@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/common/crypto/totp.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTotpSecret = createTotpSecret;
+exports.buildAuthenticatorAppUrl = buildAuthenticatorAppUrl;
+exports.totpCodeForTimeStep = totpCodeForTimeStep;
+exports.timeStepAt = timeStepAt;
+exports.verifyTotpCode = verifyTotpCode;
+exports.encodeBase32 = encodeBase32;
+exports.decodeBase32 = decodeBase32;
+const node_crypto_1 = require("node:crypto");
+const constants_1 = require("../../constants.js");
+const random_secrets_1 = require("./random-secrets");
+const time_1 = require("../time.js");
+/**
+ * Time-based one-time passwords (RFC 6238): the 6-digit codes shown by Google Authenticator,
+ * Microsoft Authenticator, 1Password, Authy and others.
+ *
+ * The user's app and our server share a secret. Every 30 seconds both compute
+ * HMAC-SHA1(secret, current 30-second step) and turn it into 6 digits. If they match, the user
+ * has the phone that holds the secret.
+ */
+/**
+ * Creates a new random secret, in the Base32 form authenticator apps expect.
+ *
+ * @returns The secret, e.g. "JBSWY3DPEHPK3PXP...".
+ */
+function createTotpSecret() {
+    return encodeBase32((0, node_crypto_1.randomBytes)(constants_1.TOTP_SECRET_BYTES));
+}
+/**
+ * Builds the link inside the QR code the user scans:
+ * otpauth://totp/Issuer:account?secret=...&issuer=Issuer
+ *
+ * @param secret - The Base32 secret from `createTotpSecret`.
+ * @param accountName - Shown in the app under the issuer, usually the user's email.
+ * @param issuerName - Your app's name, shown in the authenticator app.
+ * @returns The otpauth:// URL to turn into a QR code.
+ */
+function buildAuthenticatorAppUrl(secret, accountName, issuerName) {
+    const label = encodeURIComponent(`${issuerName}${constants_1.TOTP_LABEL_SEPARATOR}${accountName}`);
+    const parameters = new URLSearchParams({
+        secret,
+        issuer: issuerName,
+        algorithm: constants_1.TOTP_URL_ALGORITHM_NAME,
+        digits: String(constants_1.TOTP_DIGITS),
+        period: String(constants_1.TOTP_PERIOD_SECONDS),
+    });
+    return constants_1.AUTHENTICATOR_APP_URL_PREFIX + label + constants_1.URL_QUERY_SEPARATOR + parameters.toString();
+}
+/**
+ * Computes the 6-digit code for one 30-second time step (RFC 6238).
+ *
+ * @param secret - The Base32 secret shared with the authenticator app.
+ * @param timeStep - Which 30-second window, from `timeStepAt`.
+ * @returns The code as a zero-padded string, e.g. "042913".
+ */
+function totpCodeForTimeStep(secret, timeStep) {
+    const counter = Buffer.alloc(constants_1.TOTP_COUNTER_BYTES);
+    counter.writeBigUInt64BE(BigInt(timeStep));
+    const hmac = (0, node_crypto_1.createHmac)(constants_1.HASH_ALGORITHM.sha1, decodeBase32(secret)).update(counter).digest();
+    // "Dynamic truncation" from RFC 4226: pick 4 bytes based on the last nibble, keep 31 bits.
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    const binaryCode = hmac.readUInt32BE(offset) & 0x7fffffff;
+    return String(binaryCode % constants_1.DECIMAL_BASE ** constants_1.TOTP_DIGITS).padStart(constants_1.TOTP_DIGITS, constants_1.TOTP_CODE_PAD_CHARACTER);
+}
+/**
+ * Converts a time into its 30-second TOTP window number.
+ *
+ * @param unixTimeSeconds - Seconds since 1970.
+ * @returns The time step that contains this moment.
+ */
+function timeStepAt(unixTimeSeconds) {
+    return Math.floor(unixTimeSeconds / constants_1.TOTP_PERIOD_SECONDS);
+}
+/**
+ * Checks a code the user typed from their authenticator app.
+ *
+ * Codes from one step before or after the current one are also accepted, because phone clocks drift.
+ * `lastAcceptedTimeStep` blocks replay: a code that was already used (or an older one) is refused,
+ * so someone who sees a code over the user's shoulder cannot use it again.
+ *
+ * @param secret - The user's Base32 secret.
+ * @param typedCode - What the user typed; spaces are ignored.
+ * @param lastAcceptedTimeStep - The step of the last code accepted for this user, or null if none.
+ * @param unixTimeSeconds - The current time; only passed in tests.
+ * @returns The matching time step (save it as the new lastAcceptedTimeStep), or null if wrong.
