@scryan7371/sdr-security 0.1.1 → 0.1.3

package/dist/nest/security-auth.service.d.ts

@@ -0,0 +1,60 @@
+import { Repository } from "typeorm";
+import { AuthResponse, RegisterResponse } from "../api/contracts";
+import { SecurityAuthModuleOptions } from "./security-auth.options";
+import { AppUserEntity } from "./entities/app-user.entity";
+import { PasswordResetTokenEntity } from "./entities/password-reset-token.entity";
+import { RefreshTokenEntity } from "./entities/refresh-token.entity";
+import { SecurityRoleEntity } from "./entities/security-role.entity";
+import { SecurityUserEntity } from "./entities/security-user.entity";
+import { SecurityUserRoleEntity } from "./entities/security-user-role.entity";
+import { SecurityWorkflowNotifier } from "./contracts";
+export declare class SecurityAuthService {
+    private readonly appUsersRepo;
+    private readonly securityUsersRepo;
+    private readonly refreshTokenRepo;
+    private readonly passwordResetRepo;
+    private readonly rolesRepo;
+    private readonly userRolesRepo;
+    private readonly options;
+    private readonly notifier;
+    constructor(appUsersRepo: Repository<AppUserEntity>, securityUsersRepo: Repository<SecurityUserEntity>, refreshTokenRepo: Repository<RefreshTokenEntity>, passwordResetRepo: Repository<PasswordResetTokenEntity>, rolesRepo: Repository<SecurityRoleEntity>, userRolesRepo: Repository<SecurityUserRoleEntity>, options: SecurityAuthModuleOptions, notifier: SecurityWorkflowNotifier);
+    register(params: {
+        email: string;
+        password: string;
+    }): Promise<RegisterResponse>;
+    login(params: {
+        email: string;
+        password: string;
+    }): Promise<AuthResponse>;
+    refresh(refreshToken: string): Promise<AuthResponse>;
+    logout(refreshToken?: string): Promise<{
+        success: true;
+    }>;
+    changePassword(params: {
+        userId: string;
+        currentPassword: string;
+        newPassword: string;
+    }): Promise<{
+        success: true;
+    }>;
+    requestForgotPassword(emailInput: string): Promise<{
+        success: true;
+    }>;
+    resetPassword(token: string, newPassword: string): Promise<{
+        success: true;
+    }>;
+    verifyEmailByToken(token: string): Promise<{
+        success: true;
+    }>;
+    getMyRoles(userId: string): Promise<{
+        userId: string;
+        roles: string[];
+    }>;
+    getUserIdByVerificationToken(token: string): Promise<string | null>;
+    private assertCanAuthenticate;
+    private issueTokens;
+    private createEmailVerificationToken;
+    private findValidRefreshToken;
+    private getUserRoleKeys;
+    private toSafeUser;
+}

package/dist/nest/security-auth.service.js

@@ -0,0 +1,299 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const bcryptjs_1 = require("bcryptjs");
+const jsonwebtoken_1 = require("jsonwebtoken");
+const typeorm_1 = require("@nestjs/typeorm");
+const typeorm_2 = require("typeorm");
+const roles_1 = require("../api/roles");
+const validation_1 = require("../api/validation");
+const security_auth_constants_1 = require("./security-auth.constants");
+const app_user_entity_1 = require("./entities/app-user.entity");
+const password_reset_token_entity_1 = require("./entities/password-reset-token.entity");
+const refresh_token_entity_1 = require("./entities/refresh-token.entity");
+const security_role_entity_1 = require("./entities/security-role.entity");
+const security_user_entity_1 = require("./entities/security-user.entity");
+const security_user_role_entity_1 = require("./entities/security-user-role.entity");
+const tokens_1 = require("./tokens");
+const EMAIL_TOKEN_BYTES = 24;
+const REFRESH_TOKEN_BYTES = 32;
+const PASSWORD_ROUNDS = 12;
+let SecurityAuthService = class SecurityAuthService {
+    appUsersRepo;
+    securityUsersRepo;
+    refreshTokenRepo;
+    passwordResetRepo;
+    rolesRepo;
+    userRolesRepo;
+    options;
+    notifier;
+    constructor(appUsersRepo, securityUsersRepo, refreshTokenRepo, passwordResetRepo, rolesRepo, userRolesRepo, options, notifier) {
+        this.appUsersRepo = appUsersRepo;
+        this.securityUsersRepo = securityUsersRepo;
+        this.refreshTokenRepo = refreshTokenRepo;
