     *   against it without the number appearing in the token.
+     * @param maxExpiresAt - Optional upper bound on both expiries, normally an
+     *   upstream credential's own expiry, so neither token outlives it.
+     */
+    issuePair(customerId: string, phone?: string | null, maxExpiresAt?: Date | string | null): Promise<TokenPair>;
+    /**
+     * Issue a replacement access token from a verified refresh token.
+     *
+     * The refresh token itself is **not** replaced: its expiry is the absolute end
+     * of the session (see `refreshTtlSeconds`). The caller keeps using the same one
+     * until it expires, then logs in again.
+     */
+    issueAccessToken(user: AuthUser, maxExpiresAt?: Date | string | null): Promise<{
+        token: string;
+        expiresAt: Date;
+    }>;
+    /**
+     * Verify an access token and return the caller it identifies.
+     *
+     * @throws {TokenExpiredError} past `exp` — the client should refresh and retry.
+     * @throws {TokenWrongTypeError} a refresh token was sent instead.
+     * @throws {TokenInvalidError} anything else.
+     */
+    verifyAccess(token: string): Promise<AuthUser>;
+    /**
+     * Verify a refresh token and return the caller it identifies.
+     *
+     * @throws {TokenExpiredError} the session has reached its absolute end; the
+     *   customer has to log in again.
+     * @throws {TokenWrongTypeError} an access token was sent instead.
+     * @throws {TokenInvalidError} anything else.
+     */
+    verifyRefresh(token: string): Promise<AuthUser>;
+    private verify;
+    private sign;
+    private signFromHash;
+    /**
+     * Work out the `exp` claim: the given lifetime, shortened if an upstream
+     * credential expires sooner.
+     */
+    private resolveExpiry;
+}
+//# sourceMappingURL=jwt.service.d.ts.map

package/dist/auth/jwt.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.service.d.ts","sourceRoot":"","sources":["../../src/auth/jwt.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAEL,iBAAiB,EACjB,QAAQ,EAGT,MAAM,cAAc,CAAC;AAGtB,+EAA+E;AAC/E,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,iDAAiD;AACjD,qBAAa,iBAAkB,SAAQ,KAAK;CAAG;AAE/C,8EAA8E;AAC9E,qBAAa,mBAAoB,SAAQ,KAAK;CAAG;AAKjD,6BAA6B;AAC7B,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,IAAI,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,gBAAgB;IAKzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACE,OAAO,CAAC,QAAQ,CAAC,OAAO;IALhD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGxB,GAAG,EAAE,cAAc,EACG,OAAO,EAAE,iBAAiB;IAOnE;;;;;;;;;;OAUG;IACG,SAAS,CACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,YAAY,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,SAAS,CAAC;IAoBrB;;;;;;OAMG;IACG,gBAAgB,CACpB,IAAI,EAAE,QAAQ,EACd,YAAY,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC;IAU9C;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAIpD;;;;;;;OAOG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;YAIvC,MAAM;IA2CpB,OAAO,CAAC,IAAI;YAgBE,YAAY;IA8B1B;;;OAGG;IACH,OAAO,CAAC,aAAa;CActB"}