@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/admin/admin.service.js

@@ -0,0 +1,227 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+const session_service_1 = require("../sessions/session.service.js");
+const settings_service_1 = require("../settings/settings.service.js");
+const sign_in_methods_service_1 = require("../users/sign-in-methods.service.js");
+const users_service_1 = require("../users/users.service.js");
+/** Events counted by GET /auth/admin/stats, by the name they have in the response. */
+const STATS_EVENT_NAMES = {
+    signIns: constants_1.AUTH_EVENTS.userSignedIn,
+    failedSignIns: constants_1.AUTH_EVENTS.userSignInFailed,
+    newUsers: constants_1.AUTH_EVENTS.userCreated,
+    refreshTokenReuses: constants_1.AUTH_EVENTS.refreshTokenReused,
+    passwordResetsRequested: constants_1.AUTH_EVENTS.passwordResetRequested,
+};
+/** Read-heavy admin operations. Changes to a single user go through UsersService, so the rules stay in one place. */
+let AdminService = class AdminService {
+    settingsService;
+    users;
+    sessions;
+    signInMethods;
+    events;
+    database;
+    constructor(options, settingsService, users, sessions, signInMethods, events) {
+        this.settingsService = settingsService;
+        this.users = users;
+        this.sessions = sessions;
+        this.signInMethods = signInMethods;
+        this.events = events;
+        this.database = options.dataSource;
+    }
+    /**
+     * Paged user list with search and filters. Deleted accounts are excluded unless asked for
+     * with `status: "DELETED"`.
+     *
+     * @param filters - Search text, status, role, page and page size.
+     * @returns One page of public profiles, plus the total number of matches.
+     */
+    async searchUsers(filters) {
+        const settings = await this.settingsService.getSettings();
+        const { page, pageSize, skip } = this.paging(filters.page, filters.pageSize);
+        const query = this.database.getRepository(entities_1.UserEntity).createQueryBuilder('user');
+        if (filters.status)
+            query.andWhere('user.status = :status', { status: filters.status });
+        else
+            query.andWhere('user.status <> :deletedStatus', { deletedStatus: constants_1.ACCOUNT_STATUS.deleted });
+        if (filters.role)
+            query.andWhere(':role = ANY(user.roles)', { role: filters.role });
+        if (filters.search?.trim()) {
+            // Escape % and _ so the search text is matched literally.
+            const escapedSearch = filters.search.trim().replace(constants_1.SQL_LIKE_SPECIAL_CHARACTERS_PATTERN, (character) => constants_1.SQL_LIKE_ESCAPE_CHARACTER + character);
+            const pattern = constants_1.SQL_LIKE_ANY_TEXT + escapedSearch + constants_1.SQL_LIKE_ANY_TEXT;
+            query.andWhere('(user.email ILIKE :pattern OR user.phone_number ILIKE :pattern OR user.first_name ILIKE :pattern OR user.last_name ILIKE :pattern)', { pattern });
+        }
+        const [users, total] = await query.orderBy('user.created_at', constants_1.SORT_ORDER.newestFirst).skip(skip).take(pageSize).getManyAndCount();
+        return {
+            success: true,
+            users: users.map((user) => this.users.toPublicProfile(user, settings)),
+            total,
+            page,
+            pageSize,
+        };
+    }
+    /**
+     * Everything support staff need about one user: profile, suspension reason, sign-in methods, devices.
+     *
+     * @param userId - The user.
+     * @returns The profile and the extra details.
+     * @throws AuthError NOT_FOUND when the user doesn't exist.
+     */
+    async getUserDetails(userId) {
+        const settings = await this.settingsService.getSettings();
+        const user = await this.users.getUserOrThrow(userId);
+        const [signInMethods, sessions] = await Promise.all([
+            this.signInMethods.listSignInMethods(user, settings),
+            this.sessions.listActiveSessions(userId),
+        ]);
+        return {
+            success: true,
+            user: this.users.toPublicProfile(user, settings),
+            suspensionReason: user.suspensionReason,
+            statusChangedAt: user.statusChangedAt?.toISOString() ?? null,
+            termsAcceptedAt: user.termsAcceptedAt?.toISOString() ?? null,
+            privacyPolicyAcceptedAt: user.privacyPolicyAcceptedAt?.toISOString() ?? null,
+            signInMethods,
+            sessions: sessions.map((session) => ({
+                id: session.id,
+                signInMethod: session.signInMethod,
+                ipAddress: session.ipAddress,
+                userAgent: session.userAgent,
+                createdAt: session.createdAt.toISOString(),
+                lastUsedAt: session.lastUsedAt.toISOString(),
+            })),
+        };
+    }
+    /**
+     * Paged security history, newest first.
+     *
+     * @param filters - Optional user id and event name, plus page and page size.
+     * @returns One page of audit log entries, plus the total number of matches.
+     */
+    async searchAuditLog(filters) {
+        const { page, pageSize, skip } = this.paging(filters.page, filters.pageSize);
+        const [entries, total] = await this.database.getRepository(entities_1.AuditLogEntity).findAndCount({