+        this.passwordResetRepo = passwordResetRepo;
+        this.rolesRepo = rolesRepo;
+        this.userRolesRepo = userRolesRepo;
+        this.options = options;
+        this.notifier = notifier;
+    }
+    async register(params) {
+        const email = (0, validation_1.sanitizeEmail)(params.email);
+        const existing = await this.appUsersRepo.findOne({ where: { email } });
+        if (existing) {
+            throw new common_1.BadRequestException("Email already in use");
+        }
+        const appUser = await this.appUsersRepo.save(this.appUsersRepo.create({
+            email,
+        }));
+        const securityUser = await this.securityUsersRepo.save(this.securityUsersRepo.create({
+            userId: appUser.id,
+            passwordHash: await (0, bcryptjs_1.hash)(params.password, PASSWORD_ROUNDS),
+            emailVerifiedAt: null,
+            emailVerificationToken: null,
+            adminApprovedAt: null,
+            isActive: true,
+        }));
+        const verificationToken = await this.createEmailVerificationToken(appUser.id);
+        if (this.notifier.sendEmailVerification) {
+            await this.notifier.sendEmailVerification({
+                email: appUser.email,
+                token: verificationToken,
+            });
+        }
+        return {
+            success: true,
+            user: await this.toSafeUser(appUser, securityUser),
+            debugToken: verificationToken,
+        };
+    }
+    async login(params) {
+        const email = (0, validation_1.sanitizeEmail)(params.email);
+        const appUser = await this.appUsersRepo.findOne({ where: { email } });
+        if (!appUser) {
+            throw new common_1.UnauthorizedException("Invalid credentials");
+        }
+        const securityUser = await this.securityUsersRepo.findOne({
+            where: { userId: appUser.id },
+        });
+        if (!securityUser) {
+            throw new common_1.UnauthorizedException("Invalid credentials");
+        }
+        const ok = await (0, bcryptjs_1.compare)(params.password, securityUser.passwordHash);
+        if (!ok) {
+            throw new common_1.UnauthorizedException("Invalid credentials");
+        }
+        this.assertCanAuthenticate(securityUser);
+        return this.issueTokens(appUser, securityUser);
+    }
+    async refresh(refreshToken) {
+        const record = await this.findValidRefreshToken(refreshToken);
+        if (!record) {
+            throw new common_1.UnauthorizedException("Invalid refresh token");
+        }
+        await this.refreshTokenRepo.update({ id: record.id }, { revokedAt: new Date() });
+        const appUser = await this.appUsersRepo.findOne({
+            where: { id: record.userId ?? "" },
+        });
+        if (!appUser) {
+            throw new common_1.UnauthorizedException("User not found");
+        }
+        const securityUser = await this.securityUsersRepo.findOne({
+            where: { userId: appUser.id },
+        });
+        if (!securityUser) {
+            throw new common_1.UnauthorizedException("User not found");
+        }
+        this.assertCanAuthenticate(securityUser);
+        return this.issueTokens(appUser, securityUser);
+    }
+    async logout(refreshToken) {
+        if (!refreshToken) {
+            return { success: true };
+        }
+        const record = await this.findValidRefreshToken(refreshToken, false);
+        if (record && !record.revokedAt) {
+            await this.refreshTokenRepo.update({ id: record.id }, { revokedAt: new Date() });
+        }
+        return { success: true };
+    }
+    async changePassword(params) {
+        const securityUser = await this.securityUsersRepo.findOne({
+            where: { userId: params.userId },
+        });
+        if (!securityUser) {
+            throw new common_1.BadRequestException("User not found");
+        }
+        const ok = await (0, bcryptjs_1.compare)(params.currentPassword, securityUser.passwordHash);
+        if (!ok) {
+            throw new common_1.UnauthorizedException("Current password is incorrect");
+        }
+        await this.securityUsersRepo.update({ userId: securityUser.userId }, { passwordHash: await (0, bcryptjs_1.hash)(params.newPassword, PASSWORD_ROUNDS) });
