@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/sign-in/sign-in-challenges.service.d.ts

@@ -0,0 +1,54 @@
+import { AuthOptions } from '../../auth-options.js';
+import { CHALLENGE_PURPOSE } from '../../constants.js';
+import { ChallengePurpose } from '../../database/entities/index.js';
+import { SignInMethod } from '../sessions/session.types.js';
+/** A challenge that has been checked and is ready to finish. */
+export interface OpenChallenge {
+    challengeId: string;
+    userId: string;
+    signInMethod: SignInMethod;
+}
+/**
+ * Short-lived "half done" tokens (prefix "ch_"):
+ * - two_factor: the first step passed, the 2FA code is next.
+ * - reactivate_account: a DEACTIVATED user proved who they are and may now reactivate.
+ *
+ * Only the token's hash is stored. A token can be used once, and a few wrong 2FA codes burn it.
+ */
+export declare class SignInChallengesService {
+    private readonly database;
+    constructor(options: AuthOptions);
+    /**
+     * Creates a challenge and returns the plain token to give the client. Only its hash is stored.
+     *
+     * @param purpose - "two_factor" or "reactivate_account".
+     * @param userId - The user who passed the first step.
+     * @param signInMethod - How they passed it (kept for the final sign-in).
+     * @param lifetimeSeconds - How long the token works.
+     * @returns The plain "ch_..." token.
+     */
+    createChallenge(purpose: typeof CHALLENGE_PURPOSE.twoFactor | typeof CHALLENGE_PURPOSE.reactivateAccount, userId: string, signInMethod: SignInMethod, lifetimeSeconds: number): Promise<string>;
+    /**
+     * Looks up a challenge token without using it up.
+     *
+     * @param challengeToken - The token the client sent.
+     * @param purpose - What the token must be for.
+     * @returns The challenge's id, user and sign-in method.
+     * @throws AuthError INVALID_TOKEN if the token is unknown, already used, expired,
+     *   or has had too many wrong codes.
+     */
+    findOpenChallenge(challengeToken: unknown, purpose: ChallengePurpose): Promise<OpenChallenge>;
+    /**
+     * Marks the challenge used, so the same step can never complete twice.
+     *
+     * @param challengeId - From `findOpenChallenge`.
+     * @returns False if another request used it first.
+     */
+    markChallengeUsed(challengeId: string): Promise<boolean>;
+    /**
+     * Counts a wrong code. After TWO_FACTOR_MAX_ATTEMPTS the challenge stops working.
+     *
+     * @param challengeId - From `findOpenChallenge`.
+     */
+    recordFailedAttempt(challengeId: string): Promise<void>;
+}

