@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/two-factor/two-factor.service.js

@@ -0,0 +1,348 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const auth_error_1 = require("../../common/auth-error.js");
+const random_secrets_1 = require("../../common/crypto/random-secrets.js");
+const totp_1 = require("../../common/crypto/totp.js");
+const encryption_service_1 = require("../../common/encryption.service.js");
+const rate_limiter_service_1 = require("../../common/rate-limiter.service.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const auth_events_service_1 = require("../events/auth-events.service.js");
+const session_service_1 = require("../sessions/session.service.js");
+const settings_service_1 = require("../settings/settings.service.js");
+const sign_in_challenges_service_1 = require("../sign-in/sign-in-challenges.service.js");
+const sign_in_service_1 = require("../sign-in/sign-in.service.js");
+const users_service_1 = require("../users/users.service.js");
+/**
+ * Two-factor authentication with an authenticator app (Google Authenticator, Microsoft
+ * Authenticator, 1Password, Authy...), plus single-use backup codes for a lost phone.
+ *
+ * Turning it on:   POST /auth/2fa/setup   -> secret + QR-code URL
+ *                  POST /auth/2fa/enable  -> first code from the app; returns backup codes (shown once)
+ * Signing in:      sign-in returns { status: "two_factor_required", challengeToken }
+ *                  POST /auth/2fa/verify  -> challengeToken + code (or a backup code) -> tokens
+ */
+let TwoFactorService = class TwoFactorService {
+    options;
+    settingsService;
+    encryption;
+    users;
+    sessions;
+    signIn;
+    challenges;
+    rateLimiter;
+    events;
+    database;
+    constructor(options, settingsService, encryption, users, sessions, signIn, challenges, rateLimiter, events) {
+        this.options = options;
+        this.settingsService = settingsService;
+        this.encryption = encryption;
+        this.users = users;
+        this.sessions = sessions;
+        this.signIn = signIn;
+        this.challenges = challenges;
+        this.rateLimiter = rateLimiter;
+        this.events = events;
+        this.database = options.dataSource;
+    }
+    // -------------------------------------------------------------------------------------------
+    // Turning 2FA on and off
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Starts setup: creates a new secret. Show `authenticatorAppUrl` as a QR code (and `secret` for
+     * typing by hand). Nothing changes for the user until they confirm with a code (`confirmSetup`).
+     * Calling it again replaces the unconfirmed secret.
+     *
+     * @param userId - The signed-in user.
+     * @returns The plain secret and the otpauth:// URL for the QR code.
+     * @throws AuthError FEATURE_DISABLED when 2FA is turned off in settings.
+     * @throws AuthError TWO_FACTOR_ALREADY_ENABLED when the user already has 2FA on.
+     */
+    async startSetup(userId) {
+        await this.assertTwoFactorAllowed();
+        const user = await this.users.getUserOrThrow(userId);
+        if (user.isTwoFactorEnabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.twoFactorAlreadyEnabled);
+        const secret = (0, totp_1.createTotpSecret)();
+        await this.database.getRepository(entities_1.TwoFactorSecretEntity).upsert({
+            userId,
+            encryptedSecret: await this.encryption.encrypt(secret, this.encryptionContext(userId)),
+            confirmedAt: null,
+            lastUsedTimeStep: null,
+        }, ['userId']);
+        const accountName = user.email ?? user.phoneNumber ?? user.id;
+        const issuerName = this.options.appName ?? constants_1.TOTP_DEFAULT_ISSUER_NAME;
+        return { success: true, secret, authenticatorAppUrl: (0, totp_1.buildAuthenticatorAppUrl)(secret, accountName, issuerName) };
+    }
+    /**
+     * Finishes setup: the user types the first code from their app. Turns 2FA on, signs out other
+     * devices, and returns backup codes. Show them once and ask the user to save them.
+     *
+     * @param userId - The signed-in user.
+     * @param currentSessionId - This device's session, which stays signed in.
+     * @param code - The 6-digit code from the authenticator app.
+     * @param request - Who is asking (for the audit log).
+     * @returns The plain backup codes, formatted like "k7m2-x9p4".
