@techelusive/nest-auth 0.0.0-stage → 0.2.1

package/dist/auth-options.d.ts

@@ -0,0 +1,156 @@
+import type { DataSource } from 'typeorm';
+import type { AuthEventName, CookieSameSite, EMAIL_TYPE } from './constants';
+import type { SettingsChanges } from './features/settings/settings.types';
+import type { JsonObject } from './database/entities/json-object';
+/**
+ * Everything AuthModule needs from your app.
+ *
+ * Secrets (API keys, app secrets) belong here, loaded from environment variables.
+ * Behaviour (which sign-in methods are on, lifetimes, roles) belongs in `settings`,
+ * which admins can also change at runtime.
+ */
+export interface AuthOptions {
+    /** Your app's TypeORM DataSource. Add AUTH_ENTITIES and AUTH_MIGRATIONS to it. */
+    dataSource: DataSource;
+    /** Your API's public URL, e.g. https://api.myapp.com. Every token carries it as "iss" and "aud". */
+    issuer: string;
+    /** Protects the private signing key and other secrets stored in the database. */
+    encryption: EncryptionOptions;
+    /** Sends the emails the library needs (you write the email; we give you the token or code). */
+    emailSender: EmailSender;
+    /** Sends SMS codes. Required only when phone sign-in is turned on. */
+    smsSender?: SmsSender;
+    /** Facebook app secret, needed to verify Facebook sign-ins. Google and Apple need no secret. */
+    facebookAppSecret?: string;
+    /** Passkeys: your website's domain and origins. Required only when passkeys are turned on. */
+    passkeys?: PasskeyOptions;
+    /** Name shown in authenticator apps next to the 2FA code, e.g. "MyApp". */
+    appName?: string;
+    /** Your defaults for behaviour. Admins can change them later with PATCH /auth/admin/settings. */
+    settings?: SettingsChanges;
+    /**
+     * Redis connection URL, so every server shares the same rate-limit counters. Required in
+     * production unless `singleServer` is true: without it, each server counts on its own and an
+     * attacker gets one full set of attempts per server.
+     */
+    redisUrl?: string;
+    /**
+     * Set to true only when production runs exactly one server process, to run without Redis
+     * (counters then live in that process's memory and reset on restart).
+     */
+    singleServer?: boolean;
+    /**
+     * For web apps: put the refresh token in an HttpOnly cookie instead of the JSON response, so
+     * scripts on the page (including injected ones) can never read it. Applies only to requests
+     * from `allowedOrigins`; mobile apps and servers on the same API still get it in the body.
+     */
+    refreshTokenCookie?: RefreshTokenCookieOptions;
+    /** Called for every auth event (also sent to webhooks). Handy to create a profile row on "user.created". */
+    onEvent?: (event: AuthEvent) => void | Promise<void>;
+}
+export interface RefreshTokenCookieOptions {
+    /**
+     * Exact origins of your web app, e.g. ["https://app.myapp.com"]. A refresh that uses the cookie
+     * must come from one of these (checked with the Origin header), which blocks cross-site requests.
+     */
+    allowedOrigins: string[];
+    /** Default "__Host-refresh_token" (the browser then enforces Secure, path "/" and no domain). */
+    name?: string;
+    /** Share the cookie with subdomains, e.g. "myapp.com". Not allowed with a "__Host-" name. */
+    domain?: string;
+    /** Default "/". */
+    path?: string;
+    /** Default "Strict". Use "Lax" if your app and API are on different sites; "None" only if you must. */
+    sameSite?: CookieSameSite;
+}
+export type EncryptionOptions = 
+/**
+ * Production: an AWS KMS symmetric key. The server needs kms:Encrypt and kms:Decrypt on it.
+ * `legacyLocalKey`: set it to your old development localKey while moving an existing database to
+ * KMS. Values encrypted earlier still decrypt; everything new is encrypted with KMS.
+ */
+{
+    awsKmsKeyId: string;
+    awsRegion: string;
+    legacyLocalKey?: string;
+}
+/** Development only: 32 random bytes in base64. Refused when NODE_ENV=production. */
+ | {
+    localKey: string;
+};
+/** One message the library asks you to send. Use `type` to pick your template. */
+export type AuthEmail = {
+    type: typeof EMAIL_TYPE.verifyEmail;
+    to: string;
+    token: string;
+} | {
+    type: typeof EMAIL_TYPE.resetPassword;
+    to: string;
+    token: string;
+} | {
+    type: typeof EMAIL_TYPE.magicSignIn;
+    to: string;
+    token: string;
+} | {
+    type: typeof EMAIL_TYPE.signInCode;
+    to: string;
+    code: string;
+} | {
+    type: typeof EMAIL_TYPE.organizationInvitation;
+    to: string;
+    token: string;
+    organizationName: string;
+    invitedByName: string | null;
+} | {
+    type: typeof EMAIL_TYPE.passwordChanged;
+    to: string;
+} | {
+    type: typeof EMAIL_TYPE.newSignIn;
+    to: string;
+    ipAddress: string | null;
+    userAgent: string | null;
+}
+/** Sent to the NEW address; the link confirms the change (POST /auth/email/change/confirm). */
+ | {
+    type: typeof EMAIL_TYPE.confirmEmailChange;
+    to: string;
+    token: string;
+}
+/** Sent to the OLD address once the change is done. `newEmail` is masked, e.g. "r***@mail.com". */
+ | {
+    type: typeof EMAIL_TYPE.emailChanged;
+    to: string;
+    newEmail: string;
+};
+export interface EmailSender {
+    send(email: AuthEmail): Promise<void>;
+}
+export interface SmsSender {
+    /** Send `code` to `phoneNumber` (E.164, e.g. +919876543210). */
+    sendCode(phoneNumber: string, code: string): Promise<void>;
+}
+export interface PasskeyOptions {
+    /** Your domain without protocol, e.g. "myapp.com". Passkeys only work on this domain and its subdomains. */
+    relyingPartyId: string;
+    /** Name shown in the passkey prompt, e.g. "MyApp". */
+    relyingPartyName: string;
+    /** Exact origins allowed, e.g. ["https://myapp.com", "android:apk-key-hash:..."]. */
+    allowedOrigins: string[];
+}
+/** What onEvent and webhooks receive. */
+export interface AuthEvent {
+    name: AuthEventName;
+    /** The user the event is about, when there is one. */
+    userId: string | null;
+    /** Event details. Never contains passwords, tokens or codes. */
+    data: JsonObject;
+    occurredAt: string;
+}
+/** Shape of AuthModule.forRoot({ ... }). */
+export interface AuthModuleConfig {
+    imports?: any[];
+    inject?: any[];
+    useFactory: (...dependencies: any[]) => AuthOptions | Promise<AuthOptions>;
+    /** Protect every route in the app by default (open routes with @Public()). Default: true. */
+    protectAllRoutes?: boolean;
+}