+            where: {
+                ...(filters.userId ? { userId: filters.userId } : {}),
+                ...(filters.eventName ? { eventName: filters.eventName } : {}),
+            },
+            order: { createdAt: constants_1.SORT_ORDER.newestFirst },
+            skip,
+            take: pageSize,
+        });
+        return { success: true, entries, total, page, pageSize };
+    }
+    // -------------------------------------------------------------------------------------------
+    // Runtime settings
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @returns The settings in force: the code settings with any admin changes on top.
+     */
+    async getSettings() {
+        return { success: true, settings: await this.settingsService.getSettings() };
+    }
+    /**
+     * Saves admin changes on top of the code settings. Takes effect on every server within seconds.
+     *
+     * @param changes - Only the sections and fields to change.
+     * @param adminUserId - The admin doing it (for the audit log).
+     * @param request - Who is asking.
+     * @returns The settings now in force.
+     * @throws AuthError INVALID_SETTINGS when a value is not allowed.
+     */
+    async changeSettings(changes, adminUserId, request) {
+        const settings = await this.settingsService.saveAdminChanges(changes, constants_1.PERFORMED_BY.admin(adminUserId));
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.settingsChanged,
+            userId: adminUserId,
+            performedBy: constants_1.PERFORMED_BY.admin(adminUserId),
+            request,
+            details: { changedSections: Object.keys(changes) },
+        });
+        return { success: true, settings };
+    }
+    /**
+     * Throws away all admin changes, back to the settings in code.
+     *
+     * @param adminUserId - The admin doing it (for the audit log).
+     * @param request - Who is asking.
+     * @returns The settings now in force.
+     */
+    async resetSettings(adminUserId, request) {
+        const settings = await this.settingsService.discardAdminChanges();
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.settingsChanged,
+            userId: adminUserId,
+            performedBy: constants_1.PERFORMED_BY.admin(adminUserId),
+            request,
+            details: { reset: true },
+        });
+        return { success: true, settings };
+    }
+    /**
+     * Numbers for an admin dashboard or monitoring: accounts by status, signed-in devices, and what
+     * happened in the last 24 hours (from the audit log, so it covers every server).
+     *
+     * @returns The counts and when they were generated.
+     */
+    async getStats() {
+        const since = new Date(Date.now() - constants_1.ADMIN_STATS_WINDOW_SECONDS * constants_1.SECOND_IN_MILLISECONDS);
+        const statuses = Object.values(constants_1.ACCOUNT_STATUS);
+        const eventLabels = Object.entries(STATS_EVENT_NAMES);
+        const [userCounts, activeSessions, eventCounts, pendingWebhookDeliveries] = await Promise.all([
+            Promise.all(statuses.map((status) => this.database.getRepository(entities_1.UserEntity).count({ where: { status } }))),
+            this.database.getRepository(entities_1.SessionEntity).count({ where: { revokedAt: (0, typeorm_1.IsNull)(), expiresAt: (0, typeorm_1.MoreThan)(new Date()) } }),
+            Promise.all(eventLabels.map(([, eventName]) => this.database.getRepository(entities_1.AuditLogEntity).count({ where: { eventName, createdAt: (0, typeorm_1.MoreThanOrEqual)(since) } }))),
+            this.database.getRepository(entities_1.WebhookDeliveryEntity).count({ where: { status: constants_1.WEBHOOK_DELIVERY_STATUS.pending } }),
+        ]);
+        return {
+            success: true,
+            usersByStatus: Object.fromEntries(statuses.map((status, index) => [status, userCounts[index]])),
+            activeSessions,
+            last24Hours: Object.fromEntries(eventLabels.map(([label], index) => [label, eventCounts[index]])),
+            pendingWebhookDeliveries,
+            generatedAt: new Date().toISOString(),
+        };
+    }
+    /**
+     * Turns the requested page and page size into safe values (at least 1, at most MAXIMUM_PAGE_SIZE).
+     *
+     * @param requestedPage - 1-based page number.
+     * @param requestedPageSize - Rows per page.
+     * @returns The clean page, page size, and how many rows to skip.
+     */
+    paging(requestedPage = constants_1.FIRST_PAGE, requestedPageSize = constants_1.DEFAULT_PAGE_SIZE) {
+        const page = Math.max(Math.floor(requestedPage) || constants_1.FIRST_PAGE, constants_1.FIRST_PAGE);
+        const pageSize = Math.min(Math.max(Math.floor(requestedPageSize) || constants_1.DEFAULT_PAGE_SIZE, 1), constants_1.MAXIMUM_PAGE_SIZE);
+        return { page, pageSize, skip: (page - 1) * pageSize };
+    }
+};
+exports.AdminService = AdminService;
+exports.AdminService = AdminService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, settings_service_1.SettingsService,
+        users_service_1.UsersService,
+        session_service_1.SessionService,
+        sign_in_methods_service_1.SignInMethodsService,
+        auth_events_service_1.AuthEventsService])
+], AdminService);
+//# sourceMappingURL=admin.service.js.map

