@techelusive/nest-auth 0.0.0-stage → 0.2.1

package/dist/features/passwordless/passwordless-auth.service.js

@@ -0,0 +1,304 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordlessAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const auth_error_1 = require("../../common/auth-error.js");
+const identifiers_1 = require("../../common/identifiers.js");
+const rate_limiter_service_1 = require("../../common/rate-limiter.service.js");
+const constants_1 = require("../../constants.js");
+const link_tokens_service_1 = require("../email-links/link-tokens.service.js");
+const notifications_service_1 = require("../notifications/notifications.service.js");
+const one_time_codes_service_1 = require("../one-time-codes/one-time-codes.service.js");
+const settings_service_1 = require("../settings/settings.service.js");
+const sign_in_service_1 = require("../sign-in/sign-in.service.js");
+const sign_up_rules_1 = require("../users/sign-up-rules.js");
+const users_service_1 = require("../users/users.service.js");
+/**
+ * Users who may receive a code or link: anyone except suspended and deleted accounts.
+ *
+ * @param user - An existing account.
+ * @returns True when a sign-in message may be sent to this user.
+ */
+const canReceiveSignInMessages = (user) => user.status !== constants_1.ACCOUNT_STATUS.suspended && user.status !== constants_1.ACCOUNT_STATUS.deleted;
+/**
+ * Sign in without a password:
+ * - Email OTP: a 6-digit code by email.
+ * - Magic link: a one-click link by email.
+ * - Phone OTP: a 6-digit code by SMS.
+ *
+ * The same endpoints also VERIFY the email / phone of an existing account, because receiving the
+ * code proves ownership. If the settings allow sign-up, an unknown email / phone gets a new account.
+ *
+ * "Send" endpoints always answer the same, so they never reveal who has an account.
+ */
+let PasswordlessAuthService = class PasswordlessAuthService {
+    settingsService;
+    users;
+    signIn;
+    oneTimeCodes;
+    linkTokens;
+    notifications;
+    rateLimiter;
+    constructor(settingsService, users, signIn, oneTimeCodes, linkTokens, notifications, rateLimiter) {
+        this.settingsService = settingsService;
+        this.users = users;
+        this.signIn = signIn;
+        this.oneTimeCodes = oneTimeCodes;
+        this.linkTokens = linkTokens;
+        this.notifications = notifications;
+        this.rateLimiter = rateLimiter;
+    }
+    // -------------------------------------------------------------------------------------------
+    // Email OTP
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Emails a 6-digit sign-in code. Always answers the same, whether or not the email has an account.
+     *
+     * @param typedEmail - The email from the request.
+     * @param request - Who is asking (for rate limits).
+     * @returns A generic success message.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when email codes are turned off.
+     * @throws AuthError TOO_MANY_REQUESTS (with `retryAfterSeconds`) when a code was sent to this email a moment ago.
+     * @throws AuthError TOO_MANY_REQUESTS after too many codes for this IP or email.
+     */
+    async sendEmailCode(typedEmail, request) {
+        const settings = await this.settingsService.getSettings();
+        if (!settings.emailOtp.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signInMethodDisabled);
+        const email = (0, identifiers_1.normalizeEmail)(typedEmail);
+        await this.consumeSendLimits(email, request);
+        if (await this.mayReceiveMessage(await this.users.findUserByEmail(email), settings.emailOtp.allowSignUp, email, settings)) {
+            const code = await this.oneTimeCodes.createCode(constants_1.CODE_CHANNEL.email, email, settings.emailOtp);
+            await this.notifications.sendRequiredEmail({ type: constants_1.EMAIL_TYPE.signInCode, to: email, code });
+        }
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.codeSent };
+    }
+    /**
+     * Signs in with an email code. This also verifies the email, and creates the account when the
+     * email is new and sign-up is allowed.
+     *
+     * @param typedEmail - The email the code was sent to.
+     * @param code - The code the user typed.
+     * @param signUpDetails - Names and consents, only needed when this creates a new account.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     * @throws AuthError OTP_EXPIRED or INVALID_OTP when the code is not usable or wrong.
+     * @throws AuthError SIGN_UP_CLOSED when the email is new and sign-up is not allowed.
