@revisium/core 2.9.2 → 2.10.0-alpha.0

package/dist/src/features/auth/guards/universal-auth.service.js

@@ -0,0 +1,193 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UniversalAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const client_1 = require("../../../__generated__/client");
+const api_key_tracking_service_1 = require("../../api-key/api-key-tracking.service");
+const api_key_service_1 = require("../../api-key/api-key.service");
+const no_auth_service_1 = require("../no-auth.service");
+const cookie_service_1 = require("../services/cookie.service");
+const prisma_service_1 = require("../../../infrastructure/database/prisma.service");
+let UniversalAuthService = class UniversalAuthService {
+    constructor(apiKeyService, apiKeyTracking, noAuth, prisma) {
+        this.apiKeyService = apiKeyService;
+        this.apiKeyTracking = apiKeyTracking;
+        this.noAuth = noAuth;
+        this.prisma = prisma;
+    }
+    authenticateRequest(request) {
+        if (this.noAuth.enabled) {
+            request.user = this.noAuth.adminUser;
+            return Promise.resolve('authenticated');
+        }
+        return this.authenticate(request.headers, request.query, request.ip).then((user) => {
+            if (user) {
+                request.user = user;
+                return 'authenticated';
+            }
+            if (request.headers['authorization']) {
+                return 'jwt';
+            }
+            if (request.cookies?.[cookie_service_1.ACCESS_COOKIE_NAME]) {
+                return 'jwt';
+            }
+            if (request.cookies?.[cookie_service_1.SESSION_COOKIE_NAME] === '1') {
+                return 'jwt';
+            }
+            return 'anonymous';
+        });
+    }
+    async authenticate(headers, query, ip) {
+        const internalKey = this.getHeader(headers, 'x-internal-api-key');
+        if (internalKey) {
+            return this.validateApiKeyToken(internalKey, 'internal', ip);
+        }
+        const apiKey = this.getHeader(headers, 'x-api-key');
+        if (apiKey) {
+            return this.validateApiKeyToken(apiKey, 'external', ip);
+        }
+        const authHeader = this.getHeader(headers, 'authorization');
+        if (authHeader) {
+            const bearer = this.extractBearer(authHeader);
+            if (!bearer) {
+                return null;
+            }
+            if (bearer.startsWith('rev_')) {
+                return this.validateApiKeyToken(bearer, 'external', ip);
+            }
+            return null;
+        }
+        const queryKey = query?.api_key;
+        if (typeof queryKey === 'string' && queryKey) {
+            return this.validateApiKeyToken(queryKey, 'external', ip);
+        }
+        return null;
+    }
+    async validateApiKeyToken(rawKey, source, ip) {
+        if (!this.apiKeyService.validateKeyFormat(rawKey)) {
+            throw new common_1.UnauthorizedException('Invalid API key format');
+        }
+        const keyHash = this.apiKeyService.hashKey(rawKey);
+        const apiKey = await this.apiKeyService.findByHash(keyHash);
+        if (!apiKey) {
+            throw new common_1.UnauthorizedException('Invalid API key');
+        }
+        this.assertApiKeySourceMatches(apiKey.type, source);
+        this.assertApiKeyActive(apiKey);
+        const scope = {
+            organizationId: apiKey.organizationId,
+            projectIds: apiKey.projectIds,
+            branchNames: apiKey.branchNames,
+            tableIds: apiKey.tableIds,
+        };
+        const user = await this.buildUserForApiKey(apiKey, scope);
+        this.apiKeyTracking.track(apiKey.id, ip);
+        return user;
+    }
+    assertApiKeySourceMatches(keyType, source) {
+        const isInternalKey = keyType === client_1.ApiKeyType.INTERNAL;
+        const mismatched = (source === 'internal' && !isInternalKey) ||
+            (source === 'external' && isInternalKey);
+        if (mismatched) {
+            throw new common_1.UnauthorizedException('Internal keys must use X-Internal-Api-Key header');
+        }
+    }
+    assertApiKeyActive(apiKey) {
+        if (apiKey.revokedAt) {
+            throw new common_1.UnauthorizedException('API key has been revoked');
+        }
+        if (apiKey.expiresAt && apiKey.expiresAt < new Date()) {
+            throw new common_1.UnauthorizedException('API key has expired');
+        }
+    }
+    async buildUserForApiKey(apiKey, scope) {
+        if (apiKey.type === client_1.ApiKeyType.PERSONAL) {
+            const user = await this.buildPersonalKeyUser(apiKey, scope);
+            if (apiKey.readOnly) {
+                user.apiKeyReadOnly = true;
+            }
+            return user;
+        }
+        if (apiKey.type === client_1.ApiKeyType.SERVICE) {
+            const user = this.buildServiceKeyUser(apiKey, scope);
+            if (apiKey.readOnly) {
+                user.apiKeyReadOnly = true;
+            }
+            return user;
+        }
+        if (apiKey.type === client_1.ApiKeyType.INTERNAL) {
+            return this.buildInternalKeyUser(apiKey);
+        }
+        throw new common_1.UnauthorizedException('Unsupported API key type');
+    }
+    async buildPersonalKeyUser(apiKey, scope) {
+        if (!apiKey.userId) {
+            throw new common_1.UnauthorizedException('API key has no associated user');
+        }
+        const user = await this.prisma.user.findUnique({
+            where: { id: apiKey.userId },
+            select: { id: true, email: true },
+        });
+        if (!user) {
+            throw new common_1.UnauthorizedException('User not found');
+        }
+        return {
+            userId: user.id,
+            email: user.email || '',
+            authMethod: 'personal_key',
+            apiKeyId: apiKey.id,
+            apiKeyScope: scope,
+        };
+    }
+    buildServiceKeyUser(apiKey, scope) {
+        const permissions = apiKey.permissions;
+        return {
+            userId: apiKey.serviceId || apiKey.id,
+            email: '',
+            authMethod: 'service_key',
+            apiKeyId: apiKey.id,
+            serviceId: apiKey.serviceId || undefined,
+            apiKeyScope: scope,
+            serviceKeyPermissions: permissions || undefined,
+        };
+    }
+    buildInternalKeyUser(apiKey) {
+        return {
+            userId: `internal:${apiKey.internalServiceName || 'unknown'}`,
+            email: '',
+            authMethod: 'internal_key',
+            apiKeyId: apiKey.id,
+        };
+    }
+    getHeader(headers, name) {
+        const value = headers[name];
+        if (Array.isArray(value)) {
+            return value[0];
+        }
+        return value;
+    }
+    extractBearer(authHeader) {
+        if (authHeader.startsWith('Bearer ')) {
+            return authHeader.slice(7);
+        }
+        return undefined;
+    }
+};
+exports.UniversalAuthService = UniversalAuthService;
+exports.UniversalAuthService = UniversalAuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [api_key_service_1.ApiKeyService,
+        api_key_tracking_service_1.ApiKeyTrackingService,
+        no_auth_service_1.NoAuthService,
+        prisma_service_1.PrismaService])
+], UniversalAuthService);
+//# sourceMappingURL=universal-auth.service.js.map

