@sync-in/server 1.5.2 → 1.6.1

package/server/authentication/guards/auth-token-access.strategy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-access.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Injectable } from '@nestjs/common'\nimport { AbstractStrategy, PassportStrategy } from '@nestjs/passport'\nimport { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { ExtractJwt, Strategy } from 'passport-jwt'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\n\n@Injectable()\nexport class AuthTokenAccessStrategy extends PassportStrategy(Strategy, 'tokenAccess') implements AbstractStrategy {\n  private static accessCookieName: string\n\n  constructor(\n    private readonly authManager: AuthManager,\n    private readonly logger: PinoLogger\n  ) {\n    super({\n      jwtFromRequest: ExtractJwt.fromExtractors([AuthTokenAccessStrategy.extractJWTFromCookie, ExtractJwt.fromAuthHeaderAsBearerToken()]),\n      secretOrKey: authManager.authConfig.token.access.secret,\n      ignoreExpiration: false,\n      passReqToCallback: true\n    })\n    AuthTokenAccessStrategy.accessCookieName = authManager.authConfig.token.access.name\n  }\n\n  validate(req: FastifyRequest, jwtPayload: JwtPayload): UserModel {\n    this.logger.assign({ user: jwtPayload.identity.login })\n    this.authManager.csrfValidation(req, jwtPayload, TOKEN_TYPE.ACCESS)\n    return new UserModel(jwtPayload.identity)\n  }\n\n  static extractJWTFromCookie(req: FastifyRequest): string | null {\n    if (typeof req.cookies === 'object' && req.cookies[AuthTokenAccessStrategy.accessCookieName] !== undefined) {\n      return req.cookies[AuthTokenAccessStrategy.accessCookieName]\n    }\n    return null\n  }\n}\n"],"names":["AuthTokenAccessStrategy","PassportStrategy","Strategy","validate","req","jwtPayload","logger","assign","user","identity","login","authManager","csrfValidation","TOKEN_TYPE","ACCESS","UserModel","extractJWTFromCookie","cookies","accessCookieName","undefined","jwtFromRequest","ExtractJwt","fromExtractors","fromAuthHeaderAsBearerToken","secretOrKey","authConfig","token","access","secret","ignoreExpiration","passReqToCallback","name"],"mappings":"AAAA;;;;CAIC;;;;+BAaYA;;;eAAAA;;;wBAXc;0BACwB;4BAExB;6BACU;2BACX;gCAEC;oCACC;;;;;;;;;;AAGrB,IAAA,AAAMA,0BAAN,MAAMA,gCAAgCC,IAAAA,0BAAgB,EAACC,qBAAQ,EAAE;IAgBtEC,SAASC,GAAmB,EAAEC,UAAsB,EAAa;QAC/D,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMH,WAAWI,QAAQ,CAACC,KAAK;QAAC;QACrD,IAAI,CAACC,WAAW,CAACC,cAAc,CAACR,KAAKC,YAAYQ,0BAAU,CAACC,MAAM;QAClE,OAAO,IAAIC,oBAAS,CAACV,WAAWI,QAAQ;IAC1C;IAEA,OAAOO,qBAAqBZ,GAAmB,EAAiB;QAC9D,IAAI,OAAOA,IAAIa,OAAO,KAAK,YAAYb,IAAIa,OAAO,CAACjB,wBAAwBkB,gBAAgB,CAAC,KAAKC,WAAW;YAC1G,OAAOf,IAAIa,OAAO,CAACjB,wBAAwBkB,gBAAgB,CAAC;QAC9D;QACA,OAAO;IACT;IAxBA,YACE,AAAiBP,WAAwB,EACzC,AAAiBL,MAAkB,CACnC;QACA,KAAK,CAAC;YACJc,gBAAgBC,uBAAU,CAACC,cAAc,CAAC;gBAACtB,wBAAwBgB,oBAAoB;gBAAEK,uBAAU,CAACE,2BAA2B;aAAG;YAClIC,aAAab,YAAYc,UAAU,CAACC,KAAK,CAACC,MAAM,CAACC,MAAM;YACvDC,kBAAkB;YAClBC,mBAAmB;QACrB,SARiBnB,cAAAA,kBACAL,SAAAA;QAQjBN,wBAAwBkB,gBAAgB,GAAGP,YAAYc,UAAU,CAACC,KAAK,CAACC,MAAM,CAACI,IAAI;IACrF;AAcF"}
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-access.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Injectable } from '@nestjs/common'\nimport { AbstractStrategy, PassportStrategy } from '@nestjs/passport'\nimport { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { ExtractJwt, Strategy } from 'passport-jwt'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { configuration } from '../../configuration/config.environment'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\n\n@Injectable()\nexport class AuthTokenAccessStrategy extends PassportStrategy(Strategy, 'tokenAccess') implements AbstractStrategy {\n  private static accessCookieName: string\n\n  constructor(\n    private readonly authManager: AuthManager,\n    private readonly logger: PinoLogger\n  ) {\n    super({\n      jwtFromRequest: ExtractJwt.fromExtractors([AuthTokenAccessStrategy.extractJWTFromCookie, ExtractJwt.fromAuthHeaderAsBearerToken()]),\n      secretOrKey: configuration.auth.token.access.secret,\n      ignoreExpiration: false,\n      passReqToCallback: true\n    })\n    AuthTokenAccessStrategy.accessCookieName = configuration.auth.token.access.name\n  }\n\n  validate(req: FastifyRequest, jwtPayload: JwtPayload): UserModel {\n    this.logger.assign({ user: jwtPayload.identity.login })\n    this.authManager.csrfValidation(req, jwtPayload, TOKEN_TYPE.ACCESS)\n    return new UserModel(jwtPayload.identity)\n  }\n\n  static extractJWTFromCookie(req: FastifyRequest): string | null {\n    if (typeof req.cookies === 'object' && req.cookies[AuthTokenAccessStrategy.accessCookieName] !== undefined) {\n      return req.cookies[AuthTokenAccessStrategy.accessCookieName]\n    }\n    return null\n  }\n}\n"],"names":["AuthTokenAccessStrategy","PassportStrategy","Strategy","validate","req","jwtPayload","logger","assign","user","identity","login","authManager","csrfValidation","TOKEN_TYPE","ACCESS","UserModel","extractJWTFromCookie","cookies","accessCookieName","undefined","jwtFromRequest","ExtractJwt","fromExtractors","fromAuthHeaderAsBearerToken","secretOrKey","configuration","auth","token","access","secret","ignoreExpiration","passReqToCallback","name"],"mappings":"AAAA;;;;CAIC;;;;+BAcYA;;;eAAAA;;;wBAZc;0BACwB;4BAExB;6BACU;2BACX;mCACI;gCAEH;oCACC;;;;;;;;;;AAGrB,IAAA,AAAMA,0BAAN,MAAMA,gCAAgCC,IAAAA,0BAAgB,EAACC,qBAAQ,EAAE;IAgBtEC,SAASC,GAAmB,EAAEC,UAAsB,EAAa;QAC/D,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMH,WAAWI,QAAQ,CAACC,KAAK;QAAC;QACrD,IAAI,CAACC,WAAW,CAACC,cAAc,CAACR,KAAKC,YAAYQ,0BAAU,CAACC,MAAM;QAClE,OAAO,IAAIC,oBAAS,CAACV,WAAWI,QAAQ;IAC1C;IAEA,OAAOO,qBAAqBZ,GAAmB,EAAiB;QAC9D,IAAI,OAAOA,IAAIa,OAAO,KAAK,YAAYb,IAAIa,OAAO,CAACjB,wBAAwBkB,gBAAgB,CAAC,KAAKC,WAAW;YAC1G,OAAOf,IAAIa,OAAO,CAACjB,wBAAwBkB,gBAAgB,CAAC;QAC9D;QACA,OAAO;IACT;IAxBA,YACE,AAAiBP,WAAwB,EACzC,AAAiBL,MAAkB,CACnC;QACA,KAAK,CAAC;YACJc,gBAAgBC,uBAAU,CAACC,cAAc,CAAC;gBAACtB,wBAAwBgB,oBAAoB;gBAAEK,uBAAU,CAACE,2BAA2B;aAAG;YAClIC,aAAaC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,MAAM,CAACC,MAAM;YACnDC,kBAAkB;YAClBC,mBAAmB;QACrB,SARiBpB,cAAAA,kBACAL,SAAAA;QAQjBN,wBAAwBkB,gBAAgB,GAAGO,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,MAAM,CAACI,IAAI;IACjF;AAcF"}

package/server/authentication/guards/auth-token-refresh.strategy.js

@@ -17,6 +17,7 @@ const _passport = require("@nestjs/passport");
 const _nestjspino = require("nestjs-pino");
 const _passportjwt = require("passport-jwt");
 const _usermodel = require("../../applications/users/models/user.model");
+const _configenvironment = require("../../configuration/config.environment");
 const _tokeninterface = require("../interfaces/token.interface");
 const _authmanagerservice = require("../services/auth-manager.service");
 function _ts_decorate(decorators, target, key, desc) {
@@ -52,11 +53,11 @@ let AuthTokenRefreshStrategy = class AuthTokenRefreshStrategy extends (0, _passp
                 AuthTokenRefreshStrategy.extractJWTFromCookie,
                 _passportjwt.ExtractJwt.fromAuthHeaderAsBearerToken()
             ]),
-            secretOrKey: authManager.authConfig.token.refresh.secret,
+            secretOrKey: _configenvironment.configuration.auth.token.refresh.secret,
             ignoreExpiration: false,
             passReqToCallback: true
         }), this.authManager = authManager, this.logger = logger;
-        AuthTokenRefreshStrategy.refreshCookieName = authManager.authConfig.token.refresh.name;
+        AuthTokenRefreshStrategy.refreshCookieName = _configenvironment.configuration.auth.token.refresh.name;
     }
 };
 AuthTokenRefreshStrategy = _ts_decorate([

