@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/passwords/password-policy.service.d.ts

@@ -0,0 +1,63 @@
+import { AuthSettings } from '../settings/settings.types.js';
+/**
+ * Everything about password strength and storage:
+ * - checks a new password against the rules in settings.password,
+ * - refuses passwords known from data breaches,
+ * - hashes with Argon2id (the current OWASP recommendation) and verifies hashes.
+ */
+export declare class PasswordPolicyService {
+    private readonly logger;
+    /**
+     * A hash of a random password, checked when an email has no account. Sign-in then takes the same
+     * time whether or not the account exists, so timing can't reveal who has an account.
+     */
+    private dummyPasswordHash?;
+    /**
+     * Checks a new password against the rules in settings, then against known data breaches.
+     *
+     * @param password - The new password from the request.
+     * @param settings - The current settings (length and character rules).
+     * @returns The password, now known to be a string.
+     * @throws AuthError INVALID_PASSWORD with `requirements` listing every broken rule.
+     * @throws AuthError INVALID_PASSWORD (with a breach message) when the password appeared in a data breach.
+     */
+    assertPasswordIsAcceptable(password: unknown, settings: AuthSettings): Promise<string>;
+    /**
+     * Hashes a password with Argon2id.
+     *
+     * @param password - The plain password.
+     * @returns The hash to store (it includes its own salt and settings).
+     */
+    hashPassword(password: string): Promise<string>;
+    /**
+     * Checks a typed password against a stored hash.
+     *
+     * @param storedHash - The user's hash, or `null` when there is no account. A dummy hash is then
+     *   checked anyway, so the response takes the same time either way.
+     * @param typedPassword - The password from the request.
+     * @returns True only when there is a stored hash and the password matches it.
+     */
+    verifyPassword(storedHash: string | null, typedPassword: unknown): Promise<boolean>;
+    /**
+     * Checks whether an old hash was made with weaker settings and should be replaced on next sign-in.
+     *
+     * @param storedHash - The user's current hash.
+     * @returns True when the hash should be recreated.
+     */
+    needsRehash(storedHash: string): boolean;
+    /**
+     * Asks haveibeenpwned.com whether the password appeared in a breach, using "k-anonymity":
+     * only the first 5 characters of its SHA-1 hash are sent, never the password.
+     * If the service is slow or down, the password is allowed (sign-up should not depend on it).
+     *
+     * @param password - The new password.
+     * @returns True when the password is known from a breach.
+     */
+    private isKnownBreachedPassword;
+    /**
+     * Creates (once) the hash of a random password, used by `verifyPassword` when there is no account.
+     *
+     * @returns The dummy hash.
+     */
+    private getDummyPasswordHash;
+}