package/dist/features/sign-in/sign-in-challenges.service.js

@@ -0,0 +1,104 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignInChallengesService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const auth_error_1 = require("../../common/auth-error.js");
+const random_secrets_1 = require("../../common/crypto/random-secrets.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+/**
+ * Short-lived "half done" tokens (prefix "ch_"):
+ * - two_factor: the first step passed, the 2FA code is next.
+ * - reactivate_account: a DEACTIVATED user proved who they are and may now reactivate.
+ *
+ * Only the token's hash is stored. A token can be used once, and a few wrong 2FA codes burn it.
+ */
+let SignInChallengesService = class SignInChallengesService {
+    database;
+    constructor(options) {
+        this.database = options.dataSource;
+    }
+    /**
+     * Creates a challenge and returns the plain token to give the client. Only its hash is stored.
+     *
+     * @param purpose - "two_factor" or "reactivate_account".
+     * @param userId - The user who passed the first step.
+     * @param signInMethod - How they passed it (kept for the final sign-in).
+     * @param lifetimeSeconds - How long the token works.
+     * @returns The plain "ch_..." token.
+     */
+    async createChallenge(purpose, userId, signInMethod, lifetimeSeconds) {
+        const { plainToken, tokenHash } = (0, random_secrets_1.createRandomToken)(constants_1.TOKEN_PREFIX.signInChallenge);
+        await this.database.getRepository(entities_1.SignInChallengeEntity).insert({
+            purpose,
+            userId,
+            signInMethod,
+            challengeTokenHash: tokenHash,
+            expiresAt: new Date(Date.now() + lifetimeSeconds * constants_1.SECOND_IN_MILLISECONDS),
+        });
+        return plainToken;
+    }
+    /**
+     * Looks up a challenge token without using it up.
+     *
+     * @param challengeToken - The token the client sent.
+     * @param purpose - What the token must be for.
+     * @returns The challenge's id, user and sign-in method.
+     * @throws AuthError INVALID_TOKEN if the token is unknown, already used, expired,
+     *   or has had too many wrong codes.
+     */
+    async findOpenChallenge(challengeToken, purpose) {
+        if (!(0, random_secrets_1.hasRandomTokenFormat)(challengeToken, constants_1.TOKEN_PREFIX.signInChallenge))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOrExpiredLink);
+        const challenge = await this.database.getRepository(entities_1.SignInChallengeEntity).findOne({
+            where: { challengeTokenHash: (0, random_secrets_1.sha256Hex)(challengeToken), purpose, usedAt: (0, typeorm_1.IsNull)() },
+        });
+        const isUsable = challenge &&
+            challenge.userId &&
+            challenge.expiresAt.getTime() > Date.now() &&
+            challenge.failedAttempts < constants_1.TWO_FACTOR_MAX_ATTEMPTS;
+        if (!isUsable)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOrExpiredLink);
+        return { challengeId: challenge.id, userId: challenge.userId, signInMethod: challenge.signInMethod };
+    }
+    /**
+     * Marks the challenge used, so the same step can never complete twice.
+     *
+     * @param challengeId - From `findOpenChallenge`.
+     * @returns False if another request used it first.
+     */
+    async markChallengeUsed(challengeId) {
+        const result = await this.database
+            .getRepository(entities_1.SignInChallengeEntity)
+            .update({ id: challengeId, usedAt: (0, typeorm_1.IsNull)() }, { usedAt: new Date() });
+        return (result.affected ?? 0) > 0;
+    }
+    /**
+     * Counts a wrong code. After TWO_FACTOR_MAX_ATTEMPTS the challenge stops working.
+     *
+     * @param challengeId - From `findOpenChallenge`.
+     */
+    async recordFailedAttempt(challengeId) {
+        await this.database.getRepository(entities_1.SignInChallengeEntity).increment({ id: challengeId }, 'failedAttempts', 1);
+    }
+};
+exports.SignInChallengesService = SignInChallengesService;
+exports.SignInChallengesService = SignInChallengesService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object])
+], SignInChallengesService);
+//# sourceMappingURL=sign-in-challenges.service.js.map

package/dist/features/sign-in/sign-in-challenges.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-challenges.service.js","sourceRoot":"","sources":["../../../src/features/sign-in/sign-in-challenges.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAA6C;AAE7C,oDAAgD;AAChD,mEAAoG;AACpG,2CAOqB;AACrB,kDAA8E;AAU9E;;;;;;GAMG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACjB,QAAQ,CAAa;IAEtC,YAAwC,OAAoB;QAC1D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CACnB,OAAwF,EACxF,MAAc,EACd,YAA0B,EAC1B,eAAuB;QAEvB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAA,kCAAiB,EAAC,wBAAY,CAAC,eAAe,CAAC,CAAC;QAClF,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,MAAM,CAAC;YAC9D,OAAO;YACP,MAAM;YACN,YAAY;YACZ,kBAAkB,EAAE,SAAS;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,GAAG,kCAAsB,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,iBAAiB,CAAC,cAAuB,EAAE,OAAyB;QACxE,IAAI,CAAC,IAAA,qCAAoB,EAAC,cAAc,EAAE,wBAAY,CAAC,eAAe,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QAC/H,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,OAAO,CAAC;YACjF,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAA,0BAAS,EAAC,cAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAA,gBAAM,GAAE,EAAE;SACpF,CAAC,CAAC;QACH,MAAM,QAAQ,GACZ,SAAS;YACT,SAAS,CAAC,MAAM;YAChB,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YAC1C,SAAS,CAAC,cAAc,GAAG,mCAAuB,CAAC;QACrD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACrE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAO,EAAE,YAAY,EAAE,SAAS,CAAC,YAA4B,EAAE,CAAC;IACxH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;aAC/B,aAAa,CAAC,gCAAqB,CAAC;aACpC,MAAM,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,WAAmB;QAC3C,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IAC/G,CAAC;CACF,CAAA;AA7EY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;;GAH5B,uBAAuB,CA6EnC"}

