@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/events/auth-events.service.js

@@ -0,0 +1,117 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthEventsService = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const typeorm_row_1 = require("../../database/typeorm-row.js");
+/**
+ * The single place every auth event goes through. One call writes the audit log, then calls
+ * your `onEvent` handler, then queues a delivery for every webhook subscribed to the event.
+ *
+ * Recording an event never breaks the action that caused it: failures here are logged, not thrown.
+ */
+let AuthEventsService = class AuthEventsService {
+    options;
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.events);
+    database;
+    constructor(options) {
+        this.options = options;
+        this.database = options.dataSource;
+    }
+    /**
+     * Records an event: writes the audit log, calls your `onEvent` handler, and queues webhook deliveries.
+     * Never throws, so recording an event can't break the action that caused it.
+     *
+     * @param input - The event name, who it is about, who did it, the request, and extra details.
+     * @example
+     * await events.record({ name: AUTH_EVENTS.userSignedOut, userId, request, details: { sessionId } });
+     */
+    async record(input) {
+        const event = {
+            name: input.name,
+            userId: input.userId,
+            data: input.details ?? {},
+            occurredAt: new Date().toISOString(),
+        };
+        await this.writeAuditLog(input);
+        await this.callAppHandler(event);
+        await this.queueWebhookDeliveries(event);
+    }
+    /**
+     * @param input - The event to write. Failures are logged, not thrown.
+     */
+    async writeAuditLog(input) {
+        try {
+            await this.database.getRepository(entities_1.AuditLogEntity).insert((0, typeorm_row_1.typeormRow)({
+                eventName: input.name,
+                userId: input.userId,
+                performedBy: input.performedBy ?? null,
+                ipAddress: input.request?.ipAddress ?? null,
+                userAgent: input.request?.userAgent ?? null,
+                details: input.details ?? {},
+            }));
+        }
+        catch (error) {
+            this.logger.error(`Could not write audit log for "${input.name}": ${error.message}`);
+        }
+    }
+    /**
+     * Calls AuthOptions.onEvent, if set. Failures in your handler are logged, not thrown.
+     *
+     * @param event - The event to pass on.
+     */
+    async callAppHandler(event) {
+        if (!this.options.onEvent)
+            return;
+        try {
+            await this.options.onEvent(event);
+        }
+        catch (error) {
+            this.logger.error(`Your onEvent handler failed for "${event.name}": ${error.message}`);
+        }
+    }
+    /**
+     * Queues one delivery per enabled webhook that subscribes to this event. The worker sends them.
+     * Failures are logged, not thrown.
+     *
+     * @param event - The event to deliver.
+     */
+    async queueWebhookDeliveries(event) {
+        try {
+            const enabledWebhooks = await this.database.getRepository(entities_1.WebhookEntity).find({ where: { isEnabled: true } });
+            const subscribedWebhooks = enabledWebhooks.filter((webhook) => webhook.eventNames.length === 0 || webhook.eventNames.includes(event.name));
+            if (subscribedWebhooks.length === 0)
+                return;
+            await this.database.getRepository(entities_1.WebhookDeliveryEntity).insert((0, typeorm_row_1.typeormRows)(subscribedWebhooks.map((webhook) => ({
+                webhookId: webhook.id,
+                eventName: event.name,
+                payload: { ...event },
+                status: constants_1.WEBHOOK_DELIVERY_STATUS.pending,
+                nextAttemptAt: new Date(),
+            }))));
+        }
+        catch (error) {
+            this.logger.error(`Could not queue webhooks for "${event.name}": ${error.message}`);
+        }
+    }
+};
+exports.AuthEventsService = AuthEventsService;
+exports.AuthEventsService = AuthEventsService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object])
+], AuthEventsService);
+//# sourceMappingURL=auth-events.service.js.map