package/dist/auth-options.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=auth-options.js.map

package/dist/auth-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-options.js","sourceRoot":"","sources":["../src/auth-options.ts"],"names":[],"mappings":""}

package/dist/auth-options.validation.d.ts

@@ -0,0 +1,9 @@
+import { AuthOptions } from './auth-options';
+/**
+ * Checks AuthOptions when the app starts, so a mistake stops the app with a clear message
+ * instead of failing later on a user's request.
+ *
+ * @param options - What your `useFactory` returned.
+ * @throws Error listing every problem found (missing data source, bad encryption key, etc.).
+ */
+export declare function assertValidAuthOptions(options: AuthOptions): void;

package/dist/auth-options.validation.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertValidAuthOptions = assertValidAuthOptions;
+const constants_1 = require("./constants");
+/**
+ * Checks AuthOptions when the app starts, so a mistake stops the app with a clear message
+ * instead of failing later on a user's request.
+ *
+ * @param options - What your `useFactory` returned.
+ * @throws Error listing every problem found (missing data source, bad encryption key, etc.).
+ */
+function assertValidAuthOptions(options) {
+    const problems = [];
+    const isProduction = process.env.NODE_ENV === constants_1.PRODUCTION_ENVIRONMENT;
+    if (!options || typeof options !== 'object')
+        throw new Error('AuthModule: useFactory must return the AuthOptions object');
+    if (!options.dataSource)
+        problems.push(constants_1.OPTIONS_PROBLEM.dataSourceRequired);
+    if (!options.emailSender || typeof options.emailSender.send !== 'function')
+        problems.push(constants_1.OPTIONS_PROBLEM.emailSenderRequired);
+    try {
+        const issuerUrl = new URL(options.issuer);
+        if (isProduction && issuerUrl.protocol !== constants_1.URL_PROTOCOL.https)
+            problems.push(constants_1.OPTIONS_PROBLEM.issuerMustBeHttps);
+    }
+    catch {
+        problems.push(constants_1.OPTIONS_PROBLEM.issuerMustBeUrl);
+    }
+    const encryption = options.encryption;
+    if (!encryption) {
+        problems.push(constants_1.OPTIONS_PROBLEM.encryptionRequired);
+    }
+    else if ('localKey' in encryption) {
+        if (isProduction)
+            problems.push(constants_1.OPTIONS_PROBLEM.localKeyNotForProduction);
+        const keyBytes = typeof encryption.localKey === 'string' ? Buffer.from(encryption.localKey, constants_1.TEXT_ENCODING.base64) : Buffer.alloc(0);
+        if (keyBytes.length !== constants_1.LOCAL_ENCRYPTION_KEY_BYTES) {
+            problems.push(constants_1.OPTIONS_PROBLEM.localKeyWrongSize);
+        }
+    }
+    else {
+        if (!encryption.awsKmsKeyId || !encryption.awsRegion)
+            problems.push(constants_1.OPTIONS_PROBLEM.kmsDetailsRequired);
+        const legacyKey = encryption.legacyLocalKey;
+        if (legacyKey !== undefined && (typeof legacyKey !== 'string' || Buffer.from(legacyKey, constants_1.TEXT_ENCODING.base64).length !== constants_1.LOCAL_ENCRYPTION_KEY_BYTES)) {
+            problems.push(constants_1.OPTIONS_PROBLEM.legacyLocalKeyWrongSize);
+        }
+    }
+    if (isProduction && !options.redisUrl && options.singleServer !== true)
+        problems.push(constants_1.OPTIONS_PROBLEM.redisRequiredInProduction);
+    if (options.passkeys) {
+        const { relyingPartyId, relyingPartyName, allowedOrigins } = options.passkeys;
+        if (!relyingPartyId || constants_1.RELYING_PARTY_ID_FORBIDDEN_CHARACTERS.some((character) => relyingPartyId.includes(character))) {