+     * @throws AuthError TWO_FACTOR_SETUP_NOT_STARTED when `startSetup` wasn't called first.
+     * @throws AuthError INVALID_OTP when the code is wrong.
+     * @throws AuthError TOO_MANY_REQUESTS after too many attempts.
+     */
+    async confirmSetup(userId, currentSessionId, code, request) {
+        await this.assertTwoFactorAllowed();
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.twoFactorPerUser(userId), constants_1.RATE_LIMITS.twoFactorPerUser);
+        const user = await this.users.getUserOrThrow(userId);
+        if (user.isTwoFactorEnabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.twoFactorAlreadyEnabled);
+        const storedSecret = await this.database.getRepository(entities_1.TwoFactorSecretEntity).findOne({ where: { userId, confirmedAt: (0, typeorm_1.IsNull)() } });
+        if (!storedSecret)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.twoFactorSetupNotStarted);
+        if (!(await this.checkAuthenticatorCode(storedSecret, code)))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidTwoFactorCode);
+        await this.database.getRepository(entities_1.TwoFactorSecretEntity).update({ userId }, { confirmedAt: new Date() });
+        await this.database.getRepository(entities_1.UserEntity).update({ id: userId }, { isTwoFactorEnabled: true });
+        const backupCodes = await this.replaceBackupCodes(userId);
+        await this.sessions.revokeAllSessions(userId, constants_1.SESSION_END_REASON.twoFactorEnabled, currentSessionId);
+        await this.events.record({ name: constants_1.AUTH_EVENTS.twoFactorEnabled, userId, request });
+        return { success: true, backupCodes };
+    }
+    /**
+     * Turns 2FA off. Requires a current authenticator code or a backup code.
+     *
+     * @param userId - The signed-in user.
+     * @param code - An authenticator code or a backup code.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError TWO_FACTOR_NOT_ENABLED when 2FA is already off.
+     * @throws AuthError INVALID_OTP when the code is wrong.
+     */
+    async disable(userId, code, request) {
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.twoFactorPerUser(userId), constants_1.RATE_LIMITS.twoFactorPerUser);
+        const user = await this.users.getUserOrThrow(userId);
+        if (!user.isTwoFactorEnabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.twoFactorNotEnabled);
+        if (!(await this.checkAnyCode(userId, code)))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidTwoFactorCode);
+        await this.removeTwoFactor(userId);
+        await this.events.record({ name: constants_1.AUTH_EVENTS.twoFactorDisabled, userId, request });
+        return { success: true };
+    }
+    /**
+     * Replaces all backup codes (e.g. the user lost the list). The old codes stop working.
+     *
+     * @param userId - The signed-in user.
+     * @param code - An authenticator code or a backup code.
+     * @returns The new plain backup codes.
+     * @throws AuthError TWO_FACTOR_NOT_ENABLED when 2FA is off.
+     * @throws AuthError INVALID_OTP when the code is wrong.
+     */
+    async regenerateBackupCodes(userId, code) {
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.twoFactorPerUser(userId), constants_1.RATE_LIMITS.twoFactorPerUser);
+        const user = await this.users.getUserOrThrow(userId);
+        if (!user.isTwoFactorEnabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.twoFactorNotEnabled);
+        if (!(await this.checkAnyCode(userId, code)))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidTwoFactorCode);
+        return { success: true, backupCodes: await this.replaceBackupCodes(userId) };
+    }
+    /**
+     * Counts the unused backup codes (show a warning when it gets low).
+     *
+     * @param userId - The user to check.
+     * @returns How many backup codes are left.
+     */
+    async countRemainingBackupCodes(userId) {
+        return this.database.getRepository(entities_1.BackupCodeEntity).count({ where: { userId, usedAt: (0, typeorm_1.IsNull)() } });
+    }
+    /**
+     * Admin: turns 2FA off for a user who lost their phone and backup codes.
+     * Only call this after checking who the user is some other way.
+     *
+     * @param userId - The user whose 2FA is removed.
+     * @param adminUserId - The admin doing it (recorded in the audit log).
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when the user doesn't exist.
