@techelusive/nest-auth 0.0.0-stage → 0.2.1

package/dist/features/account/account.dto.js

@@ -0,0 +1,61 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateMyProfileInput = exports.ReactivateAccountInput = exports.RefreshTokenInput = void 0;
+const class_validator_1 = require("class-validator");
+const constants_1 = require("../../constants.js");
+/** POST /auth/refresh. Leave refreshToken out when it lives in the cookie (AuthOptions.refreshTokenCookie). */
+class RefreshTokenInput {
+    refreshToken;
+}
+exports.RefreshTokenInput = RefreshTokenInput;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.RANDOM_TOKEN_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], RefreshTokenInput.prototype, "refreshToken", void 0);
+/** POST /auth/reactivate */
+class ReactivateAccountInput {
+    /** The reactivationToken from the ACCOUNT_DEACTIVATED sign-in response. */
+    reactivationToken;
+}
+exports.ReactivateAccountInput = ReactivateAccountInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.RANDOM_TOKEN_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], ReactivateAccountInput.prototype, "reactivationToken", void 0);
+/** PATCH /auth/me. Users may change their name and app fields, never their roles or status. */
+class UpdateMyProfileInput {
+    firstName;
+    lastName;
+    metadata;
+}
+exports.UpdateMyProfileInput = UpdateMyProfileInput;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.DISPLAY_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], UpdateMyProfileInput.prototype, "firstName", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.DISPLAY_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], UpdateMyProfileInput.prototype, "lastName", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], UpdateMyProfileInput.prototype, "metadata", void 0);
+//# sourceMappingURL=account.dto.js.map

package/dist/features/account/account.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.dto.js","sourceRoot":"","sources":["../../../src/features/account/account.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA4E;AAC5E,2CAAqF;AAGrF,+GAA+G;AAC/G,MAAa,iBAAiB;IAE5B,YAAY,CAAU;CACvB;AAHD,8CAGC;AADC;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;uDAC7C;AAGxB,4BAA4B;AAC5B,MAAa,sBAAsB;IACjC,2EAA2E;IAE3E,iBAAiB,CAAS;CAC3B;AAJD,wDAIC;AADC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;iEAC3B;AAG5B,+FAA+F;AAC/F,MAAa,oBAAoB;IAE/B,SAAS,CAAU;IAGnB,QAAQ,CAAU;IAGlB,QAAQ,CAAc;CACvB;AATD,oDASC;AAPC;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,mCAAuB,CAAC;;uDAC1C;AAGnB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,mCAAuB,CAAC;;sDAC3C;AAGlB;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;;sDACH"}

package/dist/features/account/data-export.service.d.ts

@@ -0,0 +1,85 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RateLimiterService } from '../../common/rate-limiter.service.js';
+import { SettingsService } from '../settings/settings.service.js';
+import { SignInMethodsService } from '../users/sign-in-methods.service.js';
+import { UsersService } from '../users/users.service.js';
+/**
+ * "Download my data" (GET /auth/me/export), for privacy laws such as India's DPDP Act and the GDPR.
+ *
+ * Everything this library stores about the user, in readable form: profile, sign-in methods,
+ * linked accounts, passkeys (names only), devices, organizations and their security history.
+ * Never included: password hashes, 2FA secrets, backup codes, tokens or keys.
+ * Your app adds its own data (orders, rides...) next to this in its own export.
+ */
+export declare class DataExportService {
+    private readonly settingsService;
+    private readonly users;
+    private readonly signInMethods;
+    private readonly rateLimiter;
+    private readonly database;
+    constructor(options: AuthOptions, settingsService: SettingsService, users: UsersService, signInMethods: SignInMethodsService, rateLimiter: RateLimiterService);
+    /**
+     * Collects everything this library stores about the user, in readable form.
+     * Secrets (password hashes, 2FA secrets, backup codes, tokens, keys) are never included.
+     *
+     * @param userId - The signed-in user.
+     * @returns Profile, sign-in methods, linked accounts, passkeys, devices, organizations and security history.
+     * @throws AuthError TOO_MANY_REQUESTS when exported too often.
+     */
+    exportUserData(userId: string): Promise<{
+        success: true;
+        exportedAt: string;
+        profile: {
+            termsAcceptedAt: string | null;
+            privacyPolicyAcceptedAt: string | null;
+            onboardingCompletedAt: string | null;
+            updatedAt: string;
+            id: string;
+            email: string | null;
+            isEmailVerified: boolean;
+            phoneNumber: string | null;
+            isPhoneVerified: boolean;
+            firstName: string | null;
+            lastName: string | null;
+            roles: string[];
+            status: import("../../constants.js").AccountStatus;
+            pendingVerifications: import("../../constants.js").PendingVerification[];
+            onboardingCompleted: boolean;
+            isTwoFactorEnabled: boolean;
+            metadata: import("../../database/entities/index.js").JsonObject;
+            lastSignedInAt: string | null;
+            createdAt: string;
+        };
+        signInMethods: import("../users/sign-in-methods.service.js").UserSignInMethods;
+        linkedAccounts: {
+            provider: import("../../constants.js").SocialProvider;
+            email: string | null;
+            linkedAt: string;
+        }[];
+        passkeys: {
+            name: string;
+            createdAt: string;
+            lastUsedAt: string | null;
+        }[];
+        devices: {
+            signInMethod: string;
+            ipAddress: string | null;
+            userAgent: string | null;
+            signedInAt: string;
+            lastUsedAt: string;
+            endedAt: string | null;
+        }[];
+        organizations: {
+            name: string | null;
+            role: import("../../constants.js").OrganizationRole;
+            joinedAt: string;
+        }[];
+        securityHistory: {
+            event: string;
+            ipAddress: string | null;
+            userAgent: string | null;
+            details: import("../../database/entities/index.js").JsonObject;
+            at: string;
+        }[];
+    }>;
+}