package/dist/features/sign-in/sign-in.service.d.ts

@@ -0,0 +1,127 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RequestContext } from '../../common/request-context.js';
+import { type SignInFailureReason } from '../../constants.js';
+import { UserEntity } from '../../database/entities/index.js';
+import { AuthEventsService } from '../events/auth-events.service.js';
+import { NotificationsService } from '../notifications/notifications.service.js';
+import { SessionService } from '../sessions/session.service.js';
+import { SignInMethod } from '../sessions/session.types.js';
+import { AuthSettings } from '../settings/settings.types.js';
+import { UsersService } from '../users/users.service.js';
+import { SignInChallengesService } from './sign-in-challenges.service';
+import { SignedInResult, SignInResult } from './sign-in.types';
+/**
+ * The one path every sign-in method ends in (password, codes, magic link, Google, passkeys...).
+ * Each method only proves who the user is; this service then decides what happens:
+ *
+ * - Is the account allowed to sign in? Suspended, deactivated or unverified accounts stop here
+ *   with a clear error code.
+ * - Does the user have 2FA turned on? Then a challenge token is returned instead of tokens.
+ * - Otherwise a session starts and tokens are returned (plus the "new sign-in" email and event).
+ *
+ * Keeping this in one place means a new sign-in method can never forget a security check.
+ */
+export declare class SignInService {
+    private readonly users;
+    private readonly sessions;
+    private readonly challenges;
+    private readonly notifications;
+    private readonly events;
+    private readonly database;
+    constructor(options: AuthOptions, users: UsersService, sessions: SessionService, challenges: SignInChallengesService, notifications: NotificationsService, events: AuthEventsService);
+    /**
+     * Called by a sign-in method once the user has proven who they are.
+     *
+     * @param user - The user who proved who they are.
+     * @param signInMethod - How they did it (password, passkey, google...).
+     * @param request - Who is asking (for the session, emails and audit log).
+     * @param settings - The current settings.
+     * @returns Either tokens (`status: "signed_in"`), or a challenge token (`status: "two_factor_required"`).
+     * @throws AuthError ACCOUNT_NOT_VERIFIED, ACCOUNT_DEACTIVATED or ACCOUNT_SUSPENDED (see `assertAccountCanSignIn`).
+     */
+    completeSignIn(user: UserEntity, signInMethod: SignInMethod, request: RequestContext, settings: AuthSettings): Promise<SignInResult>;
+    /**
+     * Called by the 2FA service after a correct authenticator or backup code. Checks the account
+     * again, because it may have been suspended in the minutes since the first step.
+     *
+     * @param user - The user who passed both steps.
+     * @param signInMethod - The method used for the first step.
+     * @param request - Who is asking.
+     * @param settings - The current settings.
+     * @returns Access and refresh tokens.
+     */
+    finishTwoFactorSignIn(user: UserEntity, signInMethod: SignInMethod, request: RequestContext, settings: AuthSettings): Promise<SignedInResult>;
+    /**
+     * A deactivated user proved who they are (the sign-in returned ACCOUNT_DEACTIVATED with a
+     * reactivationToken). This switches the account back on and signs them in.
+     *
+     * @param reactivationToken - The token from the ACCOUNT_DEACTIVATED error.
+     * @param request - Who is asking.
+     * @param settings - The current settings.
+     * @returns The same result as `completeSignIn` (tokens, or a 2FA challenge).
+     * @throws AuthError INVALID_TOKEN when the token is unknown, used or expired.
+     */
+    reactivateAndSignIn(reactivationToken: unknown, request: RequestContext, settings: AuthSettings): Promise<SignInResult>;
+    /**
+     * Signs out the device that made the request.
+     *
+     * @param userId - The signed-in user.
+     * @param sessionId - The session to end (from the access token).
+     * @param request - Who is asking (for the audit log).
+     */
+    signOut(userId: string, sessionId: string, request: RequestContext): Promise<void>;
+    /**
+     * Signs out every device of the user.
+     *
+     * @param userId - The signed-in user.
+     * @param request - Who is asking (for the audit log).
+     * @param keepSessionId - When given, this device stays signed in.
+     * @returns How many sessions were ended.
+     */
+    signOutEverywhere(userId: string, request: RequestContext, keepSessionId?: string): Promise<number>;
+    /**
+     * Records a failed attempt in the audit log (wrong password, wrong code...).
+     *
+     * @param userId - The user it was for, or null when the account is unknown.
+     * @param signInMethod - The method that was tried.
+     * @param reason - Why it failed.
+     * @param request - Who tried.
+     */
+    recordFailedSignIn(userId: string | null, signInMethod: SignInMethod, reason: SignInFailureReason, request: RequestContext): Promise<void>;
+    /**
+     * Stops sign-in for accounts that may not sign in, with a code the app can act on.
+     * These run only AFTER the user proved who they are, so they reveal nothing to a stranger.
+     *
+     * A pending account whose verifications are all done is activated here.
+     *
+     * @param user - The user signing in.
+     * @param signInMethod - How they proved who they are.
+     * @param request - Who is asking.
+     * @param settings - The current settings.
+     * @throws AuthError ACCOUNT_NOT_VERIFIED with `pendingVerifications`, so the app can show the right screen.
+     * @throws AuthError ACCOUNT_DEACTIVATED with a `reactivationToken` for `reactivateAndSignIn`.
+     * @throws AuthError ACCOUNT_SUSPENDED when an admin suspended the account.
+     * @throws AuthError INVALID_CREDENTIALS for deleted accounts (so they look like unknown ones).
+     */
+    private assertAccountCanSignIn;
+    /**
+     * Starts the session, records the sign-in, and sends the "new sign-in" email for a new device.
+     *
+     * @param user - The user signing in.
+     * @param signInMethod - How they signed in.
+     * @param usedTwoFactor - Whether a second factor was used (recorded in the session and tokens).
+     * @param request - Who is asking.
+     * @param settings - The current settings.
+     * @returns Tokens plus the user's public profile.
+     */
+    private startSignedInSession;
+    /**
+     * "New device" = the user has signed in before, but never with this browser/app (user agent).
+     * The very first sign-in is not reported, since the user just created the account.
+     *
+     * @param userId - The user signing in.
+     * @param request - Holds the user agent.
+     * @returns True when the "new sign-in" email should be sent.
+     */
+    private isNewDeviceForUser;
+}