+     */
+    async verifyEmailCode(typedEmail, code, signUpDetails, request) {
+        const settings = await this.settingsService.getSettings();
+        if (!settings.emailOtp.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signInMethodDisabled);
+        const email = (0, identifiers_1.normalizeEmail)(typedEmail);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.signInPerIp(request.ipAddress), constants_1.RATE_LIMITS.signInPerIp);
+        const existingUser = await this.users.findUserByEmail(email);
+        // Check sign-up details BEFORE using the code, so a missing name doesn't burn it.
+        if (!existingUser)
+            this.assertMaySignUp(settings.emailOtp.allowSignUp, signUpDetails, settings, email);
+        await this.oneTimeCodes.verifyCode(constants_1.CODE_CHANNEL.email, email, code);
+        if (existingUser)
+            await this.users.removeUnprovenPassword(existingUser, request);
+        const user = existingUser ?? (await this.createVerifiedUser({ email }, signUpDetails, settings, request));
+        const verifiedUser = await this.users.markEmailVerified(user, settings, request);
+        return this.signIn.completeSignIn(verifiedUser, constants_1.SIGN_IN_METHOD.emailOtp, request, settings);
+    }
+    // -------------------------------------------------------------------------------------------
+    // Magic link
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Emails a one-click sign-in link. Always answers the same, whether or not the email has an account.
+     *
+     * @param typedEmail - The email from the request.
+     * @param request - Who is asking (for rate limits).
+     * @returns A generic success message.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when magic links are turned off.
+     * @throws AuthError TOO_MANY_REQUESTS after too many emails for this IP or address.
+     */
+    async sendMagicLink(typedEmail, request) {
+        const settings = await this.settingsService.getSettings();
+        if (!settings.magicLink.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signInMethodDisabled);
+        const email = (0, identifiers_1.normalizeEmail)(typedEmail);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.sendEmailLinkPerIp(request.ipAddress), constants_1.RATE_LIMITS.sendEmailLinkPerIp);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.sendEmailLinkPerEmail(email), constants_1.RATE_LIMITS.sendEmailLinkPerEmail);
+        const user = await this.users.findUserByEmail(email);
+        if (await this.mayReceiveMessage(user, settings.magicLink.allowSignUp, email, settings)) {
+            const token = await this.linkTokens.createLinkToken(constants_1.LINK_PURPOSE.magicSignIn, email, user?.id ?? null);
+            await this.notifications.sendRequiredEmail({ type: constants_1.EMAIL_TYPE.magicSignIn, to: email, token });
+        }
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.magicLinkSent };
+    }
+    /**
+     * Signs in with the token from a magic link. This also verifies the email, and creates the account
+     * when the email is new and sign-up is allowed.
+     *
+     * @param token - The token from the link.
+     * @param signUpDetails - Names and consents, only needed when this creates a new account.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     * @throws AuthError INVALID_TOKEN when the link is unknown, used or expired.
+     * @throws AuthError SIGN_UP_CLOSED when the email is new and sign-up is not allowed.
+     */
+    async verifyMagicLink(token, signUpDetails, request) {
+        const settings = await this.settingsService.getSettings();
+        if (!settings.magicLink.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signInMethodDisabled);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.signInPerIp(request.ipAddress), constants_1.RATE_LIMITS.signInPerIp);
+        const usedToken = await this.linkTokens.useLinkToken(token, constants_1.LINK_PURPOSE.magicSignIn);
+        // Look up by email, not the id stored in the token, so a link sent before sign-up still works.
+        const existingUser = await this.users.findUserByEmail(usedToken.email);
+        if (!existingUser)
+            this.assertMaySignUp(settings.magicLink.allowSignUp, signUpDetails, settings, usedToken.email);
+        if (existingUser)
+            await this.users.removeUnprovenPassword(existingUser, request);
+        const user = existingUser ?? (await this.createVerifiedUser({ email: usedToken.email }, signUpDetails, settings, request));
+        const verifiedUser = await this.users.markEmailVerified(user, settings, request);
+        return this.signIn.completeSignIn(verifiedUser, constants_1.SIGN_IN_METHOD.magicLink, request, settings);
+    }
+    // -------------------------------------------------------------------------------------------
+    // Phone OTP
+    // -------------------------------------------------------------------------------------------
+    /**
+     * Sends a 6-digit sign-in code by SMS. Always answers the same, whether or not the number has an account.