+     */
+    async resetForUser(userId, adminUserId, request) {
+        await this.users.getUserOrThrow(userId);
+        await this.removeTwoFactor(userId);
+        await this.events.record({
+            name: constants_1.AUTH_EVENTS.twoFactorDisabled,
+            userId,
+            performedBy: constants_1.PERFORMED_BY.admin(adminUserId),
+            request,
+            details: { resetByAdmin: true },
+        });
+        return { success: true };
+    }
+    // -------------------------------------------------------------------------------------------
+    // The second step of sign-in
+    // -------------------------------------------------------------------------------------------
+    /**
+     * The second step of sign-in: checks the code for a challenge token returned by the first step.
+     *
+     * @param challengeToken - The "ch_..." token from `{ status: "two_factor_required" }`.
+     * @param code - An authenticator code or a backup code.
+     * @param request - Who is asking (for rate limits, sessions and the audit log).
+     * @returns The signed-in result with access and refresh tokens.
+     * @throws AuthError INVALID_TOKEN when the challenge is unknown, used, expired or burnt by wrong codes.
+     * @throws AuthError INVALID_OTP when the code is wrong.
+     */
+    async verifySignInChallenge(challengeToken, code, request) {
+        const settings = await this.settingsService.getSettings();
+        const challenge = await this.challenges.findOpenChallenge(challengeToken, constants_1.CHALLENGE_PURPOSE.twoFactor);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.twoFactorPerUser(challenge.userId), constants_1.RATE_LIMITS.twoFactorPerUser);
+        if (!(await this.checkAnyCode(challenge.userId, code))) {
+            await this.challenges.recordFailedAttempt(challenge.challengeId);
+            await this.signIn.recordFailedSignIn(challenge.userId, challenge.signInMethod, constants_1.SIGN_IN_FAILURE_REASON.wrongTwoFactorCode, request);
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidTwoFactorCode);
+        }
+        if (!(await this.challenges.markChallengeUsed(challenge.challengeId)))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidOrExpiredLink);
+        const user = await this.users.getUserOrThrow(challenge.userId);
+        return this.signIn.finishTwoFactorSignIn(user, challenge.signInMethod, request, settings);
+    }
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @throws AuthError FEATURE_DISABLED when 2FA is turned off in settings.
+     */
+    async assertTwoFactorAllowed() {
+        const settings = await this.settingsService.getSettings();
+        if (!settings.twoFactor.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.featureDisabled);
+    }
+    /**
+     * Accepts a 6-digit authenticator code, or a backup code (which is then used up).
+     *
+     * @param userId - The user the code belongs to.
+     * @param code - What the user typed.
+     * @returns True when the code was correct.
+     */
+    async checkAnyCode(userId, code) {
+        if (typeof code !== 'string')
+            return false;
+        const storedSecret = await this.database
+            .getRepository(entities_1.TwoFactorSecretEntity)
+            .findOne({ where: { userId } });
+        if (storedSecret?.confirmedAt && (await this.checkAuthenticatorCode(storedSecret, code)))
+            return true;
+        return this.useBackupCode(userId, code);
+    }
+    /**
+     * Checks an authenticator code and remembers its time step, so the same code can't be used twice.
+     * The UPDATE only succeeds if no newer code was accepted meanwhile (two requests at once).
+     *
+     * @param storedSecret - The user's row with the encrypted secret.
+     * @param code - What the user typed.
+     * @returns True when the code was correct and not used before.
+     */
+    async checkAuthenticatorCode(storedSecret, code) {
+        if (typeof code !== 'string')
+            return false;
+        const secret = await this.encryption.decrypt(storedSecret.encryptedSecret, this.encryptionContext(storedSecret.userId));
+        const matchedTimeStep = (0, totp_1.verifyTotpCode)(secret, code, storedSecret.lastUsedTimeStep);
+        if (matchedTimeStep === null)
+            return false;
+        const result = await this.database
+            .getRepository(entities_1.TwoFactorSecretEntity)
+            .createQueryBuilder()
+            .update(entities_1.TwoFactorSecretEntity)
+            .set({ lastUsedTimeStep: matchedTimeStep })
+            .where('user_id = :userId AND (last_used_time_step IS NULL OR last_used_time_step < :matchedTimeStep)', {
+            userId: storedSecret.userId,
+            matchedTimeStep,
+        })
+            .execute();
+        return (result.affected ?? 0) > 0;
+    }
+    /**
+     * Checks a backup code and marks it used, so it works only once.