package/dist/src/features/auth/guards/universal-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"universal-auth.service.js","sourceRoot":"","sources":["../../../../../src/features/auth/guards/universal-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,0DAAsD;AACtD,qFAAsF;AACtF,mEAAqE;AACrE,wDAAkE;AAClE,+DAGmD;AAEnD,oFAA2E;AAKpE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,aAA4B,EAC5B,cAAqC,EACrC,MAAqB,EACrB,MAAqB;QAHrB,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAuB;QACrC,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ,mBAAmB,CAAC,OAMnB;QACC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CACvE,CAAC,IAAI,EAAE,EAAE;YACP,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,OAAO,eAAwB,CAAC;YAClC,CAAC;YAED,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrC,OAAO,KAAc,CAAC;YACxB,CAAC;YAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,mCAAkB,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAc,CAAC;YACxB,CAAC;YAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,oCAAmB,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnD,OAAO,KAAc,CAAC;YACxB,CAAC;YAED,OAAO,WAAoB,CAAC;QAC9B,CAAC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAAkB,EAClB,KAAyC,EACzC,EAAU;QAEV,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,mBAAmB,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAO,CAAC;QAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,MAAc,EACd,MAA+B,EAC/B,EAAU;QAEV,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,8BAAqB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAEhC,MAAM,KAAK,GAAiB;YAC1B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,yBAAyB,CAC/B,OAAmB,EACnB,MAA+B;QAE/B,MAAM,aAAa,GAAG,OAAO,KAAK,mBAAU,CAAC,QAAQ,CAAC;QACtD,MAAM,UAAU,GACd,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,aAAa,CAAC;YACzC,CAAC,MAAM,KAAK,UAAU,IAAI,aAAa,CAAC,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,8BAAqB,CAC7B,kDAAkD,CACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,kBAAkB,CAAC,MAG1B;QACC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACtD,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,MASC,EACD,KAAmB;QAEnB,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAU,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAU,CAAC,OAAO,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAU,CAAC,QAAQ,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;IAC9D,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,MAA6C,EAC7C,KAAmB;QAEnB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,8BAAqB,CAAC,gCAAgC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE;YAC5B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAEO,mBAAmB,CACzB,MAKC,EACD,KAAmB;QAEnB,MAAM,WAAW,GAAG,MAAM,CAAC,WAGd,CAAC;QAEd,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE;YACrC,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,aAAa;YACzB,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;YACxC,WAAW,EAAE,KAAK;YAClB,qBAAqB,EAAE,WAAW,IAAI,SAAS;SAChD,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,MAG5B;QACC,OAAO;YACL,MAAM,EAAE,YAAY,MAAM,CAAC,mBAAmB,IAAI,SAAS,EAAE;YAC7D,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,MAAM,CAAC,EAAE;SACpB,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,OAAkB,EAAE,IAAY;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,UAAkB;QACtC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AAxPY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAGuB,+BAAa;QACZ,gDAAqB;QAC7B,+BAAa;QACb,8BAAa;GAL7B,oBAAoB,CAwPhC"}