package/dist/features/admin/admin.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.service.js","sourceRoot":"","sources":["../../../src/features/admin/admin.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAAwE;AAGxE,2CAgBqB;AACrB,kDAAuG;AACvG,+EAA0E;AAC1E,yEAAqE;AACrE,2EAAuE;AAEvE,sFAAgF;AAChF,kEAA8D;AAE9D,sFAAsF;AACtF,MAAM,iBAAiB,GAAG;IACxB,OAAO,EAAE,uBAAW,CAAC,YAAY;IACjC,aAAa,EAAE,uBAAW,CAAC,gBAAgB;IAC3C,QAAQ,EAAE,uBAAW,CAAC,WAAW;IACjC,kBAAkB,EAAE,uBAAW,CAAC,kBAAkB;IAClD,uBAAuB,EAAE,uBAAW,CAAC,sBAAsB;CACnD,CAAC;AAkBX,qHAAqH;AAE9G,IAAM,YAAY,GAAlB,MAAM,YAAY;IAKJ;IACA;IACA;IACA;IACA;IARF,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,eAAgC,EAChC,KAAmB,EACnB,QAAwB,EACxB,aAAmC,EACnC,MAAyB;QAJzB,oBAAe,GAAf,eAAe,CAAiB;QAChC,UAAK,GAAL,KAAK,CAAc;QACnB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,kBAAa,GAAb,aAAa,CAAsB;QACnC,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,OAAmB;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE7E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,MAAM;YAAE,KAAK,CAAC,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;;YACnF,KAAK,CAAC,QAAQ,CAAC,+BAA+B,EAAE,EAAE,aAAa,EAAE,0BAAc,CAAC,OAAO,EAAE,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,IAAI;YAAE,KAAK,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YAC3B,0DAA0D;YAC1D,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,+CAAmC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,qCAAyB,GAAG,SAAS,CAAC,CAAC;YAC/I,MAAM,OAAO,GAAG,6BAAiB,GAAG,aAAa,GAAG,6BAAiB,CAAC;YACtE,KAAK,CAAC,QAAQ,CACZ,oIAAoI,EACpI,EAAE,OAAO,EAAE,CACZ,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,sBAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;QAClI,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAClF,KAAK;YACL,IAAI;YACJ,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClD,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC;SACzC,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;YAChD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,IAAI;YAC5D,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,IAAI;YAC5D,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,IAAI,IAAI;YAC5E,aAAa;YACb,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC1C,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;aAC7C,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,OAAuB;QAC1C,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7E,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,YAAY,CAAC;YACtF,KAAK,EAAE;gBACL,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D;YACD,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE;YAC5C,IAAI;YACJ,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpE,CAAC;IAED,8FAA8F;IAC9F,mBAAmB;IACnB,8FAA8F;IAE9F;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,cAAc,CAAC,OAAwB,EAAE,WAAmB,EAAE,OAAuB;QACzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,OAAO,EAAE,wBAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,eAAe;YACjC,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,wBAAY,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,OAAO;YACP,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;SACnD,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,OAAuB;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,mBAAmB,EAAE,CAAC;QAClE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,eAAe;YACjC,MAAM,EAAE,WAAW;YACnB,WAAW,EAAE,wBAAY,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,OAAO;YACP,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SACzB,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sCAA0B,GAAG,kCAAsB,CAAC,CAAC;QACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,0BAAc,CAAC,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,wBAAwB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3G,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,SAAS,EAAE,IAAA,kBAAQ,EAAC,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACrH,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAChC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,IAAA,yBAAe,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAC/G,CACF;YACD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,mCAAuB,CAAC,OAAO,EAAE,EAAE,CAAC;SACjH,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/F,cAAc;YACd,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjG,wBAAwB;YACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,aAAa,GAAG,sBAAU,EAAE,iBAAiB,GAAG,6BAAiB;QAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,sBAAU,EAAE,sBAAU,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,6BAAiB,EAAE,CAAC,CAAC,EAAE,6BAAiB,CAAC,CAAC;QAC9G,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;IACzD,CAAC;CACF,CAAA;AAnMY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACO,kCAAe;QACzB,4BAAY;QACT,gCAAc;QACT,8CAAoB;QAC3B,uCAAiB;GATjC,YAAY,CAmMxB"}