+     *
+     * @param userId - The user the code belongs to.
+     * @param typedCode - What the user typed; dashes, spaces and capitals are ignored.
+     * @returns True when the code matched an unused backup code (and this request was the one to use it).
+     */
+    async useBackupCode(userId, typedCode) {
+        const normalizedCode = (0, random_secrets_1.normalizeBackupCode)(typedCode);
+        const unusedCodes = await this.database.getRepository(entities_1.BackupCodeEntity).find({ where: { userId, usedAt: (0, typeorm_1.IsNull)() } });
+        // Check every code (no early exit), so the time taken doesn't hint at which one matched.
+        let matchingCode;
+        for (const storedCode of unusedCodes) {
+            if ((0, random_secrets_1.constantTimeEquals)((0, random_secrets_1.hashShortCode)(normalizedCode, storedCode.salt), storedCode.codeHash))
+                matchingCode = storedCode;
+        }
+        if (!matchingCode)
+            return false;
+        const result = await this.database
+            .getRepository(entities_1.BackupCodeEntity)
+            .update({ id: matchingCode.id, usedAt: (0, typeorm_1.IsNull)() }, { usedAt: new Date() });
+        return (result.affected ?? 0) > 0;
+    }
+    /**
+     * Deletes old backup codes and creates new ones. Only their hashes are stored.
+     *
+     * @param userId - The user to create codes for.
+     * @returns The plain codes, formatted like "k7m2-x9p4", to show the user once.
+     */
+    async replaceBackupCodes(userId) {
+        const plainCodes = Array.from({ length: constants_1.BACKUP_CODE_COUNT }, () => (0, random_secrets_1.createBackupCode)());
+        await this.database.transaction(async (transaction) => {
+            await transaction.delete(entities_1.BackupCodeEntity, { userId });
+            await transaction.insert(entities_1.BackupCodeEntity, plainCodes.map((code) => {
+                const salt = (0, random_secrets_1.createSalt)();
+                return { userId, salt, codeHash: (0, random_secrets_1.hashShortCode)(code, salt) };
+            }));
+        });
+        return plainCodes.map((code) => [code.slice(0, constants_1.BACKUP_CODE_DISPLAY_GROUP_LENGTH), code.slice(constants_1.BACKUP_CODE_DISPLAY_GROUP_LENGTH)].join(constants_1.BACKUP_CODE_DISPLAY_SEPARATOR));
+    }
+    /**
+     * Deletes the secret and backup codes and turns 2FA off, all in one transaction.
+     *
+     * @param userId - The user to turn 2FA off for.
+     */
+    async removeTwoFactor(userId) {
+        await this.database.transaction(async (transaction) => {
+            await transaction.delete(entities_1.TwoFactorSecretEntity, { userId });
+            await transaction.delete(entities_1.BackupCodeEntity, { userId });
+            await transaction.update(entities_1.UserEntity, { id: userId }, { isTwoFactorEnabled: false });
+        });
+    }
+    /**
+     * Binds the encrypted secret to its user, so a secret copied to another user's row won't decrypt.
+     *
+     * @param userId - The secret's owner.
+     * @returns The context for `EncryptionService`.