package/dist/src/features/auth/services/cookie.service.d.ts

@@ -0,0 +1,20 @@
+import { ConfigService } from '@nestjs/config';
+import { Response } from 'express';
+export declare const ACCESS_COOKIE_NAME = "rev_at";
+export declare const REFRESH_COOKIE_NAME = "rev_rt";
+export declare const SESSION_COOKIE_NAME = "rev_session";
+export declare const ACCESS_COOKIE_PATH = "/";
+export declare const REFRESH_COOKIE_PATH = "/api/auth/";
+export declare const SESSION_COOKIE_PATH = "/";
+export declare class CookieService {
+    private readonly configService;
+    private readonly logger;
+    private readonly isSecure;
+    private readonly sameSite;
+    constructor(configService: ConfigService);
+    setAuthCookies(res: Response, accessToken: string, refreshToken: string): void;
+    clearAuthCookies(res: Response): void;
+    private buildClearOptions;
+    private buildOptions;
+    private resolveSameSite;
+}

package/dist/src/features/auth/services/cookie.service.js

@@ -0,0 +1,94 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var CookieService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CookieService = exports.SESSION_COOKIE_PATH = exports.REFRESH_COOKIE_PATH = exports.ACCESS_COOKIE_PATH = exports.SESSION_COOKIE_NAME = exports.REFRESH_COOKIE_NAME = exports.ACCESS_COOKIE_NAME = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+exports.ACCESS_COOKIE_NAME = 'rev_at';
+exports.REFRESH_COOKIE_NAME = 'rev_rt';
+exports.SESSION_COOKIE_NAME = 'rev_session';
+exports.ACCESS_COOKIE_PATH = '/';
+exports.REFRESH_COOKIE_PATH = '/api/auth/';
+exports.SESSION_COOKIE_PATH = '/';
+const ACCESS_MAX_AGE_MS = 30 * 60 * 1000;
+const REFRESH_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const SESSION_COOKIE_VALUE = '1';
+const DEFAULT_SAMESITE = 'lax';
+const VALID_SAMESITE = ['lax', 'strict', 'none'];
+let CookieService = CookieService_1 = class CookieService {
+    constructor(configService) {
+        this.configService = configService;
+        this.logger = new common_1.Logger(CookieService_1.name);
+        const cookieSecure = this.configService.get('COOKIE_SECURE');
+        this.isSecure =
+            cookieSecure === undefined
+                ? this.configService.get('NODE_ENV') === 'production'
+                : cookieSecure === 'true';
+        this.sameSite = this.resolveSameSite();
+    }
+    setAuthCookies(res, accessToken, refreshToken) {
+        res.cookie(exports.ACCESS_COOKIE_NAME, accessToken, this.buildOptions(exports.ACCESS_COOKIE_PATH, ACCESS_MAX_AGE_MS));
+        res.cookie(exports.REFRESH_COOKIE_NAME, refreshToken, this.buildOptions(exports.REFRESH_COOKIE_PATH, REFRESH_MAX_AGE_MS));
+        res.cookie(exports.SESSION_COOKIE_NAME, SESSION_COOKIE_VALUE, this.buildOptions(exports.SESSION_COOKIE_PATH, REFRESH_MAX_AGE_MS, {
+            httpOnly: false,
+        }));
+    }
+    clearAuthCookies(res) {
+        res.clearCookie(exports.ACCESS_COOKIE_NAME, this.buildClearOptions(exports.ACCESS_COOKIE_PATH));
+        res.clearCookie(exports.REFRESH_COOKIE_NAME, this.buildClearOptions(exports.REFRESH_COOKIE_PATH));
+        res.clearCookie(exports.SESSION_COOKIE_NAME, this.buildClearOptions(exports.SESSION_COOKIE_PATH, { httpOnly: false }));
+    }
+    buildClearOptions(path, overrides) {
+        return {
+            httpOnly: true,
+            secure: this.isSecure,
+            sameSite: this.sameSite,
+            path,
+            ...overrides,
+        };
+    }
+    buildOptions(path, maxAge, overrides) {
+        return {
+            httpOnly: true,
+            secure: this.isSecure,
+            sameSite: this.sameSite,
+            path,
+            maxAge,
+            ...overrides,
+        };
+    }
+    resolveSameSite() {
+        const raw = this.configService
+            .get('COOKIE_SAMESITE')
+            ?.toLowerCase();
+        if (raw === undefined || raw === '') {
+            return DEFAULT_SAMESITE;
