@starci/hfs 5.1.0 → 5.3.0

package/templates/be/auth-lite/src/features/api/auth/application/get-jwks.query.ts

@@ -0,0 +1,12 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Query } from "@nestjs/cqrs"
+import type { JwksDocument } from "@modules/integrations/passport"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { EmptyRequest } from "./auth.contracts"
+
+/** Reads the public key document access tokens verify against. */
+export class GetJwksQuery extends Query<JwksDocument> {
+    constructor(readonly params: PublicExecuteParams<EmptyRequest>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/google-begin.command.ts

@@ -0,0 +1,11 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { ExchangeRequest } from "./auth.contracts"
+
+/** Starts the Google round trip: the strategy writes the redirect and the signed state cookie. */
+export class GoogleBeginCommand extends Command<void> {
+    constructor(readonly params: PublicExecuteParams<ExchangeRequest>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/google-begin.handler.ts

@@ -0,0 +1,22 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentitySignInService } from "@modules/domain/identity"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { GoogleBeginCommand } from "./google-begin.command"
+
+@CommandHandler(GoogleBeginCommand)
+/** Starts the Google round trip: the strategy writes the redirect and the signed state cookie. */
+export class GoogleBeginHandler extends ICQRSHandler<GoogleBeginCommand, void> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly signIn: IdentitySignInService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: GoogleBeginCommand): Promise<void> {
+        return this.signIn.beginGoogle(command.params.request.exchange)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/google-complete.command.ts

@@ -0,0 +1,12 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { GoogleRedirect } from "@modules/integrations/passport"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { ExchangeRequest } from "./auth.contracts"
+
+/** Finishes the Google round trip. */
+export class GoogleCompleteCommand extends Command<GoogleRedirect> {
+    constructor(readonly params: PublicExecuteParams<ExchangeRequest>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/google-complete.handler.ts

@@ -0,0 +1,23 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentitySignInService } from "@modules/domain/identity"
+import type { GoogleRedirect } from "@modules/integrations/passport"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { GoogleCompleteCommand } from "./google-complete.command"
+
+@CommandHandler(GoogleCompleteCommand)
+/** Finishes the Google round trip. */
+export class GoogleCompleteHandler extends ICQRSHandler<GoogleCompleteCommand, GoogleRedirect> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly signIn: IdentitySignInService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: GoogleCompleteCommand): Promise<GoogleRedirect> {
+        return this.signIn.completeGoogle(command.params.request.exchange)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/login.command.ts

@@ -0,0 +1,12 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { AccessGrant } from "@modules/integrations/passport"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { ExchangeRequest } from "./auth.contracts"
+
+/** Signs in with email and password through the local strategy and opens a session. */
+export class LoginCommand extends Command<AccessGrant> {
+    constructor(readonly params: PublicExecuteParams<ExchangeRequest>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/login.handler.ts

@@ -0,0 +1,23 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentitySignInService } from "@modules/domain/identity"
+import type { AccessGrant } from "@modules/integrations/passport"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { LoginCommand } from "./login.command"
+
+@CommandHandler(LoginCommand)
+/** Signs in with email and password through the local strategy and opens a session. */
+export class LoginHandler extends ICQRSHandler<LoginCommand, AccessGrant> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly signIn: IdentitySignInService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: LoginCommand): Promise<AccessGrant> {
+        return this.signIn.login(command.params.request.exchange)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/logout.command.ts

@@ -0,0 +1,11 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { ExchangeRequest } from "./auth.contracts"
+
+/** Ends the session of the refresh cookie and clears it. */
+export class LogoutCommand extends Command<void> {
+    constructor(readonly params: PublicExecuteParams<ExchangeRequest>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/logout.handler.ts

@@ -0,0 +1,22 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentitySignInService } from "@modules/domain/identity"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { LogoutCommand } from "./logout.command"
+
+@CommandHandler(LogoutCommand)
+/** Ends the session of the refresh cookie and clears it. */
+export class LogoutHandler extends ICQRSHandler<LogoutCommand, void> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly signIn: IdentitySignInService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: LogoutCommand): Promise<void> {
+        return this.signIn.logout(command.params.request.exchange)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/refresh.command.ts