+     */
+    encryptionContext(userId) {
+        return { purpose: constants_1.ENCRYPTION_PURPOSE.totpSecret, userId };
+    }
+};
+exports.TwoFactorService = TwoFactorService;
+exports.TwoFactorService = TwoFactorService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, settings_service_1.SettingsService,
+        encryption_service_1.EncryptionService,
+        users_service_1.UsersService,
+        session_service_1.SessionService,
+        sign_in_service_1.SignInService,
+        sign_in_challenges_service_1.SignInChallengesService,
+        rate_limiter_service_1.RateLimiterService,
+        auth_events_service_1.AuthEventsService])
+], TwoFactorService);
+//# sourceMappingURL=two-factor.service.js.map

package/dist/features/two-factor/two-factor.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor.service.js","sourceRoot":"","sources":["../../../src/features/two-factor/two-factor.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAA6C;AAE7C,oDAAgD;AAChD,mEAAsI;AACtI,+CAAkG;AAClG,oEAAgE;AAChE,wEAAmE;AAEnE,2CAeqB;AACrB,kDAA0F;AAC1F,+EAA0E;AAC1E,yEAAqE;AACrE,2EAAuE;AACvE,8FAAwF;AACxF,wEAAmE;AAEnE,kEAA8D;AAE9D;;;;;;;;GAQG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAIoB;IAC5B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAXF,QAAQ,CAAa;IAEtC,YAC+C,OAAoB,EAChD,eAAgC,EAChC,UAA6B,EAC7B,KAAmB,EACnB,QAAwB,EACxB,MAAqB,EACrB,UAAmC,EACnC,WAA+B,EAC/B,MAAyB;QARG,YAAO,GAAP,OAAO,CAAa;QAChD,oBAAe,GAAf,eAAe,CAAiB;QAChC,eAAU,GAAV,UAAU,CAAmB;QAC7B,UAAK,GAAL,KAAK,CAAc;QACnB,aAAQ,GAAR,QAAQ,CAAgB;QACxB,WAAM,GAAN,MAAM,CAAe;QACrB,eAAU,GAAV,UAAU,CAAyB;QACnC,gBAAW,GAAX,WAAW,CAAoB;QAC/B,WAAM,GAAN,MAAM,CAAmB;QAE1C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,8FAA8F;IAC9F,yBAAyB;IACzB,8FAA8F;IAE9F;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,kBAAkB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,uBAAuB,CAAC,CAAC;QAEtF,MAAM,MAAM,GAAG,IAAA,uBAAgB,GAAE,CAAC;QAClC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,MAAM,CAC7D;YACE,MAAM;YACN,eAAe,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACtF,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,IAAI;SACvB,EACD,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,oCAAwB,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAA,+BAAwB,EAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,CAAC;IAC5H,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,gBAAwB,EAAE,IAAa,EAAE,OAAuB;QACjG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,kBAAkB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,uBAAuB,CAAC,CAAC;QAEtF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,CAAC,CAAC;QACpI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,wBAAwB,CAAC,CAAC;QAC7E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QAEpH,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,gCAAqB,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACzG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,qBAAU,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,EAAE,8BAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QACrG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,IAAa,EAAE,OAAuB;QAClE,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,mBAAmB,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QAEpG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAW,CAAC,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,MAAc,EAAE,IAAa;QACvD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QACtG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,mBAAmB,CAAC,CAAC;QACnF,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACpG,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;IACxF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,yBAAyB,CAAC,MAAc;QAC5C,OAAO,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,2BAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,WAAmB,EAAE,OAAuB;QAC7E,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACvB,IAAI,EAAE,uBAAW,CAAC,iBAAiB;YACnC,MAAM;YACN,WAAW,EAAE,wBAAY,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,OAAO;YACP,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;IACpC,CAAC;IAED,8FAA8F;IAC9F,6BAA6B;IAC7B,8FAA8F;IAE9F;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CAAC,cAAuB,EAAE,IAAa,EAAE,OAAuB;QACzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,6BAAiB,CAAC,SAAS,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,uBAAW,CAAC,gBAAgB,CAAC,CAAC;QAEhH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,kCAAsB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;YACnI,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QAE7H,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5F,CAAC;IAED,8FAA8F;IAE9F;;OAEG;IACK,KAAK,CAAC,sBAAsB;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,eAAe,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,IAAa;QACtD,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,QAAQ;aACrC,aAAa,CAAC,gCAAqB,CAAC;aACpC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,YAAY,EAAE,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACtG,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,sBAAsB,CAAC,YAAmC,EAAE,IAAa;QACrF,