package/dist/features/passwords/password-policy.service.js

@@ -0,0 +1,175 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordPolicyService = void 0;
+const common_1 = require("@nestjs/common");
+const argon2 = __importStar(require("argon2"));
+const node_crypto_1 = require("node:crypto");
+const auth_error_1 = require("../../common/auth-error.js");
+const constants_1 = require("../../constants.js");
+/**
+ * Everything about password strength and storage:
+ * - checks a new password against the rules in settings.password,
+ * - refuses passwords known from data breaches,
+ * - hashes with Argon2id (the current OWASP recommendation) and verifies hashes.
+ */
+let PasswordPolicyService = class PasswordPolicyService {
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.passwordPolicy);
+    /**
+     * A hash of a random password, checked when an email has no account. Sign-in then takes the same
+     * time whether or not the account exists, so timing can't reveal who has an account.
+     */
+    dummyPasswordHash;
+    /**
+     * Checks a new password against the rules in settings, then against known data breaches.
+     *
+     * @param password - The new password from the request.
+     * @param settings - The current settings (length and character rules).
+     * @returns The password, now known to be a string.
+     * @throws AuthError INVALID_PASSWORD with `requirements` listing every broken rule.
+     * @throws AuthError INVALID_PASSWORD (with a breach message) when the password appeared in a data breach.
+     */
+    async assertPasswordIsAcceptable(password, settings) {
+        if (typeof password !== 'string')
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPassword);
+        const rules = settings.password;
+        const brokenRules = [];
+        if (password.length < rules.minimumLength)
+            brokenRules.push(constants_1.PASSWORD_REQUIREMENT.minimumLength(rules.minimumLength));
+        if (password.length > constants_1.PASSWORD_MAX_LENGTH)
+            brokenRules.push(constants_1.PASSWORD_REQUIREMENT.maximumLength(constants_1.PASSWORD_MAX_LENGTH));
+        if (rules.requireUppercaseLetter && !constants_1.UPPERCASE_LETTER_PATTERN.test(password))
+            brokenRules.push(constants_1.PASSWORD_REQUIREMENT.uppercaseLetter);
+        if (rules.requireLowercaseLetter && !constants_1.LOWERCASE_LETTER_PATTERN.test(password))
+            brokenRules.push(constants_1.PASSWORD_REQUIREMENT.lowercaseLetter);
+        if (rules.requireNumber && !constants_1.DIGIT_PATTERN.test(password))
+            brokenRules.push(constants_1.PASSWORD_REQUIREMENT.number);
+        if (rules.requireSymbol && !constants_1.PASSWORD_SYMBOL_PATTERN.test(password))
+            brokenRules.push(constants_1.PASSWORD_REQUIREMENT.symbol);
+        if (brokenRules.length > 0)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPassword, { requirements: brokenRules });
+        if (rules.rejectBreachedPasswords && (await this.isKnownBreachedPassword(password))) {
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.breachedPassword);
+        }
+        return password;
+    }
+    /**
+     * Hashes a password with Argon2id.
+     *
+     * @param password - The plain password.
+     * @returns The hash to store (it includes its own salt and settings).
+     */
+    hashPassword(password) {
+        return argon2.hash(password, { type: argon2.argon2id, ...constants_1.ARGON2_HASHING_OPTIONS });
+    }
+    /**
+     * Checks a typed password against a stored hash.
+     *
+     * @param storedHash - The user's hash, or `null` when there is no account. A dummy hash is then
+     *   checked anyway, so the response takes the same time either way.
+     * @param typedPassword - The password from the request.
+     * @returns True only when there is a stored hash and the password matches it.
+     */
+    async verifyPassword(storedHash, typedPassword) {
+        const password = typeof typedPassword === 'string' ? typedPassword.slice(0, constants_1.PASSWORD_MAX_LENGTH) : '';
+        const hashToCheck = storedHash ?? (await this.getDummyPasswordHash());
+        try {
+            const matches = await argon2.verify(hashToCheck, password);
+            return storedHash !== null && matches;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Checks whether an old hash was made with weaker settings and should be replaced on next sign-in.
+     *
+     * @param storedHash - The user's current hash.
+     * @returns True when the hash should be recreated.
+     */
+    needsRehash(storedHash) {
+        return argon2.needsRehash(storedHash, { ...constants_1.ARGON2_HASHING_OPTIONS });
+    }
+    /**
+     * Asks haveibeenpwned.com whether the password appeared in a breach, using "k-anonymity":
+     * only the first 5 characters of its SHA-1 hash are sent, never the password.
+     * If the service is slow or down, the password is allowed (sign-up should not depend on it).
+     *
+     * @param password - The new password.
+     * @returns True when the password is known from a breach.
+     */
+    async isKnownBreachedPassword(password) {
+        const sha1 = (0, node_crypto_1.createHash)(constants_1.HASH_ALGORITHM.sha1).update(password).digest(constants_1.TEXT_ENCODING.hex).toUpperCase();
+        const hashPrefix = sha1.slice(0, constants_1.BREACHED_PASSWORD_HASH_PREFIX_LENGTH);
+        const hashSuffix = sha1.slice(constants_1.BREACHED_PASSWORD_HASH_PREFIX_LENGTH);
+        try {
+            const response = await fetch(`${constants_1.BREACHED_PASSWORD_API_URL}${hashPrefix}`, {
+                headers: { [constants_1.BREACHED_PASSWORD_API.paddingHeader]: constants_1.BREACHED_PASSWORD_API.paddingHeaderValue },
+                signal: AbortSignal.timeout(constants_1.BREACHED_PASSWORD_CHECK_TIMEOUT_MS),
+            });
+            if (!response.ok)
+                return false;
+            const responseLines = (await response.text()).split(constants_1.BREACHED_PASSWORD_API.lineSeparator);
+            return responseLines.some((line) => {
+                const [suffix, timesSeen] = line.trim().split(constants_1.BREACHED_PASSWORD_API.countSeparator);
+                return suffix === hashSuffix && Number(timesSeen) > 0;
+            });
+        }
+        catch (error) {
+            this.logger.warn(`Breached-password check skipped: ${error.message}`);
+            return false;
+        }
+    }
+    /**
+     * Creates (once) the hash of a random password, used by `verifyPassword` when there is no account.
+     *
+     * @returns The dummy hash.
+     */
+    getDummyPasswordHash() {
+        this.dummyPasswordHash ??= this.hashPassword((0, node_crypto_1.createHash)(constants_1.HASH_ALGORITHM.sha256).update(String(Math.random())).digest(constants_1.TEXT_ENCODING.hex));
+        return this.dummyPasswordHash;
+    }
+};
+exports.PasswordPolicyService = PasswordPolicyService;
+exports.PasswordPolicyService = PasswordPolicyService = __decorate([
+    (0, common_1.Injectable)()
+], PasswordPolicyService);
+//# sourceMappingURL=password-policy.service.js.map