+        return { success: true };
+    }
+    async requestForgotPassword(emailInput) {
+        const email = (0, validation_1.sanitizeEmail)(emailInput);
+        const appUser = await this.appUsersRepo.findOne({ where: { email } });
+        if (!appUser) {
+            return { success: true };
+        }
+        const securityUser = await this.securityUsersRepo.findOne({
+            where: { userId: appUser.id },
+        });
+        if (!securityUser) {
+            return { success: true };
+        }
+        const token = (0, crypto_1.randomBytes)(EMAIL_TOKEN_BYTES).toString("hex");
+        const expiresAt = new Date(Date.now() +
+            (this.options.passwordResetTokenExpiresInMinutes ?? 30) * 60_000);
+        await this.passwordResetRepo.save(this.passwordResetRepo.create({
+            userId: appUser.id,
+            token,
+            expiresAt,
+            usedAt: null,
+        }));
+        if (this.notifier.sendPasswordReset) {
+            await this.notifier.sendPasswordReset({ email: appUser.email, token });
+        }
+        return { success: true };
+    }
+    async resetPassword(token, newPassword) {
+        const reset = await this.passwordResetRepo.findOne({ where: { token } });
+        if (!reset || reset.usedAt || reset.expiresAt.getTime() <= Date.now()) {
+            throw new common_1.BadRequestException("Invalid password reset token");
+        }
+        await this.securityUsersRepo.update({ userId: reset.userId }, { passwordHash: await (0, bcryptjs_1.hash)(newPassword, PASSWORD_ROUNDS) });
+        await this.passwordResetRepo.update({ id: reset.id }, { usedAt: new Date() });
+        return { success: true };
+    }
+    async verifyEmailByToken(token) {
+        const user = await this.securityUsersRepo.findOne({
+            where: { emailVerificationToken: token },
+        });
+        if (!user) {
+            throw new common_1.BadRequestException("Invalid verification token");
+        }
+        await this.securityUsersRepo.update({ userId: user.userId }, { emailVerifiedAt: new Date(), emailVerificationToken: null });
+        return { success: true };
+    }
+    async getMyRoles(userId) {
+        return { userId, roles: await this.getUserRoleKeys(userId) };
+    }
+    async getUserIdByVerificationToken(token) {
+        const user = await this.securityUsersRepo.findOne({
+            where: { emailVerificationToken: token },
+        });
+        return user?.userId ?? null;
+    }
+    assertCanAuthenticate(user) {
+        if (!user.isActive) {
+            throw new common_1.UnauthorizedException("Account is inactive");
+        }
+        if ((this.options.requireEmailVerification ?? true) &&
+            !user.emailVerifiedAt) {
+            throw new common_1.UnauthorizedException("Email verification required");
+        }
+        if ((this.options.requireAdminApproval ?? true) && !user.adminApprovedAt) {
+            throw new common_1.UnauthorizedException("Admin approval required");
+        }
+    }
+    async issueTokens(appUser, securityUser) {
+        const roles = await this.getUserRoleKeys(appUser.id);
+        const accessTokenExpiresIn = this.options.accessTokenExpiresIn ?? "15m";
+        const accessToken = (0, jsonwebtoken_1.sign)({ sub: appUser.id, email: appUser.email, roles }, this.options.jwtSecret, { expiresIn: accessTokenExpiresIn });
+        const refreshToken = (0, crypto_1.randomBytes)(REFRESH_TOKEN_BYTES).toString("hex");
+        const refreshTokenHash = await (0, bcryptjs_1.hash)(refreshToken, PASSWORD_ROUNDS);
+        const refreshTokenExpiresAt = new Date(Date.now() +
+            (this.options.refreshTokenExpiresInDays ?? 30) * 24 * 60 * 60 * 1000);
+        await this.refreshTokenRepo.save(this.refreshTokenRepo.create({
+            id: (0, crypto_1.randomUUID)(),
+            userId: appUser.id,
+            tokenHash: refreshTokenHash,
+            expiresAt: refreshTokenExpiresAt,
+            revokedAt: null,
+        }));
+        return {
+            accessToken,
+            accessTokenExpiresIn,
+            refreshToken,
+            refreshTokenExpiresAt,
+            user: await this.toSafeUser(appUser, securityUser),
