@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/account/account.controller.d.ts

@@ -0,0 +1,259 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RequestContext } from '../../common/request-context.js';
+import { RateLimiterService } from '../../common/rate-limiter.service.js';
+import { AccessTokenClaims } from '../sessions/session.types.js';
+import { SessionService } from '../sessions/session.service.js';
+import { SettingsService } from '../settings/settings.service.js';
+import { SignInService } from '../sign-in/sign-in.service.js';
+import { SignInMethodsService } from '../users/sign-in-methods.service.js';
+import { UsersService } from '../users/users.service.js';
+import { ReactivateAccountInput, RefreshTokenInput, UpdateMyProfileInput } from './account.dto';
+import { DataExportService } from './data-export.service';
+import { HealthService } from './health.service';
+/** The parts of the raw HTTP request read by the cookie refresh. */
+type HttpRequestWithHeaders = {
+    headers: Record<string, string | string[] | undefined>;
+};
+/**
+ * The signed-in user's own account: tokens, profile, devices, deactivate / delete.
+ *
+ *   POST   /auth/refresh            new tokens from a refresh token
+ *   POST   /auth/logout             sign out this device
+ *   POST   /auth/logout-all         sign out every device
+ *   GET    /auth/me                 profile
+ *   PATCH  /auth/me                 change name / app fields
+ *   GET    /auth/sign-in-methods    password? Google? passkeys?
+ *   GET    /auth/sessions           signed-in devices
+ *   DELETE /auth/sessions/:id       sign out one device
+ *   POST   /auth/deactivate         switch account off (reversible)
+ *   POST   /auth/reactivate         switch it back on
+ *   DELETE /auth/me                 delete account (permanent)
+ *   GET    /auth/me/export          download my data (JSON)
+ *   GET    /auth/health             database / Redis reachable (public)
+ */
+export declare class AccountController {
+    private readonly settingsService;
+    private readonly users;
+    private readonly sessions;
+    private readonly signIn;
+    private readonly signInMethods;
+    private readonly rateLimiter;
+    private readonly dataExport;
+    private readonly healthService;
+    private readonly options;
+    constructor(settingsService: SettingsService, users: UsersService, sessions: SessionService, signIn: SignInService, signInMethods: SignInMethodsService, rateLimiter: RateLimiterService, dataExport: DataExportService, healthService: HealthService, options: AuthOptions);
+    /**
+     * POST /auth/refresh — Swaps a refresh token for new tokens. Public.
+     *
+     * The refresh token comes from the body or, with AuthOptions.refreshTokenCookie, from the
+     * HttpOnly cookie (then the request must come from one of the allowed origins).
+     *
+     * @param body - `{ refreshToken }`, or empty when the cookie is used.
+     * @param request - Who is asking (for rate limits).
+     * @param httpRequest - The raw request, to read the cookie and Origin header.
+     * @returns A new access token and refresh token.
+     */
+    refresh(body: RefreshTokenInput, request: RequestContext, httpRequest: HttpRequestWithHeaders): Promise<{
+        accessToken: string;
+        expiresIn: number;
+        refreshToken: string;
+        refreshTokenExpiresAt: string;
+        sessionId: string;
+        success: boolean;
+    }>;
+    /**
+     * POST /auth/logout — Signs out this device and clears the refresh token cookie.
+     *
+     * @param user - The access token's claims (user id and session id).
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    logout(user: AccessTokenClaims, request: RequestContext): Promise<{
+        success: boolean;
+        message: "You have been signed out.";
+    }>;
+    /**
+     * POST /auth/logout-all — Signs out every device, this one included.
+     *
+     * @param user - The access token's claims.
+     * @param request - Who is asking.
+     * @returns A success message and how many sessions were ended.
+     */
+    logoutEverywhere(user: AccessTokenClaims, request: RequestContext): Promise<{
+        success: boolean;
+        message: "You have been signed out on all devices.";
+        endedSessions: number;
+    }>;
+    /**
+     * GET /auth/me — The signed-in user's profile.
+     *
+     * @param userId - From the access token.
+     * @returns The public profile.
+     */
+    getMe(userId: string): Promise<{
+        success: boolean;
+        user: import("../..").PublicUserProfile;
+    }>;
+    /**
+     * PATCH /auth/me — Changes the signed-in user's names or metadata.
+     *
+     * @param userId - From the access token.
+     * @param body - The fields to change.
+     * @param request - Who is asking.