package/server/authentication/guards/auth-token-refresh.strategy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-refresh.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Injectable } from '@nestjs/common'\nimport { AbstractStrategy, PassportStrategy } from '@nestjs/passport'\nimport { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { ExtractJwt, Strategy } from 'passport-jwt'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\n\n@Injectable()\nexport class AuthTokenRefreshStrategy extends PassportStrategy(Strategy, 'tokenRefresh') implements AbstractStrategy {\n  private static refreshCookieName: string\n\n  constructor(\n    private readonly authManager: AuthManager,\n    private readonly logger: PinoLogger\n  ) {\n    super({\n      jwtFromRequest: ExtractJwt.fromExtractors([AuthTokenRefreshStrategy.extractJWTFromCookie, ExtractJwt.fromAuthHeaderAsBearerToken()]),\n      secretOrKey: authManager.authConfig.token.refresh.secret,\n      ignoreExpiration: false,\n      passReqToCallback: true\n    })\n    AuthTokenRefreshStrategy.refreshCookieName = authManager.authConfig.token.refresh.name\n  }\n\n  validate(req: FastifyRequest, jwtPayload: JwtPayload): UserModel {\n    this.logger.assign({ user: jwtPayload.identity.login })\n    this.authManager.csrfValidation(req, jwtPayload, TOKEN_TYPE.REFRESH)\n    // jwt expiration is used later to refresh cookies\n    return new UserModel({ ...jwtPayload.identity, exp: jwtPayload.exp })\n  }\n\n  private static extractJWTFromCookie(req: FastifyRequest): string | null {\n    if (typeof req.cookies === 'object' && req.cookies[AuthTokenRefreshStrategy.refreshCookieName] !== undefined) {\n      return req.cookies[AuthTokenRefreshStrategy.refreshCookieName]\n    }\n    return null\n  }\n}\n"],"names":["AuthTokenRefreshStrategy","PassportStrategy","Strategy","validate","req","jwtPayload","logger","assign","user","identity","login","authManager","csrfValidation","TOKEN_TYPE","REFRESH","UserModel","exp","extractJWTFromCookie","cookies","refreshCookieName","undefined","jwtFromRequest","ExtractJwt","fromExtractors","fromAuthHeaderAsBearerToken","secretOrKey","authConfig","token","refresh","secret","ignoreExpiration","passReqToCallback","name"],"mappings":"AAAA;;;;CAIC;;;;+BAaYA;;;eAAAA;;;wBAXc;0BACwB;4BAExB;6BACU;2BACX;gCAEC;oCACC;;;;;;;;;;AAGrB,IAAA,AAAMA,2BAAN,MAAMA,iCAAiCC,IAAAA,0BAAgB,EAACC,qBAAQ,EAAE;IAgBvEC,SAASC,GAAmB,EAAEC,UAAsB,EAAa;QAC/D,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMH,WAAWI,QAAQ,CAACC,KAAK;QAAC;QACrD,IAAI,CAACC,WAAW,CAACC,cAAc,CAACR,KAAKC,YAAYQ,0BAAU,CAACC,OAAO;QACnE,kDAAkD;QAClD,OAAO,IAAIC,oBAAS,CAAC;YAAE,GAAGV,WAAWI,QAAQ;YAAEO,KAAKX,WAAWW,GAAG;QAAC;IACrE;IAEA,OAAeC,qBAAqBb,GAAmB,EAAiB;QACtE,IAAI,OAAOA,IAAIc,OAAO,KAAK,YAAYd,IAAIc,OAAO,CAAClB,yBAAyBmB,iBAAiB,CAAC,KAAKC,WAAW;YAC5G,OAAOhB,IAAIc,OAAO,CAAClB,yBAAyBmB,iBAAiB,CAAC;QAChE;QACA,OAAO;IACT;IAzBA,YACE,AAAiBR,WAAwB,EACzC,AAAiBL,MAAkB,CACnC;QACA,KAAK,CAAC;YACJe,gBAAgBC,uBAAU,CAACC,cAAc,CAAC;gBAACvB,yBAAyBiB,oBAAoB;gBAAEK,uBAAU,CAACE,2BAA2B;aAAG;YACnIC,aAAad,YAAYe,UAAU,CAACC,KAAK,CAACC,OAAO,CAACC,MAAM;YACxDC,kBAAkB;YAClBC,mBAAmB;QACrB,SARiBpB,cAAAA,kBACAL,SAAAA;QAQjBN,yBAAyBmB,iBAAiB,GAAGR,YAAYe,UAAU,CAACC,KAAK,CAACC,OAAO,CAACI,IAAI;IACxF;AAeF"}
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-token-refresh.strategy.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { Injectable } from '@nestjs/common'\nimport { AbstractStrategy, PassportStrategy } from '@nestjs/passport'\nimport { FastifyRequest } from 'fastify'\nimport { PinoLogger } from 'nestjs-pino'\nimport { ExtractJwt, Strategy } from 'passport-jwt'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { configuration } from '../../configuration/config.environment'\nimport { JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\nimport { AuthManager } from '../services/auth-manager.service'\n\n@Injectable()\nexport class AuthTokenRefreshStrategy extends PassportStrategy(Strategy, 'tokenRefresh') implements AbstractStrategy {\n  private static refreshCookieName: string\n\n  constructor(\n    private readonly authManager: AuthManager,\n    private readonly logger: PinoLogger\n  ) {\n    super({\n      jwtFromRequest: ExtractJwt.fromExtractors([AuthTokenRefreshStrategy.extractJWTFromCookie, ExtractJwt.fromAuthHeaderAsBearerToken()]),\n      secretOrKey: configuration.auth.token.refresh.secret,\n      ignoreExpiration: false,\n      passReqToCallback: true\n    })\n    AuthTokenRefreshStrategy.refreshCookieName = configuration.auth.token.refresh.name\n  }\n\n  validate(req: FastifyRequest, jwtPayload: JwtPayload): UserModel {\n    this.logger.assign({ user: jwtPayload.identity.login })\n    this.authManager.csrfValidation(req, jwtPayload, TOKEN_TYPE.REFRESH)\n    // jwt expiration is used later to refresh cookies\n    return new UserModel({ ...jwtPayload.identity, exp: jwtPayload.exp })\n  }\n\n  private static extractJWTFromCookie(req: FastifyRequest): string | null {\n    if (typeof req.cookies === 'object' && req.cookies[AuthTokenRefreshStrategy.refreshCookieName] !== undefined) {\n      return req.cookies[AuthTokenRefreshStrategy.refreshCookieName]\n    }\n    return null\n  }\n}\n"],"names":["AuthTokenRefreshStrategy","PassportStrategy","Strategy","validate","req","jwtPayload","logger","assign","user","identity","login","authManager","csrfValidation","TOKEN_TYPE","REFRESH","UserModel","exp","extractJWTFromCookie","cookies","refreshCookieName","undefined","jwtFromRequest","ExtractJwt","fromExtractors","fromAuthHeaderAsBearerToken","secretOrKey","configuration","auth","token","refresh","secret","ignoreExpiration","passReqToCallback","name"],"mappings":"AAAA;;;;CAIC;;;;+BAcYA;;;eAAAA;;;wBAZc;0BACwB;4BAExB;6BACU;2BACX;mCACI;gCAEH;oCACC;;;;;;;;;;AAGrB,IAAA,AAAMA,2BAAN,MAAMA,iCAAiCC,IAAAA,0BAAgB,EAACC,qBAAQ,EAAE;IAgBvEC,SAASC,GAAmB,EAAEC,UAAsB,EAAa;QAC/D,IAAI,CAACC,MAAM,CAACC,MAAM,CAAC;YAAEC,MAAMH,WAAWI,QAAQ,CAACC,KAAK;QAAC;QACrD,IAAI,CAACC,WAAW,CAACC,cAAc,CAACR,KAAKC,YAAYQ,0BAAU,CAACC,OAAO;QACnE,kDAAkD;QAClD,OAAO,IAAIC,oBAAS,CAAC;YAAE,GAAGV,WAAWI,QAAQ;YAAEO,KAAKX,WAAWW,GAAG;QAAC;IACrE;IAEA,OAAeC,qBAAqBb,GAAmB,EAAiB;QACtE,IAAI,OAAOA,IAAIc,OAAO,KAAK,YAAYd,IAAIc,OAAO,CAAClB,yBAAyBmB,iBAAiB,CAAC,KAAKC,WAAW;YAC5G,OAAOhB,IAAIc,OAAO,CAAClB,yBAAyBmB,iBAAiB,CAAC;QAChE;QACA,OAAO;IACT;IAzBA,YACE,AAAiBR,WAAwB,EACzC,AAAiBL,MAAkB,CACnC;QACA,KAAK,CAAC;YACJe,gBAAgBC,uBAAU,CAACC,cAAc,CAAC;gBAACvB,yBAAyBiB,oBAAoB;gBAAEK,uBAAU,CAACE,2BAA2B;aAAG;YACnIC,aAAaC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,OAAO,CAACC,MAAM;YACpDC,kBAAkB;YAClBC,mBAAmB;QACrB,SARiBrB,cAAAA,kBACAL,SAAAA;QAQjBN,yBAAyBmB,iBAAiB,GAAGO,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,OAAO,CAACI,IAAI;IACpF;AAeF"}

package/server/authentication/guards/auth-two-fa-guard.js

@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
+ * This file is part of Sync-in | The open source file sync and share solution
+ * See the LICENSE file for licensing details
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get AuthTwoFaGuard () {
+        return AuthTwoFaGuard;
+    },
+    get AuthTwoFaGuardWithoutPassword () {
+        return AuthTwoFaGuardWithoutPassword;
+    }
+});
+const _common = require("@nestjs/common");
+const _configenvironment = require("../../configuration/config.environment");
+const _auth = require("../constants/auth");
+const _authmethodtwofaservice = require("../services/auth-methods/auth-method-two-fa.service");
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+const AuthTwoFaGuard = AuthTwoFaGuardFactory();
+const AuthTwoFaGuardWithoutPassword = AuthTwoFaGuardFactory({
+    withPassword: false
+});
+function AuthTwoFaGuardFactory(options = {
+    withPassword: true
+}) {
+    let MixinAuthTwoFaGuard = class MixinAuthTwoFaGuard {
+        async canActivate(ctx) {
+            const req = ctx.switchToHttp().getRequest();
+            const user = await this.authMethod2FA.loadUser(req.user.id, req.ip);
+            if (options.withPassword) {
+                if (!req.headers[_auth.TWO_FA_HEADER_PASSWORD]) {
+                    throw new _common.HttpException('Missing TWO-FA password', _common.HttpStatus.FORBIDDEN);
+                }
+                await this.authMethod2FA.verifyUserPassword(user, req.headers[_auth.TWO_FA_HEADER_PASSWORD], req.ip);
+            }
+            if (!_configenvironment.configuration.auth.mfa.totp.enabled || !user.twoFaEnabled) {
+                return true;
+            }
+            if (!req.headers[_auth.TWO_FA_HEADER_CODE]) {
+                throw new _common.HttpException('Missing TWO-FA code', _common.HttpStatus.FORBIDDEN);
+            }
+            const auth = await this.authMethod2FA.verify({
+                code: req.headers[_auth.TWO_FA_HEADER_CODE]
+            }, req);
+            if (!auth.success) {
+                throw new _common.HttpException(auth.message, _common.HttpStatus.FORBIDDEN);
+            }
+            return true;
+        }
+        constructor(authMethod2FA){
+            this.authMethod2FA = authMethod2FA;
+        }
+    };
+    MixinAuthTwoFaGuard = _ts_decorate([
+        (0, _common.Injectable)(),
+        _ts_metadata("design:type", Function),
+        _ts_metadata("design:paramtypes", [
+            typeof _authmethodtwofaservice.AuthMethod2FA === "undefined" ? Object : _authmethodtwofaservice.AuthMethod2FA
+        ])
+    ], MixinAuthTwoFaGuard);
+    return (0, _common.mixin)(MixinAuthTwoFaGuard);
+}
+
+//# sourceMappingURL=auth-two-fa-guard.js.map

package/server/authentication/guards/auth-two-fa-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/guards/auth-two-fa-guard.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { CanActivate, ExecutionContext, HttpException, HttpStatus, Injectable, mixin, Type } from '@nestjs/common'\nimport { configuration } from '../../configuration/config.environment'\nimport { TWO_FA_HEADER_CODE, TWO_FA_HEADER_PASSWORD } from '../constants/auth'\nimport { FastifyAuthenticatedRequest } from '../interfaces/auth-request.interface'\nimport { AuthMethod2FA } from '../services/auth-methods/auth-method-two-fa.service'\n\nexport const AuthTwoFaGuard = AuthTwoFaGuardFactory()\nexport const AuthTwoFaGuardWithoutPassword = AuthTwoFaGuardFactory({ withPassword: false })\n\ninterface TwoFaGuardOptions {\n  withPassword?: boolean\n}\n\nfunction AuthTwoFaGuardFactory(options: TwoFaGuardOptions = { withPassword: true }): Type<CanActivate> {\n  @Injectable()\n  class MixinAuthTwoFaGuard implements CanActivate {\n    constructor(private readonly authMethod2FA: AuthMethod2FA) {}\n\n    async canActivate(ctx: ExecutionContext): Promise<boolean> {\n      const req: FastifyAuthenticatedRequest = ctx.switchToHttp().getRequest()\n      const user = await this.authMethod2FA.loadUser(req.user.id, req.ip)\n\n      if (options.withPassword) {\n        if (!req.headers[TWO_FA_HEADER_PASSWORD]) {\n          throw new HttpException('Missing TWO-FA password', HttpStatus.FORBIDDEN)\n        }\n        await this.authMethod2FA.verifyUserPassword(user, req.headers[TWO_FA_HEADER_PASSWORD] as string, req.ip)\n      }\n\n      if (!configuration.auth.mfa.totp.enabled || !user.twoFaEnabled) {\n        return true\n      }\n\n      if (!req.headers[TWO_FA_HEADER_CODE]) {\n        throw new HttpException('Missing TWO-FA code', HttpStatus.FORBIDDEN)\n      }\n\n      const auth = await this.authMethod2FA.verify({ code: req.headers[TWO_FA_HEADER_CODE] as string }, req)\n\n      if (!auth.success) {\n        throw new HttpException(auth.message, HttpStatus.FORBIDDEN)\n      }\n\n      return true\n    }\n  }\n\n  return mixin(MixinAuthTwoFaGuard)\n}\n"],"names":["AuthTwoFaGuard","AuthTwoFaGuardWithoutPassword","AuthTwoFaGuardFactory","withPassword","options","MixinAuthTwoFaGuard","canActivate","ctx","req","switchToHttp","getRequest","user","authMethod2FA","loadUser","id","ip","headers","TWO_FA_HEADER_PASSWORD","HttpException","HttpStatus","FORBIDDEN","verifyUserPassword","configuration","auth","mfa","totp","enabled","twoFaEnabled","TWO_FA_HEADER_CODE","verify","code","success","message","mixin"],"mappings":"AAAA;;;;CAIC;;;;;;;;;;;QAQYA;eAAAA;;QACAC;eAAAA;;;wBAPqF;mCACpE;sBAC6B;wCAE7B;;;;;;;;;;AAEvB,MAAMD,iBAAiBE;AACvB,MAAMD,gCAAgCC,sBAAsB;IAAEC,cAAc;AAAM;AAMzF,SAASD,sBAAsBE,UAA6B;IAAED,cAAc;AAAK,CAAC;IAChF,IAAA,AACME,sBADN,MACMA;QAGJ,MAAMC,YAAYC,GAAqB,EAAoB;YACzD,MAAMC,MAAmCD,IAAIE,YAAY,GAAGC,UAAU;YACtE,MAAMC,OAAO,MAAM,IAAI,CAACC,aAAa,CAACC,QAAQ,CAACL,IAAIG,IAAI,CAACG,EAAE,EAAEN,IAAIO,EAAE;YAElE,IAAIX,QAAQD,YAAY,EAAE;gBACxB,IAAI,CAACK,IAAIQ,OAAO,CAACC,4BAAsB,CAAC,EAAE;oBACxC,MAAM,IAAIC,qBAAa,CAAC,2BAA2BC,kBAAU,CAACC,SAAS;gBACzE;gBACA,MAAM,IAAI,CAACR,aAAa,CAACS,kBAAkB,CAACV,MAAMH,IAAIQ,OAAO,CAACC,4BAAsB,CAAC,EAAYT,IAAIO,EAAE;YACzG;YAEA,IAAI,CAACO,gCAAa,CAACC,IAAI,CAACC,GAAG,CAACC,IAAI,CAACC,OAAO,IAAI,CAACf,KAAKgB,YAAY,EAAE;gBAC9D,OAAO;YACT;YAEA,IAAI,CAACnB,IAAIQ,OAAO,CAACY,wBAAkB,CAAC,EAAE;gBACpC,MAAM,IAAIV,qBAAa,CAAC,uBAAuBC,kBAAU,CAACC,SAAS;YACrE;YAEA,MAAMG,OAAO,MAAM,IAAI,CAACX,aAAa,CAACiB,MAAM,CAAC;gBAAEC,MAAMtB,IAAIQ,OAAO,CAACY,wBAAkB,CAAC;YAAW,GAAGpB;YAElG,IAAI,CAACe,KAAKQ,OAAO,EAAE;gBACjB,MAAM,IAAIb,qBAAa,CAACK,KAAKS,OAAO,EAAEb,kBAAU,CAACC,SAAS;YAC5D;YAEA,OAAO;QACT;QA5BA,YAAY,AAAiBR,aAA4B,CAAE;iBAA9BA,gBAAAA;QAA+B;IA6B9D;;;;;;;;IAEA,OAAOqB,IAAAA,aAAK,EAAC5B;AACf"}