package/dist/features/api-keys/api-keys.service.d.ts

@@ -0,0 +1,67 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RequestContext } from '../../common/request-context.js';
+import { ApiKeyEntity } from '../../database/entities/index.js';
+import { AuthEventsService } from '../events/auth-events.service.js';
+export interface CreateApiKeyInput {
+    name: string;
+    scopes: string[];
+    organizationId?: string | null;
+    expiresAt?: Date | null;
+}
+/** An API key as shown in lists. The secret itself is never shown again after creation. */
+export type ApiKeySummary = Omit<ApiKeyEntity, 'keyHash'>;
+/**
+ * Keys that let other servers call your API (machine to machine).
+ * The full key is returned once, when created. Only its SHA-256 hash is stored.
+ */
+export declare class ApiKeysService {
+    private readonly events;
+    private readonly logger;
+    private readonly database;
+    constructor(options: AuthOptions, events: AuthEventsService);
+    /**
+     * Creates a key. Returns the plain key: show it to the admin once, it cannot be read again.
+     *
+     * @param input - Name, scopes, and optional organization and expiry date.
+     * @param createdByUserId - The admin creating it (for the audit log).
+     * @param request - Who is asking.
+     * @returns `apiKey` (the plain key) and `details` (what lists show).
+     */
+    createApiKey(input: CreateApiKeyInput, createdByUserId: string, request: RequestContext): Promise<{
+        apiKey: string;
+        details: ApiKeySummary;
+    }>;
+    /**
+     * @param organizationId - When given, only that organization's keys.
+     * @returns The keys, newest first, without their hashes.
+     */
+    listApiKeys(organizationId?: string): Promise<ApiKeySummary[]>;
+    /**
+     * Stops a key from working at once.
+     *
+     * @param apiKeyId - The key.
+     * @param revokedByUserId - The admin revoking it (for the audit log).
+     * @param request - Who is asking.
+     * @throws AuthError NOT_FOUND when there is no such key, or it was already revoked.
+     */
+    revokeApiKey(apiKeyId: string, revokedByUserId: string, request: RequestContext): Promise<void>;
+    /**
+     * Used by the guard. Checks a key sent by another server.
+     *
+     * @param presentedKey - The key from the request header.
+     * @returns The key's row (with its scopes) when it is valid, not revoked and not expired.
+     * @throws AuthError INVALID_API_KEY otherwise (the same error for every reason, so callers learn nothing).
+     */
+    verifyApiKey(presentedKey: unknown): Promise<ApiKeyEntity>;
+    /**
+     * Records when a key was last used, at most once a minute per key, without slowing the request.
+     *
+     * @param apiKey - The key that was just used.
+     */
+    private updateLastUsedInBackground;
+    /**
+     * @param apiKey - The key row.
+     * @returns The key without its hash, safe to show in lists.
+     */
+    private toSummary;
+}