package/dist/features/events/auth-events.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-events.service.js","sourceRoot":"","sources":["../../../src/features/events/auth-events.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4D;AAI5D,2CAAsG;AACtG,kDAA2F;AAE3F,wDAAiE;AAajE;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI6B;IAHxC,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAa;IAEtC,YAAyD,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;QAC3E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YACzB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,KAAuB;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,MAAM,CACtD,IAAA,wBAAU,EAAiB;gBACzB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACtC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI;gBAC3C,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI;gBAC3C,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;aAC7B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,KAAgB;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO;QAClC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,KAAK,CAAC,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,sBAAsB,CAAC,KAAgB;QACnD,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9G,MAAM,kBAAkB,GAAG,eAAe,CAAC,MAAM,CAC/C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CACxF,CAAC;YACF,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAE5C,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,MAAM,CAC7D,IAAA,yBAAW,EACT,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,IAAI;gBACrB,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE;gBACrB,MAAM,EAAE,mCAAuB,CAAC,OAAO;gBACvC,aAAa,EAAE,IAAI,IAAI,EAAE;aAC1B,CAAC,CAAC,CACJ,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,KAAK,CAAC,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC;CACF,CAAA;AA5FY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAKE,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;;GAJ5B,iBAAiB,CA4F7B"}

package/dist/features/maintenance/data-retention.service.d.ts

@@ -0,0 +1,60 @@
+import { OnApplicationBootstrap, OnModuleDestroy } from '@nestjs/common';
+import { AuthOptions } from '../../auth-options.js';
+import { DataRetentionStep } from '../../constants.js';
+import { SettingsService } from '../settings/settings.service.js';
+/** How many rows each cleanup step removed. */
+export type DataRetentionReport = Record<DataRetentionStep, number>;
+/**
+ * Deletes rows nobody needs any more, so tables don't grow forever:
+ *
+ * | What                                             | Kept for (settings.retention) |
+ * |--------------------------------------------------|-------------------------------|
+ * | ended sessions (+ their refresh tokens)          | expiredRecordDays (7)         |
+ * | expired refresh tokens of active sessions        | expiredRecordDays             |
+ * | used/expired email links, codes, 2FA challenges  | expiredRecordDays             |
+ * | accepted/cancelled/expired invitations           | expiredRecordDays             |
+ * | delivered or failed webhook deliveries           | webhookDeliveryDays (30)      |
+ * | audit log entries                                | auditLogDays (365, 0=forever) |
+ *
+ * Runs every hour on every server. Several servers running it at once is harmless: each deletes
+ * in small batches, and a row already deleted by one is simply not found by the other.
+ * Users, organizations, passkeys and other live data are never touched.
+ */
+export declare class DataRetentionService implements OnApplicationBootstrap, OnModuleDestroy {
+    private readonly settingsService;
+    private readonly logger;
+    private readonly database;
+    private firstRunTimer?;
+    private intervalTimer?;
+    private isRunning;
+    private readonly steps;
+    constructor(options: AuthOptions, settingsService: SettingsService);
+    /**
+     * Schedules the first cleanup shortly after start-up, then one every hour.
+     */
+    onApplicationBootstrap(): void;
+    /**
+     * Stops the timers when the app shuts down.
+     */
+    onModuleDestroy(): void;
+    /**
+     * Runs every cleanup step now. Works even when the automatic cleanup is turned off,
+     * so you can call it from your own scheduled job.
+     *
+     * @returns How many rows each step removed.
+     */
+    runCleanup(): Promise<DataRetentionReport>;
+    /**
+     * The hourly run: skipped when retention is turned off or a run is still going.
+     * Errors are logged, never thrown.
+     */
+    private runScheduledCleanup;
+    /**
+     * Deletes matching rows in batches (short statements, short locks).
+     *
+     * @param step - Which table and which rows count as old.
+     * @param cutoff - Rows older than this are deleted.
+     * @returns How many rows were deleted.
+     */
+    private deleteOldRows;
+}