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;QACxH,MAAM,eAAe,GAAG,IAAA,qBAAc,EAAC,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACpF,IAAI,eAAe,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;aAC/B,aAAa,CAAC,gCAAqB,CAAC;aACpC,kBAAkB,EAAE;aACpB,MAAM,CAAC,gCAAqB,CAAC;aAC7B,GAAG,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;aAC1C,KAAK,CAAC,+FAA+F,EAAE;YACtG,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,eAAe;SAChB,CAAC;aACD,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,SAAiB;QAC3D,MAAM,cAAc,GAAG,IAAA,oCAAmB,EAAC,SAAS,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,2BAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,CAAC,CAAC;QACtH,yFAAyF;QACzF,IAAI,YAA0C,CAAC;QAC/C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,IAAA,mCAAkB,EAAC,IAAA,8BAAa,EAAC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC;gBAAE,YAAY,GAAG,UAAU,CAAC;QACzH,CAAC;QACD,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ;aAC/B,aAAa,CAAC,2BAAgB,CAAC;aAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,IAAA,gBAAM,GAAE,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7E,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,6BAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,IAAA,iCAAgB,GAAE,CAAC,CAAC;QACvF,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,WAAW,CAAC,MAAM,CAAC,2BAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,MAAM,CACtB,2BAAgB,EAChB,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACtB,MAAM,IAAI,GAAG,IAAA,2BAAU,GAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAA,8BAAa,EAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/D,CAAC,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,GAAG,CACnB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,4CAAgC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,4CAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,yCAA6B,CAAC,CAC9I,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,MAAc;QAC1C,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACpD,MAAM,WAAW,CAAC,MAAM,CAAC,gCAAqB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,MAAM,WAAW,CAAC,MAAM,CAAC,2BAAgB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACvD,MAAM,WAAW,CAAC,MAAM,CAAC,qBAAU,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,iBAAiB,CAAC,MAAc;QACtC,OAAO,EAAE,OAAO,EAAE,8BAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAC5D,CAAC;CACF,CAAA;AA/SY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACO,kCAAe;QACpB,sCAAiB;QACtB,4BAAY;QACT,gCAAc;QAChB,+BAAa;QACT,oDAAuB;QACtB,yCAAkB;QACvB,uCAAiB;GAZjC,gBAAgB,CA+S5B"}

package/dist/features/users/sign-in-methods.service.d.ts

@@ -0,0 +1,40 @@
+import { AuthOptions } from '../../auth-options.js';
+import { type RemovableSignInMethod } from '../../constants.js';
+import { UserEntity } from '../../database/entities/index.js';
+import { AuthSettings } from '../settings/settings.types.js';
+/** Every way a user can currently sign in. Shown on a "Sign-in methods" screen. */
+export interface UserSignInMethods {
+    hasPassword: boolean;
+    /** Can sign in with an email code or magic link (verified email + one of those turned on). */
+    canUseEmailCode: boolean;
+    /** Can sign in with an SMS code (verified phone + phone OTP turned on). */
+    canUsePhoneCode: boolean;
+    socialAccounts: {
+        provider: string;
+        email: string | null;
+        linkedAt: string;
+    }[];
+    passkeyCount: number;
+}
+/** Answers "how can this user sign in?" and stops them from removing the last way. */
+export declare class SignInMethodsService {
+    private readonly database;
+    constructor(options: AuthOptions);
+    /**
+     * Lists every way the user can currently sign in. Methods turned off in settings don't count.
+     *
+     * @param user - The user.
+     * @param settings - The current settings.
+     * @returns Password, email/phone codes, linked social accounts and passkey count.
+     */
+    listSignInMethods(user: UserEntity, settings: AuthSettings): Promise<UserSignInMethods>;
+    /**
+     * Stops the user from removing their last way to sign in.
+     *
+     * @param user - The user.
+     * @param settings - The current settings.
+     * @param kind - What is about to be removed: "password", "social" or "passkey" (one item).
+     * @throws AuthError LAST_SIGN_IN_METHOD if removing it would leave no way to sign in.
+     */
+    assertCanRemove(user: UserEntity, settings: AuthSettings, kind: RemovableSignInMethod): Promise<void>;
+}

package/dist/features/users/sign-in-methods.service.js

@@ -0,0 +1,81 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignInMethodsService = void 0;
+const common_1 = require("@nestjs/common");
+const auth_error_1 = require("../../common/auth-error.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+/** Answers "how can this user sign in?" and stops them from removing the last way. */
+let SignInMethodsService = class SignInMethodsService {
+    database;
+    constructor(options) {
+        this.database = options.dataSource;
+    }
+    /**
+     * Lists every way the user can currently sign in. Methods turned off in settings don't count.