package/dist/features/account/data-export.service.js

@@ -0,0 +1,125 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DataExportService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const rate_limiter_service_1 = require("../../common/rate-limiter.service.js");
+const constants_1 = require("../../constants.js");
+const entities_1 = require("../../database/entities/index.js");
+const settings_service_1 = require("../settings/settings.service.js");
+const sign_in_methods_service_1 = require("../users/sign-in-methods.service.js");
+const users_service_1 = require("../users/users.service.js");
+/**
+ * "Download my data" (GET /auth/me/export), for privacy laws such as India's DPDP Act and the GDPR.
+ *
+ * Everything this library stores about the user, in readable form: profile, sign-in methods,
+ * linked accounts, passkeys (names only), devices, organizations and their security history.
+ * Never included: password hashes, 2FA secrets, backup codes, tokens or keys.
+ * Your app adds its own data (orders, rides...) next to this in its own export.
+ */
+let DataExportService = class DataExportService {
+    settingsService;
+    users;
+    signInMethods;
+    rateLimiter;
+    database;
+    constructor(options, settingsService, users, signInMethods, rateLimiter) {
+        this.settingsService = settingsService;
+        this.users = users;
+        this.signInMethods = signInMethods;
+        this.rateLimiter = rateLimiter;
+        this.database = options.dataSource;
+    }
+    /**
+     * Collects everything this library stores about the user, in readable form.
+     * Secrets (password hashes, 2FA secrets, backup codes, tokens, keys) are never included.
+     *
+     * @param userId - The signed-in user.
+     * @returns Profile, sign-in methods, linked accounts, passkeys, devices, organizations and security history.
+     * @throws AuthError TOO_MANY_REQUESTS when exported too often.
+     */
+    async exportUserData(userId) {
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.exportDataPerUser(userId), constants_1.RATE_LIMITS.exportDataPerUser);
+        const settings = await this.settingsService.getSettings();
+        const user = await this.users.getUserOrThrow(userId);
+        const [signInMethods, socialAccounts, passkeys, sessions, memberships, history] = await Promise.all([
+            this.signInMethods.listSignInMethods(user, settings),
+            this.database.getRepository(entities_1.SocialAccountEntity).find({ where: { userId }, order: { createdAt: constants_1.SORT_ORDER.oldestFirst } }),
+            this.database.getRepository(entities_1.PasskeyEntity).find({ where: { userId }, order: { createdAt: constants_1.SORT_ORDER.oldestFirst } }),
+            this.database.getRepository(entities_1.SessionEntity).find({ where: { userId }, order: { createdAt: constants_1.SORT_ORDER.newestFirst } }),
+            this.database.getRepository(entities_1.OrganizationMemberEntity).find({ where: { userId }, order: { createdAt: constants_1.SORT_ORDER.oldestFirst } }),
+            this.database.getRepository(entities_1.AuditLogEntity).find({
+                where: { userId },
+                order: { createdAt: constants_1.SORT_ORDER.newestFirst },
+                take: constants_1.DATA_EXPORT_AUDIT_LOG_LIMIT,
+            }),
+        ]);
+        const organizations = memberships.length
+            ? await this.database.getRepository(entities_1.OrganizationEntity).findBy({ id: (0, typeorm_1.In)(memberships.map((membership) => membership.organizationId)) })
+            : [];
+        return {
+            success: true,
+            exportedAt: new Date().toISOString(),
+            profile: {
+                ...this.users.toPublicProfile(user, settings),
+                termsAcceptedAt: user.termsAcceptedAt?.toISOString() ?? null,
+                privacyPolicyAcceptedAt: user.privacyPolicyAcceptedAt?.toISOString() ?? null,
+                onboardingCompletedAt: user.onboardingCompletedAt?.toISOString() ?? null,
+                updatedAt: user.updatedAt.toISOString(),
+            },
+            signInMethods,
+            linkedAccounts: socialAccounts.map((account) => ({
+                provider: account.provider,
+                email: account.email,
+                linkedAt: account.createdAt.toISOString(),
+            })),
+            passkeys: passkeys.map((passkey) => ({
+                name: passkey.name,
+                createdAt: passkey.createdAt.toISOString(),
+                lastUsedAt: passkey.lastUsedAt?.toISOString() ?? null,
+            })),
+            devices: sessions.map((session) => ({
+                signInMethod: session.signInMethod,
+                ipAddress: session.ipAddress,
+                userAgent: session.userAgent,
+                signedInAt: session.createdAt.toISOString(),
+                lastUsedAt: session.lastUsedAt.toISOString(),
+                endedAt: session.revokedAt?.toISOString() ?? null,
+            })),
+            organizations: memberships.map((membership) => ({
+                name: organizations.find((organization) => organization.id === membership.organizationId)?.name ?? null,
+                role: membership.role,
+                joinedAt: membership.createdAt.toISOString(),
+            })),
+            securityHistory: history.map((entry) => ({
+                event: entry.eventName,
+                ipAddress: entry.ipAddress,
+                userAgent: entry.userAgent,
+                details: entry.details,
+                at: entry.createdAt.toISOString(),
+            })),
+        };
+    }
+};
+exports.DataExportService = DataExportService;
+exports.DataExportService = DataExportService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, settings_service_1.SettingsService,
+        users_service_1.UsersService,
+        sign_in_methods_service_1.SignInMethodsService,
+        rate_limiter_service_1.RateLimiterService])
+], DataExportService);
+//# sourceMappingURL=data-export.service.js.map