package/dist/features/maintenance/data-retention.service.js

@@ -0,0 +1,182 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataRetentionService = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const settings_service_1 = require("../settings/settings.service.js");
+/**
+ * Deletes rows nobody needs any more, so tables don't grow forever:
+ *
+ * | What                                             | Kept for (settings.retention) |
+ * |--------------------------------------------------|-------------------------------|
+ * | ended sessions (+ their refresh tokens)          | expiredRecordDays (7)         |
+ * | expired refresh tokens of active sessions        | expiredRecordDays             |
+ * | used/expired email links, codes, 2FA challenges  | expiredRecordDays             |
+ * | accepted/cancelled/expired invitations           | expiredRecordDays             |
+ * | delivered or failed webhook deliveries           | webhookDeliveryDays (30)      |
+ * | audit log entries                                | auditLogDays (365, 0=forever) |
+ *
+ * Runs every hour on every server. Several servers running it at once is harmless: each deletes
+ * in small batches, and a row already deleted by one is simply not found by the other.
+ * Users, organizations, passkeys and other live data are never touched.
+ */
+let DataRetentionService = class DataRetentionService {
+    settingsService;
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.dataRetention);
+    database;
+    firstRunTimer;
+    intervalTimer;
+    isRunning = false;
+    steps = [
+        {
+            step: constants_1.DATA_RETENTION_STEP.endedSessions,
+            entity: entities_1.SessionEntity,
+            keepDays: (settings) => settings.retention.expiredRecordDays,
+        },
+        {
+            step: constants_1.DATA_RETENTION_STEP.expiredRefreshTokens,
+            entity: entities_1.RefreshTokenEntity,
+            keepDays: (settings) => settings.retention.expiredRecordDays,
+        },
+        {
+            step: constants_1.DATA_RETENTION_STEP.linkTokens,
+            entity: entities_1.LinkTokenEntity,
+            keepDays: (settings) => settings.retention.expiredRecordDays,
+        },
+        {
+            step: constants_1.DATA_RETENTION_STEP.oneTimeCodes,
+            entity: entities_1.OneTimeCodeEntity,
+            keepDays: (settings) => settings.retention.expiredRecordDays,
+        },
+        {
+            step: constants_1.DATA_RETENTION_STEP.signInChallenges,
+            entity: entities_1.SignInChallengeEntity,
+            keepDays: (settings) => settings.retention.expiredRecordDays,
+        },
+        {
+            step: constants_1.DATA_RETENTION_STEP.organizationInvitations,
+            entity: entities_1.OrganizationInvitationEntity,
+            keepDays: (settings) => settings.retention.expiredRecordDays,
+        },
+        {
+            step: constants_1.DATA_RETENTION_STEP.webhookDeliveries,
+            entity: entities_1.WebhookDeliveryEntity,
+            keepDays: (settings) => settings.retention.webhookDeliveryDays,
+        },
+        {
+            step: constants_1.DATA_RETENTION_STEP.auditLog,
+            entity: entities_1.AuditLogEntity,
+            keepDays: (settings) => settings.retention.auditLogDays,
+        },
+    ];
+    constructor(options, settingsService) {
+        this.settingsService = settingsService;
+        this.database = options.dataSource;
+    }
+    /**
+     * Schedules the first cleanup shortly after start-up, then one every hour.
+     */
+    onApplicationBootstrap() {
+        this.firstRunTimer = setTimeout(() => void this.runScheduledCleanup(), constants_1.DATA_RETENTION_FIRST_RUN_DELAY_MS);
+        this.intervalTimer = setInterval(() => void this.runScheduledCleanup(), constants_1.DATA_RETENTION_INTERVAL_MS);
+        // Timers never keep the process alive on shutdown.
+        this.firstRunTimer.unref();
+        this.intervalTimer.unref();
+    }
+    /**
+     * Stops the timers when the app shuts down.
+     */
+    onModuleDestroy() {
+        if (this.firstRunTimer)
+            clearTimeout(this.firstRunTimer);
+        if (this.intervalTimer)
+            clearInterval(this.intervalTimer);
+    }
+    /**
+     * Runs every cleanup step now. Works even when the automatic cleanup is turned off,
+     * so you can call it from your own scheduled job.
+     *
+     * @returns How many rows each step removed.
+     */
+    async runCleanup() {
+        const settings = await this.settingsService.getSettings();
+        const report = Object.fromEntries(this.steps.map(({ step }) => [step, 0]));
+        for (const step of this.steps) {
+            const keepDays = step.keepDays(settings);
+            if (keepDays <= 0)
+                continue;
+            report[step.step] = await this.deleteOldRows(step, new Date(Date.now() - keepDays * constants_1.DAY_IN_SECONDS * constants_1.SECOND_IN_MILLISECONDS));
+        }
+        return report;
+    }
+    /**
+     * The hourly run: skipped when retention is turned off or a run is still going.
+     * Errors are logged, never thrown.
+     */
+    async runScheduledCleanup() {
+        if (this.isRunning)
+            return;
+        this.isRunning = true;
+        try {
+            if (!(await this.settingsService.getSettings()).retention.enabled)
+                return;
+            const report = await this.runCleanup();
+            const removedRows = Object.values(report).reduce((total, count) => total + count, 0);
+            if (removedRows > 0)
+                this.logger.log(`Removed ${removedRows} old rows: ${JSON.stringify(report)}`);
+        }
+        catch (error) {
+            this.logger.error(`Cleanup failed: ${error.message}`);
+        }
+        finally {
+            this.isRunning = false;
+        }
+    }
+    /**
+     * Deletes matching rows in batches (short statements, short locks).
+     *
+     * @param step - Which table and which rows count as old.
+     * @param cutoff - Rows older than this are deleted.
+     * @returns How many rows were deleted.
+     */
+    async deleteOldRows(step, cutoff) {
+        const tableName = this.database.getMetadata(step.entity).tableName;
+        let removedRows = 0;
+        for (let batch = 0; batch < constants_1.DATA_RETENTION_MAX_BATCHES_PER_TABLE; batch++) {
+            const result = await this.database
+                .createQueryBuilder()
+                .delete()
+                .from(step.entity)
+                .where((0, constants_1.DATA_RETENTION_BATCH_CONDITION)(tableName, constants_1.DATA_RETENTION_OLD_ROW_CONDITION[step.step]), {
+                cutoff,
+                batchSize: constants_1.DATA_RETENTION_BATCH_SIZE,
+            })
+                .execute();
+            const deletedInBatch = result.affected ?? 0;
+            removedRows += deletedInBatch;
+            if (deletedInBatch < constants_1.DATA_RETENTION_BATCH_SIZE)
+                break;
+        }
+        return removedRows;
+    }
+};
+exports.DataRetentionService = DataRetentionService;
+exports.DataRetentionService = DataRetentionService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, settings_service_1.SettingsService])
+], DataRetentionService);
+//# sourceMappingURL=data-retention.service.js.map