+     *
+     * @param user - The user.
+     * @param settings - The current settings.
+     * @returns Password, email/phone codes, linked social accounts and passkey count.
+     */
+    async listSignInMethods(user, settings) {
+        const [hasPassword, socialAccounts, passkeyCount] = await Promise.all([
+            this.database.getRepository(entities_1.PasswordEntity).exists({ where: { userId: user.id } }),
+            this.database.getRepository(entities_1.SocialAccountEntity).find({ where: { userId: user.id }, order: { createdAt: constants_1.SORT_ORDER.oldestFirst } }),
+            this.database.getRepository(entities_1.PasskeyEntity).count({ where: { userId: user.id } }),
+        ]);
+        return {
+            hasPassword: hasPassword && settings.password.enabled,
+            canUseEmailCode: !!user.email && user.isEmailVerified && (settings.emailOtp.enabled || settings.magicLink.enabled),
+            canUsePhoneCode: !!user.phoneNumber && user.isPhoneVerified && settings.phoneOtp.enabled,
+            socialAccounts: socialAccounts.map((account) => ({
+                provider: account.provider,
+                email: account.email,
+                linkedAt: account.createdAt.toISOString(),
+            })),
+            passkeyCount: settings.passkeys.enabled ? passkeyCount : 0,
+        };
+    }
+    /**
+     * Stops the user from removing their last way to sign in.
+     *
+     * @param user - The user.
+     * @param settings - The current settings.
+     * @param kind - What is about to be removed: "password", "social" or "passkey" (one item).
+     * @throws AuthError LAST_SIGN_IN_METHOD if removing it would leave no way to sign in.
+     */
+    async assertCanRemove(user, settings, kind) {
+        const methods = await this.listSignInMethods(user, settings);
+        const totalMethods = Number(methods.hasPassword) +
+            Number(methods.canUseEmailCode) +
+            Number(methods.canUsePhoneCode) +
+            methods.socialAccounts.length +
+            methods.passkeyCount;
+        const removedCount = (kind === constants_1.REMOVABLE_SIGN_IN_METHOD.password && methods.hasPassword) ||
+            (kind === constants_1.REMOVABLE_SIGN_IN_METHOD.social && methods.socialAccounts.length > 0) ||
+            (kind === constants_1.REMOVABLE_SIGN_IN_METHOD.passkey && methods.passkeyCount > 0)
+            ? 1
+            : 0;
+        if (totalMethods - removedCount < 1)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.cannotRemoveLastSignInMethod);
+    }
+};
+exports.SignInMethodsService = SignInMethodsService;
+exports.SignInMethodsService = SignInMethodsService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object])
+], SignInMethodsService);
+//# sourceMappingURL=sign-in-methods.service.js.map

package/dist/features/users/sign-in-methods.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-methods.service.js","sourceRoot":"","sources":["../../../src/features/users/sign-in-methods.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AAGpD,oDAAgD;AAChD,2CAMqB;AACrB,kDAAqG;AAcrG,sFAAsF;AAE/E,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACd,QAAQ,CAAa;IAEtC,YAAwC,OAAoB;QAC1D,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,iBAAiB,CAAC,IAAgB,EAAE,QAAsB;QAC9D,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;YAClF,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YACnI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;SACjF,CAAC,CAAC;QACH,OAAO;YACL,WAAW,EAAE,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO;YACrD,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;YAClH,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO;YACxF,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;aAC1C,CAAC,CAAC;YACH,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;SAC3D,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CAAC,IAAgB,EAAE,QAAsB,EAAE,IAA2B;QACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC7D,MAAM,YAAY,GAChB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;YAC3B,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YAC/B,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YAC/B,OAAO,CAAC,cAAc,CAAC,MAAM;YAC7B,OAAO,CAAC,YAAY,CAAC;QAEvB,MAAM,YAAY,GAChB,CAAC,IAAI,KAAK,oCAAwB,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC;YACnE,CAAC,IAAI,KAAK,oCAAwB,CAAC,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/E,CAAC,IAAI,KAAK,oCAAwB,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CAAC;QACR,IAAI,YAAY,GAAG,YAAY,GAAG,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,4BAA4B,CAAC,CAAC;IACrG,CAAC;CACF,CAAA;AA1DY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;;GAH5B,oBAAoB,CA0DhC"}

package/dist/features/users/sign-up-rules.d.ts

@@ -0,0 +1,12 @@
+import type { SignUpDetailsInput } from '../passwordless/passwordless.dto.js';
+import { AuthSettings } from '../settings/settings.types.js';
+/**
+ * Checks the details a new account needs under the current settings (names, consent).