package/dist/features/sign-in/sign-in.service.js

@@ -0,0 +1,248 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignInService = void 0;
+const common_1 = require("@nestjs/common");
+const auth_error_1 = require("../../common/auth-error.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+const notifications_service_1 = require("../notifications/notifications.service.js");
+const session_service_1 = require("../sessions/session.service.js");
+const users_service_1 = require("../users/users.service.js");
+const sign_in_challenges_service_1 = require("./sign-in-challenges.service");
+/**
+ * The one path every sign-in method ends in (password, codes, magic link, Google, passkeys...).
+ * Each method only proves who the user is; this service then decides what happens:
+ *
+ * - Is the account allowed to sign in? Suspended, deactivated or unverified accounts stop here
+ *   with a clear error code.
+ * - Does the user have 2FA turned on? Then a challenge token is returned instead of tokens.
+ * - Otherwise a session starts and tokens are returned (plus the "new sign-in" email and event).
+ *
+ * Keeping this in one place means a new sign-in method can never forget a security check.
+ */
+let SignInService = class SignInService {
+    users;
+    sessions;
+    challenges;
+    notifications;
+    events;
+    database;
+    constructor(options, users, sessions, challenges, notifications, events) {
+        this.users = users;
+        this.sessions = sessions;
+        this.challenges = challenges;
+        this.notifications = notifications;
+        this.events = events;
+        this.database = options.dataSource;
+    }
+    /**
+     * Called by a sign-in method once the user has proven who they are.
+     *
+     * @param user - The user who proved who they are.
+     * @param signInMethod - How they did it (password, passkey, google...).
+     * @param request - Who is asking (for the session, emails and audit log).
+     * @param settings - The current settings.
+     * @returns Either tokens (`status: "signed_in"`), or a challenge token (`status: "two_factor_required"`).
+     * @throws AuthError ACCOUNT_NOT_VERIFIED, ACCOUNT_DEACTIVATED or ACCOUNT_SUSPENDED (see `assertAccountCanSignIn`).
+     */
+    async completeSignIn(user, signInMethod, request, settings) {
+        await this.assertAccountCanSignIn(user, signInMethod, request, settings);
+        // Passkeys already combine "something you have" with a fingerprint/PIN, so they count as two factors.
+        const needsTwoFactor = settings.twoFactor.enabled && user.isTwoFactorEnabled && signInMethod !== constants_1.SIGN_IN_METHOD.passkey;
+        if (needsTwoFactor) {
+            const challengeSeconds = settings.twoFactor.challengeExpiresInMinutes * constants_1.MINUTE_IN_SECONDS;
+            const challengeToken = await this.challenges.createChallenge(constants_1.CHALLENGE_PURPOSE.twoFactor, user.id, signInMethod, challengeSeconds);
+            return { success: true, status: constants_1.SIGN_IN_STATUS.twoFactorRequired, challengeToken, expiresIn: challengeSeconds };
+        }
+        return this.startSignedInSession(user, signInMethod, signInMethod === constants_1.SIGN_IN_METHOD.passkey, request, settings);
+    }
+    /**
+     * Called by the 2FA service after a correct authenticator or backup code. Checks the account
+     * again, because it may have been suspended in the minutes since the first step.
+     *
+     * @param user - The user who passed both steps.
+     * @param signInMethod - The method used for the first step.
+     * @param request - Who is asking.
+     * @param settings - The current settings.
+     * @returns Access and refresh tokens.
+     */
+    async finishTwoFactorSignIn(user, signInMethod, request, settings) {
+        await this.assertAccountCanSignIn(user, signInMethod, request, settings);
+        return this.startSignedInSession(user, signInMethod, true, request, settings);
+    }
+    /**
+     * A deactivated user proved who they are (the sign-in returned ACCOUNT_DEACTIVATED with a
+     * reactivationToken). This switches the account back on and signs them in.
+     *
+     * @param reactivationToken - The token from the ACCOUNT_DEACTIVATED error.