+     *
+     * @param typedPhoneNumber - The phone number from the request, with country code.
+     * @param request - Who is asking (for rate limits).
+     * @returns A generic success message.
+     * @throws AuthError PHONE_COUNTRY_NOT_ALLOWED when the country code is not in the allowed list.
+     * @throws AuthError TOO_MANY_REQUESTS (with `retryAfterSeconds`) when a code was sent to this number a moment ago.
+     */
+    async sendPhoneCode(typedPhoneNumber, request) {
+        const settings = await this.getPhoneSettings();
+        const phoneNumber = (0, identifiers_1.normalizePhoneNumber)(typedPhoneNumber);
+        if (!(0, identifiers_1.isPhoneCountryAllowed)(phoneNumber, settings.phoneOtp.allowedCountryCodes))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.phoneCountryNotAllowed);
+        await this.consumeSendLimits(phoneNumber, request);
+        const user = await this.users.findUserByPhoneNumber(phoneNumber);
+        const mayReceive = user ? canReceiveSignInMessages(user) : settings.phoneOtp.allowSignUp && settings.registration.enabled;
+        if (mayReceive) {
+            const code = await this.oneTimeCodes.createCode(constants_1.CODE_CHANNEL.sms, phoneNumber, settings.phoneOtp);
+            await this.notifications.sendSmsCode(phoneNumber, code);
+        }
+        return { success: true, message: constants_1.SUCCESS_MESSAGES.codeSent };
+    }
+    /**
+     * Signs in with an SMS code. This also verifies the phone number, and creates the account when the
+     * number is new and sign-up is allowed.
+     *
+     * @param typedPhoneNumber - The number the code was sent to.
+     * @param code - The code the user typed.
+     * @param signUpDetails - Names and consents, only needed when this creates a new account.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     * @throws AuthError OTP_EXPIRED or INVALID_OTP when the code is not usable or wrong.
+     */
+    async verifyPhoneCode(typedPhoneNumber, code, signUpDetails, request) {
+        const settings = await this.getPhoneSettings();
+        const phoneNumber = (0, identifiers_1.normalizePhoneNumber)(typedPhoneNumber);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.signInPerIp(request.ipAddress), constants_1.RATE_LIMITS.signInPerIp);
+        const existingUser = await this.users.findUserByPhoneNumber(phoneNumber);
+        if (!existingUser)
+            this.assertMaySignUp(settings.phoneOtp.allowSignUp, signUpDetails, settings, null);
+        await this.oneTimeCodes.verifyCode(constants_1.CODE_CHANNEL.sms, phoneNumber, code);
+        const user = existingUser ?? (await this.createVerifiedUser({ phoneNumber }, signUpDetails, settings, request));
+        const verifiedUser = await this.users.markPhoneVerified(user, settings, request);
+        return this.signIn.completeSignIn(verifiedUser, constants_1.SIGN_IN_METHOD.phoneOtp, request, settings);
+    }
+    // -------------------------------------------------------------------------------------------
+    /**
+     * @returns The current settings.
+     * @throws AuthError SIGN_IN_METHOD_DISABLED when phone codes are turned off.
+     * @throws AuthError NOT_CONFIGURED when the app has no SMS sender.
+     */
+    async getPhoneSettings() {
+        const settings = await this.settingsService.getSettings();
+        if (!settings.phoneOtp.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signInMethodDisabled);
+        if (!this.notifications.canSendSms)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.notConfigured);
+        return settings;
+    }
+    /**
+     * Applies the "send a code" rate limits for both the IP and the destination.
+     *
+     * @param destination - The email or phone number the code goes to.
+     * @param request - Who is asking.
+     * @throws AuthError TOO_MANY_REQUESTS when either limit is reached.