package/server/authentication/interfaces/jwt-payload.interface.js

@@ -13,6 +13,9 @@ function _export(target, all) {
     });
 }
 _export(exports, {
+    get JwtIdentity2FaPayload () {
+        return JwtIdentity2FaPayload;
+    },
     get JwtIdentityPayload () {
         return JwtIdentityPayload;
     },
@@ -22,6 +25,8 @@ _export(exports, {
 });
 let JwtIdentityPayload = class JwtIdentityPayload {
 };
+let JwtIdentity2FaPayload = class JwtIdentity2FaPayload {
+};
 let JwtPayload = class JwtPayload {
 };
 

package/server/authentication/interfaces/jwt-payload.interface.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/interfaces/jwt-payload.interface.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nexport class JwtIdentityPayload {\n  id: number\n  login: string\n  email: string\n  fullName: string\n  role: number\n  applications: string[]\n  impersonatedFromId?: number\n  impersonatedClientId?: string\n  clientId?: string\n}\n\nexport class JwtPayload {\n  identity: JwtIdentityPayload\n  csrf?: string\n  iat?: number\n  exp: number\n}\n"],"names":["JwtIdentityPayload","JwtPayload"],"mappings":"AAAA;;;;CAIC;;;;;;;;;;;QAEYA;eAAAA;;QAYAC;eAAAA;;;AAZN,IAAA,AAAMD,qBAAN,MAAMA;AAUb;AAEO,IAAA,AAAMC,aAAN,MAAMA;AAKb"}
+{"version":3,"sources":["../../../../backend/src/authentication/interfaces/jwt-payload.interface.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nexport class JwtIdentityPayload {\n  id: number\n  login: string\n  email: string\n  fullName: string\n  language: string\n  role: number\n  applications: string[]\n  impersonatedFromId?: number\n  impersonatedClientId?: string\n  clientId?: string\n  twoFaEnabled?: boolean\n}\n\nexport class JwtIdentity2FaPayload {\n  id: number\n  login: string\n  language: string\n  role: number\n  twoFaEnabled: true\n}\n\nexport class JwtPayload {\n  identity: JwtIdentityPayload\n  csrf?: string\n  iat?: number\n  exp: number\n}\n"],"names":["JwtIdentity2FaPayload","JwtIdentityPayload","JwtPayload"],"mappings":"AAAA;;;;CAIC;;;;;;;;;;;QAgBYA;eAAAA;;QAdAC;eAAAA;;QAsBAC;eAAAA;;;AAtBN,IAAA,AAAMD,qBAAN,MAAMA;AAYb;AAEO,IAAA,AAAMD,wBAAN,MAAMA;AAMb;AAEO,IAAA,AAAME,aAAN,MAAMA;AAKb"}

package/server/authentication/interfaces/token.interface.js

@@ -14,9 +14,11 @@ Object.defineProperty(exports, "TOKEN_TYPE", {
 });
 var TOKEN_TYPE = /*#__PURE__*/ function(TOKEN_TYPE) {
     TOKEN_TYPE["ACCESS"] = "access";
+    TOKEN_TYPE["ACCESS_2FA"] = "access_2fa";
     TOKEN_TYPE["REFRESH"] = "refresh";
     TOKEN_TYPE["WS"] = "ws";
     TOKEN_TYPE["CSRF"] = "csrf";
+    TOKEN_TYPE["CSRF_2FA"] = "csrf_2fa";
     return TOKEN_TYPE;
 }({});
 

package/server/authentication/interfaces/token.interface.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/interfaces/token.interface.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nexport enum TOKEN_TYPE {\n  ACCESS = 'access',\n  REFRESH = 'refresh',\n  WS = 'ws',\n  CSRF = 'csrf'\n}\n"],"names":["TOKEN_TYPE"],"mappings":"AAAA;;;;CAIC;;;;+BAEWA;;;eAAAA;;;AAAL,IAAA,AAAKA,oCAAAA;;;;;WAAAA"}
+{"version":3,"sources":["../../../../backend/src/authentication/interfaces/token.interface.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nexport enum TOKEN_TYPE {\n  ACCESS = 'access',\n  ACCESS_2FA = 'access_2fa',\n  REFRESH = 'refresh',\n  WS = 'ws',\n  CSRF = 'csrf',\n  CSRF_2FA = 'csrf_2fa'\n}\n"],"names":["TOKEN_TYPE"],"mappings":"AAAA;;;;CAIC;;;;+BAEWA;;;eAAAA;;;AAAL,IAAA,AAAKA,oCAAAA;;;;;;;WAAAA"}

package/server/authentication/interfaces/two-fa-setup.interface.js

@@ -0,0 +1,10 @@
+/*
+ * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>
+ * This file is part of Sync-in | The open source file sync and share solution
+ * See the LICENSE file for licensing details
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+
+//# sourceMappingURL=two-fa-setup.interface.js.map

package/server/authentication/interfaces/two-fa-setup.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../backend/src/authentication/interfaces/two-fa-setup.interface.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nexport interface TwoFaSetup {\n  secret: string\n  qrDataUrl: string\n}\n\nexport interface TwoFaVerifyResult {\n  success: boolean\n  message: string\n}\n\nexport interface TwoFaEnableResult extends TwoFaVerifyResult {\n  recoveryCodes: string[]\n}\n"],"names":[],"mappings":"AAAA;;;;CAIC"}

package/server/authentication/models/auth-method.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/models/auth-method.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { UserModel } from '../../applications/users/models/user.model'\n\nexport abstract class AuthMethod {\n  abstract validateUser(loginOrEmail: string, password: string, ip?: string): Promise<UserModel>\n}\n"],"names":["AuthMethod"],"mappings":"AAAA;;;;CAIC;;;;+BAIqBA;;;eAAAA;;;AAAf,IAAA,AAAeA,aAAf,MAAeA;AAEtB"}
+{"version":3,"sources":["../../../../backend/src/authentication/models/auth-method.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport type { UserModel } from '../../applications/users/models/user.model'\nimport type { AUTH_SCOPE } from '../constants/scope'\n\nexport abstract class AuthMethod {\n  abstract validateUser(loginOrEmail: string, password: string, ip?: string, scope?: AUTH_SCOPE): Promise<UserModel>\n}\n"],"names":["AuthMethod"],"mappings":"AAAA;;;;CAIC;;;;+BAKqBA;;;eAAAA;;;AAAf,IAAA,AAAeA,aAAf,MAAeA;AAEtB"}