+     * @param request - Who is asking.
+     * @param settings - The current settings.
+     * @returns The same result as `completeSignIn` (tokens, or a 2FA challenge).
+     * @throws AuthError INVALID_TOKEN when the token is unknown, used or expired.
+     */
+    async reactivateAndSignIn(reactivationToken, request, settings) {
+        const challenge = await this.challenges.findOpenChallenge(reactivationToken, constants_1.CHALLENGE_PURPOSE.reactivateAccount);
+        if (!(await this.challenges.markChallengeUsed(challenge.challengeId)))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOrExpiredLink);
+        const reactivatedUser = await this.users.reactivateAccount(challenge.userId, settings, request);
+        return this.completeSignIn(reactivatedUser, challenge.signInMethod, request, settings);
+    }
+    /**
+     * Signs out the device that made the request.
+     *
+     * @param userId - The signed-in user.
+     * @param sessionId - The session to end (from the access token).
+     * @param request - Who is asking (for the audit log).
+     */
+    async signOut(userId, sessionId, request) {
+        await this.sessions.revokeSession(sessionId, constants_1.SESSION_END_REASON.signedOut, userId);
+        await this.events.record({ name: constants_1.AUTH_EVENTS.userSignedOut, userId, request, details: { sessionId } });
+    }
+    /**
+     * Signs out every device of the user.
+     *
+     * @param userId - The signed-in user.
+     * @param request - Who is asking (for the audit log).
+     * @param keepSessionId - When given, this device stays signed in.
+     * @returns How many sessions were ended.
+     */
+    async signOutEverywhere(userId, request, keepSessionId) {
+        const endedSessions = await this.sessions.revokeAllSessions(userId, constants_1.SESSION_END_REASON.signedOutEverywhere, keepSessionId);
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.userSignedOut,
+            userId,
+            request,
+            details: { everywhere: true, endedSessions },
+        });
+        return endedSessions;
+    }
+    /**
+     * Records a failed attempt in the audit log (wrong password, wrong code...).
+     *
+     * @param userId - The user it was for, or null when the account is unknown.
+     * @param signInMethod - The method that was tried.
+     * @param reason - Why it failed.
+     * @param request - Who tried.
+     */
+    async recordFailedSignIn(userId, signInMethod, reason, request) {
+        await this.events.record({ name: constants_1.AUTH_EVENTS.userSignInFailed, userId, request, details: { signInMethod, reason } });
+    }
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Stops sign-in for accounts that may not sign in, with a code the app can act on.
+     * These run only AFTER the user proved who they are, so they reveal nothing to a stranger.
+     *
+     * A pending account whose verifications are all done is activated here.
+     *
+     * @param user - The user signing in.
+     * @param signInMethod - How they proved who they are.
+     * @param request - Who is asking.
+     * @param settings - The current settings.
+     * @throws AuthError ACCOUNT_NOT_VERIFIED with `pendingVerifications`, so the app can show the right screen.
+     * @throws AuthError ACCOUNT_DEACTIVATED with a `reactivationToken` for `reactivateAndSignIn`.
+     * @throws AuthError ACCOUNT_SUSPENDED when an admin suspended the account.
+     * @throws AuthError INVALID_CREDENTIALS for deleted accounts (so they look like unknown ones).
+     */
+    async assertAccountCanSignIn(user, signInMethod, request, settings) {
+        switch (user.status) {
+            case constants_1.ACCOUNT_STATUS.active:
+                return;
+            case constants_1.ACCOUNT_STATUS.pendingVerification: {
+                // The app sends the user to the right verification screen using `pendingVerifications`.
+                const pendingVerifications = this.users.getPendingVerifications(user, settings);
+                if (pendingVerifications.length === 0) {
+                    await this.users.activateIfReady(user, settings, request);
+                    return;
+                }