+ */
+function verifyTotpCode(secret, typedCode, lastAcceptedTimeStep, unixTimeSeconds = (0, time_1.currentUnixTimeSeconds)()) {
+    const cleanCode = typedCode.replace(constants_1.WHITESPACE_PATTERN, '');
+    if (!constants_1.DIGITS_ONLY_PATTERN.test(cleanCode) || cleanCode.length !== constants_1.TOTP_DIGITS)
+        return null;
+    const currentStep = timeStepAt(unixTimeSeconds);
+    for (let drift = -constants_1.TOTP_ALLOWED_DRIFT_STEPS; drift <= constants_1.TOTP_ALLOWED_DRIFT_STEPS; drift++) {
+        const step = currentStep + drift;
+        const alreadyUsed = lastAcceptedTimeStep !== null && step <= lastAcceptedTimeStep;
+        if (!alreadyUsed && (0, random_secrets_1.constantTimeEquals)(totpCodeForTimeStep(secret, step), cleanCode))
+            return step;
+    }
+    return null;
+}
+/**
+ * Encodes bytes as Base32 (RFC 4648, no padding), the format authenticator apps use for secrets.
+ *
+ * @param bytes - The raw bytes.
+ * @returns The Base32 text.
+ */
+function encodeBase32(bytes) {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of bytes) {
+        value = (value << constants_1.BITS_PER_BYTE) | byte;
+        bits += constants_1.BITS_PER_BYTE;
+        while (bits >= constants_1.BASE32_BITS_PER_CHARACTER) {
+            output += constants_1.BASE32_ALPHABET[(value >>> (bits - constants_1.BASE32_BITS_PER_CHARACTER)) & constants_1.BASE32_CHARACTER_MASK];
+            bits -= constants_1.BASE32_BITS_PER_CHARACTER;
+        }
+    }
+    if (bits > 0)
+        output += constants_1.BASE32_ALPHABET[(value << (constants_1.BASE32_BITS_PER_CHARACTER - bits)) & constants_1.BASE32_CHARACTER_MASK];
+    return output;
+}
+/**
+ * Decodes Base32 text back into bytes. Lower case and "=" padding are accepted.
+ *
+ * @param text - The Base32 text.
+ * @returns The decoded bytes.
+ * @throws If the text contains a character that is not in the Base32 alphabet.
+ */
+function decodeBase32(text) {
+    const cleanText = text.toUpperCase().replace(constants_1.BASE32_PADDING_PATTERN, '');
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const character of cleanText) {
+        const index = constants_1.BASE32_ALPHABET.indexOf(character);
+        if (index === -1)
+            throw new Error('Invalid Base32 character');
+        value = (value << constants_1.BASE32_BITS_PER_CHARACTER) | index;
+        bits += constants_1.BASE32_BITS_PER_CHARACTER;
+        if (bits >= constants_1.BITS_PER_BYTE) {
+            bytes.push((value >>> (bits - constants_1.BITS_PER_BYTE)) & constants_1.BYTE_MASK);
+            bits -= constants_1.BITS_PER_BYTE;
+        }
+    }
+    return Buffer.from(bytes);
+}
+//# sourceMappingURL=totp.js.map

package/dist/common/crypto/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../../src/common/crypto/totp.ts"],"names":[],"mappings":";;AAwCA,4CAEC;AAWD,4DAUC;AASD,kDASC;AAQD,gCAEC;AAeD,wCAgBC;AAQD,oCAcC;AASD,oCAgBC;AAzKD,6CAAsD;AACtD,2CAqBqB;AACrB,qDAAsD;AACtD,wCAAuD;AAEvD;;;;;;;GAOG;AAEH;;;;GAIG;AACH,SAAgB,gBAAgB;IAC9B,OAAO,YAAY,CAAC,IAAA,yBAAW,EAAC,6BAAiB,CAAC,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CAAC,MAAc,EAAE,WAAmB,EAAE,UAAkB;IAC9F,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,UAAU,GAAG,gCAAoB,GAAG,WAAW,EAAE,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC;QACrC,MAAM;QACN,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,mCAAuB;QAClC,MAAM,EAAE,MAAM,CAAC,uBAAW,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC,+BAAmB,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,wCAA4B,GAAG,KAAK,GAAG,+BAAmB,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC;AAC5F,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,MAAc,EAAE,QAAgB;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,8BAAkB,CAAC,CAAC;IACjD,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,0BAAc,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IAE5F,2FAA2F;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;IAC1D,OAAO,MAAM,CAAC,UAAU,GAAG,wBAAY,IAAI,uBAAW,CAAC,CAAC,QAAQ,CAAC,uBAAW,EAAE,mCAAuB,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,eAAuB;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,+BAAmB,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,cAAc,CAC5B,MAAc,EACd,SAAiB,EACjB,oBAAmC,EACnC,eAAe,GAAG,IAAA,6BAAsB,GAAE;IAE1C,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,8BAAkB,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,+BAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,uBAAW;QAAE,OAAO,IAAI,CAAC;IAE1F,MAAM,WAAW,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAChD,KAAK,IAAI,KAAK,GAAG,CAAC,oCAAwB,EAAE,KAAK,IAAI,oCAAwB,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,MAAM,IAAI,GAAG,WAAW,GAAG,KAAK,CAAC;QACjC,MAAM,WAAW,GAAG,oBAAoB,KAAK,IAAI,IAAI,IAAI,IAAI,oBAAoB,CAAC;QAClF,IAAI,CAAC,WAAW,IAAI,IAAA,mCAAkB,EAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;IACpG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,YAAY,CAAC,KAAa;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,yBAAa,CAAC,GAAG,IAAI,CAAC;QACxC,IAAI,IAAI,yBAAa,CAAC;QACtB,OAAO,IAAI,IAAI,qCAAyB,EAAE,CAAC;YACzC,MAAM,IAAI,2BAAe,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,qCAAyB,CAAC,CAAC,GAAG,iCAAqB,CAAC,CAAC;YAClG,IAAI,IAAI,qCAAyB,CAAC;QACpC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,MAAM,IAAI,2BAAe,CAAC,CAAC,KAAK,IAAI,CAAC,qCAAyB,GAAG,IAAI,CAAC,CAAC,GAAG,iCAAqB,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,IAAY;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,kCAAsB,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,2BAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9D,KAAK,GAAG,CAAC,KAAK,IAAI,qCAAyB,CAAC,GAAG,KAAK,CAAC;QACrD,IAAI,IAAI,qCAAyB,CAAC;QAClC,IAAI,IAAI,IAAI,yBAAa,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,yBAAa,CAAC,CAAC,GAAG,qBAAS,CAAC,CAAC;YAC3D,IAAI,IAAI,yBAAa,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/common/encryption.service.d.ts

@@ -0,0 +1,36 @@
+import { AuthOptions } from '../auth-options.js';
+/**
+ * Encrypts secrets we must be able to read back later: the token-signing private key,
+ * authenticator-app secrets and webhook signing secrets. (Passwords and tokens are hashed instead.)
+ *
+ * Stored format: "<method>:<base64 data>", where method is "kms" or "local". Keeping the method
+ * with the data means you can move from the local key to KMS later and old values still decrypt.
+ *
+ * `context` (e.g. { purpose: 'two-factor', userId }) is bound to the ciphertext: a value copied
+ * onto another user's row will not decrypt.
+ */
+export declare class EncryptionService {
+    private readonly kmsClient?;
+    private readonly kmsKeyId?;
+    private readonly localKey?;
+    constructor(options: AuthOptions);
+    /**
+     * Encrypts a secret with AWS KMS when configured, otherwise with the local AES-256-GCM key.
+     *
+     * @param plainText - The secret to protect.
+     * @param context - Binds the value to its owner, e.g. { purpose: 'two-factor', userId }.
+     *   The same context must be passed to `decrypt`.
+     * @returns The stored form, "<method>:<base64 data>".
+     */
+    encrypt(plainText: string, context: Record<string, string>): Promise<string>;
+    /**
+     * Decrypts a value written by `encrypt`. Works for both "kms" and "local" values,
+     * whichever method is configured now.
+     *
+     * @param storedValue - The "<method>:<base64 data>" text from the database.
+     * @param context - The same context that was used to encrypt it.
+     * @returns The original secret.
+     * @throws If the context doesn't match, the data was tampered with, or the needed key is not configured.
+     */
+    decrypt(storedValue: string, context: Record<string, string>): Promise<string>;
+}

package/dist/common/encryption.service.js

@@ -0,0 +1,111 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionService = void 0;
+const client_kms_1 = require("@aws-sdk/client-kms");
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const constants_1 = require("../constants.js");
+/**
+ * Encrypts secrets we must be able to read back later: the token-signing private key,
+ * authenticator-app secrets and webhook signing secrets. (Passwords and tokens are hashed instead.)
+ *
+ * Stored format: "<method>:<base64 data>", where method is "kms" or "local". Keeping the method
+ * with the data means you can move from the local key to KMS later and old values still decrypt.
+ *
+ * `context` (e.g. { purpose: 'two-factor', userId }) is bound to the ciphertext: a value copied
+ * onto another user's row will not decrypt.
+ */
+let EncryptionService = class EncryptionService {
+    kmsClient;
+    kmsKeyId;
+    localKey;
+    constructor(options) {
+        if ('awsKmsKeyId' in options.encryption) {
+            this.kmsClient = new client_kms_1.KMSClient({ region: options.encryption.awsRegion });
+            this.kmsKeyId = options.encryption.awsKmsKeyId;
+            // Only for reading values written before the move to KMS.
+            if (options.encryption.legacyLocalKey)
+                this.localKey = Buffer.from(options.encryption.legacyLocalKey, constants_1.TEXT_ENCODING.base64);
+        }
+        else {
+            this.localKey = Buffer.from(options.encryption.localKey, constants_1.TEXT_ENCODING.base64);
+        }
+    }
+    /**
+     * Encrypts a secret with AWS KMS when configured, otherwise with the local AES-256-GCM key.