package/dist/features/maintenance/data-retention.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-retention.service.js","sourceRoot":"","sources":["../../../src/features/maintenance/data-retention.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAqG;AAGrG,2CAaqB;AACrB,kDAS6B;AAC7B,2EAAuE;AAcvE;;;;;;;;;;;;;;;GAeG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAoDZ;IAnDF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;IAC/C,QAAQ,CAAa;IAC9B,aAAa,CAAkB;IAC/B,aAAa,CAAkB;IAC/B,SAAS,GAAG,KAAK,CAAC;IAET,KAAK,GAAkB;QACtC;YACE,IAAI,EAAE,+BAAmB,CAAC,aAAa;YACvC,MAAM,EAAE,wBAAa;YACrB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB;SAC7D;QACD;YACE,IAAI,EAAE,+BAAmB,CAAC,oBAAoB;YAC9C,MAAM,EAAE,6BAAkB;YAC1B,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB;SAC7D;QACD;YACE,IAAI,EAAE,+BAAmB,CAAC,UAAU;YACpC,MAAM,EAAE,0BAAe;YACvB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB;SAC7D;QACD;YACE,IAAI,EAAE,+BAAmB,CAAC,YAAY;YACtC,MAAM,EAAE,4BAAiB;YACzB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB;SAC7D;QACD;YACE,IAAI,EAAE,+BAAmB,CAAC,gBAAgB;YAC1C,MAAM,EAAE,gCAAqB;YAC7B,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB;SAC7D;QACD;YACE,IAAI,EAAE,+BAAmB,CAAC,uBAAuB;YACjD,MAAM,EAAE,uCAA4B;YACpC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB;SAC7D;QACD;YACE,IAAI,EAAE,+BAAmB,CAAC,iBAAiB;YAC3C,MAAM,EAAE,gCAAqB;YAC7B,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,mBAAmB;SAC/D;QACD;YACE,IAAI,EAAE,+BAAmB,CAAC,QAAQ;YAClC,MAAM,EAAE,yBAAc;YACtB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY;SACxD;KACF,CAAC;IAEF,YAC8B,OAAoB,EAC/B,eAAgC;QAAhC,oBAAe,GAAf,eAAe,CAAiB;QAEjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,sBAAsB;QACpB,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,mBAAmB,EAAE,EAAE,6CAAiC,CAAC,CAAC;QAC1G,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,mBAAmB,EAAE,EAAE,sCAA0B,CAAC,CAAC;QACpG,mDAAmD;QACnD,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,eAAe;QACb,IAAI,IAAI,CAAC,aAAa;YAAE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,aAAa;YAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAwB,CAAC;QAClG,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,QAAQ,IAAI,CAAC;gBAAE,SAAS;YAC5B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,0BAAc,GAAG,kCAAsB,CAAC,CAAC,CAAC;QAChI,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB;QAC/B,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO;gBAAE,OAAO;YAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;YACrF,IAAI,WAAW,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,WAAW,cAAc,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAoB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAC,IAAiB,EAAE,MAAY;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,gDAAoC,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;iBAC/B,kBAAkB,EAAE;iBACpB,MAAM,EAAE;iBACR,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;iBACjB,KAAK,CAAC,IAAA,0CAA8B,EAAC,SAAS,EAAE,4CAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;gBAC7F,MAAM;gBACN,SAAS,EAAE,qCAAyB;aACrC,CAAC;iBACD,OAAO,EAAE,CAAC;YACb,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;YAC5C,WAAW,IAAI,cAAc,CAAC;YAC9B,IAAI,cAAc,GAAG,qCAAyB;gBAAE,MAAM;QACxD,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAA;AA1IY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAoDR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACO,kCAAe;GApDxC,oBAAoB,CA0IhC"}