+            problems.push(constants_1.OPTIONS_PROBLEM.relyingPartyIdMustBeDomain);
+        }
+        if (!relyingPartyName)
+            problems.push(constants_1.OPTIONS_PROBLEM.relyingPartyNameRequired);
+        if (!Array.isArray(allowedOrigins) || allowedOrigins.length === 0)
+            problems.push(constants_1.OPTIONS_PROBLEM.allowedOriginsRequired);
+    }
+    if (options.refreshTokenCookie) {
+        const cookie = options.refreshTokenCookie;
+        if (!Array.isArray(cookie.allowedOrigins) || cookie.allowedOrigins.length === 0)
+            problems.push(constants_1.OPTIONS_PROBLEM.cookieAllowedOriginsRequired);
+        const name = cookie.name ?? constants_1.REFRESH_TOKEN_COOKIE_DEFAULTS.name;
+        const path = cookie.path ?? constants_1.REFRESH_TOKEN_COOKIE_DEFAULTS.path;
+        if (name.startsWith(constants_1.HOST_COOKIE_PREFIX) && (cookie.domain !== undefined || path !== constants_1.REFRESH_TOKEN_COOKIE_DEFAULTS.path)) {
+            problems.push(constants_1.OPTIONS_PROBLEM.hostCookieRules);
+        }
+    }
+    if (problems.length > 0)
+        throw new Error(`AuthModule options are invalid:\n  - ${problems.join('\n  - ')}`);
+}
+//# sourceMappingURL=auth-options.validation.js.map

package/dist/auth-options.validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-options.validation.js","sourceRoot":"","sources":["../src/auth-options.validation.ts"],"names":[],"mappings":";;AAmBA,wDAsDC;AAxED,2CASqB;AAErB;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,OAAoB;IACzD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,kCAAsB,CAAC;IAErE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC1H,IAAI,CAAC,OAAO,CAAC,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,kBAAkB,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,mBAAmB,CAAC,CAAC;IAE/H,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,YAAY,IAAI,SAAS,CAAC,QAAQ,KAAK,wBAAY,CAAC,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,iBAAiB,CAAC,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,eAAe,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAiD,CAAC;IAC7E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,kBAAkB,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,YAAY;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,wBAAwB,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,yBAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpI,IAAI,QAAQ,CAAC,MAAM,KAAK,sCAA0B,EAAE,CAAC;YACnD,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,kBAAkB,CAAC,CAAC;QACxG,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAa,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,sCAA0B,CAAC,EAAE,CAAC;YACrJ,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,uBAAuB,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,yBAAyB,CAAC,CAAC;IAEjI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,EAAE,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9E,IAAI,CAAC,cAAc,IAAI,iDAAqC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrH,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,gBAAgB;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,wBAAwB,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,sBAAsB,CAAC,CAAC;IAC3H,CAAC;IAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,4BAA4B,CAAC,CAAC;QAC7I,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,yCAA6B,CAAC,IAAI,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,yCAA6B,CAAC,IAAI,CAAC;QAC/D,IAAI,IAAI,CAAC,UAAU,CAAC,8BAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,yCAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;YACxH,QAAQ,CAAC,IAAI,CAAC,2BAAe,CAAC,eAAe,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC"}