+     *
+     * @param plainText - The secret to protect.
+     * @param context - Binds the value to its owner, e.g. { purpose: 'two-factor', userId }.
+     *   The same context must be passed to `decrypt`.
+     * @returns The stored form, "<method>:<base64 data>".
+     */
+    async encrypt(plainText, context) {
+        if (this.kmsClient) {
+            const result = await this.kmsClient.send(new client_kms_1.EncryptCommand({ KeyId: this.kmsKeyId, Plaintext: Buffer.from(plainText, constants_1.TEXT_ENCODING.utf8), EncryptionContext: context }));
+            return `${constants_1.ENCRYPTED_VALUE_METHOD.kms}${constants_1.ENCRYPTED_VALUE_SEPARATOR}${Buffer.from(result.CiphertextBlob).toString(constants_1.TEXT_ENCODING.base64)}`;
+        }
+        const initializationVector = (0, node_crypto_1.randomBytes)(constants_1.AES_GCM_INITIALIZATION_VECTOR_BYTES);
+        const cipher = (0, node_crypto_1.createCipheriv)(constants_1.LOCAL_ENCRYPTION_CIPHER, this.localKey, initializationVector);
+        cipher.setAAD(Buffer.from(describeContext(context)));
+        const encrypted = Buffer.concat([cipher.update(plainText, constants_1.TEXT_ENCODING.utf8), cipher.final()]);
+        const authenticationTag = cipher.getAuthTag();
+        return `${constants_1.ENCRYPTED_VALUE_METHOD.local}${constants_1.ENCRYPTED_VALUE_SEPARATOR}${Buffer.concat([initializationVector, authenticationTag, encrypted]).toString(constants_1.TEXT_ENCODING.base64)}`;
+    }
+    /**
+     * Decrypts a value written by `encrypt`. Works for both "kms" and "local" values,
+     * whichever method is configured now.
+     *
+     * @param storedValue - The "<method>:<base64 data>" text from the database.
+     * @param context - The same context that was used to encrypt it.
+     * @returns The original secret.
+     * @throws If the context doesn't match, the data was tampered with, or the needed key is not configured.
+     */
+    async decrypt(storedValue, context) {
+        const separatorIndex = storedValue.indexOf(constants_1.ENCRYPTED_VALUE_SEPARATOR);
+        const method = storedValue.slice(0, separatorIndex);
+        const data = Buffer.from(storedValue.slice(separatorIndex + 1), constants_1.TEXT_ENCODING.base64);
+        if (method === constants_1.ENCRYPTED_VALUE_METHOD.kms) {
+            // KMS knows which key encrypted the data, so no key id is needed here.
+            const client = this.kmsClient ?? new client_kms_1.KMSClient({});
+            const result = await client.send(new client_kms_1.DecryptCommand({ CiphertextBlob: data, EncryptionContext: context }));
+            return Buffer.from(result.Plaintext).toString(constants_1.TEXT_ENCODING.utf8);
+        }
+        if (method === constants_1.ENCRYPTED_VALUE_METHOD.local) {
+            if (!this.localKey)
+                throw new Error('This value was encrypted with a local key, but no localKey is configured');
+            const decipher = (0, node_crypto_1.createDecipheriv)(constants_1.LOCAL_ENCRYPTION_CIPHER, this.localKey, data.subarray(0, constants_1.AES_GCM_INITIALIZATION_VECTOR_BYTES));
+            decipher.setAAD(Buffer.from(describeContext(context)));
+            decipher.setAuthTag(data.subarray(constants_1.AES_GCM_INITIALIZATION_VECTOR_BYTES, constants_1.AES_GCM_INITIALIZATION_VECTOR_BYTES + constants_1.AES_GCM_AUTH_TAG_BYTES));
+            return Buffer.concat([decipher.update(data.subarray(constants_1.AES_GCM_INITIALIZATION_VECTOR_BYTES + constants_1.AES_GCM_AUTH_TAG_BYTES)), decipher.final()]).toString(constants_1.TEXT_ENCODING.utf8);
+        }
+        throw new Error(`Unknown encryption method "${method}"`);
+    }
+};
+exports.EncryptionService = EncryptionService;
+exports.EncryptionService = EncryptionService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object])
+], EncryptionService);
+/**
+ * Turns the context into one stable string (keys sorted) for AES-GCM's "additional authenticated data".
+ *
+ * @param context - The encryption context.
+ * @returns A JSON string that is the same for the same keys and values in any order.