+     * @returns The updated public profile.
+     */
+    updateMe(userId: string, body: UpdateMyProfileInput, request: RequestContext): Promise<{
+        success: boolean;
+        user: import("../..").PublicUserProfile;
+    }>;
+    /**
+     * GET /auth/sign-in-methods — Every way the user can currently sign in.
+     *
+     * @param userId - From the access token.
+     * @returns Password, codes, social accounts and passkey count.
+     */
+    getSignInMethods(userId: string): Promise<{
+        success: boolean;
+        signInMethods: import("../users/sign-in-methods.service.js").UserSignInMethods;
+    }>;
+    /**
+     * GET /auth/sessions — The user's signed-in devices, with this one marked `isCurrentDevice`.
+     *
+     * @param user - The access token's claims (user id and session id).
+     * @returns The devices, most recently used first.
+     */
+    listSessions(user: AccessTokenClaims): Promise<{
+        success: boolean;
+        sessions: {
+            id: string;
+            isCurrentDevice: boolean;
+            signInMethod: string;
+            ipAddress: string | null;
+            userAgent: string | null;
+            createdAt: string;
+            lastUsedAt: string;
+        }[];
+    }>;
+    /**
+     * DELETE /auth/sessions/:sessionId — Signs out one of the user's devices.
+     *
+     * @param userId - From the access token.
+     * @param sessionId - From the URL.
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the session isn't the user's or has already ended.
+     */
+    revokeSession(userId: string, sessionId: string): Promise<{
+        success: boolean;
+    }>;
+    /**
+     * POST /auth/deactivate — Switches the account off and signs out everywhere.
+     * Signing in again offers to reactivate it.
+     *
+     * @param userId - From the access token.
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    deactivate(userId: string, request: RequestContext): Promise<{
+        success: boolean;
+        message: "Your account has been deactivated. Sign in again at any time to reactivate it.";
+    }>;
+    /**
+     * POST /auth/reactivate — Switches a deactivated account back on and signs in. Public.
+     *
+     * @param body - `{ reactivationToken }` from the ACCOUNT_DEACTIVATED error.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    reactivate(body: ReactivateAccountInput, request: RequestContext): Promise<import("../..").SignInResult>;
+    /**
+     * GET /auth/me/export — Everything stored about the signed-in user, as JSON ("download my data").
+     *
+     * @param userId - From the access token.
+     * @returns See `DataExportService.exportUserData`.
+     */
+    exportMyData(userId: string): Promise<{
+        success: true;
+        exportedAt: string;
+        profile: {
+            termsAcceptedAt: string | null;
+            privacyPolicyAcceptedAt: string | null;
+            onboardingCompletedAt: string | null;
+            updatedAt: string;
+            id: string;
+            email: string | null;
+            isEmailVerified: boolean;
+            phoneNumber: string | null;
+            isPhoneVerified: boolean;
+            firstName: string | null;
+            lastName: string | null;
+            roles: string[];
+            status: import("../../constants.js").AccountStatus;
+            pendingVerifications: import("../../constants.js").PendingVerification[];
+            onboardingCompleted: boolean;
+            isTwoFactorEnabled: boolean;
+            metadata: import("../..").JsonObject;
+            lastSignedInAt: string | null;
+            createdAt: string;
+        };
+        signInMethods: import("../users/sign-in-methods.service.js").UserSignInMethods;
+        linkedAccounts: {
+            provider: import("../../constants.js").SocialProvider;
+            email: string | null;
+            linkedAt: string;
+        }[];
+        passkeys: {
+            name: string;
+            createdAt: string;
+            lastUsedAt: string | null;
+        }[];
+        devices: {
+            signInMethod: string;
+            ipAddress: string | null;
+            userAgent: string | null;
+            signedInAt: string;
+            lastUsedAt: string;
+            endedAt: string | null;
+        }[];
+        organizations: {
+            name: string | null;
+            role: import("../../constants.js").OrganizationRole;
+            joinedAt: string;
+        }[];
+        securityHistory: {
+            event: string;
+            ipAddress: string | null;
+            userAgent: string | null;
+            details: import("../..").JsonObject;
+            at: string;
+        }[];
+    }>;
+    /**
+     * GET /auth/health — For load balancers and uptime checks: 200 when the database (and Redis, if
+     * used) answer, 503 otherwise. Says nothing about users. Public.
+     *
+     * @param response - Used only to set the 503 status.
+     * @returns The overall status and each check's result.