@@ -0,0 +1,12 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { AccessGrant } from "@modules/integrations/passport"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { ExchangeRequest } from "./auth.contracts"
+
+/** Rotates the refresh cookie and answers a new access token; a bad cookie is cleared. */
+export class RefreshCommand extends Command<AccessGrant> {
+    constructor(readonly params: PublicExecuteParams<ExchangeRequest>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/refresh.handler.ts

@@ -0,0 +1,23 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentitySignInService } from "@modules/domain/identity"
+import type { AccessGrant } from "@modules/integrations/passport"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { RefreshCommand } from "./refresh.command"
+
+@CommandHandler(RefreshCommand)
+/** Rotates the refresh cookie and answers a new access token; a bad cookie is cleared. */
+export class RefreshHandler extends ICQRSHandler<RefreshCommand, AccessGrant> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly signIn: IdentitySignInService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: RefreshCommand): Promise<AccessGrant> {
+        return this.signIn.refresh(command.params.request.exchange)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/resend.command.ts

@@ -0,0 +1,11 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { AddressData } from "./auth.contracts"
+
+/** Mails a new confirmation link to an unconfirmed account; the answer never says whether the address has one. */
+export class ResendCommand extends Command<void> {
+    constructor(readonly params: PublicExecuteParams<AddressData>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/resend.handler.ts

@@ -0,0 +1,22 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentityEmailService } from "@modules/domain/identity"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { ResendCommand } from "./resend.command"
+
+@CommandHandler(ResendCommand)
+/** Mails a new confirmation link to an unconfirmed account; the answer never says whether the address has one. */
+export class ResendHandler extends ICQRSHandler<ResendCommand, void> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly email: IdentityEmailService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: ResendCommand): Promise<void> {
+        return this.email.resend(command.params.request.email, command.params.request.language)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/reset.command.ts

@@ -0,0 +1,11 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { ResetData } from "./auth.contracts"
+
+/** Spends a reset link: sets the new password and ends every session of the person. */
+export class ResetCommand extends Command<void> {
+    constructor(readonly params: PublicExecuteParams<ResetData>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/reset.handler.ts

@@ -0,0 +1,22 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentityEmailService } from "@modules/domain/identity"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { ResetCommand } from "./reset.command"
+
+@CommandHandler(ResetCommand)
+/** Spends a reset link: sets the new password and ends every session of the person. */
+export class ResetHandler extends ICQRSHandler<ResetCommand, void> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly email: IdentityEmailService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: ResetCommand): Promise<void> {
+        return this.email.reset(command.params.request.token, command.params.request.password)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/session.command.ts

@@ -0,0 +1,12 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { AccessGrant } from "@modules/integrations/passport"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { ExchangeRequest } from "./auth.contracts"
+
+/** Answers a fresh access token for the cookie session without rotating the cookie. */
+export class SessionCommand extends Command<AccessGrant> {
+    constructor(readonly params: PublicExecuteParams<ExchangeRequest>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/session.handler.ts

@@ -0,0 +1,23 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentitySignInService } from "@modules/domain/identity"
+import type { AccessGrant } from "@modules/integrations/passport"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { SessionCommand } from "./session.command"
+
+@CommandHandler(SessionCommand)
+/** Answers a fresh access token for the cookie session without rotating the cookie. */
+export class SessionHandler extends ICQRSHandler<SessionCommand, AccessGrant> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly signIn: IdentitySignInService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: SessionCommand): Promise<AccessGrant> {
+        return this.signIn.session(command.params.request.exchange)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/signup.command.ts

@@ -0,0 +1,11 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Command } from "@nestjs/cqrs"
+import type { PublicExecuteParams } from "@modules/platform/cqrs"
+import type { SignupData } from "./auth.contracts"
+
+/** Creates an unconfirmed password account and mails the confirmation link; the answer never says whether the address already had an account. */
+export class SignupCommand extends Command<void> {
+    constructor(readonly params: PublicExecuteParams<SignupData>) {
+        super()
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/application/signup.handler.ts