+ */
+function describeContext(context) {
+    return JSON.stringify(Object.keys(context).sort().map((key) => [key, context[key]]));
+}
+//# sourceMappingURL=encryption.service.js.map

package/dist/common/encryption.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.js","sourceRoot":"","sources":["../../src/common/encryption.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oDAAgF;AAChF,2CAAoD;AACpD,6CAA4E;AAE5E,2CAQqB;AAErB;;;;;;;;;GASG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACX,SAAS,CAAa;IACtB,QAAQ,CAAU;IAClB,QAAQ,CAAU;IAEnC,YAAwC,OAAoB;QAC1D,IAAI,aAAa,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,CAAC,SAAS,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YAC/C,0DAA0D;YAC1D,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc;gBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,yBAAa,CAAC,MAAM,CAAC,CAAC;QAC9H,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,yBAAa,CAAC,MAAM,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAA+B;QAC9D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CACtC,IAAI,2BAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAa,CAAC,IAAI,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAChI,CAAC;YACF,OAAO,GAAG,kCAAsB,CAAC,GAAG,GAAG,qCAAyB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAe,CAAC,CAAC,QAAQ,CAAC,yBAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1I,CAAC;QAED,MAAM,oBAAoB,GAAG,IAAA,yBAAW,EAAC,+CAAmC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,mCAAuB,EAAE,IAAI,CAAC,QAAS,EAAE,oBAAoB,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,yBAAa,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChG,MAAM,iBAAiB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC9C,OAAO,GAAG,kCAAsB,CAAC,KAAK,GAAG,qCAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5K,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,OAA+B;QAChE,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,qCAAyB,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,EAAE,yBAAa,CAAC,MAAM,CAAC,CAAC;QAEtF,IAAI,MAAM,KAAK,kCAAsB,CAAC,GAAG,EAAE,CAAC;YAC1C,uEAAuE;YACvE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,sBAAS,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,2BAAc,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAC3G,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAU,CAAC,CAAC,QAAQ,CAAC,yBAAa,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,MAAM,KAAK,kCAAsB,CAAC,KAAK,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;YAChH,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,mCAAuB,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,+CAAmC,CAAC,CAAC,CAAC;YACjI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACvD,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,+CAAmC,EAAE,+CAAmC,GAAG,kCAAsB,CAAC,CAAC,CAAC;YACtI,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,+CAAmC,GAAG,kCAAsB,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAa,CAAC,IAAI,CAAC,CAAC;QACtK,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,GAAG,CAAC,CAAC;IAC3D,CAAC;CACF,CAAA;AAvEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAME,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;;GAL5B,iBAAiB,CAuE7B;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAA+B;IACtD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC"}

package/dist/common/identifiers.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Turns what the user typed into the one form we store and look up, so "Asha@Mail.com " and
+ * "asha@mail.com" are the same account.
+ *
+ * @param typedEmail - The raw value from the request.
+ * @returns The trimmed, lower-case email.
+ * @throws AuthError INVALID_EMAIL if it is not an email address.
+ */
+export declare function normalizeEmail(typedEmail: unknown): string;
+/**
+ * Turns "+91 98765-43210" into "+919876543210" (E.164). The country code is required,
+ * because guessing it would send codes to the wrong country.
+ *
+ * @param typedPhoneNumber - The raw value from the request.
+ * @returns The phone number in E.164 form.
+ * @throws AuthError INVALID_PHONE if it is not a valid international number.
+ */
+export declare function normalizePhoneNumber(typedPhoneNumber: unknown): string;
+/**
+ * Checks the email's domain against an allow-list.
+ *
+ * @param email - A normalized email.
+ * @param allowedDomains - e.g. ["company.com"]; an empty list allows any domain.
+ * @returns True when the domain is allowed.
+ */
+export declare function isEmailDomainAllowed(email: string, allowedDomains: string[]): boolean;
+/**
+ * Checks the phone number's country code against an allow-list.
+ *
+ * @param phoneNumber - A normalized E.164 phone number.
+ * @param allowedCountryCodes - e.g. ["+91", "+1"]; an empty list allows any country.
+ * @returns True when the country is allowed.
+ */
+export declare function isPhoneCountryAllowed(phoneNumber: string, allowedCountryCodes: string[]): boolean;
+/**
+ * Hides most of an email for messages and logs: "asha@mail.com" -> "a***@mail.com".
+ *
+ * @param email - A normalized email.
+ * @returns The masked email.
+ */
+export declare function maskEmail(email: string): string;
+/**
+ * Hides the middle of a phone number for messages and logs: "+919876543210" -> "+91******3210".
+ *
+ * @param phoneNumber - A normalized E.164 phone number.
+ * @returns The masked phone number.
+ */
+export declare function maskPhoneNumber(phoneNumber: string): string;

package/dist/common/identifiers.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeEmail = normalizeEmail;
+exports.normalizePhoneNumber = normalizePhoneNumber;
+exports.isEmailDomainAllowed = isEmailDomainAllowed;
+exports.isPhoneCountryAllowed = isPhoneCountryAllowed;
+exports.maskEmail = maskEmail;
+exports.maskPhoneNumber = maskPhoneNumber;
+const constants_1 = require("../constants.js");
+const auth_error_1 = require("./auth-error");
+/**
+ * Turns what the user typed into the one form we store and look up, so "Asha@Mail.com " and
+ * "asha@mail.com" are the same account.
+ *
+ * @param typedEmail - The raw value from the request.