+        };
+    }
+    async createEmailVerificationToken(userId) {
+        const token = (0, crypto_1.randomBytes)(EMAIL_TOKEN_BYTES).toString("hex");
+        await this.securityUsersRepo.update({ userId }, { emailVerificationToken: token });
+        return token;
+    }
+    async findValidRefreshToken(token, onlyUnexpired = true) {
+        const candidates = await this.refreshTokenRepo.find({
+            where: { revokedAt: (0, typeorm_2.IsNull)() },
+            order: { createdAt: "DESC" },
+            take: 50,
+        });
+        for (const candidate of candidates) {
+            const match = await (0, bcryptjs_1.compare)(token, candidate.tokenHash);
+            if (!match) {
+                continue;
+            }
+            if (onlyUnexpired && candidate.expiresAt.getTime() <= Date.now()) {
+                return null;
+            }
+            return candidate;
+        }
+        return null;
+    }
+    async getUserRoleKeys(userId) {
+        const assignments = await this.userRolesRepo.find({ where: { userId } });
+        if (assignments.length === 0) {
+            return [];
+        }
+        const roleIds = assignments.map((assignment) => assignment.roleId);
+        const roles = await this.rolesRepo.find({ where: { id: (0, typeorm_2.In)(roleIds) } });
+        return roles.map((role) => (0, roles_1.normalizeRoleName)(role.roleKey)).sort();
+    }
+    async toSafeUser(appUser, securityUser) {
+        return {
+            id: appUser.id,
+            email: appUser.email,
+            phone: null,
+            roles: await this.getUserRoleKeys(appUser.id),
+            emailVerifiedAt: securityUser.emailVerifiedAt,
+            phoneVerifiedAt: null,
+            adminApprovedAt: securityUser.adminApprovedAt,
+            isActive: securityUser.isActive,
+        };
+    }
+};
+exports.SecurityAuthService = SecurityAuthService;
+exports.SecurityAuthService = SecurityAuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, typeorm_1.InjectRepository)(app_user_entity_1.AppUserEntity)),
+    __param(1, (0, typeorm_1.InjectRepository)(security_user_entity_1.SecurityUserEntity)),
+    __param(2, (0, typeorm_1.InjectRepository)(refresh_token_entity_1.RefreshTokenEntity)),
+    __param(3, (0, typeorm_1.InjectRepository)(password_reset_token_entity_1.PasswordResetTokenEntity)),
+    __param(4, (0, typeorm_1.InjectRepository)(security_role_entity_1.SecurityRoleEntity)),
+    __param(5, (0, typeorm_1.InjectRepository)(security_user_role_entity_1.SecurityUserRoleEntity)),
+    __param(6, (0, common_1.Inject)(security_auth_constants_1.SECURITY_AUTH_OPTIONS)),
+    __param(7, (0, common_1.Inject)(tokens_1.SECURITY_WORKFLOW_NOTIFIER)),
+    __metadata("design:paramtypes", [typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        typeorm_2.Repository, Object, Object])
+], SecurityAuthService);

package/dist/nest/security-auth.service.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/nest/security-auth.service.test.js

@@ -0,0 +1,249 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@nestjs/common");
+const vitest_1 = require("vitest");
+vitest_1.vi.mock("bcryptjs", () => ({
+    hash: vitest_1.vi.fn(async (value) => `hashed:${value}`),
+    compare: vitest_1.vi.fn(async (plain, hashed) => hashed === `hashed:${plain}`),
+}));
+vitest_1.vi.mock("crypto", () => ({
+    randomBytes: vitest_1.vi.fn(() => ({ toString: () => "token-bytes" })),
+    randomUUID: vitest_1.vi.fn(() => "uuid-1"),
+}));
+vitest_1.vi.mock("jsonwebtoken", () => ({
+    sign: vitest_1.vi.fn(() => "signed-access-token"),
+}));
+const bcryptjs_1 = require("bcryptjs");
+const jsonwebtoken_1 = require("jsonwebtoken");
+const security_auth_service_1 = require("./security-auth.service");
+const makeRepo = () => ({
+    findOne: vitest_1.vi.fn(),
+    save: vitest_1.vi.fn(async (value) => value),
+    create: vitest_1.vi.fn((value) => value),
+    update: vitest_1.vi.fn(async () => ({ affected: 1 })),
+    find: vitest_1.vi.fn(async () => []),
+});
+const makeNotifier = () => ({
+    sendEmailVerification: vitest_1.vi.fn(async () => undefined),
+    sendPasswordReset: vitest_1.vi.fn(async () => undefined),