+     */
+    health(response: {
+        status: (code: number) => unknown;
+    }): Promise<{
+        success: boolean;
+        status: "error" | "ok";
+        checks: {
+            database: import("../../constants.js").HealthStatus;
+            redis: import("../../constants.js").HealthStatus;
+        };
+    }>;
+    /**
+     * DELETE /auth/me — Deletes the signed-in user's account. This cannot be undone.
+     *
+     * @param userId - From the access token.
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    deleteMe(userId: string, request: RequestContext): Promise<{
+        success: boolean;
+        message: "Your account has been deleted.";
+    }>;
+}
+export {};

package/dist/features/account/account.controller.js

@@ -0,0 +1,372 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccountController = void 0;
+const common_1 = require("@nestjs/common");
+const auth_error_1 = require("../../common/auth-error.js");
+const strict_validation_pipe_1 = require("../../common/strict-validation.pipe.js");
+const request_context_1 = require("../../common/request-context.js");
+const constants_1 = require("../../constants.js");
+const rate_limiter_service_1 = require("../../common/rate-limiter.service.js");
+const auth_decorators_1 = require("../../guards/auth.decorators.js");
+const session_service_1 = require("../sessions/session.service.js");
+const settings_service_1 = require("../settings/settings.service.js");
+const sign_in_service_1 = require("../sign-in/sign-in.service.js");
+const sign_in_methods_service_1 = require("../users/sign-in-methods.service.js");
+const users_service_1 = require("../users/users.service.js");
+const account_dto_1 = require("./account.dto");
+const data_export_service_1 = require("./data-export.service");
+const health_service_1 = require("./health.service");
+const refresh_token_cookie_1 = require("../../common/refresh-token-cookie.js");
+/**
+ * The signed-in user's own account: tokens, profile, devices, deactivate / delete.
+ *
+ *   POST   /auth/refresh            new tokens from a refresh token
+ *   POST   /auth/logout             sign out this device
+ *   POST   /auth/logout-all         sign out every device
+ *   GET    /auth/me                 profile
+ *   PATCH  /auth/me                 change name / app fields
+ *   GET    /auth/sign-in-methods    password? Google? passkeys?
+ *   GET    /auth/sessions           signed-in devices
+ *   DELETE /auth/sessions/:id       sign out one device
+ *   POST   /auth/deactivate         switch account off (reversible)
+ *   POST   /auth/reactivate         switch it back on
+ *   DELETE /auth/me                 delete account (permanent)
+ *   GET    /auth/me/export          download my data (JSON)
+ *   GET    /auth/health             database / Redis reachable (public)
+ */
+let AccountController = class AccountController {
+    settingsService;
+    users;
+    sessions;
+    signIn;
+    signInMethods;
+    rateLimiter;
+    dataExport;
+    healthService;
+    options;
+    constructor(settingsService, users, sessions, signIn, signInMethods, rateLimiter, dataExport, healthService, options) {
+        this.settingsService = settingsService;
+        this.users = users;
+        this.sessions = sessions;
+        this.signIn = signIn;
+        this.signInMethods = signInMethods;
+        this.rateLimiter = rateLimiter;
+        this.dataExport = dataExport;
+        this.healthService = healthService;
+        this.options = options;
+    }
+    /**
+     * POST /auth/refresh — Swaps a refresh token for new tokens. Public.
+     *
+     * The refresh token comes from the body or, with AuthOptions.refreshTokenCookie, from the
+     * HttpOnly cookie (then the request must come from one of the allowed origins).
+     *
+     * @param body - `{ refreshToken }`, or empty when the cookie is used.
+     * @param request - Who is asking (for rate limits).
+     * @param httpRequest - The raw request, to read the cookie and Origin header.
+     * @returns A new access token and refresh token.
+     */
+    async refresh(body, request, httpRequest) {
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.refreshPerIp(request.ipAddress), constants_1.RATE_LIMITS.refreshPerIp);
+        let refreshToken = body.refreshToken;
+        const cookieOptions = this.options.refreshTokenCookie;
+        if (refreshToken === undefined && cookieOptions) {
+            (0, refresh_token_cookie_1.assertAllowedOrigin)(cookieOptions, httpRequest);
+            refreshToken = (0, refresh_token_cookie_1.readRefreshCookie)(cookieOptions, httpRequest);
+        }
+        const tokens = await this.sessions.refreshSession(refreshToken, request, await this.settingsService.getSettings());
+        return { success: true, ...tokens };
+    }
+    /**
+     * POST /auth/logout — Signs out this device and clears the refresh token cookie.