+        }
+        if (!VALID_SAMESITE.includes(raw)) {
+            this.logger.warn(`Invalid COOKIE_SAMESITE='${raw}', falling back to '${DEFAULT_SAMESITE}'. Allowed: ${VALID_SAMESITE.join(', ')}.`);
+            return DEFAULT_SAMESITE;
+        }
+        const value = raw;
+        if (value === 'none' && !this.isSecure) {
+            throw new Error(`Invalid cookie configuration: COOKIE_SAMESITE='none' requires COOKIE_SECURE=true. ` +
+                `Browsers reject SameSite=None cookies that are not Secure. ` +
+                `Either set COOKIE_SECURE=true (requires HTTPS) or use COOKIE_SAMESITE='lax' / 'strict'.`);
+        }
+        return value;
+    }
+};
+exports.CookieService = CookieService;
+exports.CookieService = CookieService = CookieService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService])
+], CookieService);
+//# sourceMappingURL=cookie.service.js.map

package/dist/src/features/auth/services/cookie.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.service.js","sourceRoot":"","sources":["../../../../../src/features/auth/services/cookie.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,2CAA+C;AAGlC,QAAA,kBAAkB,GAAG,QAAQ,CAAC;AAC9B,QAAA,mBAAmB,GAAG,QAAQ,CAAC;AAC/B,QAAA,mBAAmB,GAAG,aAAa,CAAC;AACpC,QAAA,kBAAkB,GAAG,GAAG,CAAC;AACzB,QAAA,mBAAmB,GAAG,YAAY,CAAC;AACnC,QAAA,mBAAmB,GAAG,GAAG,CAAC;AAEvC,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnD,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAGjC,MAAM,gBAAgB,GAAkB,KAAK,CAAC;AAC9C,MAAM,cAAc,GAA6B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAGpE,IAAM,aAAa,qBAAnB,MAAM,aAAa;IAKxB,YAA6B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;QAJxC,WAAM,GAAG,IAAI,eAAM,CAAC,eAAa,CAAC,IAAI,CAAC,CAAC;QAKvD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,eAAe,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ;YACX,YAAY,KAAK,SAAS;gBACxB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,UAAU,CAAC,KAAK,YAAY;gBAC7D,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC;QAE9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;IACzC,CAAC;IAEM,cAAc,CACnB,GAAa,EACb,WAAmB,EACnB,YAAoB;QAEpB,GAAG,CAAC,MAAM,CACR,0BAAkB,EAClB,WAAW,EACX,IAAI,CAAC,YAAY,CAAC,0BAAkB,EAAE,iBAAiB,CAAC,CACzD,CAAC;QAEF,GAAG,CAAC,MAAM,CACR,2BAAmB,EACnB,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,2BAAmB,EAAE,kBAAkB,CAAC,CAC3D,CAAC;QAMF,GAAG,CAAC,MAAM,CACR,2BAAmB,EACnB,oBAAoB,EACpB,IAAI,CAAC,YAAY,CAAC,2BAAmB,EAAE,kBAAkB,EAAE;YACzD,QAAQ,EAAE,KAAK;SAChB,CAAC,CACH,CAAC;IACJ,CAAC;IAEM,gBAAgB,CAAC,GAAa;QAKnC,GAAG,CAAC,WAAW,CACb,0BAAkB,EAClB,IAAI,CAAC,iBAAiB,CAAC,0BAAkB,CAAC,CAC3C,CAAC;QACF,GAAG,CAAC,WAAW,CACb,2BAAmB,EACnB,IAAI,CAAC,iBAAiB,CAAC,2BAAmB,CAAC,CAC5C,CAAC;QACF,GAAG,CAAC,WAAW,CACb,2BAAmB,EACnB,IAAI,CAAC,iBAAiB,CAAC,2BAAmB,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CACjE,CAAC;IACJ,CAAC;IAEO,iBAAiB,CACvB,IAAY,EACZ,SAAkC;QAElC,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,QAAQ;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI;YACJ,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAEO,YAAY,CAClB,IAAY,EACZ,MAAc,EACd,SAAkC;QAElC,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,QAAQ;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI;YACJ,MAAM;YACN,GAAG,SAAS;SACb,CAAC;IACJ,CAAC;IAEO,eAAe;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa;aAC3B,GAAG,CAAS,iBAAiB,CAAC;YAC/B,EAAE,WAAW,EAAE,CAAC;QAElB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACpC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAoB,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,GAAG,uBAAuB,gBAAgB,eAAe,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClH,CAAC;YACF,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,KAAK,GAAG,GAAoB,CAAC;QAEnC,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,6DAA6D;gBAC7D,yFAAyF,CAC5F,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAxHY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAMiC,sBAAa;GAL9C,aAAa,CAwHzB"}