+                await this.recordFailedSignIn(user.id, signInMethod, constants_1.SIGN_IN_FAILURE_REASON.accountNotVerified, request);
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.accountNotVerified, {
+                    pendingVerifications,
+                    email: pendingVerifications.includes(constants_1.PENDING_VERIFICATION.email) ? user.email : undefined,
+                    phoneNumber: pendingVerifications.includes(constants_1.PENDING_VERIFICATION.phone) ? user.phoneNumber : undefined,
+                });
+            }
+            case constants_1.ACCOUNT_STATUS.deactivated: {
+                const reactivationToken = await this.challenges.createChallenge(constants_1.CHALLENGE_PURPOSE.reactivateAccount, user.id, signInMethod, constants_1.REACTIVATION_CHALLENGE_LIFETIME_SECONDS);
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.accountDeactivated, { reactivationToken, expiresIn: constants_1.REACTIVATION_CHALLENGE_LIFETIME_SECONDS });
+            }
+            case constants_1.ACCOUNT_STATUS.suspended:
+                await this.recordFailedSignIn(user.id, signInMethod, constants_1.SIGN_IN_FAILURE_REASON.accountSuspended, request);
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.accountSuspended);
+            case constants_1.ACCOUNT_STATUS.deleted:
+            default:
+                throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidCredentials);
+        }
+    }
+    /**
+     * Starts the session, records the sign-in, and sends the "new sign-in" email for a new device.
+     *
+     * @param user - The user signing in.
+     * @param signInMethod - How they signed in.
+     * @param usedTwoFactor - Whether a second factor was used (recorded in the session and tokens).
+     * @param request - Who is asking.
+     * @param settings - The current settings.
+     * @returns Tokens plus the user's public profile.
+     */
+    async startSignedInSession(user, signInMethod, usedTwoFactor, request, settings) {
+        const isNewDevice = await this.isNewDeviceForUser(user.id, request);
+        const tokens = await this.sessions.startSession(user, signInMethod, usedTwoFactor, request, settings);
+        await this.users.recordSignIn(user);
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.userSignedIn,
+            userId: user.id,
+            request,
+            details: { signInMethod, usedTwoFactor, sessionId: tokens.sessionId, isNewDevice },
+        });
+        if (isNewDevice && settings.security.notifyOnNewSignIn && user.email) {
+            await this.notifications.sendNoticeEmail({
+                type: constants_1.EMAIL_TYPE.newSignIn,
+                to: user.email,
+                ipAddress: request.ipAddress,
+                userAgent: request.userAgent,
+            });
+        }
+        return { success: true, status: constants_1.SIGN_IN_STATUS.signedIn, ...tokens, user: this.users.toPublicProfile(user, settings) };
+    }
+    /**
+     * "New device" = the user has signed in before, but never with this browser/app (user agent).
+     * The very first sign-in is not reported, since the user just created the account.
+     *
+     * @param userId - The user signing in.
+     * @param request - Holds the user agent.
+     * @returns True when the "new sign-in" email should be sent.
+     */
+    async isNewDeviceForUser(userId, request) {
+        const sessionRepository = this.database.getRepository(entities_1.SessionEntity);
+        const hasSignedInBefore = await sessionRepository.exists({ where: { userId } });
+        if (!hasSignedInBefore)
+            return false;
+        if (!request.userAgent)
+            return true;
+        const hasUsedThisDevice = await sessionRepository.exists({ where: { userId, userAgent: request.userAgent } });
+        return !hasUsedThisDevice;
+    }
+};
+exports.SignInService = SignInService;
+exports.SignInService = SignInService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, users_service_1.UsersService,
+        session_service_1.SessionService,
+        sign_in_challenges_service_1.SignInChallengesService,
+        notifications_service_1.NotificationsService,
+        auth_events_service_1.AuthEventsService])
+], SignInService);
+//# sourceMappingURL=sign-in.service.js.map