+     *
+     * @param user - The access token's claims (user id and session id).
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    async logout(user, request) {
+        await this.signIn.signOut(user.sub, user.sid, request);
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.signedOut };
+    }
+    /**
+     * POST /auth/logout-all — Signs out every device, this one included.
+     *
+     * @param user - The access token's claims.
+     * @param request - Who is asking.
+     * @returns A success message and how many sessions were ended.
+     */
+    async logoutEverywhere(user, request) {
+        const endedSessions = await this.signIn.signOutEverywhere(user.sub, request);
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.signedOutEverywhere, endedSessions };
+    }
+    /**
+     * GET /auth/me — The signed-in user's profile.
+     *
+     * @param userId - From the access token.
+     * @returns The public profile.
+     */
+    async getMe(userId) {
+        const settings = await this.settingsService.getSettings();
+        return { success: true, user: this.users.toPublicProfile(await this.users.getUserOrThrow(userId), settings) };
+    }
+    /**
+     * PATCH /auth/me — Changes the signed-in user's names or metadata.
+     *
+     * @param userId - From the access token.
+     * @param body - The fields to change.
+     * @param request - Who is asking.
+     * @returns The updated public profile.
+     */
+    async updateMe(userId, body, request) {
+        const settings = await this.settingsService.getSettings();
+        const user = await this.users.updateProfile(userId, body, null, request);
+        return { success: true, user: this.users.toPublicProfile(user, settings) };
+    }
+    /**
+     * GET /auth/sign-in-methods — Every way the user can currently sign in.
+     *
+     * @param userId - From the access token.
+     * @returns Password, codes, social accounts and passkey count.
+     */
+    async getSignInMethods(userId) {
+        const settings = await this.settingsService.getSettings();
+        const user = await this.users.getUserOrThrow(userId);
+        return { success: true, signInMethods: await this.signInMethods.listSignInMethods(user, settings) };
+    }
+    /**
+     * GET /auth/sessions — The user's signed-in devices, with this one marked `isCurrentDevice`.
+     *
+     * @param user - The access token's claims (user id and session id).
+     * @returns The devices, most recently used first.
+     */
+    async listSessions(user) {
+        const sessions = await this.sessions.listActiveSessions(user.sub);
+        return {
+            success: true,
+            sessions: sessions.map((session) => ({
+                id: session.id,
+                isCurrentDevice: session.id === user.sid,
+                signInMethod: session.signInMethod,
+                ipAddress: session.ipAddress,
+                userAgent: session.userAgent,
+                createdAt: session.createdAt.toISOString(),
+                lastUsedAt: session.lastUsedAt.toISOString(),
+            })),
+        };
+    }
+    /**
+     * DELETE /auth/sessions/:sessionId — Signs out one of the user's devices.
+     *
+     * @param userId - From the access token.
+     * @param sessionId - From the URL.
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the session isn't the user's or has already ended.
+     */
+    async revokeSession(userId, sessionId) {
+        const wasRevoked = await this.sessions.revokeSession(sessionId, constants_1.SESSION_END_REASON.signedOutByUser, userId);
+        if (!wasRevoked)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        return { success: true };
+    }
+    /**
+     * POST /auth/deactivate — Switches the account off and signs out everywhere.
+     * Signing in again offers to reactivate it.
+     *
+     * @param userId - From the access token.
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    async deactivate(userId, request) {
+        await this.users.deactivateAccount(userId, request);
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.accountDeactivated };
+    }
+    /**
+     * POST /auth/reactivate — Switches a deactivated account back on and signs in. Public.
+     *
+     * @param body - `{ reactivationToken }` from the ACCOUNT_DEACTIVATED error.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    async reactivate(body, request) {
+        return this.signIn.reactivateAndSignIn(body.reactivationToken, request, await this.settingsService.getSettings());
+    }
+    /**
+     * GET /auth/me/export — Everything stored about the signed-in user, as JSON ("download my data").
+     *
+     * @param userId - From the access token.
+     * @returns See `DataExportService.exportUserData`.
+     */
+    exportMyData(userId) {
+        return this.dataExport.exportUserData(userId);
+    }
+    /**
+     * GET /auth/health — For load balancers and uptime checks: 200 when the database (and Redis, if
+     * used) answer, 503 otherwise. Says nothing about users. Public.