+     */
+    async consumeSendLimits(destination, request) {
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.sendCodePerIp(request.ipAddress), constants_1.RATE_LIMITS.sendCodePerIp);
+        await this.rateLimiter.consume(constants_1.RATE_LIMIT_KEY.sendCodePerDestination(destination), constants_1.RATE_LIMITS.sendCodePerDestination);
+    }
+    /**
+     * Decides whether to actually send: existing users who may sign in, or new ones when sign-up is allowed.
+     *
+     * @param user - The existing account, or null.
+     * @param allowSignUp - Whether this sign-in method may create accounts.
+     * @param email - The normalized email.
+     * @param settings - The current settings.
+     * @returns True when the code or link should be sent.
+     */
+    async mayReceiveMessage(user, allowSignUp, email, settings) {
+        if (user)
+            return canReceiveSignInMessages(user);
+        return allowSignUp && settings.registration.enabled && (0, identifiers_1.isEmailDomainAllowed)(email, settings.registration.allowedEmailDomains);
+    }
+    /**
+     * Checks that a new account may be created with this method and these details.
+     *
+     * @param allowSignUp - Whether this sign-in method may create accounts.
+     * @param details - The names and consents from the request.
+     * @param settings - The current settings.
+     * @param email - The new account's email, or null for phone sign-up.
+     * @throws AuthError SIGN_UP_CLOSED, EMAIL_DOMAIN_NOT_ALLOWED, or an error for missing details.
+     */
+    assertMaySignUp(allowSignUp, details, settings, email) {
+        if (!allowSignUp || !settings.registration.enabled)
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.signUpClosed);
+        if (email && !(0, identifiers_1.isEmailDomainAllowed)(email, settings.registration.allowedEmailDomains))
+            throw new auth_error_1.AuthError(constants_1.AUTH_ERRORS.emailDomainNotAllowed);
+        (0, sign_up_rules_1.assertSignUpDetailsComplete)(details, settings);
+    }
+    /**
+     * Creates an account whose email or phone is already verified (the user just received the code).
+     *
+     * @param contact - The email or the phone number the code was sent to.
+     * @param details - The names and consents from the request.
+     * @param settings - The current settings.
+     * @param request - Who is asking (for the audit log).
+     * @returns The new user.
+     */
+    createVerifiedUser(contact, details, settings, request) {
+        return this.users.createUser({
+            email: contact.email ?? null,
+            isEmailVerified: contact.email !== undefined,
+            phoneNumber: contact.phoneNumber ?? null,
+            isPhoneVerified: contact.phoneNumber !== undefined,
+            firstName: details.firstName?.trim() || null,
+            lastName: details.lastName?.trim() || null,
+            acceptedTerms: details.acceptTerms === true,
+            acceptedPrivacyPolicy: details.acceptPrivacyPolicy === true,
+        }, settings, request);
+    }
+};
+exports.PasswordlessAuthService = PasswordlessAuthService;
+exports.PasswordlessAuthService = PasswordlessAuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [settings_service_1.SettingsService,
+        users_service_1.UsersService,
+        sign_in_service_1.SignInService,
+        one_time_codes_service_1.OneTimeCodesService,
+        link_tokens_service_1.LinkTokensService,
+        notifications_service_1.NotificationsService,
+        rate_limiter_service_1.RateLimiterService])
+], PasswordlessAuthService);
+//# sourceMappingURL=passwordless-auth.service.js.map