+ * Used by every sign-in method that can create an account (codes, links, social, passkeys).
+ *
+ * @param details - The names and consents from the request.
+ * @param settings - The current settings (registration rules).
+ * @throws AuthError VALIDATION_ERROR with `missingSignUpDetails` listing exactly what is missing,
+ *   so the app can show the right form.
+ */
+export declare function assertSignUpDetailsComplete(details: SignUpDetailsInput, settings: AuthSettings): void;

package/dist/features/users/sign-up-rules.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertSignUpDetailsComplete = assertSignUpDetailsComplete;
+const auth_error_1 = require("../../common/auth-error.js");
+const constants_1 = require("../../constants.js");
+/**
+ * Checks the details a new account needs under the current settings (names, consent).
+ * Used by every sign-in method that can create an account (codes, links, social, passkeys).
+ *
+ * @param details - The names and consents from the request.
+ * @param settings - The current settings (registration rules).
+ * @throws AuthError VALIDATION_ERROR with `missingSignUpDetails` listing exactly what is missing,
+ *   so the app can show the right form.
+ */
+function assertSignUpDetailsComplete(details, settings) {
+    const rules = settings.registration;
+    const missingSignUpDetails = [];
+    if (rules.requireFirstAndLastName && !details.firstName?.trim())
+        missingSignUpDetails.push(constants_1.SIGN_UP_DETAIL.firstName);
+    if (rules.requireFirstAndLastName && !details.lastName?.trim())
+        missingSignUpDetails.push(constants_1.SIGN_UP_DETAIL.lastName);
+    if (rules.requireTermsAcceptance && details.acceptTerms !== true)
+        missingSignUpDetails.push(constants_1.SIGN_UP_DETAIL.acceptTerms);
+    if (rules.requirePrivacyPolicyAcceptance && details.acceptPrivacyPolicy !== true)
+        missingSignUpDetails.push(constants_1.SIGN_UP_DETAIL.acceptPrivacyPolicy);
+    if (missingSignUpDetails.length > 0)
+        throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.validationFailed, { missingSignUpDetails });
+}
+//# sourceMappingURL=sign-up-rules.js.map

package/dist/features/users/sign-up-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-up-rules.js","sourceRoot":"","sources":["../../../src/features/users/sign-up-rules.ts"],"names":[],"mappings":";;AAcA,kEAQC;AAtBD,oDAAgD;AAGhD,2CAA0D;AAE1D;;;;;;;;GAQG;AACH,SAAgB,2BAA2B,CAAC,OAA2B,EAAE,QAAsB;IAC7F,MAAM,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC;IACpC,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;QAAE,oBAAoB,CAAC,IAAI,CAAC,0BAAc,CAAC,SAAS,CAAC,CAAC;IACrH,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE;QAAE,oBAAoB,CAAC,IAAI,CAAC,0BAAc,CAAC,QAAQ,CAAC,CAAC;IACnH,IAAI,KAAK,CAAC,sBAAsB,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI;QAAE,oBAAoB,CAAC,IAAI,CAAC,0BAAc,CAAC,WAAW,CAAC,CAAC;IACxH,IAAI,KAAK,CAAC,8BAA8B,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI;QAAE,oBAAoB,CAAC,IAAI,CAAC,0BAAc,CAAC,mBAAmB,CAAC,CAAC;IAChJ,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,gBAAgB,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACnH,CAAC"}