@@ -0,0 +1,22 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { CommandHandler } from "@nestjs/cqrs"
+import { IdentityEmailService } from "@modules/domain/identity"
+import { ICQRSHandler } from "@modules/platform/cqrs"
+import { InjectLogger } from "@modules/platform/logging"
+import type { Logger } from "@modules/platform/logging"
+import { SignupCommand } from "./signup.command"
+
+@CommandHandler(SignupCommand)
+/** Creates an unconfirmed password account and mails the confirmation link; the answer never says whether the address already had an account. */
+export class SignupHandler extends ICQRSHandler<SignupCommand, void> {
+    constructor(
+        @InjectLogger() logger: Logger,
+        private readonly email: IdentityEmailService,
+    ) {
+        super(logger)
+    }
+
+    protected override process(command: SignupCommand): Promise<void> {
+        return this.email.signup(command.params.request.email, command.params.request.password, command.params.request.language)
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/auth.module-definition.ts

@@ -0,0 +1,6 @@
+import { defineConfigurableModule } from "@starci/nest-kit"
+import type { AuthApiOptions } from "./auth.options"
+
+/** The configurable-module base of the auth feature module. */
+export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } =
+    defineConfigurableModule<AuthApiOptions>()

package/templates/be/auth-lite/src/features/api/auth/auth.module.ts

@@ -0,0 +1,21 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Module } from "@nestjs/common"
+import { LoginHandler } from "./application/login.handler"
+import { RefreshHandler } from "./application/refresh.handler"
+import { SessionHandler } from "./application/session.handler"
+import { LogoutHandler } from "./application/logout.handler"
+import { GoogleBeginHandler } from "./application/google-begin.handler"
+import { GoogleCompleteHandler } from "./application/google-complete.handler"
+import { GetJwksHandler } from "./application/get-jwks.handler"
+import { SignupHandler } from "./application/signup.handler"
+import { ResendHandler } from "./application/resend.handler"
+import { ConfirmHandler } from "./application/confirm.handler"
+import { ForgotHandler } from "./application/forgot.handler"
+import { ResetHandler } from "./application/reset.handler"
+import { ConfigurableModuleClass } from "./auth.module-definition"
+
+@Module({
+    providers: [LoginHandler, RefreshHandler, SessionHandler, LogoutHandler, GoogleBeginHandler, GoogleCompleteHandler, GetJwksHandler, SignupHandler, ResendHandler, ConfirmHandler, ForgotHandler, ResetHandler],
+})
+/** The auth feature: the handlers behind the sign-in doors. */
+export class AuthApiModule extends ConfigurableModuleClass {}

package/templates/be/auth-lite/src/features/api/auth/auth.options.ts

@@ -0,0 +1,3 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+/** The auth feature module takes no options yet. */
+export type AuthApiOptions = Record<string, never>

package/templates/be/auth-lite/src/features/api/auth/index.ts

@@ -0,0 +1,2 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+export { AuthHttpModule } from "./transport/http/auth-http.module"

package/templates/be/auth-lite/src/features/api/auth/transport/http/auth-http.module-definition.ts

@@ -0,0 +1,6 @@
+import { defineConfigurableModule } from "@starci/nest-kit"
+import type { AuthHttpOptions } from "./auth-http.options"
+
+/** The configurable-module base of the auth-http module. */
+export const { ConfigurableModuleClass, MODULE_OPTIONS_TOKEN, OPTIONS_TYPE } =
+    defineConfigurableModule<AuthHttpOptions>()

package/templates/be/auth-lite/src/features/api/auth/transport/http/auth-http.module.ts

@@ -0,0 +1,9 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Module } from "@nestjs/common"
+import { AuthApiModule } from "../../auth.module"
+import { AuthController } from "./auth.controller"
+import { ConfigurableModuleClass } from "./auth-http.module-definition"
+
+@Module({ imports: [AuthApiModule.register({})], controllers: [AuthController] })
+/** The HTTP transport of the auth feature: the REST doors under /auth. */
+export class AuthHttpModule extends ConfigurableModuleClass {}

package/templates/be/auth-lite/src/features/api/auth/transport/http/auth-http.options.ts

@@ -0,0 +1,3 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+/** The auth-http module takes no options yet. */
+export type AuthHttpOptions = Record<string, never>

package/templates/be/auth-lite/src/features/api/auth/transport/http/auth.controller.ts