package/dist/features/passwordless/passwordless-auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordless-auth.service.js","sourceRoot":"","sources":["../../../src/features/passwordless/passwordless-auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,oDAAgD;AAChD,sDAAyH;AACzH,wEAAmE;AAEnE,2CAUqB;AAErB,oFAA+E;AAC/E,0FAAsF;AACtF,6FAAuF;AACvF,2EAAuE;AAEvE,wEAAmE;AAEnE,kEAA6E;AAC7E,kEAA8D;AAG9D;;;;;GAKG;AACH,MAAM,wBAAwB,GAAG,CAAC,IAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,0BAAc,CAAC,OAAO,CAAC;AAE1I;;;;;;;;;;GAUG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAEf;IACA;IACA;IACA;IACA;IACA;IACA;IAPnB,YACmB,eAAgC,EAChC,KAAmB,EACnB,MAAqB,EACrB,YAAiC,EACjC,UAA6B,EAC7B,aAAmC,EACnC,WAA+B;QAN/B,oBAAe,GAAf,eAAe,CAAiB;QAChC,UAAK,GAAL,KAAK,CAAc;QACnB,WAAM,GAAN,MAAM,CAAe;QACrB,iBAAY,GAAZ,YAAY,CAAqB;QACjC,eAAU,GAAV,UAAU,CAAmB;QAC7B,kBAAa,GAAb,aAAa,CAAsB;QACnC,gBAAW,GAAX,WAAW,CAAoB;IAC/C,CAAC;IAEJ,8FAA8F;IAC9F,YAAY;IACZ,8FAA8F;IAE9F;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,UAAmB,EAAE,OAAuB;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,IAAA,4BAAc,EAAC,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE7C,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,wBAAY,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9F,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,sBAAU,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,4BAAgB,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,eAAe,CAAC,UAAmB,EAAE,IAAa,EAAE,aAAiC,EAAE,OAAuB;QAClH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,IAAA,4BAAc,EAAC,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,WAAW,CAAC,CAAC;QAEvG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC7D,kFAAkF;QAClF,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,wBAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAEpE,IAAI,YAAY;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1G,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,0BAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9F,CAAC;IAED,8FAA8F;IAC9F,aAAa;IACb,8FAA8F;IAE9F;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,UAAmB,EAAE,OAAuB;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAA,4BAAc,EAAC,UAAU,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,kBAAkB,CAAC,CAAC;QACrH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,uBAAW,CAAC,qBAAqB,CAAC,CAAC;QAE/G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACxF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,wBAAY,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC;YACvG,MAAM,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,sBAAU,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,4BAAgB,CAAC,aAAa,EAAE,CAAC;IAC7E,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CAAC,KAAc,EAAE,aAAiC,EAAE,OAAuB;QAC9F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACvF,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,WAAW,CAAC,CAAC;QAEvG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,KAAK,EAAE,wBAAY,CAAC,WAAW,CAAC,CAAC;QACtF,+FAA+F;QAC/F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAElH,IAAI,YAAY;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3H,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,0BAAc,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/F,CAAC;IAED,8FAA8F;IAC9F,YAAY;IACZ,8FAA8F;IAE9F;;;;;;;;OAQG;IACH,KAAK,CAAC,aAAa,CAAC,gBAAyB,EAAE,OAAuB;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAA,kCAAoB,EAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAA,mCAAqB,EAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,sBAAsB,CAAC,CAAC;QACxI,MAAM,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC;QAC1H,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,wBAAY,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAa,EAAE,OAAO,EAAE,4BAAgB,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,eAAe,CAAC,gBAAyB,EAAE,IAAa,EAAE,aAAiC,EAAE,OAAuB;QACxH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,IAAA,kCAAoB,EAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,WAAW,CAAC,CAAC;QAEvG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,wBAAY,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAChH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,0BAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9F,CAAC;IAED,8FAA8F;IAE9F;;;;OAIG;IACK,KAAK,CAAC,gBAAgB;QAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,oBAAoB,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,aAAa,CAAC,CAAC;QACnF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,iBAAiB,CAAC,WAAmB,EAAE,OAAuB;QAC1E,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,uBAAW,CAAC,aAAa,CAAC,CAAC;QAC3G,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,0BAAc,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,uBAAW,CAAC,sBAAsB,CAAC,CAAC;IACzH,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAuB,EAAE,WAAoB,