package/dist/features/passwords/password-policy.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-policy.service.js","sourceRoot":"","sources":["../../../src/features/passwords/password-policy.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,+CAAiC;AACjC,6CAAyC;AACzC,oDAAgD;AAChD,2CAgBqB;AAGrB;;;;;GAKG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACf,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,cAAc,CAAC,CAAC;IACjE;;;OAGG;IACK,iBAAiB,CAAmB;IAE5C;;;;;;;;OAQG;IACH,KAAK,CAAC,0BAA0B,CAAC,QAAiB,EAAE,QAAsB;QACxE,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,eAAe,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAEhC,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,aAAa;YAAE,WAAW,CAAC,IAAI,CAAC,gCAAoB,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACrH,IAAI,QAAQ,CAAC,MAAM,GAAG,+BAAmB;YAAE,WAAW,CAAC,IAAI,CAAC,gCAAoB,CAAC,aAAa,CAAC,+BAAmB,CAAC,CAAC,CAAC;QACrH,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,oCAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,gCAAoB,CAAC,eAAe,CAAC,CAAC;QACrI,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,oCAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,gCAAoB,CAAC,eAAe,CAAC,CAAC;QACrI,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,yBAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,gCAAoB,CAAC,MAAM,CAAC,CAAC;QACxG,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,mCAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,gCAAoB,CAAC,MAAM,CAAC,CAAC;QAClH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QAE5G,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,QAAgB;QAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,kCAAsB,EAAE,CAAC,CAAC;IACrF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,UAAyB,EAAE,aAAsB;QACpE,MAAM,QAAQ,GAAG,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,WAAW,GAAG,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC3D,OAAO,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,WAAW,CAAC,UAAkB;QAC5B,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,kCAAsB,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,uBAAuB,CAAC,QAAgB;QACpD,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,0BAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAa,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACtG,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,gDAAoC,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,gDAAoC,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,qCAAyB,GAAG,UAAU,EAAE,EAAE;gBACxE,OAAO,EAAE,EAAE,CAAC,iCAAqB,CAAC,aAAa,CAAC,EAAE,iCAAqB,CAAC,kBAAkB,EAAE;gBAC5F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,8CAAkC,CAAC;aAChE,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,aAAa,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAqB,CAAC,aAAa,CAAC,CAAC;YACzF,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACjC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iCAAqB,CAAC,cAAc,CAAC,CAAC;gBACpF,OAAO,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACxD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAqC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,oBAAoB;QAC1B,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC,YAAY,CAAC,IAAA,wBAAU,EAAC,0BAAc,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,yBAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACxI,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;CACF,CAAA;AAjHY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;GACA,qBAAqB,CAiHjC"}