@@ -0,0 +1,145 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { Body, Controller, Get, HttpCode, Post, Query, Redirect, Req, Res } from "@nestjs/common"
+import type { CommandBus, QueryBus } from "@nestjs/cqrs"
+import type { Request, Response } from "express"
+import { Public, PublicReason } from "@modules/domain/identity"
+import type { AccessGrant, GoogleRedirect, JwksDocument } from "@modules/integrations/passport"
+import { InjectCommandBus, InjectQueryBus } from "@modules/platform/cqrs"
+import { RateLimit, RateTier } from "@modules/platform/http-security"
+import { SignupCommand } from "../../application/signup.command"
+import { ResendCommand } from "../../application/resend.command"
+import { ConfirmCommand } from "../../application/confirm.command"
+import { ForgotCommand } from "../../application/forgot.command"
+import { ResetCommand } from "../../application/reset.command"
+import { GetJwksQuery } from "../../application/get-jwks.query"
+import { GoogleBeginCommand } from "../../application/google-begin.command"
+import { GoogleCompleteCommand } from "../../application/google-complete.command"
+import { LoginCommand } from "../../application/login.command"
+import { LogoutCommand } from "../../application/logout.command"
+import { RefreshCommand } from "../../application/refresh.command"
+import { SessionCommand } from "../../application/session.command"
+import { ForgotRequest } from "./dto/forgot.request"
+import { GoogleStartRequest } from "./dto/google-start.request"
+import { LoginRequest } from "./dto/login.request"
+import { ResendRequest } from "./dto/resend.request"
+import { ResetRequest } from "./dto/reset.request"
+import { SignupRequest } from "./dto/signup.request"
+import { TokenRequest } from "./dto/token.request"
+
+@Controller("auth")
+/** The cookie doors of sign-in: email and password, the email doors (sign up, confirm, resend, forgot, reset), Google, refresh, session, sign-out and the public keys. */
+export class AuthController {
+    constructor(
+        @InjectCommandBus() private readonly commandBus: CommandBus,
+        @InjectQueryBus() private readonly queryBus: QueryBus,
+    ) {}
+
+    /** Signs in with email and password; the refresh token is set as an httpOnly cookie. */
+    @Post("login")
+    @HttpCode(200)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    login(
+        @Body() _body: LoginRequest,
+        @Req() req: Request,
+        @Res({ passthrough: true }) res: Response,
+    ): Promise<AccessGrant> {
+        return this.commandBus.execute(new LoginCommand({ request: { exchange: { req, res } } }))
+    }
+
+    /** Rotates the refresh cookie and answers a new access token; a bad cookie is cleared. */
+    @Post("refresh")
+    @HttpCode(200)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    refresh(@Req() req: Request, @Res({ passthrough: true }) res: Response): Promise<AccessGrant> {
+        return this.commandBus.execute(new RefreshCommand({ request: { exchange: { req, res } } }))
+    }
+
+    /** Answers a fresh access token for the cookie session WITHOUT rotating the cookie, so parallel requests of one browser never race. */
+    @Get("session")
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    session(@Req() req: Request, @Res({ passthrough: true }) res: Response): Promise<AccessGrant> {
+        return this.commandBus.execute(new SessionCommand({ request: { exchange: { req, res } } }))
+    }
+
+    /** Ends the session of the refresh cookie and clears it. */
+    @Post("logout")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    logout(@Req() req: Request, @Res({ passthrough: true }) res: Response): Promise<void> {
+        return this.commandBus.execute(new LogoutCommand({ request: { exchange: { req, res } } }))
+    }
+
+    /** Sends the browser to Google (authorization code with state and PKCE); `returnTo` is an absolute address on the web origin or a path. */
+    @Get("google")
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    google(@Query() _query: GoogleStartRequest, @Req() req: Request, @Res() res: Response): Promise<void> {
+        return this.commandBus.execute(new GoogleBeginCommand({ request: { exchange: { req, res } } }))
+    }
+
+    /** Google sends the browser back here; the session cookie is set and the browser lands on the web app (or its sign-in page on failure). */
+    @Get("google/callback")
+    @Redirect()
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    googleCallback(@Req() req: Request, @Res({ passthrough: true }) res: Response): Promise<GoogleRedirect> {
+        return this.commandBus.execute(new GoogleCompleteCommand({ request: { exchange: { req, res } } }))
+    }
+
+    /** Creates an unconfirmed account and mails the confirmation link; always answers 204. */
+    @Post("signup")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    signup(@Body() body: SignupRequest): Promise<void> {
+        return this.commandBus.execute(new SignupCommand({ request: { email: body.email, password: body.password, language: body.language } }))
+    }
+
+    /** Mails a new confirmation link; always answers 204. */
+    @Post("resend")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    resend(@Body() body: ResendRequest): Promise<void> {
+        return this.commandBus.execute(new ResendCommand({ request: { email: body.email, language: body.language } }))
+    }
+
+    /** Spends a confirmation link; a spent, expired or unknown link is refused with IDENTITY_RESET_TOKEN_INVALID. */
+    @Post("confirm")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    confirm(@Body() body: TokenRequest): Promise<void> {
+        return this.commandBus.execute(new ConfirmCommand({ request: { token: body.token } }))
+    }
+
+    /** Mails a password reset link when the address has an account; always answers 204. */
+    @Post("forgot")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    forgot(@Body() body: ForgotRequest): Promise<void> {
+        return this.commandBus.execute(new ForgotCommand({ request: { email: body.email, language: body.language } }))
+    }
+
+    /** Spends a reset link and sets the new password; every session of the person ends. */
+    @Post("reset")
+    @HttpCode(204)
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    reset(@Body() body: ResetRequest): Promise<void> {
+        return this.commandBus.execute(new ResetCommand({ request: { token: body.token, password: body.password } }))
+    }
+
+    /** The public keys access tokens verify against. */
+    @Get("jwks")
+    @Public({ reason: PublicReason.AuthHandshake })
+    @RateLimit(RateTier.Strict)
+    jwks(): Promise<JwksDocument> {
+        return this.queryBus.execute(new GetJwksQuery({ request: {} }))
+    }
+}