EAAE,KAAa,EAAE,QAAsB;QAClH,IAAI,IAAI;YAAE,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,WAAW,IAAI,QAAQ,CAAC,YAAY,CAAC,OAAO,IAAI,IAAA,kCAAoB,EAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAChI,CAAC;IAED;;;;;;;;OAQG;IACK,eAAe,CAAC,WAAoB,EAAE,OAA2B,EAAE,QAAsB,EAAE,KAAoB;QACrH,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,YAAY,CAAC,CAAC;QAClG,IAAI,KAAK,IAAI,CAAC,IAAA,kCAAoB,EAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC;YAAE,MAAM,IAAI,sBAAS,CAAC,uBAAW,CAAC,qBAAqB,CAAC,CAAC;QAC7I,IAAA,2CAA2B,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;OAQG;IACK,kBAAkB,CACxB,OAAiD,EACjD,OAA2B,EAC3B,QAAsB,EACtB,OAAuB;QAEvB,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAC1B;YACE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;YAC5B,eAAe,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS;YAC5C,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI;YACxC,eAAe,EAAE,OAAO,CAAC,WAAW,KAAK,SAAS;YAClD,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI;YAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI;YAC1C,aAAa,EAAE,OAAO,CAAC,WAAW,KAAK,IAAI;YAC3C,qBAAqB,EAAE,OAAO,CAAC,mBAAmB,KAAK,IAAI;SAC5D,EACD,QAAQ,EACR,OAAO,CACR,CAAC;IACJ,CAAC;CACF,CAAA;AApQY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGyB,kCAAe;QACzB,4BAAY;QACX,+BAAa;QACP,4CAAmB;QACrB,uCAAiB;QACd,4CAAoB;QACtB,yCAAkB;GARvC,uBAAuB,CAoQnC"}

package/dist/features/passwordless/passwordless.controller.d.ts

@@ -0,0 +1,75 @@
+import { RequestContext } from '../../common/request-context.js';
+import { EmailOnlyInput } from '../passwords/password.dto.js';
+import { PhoneNumberInput, VerifyEmailCodeInput, VerifyMagicLinkInput, VerifyPhoneCodeInput } from './passwordless.dto';
+import { PasswordlessAuthService } from './passwordless-auth.service';
+/**
+ * Sign in (or verify) without a password.
+ *
+ *   POST /auth/email/send-otp        email a 6-digit code
+ *   POST /auth/email/verify-otp      sign in with it (also verifies the email)
+ *   POST /auth/magic-link/send       email a sign-in link
+ *   POST /auth/magic-link/verify     sign in with the token from the link
+ *   POST /auth/phone/send-otp        SMS a 6-digit code
+ *   POST /auth/phone/verify-otp      sign in with it (also verifies the phone)
+ */
+export declare class PasswordlessController {
+    private readonly passwordless;
+    constructor(passwordless: PasswordlessAuthService);
+    /**
+     * POST /auth/email/send-otp — Emails a 6-digit code.
+     *
+     * @param body - `{ email }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    sendEmailCode(body: EmailOnlyInput, request: RequestContext): Promise<{
+        success: true;
+        message: "If this destination can receive codes, a code is on its way.";
+    }>;
+    /**
+     * POST /auth/email/verify-otp — Signs in with the email code (and verifies the email).
+     *
+     * @param body - `{ email, code }`, plus sign-up details for new accounts.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    verifyEmailCode(body: VerifyEmailCodeInput, request: RequestContext): Promise<import("../..").SignInResult>;
+    /**
+     * POST /auth/magic-link/send — Emails a sign-in link.
+     *
+     * @param body - `{ email }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    sendMagicLink(body: EmailOnlyInput, request: RequestContext): Promise<{
+        success: true;
+        message: "If this email can sign in, a sign-in link is on its way.";
+    }>;
+    /**
+     * POST /auth/magic-link/verify — Signs in with the token from the link.
+     *
+     * @param body - `{ token }`, plus sign-up details for new accounts.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    verifyMagicLink(body: VerifyMagicLinkInput, request: RequestContext): Promise<import("../..").SignInResult>;
+    /**
+     * POST /auth/phone/send-otp — Sends a 6-digit code by SMS.
+     *
+     * @param body - `{ phoneNumber }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    sendPhoneCode(body: PhoneNumberInput, request: RequestContext): Promise<{
+        success: true;
+        message: "If this destination can receive codes, a code is on its way.";
+    }>;
+    /**
+     * POST /auth/phone/verify-otp — Signs in with the SMS code (and verifies the phone).