package/server/authentication/services/auth-manager.service.js

@@ -14,12 +14,12 @@ Object.defineProperty(exports, "AuthManager", {
 });
 const _cookie = require("@fastify/cookie");
 const _common = require("@nestjs/common");
-const _config = require("@nestjs/config");
 const _jwt = require("@nestjs/jwt");
 const _nodecrypto = /*#__PURE__*/ _interop_require_default(require("node:crypto"));
 const _applicationsconstants = require("../../applications/applications.constants");
 const _functions = require("../../common/functions");
 const _shared = require("../../common/shared");
+const _configenvironment = require("../../configuration/config.environment");
 const _auth = require("../constants/auth");
 const _loginresponsedto = require("../dto/login-response.dto");
 const _tokeninterface = require("../interfaces/token.interface");
@@ -44,8 +44,8 @@ let AuthManager = class AuthManager {
             this.logger.error(`${this.getTokens.name} - token refresh has incorrect expiration : *${user.login}*`);
             throw new _common.HttpException('Token has expired', _common.HttpStatus.FORBIDDEN);
         }
-        const accessExpiration = (0, _functions.convertHumanTimeToSeconds)(this.authConfig.token.access.expiration);
-        const refreshExpiration = refresh ? user.exp - currentTime : (0, _functions.convertHumanTimeToSeconds)(this.authConfig.token.refresh.expiration);
+        const accessExpiration = (0, _functions.convertHumanTimeToSeconds)(_configenvironment.configuration.auth.token.access.expiration);
+        const refreshExpiration = refresh ? user.exp - currentTime : (0, _functions.convertHumanTimeToSeconds)(_configenvironment.configuration.auth.token.refresh.expiration);
         return {
             [_tokeninterface.TOKEN_TYPE.ACCESS]: await this.jwtSign(user, _tokeninterface.TOKEN_TYPE.ACCESS, accessExpiration),
             [_tokeninterface.TOKEN_TYPE.REFRESH]: await this.jwtSign(user, _tokeninterface.TOKEN_TYPE.REFRESH, refreshExpiration),
@@ -53,20 +53,31 @@ let AuthManager = class AuthManager {
             [`${_tokeninterface.TOKEN_TYPE.REFRESH}_expiration`]: refreshExpiration + currentTime
         };
     }
-    async setCookies(user, res) {
-        const response = new _loginresponsedto.LoginResponseDto(user);
+    async setCookies(user, res, init2FaVerify = false) {
+        // If `verify2Fa` is true, it sets the cookies and response required for valid 2FA authentication.
+        const verify2Fa = init2FaVerify && _configenvironment.configuration.auth.mfa.totp.enabled && user.twoFaEnabled;
+        const response = verify2Fa ? new _loginresponsedto.LoginVerify2FaDto(_configenvironment.serverConfig) : new _loginresponsedto.LoginResponseDto(user, _configenvironment.serverConfig);
         const currentTime = (0, _shared.currentTimeStamp)();
         const csrfToken = _nodecrypto.default.randomUUID();
-        for (const type of _auth.TOKEN_TYPES){
-            const tokenExpiration = (0, _functions.convertHumanTimeToSeconds)(this.authConfig.token[type].expiration);
-            const cookieValue = type === _tokeninterface.TOKEN_TYPE.CSRF ? csrfToken : await this.jwtSign(user, type, tokenExpiration, csrfToken);
-            res.setCookie(this.authConfig.token[type].name, cookieValue, {
-                signed: type === _tokeninterface.TOKEN_TYPE.CSRF,
+        const tokenTypes = verify2Fa ? _auth.TOKEN_2FA_TYPES : _auth.TOKEN_TYPES;
+        for (const type of tokenTypes){
+            const isCSRFToken = type === _tokeninterface.TOKEN_TYPE.CSRF || type === _tokeninterface.TOKEN_TYPE.CSRF_2FA;
+            const tokenExpiration = (0, _functions.convertHumanTimeToSeconds)(_configenvironment.configuration.auth.token[type].expiration);
+            let cookieValue;
+            if (isCSRFToken) {
+                cookieValue = csrfToken;
+            } else if (verify2Fa) {
+                cookieValue = await this.jwtSign2Fa(user, type, tokenExpiration, csrfToken);
+            } else {
+                cookieValue = await this.jwtSign(user, type, tokenExpiration, csrfToken);
+            }
+            res.setCookie(_configenvironment.configuration.auth.token[type].name, cookieValue, {
+                signed: isCSRFToken,
                 path: _auth.TOKEN_PATHS[type],
-                maxAge: (0, _functions.convertHumanTimeToSeconds)(this.authConfig.token[type].cookieMaxAge),
-                httpOnly: type !== _tokeninterface.TOKEN_TYPE.CSRF
+                maxAge: tokenExpiration,
+                httpOnly: !isCSRFToken
             });
-            if (type === _tokeninterface.TOKEN_TYPE.ACCESS || type === _tokeninterface.TOKEN_TYPE.REFRESH) {
+            if (type === _tokeninterface.TOKEN_TYPE.ACCESS || type === _tokeninterface.TOKEN_TYPE.REFRESH || type === _tokeninterface.TOKEN_TYPE.ACCESS_2FA) {
                 response.token[`${type}_expiration`] = tokenExpiration + currentTime;
             }
         }
@@ -76,25 +87,22 @@ let AuthManager = class AuthManager {
         const response = {};
         const currentTime = (0, _shared.currentTimeStamp)();
         let refreshTokenExpiration;
-        let refreshMaxAge;
         // refresh cookie must have the `exp` attribute
         // reuse token expiration to make it final
         if (user.exp && user.exp > currentTime) {
             refreshTokenExpiration = user.exp - currentTime;
-            refreshMaxAge = refreshTokenExpiration;
         } else {
             this.logger.error(`${this.refreshCookies.name} - token ${_tokeninterface.TOKEN_TYPE.REFRESH} has incorrect expiration : *${user.login}*`);
             throw new _common.HttpException('Token has expired', _common.HttpStatus.FORBIDDEN);
         }
         const csrfToken = _nodecrypto.default.randomUUID();
         for (const type of _auth.TOKEN_TYPES){
-            const tokenExpiration = type === _tokeninterface.TOKEN_TYPE.REFRESH ? refreshTokenExpiration : (0, _functions.convertHumanTimeToSeconds)(this.authConfig.token[type].expiration);
-            const maxAge = type === _tokeninterface.TOKEN_TYPE.REFRESH ? refreshMaxAge : (0, _functions.convertHumanTimeToSeconds)(this.authConfig.token[type].cookieMaxAge);
+            const tokenExpiration = type === _tokeninterface.TOKEN_TYPE.ACCESS ? (0, _functions.convertHumanTimeToSeconds)(_configenvironment.configuration.auth.token[_tokeninterface.TOKEN_TYPE.ACCESS].expiration) : refreshTokenExpiration;
             const cookieValue = type === _tokeninterface.TOKEN_TYPE.CSRF ? csrfToken : await this.jwtSign(user, type, tokenExpiration, csrfToken);
-            res.setCookie(this.authConfig.token[type].name, cookieValue, {
+            res.setCookie(_configenvironment.configuration.auth.token[type].name, cookieValue, {
                 signed: type === _tokeninterface.TOKEN_TYPE.CSRF,
                 path: _auth.TOKEN_PATHS[type],
-                maxAge: maxAge,
+                maxAge: tokenExpiration,
                 httpOnly: type !== _tokeninterface.TOKEN_TYPE.CSRF
             });
             if (type === _tokeninterface.TOKEN_TYPE.ACCESS || type === _tokeninterface.TOKEN_TYPE.REFRESH) {
@@ -105,40 +113,19 @@ let AuthManager = class AuthManager {
     }
     async clearCookies(res) {
         for (const [type, path] of Object.entries(_auth.TOKEN_PATHS)){
-            res.clearCookie(this.authConfig.token[type].name, {
+            res.clearCookie(_configenvironment.configuration.auth.token[type].name, {
                 path: path,
                 httpOnly: type !== _tokeninterface.TOKEN_TYPE.CSRF
             });
         }
     }
-    jwtSign(user, type, expiration, csrfToken) {
-        return this.jwt.signAsync({
-            identity: {
-                id: user.id,
-                login: user.login,
-                email: user.email,
-                fullName: user.fullName,
-                role: user.role,
-                applications: user.applications,
-                impersonatedFromId: user.impersonatedFromId || undefined,
-                impersonatedClientId: user.impersonatedClientId || undefined,
-                clientId: user.clientId || undefined
-            },
-            ...(type === _tokeninterface.TOKEN_TYPE.ACCESS || type === _tokeninterface.TOKEN_TYPE.REFRESH) && {
-                csrf: csrfToken
-            }
-        }, {
-            secret: this.authConfig.token[type].secret,
-            expiresIn: expiration
-        });
-    }
     csrfValidation(req, jwtPayload, type) {
         // ignore safe methods
         if (_applicationsconstants.HTTP_CSRF_IGNORED_METHODS.has(req.method)) {
             return;
         }
-        // check csrf only for access & refresh cookies
-        if (typeof req.cookies !== 'object' || req.cookies[this.authConfig.token[type].name] === undefined) {
+        // check csrf only for access and refresh cookies
+        if (typeof req.cookies !== 'object' || req.cookies[_configenvironment.configuration.auth.token[type].name] === undefined) {
             return;
         }
         if (!jwtPayload.csrf) {
@@ -149,25 +136,61 @@ let AuthManager = class AuthManager {
             this.logger.warn(`${this.csrfValidation.name} - ${_auth.CSRF_ERROR.MISSING_HEADERS}`);
             throw new _common.HttpException(_auth.CSRF_ERROR.MISSING_HEADERS, _common.HttpStatus.FORBIDDEN);
         }
-        const csrfHeader = (0, _cookie.unsign)(req.headers[_auth.CSRF_KEY], this.authConfig.token.csrf.secret);
+        const csrfHeader = (0, _cookie.unsign)(req.headers[_auth.CSRF_KEY], _configenvironment.configuration.auth.token.csrf.secret);
         if (jwtPayload.csrf !== csrfHeader.value) {
             this.logger.warn(`${this.csrfValidation.name} - ${_auth.CSRF_ERROR.MISMATCH}`);
             throw new _common.HttpException(_auth.CSRF_ERROR.MISMATCH, _common.HttpStatus.FORBIDDEN);
         }
     }
-    constructor(jwt, config){
+    jwtSign(user, type, expiration, csrfToken) {
+        return this.jwt.signAsync({
+            identity: {
+                id: user.id,
+                login: user.login,
+                email: user.email,
+                fullName: user.fullName,
+                language: user.language,
+                role: user.role,
+                applications: user.applications,
+                impersonatedFromId: user.impersonatedFromId || undefined,
+                impersonatedClientId: user.impersonatedClientId || undefined,
+                clientId: user.clientId || undefined,
+                twoFaEnabled: user.twoFaEnabled || undefined
+            },
+            ...(type === _tokeninterface.TOKEN_TYPE.ACCESS || type === _tokeninterface.TOKEN_TYPE.REFRESH) && {
+                csrf: csrfToken
+            }
+        }, {
+            secret: _configenvironment.configuration.auth.token[type].secret,
+            expiresIn: expiration
+        });
+    }
+    jwtSign2Fa(user, type, expiration, csrfToken) {
+        // Restrict the temporary token to the minimum required information
+        return this.jwt.signAsync({
+            identity: {
+                id: user.id,
+                login: user.login,
+                language: user.language,
+                role: user.role,
+                twoFaEnabled: true
+            },
+            csrf: csrfToken
+        }, {
+            secret: _configenvironment.configuration.auth.token[type].secret,
+            expiresIn: expiration
+        });
+    }
+    constructor(jwt){
         this.jwt = jwt;
-        this.config = config;
         this.logger = new _common.Logger(AuthManager.name);
-        this.authConfig = this.config.get('auth');
     }
 };
 AuthManager = _ts_decorate([
     (0, _common.Injectable)(),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _jwt.JwtService === "undefined" ? Object : _jwt.JwtService,
-        typeof _config.ConfigService === "undefined" ? Object : _config.ConfigService
+        typeof _jwt.JwtService === "undefined" ? Object : _jwt.JwtService
     ])
 ], AuthManager);
 