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/forgot.request.ts

@@ -0,0 +1,16 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsEmail, IsIn, IsOptional, MaxLength } from "class-validator"
+import type { MailLanguage } from "@modules/integrations/mail"
+
+/** The posted address of a password reset request. */
+export class ForgotRequest {
+    /** The sign-in address. */
+    @IsEmail()
+    @MaxLength(254)
+    email!: string
+
+    /** The language of the mail; the app's default when left out. */
+    @IsOptional()
+    @IsIn(["vi", "en"])
+    language?: MailLanguage
+}

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/google-start.request.ts

@@ -0,0 +1,17 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsOptional, IsString, MaxLength } from "class-validator"
+
+/** The query that starts a Google sign-in. */
+export class GoogleStartRequest {
+    /** An absolute address on the web origin, or a path, to land on afterwards. */
+    @IsOptional()
+    @IsString()
+    @MaxLength(1024)
+    returnTo?: string
+
+    /** A path to land on afterwards (the older spelling of returnTo). */
+    @IsOptional()
+    @IsString()
+    @MaxLength(512)
+    next?: string
+}

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/login.request.ts

@@ -0,0 +1,16 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsEmail, IsString, MaxLength, MinLength } from "class-validator"
+
+/** The posted sign-in pair. */
+export class LoginRequest {
+    /** The sign-in address. */
+    @IsEmail()
+    @MaxLength(254)
+    email!: string
+
+    /** The password. */
+    @IsString()
+    @MinLength(1)
+    @MaxLength(128)
+    password!: string
+}

package/templates/be/auth-lite/src/features/api/auth/transport/http/dto/resend.request.ts

@@ -0,0 +1,16 @@
+// Managed by starci app sync (slot be.feature.auth); do not edit: run "npx starci app sync --execute".
+import { IsEmail, IsIn, IsOptional, MaxLength } from "class-validator"
+import type { MailLanguage } from "@modules/integrations/mail"
+
+/** The posted address of a resend. */
+export class ResendRequest {
+    /** The sign-in address. */
+    @IsEmail()
+    @MaxLength(254)
+    email!: string
+
+    /** The language of the mail; the app's default when left out. */
+    @IsOptional()
+    @IsIn(["vi", "en"])
+    language?: MailLanguage
+}