+     *
+     * @param body - `{ phoneNumber, code }`, plus sign-up details for new accounts.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    verifyPhoneCode(body: VerifyPhoneCodeInput, request: RequestContext): Promise<import("../..").SignInResult>;
+}

package/dist/features/passwordless/passwordless.controller.js

@@ -0,0 +1,163 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordlessController = void 0;
+const common_1 = require("@nestjs/common");
+const strict_validation_pipe_1 = require("../../common/strict-validation.pipe.js");
+const request_context_1 = require("../../common/request-context.js");
+const auth_decorators_1 = require("../../guards/auth.decorators.js");
+const password_dto_1 = require("../passwords/password.dto.js");
+const passwordless_dto_1 = require("./passwordless.dto");
+const passwordless_auth_service_1 = require("./passwordless-auth.service");
+const constants_1 = require("../../constants.js");
+const refresh_token_cookie_1 = require("../../common/refresh-token-cookie.js");
+/**
+ * Sign in (or verify) without a password.
+ *
+ *   POST /auth/email/send-otp        email a 6-digit code
+ *   POST /auth/email/verify-otp      sign in with it (also verifies the email)
+ *   POST /auth/magic-link/send       email a sign-in link
+ *   POST /auth/magic-link/verify     sign in with the token from the link
+ *   POST /auth/phone/send-otp        SMS a 6-digit code
+ *   POST /auth/phone/verify-otp      sign in with it (also verifies the phone)
+ */
+let PasswordlessController = class PasswordlessController {
+    passwordless;
+    constructor(passwordless) {
+        this.passwordless = passwordless;
+    }
+    /**
+     * POST /auth/email/send-otp — Emails a 6-digit code.
+     *
+     * @param body - `{ email }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    sendEmailCode(body, request) {
+        return this.passwordless.sendEmailCode(body.email, request);
+    }
+    /**
+     * POST /auth/email/verify-otp — Signs in with the email code (and verifies the email).
+     *
+     * @param body - `{ email, code }`, plus sign-up details for new accounts.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    verifyEmailCode(body, request) {
+        return this.passwordless.verifyEmailCode(body.email, body.code, body, request);
+    }
+    /**
+     * POST /auth/magic-link/send — Emails a sign-in link.
+     *
+     * @param body - `{ email }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    sendMagicLink(body, request) {
+        return this.passwordless.sendMagicLink(body.email, request);
+    }
+    /**
+     * POST /auth/magic-link/verify — Signs in with the token from the link.
+     *
+     * @param body - `{ token }`, plus sign-up details for new accounts.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    verifyMagicLink(body, request) {
+        return this.passwordless.verifyMagicLink(body.token, body, request);
+    }
+    /**
+     * POST /auth/phone/send-otp — Sends a 6-digit code by SMS.
+     *
+     * @param body - `{ phoneNumber }`.
+     * @param request - Who is asking.
+     * @returns A generic success message.
+     */
+    sendPhoneCode(body, request) {
+        return this.passwordless.sendPhoneCode(body.phoneNumber, request);
+    }
+    /**
+     * POST /auth/phone/verify-otp — Signs in with the SMS code (and verifies the phone).
+     *
+     * @param body - `{ phoneNumber, code }`, plus sign-up details for new accounts.
+     * @param request - Who is asking.
+     * @returns Tokens, or a 2FA challenge.