package/dist/src/features/auth/services/refresh-token.service.d.ts

@@ -0,0 +1,34 @@
+import { ConfigService } from '@nestjs/config';
+import { PrismaService } from '../../../infrastructure/database/prisma.service';
+export type RefreshTokenMeta = {
+    ip?: string;
+    userAgent?: string;
+};
+export type RotateResult = {
+    userId: string;
+    newToken: string;
+};
+export declare class RefreshTokenService {
+    private readonly prisma;
+    private readonly configService;
+    private readonly logger;
+    private readonly refreshTtlMs;
+    private readonly gracePeriodMs;
+    private readonly gracePeriodReplayCache;
+    constructor(prisma: PrismaService, configService: ConfigService);
+    createToken(userId: string, familyId?: string, meta?: RefreshTokenMeta): Promise<string>;
+    rotateToken(rawToken: string, meta?: RefreshTokenMeta): Promise<RotateResult>;
+    revokeFamily(familyId: string): Promise<void>;
+    revokeFamilyByRawToken(rawToken: string): Promise<void>;
+    revokeAllUserTokens(userId: string): Promise<void>;
+    private generateRawToken;
+    private hashToken;
+    private sanitizeMeta;
+    private insertToken;
+    private redactUserId;
+    private redactIp;
+    private rotateOrDetectReuse;
+    private peekGraceCache;
+    private writeGraceCache;
+    private pruneGraceCache;
+}