package/dist/features/passwords/password.controller.d.ts

@@ -0,0 +1,95 @@
+import { RequestContext } from '../../common/request-context.js';
+import { EmailVerificationService } from '../email-links/email-verification.service.js';
+import { AccessTokenClaims } from '../sessions/session.types.js';
+import { PasswordAuthService } from './password-auth.service';
+import { ChangePasswordInput, EmailOnlyInput, RegisterInput, ResetPasswordInput, SignInWithPasswordInput, TokenInput } from './password.dto';
+/**
+ * Email + password and email verification.
+ *
+ *   POST /auth/register                  create an account
+ *   POST /auth/login                     sign in
+ *   POST /auth/email/send-verification   (re)send the verification link
+ *   POST /auth/email/verify              use the token from the link
+ *   POST /auth/password/forgot           email a reset link
+ *   POST /auth/password/reset            set a new password with the token from the link
+ *   POST /auth/password/change           signed in: change (or first set) the password
+ */
+export declare class PasswordController {
+    private readonly passwordAuth;
+    private readonly emailVerification;
+    constructor(passwordAuth: PasswordAuthService, emailVerification: EmailVerificationService);
+    /**
+     * POST /auth/register — Creates an account. Public.
+     *
+     * @param body - The sign-up form.
+     * @param request - Who is asking.
+     * @returns See `PasswordAuthService.register`.
+     */
+    register(body: RegisterInput, request: RequestContext): Promise<import("../..").SignInResult | import("./password-auth.service").RegisteredResult>;
+    /**
+     * POST /auth/login — Signs in with email + password. Public.
+     *
+     * @param body - `{ email, password }`.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    login(body: SignInWithPasswordInput, request: RequestContext): Promise<import("../..").SignInResult>;
+    /**
+     * POST /auth/email/send-verification — (Re)sends the email verification link. Public.
+     *
+     * @param body - `{ email }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    sendVerificationEmail(body: EmailOnlyInput, request: RequestContext): Promise<{
+        success: true;
+        message: "If this email needs verifying, a verification link is on its way.";
+    }>;
+    /**
+     * POST /auth/email/verify — Verifies the email with the token from the link. Public.
+     *
+     * @param body - `{ token }`.
+     * @param request - Who is asking.
+     * @returns See `EmailVerificationService.verifyEmail`.
+     */
+    verifyEmail(body: TokenInput, request: RequestContext): Promise<{
+        success: true;
+        message: "Your email has been verified.";
+        status: import("../../constants.js").AccountStatus;
+        pendingVerifications: import("../../constants.js").PendingVerification[];
+    }>;
+    /**
+     * POST /auth/password/forgot — Emails a password reset link. Public.
+     *
+     * @param body - `{ email }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    forgotPassword(body: EmailOnlyInput, request: RequestContext): Promise<{
+        success: true;
+        message: "If an account exists for this email, a password reset link is on its way.";
+    }>;
+    /**
+     * POST /auth/password/reset — Sets a new password with the token from the link. Public.
+     *
+     * @param body - `{ token, newPassword }`.
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    resetPassword(body: ResetPasswordInput, request: RequestContext): Promise<{
+        success: true;
+        message: "Your password has been reset. Please sign in with your new password.";
+    }>;
+    /**
+     * POST /auth/password/change — Changes (or first sets) the signed-in user's password.
+     *
+     * @param user - The access token's claims (user id and session id).
+     * @param body - `{ currentPassword, newPassword }`.
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    changePassword(user: AccessTokenClaims, body: ChangePasswordInput, request: RequestContext): Promise<{
+        success: true;
+        message: "Your password has been changed. Other devices have been signed out.";
+    }>;
+}