package/dist/features/api-keys/api-keys.service.js

@@ -0,0 +1,144 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeysService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const auth_error_1 = require("../../common/auth-error.js");
+const random_secrets_1 = require("../../common/crypto/random-secrets.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+/**
+ * Keys that let other servers call your API (machine to machine).
+ * The full key is returned once, when created. Only its SHA-256 hash is stored.
+ */
+let ApiKeysService = class ApiKeysService {
+    events;
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.apiKeys);
+    database;
+    constructor(options, events) {
+        this.events = events;
+        this.database = options.dataSource;
+    }
+    /**
+     * Creates a key. Returns the plain key: show it to the admin once, it cannot be read again.
+     *
+     * @param input - Name, scopes, and optional organization and expiry date.
+     * @param createdByUserId - The admin creating it (for the audit log).
+     * @param request - Who is asking.
+     * @returns `apiKey` (the plain key) and `details` (what lists show).
+     */
+    async createApiKey(input, createdByUserId, request) {
+        const { plainToken: plainKey, tokenHash: keyHash } = (0, random_secrets_1.createRandomToken)(constants_1.TOKEN_PREFIX.apiKey);
+        const savedKey = await this.database.getRepository(entities_1.ApiKeyEntity).save({
+            name: input.name,
+            scopes: [...new Set(input.scopes)],
+            organizationId: input.organizationId ?? null,
+            expiresAt: input.expiresAt ?? null,
+            createdByUserId,
+            keyHash,
+            keyPreview: plainKey.slice(0, constants_1.TOKEN_PREFIX.apiKey.length + 1 + constants_1.API_KEY_PREVIEW_LENGTH),
+        });
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.apiKeyCreated,
+            userId: createdByUserId,
+            performedBy: constants_1.PERFORMED_BY.admin(createdByUserId),
+            request,
+            details: { apiKeyId: savedKey.id, name: savedKey.name, scopes: savedKey.scopes },
+        });
+        return { apiKey: plainKey, details: this.toSummary(savedKey) };
+    }
+    /**
+     * @param organizationId - When given, only that organization's keys.
+     * @returns The keys, newest first, without their hashes.
+     */
+    async listApiKeys(organizationId) {
+        const keys = await this.database.getRepository(entities_1.ApiKeyEntity).find({
+            where: organizationId ? { organizationId } : {},
+            order: { createdAt: constants_1.SORT_ORDER.newestFirst },
+        });
+        return keys.map((key) => this.toSummary(key));
+    }
+    /**
+     * Stops a key from working at once.
+     *
+     * @param apiKeyId - The key.
+     * @param revokedByUserId - The admin revoking it (for the audit log).
+     * @param request - Who is asking.
+     * @throws AuthError NOT_FOUND when there is no such key, or it was already revoked.
+     */
+    async revokeApiKey(apiKeyId, revokedByUserId, request) {
+        const result = await this.database
+            .getRepository(entities_1.ApiKeyEntity)
+            .update({ id: apiKeyId, revokedAt: (0, typeorm_1.IsNull)() }, { revokedAt: new Date() });
+        if (!result.affected)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notFound);
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.apiKeyRevoked,
+            userId: revokedByUserId,
+            performedBy: constants_1.PERFORMED_BY.admin(revokedByUserId),
+            request,
+            details: { apiKeyId },
+        });
+    }
+    /**
+     * Used by the guard. Checks a key sent by another server.
+     *
+     * @param presentedKey - The key from the request header.
+     * @returns The key's row (with its scopes) when it is valid, not revoked and not expired.
+     * @throws AuthError INVALID_API_KEY otherwise (the same error for every reason, so callers learn nothing).
+     */
+    async verifyApiKey(presentedKey) {
+        if (!(0, random_secrets_1.hasRandomTokenFormat)(presentedKey, constants_1.TOKEN_PREFIX.apiKey))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidApiKey);
+        const apiKey = await this.database.getRepository(entities_1.ApiKeyEntity).findOne({
+            where: { keyHash: (0, random_secrets_1.sha256Hex)(presentedKey), revokedAt: (0, typeorm_1.IsNull)() },
+        });
+        const isExpired = apiKey?.expiresAt != null && apiKey.expiresAt.getTime() <= Date.now();
+        if (!apiKey || isExpired)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidApiKey);
+        this.updateLastUsedInBackground(apiKey);
+        return apiKey;
+    }
+    /**
+     * Records when a key was last used, at most once a minute per key, without slowing the request.
+     *
+     * @param apiKey - The key that was just used.
+     */
+    updateLastUsedInBackground(apiKey) {
+        const lastUsedMs = apiKey.lastUsedAt?.getTime() ?? 0;
+        if (Date.now() - lastUsedMs < constants_1.API_KEY_LAST_USED_UPDATE_SECONDS * constants_1.SECOND_IN_MILLISECONDS)
+            return;
+        this.database
+            .getRepository(entities_1.ApiKeyEntity)
+            .update({ id: apiKey.id }, { lastUsedAt: new Date() })
+            .catch((error) => this.logger.warn(`Could not update lastUsedAt for API key ${apiKey.id}: ${error.message}`));
+    }
+    /**
+     * @param apiKey - The key row.
+     * @returns The key without its hash, safe to show in lists.
+     */
+    toSummary(apiKey) {
+        const { keyHash: _hiddenHash, ...summary } = apiKey;
+        return summary;
+    }
+};
+exports.ApiKeysService = ApiKeysService;
+exports.ApiKeysService = ApiKeysService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, auth_events_service_1.AuthEventsService])
+], ApiKeysService);
+//# sourceMappingURL=api-keys.service.js.map