package/dist/features/sign-in/sign-in.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.service.js","sourceRoot":"","sources":["../../../src/features/sign-in/sign-in.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AAGpD,oDAAgD;AAEhD,2CAeqB;AACrB,kDAAgE;AAChE,+EAA0E;AAC1E,0FAAsF;AACtF,yEAAqE;AAGrE,kEAA8D;AAC9D,6EAAuE;AAGvE;;;;;;;;;;GAUG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAa;IAKL;IACA;IACA;IACA;IACA;IARF,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,KAAmB,EACnB,QAAwB,EACxB,UAAmC,EACnC,aAAmC,EACnC,MAAyB;QAJzB,UAAK,GAAL,KAAK,CAAc;QACnB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,eAAU,GAAV,UAAU,CAAyB;QACnC,kBAAa,GAAb,aAAa,CAAsB;QACnC,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAClB,IAAgB,EAChB,YAA0B,EAC1B,OAAuB,EACvB,QAAsB;QAEtB,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEzE,sGAAsG;QACtG,MAAM,cAAc,GAAG,QAAQ,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,kBAAkB,IAAI,YAAY,KAAK,0BAAc,CAAC,OAAO,CAAC;QACxH,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,gBAAgB,GAAG,QAAQ,CAAC,SAAS,CAAC,yBAAyB,GAAG,6BAAiB,CAAC;YAC1F,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAC1D,6BAAiB,CAAC,SAAS,EAC3B,IAAI,CAAC,EAAE,EACP,YAAY,EACZ,gBAAgB,CACjB,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0BAAc,CAAC,iBAAiB,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAClH,CAAC;QAED,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,YAAY,KAAK,0BAAc,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CACzB,IAAgB,EAChB,YAA0B,EAC1B,OAAuB,EACvB,QAAsB;QAEtB,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAChF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CAAC,iBAA0B,EAAE,OAAuB,EAAE,QAAsB;QACnG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,6BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAClH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QAE7H,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzF,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAuB;QACtE,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,8BAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,OAAuB,EAAE,aAAsB;QACrF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,8BAAkB,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;QAC3H,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,aAAa;YAC/B,MAAM;YACN,OAAO;YACP,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE;SAC7C,CAAC,CAAC;QACH,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB,CAAC,MAAqB,EAAE,YAA0B,EAAE,MAA2B,EAAE,OAAuB;QAC9H,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,8FAA8F;IAE9F;;;;;;;;;;;;;;OAcG;IACK,KAAK,CAAC,sBAAsB,CAClC,IAAgB,EAChB,YAA0B,EAC1B,OAAuB,EACvB,QAAsB;QAEtB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,0BAAc,CAAC,MAAM;gBACxB,OAAO;YAET,KAAK,0BAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACxC,wFAAwF;gBACxF,MAAM,oBAAoB,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBAChF,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;oBAC1D,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,kCAAsB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;gBACzG,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,EAAE;oBAClD,oBAAoB;oBACpB,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAAC,gCAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;oBACzF,WAAW,EAAE,oBAAoB,CAAC,QAAQ,CAAC,gCAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;iBACtG,CAAC,CAAC;YACL,CAAC;YAED,KAAK,0BAAc,CAAC,WAAW,CAAC,CAAC,CAAC;gBAChC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAC7D,6BAAiB,CAAC,iBAAiB,EACnC,IAAI,CAAC,EAAE,EACP,YAAY,EACZ,mDAAuC,CACxC,CAAC;gBACF,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,mDAAuC,EAAE,CAAC,CAAC;YACjI,CAAC;YAED,KAAK,0BAAc,CAAC,SAAS;gBAC3B,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,kCAAsB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBACvG,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,CAAC,CAAC;YAEpD,KAAK,0BAAc,CAAC,OAAO,CAAC;YAC5B;gBACE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,kBAAkB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,oBAAoB,CAChC,IAAgB,EAChB,YAA0B,EAC1B,aAAsB,EACtB,OAAuB,EACvB,QAAsB;QAEtB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAEpC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,YAAY;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,OAAO;YACP,OAAO,EAAE,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;SACnF,CAAC,CAAC;QAEH,IAAI,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC;gBACvC,IAAI,EAAE,sBAAU,CAAC,SAAS;gBAC1B,EAAE,EAAE,IAAI,CAAC,KAAK;gBACd,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0BAAc,CAAC,QAAQ,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;IACzH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,OAAuB;QACtE,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC;QACrE,MAAM,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC9G,OAAO,CAAC,iBAAiB,CAAC;IAC5B,CAAC;CACF,CAAA;AAvPY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACH,4BAAY;QACT,gCAAc;QACZ,oDAAuB;QACpB,4CAAoB;QAC3B,uCAAiB;GATjC,aAAa,CAuPzB"}