package/dist/features/notifications/notifications.service.d.ts

@@ -0,0 +1,40 @@
+import { AuthEmail, AuthOptions } from '../../auth-options.js';
+/**
+ * Sends emails and SMS through the senders your app provides in AuthOptions.
+ *
+ * Two kinds of message:
+ * - Required (a code or link the user is waiting for): if sending fails, the request fails, so the
+ *   user knows to try again.
+ * - Notices (password changed, new sign-in): sending failures are logged and the action still succeeds.
+ */
+export declare class NotificationsService {
+    private readonly options;
+    private readonly logger;
+    constructor(options: AuthOptions);
+    /**
+     * @returns True when an SMS sender is configured (phone OTP needs one).
+     */
+    get canSendSms(): boolean;
+    /**
+     * Sends an email the user is waiting for (a code or link).
+     *
+     * @param email - The email to send; its `type` says which template your sender should use.
+     * @throws AuthError INTERNAL_SERVER_ERROR if it could not be sent, so the user knows to try again.
+     */
+    sendRequiredEmail(email: AuthEmail): Promise<void>;
+    /**
+     * Sends an informational email (password changed, new sign-in). Never throws; failures are logged.
+     *
+     * @param email - The email to send.
+     */
+    sendNoticeEmail(email: AuthEmail): Promise<void>;
+    /**
+     * Sends a one-time code by SMS.
+     *
+     * @param phoneNumber - The E.164 phone number.
+     * @param code - The code to send.
+     * @throws AuthError NOT_CONFIGURED when no SMS sender is configured.
+     * @throws AuthError INTERNAL_SERVER_ERROR when sending failed.
+     */
+    sendSmsCode(phoneNumber: string, code: string): Promise<void>;
+}

package/dist/features/notifications/notifications.service.js

@@ -0,0 +1,94 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotificationsService = void 0;
+const common_1 = require("@nestjs/common");
+const auth_error_1 = require("../../common/auth-error.js");
+const identifiers_1 = require("../../common/identifiers.js");
+const constants_1 = require("../../constants.js");
+/**
+ * Sends emails and SMS through the senders your app provides in AuthOptions.
+ *
+ * Two kinds of message:
+ * - Required (a code or link the user is waiting for): if sending fails, the request fails, so the
+ *   user knows to try again.
+ * - Notices (password changed, new sign-in): sending failures are logged and the action still succeeds.
+ */
+let NotificationsService = class NotificationsService {
+    options;
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.notifications);
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * @returns True when an SMS sender is configured (phone OTP needs one).
+     */
+    get canSendSms() {
+        return this.options.smsSender !== undefined;
+    }
+    /**
+     * Sends an email the user is waiting for (a code or link).
+     *
+     * @param email - The email to send; its `type` says which template your sender should use.
+     * @throws AuthError INTERNAL_SERVER_ERROR if it could not be sent, so the user knows to try again.
+     */
+    async sendRequiredEmail(email) {
+        try {
+            await this.options.emailSender.send(email);
+        }
+        catch (error) {
+            this.logger.error(`Could not send "${email.type}" email: ${error.message}`);
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.internalError);
+        }
+    }
+    /**
+     * Sends an informational email (password changed, new sign-in). Never throws; failures are logged.
+     *
+     * @param email - The email to send.
+     */
+    async sendNoticeEmail(email) {
+        try {
+            await this.options.emailSender.send(email);
+        }
+        catch (error) {
+            this.logger.warn(`Could not send "${email.type}" notice email: ${error.message}`);
+        }
+    }
+    /**
+     * Sends a one-time code by SMS.
+     *
+     * @param phoneNumber - The E.164 phone number.
+     * @param code - The code to send.
+     * @throws AuthError NOT_CONFIGURED when no SMS sender is configured.
+     * @throws AuthError INTERNAL_SERVER_ERROR when sending failed.
+     */
+    async sendSmsCode(phoneNumber, code) {
+        if (!this.options.smsSender)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notConfigured);
+        try {
+            await this.options.smsSender.sendCode(phoneNumber, code);
+        }
+        catch (error) {
+            this.logger.error(`Could not send SMS to ${(0, identifiers_1.maskPhoneNumber)(phoneNumber)}: ${error.message}`);
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.internalError);
+        }
+    }
+};
+exports.NotificationsService = NotificationsService;
+exports.NotificationsService = NotificationsService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object])
+], NotificationsService);
+//# sourceMappingURL=notifications.service.js.map