package/dist/features/api-keys/api-keys.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.service.js","sourceRoot":"","sources":["../../../src/features/api-keys/api-keys.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,qCAA6C;AAE7C,oDAAgD;AAChD,mEAAoG;AAEpG,2CAWqB;AACrB,kDAAmD;AACnD,+EAA0E;AAY1E;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAMN;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,KAAwB,EAAE,eAAuB,EAAE,OAAuB;QAC3F,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,IAAA,kCAAiB,EAAC,wBAAY,CAAC,MAAM,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,uBAAY,CAAC,CAAC,IAAI,CAAC;YACpE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;YAC5C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,eAAe;YACf,OAAO;YACP,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAY,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,kCAAsB,CAAC;SACvF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,aAAa;YAC/B,MAAM,EAAE,eAAe;YACvB,WAAW,EAAE,wBAAY,CAAC,KAAK,CAAC,eAAe,CAAC;YAChD,OAAO;YACP,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;SACjF,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,cAAuB;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,uBAAY,CAAC,CAAC,IAAI,CAAC;YAChE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE;YAC/C,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE;SAC7C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,eAAuB,EAAE,OAAuB;QACnF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;aAC/B,aAAa,CAAC,uBAAY,CAAC;aAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,aAAa;YAC/B,MAAM,EAAE,eAAe;YACvB,WAAW,EAAE,wBAAY,CAAC,KAAK,CAAC,eAAe,CAAC;YAChD,OAAO;YACP,OAAO,EAAE,EAAE,QAAQ,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,YAAqB;QACtC,IAAI,CAAC,IAAA,qCAAoB,EAAC,YAAY,EAAE,wBAAY,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;QAE7G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,uBAAY,CAAC,CAAC,OAAO,CAAC;YACrE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAA,0BAAS,EAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAA,gBAAM,GAAE,EAAE;SACjE,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACxF,IAAI,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;QAEzE,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,0BAA0B,CAAC,MAAoB;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,4CAAgC,GAAG,kCAAsB;YAAE,OAAO;QAChG,IAAI,CAAC,QAAQ;aACV,aAAa,CAAC,uBAAY,CAAC;aAC3B,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aACrD,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACzH,CAAC;IAED;;;OAGG;IACK,SAAS,CAAC,MAAoB;QACpC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AApHY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACF,uCAAiB;GANjC,cAAc,CAoH1B"}