package/server/authentication/services/auth-manager.service.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../backend/src/authentication/services/auth-manager.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\nimport { unsign, UnsignResult } from '@fastify/cookie'\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { ConfigService } from '@nestjs/config'\nimport { JwtService } from '@nestjs/jwt'\nimport { FastifyReply, FastifyRequest } from 'fastify'\nimport crypto from 'node:crypto'\nimport { HTTP_CSRF_IGNORED_METHODS } from '../../applications/applications.constants'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { convertHumanTimeToSeconds } from '../../common/functions'\nimport { currentTimeStamp } from '../../common/shared'\nimport { AuthConfig } from '../auth.config'\nimport { CSRF_ERROR, CSRF_KEY, TOKEN_PATHS, TOKEN_TYPES } from '../constants/auth'\nimport { LoginResponseDto } from '../dto/login-response.dto'\nimport { TokenResponseDto } from '../dto/token-response.dto'\nimport { JwtIdentityPayload, JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\n\n@Injectable()\nexport class AuthManager {\n  private readonly logger = new Logger(AuthManager.name)\n  public readonly authConfig: AuthConfig\n\n  constructor(\n    private readonly jwt: JwtService,\n    private readonly config: ConfigService\n  ) {\n    this.authConfig = this.config.get<AuthConfig>('auth')\n  }\n\n  async getTokens(user: UserModel, refresh = false): Promise<TokenResponseDto> {\n    const currentTime = currentTimeStamp()\n    if (refresh && user.exp < currentTime) {\n      this.logger.error(`${this.getTokens.name} - token refresh has incorrect expiration : *${user.login}*`)\n      throw new HttpException('Token has expired', HttpStatus.FORBIDDEN)\n    }\n    const accessExpiration = convertHumanTimeToSeconds(this.authConfig.token.access.expiration)\n    const refreshExpiration = refresh ? user.exp - currentTime : convertHumanTimeToSeconds(this.authConfig.token.refresh.expiration)\n    return {\n      [TOKEN_TYPE.ACCESS]: await this.jwtSign(user, TOKEN_TYPE.ACCESS, accessExpiration),\n      [TOKEN_TYPE.REFRESH]: await this.jwtSign(user, TOKEN_TYPE.REFRESH, refreshExpiration),\n      [`${TOKEN_TYPE.ACCESS}_expiration`]: accessExpiration + currentTime,\n      [`${TOKEN_TYPE.REFRESH}_expiration`]: refreshExpiration + currentTime\n    }\n  }\n\n  async setCookies(user: UserModel, res: FastifyReply): Promise<LoginResponseDto> {\n    const response = new LoginResponseDto(user)\n    const currentTime = currentTimeStamp()\n    const csrfToken: string = crypto.randomUUID()\n    for (const type of TOKEN_TYPES) {\n      const tokenExpiration = convertHumanTimeToSeconds(this.authConfig.token[type].expiration)\n      const cookieValue: string = type === TOKEN_TYPE.CSRF ? csrfToken : await this.jwtSign(user, type, tokenExpiration, csrfToken)\n      res.setCookie(this.authConfig.token[type].name, cookieValue, {\n        signed: type === TOKEN_TYPE.CSRF,\n        path: TOKEN_PATHS[type],\n        maxAge: convertHumanTimeToSeconds(this.authConfig.token[type].cookieMaxAge),\n        httpOnly: type !== TOKEN_TYPE.CSRF\n      })\n      if (type === TOKEN_TYPE.ACCESS || type === TOKEN_TYPE.REFRESH) {\n        response.token[`${type}_expiration`] = tokenExpiration + currentTime\n      }\n    }\n    return response\n  }\n\n  async refreshCookies(user: UserModel, res: FastifyReply): Promise<TokenResponseDto> {\n    const response = {} as TokenResponseDto\n    const currentTime = currentTimeStamp()\n    let refreshTokenExpiration: number\n    let refreshMaxAge: number\n    // refresh cookie must have the `exp` attribute\n    // reuse token expiration to make it final\n    if (user.exp && user.exp > currentTime) {\n      refreshTokenExpiration = user.exp - currentTime\n      refreshMaxAge = refreshTokenExpiration\n    } else {\n      this.logger.error(`${this.refreshCookies.name} - token ${TOKEN_TYPE.REFRESH} has incorrect expiration : *${user.login}*`)\n      throw new HttpException('Token has expired', HttpStatus.FORBIDDEN)\n    }\n    const csrfToken: string = crypto.randomUUID()\n    for (const type of TOKEN_TYPES) {\n      const tokenExpiration = type === TOKEN_TYPE.REFRESH ? refreshTokenExpiration : convertHumanTimeToSeconds(this.authConfig.token[type].expiration)\n      const maxAge = type === TOKEN_TYPE.REFRESH ? refreshMaxAge : convertHumanTimeToSeconds(this.authConfig.token[type].cookieMaxAge)\n      const cookieValue: string = type === TOKEN_TYPE.CSRF ? csrfToken : await this.jwtSign(user, type, tokenExpiration, csrfToken)\n      res.setCookie(this.authConfig.token[type].name, cookieValue, {\n        signed: type === TOKEN_TYPE.CSRF,\n        path: TOKEN_PATHS[type],\n        maxAge: maxAge,\n        httpOnly: type !== TOKEN_TYPE.CSRF\n      })\n      if (type === TOKEN_TYPE.ACCESS || type === TOKEN_TYPE.REFRESH) {\n        response[`${type}_expiration`] = tokenExpiration + currentTime\n      }\n    }\n    return response\n  }\n\n  async clearCookies(res: FastifyReply) {\n    for (const [type, path] of Object.entries(TOKEN_PATHS)) {\n      res.clearCookie(this.authConfig.token[type].name, { path: path, httpOnly: type !== TOKEN_TYPE.CSRF })\n    }\n  }\n\n  private jwtSign(user: UserModel, type: TOKEN_TYPE, expiration: number, csrfToken?: string): Promise<string> {\n    return this.jwt.signAsync(\n      {\n        identity: {\n          id: user.id,\n          login: user.login,\n          email: user.email,\n          fullName: user.fullName,\n          role: user.role,\n          applications: user.applications,\n          impersonatedFromId: user.impersonatedFromId || undefined,\n          impersonatedClientId: user.impersonatedClientId || undefined,\n          clientId: user.clientId || undefined\n        } satisfies JwtIdentityPayload,\n        ...((type === TOKEN_TYPE.ACCESS || type === TOKEN_TYPE.REFRESH) && { csrf: csrfToken })\n      },\n      {\n        secret: this.authConfig.token[type].secret,\n        expiresIn: expiration\n      }\n    )\n  }\n\n  csrfValidation(req: FastifyRequest, jwtPayload: JwtPayload, type: TOKEN_TYPE.ACCESS | TOKEN_TYPE.REFRESH): void {\n    // ignore safe methods\n    if (HTTP_CSRF_IGNORED_METHODS.has(req.method)) {\n      return\n    }\n\n    // check csrf only for access & refresh cookies\n    if (typeof req.cookies !== 'object' || req.cookies[this.authConfig.token[type].name] === undefined) {\n      return\n    }\n\n    if (!jwtPayload.csrf) {\n      this.logger.warn(`${this.csrfValidation.name} - ${CSRF_ERROR.MISSING_JWT}`)\n      throw new HttpException(CSRF_ERROR.MISSING_JWT, HttpStatus.FORBIDDEN)\n    }\n\n    if (!req.headers[CSRF_KEY]) {\n      this.logger.warn(`${this.csrfValidation.name} - ${CSRF_ERROR.MISSING_HEADERS}`)\n      throw new HttpException(CSRF_ERROR.MISSING_HEADERS, HttpStatus.FORBIDDEN)\n    }\n\n    const csrfHeader: UnsignResult = unsign(req.headers[CSRF_KEY] as string, this.authConfig.token.csrf.secret)\n    if (jwtPayload.csrf !== csrfHeader.value) {\n      this.logger.warn(`${this.csrfValidation.name} - ${CSRF_ERROR.MISMATCH}`)\n      throw new HttpException(CSRF_ERROR.MISMATCH, HttpStatus.FORBIDDEN)\n    }\n  }\n}\n"],"names":["AuthManager","getTokens","user","refresh","currentTime","currentTimeStamp","exp","logger","error","name","login","HttpException","HttpStatus","FORBIDDEN","accessExpiration","convertHumanTimeToSeconds","authConfig","token","access","expiration","refreshExpiration","TOKEN_TYPE","ACCESS","jwtSign","REFRESH","setCookies","res","response","LoginResponseDto","csrfToken","crypto","randomUUID","type","TOKEN_TYPES","tokenExpiration","cookieValue","CSRF","setCookie","signed","path","TOKEN_PATHS","maxAge","cookieMaxAge","httpOnly","refreshCookies","refreshTokenExpiration","refreshMaxAge","clearCookies","Object","entries","clearCookie","jwt","signAsync","identity","id","email","fullName","role","applications","impersonatedFromId","undefined","impersonatedClientId","clientId","csrf","secret","expiresIn","csrfValidation","req","jwtPayload","HTTP_CSRF_IGNORED_METHODS","has","method","cookies","warn","CSRF_ERROR","MISSING_JWT","headers","CSRF_KEY","MISSING_HEADERS","csrfHeader","unsign","value","MISMATCH","config","Logger","get"],"mappings":"AAAA;;;;CAIC;;;;+BAmBYA;;;eAAAA;;;wBAlBwB;wBACyB;wBAChC;qBACH;mEAER;uCACuB;2BAEA;wBACT;sBAE8B;kCAC9B;gCAGN;;;;;;;;;;;;;;;AAGpB,IAAA,AAAMA,cAAN,MAAMA;IAWX,MAAMC,UAAUC,IAAe,EAAEC,UAAU,KAAK,EAA6B;QAC3E,MAAMC,cAAcC,IAAAA,wBAAgB;QACpC,IAAIF,WAAWD,KAAKI,GAAG,GAAGF,aAAa;YACrC,IAAI,CAACG,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACP,SAAS,CAACQ,IAAI,CAAC,6CAA6C,EAAEP,KAAKQ,KAAK,CAAC,CAAC,CAAC;YACrG,MAAM,IAAIC,qBAAa,CAAC,qBAAqBC,kBAAU,CAACC,SAAS;QACnE;QACA,MAAMC,mBAAmBC,IAAAA,oCAAyB,EAAC,IAAI,CAACC,UAAU,CAACC,KAAK,CAACC,MAAM,CAACC,UAAU;QAC1F,MAAMC,oBAAoBjB,UAAUD,KAAKI,GAAG,GAAGF,cAAcW,IAAAA,oCAAyB,EAAC,IAAI,CAACC,UAAU,CAACC,KAAK,CAACd,OAAO,CAACgB,UAAU;QAC/H,OAAO;YACL,CAACE,0BAAU,CAACC,MAAM,CAAC,EAAE,MAAM,IAAI,CAACC,OAAO,CAACrB,MAAMmB,0BAAU,CAACC,MAAM,EAAER;YACjE,CAACO,0BAAU,CAACG,OAAO,CAAC,EAAE,MAAM,IAAI,CAACD,OAAO,CAACrB,MAAMmB,0BAAU,CAACG,OAAO,EAAEJ;YACnE,CAAC,GAAGC,0BAAU,CAACC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAER,mBAAmBV;YACxD,CAAC,GAAGiB,0BAAU,CAACG,OAAO,CAAC,WAAW,CAAC,CAAC,EAAEJ,oBAAoBhB;QAC5D;IACF;IAEA,MAAMqB,WAAWvB,IAAe,EAAEwB,GAAiB,EAA6B;QAC9E,MAAMC,WAAW,IAAIC,kCAAgB,CAAC1B;QACtC,MAAME,cAAcC,IAAAA,wBAAgB;QACpC,MAAMwB,YAAoBC,mBAAM,CAACC,UAAU;QAC3C,KAAK,MAAMC,QAAQC,iBAAW,CAAE;YAC9B,MAAMC,kBAAkBnB,IAAAA,oCAAyB,EAAC,IAAI,CAACC,UAAU,CAACC,KAAK,CAACe,KAAK,CAACb,UAAU;YACxF,MAAMgB,cAAsBH,SAASX,0BAAU,CAACe,IAAI,GAAGP,YAAY,MAAM,IAAI,CAACN,OAAO,CAACrB,MAAM8B,MAAME,iBAAiBL;YACnHH,IAAIW,SAAS,CAAC,IAAI,CAACrB,UAAU,CAACC,KAAK,CAACe,KAAK,CAACvB,IAAI,EAAE0B,aAAa;gBAC3DG,QAAQN,SAASX,0BAAU,CAACe,IAAI;gBAChCG,MAAMC,iBAAW,CAACR,KAAK;gBACvBS,QAAQ1B,IAAAA,oCAAyB,EAAC,IAAI,CAACC,UAAU,CAACC,KAAK,CAACe,KAAK,CAACU,YAAY;gBAC1EC,UAAUX,SAASX,0BAAU,CAACe,IAAI;YACpC;YACA,IAAIJ,SAASX,0BAAU,CAACC,MAAM,IAAIU,SAASX,0BAAU,CAACG,OAAO,EAAE;gBAC7DG,SAASV,KAAK,CAAC,GAAGe,KAAK,WAAW,CAAC,CAAC,GAAGE,kBAAkB9B;YAC3D;QACF;QACA,OAAOuB;IACT;IAEA,MAAMiB,eAAe1C,IAAe,EAAEwB,GAAiB,EAA6B;QAClF,MAAMC,WAAW,CAAC;QAClB,MAAMvB,cAAcC,IAAAA,wBAAgB;QACpC,IAAIwC;QACJ,IAAIC;QACJ,+CAA+C;QAC/C,0CAA0C;QAC1C,IAAI5C,KAAKI,GAAG,IAAIJ,KAAKI,GAAG,GAAGF,aAAa;YACtCyC,yBAAyB3C,KAAKI,GAAG,GAAGF;YACpC0C,gBAAgBD;QAClB,OAAO;YACL,IAAI,CAACtC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACoC,cAAc,CAACnC,IAAI,CAAC,SAAS,EAAEY,0BAAU,CAACG,OAAO,CAAC,6BAA6B,EAAEtB,KAAKQ,KAAK,CAAC,CAAC,CAAC;YACxH,MAAM,IAAIC,qBAAa,CAAC,qBAAqBC,kBAAU,CAACC,SAAS;QACnE;QACA,MAAMgB,YAAoBC,mBAAM,CAACC,UAAU;QAC3C,KAAK,MAAMC,QAAQC,iBAAW,CAAE;YAC9B,MAAMC,kBAAkBF,SAASX,0BAAU,CAACG,OAAO,GAAGqB,yBAAyB9B,IAAAA,oCAAyB,EAAC,IAAI,CAACC,UAAU,CAACC,KAAK,CAACe,KAAK,CAACb,UAAU;YAC/I,MAAMsB,SAAST,SAASX,0BAAU,CAACG,OAAO,GAAGsB,gBAAgB/B,IAAAA,oCAAyB,EAAC,IAAI,CAACC,UAAU,CAACC,KAAK,CAACe,KAAK,CAACU,YAAY;YAC/H,MAAMP,cAAsBH,SAASX,0BAAU,CAACe,IAAI,GAAGP,YAAY,MAAM,IAAI,CAACN,OAAO,CAACrB,MAAM8B,MAAME,iBAAiBL;YACnHH,IAAIW,SAAS,CAAC,IAAI,CAACrB,UAAU,CAACC,KAAK,CAACe,KAAK,CAACvB,IAAI,EAAE0B,aAAa;gBAC3DG,QAAQN,SAASX,0BAAU,CAACe,IAAI;gBAChCG,MAAMC,iBAAW,CAACR,KAAK;gBACvBS,QAAQA;gBACRE,UAAUX,SAASX,0BAAU,CAACe,IAAI;YACpC;YACA,IAAIJ,SAASX,0BAAU,CAACC,MAAM,IAAIU,SAASX,0BAAU,CAACG,OAAO,EAAE;gBAC7DG,QAAQ,CAAC,GAAGK,KAAK,WAAW,CAAC,CAAC,GAAGE,kBAAkB9B;YACrD;QACF;QACA,OAAOuB;IACT;IAEA,MAAMoB,aAAarB,GAAiB,EAAE;QACpC,KAAK,MAAM,CAACM,MAAMO,KAAK,IAAIS,OAAOC,OAAO,CAACT,iBAAW,EAAG;YACtDd,IAAIwB,WAAW,CAAC,IAAI,CAAClC,UAAU,CAACC,KAAK,CAACe,KAAK,CAACvB,IAAI,EAAE;gBAAE8B,MAAMA;gBAAMI,UAAUX,SAASX,0BAAU,CAACe,IAAI;YAAC;QACrG;IACF;IAEQb,QAAQrB,IAAe,EAAE8B,IAAgB,EAAEb,UAAkB,EAAEU,SAAkB,EAAmB;QAC1G,OAAO,IAAI,CAACsB,GAAG,CAACC,SAAS,CACvB;YACEC,UAAU;gBACRC,IAAIpD,KAAKoD,EAAE;gBACX5C,OAAOR,KAAKQ,KAAK;gBACjB6C,OAAOrD,KAAKqD,KAAK;gBACjBC,UAAUtD,KAAKsD,QAAQ;gBACvBC,MAAMvD,KAAKuD,IAAI;gBACfC,cAAcxD,KAAKwD,YAAY;gBAC/BC,oBAAoBzD,KAAKyD,kBAAkB,IAAIC;gBAC/CC,sBAAsB3D,KAAK2D,oBAAoB,IAAID;gBACnDE,UAAU5D,KAAK4D,QAAQ,IAAIF;YAC7B;YACA,GAAI,AAAC5B,CAAAA,SAASX,0BAAU,CAACC,MAAM,IAAIU,SAASX,0BAAU,CAACG,OAAO,AAAD,KAAM;gBAAEuC,MAAMlC;YAAU,CAAC;QACxF,GACA;YACEmC,QAAQ,IAAI,CAAChD,UAAU,CAACC,KAAK,CAACe,KAAK,CAACgC,MAAM;YAC1CC,WAAW9C;QACb;IAEJ;IAEA+C,eAAeC,GAAmB,EAAEC,UAAsB,EAAEpC,IAA4C,EAAQ;QAC9G,sBAAsB;QACtB,IAAIqC,gDAAyB,CAACC,GAAG,CAACH,IAAII,MAAM,GAAG;YAC7C;QACF;QAEA,+CAA+C;QAC/C,IAAI,OAAOJ,IAAIK,OAAO,KAAK,YAAYL,IAAIK,OAAO,CAAC,IAAI,CAACxD,UAAU,CAACC,KAAK,CAACe,KAAK,CAACvB,IAAI,CAAC,KAAKmD,WAAW;YAClG;QACF;QAEA,IAAI,CAACQ,WAAWL,IAAI,EAAE;YACpB,IAAI,CAACxD,MAAM,CAACkE,IAAI,CAAC,GAAG,IAAI,CAACP,cAAc,CAACzD,IAAI,CAAC,GAAG,EAAEiE,gBAAU,CAACC,WAAW,EAAE;YAC1E,MAAM,IAAIhE,qBAAa,CAAC+D,gBAAU,CAACC,WAAW,EAAE/D,kBAAU,CAACC,SAAS;QACtE;QAEA,IAAI,CAACsD,IAAIS,OAAO,CAACC,cAAQ,CAAC,EAAE;YAC1B,IAAI,CAACtE,MAAM,CAACkE,IAAI,CAAC,GAAG,IAAI,CAACP,cAAc,CAACzD,IAAI,CAAC,GAAG,EAAEiE,gBAAU,CAACI,eAAe,EAAE;YAC9E,MAAM,IAAInE,qBAAa,CAAC+D,gBAAU,CAACI,eAAe,EAAElE,kBAAU,CAACC,SAAS;QAC1E;QAEA,MAAMkE,aAA2BC,IAAAA,cAAM,EAACb,IAAIS,OAAO,CAACC,cAAQ,CAAC,EAAY,IAAI,CAAC7D,UAAU,CAACC,KAAK,CAAC8C,IAAI,CAACC,MAAM;QAC1G,IAAII,WAAWL,IAAI,KAAKgB,WAAWE,KAAK,EAAE;YACxC,IAAI,CAAC1E,MAAM,CAACkE,IAAI,CAAC,GAAG,IAAI,CAACP,cAAc,CAACzD,IAAI,CAAC,GAAG,EAAEiE,gBAAU,CAACQ,QAAQ,EAAE;YACvE,MAAM,IAAIvE,qBAAa,CAAC+D,gBAAU,CAACQ,QAAQ,EAAEtE,kBAAU,CAACC,SAAS;QACnE;IACF;IAlIA,YACE,AAAiBsC,GAAe,EAChC,AAAiBgC,MAAqB,CACtC;aAFiBhC,MAAAA;aACAgC,SAAAA;aALF5E,SAAS,IAAI6E,cAAM,CAACpF,YAAYS,IAAI;QAOnD,IAAI,CAACO,UAAU,GAAG,IAAI,CAACmE,MAAM,CAACE,GAAG,CAAa;IAChD;AA8HF"}