+ * @returns The trimmed, lower-case email.
+ * @throws AuthError INVALID_EMAIL if it is not an email address.
+ */
+function normalizeEmail(typedEmail) {
+    if (typeof typedEmail !== 'string')
+        throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidEmail);
+    const email = typedEmail.trim().toLowerCase();
+    if (email.length > constants_1.EMAIL_MAX_LENGTH || !constants_1.EMAIL_PATTERN.test(email))
+        throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidEmail);
+    return email;
+}
+/**
+ * Turns "+91 98765-43210" into "+919876543210" (E.164). The country code is required,
+ * because guessing it would send codes to the wrong country.
+ *
+ * @param typedPhoneNumber - The raw value from the request.
+ * @returns The phone number in E.164 form.
+ * @throws AuthError INVALID_PHONE if it is not a valid international number.
+ */
+function normalizePhoneNumber(typedPhoneNumber) {
+    if (typeof typedPhoneNumber !== 'string')
+        throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPhone);
+    const phoneNumber = typedPhoneNumber.replace(constants_1.PHONE_FORMATTING_CHARACTERS_PATTERN, '');
+    if (!constants_1.PHONE_NUMBER_PATTERN.test(phoneNumber))
+        throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.invalidPhone);
+    return phoneNumber;
+}
+/**
+ * Checks the email's domain against an allow-list.
+ *
+ * @param email - A normalized email.
+ * @param allowedDomains - e.g. ["company.com"]; an empty list allows any domain.
+ * @returns True when the domain is allowed.
+ */
+function isEmailDomainAllowed(email, allowedDomains) {
+    if (allowedDomains.length === 0)
+        return true;
+    const domain = email.slice(email.lastIndexOf(constants_1.EMAIL_MASK.domainSeparator) + 1);
+    return allowedDomains.some((allowedDomain) => allowedDomain.toLowerCase() === domain);
+}
+/**
+ * Checks the phone number's country code against an allow-list.
+ *
+ * @param phoneNumber - A normalized E.164 phone number.
+ * @param allowedCountryCodes - e.g. ["+91", "+1"]; an empty list allows any country.
+ * @returns True when the country is allowed.
+ */
+function isPhoneCountryAllowed(phoneNumber, allowedCountryCodes) {
+    if (allowedCountryCodes.length === 0)
+        return true;
+    return allowedCountryCodes.some((countryCode) => phoneNumber.startsWith(countryCode));
+}
+/**
+ * Hides most of an email for messages and logs: "asha@mail.com" -> "a***@mail.com".
+ *
+ * @param email - A normalized email.
+ * @returns The masked email.
+ */
+function maskEmail(email) {
+    const [localPart, domain] = email.split(constants_1.EMAIL_MASK.domainSeparator);
+    return `${localPart.slice(0, constants_1.EMAIL_MASK.visibleCharacters)}${constants_1.EMAIL_MASK.hiddenPart}${constants_1.EMAIL_MASK.domainSeparator}${domain}`;
+}
+/**
+ * Hides the middle of a phone number for messages and logs: "+919876543210" -> "+91******3210".
+ *
+ * @param phoneNumber - A normalized E.164 phone number.
+ * @returns The masked phone number.
+ */
+function maskPhoneNumber(phoneNumber) {
+    const visibleEnd = phoneNumber.slice(-constants_1.PHONE_MASK.visibleEnd);
+    const visibleStart = phoneNumber.slice(0, constants_1.PHONE_MASK.visibleStart);
+    return `${visibleStart}${constants_1.PHONE_MASK.maskCharacter.repeat(Math.max(phoneNumber.length - constants_1.PHONE_MASK.visibleStart - constants_1.PHONE_MASK.visibleEnd, 0))}${visibleEnd}`;
+}
+//# sourceMappingURL=identifiers.js.map

package/dist/common/identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.js","sourceRoot":"","sources":["../../src/common/identifiers.ts"],"names":[],"mappings":";;AAmBA,wCAKC;AAUD,oDAKC;AASD,oDAIC;AASD,sDAGC;AAQD,8BAGC;AAQD,0CAIC;AAvFD,2CAQqB;AACrB,6CAAyC;AAEzC;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,UAAmB;IAChD,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,4BAAgB,IAAI,CAAC,yBAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;IACjH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAAC,gBAAyB;IAC5D,IAAI,OAAO,gBAAgB,KAAK,QAAQ;QAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;IACxF,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,+CAAmC,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC,gCAAoB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;IAC3F,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,KAAa,EAAE,cAAwB;IAC1E,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,sBAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,WAAmB,EAAE,mBAA6B;IACtF,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,SAAS,CAAC,KAAa;IACrC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAU,CAAC,eAAe,CAAC,CAAC;IACpE,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAU,CAAC,iBAAiB,CAAC,GAAG,sBAAU,CAAC,UAAU,GAAG,sBAAU,CAAC,eAAe,GAAG,MAAM,EAAE,CAAC;AAC7H,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,WAAmB;IACjD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,sBAAU,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAU,CAAC,YAAY,CAAC,CAAC;IACnE,OAAO,GAAG,YAAY,GAAG,sBAAU,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,sBAAU,CAAC,YAAY,GAAG,sBAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,CAAC;AAC7J,CAAC"}

package/dist/common/network-safety.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Checks whether an IP address is private, loopback, link-local, multicast or otherwise not public.