package/dist/features/email-change/email-change.controller.d.ts

@@ -0,0 +1,38 @@
+import { RequestContext } from '../../common/request-context.js';
+import { AccessTokenClaims } from '../sessions/session.types.js';
+import { ConfirmEmailChangeInput, RequestEmailChangeInput } from './email-change.dto';
+import { EmailChangeService } from './email-change.service';
+/**
+ * Changing the account's email:
+ *
+ *   POST /auth/email/change           (signed in) send a confirmation link to the new address
+ *   POST /auth/email/change/confirm   (the link)  switch to the new address
+ */
+export declare class EmailChangeController {
+    private readonly emailChange;
+    constructor(emailChange: EmailChangeService);
+    /**
+     * POST /auth/email/change — Sends a confirmation link to the new address.
+     *
+     * @param user - The access token's claims (user id and session id).
+     * @param body - `{ newEmail, currentPassword? }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    requestEmailChange(user: AccessTokenClaims, body: RequestEmailChangeInput, request: RequestContext): Promise<{
+        success: true;
+        message: "If this email can be used, a confirmation link is on its way to it.";
+    }>;
+    /**
+     * POST /auth/email/change/confirm — Switches to the new address using the token from the link. Public.
+     *
+     * @param body - `{ token }`.
+     * @param request - Who is asking.
+     * @returns A success message and the updated profile.
+     */
+    confirmEmailChange(body: ConfirmEmailChangeInput, request: RequestContext): Promise<{
+        success: true;
+        message: "Your email has been changed.";
+        user: import("../..").PublicUserProfile;
+    }>;
+}

package/dist/features/email-change/email-change.controller.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmailChangeController = void 0;
+const common_1 = require("@nestjs/common");
+const refresh_token_cookie_1 = require("../../common/refresh-token-cookie.js");
+const request_context_1 = require("../../common/request-context.js");
+const strict_validation_pipe_1 = require("../../common/strict-validation.pipe.js");
+const constants_1 = require("../../constants.js");
+const auth_decorators_1 = require("../../guards/auth.decorators.js");
+const email_change_dto_1 = require("./email-change.dto");
+const email_change_service_1 = require("./email-change.service");
+/**
+ * Changing the account's email:
+ *
+ *   POST /auth/email/change           (signed in) send a confirmation link to the new address
+ *   POST /auth/email/change/confirm   (the link)  switch to the new address
+ */
+let EmailChangeController = class EmailChangeController {
+    emailChange;
+    constructor(emailChange) {
+        this.emailChange = emailChange;
+    }
+    /**
+     * POST /auth/email/change — Sends a confirmation link to the new address.
+     *
+     * @param user - The access token's claims (user id and session id).
+     * @param body - `{ newEmail, currentPassword? }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    requestEmailChange(user, body, request) {
+        return this.emailChange.requestEmailChange(user.sub, user.sid, body.newEmail, body.currentPassword, request);
+    }
+    /**
+     * POST /auth/email/change/confirm — Switches to the new address using the token from the link. Public.
+     *
+     * @param body - `{ token }`.
+     * @param request - Who is asking.
+     * @returns A success message and the updated profile.
+     */
+    confirmEmailChange(body, request) {
+        return this.emailChange.confirmEmailChange(body.token, request);
+    }
+};
+exports.EmailChangeController = EmailChangeController;
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.emailChange),
+    (0, auth_decorators_1.CheckSession)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, auth_decorators_1.CurrentUser)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, email_change_dto_1.RequestEmailChangeInput, Object]),
+    __metadata("design:returntype", void 0)
+], EmailChangeController.prototype, "requestEmailChange", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.emailChangeConfirm),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [email_change_dto_1.ConfirmEmailChangeInput, Object]),
+    __metadata("design:returntype", void 0)
+], EmailChangeController.prototype, "confirmEmailChange", null);
+exports.EmailChangeController = EmailChangeController = __decorate([
+    (0, common_1.Controller)(constants_1.ROUTES.auth.prefix),
+    (0, refresh_token_cookie_1.LibraryController)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.strictValidationPipe),
+    __metadata("design:paramtypes", [email_change_service_1.EmailChangeService])
+], EmailChangeController);
+//# sourceMappingURL=email-change.controller.js.map