+{"version":3,"sources":["../../../../backend/src/authentication/services/auth-manager.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\nimport { unsign, UnsignResult } from '@fastify/cookie'\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { JwtService } from '@nestjs/jwt'\nimport { FastifyReply, FastifyRequest } from 'fastify'\nimport crypto from 'node:crypto'\nimport { HTTP_CSRF_IGNORED_METHODS } from '../../applications/applications.constants'\nimport { UserModel } from '../../applications/users/models/user.model'\nimport { convertHumanTimeToSeconds } from '../../common/functions'\nimport { currentTimeStamp } from '../../common/shared'\nimport { configuration, serverConfig } from '../../configuration/config.environment'\nimport { CSRF_ERROR, CSRF_KEY, TOKEN_2FA_TYPES, TOKEN_PATHS, TOKEN_TYPES } from '../constants/auth'\nimport { LoginResponseDto, LoginVerify2FaDto } from '../dto/login-response.dto'\nimport { TokenResponseDto } from '../dto/token-response.dto'\nimport { JwtIdentity2FaPayload, JwtIdentityPayload, JwtPayload } from '../interfaces/jwt-payload.interface'\nimport { TOKEN_TYPE } from '../interfaces/token.interface'\n\n@Injectable()\nexport class AuthManager {\n  private readonly logger = new Logger(AuthManager.name)\n\n  constructor(private readonly jwt: JwtService) {}\n\n  async getTokens(user: UserModel, refresh = false): Promise<TokenResponseDto> {\n    const currentTime = currentTimeStamp()\n    if (refresh && user.exp < currentTime) {\n      this.logger.error(`${this.getTokens.name} - token refresh has incorrect expiration : *${user.login}*`)\n      throw new HttpException('Token has expired', HttpStatus.FORBIDDEN)\n    }\n    const accessExpiration = convertHumanTimeToSeconds(configuration.auth.token.access.expiration)\n    const refreshExpiration = refresh ? user.exp - currentTime : convertHumanTimeToSeconds(configuration.auth.token.refresh.expiration)\n    return {\n      [TOKEN_TYPE.ACCESS]: await this.jwtSign(user, TOKEN_TYPE.ACCESS, accessExpiration),\n      [TOKEN_TYPE.REFRESH]: await this.jwtSign(user, TOKEN_TYPE.REFRESH, refreshExpiration),\n      [`${TOKEN_TYPE.ACCESS}_expiration`]: accessExpiration + currentTime,\n      [`${TOKEN_TYPE.REFRESH}_expiration`]: refreshExpiration + currentTime\n    }\n  }\n\n  async setCookies(user: UserModel, res: FastifyReply, init2FaVerify: true): Promise<LoginVerify2FaDto>\n  async setCookies(user: UserModel, res: FastifyReply, init2FaVerify?: false): Promise<LoginResponseDto>\n  async setCookies(user: UserModel, res: FastifyReply, init2FaVerify = false): Promise<LoginResponseDto | LoginVerify2FaDto> {\n    // If `verify2Fa` is true, it sets the cookies and response required for valid 2FA authentication.\n    const verify2Fa = init2FaVerify && configuration.auth.mfa.totp.enabled && user.twoFaEnabled\n    const response = verify2Fa ? new LoginVerify2FaDto(serverConfig) : new LoginResponseDto(user, serverConfig)\n    const currentTime = currentTimeStamp()\n    const csrfToken: string = crypto.randomUUID()\n    const tokenTypes: TOKEN_TYPE[] = verify2Fa ? TOKEN_2FA_TYPES : TOKEN_TYPES\n    for (const type of tokenTypes) {\n      const isCSRFToken = type === TOKEN_TYPE.CSRF || type === TOKEN_TYPE.CSRF_2FA\n      const tokenExpiration = convertHumanTimeToSeconds(configuration.auth.token[type].expiration)\n      let cookieValue: string\n      if (isCSRFToken) {\n        cookieValue = csrfToken\n      } else if (verify2Fa) {\n        cookieValue = await this.jwtSign2Fa(user, type, tokenExpiration, csrfToken)\n      } else {\n        cookieValue = await this.jwtSign(user, type, tokenExpiration, csrfToken)\n      }\n      res.setCookie(configuration.auth.token[type].name, cookieValue, {\n        signed: isCSRFToken,\n        path: TOKEN_PATHS[type],\n        maxAge: tokenExpiration,\n        httpOnly: !isCSRFToken\n      })\n      if (type === TOKEN_TYPE.ACCESS || type === TOKEN_TYPE.REFRESH || type === TOKEN_TYPE.ACCESS_2FA) {\n        response.token[`${type}_expiration`] = tokenExpiration + currentTime\n      }\n    }\n    return response\n  }\n\n  async refreshCookies(user: UserModel, res: FastifyReply): Promise<TokenResponseDto> {\n    const response = {} as TokenResponseDto\n    const currentTime = currentTimeStamp()\n    let refreshTokenExpiration: number\n    // refresh cookie must have the `exp` attribute\n    // reuse token expiration to make it final\n    if (user.exp && user.exp > currentTime) {\n      refreshTokenExpiration = user.exp - currentTime\n    } else {\n      this.logger.error(`${this.refreshCookies.name} - token ${TOKEN_TYPE.REFRESH} has incorrect expiration : *${user.login}*`)\n      throw new HttpException('Token has expired', HttpStatus.FORBIDDEN)\n    }\n    const csrfToken: string = crypto.randomUUID()\n    for (const type of TOKEN_TYPES) {\n      const tokenExpiration =\n        type === TOKEN_TYPE.ACCESS ? convertHumanTimeToSeconds(configuration.auth.token[TOKEN_TYPE.ACCESS].expiration) : refreshTokenExpiration\n      const cookieValue: string = type === TOKEN_TYPE.CSRF ? csrfToken : await this.jwtSign(user, type, tokenExpiration, csrfToken)\n      res.setCookie(configuration.auth.token[type].name, cookieValue, {\n        signed: type === TOKEN_TYPE.CSRF,\n        path: TOKEN_PATHS[type],\n        maxAge: tokenExpiration,\n        httpOnly: type !== TOKEN_TYPE.CSRF\n      })\n      if (type === TOKEN_TYPE.ACCESS || type === TOKEN_TYPE.REFRESH) {\n        response[`${type}_expiration`] = tokenExpiration + currentTime\n      }\n    }\n    return response\n  }\n\n  async clearCookies(res: FastifyReply) {\n    for (const [type, path] of Object.entries(TOKEN_PATHS)) {\n      res.clearCookie(configuration.auth.token[type].name, { path: path, httpOnly: type !== TOKEN_TYPE.CSRF })\n    }\n  }\n\n  csrfValidation(req: FastifyRequest, jwtPayload: JwtPayload, type: TOKEN_TYPE.ACCESS | TOKEN_TYPE.REFRESH): void {\n    // ignore safe methods\n    if (HTTP_CSRF_IGNORED_METHODS.has(req.method)) {\n      return\n    }\n\n    // check csrf only for access and refresh cookies\n    if (typeof req.cookies !== 'object' || req.cookies[configuration.auth.token[type].name] === undefined) {\n      return\n    }\n\n    if (!jwtPayload.csrf) {\n      this.logger.warn(`${this.csrfValidation.name} - ${CSRF_ERROR.MISSING_JWT}`)\n      throw new HttpException(CSRF_ERROR.MISSING_JWT, HttpStatus.FORBIDDEN)\n    }\n\n    if (!req.headers[CSRF_KEY]) {\n      this.logger.warn(`${this.csrfValidation.name} - ${CSRF_ERROR.MISSING_HEADERS}`)\n      throw new HttpException(CSRF_ERROR.MISSING_HEADERS, HttpStatus.FORBIDDEN)\n    }\n\n    const csrfHeader: UnsignResult = unsign(req.headers[CSRF_KEY] as string, configuration.auth.token.csrf.secret)\n    if (jwtPayload.csrf !== csrfHeader.value) {\n      this.logger.warn(`${this.csrfValidation.name} - ${CSRF_ERROR.MISMATCH}`)\n      throw new HttpException(CSRF_ERROR.MISMATCH, HttpStatus.FORBIDDEN)\n    }\n  }\n\n  private jwtSign(user: UserModel, type: TOKEN_TYPE, expiration: number, csrfToken?: string): Promise<string> {\n    return this.jwt.signAsync(\n      {\n        identity: {\n          id: user.id,\n          login: user.login,\n          email: user.email,\n          fullName: user.fullName,\n          language: user.language,\n          role: user.role,\n          applications: user.applications,\n          impersonatedFromId: user.impersonatedFromId || undefined,\n          impersonatedClientId: user.impersonatedClientId || undefined,\n          clientId: user.clientId || undefined,\n          twoFaEnabled: user.twoFaEnabled || undefined\n        } satisfies JwtIdentityPayload,\n        ...((type === TOKEN_TYPE.ACCESS || type === TOKEN_TYPE.REFRESH) && { csrf: csrfToken })\n      },\n      {\n        secret: configuration.auth.token[type].secret,\n        expiresIn: expiration\n      }\n    )\n  }\n\n  private jwtSign2Fa(user: UserModel, type: TOKEN_TYPE, expiration: number, csrfToken: string): Promise<string> {\n    // Restrict the temporary token to the minimum required information\n    return this.jwt.signAsync(\n      {\n        identity: {\n          id: user.id,\n          login: user.login,\n          language: user.language,\n          role: user.role,\n          twoFaEnabled: true\n        } satisfies JwtIdentity2FaPayload,\n        csrf: csrfToken\n      },\n      {\n        secret: configuration.auth.token[type].secret,\n        expiresIn: expiration\n      }\n    )\n  }\n}\n"],"names":["AuthManager","getTokens","user","refresh","currentTime","currentTimeStamp","exp","logger","error","name","login","HttpException","HttpStatus","FORBIDDEN","accessExpiration","convertHumanTimeToSeconds","configuration","auth","token","access","expiration","refreshExpiration","TOKEN_TYPE","ACCESS","jwtSign","REFRESH","setCookies","res","init2FaVerify","verify2Fa","mfa","totp","enabled","twoFaEnabled","response","LoginVerify2FaDto","serverConfig","LoginResponseDto","csrfToken","crypto","randomUUID","tokenTypes","TOKEN_2FA_TYPES","TOKEN_TYPES","type","isCSRFToken","CSRF","CSRF_2FA","tokenExpiration","cookieValue","jwtSign2Fa","setCookie","signed","path","TOKEN_PATHS","maxAge","httpOnly","ACCESS_2FA","refreshCookies","refreshTokenExpiration","clearCookies","Object","entries","clearCookie","csrfValidation","req","jwtPayload","HTTP_CSRF_IGNORED_METHODS","has","method","cookies","undefined","csrf","warn","CSRF_ERROR","MISSING_JWT","headers","CSRF_KEY","MISSING_HEADERS","csrfHeader","unsign","secret","value","MISMATCH","jwt","signAsync","identity","id","email","fullName","language","role","applications","impersonatedFromId","impersonatedClientId","clientId","expiresIn","Logger"],"mappings":"AAAA;;;;CAIC;;;;+BAkBYA;;;eAAAA;;;wBAjBwB;wBACyB;qBACnC;mEAER;uCACuB;2BAEA;wBACT;mCACW;sBACoC;kCAC5B;gCAGzB;;;;;;;;;;;;;;;AAGpB,IAAA,AAAMA,cAAN,MAAMA;IAKX,MAAMC,UAAUC,IAAe,EAAEC,UAAU,KAAK,EAA6B;QAC3E,MAAMC,cAAcC,IAAAA,wBAAgB;QACpC,IAAIF,WAAWD,KAAKI,GAAG,GAAGF,aAAa;YACrC,IAAI,CAACG,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACP,SAAS,CAACQ,IAAI,CAAC,6CAA6C,EAAEP,KAAKQ,KAAK,CAAC,CAAC,CAAC;YACrG,MAAM,IAAIC,qBAAa,CAAC,qBAAqBC,kBAAU,CAACC,SAAS;QACnE;QACA,MAAMC,mBAAmBC,IAAAA,oCAAyB,EAACC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACC,MAAM,CAACC,UAAU;QAC7F,MAAMC,oBAAoBlB,UAAUD,KAAKI,GAAG,GAAGF,cAAcW,IAAAA,oCAAyB,EAACC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACf,OAAO,CAACiB,UAAU;QAClI,OAAO;YACL,CAACE,0BAAU,CAACC,MAAM,CAAC,EAAE,MAAM,IAAI,CAACC,OAAO,CAACtB,MAAMoB,0BAAU,CAACC,MAAM,EAAET;YACjE,CAACQ,0BAAU,CAACG,OAAO,CAAC,EAAE,MAAM,IAAI,CAACD,OAAO,CAACtB,MAAMoB,0BAAU,CAACG,OAAO,EAAEJ;YACnE,CAAC,GAAGC,0BAAU,CAACC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAET,mBAAmBV;YACxD,CAAC,GAAGkB,0BAAU,CAACG,OAAO,CAAC,WAAW,CAAC,CAAC,EAAEJ,oBAAoBjB;QAC5D;IACF;IAIA,MAAMsB,WAAWxB,IAAe,EAAEyB,GAAiB,EAAEC,gBAAgB,KAAK,EAAiD;QACzH,kGAAkG;QAClG,MAAMC,YAAYD,iBAAiBZ,gCAAa,CAACC,IAAI,CAACa,GAAG,CAACC,IAAI,CAACC,OAAO,IAAI9B,KAAK+B,YAAY;QAC3F,MAAMC,WAAWL,YAAY,IAAIM,mCAAiB,CAACC,+BAAY,IAAI,IAAIC,kCAAgB,CAACnC,MAAMkC,+BAAY;QAC1G,MAAMhC,cAAcC,IAAAA,wBAAgB;QACpC,MAAMiC,YAAoBC,mBAAM,CAACC,UAAU;QAC3C,MAAMC,aAA2BZ,YAAYa,qBAAe,GAAGC,iBAAW;QAC1E,KAAK,MAAMC,QAAQH,WAAY;YAC7B,MAAMI,cAAcD,SAAStB,0BAAU,CAACwB,IAAI,IAAIF,SAAStB,0BAAU,CAACyB,QAAQ;YAC5E,MAAMC,kBAAkBjC,IAAAA,oCAAyB,EAACC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAAC0B,KAAK,CAACxB,UAAU;YAC3F,IAAI6B;YACJ,IAAIJ,aAAa;gBACfI,cAAcX;YAChB,OAAO,IAAIT,WAAW;gBACpBoB,cAAc,MAAM,IAAI,CAACC,UAAU,CAAChD,MAAM0C,MAAMI,iBAAiBV;YACnE,OAAO;gBACLW,cAAc,MAAM,IAAI,CAACzB,OAAO,CAACtB,MAAM0C,MAAMI,iBAAiBV;YAChE;YACAX,IAAIwB,SAAS,CAACnC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAAC0B,KAAK,CAACnC,IAAI,EAAEwC,aAAa;gBAC9DG,QAAQP;gBACRQ,MAAMC,iBAAW,CAACV,KAAK;gBACvBW,QAAQP;gBACRQ,UAAU,CAACX;YACb;YACA,IAAID,SAAStB,0BAAU,CAACC,MAAM,IAAIqB,SAAStB,0BAAU,CAACG,OAAO,IAAImB,SAAStB,0BAAU,CAACmC,UAAU,EAAE;gBAC/FvB,SAAShB,KAAK,CAAC,GAAG0B,KAAK,WAAW,CAAC,CAAC,GAAGI,kBAAkB5C;YAC3D;QACF;QACA,OAAO8B;IACT;IAEA,MAAMwB,eAAexD,IAAe,EAAEyB,GAAiB,EAA6B;QAClF,MAAMO,WAAW,CAAC;QAClB,MAAM9B,cAAcC,IAAAA,wBAAgB;QACpC,IAAIsD;QACJ,+CAA+C;QAC/C,0CAA0C;QAC1C,IAAIzD,KAAKI,GAAG,IAAIJ,KAAKI,GAAG,GAAGF,aAAa;YACtCuD,yBAAyBzD,KAAKI,GAAG,GAAGF;QACtC,OAAO;YACL,IAAI,CAACG,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACkD,cAAc,CAACjD,IAAI,CAAC,SAAS,EAAEa,0BAAU,CAACG,OAAO,CAAC,6BAA6B,EAAEvB,KAAKQ,KAAK,CAAC,CAAC,CAAC;YACxH,MAAM,IAAIC,qBAAa,CAAC,qBAAqBC,kBAAU,CAACC,SAAS;QACnE;QACA,MAAMyB,YAAoBC,mBAAM,CAACC,UAAU;QAC3C,KAAK,MAAMI,QAAQD,iBAAW,CAAE;YAC9B,MAAMK,kBACJJ,SAAStB,0BAAU,CAACC,MAAM,GAAGR,IAAAA,oCAAyB,EAACC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACI,0BAAU,CAACC,MAAM,CAAC,CAACH,UAAU,IAAIuC;YACnH,MAAMV,cAAsBL,SAAStB,0BAAU,CAACwB,IAAI,GAAGR,YAAY,MAAM,IAAI,CAACd,OAAO,CAACtB,MAAM0C,MAAMI,iBAAiBV;YACnHX,IAAIwB,SAAS,CAACnC,gCAAa,CAACC,IAAI,CAACC,KAAK,CAAC0B,KAAK,CAACnC,IAAI,EAAEwC,aAAa;gBAC9DG,QAAQR,SAAStB,0BAAU,CAACwB,IAAI;gBAChCO,MAAMC,iBAAW,CAACV,KAAK;gBACvBW,QAAQP;gBACRQ,UAAUZ,SAAStB,0BAAU,CAACwB,IAAI;YACpC;YACA,IAAIF,SAAStB,0BAAU,CAACC,MAAM,IAAIqB,SAAStB,0BAAU,CAACG,OAAO,EAAE;gBAC7DS,QAAQ,CAAC,GAAGU,KAAK,WAAW,CAAC,CAAC,GAAGI,kBAAkB5C;YACrD;QACF;QACA,OAAO8B;IACT;IAEA,MAAM0B,aAAajC,GAAiB,EAAE;QACpC,KAAK,MAAM,CAACiB,MAAMS,KAAK,IAAIQ,OAAOC,OAAO,CAACR,iBAAW,EAAG;YACtD3B,IAAIoC,WAAW,CAAC/C,gCAAa,CAACC,IAAI,CAACC,KAAK,CAAC0B,KAAK,CAACnC,IAAI,EAAE;gBAAE4C,MAAMA;gBAAMG,UAAUZ,SAAStB,0BAAU,CAACwB,IAAI;YAAC;QACxG;IACF;IAEAkB,eAAeC,GAAmB,EAAEC,UAAsB,EAAEtB,IAA4C,EAAQ;QAC9G,sBAAsB;QACtB,IAAIuB,gDAAyB,CAACC,GAAG,CAACH,IAAII,MAAM,GAAG;YAC7C;QACF;QAEA,iDAAiD;QACjD,IAAI,OAAOJ,IAAIK,OAAO,KAAK,YAAYL,IAAIK,OAAO,CAACtD,gCAAa,CAACC,IAAI,CAACC,KAAK,CAAC0B,KAAK,CAACnC,IAAI,CAAC,KAAK8D,WAAW;YACrG;QACF;QAEA,IAAI,CAACL,WAAWM,IAAI,EAAE;YACpB,IAAI,CAACjE,MAAM,CAACkE,IAAI,CAAC,GAAG,IAAI,CAACT,cAAc,CAACvD,IAAI,CAAC,GAAG,EAAEiE,gBAAU,CAACC,WAAW,EAAE;YAC1E,MAAM,IAAIhE,qBAAa,CAAC+D,gBAAU,CAACC,WAAW,EAAE/D,kBAAU,CAACC,SAAS;QACtE;QAEA,IAAI,CAACoD,IAAIW,OAAO,CAACC,cAAQ,CAAC,EAAE;YAC1B,IAAI,CAACtE,MAAM,CAACkE,IAAI,CAAC,GAAG,IAAI,CAACT,cAAc,CAACvD,IAAI,CAAC,GAAG,EAAEiE,gBAAU,CAACI,eAAe,EAAE;YAC9E,MAAM,IAAInE,qBAAa,CAAC+D,gBAAU,CAACI,eAAe,EAAElE,kBAAU,CAACC,SAAS;QAC1E;QAEA,MAAMkE,aAA2BC,IAAAA,cAAM,EAACf,IAAIW,OAAO,CAACC,cAAQ,CAAC,EAAY7D,gCAAa,CAACC,IAAI,CAACC,KAAK,CAACsD,IAAI,CAACS,MAAM;QAC7G,IAAIf,WAAWM,IAAI,KAAKO,WAAWG,KAAK,EAAE;YACxC,IAAI,CAAC3E,MAAM,CAACkE,IAAI,CAAC,GAAG,IAAI,CAACT,cAAc,CAACvD,IAAI,CAAC,GAAG,EAAEiE,gBAAU,CAACS,QAAQ,EAAE;YACvE,MAAM,IAAIxE,qBAAa,CAAC+D,gBAAU,CAACS,QAAQ,EAAEvE,kBAAU,CAACC,SAAS;QACnE;IACF;IAEQW,QAAQtB,IAAe,EAAE0C,IAAgB,EAAExB,UAAkB,EAAEkB,SAAkB,EAAmB;QAC1G,OAAO,IAAI,CAAC8C,GAAG,CAACC,SAAS,CACvB;YACEC,UAAU;gBACRC,IAAIrF,KAAKqF,EAAE;gBACX7E,OAAOR,KAAKQ,KAAK;gBACjB8E,OAAOtF,KAAKsF,KAAK;gBACjBC,UAAUvF,KAAKuF,QAAQ;gBACvBC,UAAUxF,KAAKwF,QAAQ;gBACvBC,MAAMzF,KAAKyF,IAAI;gBACfC,cAAc1F,KAAK0F,YAAY;gBAC/BC,oBAAoB3F,KAAK2F,kBAAkB,IAAItB;gBAC/CuB,sBAAsB5F,KAAK4F,oBAAoB,IAAIvB;gBACnDwB,UAAU7F,KAAK6F,QAAQ,IAAIxB;gBAC3BtC,cAAc/B,KAAK+B,YAAY,IAAIsC;YACrC;YACA,GAAI,AAAC3B,CAAAA,SAAStB,0BAAU,CAACC,MAAM,IAAIqB,SAAStB,0BAAU,CAACG,OAAO,AAAD,KAAM;gBAAE+C,MAAMlC;YAAU,CAAC;QACxF,GACA;YACE2C,QAAQjE,gCAAa,CAACC,IAAI,CAACC,KAAK,CAAC0B,KAAK,CAACqC,MAAM;YAC7Ce,WAAW5E;QACb;IAEJ;IAEQ8B,WAAWhD,IAAe,EAAE0C,IAAgB,EAAExB,UAAkB,EAAEkB,SAAiB,EAAmB;QAC5G,mEAAmE;QACnE,OAAO,IAAI,CAAC8C,GAAG,CAACC,SAAS,CACvB;YACEC,UAAU;gBACRC,IAAIrF,KAAKqF,EAAE;gBACX7E,OAAOR,KAAKQ,KAAK;gBACjBgF,UAAUxF,KAAKwF,QAAQ;gBACvBC,MAAMzF,KAAKyF,IAAI;gBACf1D,cAAc;YAChB;YACAuC,MAAMlC;QACR,GACA;YACE2C,QAAQjE,gCAAa,CAACC,IAAI,CAACC,KAAK,CAAC0B,KAAK,CAACqC,MAAM;YAC7Ce,WAAW5E;QACb;IAEJ;IA9JA,YAAY,AAAiBgE,GAAe,CAAE;aAAjBA,MAAAA;aAFZ7E,SAAS,IAAI0F,cAAM,CAACjG,YAAYS,IAAI;IAEN;AA+JjD"}