package/dist/features/notifications/notifications.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notifications.service.js","sourceRoot":"","sources":["../../../src/features/notifications/notifications.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4D;AAE5D,oDAAgD;AAChD,sDAAuD;AACvD,2CAA2E;AAE3E;;;;;;;GAOG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAG0B;IAFxC,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;IAEhE,YAAyD,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;IAAG,CAAC;IAEjF;;OAEG;IACH,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;IAC9C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAgB;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,YAAa,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACvF,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,KAAgB;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,IAAI,mBAAoB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,WAAmB,EAAE,IAAY;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,IAAA,6BAAe,EAAC,WAAW,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACxG,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;CACF,CAAA;AAzDY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;;GAH5B,oBAAoB,CAyDhC"}

package/dist/features/one-time-codes/one-time-codes.service.d.ts

@@ -0,0 +1,40 @@
+import { AuthOptions } from '../../auth-options.js';
+import { CodeChannel } from '../../database/entities/index.js';
+export interface CodeRules {
+    codeLength: number;
+    expiresInMinutes: number;
+    resendAfterSeconds: number;
+}
+/**
+ * Short numeric codes sent by email or SMS ("Your code is 482913").
+ *
+ * - Only a salted hash of the code is stored.
+ * - A new code can be requested after `resendAfterSeconds` (default a minute); it replaces the previous one.
+ * - After ONE_TIME_CODE_MAX_ATTEMPTS wrong tries the code stops working.
+ * - A code works once.
+ */
+export declare class OneTimeCodesService {
+    private readonly database;
+    constructor(options: AuthOptions);
+    /**
+     * Creates a new code for `destination` and returns it so the caller can send it.
+     * Any earlier code for the same destination stops working.
+     *
+     * @param channel - "email" or "sms".
+     * @param destination - An email or E.164 phone number.
+     * @param rules - Code length, lifetime and how soon a new one may be sent.
+     * @returns The plain code to send. Only its hash is stored.
+     * @throws AuthError TOO_MANY_REQUESTS (with `retryAfterSeconds`) if a code was sent less than `resendAfterSeconds` ago.
+     */
+    createCode(channel: CodeChannel, destination: string, rules: CodeRules): Promise<string>;
+    /**
+     * Checks a typed code and uses it up if right.
+     *
+     * @param channel - "email" or "sms".
+     * @param destination - The email or phone number the code was sent to.
+     * @param typedCode - What the user typed.
+     * @throws AuthError OTP_EXPIRED when there is no usable code (none sent, expired, used, or too many wrong tries).
+     * @throws AuthError INVALID_OTP (with `attemptsLeft`) when the code is wrong.
+     */
+    verifyCode(channel: CodeChannel, destination: string, typedCode: unknown): Promise<void>;
+}