+     *
+     * @param response - Used only to set the 503 status.
+     * @returns The overall status and each check's result.
+     */
+    async health(response) {
+        const report = await this.healthService.check();
+        if (!report.isHealthy)
+            response.status(constants_1.HEALTH_SERVICE_UNAVAILABLE_STATUS);
+        return { success: report.isHealthy, status: report.isHealthy ? constants_1.HEALTH_STATUS.ok : constants_1.HEALTH_STATUS.error, checks: report.checks };
+    }
+    /**
+     * DELETE /auth/me — Deletes the signed-in user's account. This cannot be undone.
+     *
+     * @param userId - From the access token.
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    async deleteMe(userId, request) {
+        await this.users.deleteUser(userId, null, request);
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.accountDeleted };
+    }
+};
+exports.AccountController = AccountController;
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.refresh),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __param(2, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [account_dto_1.RefreshTokenInput, Object, Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "refresh", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.logout),
+    (0, refresh_token_cookie_1.ClearsRefreshTokenCookie)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, auth_decorators_1.CurrentUser)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "logout", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.logoutAll),
+    (0, refresh_token_cookie_1.ClearsRefreshTokenCookie)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, auth_decorators_1.CurrentUser)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "logoutEverywhere", null);
+__decorate([
+    (0, common_1.Get)(constants_1.ROUTES.auth.me),
+    (0, auth_decorators_1.CheckSession)(),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "getMe", null);
+__decorate([
+    (0, common_1.Patch)(constants_1.ROUTES.auth.me),
+    (0, auth_decorators_1.CheckSession)(),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, account_dto_1.UpdateMyProfileInput, Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "updateMe", null);
+__decorate([
+    (0, common_1.Get)(constants_1.ROUTES.auth.signInMethods),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "getSignInMethods", null);
+__decorate([
+    (0, common_1.Get)(constants_1.ROUTES.auth.sessions),
+    __param(0, (0, auth_decorators_1.CurrentUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "listSessions", null);
+__decorate([
+    (0, common_1.Delete)(constants_1.ROUTES.auth.session),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __param(1, (0, common_1.Param)(constants_1.ROUTE_PARAM.sessionId, new common_1.ParseUUIDPipe())),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "revokeSession", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.deactivate),
+    (0, refresh_token_cookie_1.ClearsRefreshTokenCookie)(),
+    (0, auth_decorators_1.CheckSession)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "deactivate", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.reactivate),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [account_dto_1.ReactivateAccountInput, Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "reactivate", null);
+__decorate([
+    (0, common_1.Get)(constants_1.ROUTES.auth.exportMyData),
+    (0, auth_decorators_1.CheckSession)(),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", void 0)
+], AccountController.prototype, "exportMyData", null);
+__decorate([
+    (0, common_1.Get)(constants_1.ROUTES.auth.health),
+    (0, auth_decorators_1.Public)(),
+    __param(0, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "health", null);
+__decorate([
+    (0, common_1.Delete)(constants_1.ROUTES.auth.me),
+    (0, refresh_token_cookie_1.ClearsRefreshTokenCookie)(),
+    (0, auth_decorators_1.CheckSession)(),