+    sendAdminsUserEmailVerified: vitest_1.vi.fn(async () => undefined),
+    sendUserAccountApproved: vitest_1.vi.fn(async () => undefined),
+});
+const makeUser = () => ({
+    id: "user-1",
+    email: "user@example.com",
+});
+const makeSecurityUser = () => ({
+    userId: "user-1",
+    passwordHash: "hashed:Secret123",
+    emailVerifiedAt: new Date("2026-01-01T00:00:00.000Z"),
+    emailVerificationToken: null,
+    adminApprovedAt: new Date("2026-01-01T00:00:00.000Z"),
+    isActive: true,
+});
+const setup = () => {
+    const appUsersRepo = makeRepo();
+    const securityUsersRepo = makeRepo();
+    const refreshTokenRepo = makeRepo();
+    const passwordResetRepo = makeRepo();
+    const rolesRepo = makeRepo();
+    const userRolesRepo = makeRepo();
+    const notifier = makeNotifier();
+    const service = new security_auth_service_1.SecurityAuthService(appUsersRepo, securityUsersRepo, refreshTokenRepo, passwordResetRepo, rolesRepo, userRolesRepo, {
+        jwtSecret: "secret",
+        accessTokenExpiresIn: "15m",
+        refreshTokenExpiresInDays: 30,
+        requireEmailVerification: true,
+        requireAdminApproval: true,
+        passwordResetTokenExpiresInMinutes: 30,
+    }, notifier);
+    return {
+        service,
+        appUsersRepo,
+        securityUsersRepo,
+        refreshTokenRepo,
+        passwordResetRepo,
+        rolesRepo,
+        userRolesRepo,
+        notifier,
+    };
+};
+(0, vitest_1.describe)("SecurityAuthService", () => {
+    (0, vitest_1.beforeEach)(() => {
+        vitest_1.vi.clearAllMocks();
+    });
+    (0, vitest_1.it)("registers user and sends verification", async () => {
+        const { service, appUsersRepo, securityUsersRepo, userRolesRepo, rolesRepo, notifier, } = setup();
+        appUsersRepo.findOne.mockResolvedValue(null);
+        appUsersRepo.save.mockResolvedValue(makeUser());
+        securityUsersRepo.save.mockResolvedValue(makeSecurityUser());
+        userRolesRepo.find.mockResolvedValue([]);
+        rolesRepo.find.mockResolvedValue([]);
+        const result = await service.register({
+            email: "USER@example.com",
+            password: "Secret123",
+        });
+        (0, vitest_1.expect)(result.success).toBe(true);
+        (0, vitest_1.expect)(appUsersRepo.create).toHaveBeenCalledWith(vitest_1.expect.objectContaining({ email: "user@example.com" }));
+        (0, vitest_1.expect)(notifier.sendEmailVerification).toHaveBeenCalled();
+    });
+    (0, vitest_1.it)("rejects duplicate email on register", async () => {
+        const { service, appUsersRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
+        await (0, vitest_1.expect)(service.register({ email: "user@example.com", password: "Secret123" })).rejects.toBeInstanceOf(common_1.BadRequestException);
+    });
+    (0, vitest_1.it)("handles login success and auth failures", async () => {
+        const { service, appUsersRepo, securityUsersRepo, userRolesRepo, rolesRepo, refreshTokenRepo, } = setup();
+        const user = makeUser();
+        appUsersRepo.findOne.mockResolvedValue(user);
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
+        userRolesRepo.find.mockResolvedValue([{ roleId: "r1" }]);
+        rolesRepo.find.mockResolvedValue([{ id: "r1", roleKey: "admin" }]);
+        const auth = await service.login({
+            email: user.email,
+            password: "Secret123",
+        });
+        (0, vitest_1.expect)(auth.accessToken).toBe("signed-access-token");
+        (0, vitest_1.expect)(jsonwebtoken_1.sign).toHaveBeenCalled();
+        (0, vitest_1.expect)(refreshTokenRepo.save).toHaveBeenCalled();
+        appUsersRepo.findOne.mockResolvedValue(null);
+        await (0, vitest_1.expect)(service.login({ email: "none@example.com", password: "Secret123" })).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    });
+    (0, vitest_1.it)("blocks login when account is inactive or missing approvals", async () => {
+        const { service, appUsersRepo, securityUsersRepo } = setup();
+        const inactive = { ...makeSecurityUser(), isActive: false };
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
+        securityUsersRepo.findOne.mockResolvedValue(inactive);