package/server/authentication/services/auth-methods/auth-method-database.service.js

@@ -25,19 +25,19 @@ function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 let AuthMethodDatabase = class AuthMethodDatabase {
-    async validateUser(loginOrEmail, password, ip) {
+    async validateUser(loginOrEmail, password, ip, scope) {
         let user;
         try {
             user = await this.usersManager.findUser(loginOrEmail, false);
         } catch (e) {
             this.logger.error(`${this.validateUser.name} - ${e}`);
-            throw new _common.HttpException(_appconstants.CONNECT_ERROR_CODE.has(e.cause?.code) ? 'Authentication service error' : e.message, _common.HttpStatus.INTERNAL_SERVER_ERROR);
+            throw new _common.HttpException(_appconstants.CONNECT_ERROR_CODE.has(e.cause?.code) ? 'Authentication service error' : e.cause?.code || e.message, _common.HttpStatus.INTERNAL_SERVER_ERROR);
         }
         if (!user) {
             this.logger.warn(`${this.validateUser.name} - login or email not found for *${loginOrEmail}*`);
             return null;
         }
-        return await this.usersManager.logUser(user, password, ip);
+        return await this.usersManager.logUser(user, password, ip, scope);
     }
     constructor(usersManager){
         this.usersManager = usersManager;