+    __param(0, (0, auth_decorators_1.CurrentUserId)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], AccountController.prototype, "deleteMe", null);
+exports.AccountController = AccountController = __decorate([
+    (0, common_1.Controller)(constants_1.ROUTES.auth.prefix),
+    (0, refresh_token_cookie_1.LibraryController)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.strictValidationPipe),
+    __param(8, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [settings_service_1.SettingsService,
+        users_service_1.UsersService,
+        session_service_1.SessionService,
+        sign_in_service_1.SignInService,
+        sign_in_methods_service_1.SignInMethodsService,
+        rate_limiter_service_1.RateLimiterService,
+        data_export_service_1.DataExportService,
+        health_service_1.HealthService, Object])
+], AccountController);
+//# sourceMappingURL=account.controller.js.map

package/dist/features/account/account.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.controller.js","sourceRoot":"","sources":["../../../src/features/account/account.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoJ;AAEpJ,oDAAgD;AAChD,4EAAuE;AACvE,8DAA0E;AAC1E,2CAWqB;AACrB,wEAAmE;AACnE,8DAA4F;AAE5F,yEAAqE;AACrE,2EAAuE;AACvE,wEAAmE;AACnE,sFAAgF;AAChF,kEAA8D;AAC9D,+CAAgG;AAChG,+DAA0D;AAC1D,qDAAiD;AACjD,wEAKuC;AAKvC;;;;;;;;;;;;;;;;GAgBG;AAII,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAC4B;IAT/C,YACmB,eAAgC,EAChC,KAAmB,EACnB,QAAwB,EACxB,MAAqB,EACrB,aAAmC,EACnC,WAA+B,EAC/B,UAA6B,EAC7B,aAA4B,EACA,OAAoB;QARhD,oBAAe,GAAf,eAAe,CAAiB;QAChC,UAAK,GAAL,KAAK,CAAc;QACnB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAe;QACrB,kBAAa,GAAb,aAAa,CAAsB;QACnC,gBAAW,GAAX,WAAW,CAAoB;QAC/B,eAAU,GAAV,UAAU,CAAmB;QAC7B,kBAAa,GAAb,aAAa,CAAe;QACA,YAAO,GAAP,OAAO,CAAa;IAChE,CAAC;IAEJ;;;;;;;;;;OAUG;IAIG,AAAN,KAAK,CAAC,OAAO,CAAS,IAAuB,EAAoB,OAAuB,EAAS,WAAmC;QAClI,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,YAAY,CAAC,CAAC;QACzG,IAAI,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACrC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACtD,IAAI,YAAY,KAAK,SAAS,IAAI,aAAa,EAAE,CAAC;YAChD,IAAA,0CAAmB,EAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YAChD,YAAY,GAAG,IAAA,wCAAiB,EAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;QACnH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;OAMG;IAIG,AAAN,KAAK,CAAC,MAAM,CAAgB,IAAuB,EAAoB,OAAuB;QAC5F,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,4BAAgB,CAAC,SAAS,EAAE,CAAC;IAChE,CAAC;IAED;;;;;;OAMG;IAIG,AAAN,KAAK,CAAC,gBAAgB,CAAgB,IAAuB,EAAoB,OAAuB;QACtG,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,4BAAgB,CAAC,mBAAmB,EAAE,aAAa,EAAE,CAAC;IACzF,CAAC;IAED;;;;;OAKG;IAGG,AAAN,KAAK,CAAC,KAAK,CAAkB,MAAc;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;IAChH,CAAC;IAED;;;;;;;OAOG;IAGG,AAAN,KAAK,CAAC,QAAQ,CAAkB,MAAc,EAAU,IAA0B,EAAoB,OAAuB;QAC3H,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,gBAAgB,CAAkB,MAAc;QACpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;IACtG,CAAC;IAED;;;;;OAKG;IAEG,AAAN,KAAK,CAAC,YAAY,CAAgB,IAAuB;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,eAAe,EAAE,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG;gBACxC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC1C,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;aAC7C,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,aAAa,CAAkB,MAAc,EAAqD,SAAiB;QACvH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,8BAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC5G,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IAKG,AAAN,KAAK,CAAC,UAAU,CAAkB,MAAc,EAAoB,OAAuB;QACzF,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,4BAAgB,CAAC,kBAAkB,EAAE,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IAIG,AAAN,KAAK,CAAC,UAAU,CAAS,IAA4B,EAAoB,OAAuB;QAC9F,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;IACpH,CAAC;IAED;;;;;OAKG;IAGH,YAAY,CAAkB,MAAc;QAC1C,OAAO,