+ *
+ * @param ipAddress - An IPv4 or IPv6 address.
+ * @returns True when the address must not be called (anything that isn't an IP also counts as unsafe).
+ */
+export declare function isPrivateIpAddress(ipAddress: string): boolean;
+/**
+ * Checks that a URL is safe for the server to call (protection against SSRF):
+ * - https only (http allowed for localhost only when NODE_ENV is not "production", for local testing),
+ * - no username/password in the URL,
+ * - every address the host name resolves to is public.
+ *
+ * Call it when a webhook is saved AND right before each delivery, because DNS answers can change.
+ *
+ * @param rawUrl - The URL to check.
+ * @returns A reason (from URL_SAFETY_PROBLEM) when unsafe, or null when safe.
+ */
+export declare function findUrlSafetyProblem(rawUrl: string): Promise<string | null>;

package/dist/common/network-safety.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPrivateIpAddress = isPrivateIpAddress;
+exports.findUrlSafetyProblem = findUrlSafetyProblem;
+const promises_1 = require("node:dns/promises");
+const node_net_1 = require("node:net");
+const constants_1 = require("../constants.js");
+/** All address ranges that outgoing webhook calls must never reach. */
+const blockedAddresses = new node_net_1.BlockList();
+for (const [network, prefixLength] of constants_1.BLOCKED_IPV4_RANGES)
+    blockedAddresses.addSubnet(network, prefixLength, constants_1.IP_FAMILY.ipv4);
+for (const [network, prefixLength] of constants_1.BLOCKED_IPV6_RANGES)
+    blockedAddresses.addSubnet(network, prefixLength, constants_1.IP_FAMILY.ipv6);
+/**
+ * Checks whether an IP address is private, loopback, link-local, multicast or otherwise not public.
+ *
+ * @param ipAddress - An IPv4 or IPv6 address.
+ * @returns True when the address must not be called (anything that isn't an IP also counts as unsafe).
+ */
+function isPrivateIpAddress(ipAddress) {
+    const version = (0, node_net_1.isIP)(ipAddress);
+    if (version === 0)
+        return true; // Not an IP at all: treat as unsafe.
+    if (version === constants_1.IP_VERSION_6) {
+        // "::ffff:10.0.0.1" is an IPv4 address in IPv6 clothing; check the IPv4 part too.
+        const mappedIpv4 = constants_1.IPV4_MAPPED_IPV6_PATTERN.exec(ipAddress)?.[1];
+        if (mappedIpv4 && blockedAddresses.check(mappedIpv4, constants_1.IP_FAMILY.ipv4))
+            return true;
+        return blockedAddresses.check(ipAddress, constants_1.IP_FAMILY.ipv6);
+    }
+    return blockedAddresses.check(ipAddress, constants_1.IP_FAMILY.ipv4);
+}
+/**
+ * Checks that a URL is safe for the server to call (protection against SSRF):
+ * - https only (http allowed for localhost only when NODE_ENV is not "production", for local testing),
+ * - no username/password in the URL,
+ * - every address the host name resolves to is public.
+ *
+ * Call it when a webhook is saved AND right before each delivery, because DNS answers can change.
+ *
+ * @param rawUrl - The URL to check.
+ * @returns A reason (from URL_SAFETY_PROBLEM) when unsafe, or null when safe.