package/dist/src/features/auth/services/refresh-token.service.js

@@ -0,0 +1,249 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var RefreshTokenService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshTokenService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const node_crypto_1 = require("node:crypto");
+const nanoid_1 = require("nanoid");
+const prisma_service_1 = require("../../../infrastructure/database/prisma.service");
+const TOKEN_PREFIX = 'ref_';
+const TOKEN_BYTE_LENGTH = 36;
+const DEFAULT_REFRESH_TTL_DAYS = 7;
+const DEFAULT_GRACE_PERIOD_MS = 30_000;
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+const MAX_IP_LENGTH = 64;
+const MAX_USER_AGENT_LENGTH = 512;
+let RefreshTokenService = RefreshTokenService_1 = class RefreshTokenService {
+    constructor(prisma, configService) {
+        this.prisma = prisma;
+        this.configService = configService;
+        this.logger = new common_1.Logger(RefreshTokenService_1.name);
+        this.gracePeriodReplayCache = new Map();
+        const ttlDays = Number(this.configService.get('JWT_REFRESH_TOKEN_TTL_DAYS')) ||
+            DEFAULT_REFRESH_TTL_DAYS;
+        this.refreshTtlMs = ttlDays * MS_PER_DAY;
+        this.gracePeriodMs =
+            Number(this.configService.get('JWT_REFRESH_GRACE_PERIOD_MS')) ||
+                DEFAULT_GRACE_PERIOD_MS;
+    }
+    async createToken(userId, familyId, meta) {
+        const token = this.generateRawToken();
+        const family = familyId ?? (0, nanoid_1.nanoid)();
+        await this.insertToken(this.prisma, {
+            tokenHash: this.hashToken(token),
+            userId,
+            familyId: family,
+            meta,
+        });
+        return token;
+    }
+    async rotateToken(rawToken, meta) {
+        const tokenHash = this.hashToken(rawToken);
+        const storedToken = await this.prisma.refreshToken.findUnique({
+            where: { tokenHash },
+        });
+        if (!storedToken) {
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        }
+        if (storedToken.expiresAt < new Date() && !storedToken.revokedAt) {
+            throw new common_1.UnauthorizedException('Refresh token expired');
+        }
+        if (storedToken.revokedAt) {
+            const elapsedSinceRevoke = Date.now() - storedToken.revokedAt.getTime();
+            if (elapsedSinceRevoke <= this.gracePeriodMs) {
+                const cached = this.peekGraceCache(storedToken.id);
+                if (cached) {
+                    return { userId: cached.userId, newToken: cached.rawToken };
+                }
+            }
+        }
+        const outcome = await this.prisma.$transaction(async (tx) => {
+            if (storedToken.revokedAt) {
+                return this.rotateOrDetectReuse(tx, storedToken, meta);
+            }
+            const { count } = await tx.refreshToken.updateMany({
+                where: { id: storedToken.id, revokedAt: null },
+                data: { revokedAt: new Date() },
+            });
+            if (count === 0) {
+                const fresh = await tx.refreshToken.findUnique({
+                    where: { id: storedToken.id },
+                });
+                if (!fresh) {
+                    return null;
+                }
+                return this.rotateOrDetectReuse(tx, fresh, meta);
+            }
+            const newTokenValue = this.generateRawToken();
+            await this.insertToken(tx, {
+                tokenHash: this.hashToken(newTokenValue),
+                userId: storedToken.userId,
+                familyId: storedToken.familyId,
+                meta,
+            });
+            return {
+                kind: 'ok',
+                result: { userId: storedToken.userId, newToken: newTokenValue },
+                predecessorId: storedToken.id,
+            };
+        });
+        if (outcome === null) {
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        }
+        if (outcome.kind === 'reuse') {
+            this.logger.warn(`Refresh token reuse detected — revoking family ${outcome.familyId} for user ${this.redactUserId(outcome.userId)}. ip=${this.redactIp(meta?.ip)}`);
+            throw new common_1.UnauthorizedException('Refresh token reuse detected');
+        }
+        this.writeGraceCache(outcome.predecessorId, {
+            rawToken: outcome.result.newToken,
+            userId: outcome.result.userId,
+            expiresAt: Date.now() + this.gracePeriodMs,
+        });
+        return outcome.result;
+    }
+    async revokeFamily(familyId) {
+        await this.prisma.refreshToken.updateMany({
+            where: { familyId, revokedAt: null },
+            data: { revokedAt: new Date() },
+        });
+    }
+    async revokeFamilyByRawToken(rawToken) {
+        const tokenHash = this.hashToken(rawToken);
+        const stored = await this.prisma.refreshToken.findUnique({
+            where: { tokenHash },
+        });
+        if (stored) {
+            await this.revokeFamily(stored.familyId);
+        }
+    }
+    async revokeAllUserTokens(userId) {
+        await this.prisma.refreshToken.updateMany({
+            where: { userId, revokedAt: null },
+            data: { revokedAt: new Date() },
+        });
+    }
+    generateRawToken() {
+        return `${TOKEN_PREFIX}${(0, node_crypto_1.randomBytes)(TOKEN_BYTE_LENGTH).toString('hex')}`;
+    }
+    hashToken(rawToken) {
+        return (0, node_crypto_1.createHash)('sha256').update(rawToken).digest('hex');
+    }
+    sanitizeMeta(meta) {
+        return {
+            ip: meta?.ip ? meta.ip.slice(0, MAX_IP_LENGTH) : null,
+            userAgent: meta?.userAgent
+                ? meta.userAgent.slice(0, MAX_USER_AGENT_LENGTH)
+                : null,
+        };
+    }
+    async insertToken(client, args) {
+        const sanitized = this.sanitizeMeta(args.meta);
+        await client.refreshToken.create({
+            data: {
+                tokenHash: args.tokenHash,
+                userId: args.userId,
+                familyId: args.familyId,
+                expiresAt: new Date(Date.now() + this.refreshTtlMs),
+                ip: sanitized.ip,
+                userAgent: sanitized.userAgent,
+            },
+        });
+    }
+    redactUserId(userId) {
+        return (0, node_crypto_1.createHash)('sha256').update(userId).digest('hex').slice(0, 12);
+    }
+    redactIp(ip) {
+        if (!ip) {
+            return 'unknown';
+        }
+        const dotCount = (ip.match(/\./g) ?? []).length;
+        if (dotCount === 3) {
+            const lastDot = ip.lastIndexOf('.');
+            return `${ip.slice(0, lastDot)}.*`;
+        }
+        return ip.slice(0, 24);
+    }
+    async rotateOrDetectReuse(tx, storedToken, meta) {
+        if (storedToken.revokedAt) {
+            const elapsed = Date.now() - storedToken.revokedAt.getTime();
+            if (elapsed <= this.gracePeriodMs) {
+                const latestToken = await tx.refreshToken.findFirst({
+                    where: { familyId: storedToken.familyId, revokedAt: null },
+                    orderBy: { createdAt: 'desc' },
+                });
+                if (latestToken) {
+                    const { count } = await tx.refreshToken.updateMany({
+                        where: { id: latestToken.id, revokedAt: null },
+                        data: { revokedAt: new Date() },
+                    });
+                    if (count > 0) {
+                        const newTokenValue = this.generateRawToken();
+                        await this.insertToken(tx, {
+                            tokenHash: this.hashToken(newTokenValue),
+                            userId: latestToken.userId,
+                            familyId: latestToken.familyId,
+                            meta,
+                        });
+                        return {
+                            kind: 'ok',
+                            result: {
+                                userId: latestToken.userId,
+                                newToken: newTokenValue,
+                            },
+                            predecessorId: storedToken.id,
+                        };
+                    }
+                }
+            }
+        }
+        await tx.refreshToken.updateMany({
+            where: { familyId: storedToken.familyId, revokedAt: null },
+            data: { revokedAt: new Date() },
+        });
+        return {
+            kind: 'reuse',
+            familyId: storedToken.familyId,
+            userId: storedToken.userId,
+        };
+    }
+    peekGraceCache(predecessorId) {
+        const entry = this.gracePeriodReplayCache.get(predecessorId);
+        if (!entry) {
+            return null;
+        }
+        if (entry.expiresAt <= Date.now()) {
+            this.gracePeriodReplayCache.delete(predecessorId);
+            return null;
+        }
+        return entry;
+    }
+    writeGraceCache(predecessorId, entry) {
+        this.pruneGraceCache();
+        this.gracePeriodReplayCache.set(predecessorId, entry);
+    }
+    pruneGraceCache() {
+        const now = Date.now();
+        for (const [key, entry] of this.gracePeriodReplayCache) {
+            if (entry.expiresAt <= now) {
+                this.gracePeriodReplayCache.delete(key);
+            }
+        }
+    }
+};
+exports.RefreshTokenService = RefreshTokenService;
+exports.RefreshTokenService = RefreshTokenService = RefreshTokenService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService,
+        config_1.ConfigService])
+], RefreshTokenService);
+//# sourceMappingURL=refresh-token.service.js.map