package/dist/features/one-time-codes/one-time-codes.service.js

@@ -0,0 +1,102 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OneTimeCodesService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const auth_error_1 = require("../../common/auth-error.js");
+const random_secrets_1 = require("../../common/crypto/random-secrets.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+/**
+ * Short numeric codes sent by email or SMS ("Your code is 482913").
+ *
+ * - Only a salted hash of the code is stored.
+ * - A new code can be requested after `resendAfterSeconds` (default a minute); it replaces the previous one.
+ * - After ONE_TIME_CODE_MAX_ATTEMPTS wrong tries the code stops working.
+ * - A code works once.
+ */
+let OneTimeCodesService = class OneTimeCodesService {
+    database;
+    constructor(options) {
+        this.database = options.dataSource;
+    }
+    /**
+     * Creates a new code for `destination` and returns it so the caller can send it.
+     * Any earlier code for the same destination stops working.
+     *
+     * @param channel - "email" or "sms".
+     * @param destination - An email or E.164 phone number.
+     * @param rules - Code length, lifetime and how soon a new one may be sent.
+     * @returns The plain code to send. Only its hash is stored.
+     * @throws AuthError TOO_MANY_REQUESTS (with `retryAfterSeconds`) if a code was sent less than `resendAfterSeconds` ago.
+     */
+    async createCode(channel, destination, rules) {
+        const codes = this.database.getRepository(entities_1.OneTimeCodeEntity);
+        const resendAllowedAfter = new Date(Date.now() - rules.resendAfterSeconds * constants_1.SECOND_IN_MILLISECONDS);
+        const sentRecently = await codes.exists({ where: { channel, destination, createdAt: (0, typeorm_1.MoreThan)(resendAllowedAfter) } });
+        if (sentRecently)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.resendTooSoon, { retryAfterSeconds: rules.resendAfterSeconds });
+        const code = (0, random_secrets_1.createNumericCode)(rules.codeLength);
+        const salt = (0, random_secrets_1.createSalt)();
+        await this.database.transaction(async (transaction) => {
+            // Only the newest code works.
+            await transaction.update(entities_1.OneTimeCodeEntity, { channel, destination, usedAt: (0, typeorm_1.IsNull)() }, { usedAt: new Date() });
+            await transaction.insert(entities_1.OneTimeCodeEntity, {
+                channel,
+                destination,
+                salt,
+                codeHash: (0, random_secrets_1.hashShortCode)(code, salt),
+                expiresAt: new Date(Date.now() + rules.expiresInMinutes * constants_1.MINUTE_IN_SECONDS * constants_1.SECOND_IN_MILLISECONDS),
+            });
+        });
+        return code;
+    }
+    /**
+     * Checks a typed code and uses it up if right.
+     *
+     * @param channel - "email" or "sms".
+     * @param destination - The email or phone number the code was sent to.
+     * @param typedCode - What the user typed.
+     * @throws AuthError OTP_EXPIRED when there is no usable code (none sent, expired, used, or too many wrong tries).
+     * @throws AuthError INVALID_OTP (with `attemptsLeft`) when the code is wrong.
+     */
+    async verifyCode(channel, destination, typedCode) {
+        const codes = this.database.getRepository(entities_1.OneTimeCodeEntity);
+        const latestCode = await codes.findOne({
+            where: { channel, destination, usedAt: (0, typeorm_1.IsNull)() },
+            order: { createdAt: constants_1.SORT_ORDER.newestFirst },
+        });
+        const isUsable = latestCode && latestCode.expiresAt.getTime() > Date.now() && latestCode.failedAttempts < constants_1.ONE_TIME_CODE_MAX_ATTEMPTS;
+        if (!isUsable)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.otpExpired);
+        const codeIsRight = typeof typedCode === 'string' && (0, random_secrets_1.constantTimeEquals)((0, random_secrets_1.hashShortCode)(typedCode.trim(), latestCode.salt), latestCode.codeHash);
+        if (!codeIsRight) {
+            await codes.increment({ id: latestCode.id }, 'failedAttempts', 1);
+            const attemptsLeft = constants_1.ONE_TIME_CODE_MAX_ATTEMPTS - latestCode.failedAttempts - 1;
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOtp, { attemptsLeft: Math.max(attemptsLeft, 0) });
+        }
+        // Use it up in one UPDATE, so the same code can't sign in twice at the same moment.
+        const result = await codes.update({ id: latestCode.id, usedAt: (0, typeorm_1.IsNull)() }, { usedAt: new Date() });
+        if (!result.affected)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.otpExpired);
+    }
+};
+exports.OneTimeCodesService = OneTimeCodesService;
+exports.OneTimeCodesService = OneTimeCodesService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object])
+], OneTimeCodesService);
+//# sourceMappingURL=one-time-codes.service.js.map