package/server/authentication/services/auth-methods/auth-method-database.service.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../backend/src/authentication/services/auth-methods/auth-method-database.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { CONNECT_ERROR_CODE } from '../../../app.constants'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { AuthMethod } from '../../models/auth-method'\n\n@Injectable()\nexport class AuthMethodDatabase implements AuthMethod {\n  private readonly logger = new Logger(AuthMethodDatabase.name)\n\n  constructor(private readonly usersManager: UsersManager) {}\n\n  async validateUser(loginOrEmail: string, password: string, ip?: string): Promise<UserModel> {\n    let user: UserModel\n    try {\n      user = await this.usersManager.findUser(loginOrEmail, false)\n    } catch (e) {\n      this.logger.error(`${this.validateUser.name} - ${e}`)\n      throw new HttpException(CONNECT_ERROR_CODE.has(e.cause?.code) ? 'Authentication service error' : e.message, HttpStatus.INTERNAL_SERVER_ERROR)\n    }\n    if (!user) {\n      this.logger.warn(`${this.validateUser.name} - login or email not found for *${loginOrEmail}*`)\n      return null\n    }\n    return await this.usersManager.logUser(user, password, ip)\n  }\n}\n"],"names":["AuthMethodDatabase","validateUser","loginOrEmail","password","ip","user","usersManager","findUser","e","logger","error","name","HttpException","CONNECT_ERROR_CODE","has","cause","code","message","HttpStatus","INTERNAL_SERVER_ERROR","warn","logUser","Logger"],"mappings":"AAAA;;;;CAIC;;;;+BASYA;;;eAAAA;;;wBAPiD;8BAC3B;qCAEN;;;;;;;;;;AAItB,IAAA,AAAMA,qBAAN,MAAMA;IAKX,MAAMC,aAAaC,YAAoB,EAAEC,QAAgB,EAAEC,EAAW,EAAsB;QAC1F,IAAIC;QACJ,IAAI;YACFA,OAAO,MAAM,IAAI,CAACC,YAAY,CAACC,QAAQ,CAACL,cAAc;QACxD,EAAE,OAAOM,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACT,YAAY,CAACU,IAAI,CAAC,GAAG,EAAEH,GAAG;YACpD,MAAM,IAAII,qBAAa,CAACC,gCAAkB,CAACC,GAAG,CAACN,EAAEO,KAAK,EAAEC,QAAQ,iCAAiCR,EAAES,OAAO,EAAEC,kBAAU,CAACC,qBAAqB;QAC9I;QACA,IAAI,CAACd,MAAM;YACT,IAAI,CAACI,MAAM,CAACW,IAAI,CAAC,GAAG,IAAI,CAACnB,YAAY,CAACU,IAAI,CAAC,iCAAiC,EAAET,aAAa,CAAC,CAAC;YAC7F,OAAO;QACT;QACA,OAAO,MAAM,IAAI,CAACI,YAAY,CAACe,OAAO,CAAChB,MAAMF,UAAUC;IACzD;IAfA,YAAY,AAAiBE,YAA0B,CAAE;aAA5BA,eAAAA;aAFZG,SAAS,IAAIa,cAAM,CAACtB,mBAAmBW,IAAI;IAEF;AAgB5D"}
+{"version":3,"sources":["../../../../../backend/src/authentication/services/auth-methods/auth-method-database.service.ts"],"sourcesContent":["/*\n * Copyright (C) 2012-2025 Johan Legrand <johan.legrand@sync-in.com>\n * This file is part of Sync-in | The open source file sync and share solution\n * See the LICENSE file for licensing details\n */\n\nimport { HttpException, HttpStatus, Injectable, Logger } from '@nestjs/common'\nimport { CONNECT_ERROR_CODE } from '../../../app.constants'\nimport { UserModel } from '../../../applications/users/models/user.model'\nimport { UsersManager } from '../../../applications/users/services/users-manager.service'\nimport { AUTH_SCOPE } from '../../constants/scope'\nimport { AuthMethod } from '../../models/auth-method'\n\n@Injectable()\nexport class AuthMethodDatabase implements AuthMethod {\n  private readonly logger = new Logger(AuthMethodDatabase.name)\n\n  constructor(private readonly usersManager: UsersManager) {}\n\n  async validateUser(loginOrEmail: string, password: string, ip?: string, scope?: AUTH_SCOPE): Promise<UserModel> {\n    let user: UserModel\n    try {\n      user = await this.usersManager.findUser(loginOrEmail, false)\n    } catch (e) {\n      this.logger.error(`${this.validateUser.name} - ${e}`)\n      throw new HttpException(\n        CONNECT_ERROR_CODE.has(e.cause?.code) ? 'Authentication service error' : e.cause?.code || e.message,\n        HttpStatus.INTERNAL_SERVER_ERROR\n      )\n    }\n    if (!user) {\n      this.logger.warn(`${this.validateUser.name} - login or email not found for *${loginOrEmail}*`)\n      return null\n    }\n    return await this.usersManager.logUser(user, password, ip, scope)\n  }\n}\n"],"names":["AuthMethodDatabase","validateUser","loginOrEmail","password","ip","scope","user","usersManager","findUser","e","logger","error","name","HttpException","CONNECT_ERROR_CODE","has","cause","code","message","HttpStatus","INTERNAL_SERVER_ERROR","warn","logUser","Logger"],"mappings":"AAAA;;;;CAIC;;;;+BAUYA;;;eAAAA;;;wBARiD;8BAC3B;qCAEN;;;;;;;;;;AAKtB,IAAA,AAAMA,qBAAN,MAAMA;IAKX,MAAMC,aAAaC,YAAoB,EAAEC,QAAgB,EAAEC,EAAW,EAAEC,KAAkB,EAAsB;QAC9G,IAAIC;QACJ,IAAI;YACFA,OAAO,MAAM,IAAI,CAACC,YAAY,CAACC,QAAQ,CAACN,cAAc;QACxD,EAAE,OAAOO,GAAG;YACV,IAAI,CAACC,MAAM,CAACC,KAAK,CAAC,GAAG,IAAI,CAACV,YAAY,CAACW,IAAI,CAAC,GAAG,EAAEH,GAAG;YACpD,MAAM,IAAII,qBAAa,CACrBC,gCAAkB,CAACC,GAAG,CAACN,EAAEO,KAAK,EAAEC,QAAQ,iCAAiCR,EAAEO,KAAK,EAAEC,QAAQR,EAAES,OAAO,EACnGC,kBAAU,CAACC,qBAAqB;QAEpC;QACA,IAAI,CAACd,MAAM;YACT,IAAI,CAACI,MAAM,CAACW,IAAI,CAAC,GAAG,IAAI,CAACpB,YAAY,CAACW,IAAI,CAAC,iCAAiC,EAAEV,aAAa,CAAC,CAAC;YAC7F,OAAO;QACT;QACA,OAAO,MAAM,IAAI,CAACK,YAAY,CAACe,OAAO,CAAChB,MAAMH,UAAUC,IAAIC;IAC7D;IAlBA,YAAY,AAAiBE,YAA0B,CAAE;aAA5BA,eAAAA;aAFZG,SAAS,IAAIa,cAAM,CAACvB,mBAAmBY,IAAI;IAEF;AAmB5D"}

package/server/authentication/services/auth-methods/auth-method-database.service.spec.js

@@ -8,6 +8,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 const _testing = require("@nestjs/testing");
 const _appconstants = require("../../../app.constants");
+const _notificationsmanagerservice = require("../../../applications/notifications/services/notifications-manager.service");
 const _usermodel = require("../../../applications/users/models/user.model");
 const _adminusersmanagerservice = require("../../../applications/users/services/admin-users-manager.service");
 const _adminusersqueriesservice = require("../../../applications/users/services/admin-users-queries.service");
@@ -42,6 +43,10 @@ describe(_authmethoddatabaseservice.AuthMethodDatabase.name, ()=>{
                 {
                     provide: _cacheservice.Cache,
                     useValue: {}
+                },
+                {
+                    provide: _notificationsmanagerservice.NotificationsManager,
+                    useValue: {}
                 }
             ]
         }).compile();