+        await (0, vitest_1.expect)(service.login({ email: "x@example.com", password: "Secret123" })).rejects.toThrow("Account is inactive");
+        securityUsersRepo.findOne.mockResolvedValue({
+            ...makeSecurityUser(),
+            emailVerifiedAt: null,
+        });
+        await (0, vitest_1.expect)(service.login({ email: "x@example.com", password: "Secret123" })).rejects.toThrow("Email verification required");
+        securityUsersRepo.findOne.mockResolvedValue({
+            ...makeSecurityUser(),
+            adminApprovedAt: null,
+        });
+        await (0, vitest_1.expect)(service.login({ email: "x@example.com", password: "Secret123" })).rejects.toThrow("Admin approval required");
+    });
+    (0, vitest_1.it)("refreshes and revokes tokens", async () => {
+        const { service, appUsersRepo, securityUsersRepo, refreshTokenRepo, userRolesRepo, rolesRepo, } = setup();
+        refreshTokenRepo.find.mockResolvedValue([
+            {
+                id: "rt1",
+                userId: "user-1",
+                tokenHash: "hashed:token-bytes",
+                expiresAt: new Date(Date.now() + 60_000),
+            },
+        ]);
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
+        userRolesRepo.find.mockResolvedValue([]);
+        rolesRepo.find.mockResolvedValue([]);
+        const result = await service.refresh("token-bytes");
+        (0, vitest_1.expect)(result.accessToken).toBe("signed-access-token");
+        (0, vitest_1.expect)(refreshTokenRepo.update).toHaveBeenCalledWith({ id: "rt1" }, vitest_1.expect.objectContaining({ revokedAt: vitest_1.expect.any(Date) }));
+        await (0, vitest_1.expect)(service.logout()).resolves.toEqual({ success: true });
+        await (0, vitest_1.expect)(service.logout("token-bytes")).resolves.toEqual({
+            success: true,
+        });
+    });
+    (0, vitest_1.it)("rejects invalid refresh token and missing refresh user", async () => {
+        const { service, refreshTokenRepo, appUsersRepo } = setup();
+        refreshTokenRepo.find.mockResolvedValue([]);
+        await (0, vitest_1.expect)(service.refresh("bad-token")).rejects.toThrow("Invalid refresh token");
+        refreshTokenRepo.find.mockResolvedValue([
+            {
+                id: "rt1",
+                userId: "missing",
+                tokenHash: "hashed:token-bytes",
+                expiresAt: new Date(Date.now() + 60_000),
+            },
+        ]);
+        appUsersRepo.findOne.mockResolvedValue(null);
+        await (0, vitest_1.expect)(service.refresh("token-bytes")).rejects.toThrow("User not found");
+    });
+    (0, vitest_1.it)("changes password", async () => {
+        const { service, securityUsersRepo } = setup();
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
+        await (0, vitest_1.expect)(service.changePassword({
+            userId: "user-1",
+            currentPassword: "Secret123",
+            newPassword: "NewPass1",
+        })).resolves.toEqual({ success: true });
+        securityUsersRepo.findOne.mockResolvedValue(null);
+        await (0, vitest_1.expect)(service.changePassword({
+            userId: "missing",
+            currentPassword: "Secret123",
+            newPassword: "NewPass1",
+        })).rejects.toThrow("User not found");
+    });
+    (0, vitest_1.it)("handles forgot/reset password flow", async () => {
+        const { service, appUsersRepo, securityUsersRepo, passwordResetRepo, notifier, } = setup();
+        appUsersRepo.findOne.mockResolvedValue(makeUser());
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
+        passwordResetRepo.findOne.mockResolvedValue({
+            id: "pr1",
+            userId: "user-1",
+            token: "token-bytes",
+            usedAt: null,
+            expiresAt: new Date(Date.now() + 60_000),
+        });
+        await (0, vitest_1.expect)(service.requestForgotPassword("user@example.com")).resolves.toEqual({
+            success: true,
+        });
+        (0, vitest_1.expect)(passwordResetRepo.save).toHaveBeenCalled();
+        (0, vitest_1.expect)(notifier.sendPasswordReset).toHaveBeenCalled();
+        await (0, vitest_1.expect)(service.resetPassword("token-bytes", "NewPass1")).resolves.toEqual({
+            success: true,