package/dist/features/email-change/email-change.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-change.controller.js","sourceRoot":"","sources":["../../../src/features/email-change/email-change.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwF;AACxF,wEAAkE;AAClE,8DAA0E;AAC1E,4EAAuE;AACvE,2CAAqC;AACrC,8DAA6E;AAE7E,yDAAsF;AACtF,iEAA4D;AAE5D;;;;;GAKG;AAII,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACH;IAA7B,YAA6B,WAA+B;QAA/B,gBAAW,GAAX,WAAW,CAAoB;IAAG,CAAC;IAEhE;;;;;;;OAOG;IAIH,kBAAkB,CAAgB,IAAuB,EAAU,IAA6B,EAAoB,OAAuB;QACzI,OAAO,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IAC/G,CAAC;IAED;;;;;;OAMG;IAIH,kBAAkB,CAAS,IAA6B,EAAoB,OAAuB;QACjG,OAAO,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClE,CAAC;CACF,CAAA;AA/BY,sDAAqB;AAchC;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,WAAW,CAAC;IAC7B,IAAA,8BAAY,GAAE;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACJ,WAAA,IAAA,6BAAW,GAAE,CAAA;IAA2B,WAAA,IAAA,aAAI,GAAE,CAAA;IAAiC,WAAA,IAAA,gCAAc,GAAE,CAAA;;6CAA1C,0CAAuB;;+DAE/F;AAYD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACpC,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACJ,WAAA,IAAA,aAAI,GAAE,CAAA;IAAiC,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAA1C,0CAAuB;;+DAEvD;gCA9BU,qBAAqB;IAHjC,IAAA,mBAAU,EAAC,kBAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IAC9B,IAAA,wCAAiB,GAAE;IACnB,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAEa,yCAAkB;GADjD,qBAAqB,CA+BjC"}

package/dist/features/email-change/email-change.dto.d.ts

@@ -0,0 +1,10 @@
+/** POST /auth/email/change */
+export declare class RequestEmailChangeInput {
+    newEmail: string;
+    /** Required when the account has a password. Accounts without one must have signed in recently. */
+    currentPassword?: string;
+}
+/** POST /auth/email/change/confirm */
+export declare class ConfirmEmailChangeInput {
+    token: string;
+}

package/dist/features/email-change/email-change.dto.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfirmEmailChangeInput = exports.RequestEmailChangeInput = void 0;
+const class_validator_1 = require("class-validator");
+const constants_1 = require("../../constants.js");
+/** POST /auth/email/change */
+class RequestEmailChangeInput {
+    newEmail;
+    /** Required when the account has a password. Accounts without one must have signed in recently. */
+    currentPassword;
+}
+exports.RequestEmailChangeInput = RequestEmailChangeInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.EMAIL_MAX_LENGTH),
+    __metadata("design:type", String)
+], RequestEmailChangeInput.prototype, "newEmail", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.PASSWORD_MAX_LENGTH),
+    __metadata("design:type", String)
+], RequestEmailChangeInput.prototype, "currentPassword", void 0);
+/** POST /auth/email/change/confirm */
+class ConfirmEmailChangeInput {
+    token;
+}
+exports.ConfirmEmailChangeInput = ConfirmEmailChangeInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.RANDOM_TOKEN_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], ConfirmEmailChangeInput.prototype, "token", void 0);
+//# sourceMappingURL=email-change.dto.js.map

package/dist/features/email-change/email-change.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-change.dto.js","sourceRoot":"","sources":["../../../src/features/email-change/email-change.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkE;AAClE,2CAAmG;AAEnG,8BAA8B;AAC9B,MAAa,uBAAuB;IAElC,QAAQ,CAAS;IAEjB,mGAAmG;IAEnG,eAAe,CAAU;CAC1B;AAPD,0DAOC;AALC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,4BAAgB,CAAC;;yDACvB;AAIjB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,+BAAmB,CAAC;;gEAChC;AAG3B,sCAAsC;AACtC,MAAa,uBAAuB;IAElC,KAAK,CAAS;CACf;AAHD,0DAGC;AADC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;sDACvC"}