package/dist/features/account/data-export.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-export.service.js","sourceRoot":"","sources":["../../../src/features/account/data-export.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAAyC;AAEzC,wEAAmE;AACnE,2CAAuH;AACvH,kDAO6B;AAC7B,2EAAuE;AACvE,sFAAgF;AAChF,kEAA8D;AAE9D;;;;;;;GAOG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAKT;IACA;IACA;IACA;IAPF,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,eAAgC,EAChC,KAAmB,EACnB,aAAmC,EACnC,WAA+B;QAH/B,oBAAe,GAAf,eAAe,CAAiB;QAChC,UAAK,GAAL,KAAK,CAAc;QACnB,kBAAa,GAAb,aAAa,CAAsB;QACnC,gBAAW,GAAX,WAAW,CAAoB;QAEhD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,uBAAW,CAAC,iBAAiB,CAAC,CAAC;QACxG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAErD,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,8BAAmB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC1H,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YACpH,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,wBAAa,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YACpH,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,mCAAwB,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/H,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,yBAAc,CAAC,CAAC,IAAI,CAAC;gBAC/C,KAAK,EAAE,EAAE,MAAM,EAAE;gBACjB,KAAK,EAAE,EAAE,SAAS,EAAE,sBAAU,CAAC,WAAW,EAAE;gBAC5C,IAAI,EAAE,uCAA2B;aAClC,CAAC;SACH,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM;YACtC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,6BAAkB,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACtI,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO;YACL,OAAO,EAAE,IAAa;YACtB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE;gBACP,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC7C,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,IAAI;gBAC5D,uBAAuB,EAAE,IAAI,CAAC,uBAAuB,EAAE,WAAW,EAAE,IAAI,IAAI;gBAC5E,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE,WAAW,EAAE,IAAI,IAAI;gBACxE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;aACxC;YACD,aAAa;YACb,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC/C,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;aAC1C,CAAC,CAAC;YACH,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACnC,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC1C,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;aACtD,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAClC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC3C,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC5C,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;aAClD,CAAC,CAAC;YACH,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC9C,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,UAAU,CAAC,cAAc,CAAC,EAAE,IAAI,IAAI,IAAI;gBACvG,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,QAAQ,EAAE,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE;aAC7C,CAAC,CAAC;YACH,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACvC,KAAK,EAAE,KAAK,CAAC,SAAS;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;aAClC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;CACF,CAAA;AArFY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACO,kCAAe;QACzB,4BAAY;QACJ,8CAAoB;QACtB,yCAAkB;GARvC,iBAAiB,CAqF7B"}