package/dist/features/passwords/password.controller.js

@@ -0,0 +1,193 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordController = void 0;
+const common_1 = require("@nestjs/common");
+const strict_validation_pipe_1 = require("../../common/strict-validation.pipe.js");
+const request_context_1 = require("../../common/request-context.js");
+const auth_decorators_1 = require("../../guards/auth.decorators.js");
+const email_verification_service_1 = require("../email-links/email-verification.service.js");
+const password_auth_service_1 = require("./password-auth.service");
+const password_dto_1 = require("./password.dto");
+const constants_1 = require("../../constants.js");
+const refresh_token_cookie_1 = require("../../common/refresh-token-cookie.js");
+/**
+ * Email + password and email verification.
+ *
+ *   POST /auth/register                  create an account
+ *   POST /auth/login                     sign in
+ *   POST /auth/email/send-verification   (re)send the verification link
+ *   POST /auth/email/verify              use the token from the link
+ *   POST /auth/password/forgot           email a reset link
+ *   POST /auth/password/reset            set a new password with the token from the link
+ *   POST /auth/password/change           signed in: change (or first set) the password
+ */
+let PasswordController = class PasswordController {
+    passwordAuth;
+    emailVerification;
+    constructor(passwordAuth, emailVerification) {
+        this.passwordAuth = passwordAuth;
+        this.emailVerification = emailVerification;
+    }
+    /**
+     * POST /auth/register — Creates an account. Public.
+     *
+     * @param body - The sign-up form.
+     * @param request - Who is asking.
+     * @returns See `PasswordAuthService.register`.
+     */
+    register(body, request) {
+        return this.passwordAuth.register(body, request);
+    }
+    /**
+     * POST /auth/login — Signs in with email + password. Public.
+     *
+     * @param body - `{ email, password }`.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    login(body, request) {
+        return this.passwordAuth.signInWithPassword(body.email, body.password, request);
+    }
+    /**
+     * POST /auth/email/send-verification — (Re)sends the email verification link. Public.
+     *
+     * @param body - `{ email }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    sendVerificationEmail(body, request) {
+        return this.emailVerification.sendVerificationEmail(body.email, request);
+    }
+    /**
+     * POST /auth/email/verify — Verifies the email with the token from the link. Public.
+     *
+     * @param body - `{ token }`.
+     * @param request - Who is asking.
+     * @returns See `EmailVerificationService.verifyEmail`.
+     */
+    verifyEmail(body, request) {
+        return this.emailVerification.verifyEmail(body.token, request);
+    }
+    /**
+     * POST /auth/password/forgot — Emails a password reset link. Public.
+     *
+     * @param body - `{ email }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    forgotPassword(body, request) {
+        return this.passwordAuth.requestPasswordReset(body.email, request);
+    }
+    /**
+     * POST /auth/password/reset — Sets a new password with the token from the link. Public.
+     *
+     * @param body - `{ token, newPassword }`.
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    resetPassword(body, request) {
+        return this.passwordAuth.resetPassword(body.token, body.newPassword, request);
+    }
+    /**
+     * POST /auth/password/change — Changes (or first sets) the signed-in user's password.
+     *
+     * @param user - The access token's claims (user id and session id).
+     * @param body - `{ currentPassword, newPassword }`.
+     * @param request - Who is asking.
+     * @returns A success message.
+     */
+    changePassword(user, body, request) {
+        return this.passwordAuth.changePassword(user.sub, user.sid, body.currentPassword, body.newPassword, request);
+    }
+};
+exports.PasswordController = PasswordController;
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.register),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.CREATED),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_dto_1.RegisterInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordController.prototype, "register", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.login),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_dto_1.SignInWithPasswordInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordController.prototype, "login", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.emailSendVerification),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_dto_1.EmailOnlyInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordController.prototype, "sendVerificationEmail", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.emailVerify),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_dto_1.TokenInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordController.prototype, "verifyEmail", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.passwordForgot),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_dto_1.EmailOnlyInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordController.prototype, "forgotPassword", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.passwordReset),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_dto_1.ResetPasswordInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordController.prototype, "resetPassword", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.passwordChange),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, auth_decorators_1.CurrentUser)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, password_dto_1.ChangePasswordInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordController.prototype, "changePassword", null);
+exports.PasswordController = PasswordController = __decorate([
+    (0, common_1.Controller)(constants_1.ROUTES.auth.prefix),
+    (0, refresh_token_cookie_1.LibraryController)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.strictValidationPipe),
+    __metadata("design:paramtypes", [password_auth_service_1.PasswordAuthService,
+        email_verification_service_1.EmailVerificationService])
+], PasswordController);
+//# sourceMappingURL=password.controller.js.map