package/dist/src/features/auth/services/refresh-token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.service.js","sourceRoot":"","sources":["../../../../../src/features/auth/services/refresh-token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,2CAA+C;AAC/C,6CAAsD;AACtD,mCAAgC;AAEhC,oFAA2E;AAE3E,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAqC3B,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAW9B,YACmB,MAAqB,EACrB,aAA4B;QAD5B,WAAM,GAAN,MAAM,CAAe;QACrB,kBAAa,GAAb,aAAa,CAAe;QAZ9B,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAQ9C,2BAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;QAM3E,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,4BAA4B,CAAC,CAAC;YACpE,wBAAwB,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,OAAO,GAAG,UAAU,CAAC;QACzC,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,6BAA6B,CAAC,CAAC;gBACrE,uBAAuB,CAAC;IAC5B,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,MAAc,EACd,QAAiB,EACjB,IAAuB;QAEvB,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAA,eAAM,GAAE,CAAC;QAEpC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAChC,MAAM;YACN,QAAQ,EAAE,MAAM;YAChB,IAAI;SACL,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACf,CAAC;IAEM,KAAK,CAAC,WAAW,CACtB,QAAgB,EAChB,IAAuB;QAEvB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YAC5D,KAAK,EAAE,EAAE,SAAS,EAAE;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,WAAW,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;YACjE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QAeD,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACxE,IAAI,kBAAkB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACnD,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;QAQD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC1D,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACzD,CAAC;YAQD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;gBACjD,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC9C,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aAChC,CAAC,CAAC;YAEH,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;oBAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE;iBAC9B,CAAC,CAAC;gBACH,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;gBACxC,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,IAAI;aACL,CAAC,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,IAAa;gBACnB,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE;gBAC/D,aAAa,EAAE,WAAW,CAAC,EAAE;aAC9B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kDAAkD,OAAO,CAAC,QAAQ,aAAa,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAClJ,CAAC;YACF,MAAM,IAAI,8BAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,aAAa,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;YACjC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;YAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa;SAC3C,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,QAAgB;QACxC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YACxC,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;YACpC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,sBAAsB,CAAC,QAAgB;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YACvD,KAAK,EAAE,EAAE,SAAS,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,MAAc;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;YACxC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;YAClC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB;QACtB,OAAO,GAAG,YAAY,GAAG,IAAA,yBAAW,EAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,CAAC;IAEO,SAAS,CAAC,QAAgB;QAChC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7D,CAAC;IAEO,YAAY,CAAC,IAAuB;QAI1C,OAAO;YACL,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI;YACrD,SAAS,EAAE,IAAI,EAAE,SAAS;gBACxB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC;gBAChD,CAAC,CAAC,IAAI;SACT,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,MAAyC,EACzC,IAKC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;YAC/B,IAAI,EAAE;gBACJ,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;gBACnD,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC;IAEO,QAAQ,CAAC,EAA6B;QAC5C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAChD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,EAAqB,EACrB,WAKC,EACD,IAAuB;QAEvB,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC7D,IAAI,OAAO,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBASlC,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC;oBAClD,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;oBAC1D,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;iBAC/B,CAAC,CAAC;gBAEH,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;wBACjD,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;wBAC9C,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;qBAChC,CAAC,CAAC;oBAEH,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;wBACd,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE;4BACzB,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;4BACxC,MAAM,EAAE,WAAW,CAAC,MAAM;4BAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;4BAC9B,IAAI;yBACL,CAAC,CAAC;wBAMH,OAAO;4BACL,IAAI,EAAE,IAAI;4BACV,MAAM,EAAE;gCACN,MAAM,EAAE,WAAW,CAAC,MAAM;gCAC1B,QAAQ,EAAE,aAAa;6BACxB;4BACD,aAAa,EAAE,WAAW,CAAC,EAAE;yBAC9B,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;YAC/B,KAAK,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;YAC1D,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC,CAAC;QAEH,OAAO;YACL,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM;SAC3B,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,aAAqB;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAClC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,eAAe,CAAC,aAAqB,EAAE,KAAsB;QACnE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAEO,eAAe;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;CACF,CAAA;AAlUY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;qCAagB,8BAAa;QACN,sBAAa;GAbpC,mBAAmB,CAkU/B"}