+ */
+async function findUrlSafetyProblem(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return constants_1.URL_SAFETY_PROBLEM.invalidUrl;
+    }
+    if (url.username || url.password)
+        return constants_1.URL_SAFETY_PROBLEM.hasCredentials;
+    const hostName = url.hostname.replace(constants_1.URL_IPV6_BRACKETS_PATTERN, '');
+    const isLocalDevelopmentUrl = process.env.NODE_ENV !== constants_1.PRODUCTION_ENVIRONMENT && url.protocol === constants_1.URL_PROTOCOL.http && constants_1.LOCAL_DEVELOPMENT_HOSTS.includes(hostName);
+    if (isLocalDevelopmentUrl)
+        return null;
+    if (url.protocol !== constants_1.URL_PROTOCOL.https)
+        return constants_1.URL_SAFETY_PROBLEM.notHttps;
+    try {
+        const resolvedAddresses = (0, node_net_1.isIP)(hostName) ? [{ address: hostName }] : await (0, promises_1.lookup)(hostName, { all: true, verbatim: true });
+        if (resolvedAddresses.length === 0)
+            return constants_1.URL_SAFETY_PROBLEM.doesNotResolve;
+        if (resolvedAddresses.some(({ address }) => isPrivateIpAddress(address)))
+            return constants_1.URL_SAFETY_PROBLEM.privateAddress;
+    }
+    catch {
+        return constants_1.URL_SAFETY_PROBLEM.doesNotResolve;
+    }
+    return null;
+}
+//# sourceMappingURL=network-safety.js.map

package/dist/common/network-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-safety.js","sourceRoot":"","sources":["../../src/common/network-safety.ts"],"names":[],"mappings":";;AA0BA,gDAUC;AAaD,oDAuBC;AAxED,gDAA2C;AAC3C,uCAA2C;AAC3C,2CAWqB;AAErB,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,IAAI,oBAAS,EAAE,CAAC;AACzC,KAAK,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,+BAAmB;IAAE,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,qBAAS,CAAC,IAAI,CAAC,CAAC;AAC7H,KAAK,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,+BAAmB;IAAE,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,qBAAS,CAAC,IAAI,CAAC,CAAC;AAE7H;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,MAAM,OAAO,GAAG,IAAA,eAAI,EAAC,SAAS,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,qCAAqC;IACrE,IAAI,OAAO,KAAK,wBAAY,EAAE,CAAC;QAC7B,kFAAkF;QAClF,MAAM,UAAU,GAAG,oCAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,qBAAS,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAS,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,qBAAS,CAAC,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,8BAAkB,CAAC,UAAU,CAAC;IACvC,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,8BAAkB,CAAC,cAAc,CAAC;IAE3E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,qCAAyB,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,qBAAqB,GACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,kCAAsB,IAAI,GAAG,CAAC,QAAQ,KAAK,wBAAY,CAAC,IAAI,IAAI,mCAAuB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtI,IAAI,qBAAqB;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,GAAG,CAAC,QAAQ,KAAK,wBAAY,CAAC,KAAK;QAAE,OAAO,8BAAkB,CAAC,QAAQ,CAAC;IAE5E,IAAI,CAAC;QACH,MAAM,iBAAiB,GAAG,IAAA,eAAI,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAA,iBAAM,EAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3H,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,8BAAkB,CAAC,cAAc,CAAC;QAC7E,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,8BAAkB,CAAC,cAAc,CAAC;IACrH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,8BAAkB,CAAC,cAAc,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/common/rate-limiter.service.d.ts

@@ -0,0 +1,63 @@
+import { OnModuleDestroy } from '@nestjs/common';
+import { AuthOptions } from '../auth-options.js';
+import { HealthStatus, RateLimitRule } from '../constants.js';
+/**
+ * Counts attempts per key (an IP address, an email, a user id) inside a time window and blocks
+ * once there are too many. Counters live in Redis when `redisUrl` is set (shared by every server),
+ * otherwise in this server's memory.
+ */
+export declare class RateLimiterService implements OnModuleDestroy {
+    private readonly logger;
+    private readonly redisClient?;
+    private readonly countersInMemory;
+    constructor(options: AuthOptions);
+    /**
+     * For the health check: is Redis answering?
+     *
+     * @returns "ok", "error", or "not_used" when rate limits live in memory.
+     */
+    checkRedis(): Promise<HealthStatus>;
+    /**
+     * Closes the Redis connection when the app shuts down, so the process can exit cleanly.
+     */
+    onModuleDestroy(): Promise<void>;
+    /**
+     * Records one attempt for `key` and blocks when there have been too many inside the rule's window.
+     *
+     * @param key - What is being limited, e.g. an IP address, an email or a user id.
+     * @param rule - How many attempts are allowed and in how long a window.
+     * @throws AuthError TOO_MANY_REQUESTS (with `retryAfterSeconds`) when the limit is exceeded.
+     * @example
+     * await rateLimiter.consume(`sign-in:ip:${ipAddress}`, RATE_LIMITS.signInPerIp);
+     */
+    consume(key: string, rule: RateLimitRule): Promise<void>;
+    /**
+     * Forgets the attempts for `key`, e.g. the per-account sign-in counter after a successful sign-in.
+     *
+     * @param key - The same key that was passed to `consume`.
+     */
+    reset(key: string): Promise<void>;
+    /**
+     * Counts an attempt in Redis (shared by every server).
+     * If Redis is down the request is blocked, rather than allowing unlimited password or code guessing.
+     *
+     * @param key - What is being limited.
+     * @param rule - The limit to apply.
+     * @returns 0 when allowed, otherwise the seconds until the window resets.
+     */
+    private countInRedis;
+    /**
+     * Counts an attempt in this server's memory (used when there is no Redis).
+     *
+     * @param key - What is being limited.
+     * @param rule - The limit to apply.
+     * @returns 0 when allowed, otherwise the seconds until the window resets.
+     */
+    private countInMemory;
+    /**
+     * Removes finished windows once the map gets large, so memory stays bounded on long-running servers.
+     *
+     * @param now - The current time in milliseconds.
+     */
+    private pruneExpiredCounters;
+}