package/dist/features/passwords/password.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.controller.js","sourceRoot":"","sources":["../../../src/features/passwords/password.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwF;AACxF,4EAAuE;AACvE,8DAA0E;AAC1E,8DAA+D;AAC/D,kGAA6F;AAE7F,mEAA8D;AAC9D,iDAOwB;AACxB,2CAAqC;AACrC,wEAAkE;AAElE;;;;;;;;;;GAUG;AAII,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAEV;IACA;IAFnB,YACmB,YAAiC,EACjC,iBAA2C;QAD3C,iBAAY,GAAZ,YAAY,CAAqB;QACjC,sBAAiB,GAAjB,iBAAiB,CAA0B;IAC3D,CAAC;IAEJ;;;;;;OAMG;IAIH,QAAQ,CAAS,IAAmB,EAAoB,OAAuB;QAC7E,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;;;;OAMG;IAIH,KAAK,CAAS,IAA6B,EAAoB,OAAuB;QACpF,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;OAMG;IAIH,qBAAqB,CAAS,IAAoB,EAAoB,OAAuB;QAC3F,OAAO,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IAIH,WAAW,CAAS,IAAgB,EAAoB,OAAuB;QAC7E,OAAO,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IAIH,cAAc,CAAS,IAAoB,EAAoB,OAAuB;QACpF,OAAO,IAAI,CAAC,YAAY,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IAIH,aAAa,CAAS,IAAwB,EAAoB,OAAuB;QACvF,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;IAED;;;;;;;OAOG;IAGH,cAAc,CAAgB,IAAuB,EAAU,IAAyB,EAAoB,OAAuB;QACjI,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/G,CAAC;CACF,CAAA;AAvGY,gDAAkB;AAgB7B;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC1B,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,OAAO,CAAC;IACnB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAuB,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAhC,4BAAa;;kDAEnC;AAYD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IACvB,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACjB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAiC,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAA1C,sCAAuB;;+CAE1C;AAYD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC;IACvC,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACD,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwB,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAjC,6BAAc;;+DAEjD;AAYD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,WAAW,CAAC;IAC7B,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoB,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAA7B,yBAAU;;qDAEnC;AAYD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,cAAc,CAAC;IAChC,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACR,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwB,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAjC,6BAAc;;wDAE1C;AAYD;IAHC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,aAAa,CAAC;IAC/B,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;IAA4B,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAArC,iCAAkB;;uDAE7C;AAYD;IAFC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,cAAc,CAAC;IAChC,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACR,WAAA,IAAA,6BAAW,GAAE,CAAA;IAA2B,WAAA,IAAA,aAAI,GAAE,CAAA;IAA6B,WAAA,IAAA,gCAAc,GAAE,CAAA;;6CAAtC,kCAAmB;;wDAEvF;6BAtGU,kBAAkB;IAH9B,IAAA,mBAAU,EAAC,kBAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IAC9B,IAAA,wCAAiB,GAAE;IACnB,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAGI,2CAAmB;QACd,qDAAwB;GAHnD,kBAAkB,CAuG9B"}

package/dist/features/passwords/password.dto.d.ts

@@ -0,0 +1,36 @@
+/** POST /auth/register */
+export declare class RegisterInput {
+    email: string;
+    password: string;
+    firstName?: string;
+    lastName?: string;
+    /** International format, e.g. +919876543210. */
+    phoneNumber?: string;
+    acceptTerms?: boolean;
+    acceptPrivacyPolicy?: boolean;
+}
+/** POST /auth/login */
+export declare class SignInWithPasswordInput {
+    email: string;
+    password: string;
+}
+/** POST /auth/password/forgot, /auth/email/send-verification, /auth/email/send-otp, magic link */
+export declare class EmailOnlyInput {
+    email: string;
+}
+/** POST /auth/password/reset */
+export declare class ResetPasswordInput {
+    /** The token from the reset link. */
+    token: string;
+    newPassword: string;
+}
+/** POST /auth/password/change */
+export declare class ChangePasswordInput {
+    /** Leave out only if the account has no password yet (signed up with Google etc.). */
+    currentPassword?: string;
+    newPassword: string;
+}
+/** Any endpoint that receives a single token: verify email, magic link, refresh, reactivate... */
+export declare class TokenInput {
+    token: string;
+}