package/dist/features/sign-in/sign-in.types.d.ts

@@ -0,0 +1,22 @@
+import type { TokenSet } from '../sessions/session.types.js';
+import type { PublicUserProfile } from '../users/users.types.js';
+import { type SIGN_IN_STATUS } from '../../constants.js';
+/** The user is signed in. */
+export interface SignedInResult extends TokenSet {
+    success: true;
+    status: typeof SIGN_IN_STATUS.signedIn;
+    user: PublicUserProfile;
+}
+/**
+ * The first step passed but the user has two-factor authentication on.
+ * Send POST /auth/2fa/verify with this challengeToken and the code from their authenticator app.
+ */
+export interface TwoFactorRequiredResult {
+    success: true;
+    status: typeof SIGN_IN_STATUS.twoFactorRequired;
+    challengeToken: string;
+    /** Seconds the user has to enter the code. */
+    expiresIn: number;
+}
+/** What every sign-in endpoint returns. */
+export type SignInResult = SignedInResult | TwoFactorRequiredResult;

package/dist/features/sign-in/sign-in.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=sign-in.types.js.map

package/dist/features/sign-in/sign-in.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.types.js","sourceRoot":"","sources":["../../../src/features/sign-in/sign-in.types.ts"],"names":[],"mappings":""}

package/dist/features/signing-keys/jwks.controller.d.ts

@@ -0,0 +1,17 @@
+import { SigningKeysService } from './signing-keys.service';
+/**
+ * Publishes the public keys that verify access tokens. Your other services (any language) can check
+ * tokens with a standard JWT library pointed at GET /.well-known/jwks.json.
+ */
+export declare class JwksController {
+    private readonly signingKeys;
+    constructor(signingKeys: SigningKeysService);
+    /**
+     * GET /.well-known/jwks.json — The public keys that verify access tokens. Public; may be cached for 5 minutes.
+     *
+     * @returns `{ keys: [...] }` in standard JWKS format.
+     */
+    getPublicKeys(): Promise<{
+        keys: import("../../common/crypto/jwt").JsonWebKey[];
+    }>;
+}

package/dist/features/signing-keys/jwks.controller.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwksController = void 0;
+const common_1 = require("@nestjs/common");
+const auth_decorators_1 = require("../../guards/auth.decorators.js");
+const signing_keys_service_1 = require("./signing-keys.service");
+const constants_1 = require("../../constants.js");
+const refresh_token_cookie_1 = require("../../common/refresh-token-cookie.js");
+/**
+ * Publishes the public keys that verify access tokens. Your other services (any language) can check
+ * tokens with a standard JWT library pointed at GET /.well-known/jwks.json.
+ */
+let JwksController = class JwksController {
+    signingKeys;
+    constructor(signingKeys) {
+        this.signingKeys = signingKeys;
+    }
+    /**
+     * GET /.well-known/jwks.json — The public keys that verify access tokens. Public; may be cached for 5 minutes.
+     *
+     * @returns `{ keys: [...] }` in standard JWKS format.
+     */
+    async getPublicKeys() {
+        const { publicJwks } = await this.signingKeys.getSigningKeys();
+        return { keys: publicJwks };
+    }
+};
+exports.JwksController = JwksController;
+__decorate([
+    (0, common_1.Get)(constants_1.ROUTES.wellKnown.jwks),
+    (0, common_1.Header)(constants_1.HTTP_HEADER.cacheControl, constants_1.JWKS_CACHE_CONTROL),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], JwksController.prototype, "getPublicKeys", null);
+exports.JwksController = JwksController = __decorate([
+    (0, common_1.Controller)(constants_1.ROUTES.wellKnown.prefix),
+    (0, refresh_token_cookie_1.LibraryController)(),
+    (0, auth_decorators_1.Public)(),
+    __metadata("design:paramtypes", [signing_keys_service_1.SigningKeysService])
+], JwksController);
+//# sourceMappingURL=jwks.controller.js.map