+     */
+    verifyPhoneCode(body, request) {
+        return this.passwordless.verifyPhoneCode(body.phoneNumber, body.code, body, request);
+    }
+};
+exports.PasswordlessController = PasswordlessController;
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.emailSendOtp),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_dto_1.EmailOnlyInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordlessController.prototype, "sendEmailCode", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.emailVerifyOtp),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [passwordless_dto_1.VerifyEmailCodeInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordlessController.prototype, "verifyEmailCode", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.magicLinkSend),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_dto_1.EmailOnlyInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordlessController.prototype, "sendMagicLink", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.magicLinkVerify),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [passwordless_dto_1.VerifyMagicLinkInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordlessController.prototype, "verifyMagicLink", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.phoneSendOtp),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [passwordless_dto_1.PhoneNumberInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordlessController.prototype, "sendPhoneCode", null);
+__decorate([
+    (0, common_1.Post)(constants_1.ROUTES.auth.phoneVerifyOtp),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, request_context_1.CurrentRequest)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [passwordless_dto_1.VerifyPhoneCodeInput, Object]),
+    __metadata("design:returntype", void 0)
+], PasswordlessController.prototype, "verifyPhoneCode", null);
+exports.PasswordlessController = PasswordlessController = __decorate([
+    (0, common_1.Controller)(constants_1.ROUTES.auth.prefix),
+    (0, refresh_token_cookie_1.LibraryController)(),
+    (0, auth_decorators_1.Public)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.strictValidationPipe),
+    __metadata("design:paramtypes", [passwordless_auth_service_1.PasswordlessAuthService])
+], PasswordlessController);
+//# sourceMappingURL=passwordless.controller.js.map

package/dist/features/passwordless/passwordless.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwordless.controller.js","sourceRoot":"","sources":["../../../src/features/passwordless/passwordless.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwF;AACxF,4EAAuE;AACvE,8DAA0E;AAC1E,8DAAkD;AAClD,oEAAmE;AACnE,yDAAwH;AACxH,2EAAsE;AACtE,2CAAqC;AACrC,wEAAkE;AAElE;;;;;;;;;GASG;AAKI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACJ;IAA7B,YAA6B,YAAqC;QAArC,iBAAY,GAAZ,YAAY,CAAyB;IAAG,CAAC;IAEtE;;;;;;OAMG;IAGH,aAAa,CAAS,IAAoB,EAAoB,OAAuB;QACnF,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IAGH,eAAe,CAAS,IAA0B,EAAoB,OAAuB;QAC3F,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACjF,CAAC;IAED;;;;;;OAMG;IAGH,aAAa,CAAS,IAAoB,EAAoB,OAAuB;QACnF,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IAGH,eAAe,CAAS,IAA0B,EAAoB,OAAuB;QAC3F,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;OAMG;IAGH,aAAa,CAAS,IAAsB,EAAoB,OAAuB;QACrF,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IAGH,eAAe,CAAS,IAA0B,EAAoB,OAAuB;QAC3F,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC;CACF,CAAA;AAhFY,wDAAsB;AAYjC;IAFC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwB,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAjC,6BAAc;;2DAEzC;AAWD;IAFC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,cAAc,CAAC;IAChC,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACP,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAvC,uCAAoB;;6DAEjD;AAWD;IAFC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,aAAa,CAAC;IAC/B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwB,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAjC,6BAAc;;2DAEzC;AAWD;IAFC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,eAAe,CAAC;IACjC,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACP,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAvC,uCAAoB;;6DAEjD;AAWD;IAFC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACT,WAAA,IAAA,aAAI,GAAE,CAAA;IAA0B,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAnC,mCAAgB;;2DAE3C;AAWD;IAFC,IAAA,aAAI,EAAC,kBAAM,CAAC,IAAI,CAAC,cAAc,CAAC;IAChC,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACP,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,gCAAc,GAAE,CAAA;;qCAAvC,uCAAoB;;6DAEjD;iCA/EU,sBAAsB;IAJlC,IAAA,mBAAU,EAAC,kBAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IAC9B,IAAA,wCAAiB,GAAE;IACnB,IAAA,wBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAEc,mDAAuB;GADvD,sBAAsB,CAgFlC"}

package/dist/features/passwordless/passwordless.dto.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Optional details for someone signing up with a code, link or social account. Only used when
+ * the sign-in creates a NEW account; ignored for existing users. If your settings require names
+ * or consent and they are missing, the response is VALIDATION_ERROR with `missingSignUpDetails`.
+ */
+export declare class SignUpDetailsInput {
+    firstName?: string;
+    lastName?: string;
+    acceptTerms?: boolean;
+    acceptPrivacyPolicy?: boolean;
+}
+/** POST /auth/email/verify-otp */
+export declare class VerifyEmailCodeInput extends SignUpDetailsInput {
+    email: string;
+    code: string;
+}
+/** POST /auth/phone/send-otp */
+export declare class PhoneNumberInput {
+    phoneNumber: string;
+}
+/** POST /auth/phone/verify-otp */
+export declare class VerifyPhoneCodeInput extends SignUpDetailsInput {
+    phoneNumber: string;
+    code: string;
+}
+/** POST /auth/magic-link/verify */
+export declare class VerifyMagicLinkInput extends SignUpDetailsInput {
+    token: string;
+}