+        });
+    });
+    (0, vitest_1.it)("returns success for unknown forgot email and rejects bad reset token", async () => {
+        const { service, appUsersRepo, passwordResetRepo } = setup();
+        appUsersRepo.findOne.mockResolvedValue(null);
+        await (0, vitest_1.expect)(service.requestForgotPassword("none@example.com")).resolves.toEqual({
+            success: true,
+        });
+        passwordResetRepo.findOne.mockResolvedValue(null);
+        await (0, vitest_1.expect)(service.resetPassword("bad", "x")).rejects.toThrow("Invalid password reset token");
+        passwordResetRepo.findOne.mockResolvedValue({
+            id: "pr1",
+            userId: "user-1",
+            token: "bad",
+            usedAt: new Date(),
+            expiresAt: new Date(Date.now() + 60_000),
+        });
+        await (0, vitest_1.expect)(service.resetPassword("bad", "x")).rejects.toThrow("Invalid password reset token");
+    });
+    (0, vitest_1.it)("verifies email token and reads user roles", async () => {
+        const { service, securityUsersRepo, userRolesRepo, rolesRepo } = setup();
+        securityUsersRepo.findOne.mockResolvedValue(makeSecurityUser());
+        userRolesRepo.find.mockResolvedValue([{ roleId: "r1" }]);
+        rolesRepo.find.mockResolvedValue([{ id: "r1", roleKey: "coach" }]);
+        await (0, vitest_1.expect)(service.verifyEmailByToken("token-bytes")).resolves.toEqual({
+            success: true,
+        });
+        await (0, vitest_1.expect)(service.getMyRoles("user-1")).resolves.toEqual({
+            userId: "user-1",
+            roles: ["COACH"],
+        });
+    });
+    (0, vitest_1.it)("rejects invalid email verification token", async () => {
+        const { service, securityUsersRepo } = setup();
+        securityUsersRepo.findOne.mockResolvedValue(null);
+        await (0, vitest_1.expect)(service.verifyEmailByToken("missing")).rejects.toThrow("Invalid verification token");
+    });
+    (0, vitest_1.it)("handles refresh with expired matching token", async () => {
+        const { service, refreshTokenRepo } = setup();
+        refreshTokenRepo.find.mockResolvedValue([
+            {
+                id: "rt1",
+                userId: "user-1",
+                tokenHash: "hashed:token-bytes",
+                expiresAt: new Date(Date.now() - 1),
+            },
+        ]);
+        await (0, vitest_1.expect)(service.refresh("token-bytes")).rejects.toThrow("Invalid refresh token");
+        (0, vitest_1.expect)(bcryptjs_1.compare).toHaveBeenCalled();
+    });
+});

package/dist/nest/security-jwt.guard.d.ts

@@ -0,0 +1,7 @@
+import { CanActivate, ExecutionContext } from "@nestjs/common";
+import { SecurityAuthModuleOptions } from "./security-auth.options";
+export declare class SecurityJwtGuard implements CanActivate {
+    private readonly options;
+    constructor(options: SecurityAuthModuleOptions);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/nest/security-jwt.guard.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityJwtGuard = void 0;
+const common_1 = require("@nestjs/common");
+const jsonwebtoken_1 = require("jsonwebtoken");
+const security_auth_constants_1 = require("./security-auth.constants");
+let SecurityJwtGuard = class SecurityJwtGuard {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const header = request.headers?.authorization ?? request.headers?.Authorization;
+        if (!header || !header.startsWith("Bearer ")) {
+            throw new common_1.UnauthorizedException("Missing bearer token");
+        }
+        const token = header.slice("Bearer ".length);
+        try {
+            const payload = (0, jsonwebtoken_1.verify)(token, this.options.jwtSecret);
+            request.user = payload;
+            return true;
+        }
+        catch {
+            throw new common_1.UnauthorizedException("Invalid token");
+        }
+    }
+};
+exports.SecurityJwtGuard = SecurityJwtGuard;
+exports.SecurityJwtGuard = SecurityJwtGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(security_auth_constants_1.SECURITY_AUTH_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], SecurityJwtGuard);

package/dist/nest/security-jwt.guard.test.d.ts

@@ -0,0 +1 @@
+export {};