package/dist/src/features/auth/strategy/jwt.strategy.d.ts

@@ -1,11 +1,27 @@
+import { Request } from 'express';
 import { Strategy } from 'passport-jwt';
 import { JwtSecretService } from '../../../features/auth/jwt-secret.service';
 import { IAuthUser } from '../../../features/auth/types';
+import { AuthCacheService } from '../../../infrastructure/cache/services/auth-cache.service';
+import { PrismaService } from '../../../infrastructure/database/prisma.service';
+type RequestWithCookies = Request & {
+    cookies?: Record<string, string>;
+};
+type AccessTokenPayload = {
+    sub: string;
+    email?: string;
+    username?: string;
+    roleId?: string;
+    ver?: number;
+};
+export declare function extractTokenFromCookieOrHeader(req: RequestWithCookies): string | null;
 declare const JwtStrategy_base: new (...args: [opt: import("passport-jwt").StrategyOptionsWithRequest] | [opt: import("passport-jwt").StrategyOptionsWithoutRequest]) => Strategy & {
     validate(...args: any[]): unknown;
 };
 export declare class JwtStrategy extends JwtStrategy_base {
-    constructor(jwtSecret: JwtSecretService);
-    validate(payload: any): Promise<IAuthUser>;
+    private readonly prisma;
+    private readonly authCache;
+    constructor(jwtSecret: JwtSecretService, prisma: PrismaService, authCache: AuthCacheService);
+    validate(payload: AccessTokenPayload): Promise<IAuthUser>;
 }
 export {};