package/dist/features/account/health.service.d.ts

@@ -0,0 +1,30 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RateLimiterService } from '../../common/rate-limiter.service.js';
+import { HealthStatus } from '../../constants.js';
+export interface HealthReport {
+    /** True when everything the library needs is reachable. */
+    isHealthy: boolean;
+    checks: {
+        database: HealthStatus;
+        redis: HealthStatus;
+    };
+}
+/**
+ * Answers "can this server sign people in right now?" for load balancers and uptime monitors.
+ * Checks only what the library itself needs (PostgreSQL, and Redis when configured).
+ */
+export declare class HealthService {
+    private readonly rateLimiter;
+    private readonly database;
+    constructor(options: AuthOptions, rateLimiter: RateLimiterService);
+    /**
+     * Checks PostgreSQL and (when configured) Redis, each with a short timeout.
+     *
+     * @returns `isHealthy` plus the result of each check.
+     */
+    check(): Promise<HealthReport>;
+    /**
+     * @returns "ok" when PostgreSQL answers a trivial query in time, otherwise "error".
+     */
+    private checkDatabase;
+}

package/dist/features/account/health.service.js

@@ -0,0 +1,59 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HealthService = void 0;
+const common_1 = require("@nestjs/common");
+const rate_limiter_service_1 = require("../../common/rate-limiter.service.js");
+const time_1 = require("../../common/time.js");
+const constants_1 = require("../../constants.js");
+/**
+ * Answers "can this server sign people in right now?" for load balancers and uptime monitors.
+ * Checks only what the library itself needs (PostgreSQL, and Redis when configured).
+ */
+let HealthService = class HealthService {
+    rateLimiter;
+    database;
+    constructor(options, rateLimiter) {
+        this.rateLimiter = rateLimiter;
+        this.database = options.dataSource;
+    }
+    /**
+     * Checks PostgreSQL and (when configured) Redis, each with a short timeout.
+     *
+     * @returns `isHealthy` plus the result of each check.
+     */
+    async check() {
+        const [database, redis] = await Promise.all([this.checkDatabase(), this.rateLimiter.checkRedis()]);
+        return { isHealthy: database === constants_1.HEALTH_STATUS.ok && redis !== constants_1.HEALTH_STATUS.error, checks: { database, redis } };
+    }
+    /**
+     * @returns "ok" when PostgreSQL answers a trivial query in time, otherwise "error".
+     */
+    async checkDatabase() {
+        try {
+            await (0, time_1.withTimeout)(this.database.query(constants_1.HEALTH_CHECK_QUERY), constants_1.HEALTH_CHECK_TIMEOUT_MS);
+            return constants_1.HEALTH_STATUS.ok;
+        }
+        catch {
+            return constants_1.HEALTH_STATUS.error;
+        }
+    }
+};
+exports.HealthService = HealthService;
+exports.HealthService = HealthService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.AUTH_OPTIONS_TOKEN)),
+    __metadata("design:paramtypes", [Object, rate_limiter_service_1.RateLimiterService])
+], HealthService);
+//# sourceMappingURL=health.service.js.map

package/dist/features/account/health.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.service.js","sourceRoot":"","sources":["../../../src/features/account/health.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AAGpD,wEAAmE;AACnE,wCAA4C;AAC5C,2CAA2H;AAQ3H;;;GAGG;AAEI,IAAM,aAAa,GAAnB,MAAM,aAAa;IAKL;IAJF,QAAQ,CAAa;IAEtC,YAC8B,OAAoB,EAC/B,WAA+B;QAA/B,gBAAW,GAAX,WAAW,CAAoB;QAEhD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACnG,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,yBAAa,CAAC,EAAE,IAAI,KAAK,KAAK,yBAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IACpH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC;YACH,MAAM,IAAA,kBAAW,EAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,8BAAkB,CAAC,EAAE,mCAAuB,CAAC,CAAC;YACpF,OAAO,yBAAa,CAAC,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,yBAAa,CAAC,KAAK,CAAC;QAC7B,CAAC;IACH,CAAC;CACF,CAAA;AA/BY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,8BAAkB,CAAC,CAAA;6CACG,yCAAkB;GALvC,aAAa,CA+BzB"}