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;OAMG;IAGG,AAAN,KAAK,CAAC,MAAM,CAA6B,QAA+C;QACtF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,QAAQ,CAAC,MAAM,CAAC,6CAAiC,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAa,CAAC,EAAE,CAAC,CAAC,CAAC,yBAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACjI,CAAC;IAED;;;;;;OAMG;IAIG,AAAN,KAAK,CAAC,QAAQ,CAAkB,MAAc,EAAoB,OAAuB;QACvF,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,4BAAgB,CAAC,cAAc,EAAE,CAAC;IACrE,CAAC;CACF,CAAA;AA7NY,8CAAiB;AA2BtB;IAHL,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,OAAO,CAAC;IACzB,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;IAA2B,WAAA,IAAA,gCAAc,GAAE,CAAA;IAA2B,WAAA,IAAA,YAAG,GAAE,CAAA;;qCAApE,+BAAiB;;gDAU5C;AAYK;IAHL,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IACxB,IAAA,+CAAwB,GAAE;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACV,WAAA,IAAA,6BAAW,GAAE,CAAA;IAA2B,WAAA,IAAA,gCAAc,GAAE,CAAA;;;;+CAGrE;AAYK;IAHL,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,SAAS,CAAC;IAC3B,IAAA,+CAAwB,GAAE;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACA,WAAA,IAAA,6BAAW,GAAE,CAAA;IAA2B,WAAA,IAAA,gCAAc,GAAE,CAAA;;;;yDAG/E;AAUK;IAFL,IAAA,YAAG,EAAC,kBAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IACnB,IAAA,8BAAY,GAAE;IACF,WAAA,IAAA,+BAAa,GAAE,CAAA;;;;8CAG3B;AAYK;IAFL,IAAA,cAAK,EAAC,kBAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IACrB,IAAA,8BAAY,GAAE;IACC,WAAA,IAAA,+BAAa,GAAE,CAAA;IAAkB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,gCAAc,GAAE,CAAA;;6CAAvC,kCAAoB;;iDAIjF;AASK;IADL,IAAA,YAAG,EAAC,kBAAM,CAAC,IAAI,CAAC,aAAa,CAAC;IACP,WAAA,IAAA,+BAAa,GAAE,CAAA;;;;yDAItC;AASK;IADL,IAAA,YAAG,EAAC,kBAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IACN,WAAA,IAAA,6BAAW,GAAE,CAAA;;;;qDAchC;AAWK;IADL,IAAA,eAAM,EAAC,kBAAM,CAAC,IAAI,CAAC,OAAO,CAAC;IACP,WAAA,IAAA,+BAAa,GAAE,CAAA;IAAkB,WAAA,IAAA,cAAK,EAAC,uBAAW,CAAC,SAAS,EAAE,IAAI,sBAAa,EAAE,CAAC,CAAA;;;;sDAItG;AAcK;IAJL,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,UAAU,CAAC;IAC5B,IAAA,+CAAwB,GAAE;IAC1B,IAAA,8BAAY,GAAE;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACN,WAAA,IAAA,+BAAa,GAAE,CAAA;IAAkB,WAAA,IAAA,gCAAc,GAAE,CAAA;;;;mDAGlE;AAYK;IAHL,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,UAAU,CAAC;IAC5B,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACN,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAzC,oCAAsB;;mDAEpD;AAUD;IAFC,IAAA,YAAG,EAAC,kBAAM,CAAC,IAAI,CAAC,YAAY,CAAC;IAC7B,IAAA,8BAAY,GAAE;IACD,WAAA,IAAA,+BAAa,GAAE,CAAA;;;;qDAE5B;AAWK;IAFL,IAAA,YAAG,EAAC,kBAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IACvB,IAAA,wBAAM,GAAE;IACK,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;+CAIvC;AAYK;IAHL,IAAA,eAAM,EAAC,kBAAM,CAAC,IAAI,CAAC,EAAE,CAAC;IACtB,IAAA,+CAAwB,GAAE;IAC1B,IAAA,8BAAY,GAAE;IACC,WAAA,IAAA,+BAAa,GAAE,CAAA;IAAkB,WAAA,IAAA,gCAAc,GAAE,CAAA;;;;iDAGhE;4BA5NU,iBAAiB;IAH7B,IAAA,mBAAU,EAAC,kBAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IAC9B,IAAA,wCAAiB,GAAE;IACnB,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAW1B,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;qCARO,kCAAe;QACzB,4BAAY;QACT,gCAAc;QAChB,+BAAa;QACN,8CAAoB;QACtB,yCAAkB;QACnB,uCAAiB;QACd,8BAAa;GATpC,iBAAiB,CA6N7B"}

package/dist/features/account/account.dto.d.ts

@@ -0,0 +1,16 @@
+import type { JsonObject } from '../../database/entities/json-object.js';
+/** POST /auth/refresh. Leave refreshToken out when it lives in the cookie (AuthOptions.refreshTokenCookie). */
+export declare class RefreshTokenInput {
+    refreshToken?: string;
+}
+/** POST /auth/reactivate */
+export declare class ReactivateAccountInput {
+    /** The reactivationToken from the ACCOUNT_DEACTIVATED sign-in response. */
+    reactivationToken: string;
+}
+/** PATCH /auth/me. Users may change their name and app fields, never their roles or status. */
+export declare class UpdateMyProfileInput {
+    firstName?: string;
+    lastName?: string;
+    metadata?: JsonObject;
+}