package/dist/auth.module.d.ts

@@ -0,0 +1,38 @@
+import { DynamicModule } from '@nestjs/common';
+import { AuthModuleConfig } from './auth-options';
+/**
+ * Add authentication to a NestJS app:
+ *
+ *   @Module({
+ *     imports: [
+ *       AuthModule.forRoot({
+ *         inject: [DataSource, ConfigService],
+ *         useFactory: (dataSource: DataSource, config: ConfigService) => ({
+ *           dataSource,
+ *           issuer: 'https://api.myapp.com',
+ *           encryption: { awsKmsKeyId: config.getOrThrow('KMS_KEY_ID'), awsRegion: 'ap-south-1' },
+ *           emailSender: myEmailSender,
+ *           settings: { emailOtp: { enabled: true } },
+ *         }),
+ *       }),
+ *     ],
+ *   })
+ *
+ * What you get:
+ * - every /auth/* endpoint (see each controller for the list),
+ * - every route in your app protected by default (open one with @Public()),
+ * - errors in the { success: false, code, message } format,
+ * - the background worker that delivers webhooks.
+ */
+export declare class AuthModule {
+    /**
+     * Registers the library in your app.
+     *
+     * @param config - `useFactory` returns the AuthOptions (data source, issuer, encryption, senders,
+     *   settings); `inject` and `imports` work as in any Nest async module. Set
+     *   `protectAllRoutes: false` to opt routes in with @UseGuards(AuthGuard) instead.
+     * @returns The configured, global module.
+     * @throws At start-up, when the options are invalid (every problem is listed).
+     */
+    static forRoot(config: AuthModuleConfig): DynamicModule;
+}

package/dist/auth.module.js

@@ -0,0 +1,173 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AuthModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const auth_options_validation_1 = require("./auth-options.validation");
+const auth_exception_filter_1 = require("./common/auth-exception.filter");
+const encryption_service_1 = require("./common/encryption.service");
+const rate_limiter_service_1 = require("./common/rate-limiter.service");
+const refresh_token_cookie_1 = require("./common/refresh-token-cookie");
+const data_export_service_1 = require("./features/account/data-export.service");
+const health_service_1 = require("./features/account/health.service");
+const email_change_controller_1 = require("./features/email-change/email-change.controller");
+const email_change_service_1 = require("./features/email-change/email-change.service");
+const constants_1 = require("./constants");
+const account_controller_1 = require("./features/account/account.controller");
+const admin_controller_1 = require("./features/admin/admin.controller");
+const admin_service_1 = require("./features/admin/admin.service");
+const api_keys_service_1 = require("./features/api-keys/api-keys.service");
+const email_verification_service_1 = require("./features/email-links/email-verification.service");
+const link_tokens_service_1 = require("./features/email-links/link-tokens.service");
+const data_retention_service_1 = require("./features/maintenance/data-retention.service");
+const auth_events_service_1 = require("./features/events/auth-events.service");
+const notifications_service_1 = require("./features/notifications/notifications.service");
+const one_time_codes_service_1 = require("./features/one-time-codes/one-time-codes.service");
+const organizations_controller_1 = require("./features/organizations/organizations.controller");
+const organizations_service_1 = require("./features/organizations/organizations.service");
+const passkeys_controller_1 = require("./features/passkeys/passkeys.controller");
+const passkeys_service_1 = require("./features/passkeys/passkeys.service");
+const passwordless_controller_1 = require("./features/passwordless/passwordless.controller");
+const passwordless_auth_service_1 = require("./features/passwordless/passwordless-auth.service");
+const password_auth_service_1 = require("./features/passwords/password-auth.service");
+const password_controller_1 = require("./features/passwords/password.controller");
+const password_policy_service_1 = require("./features/passwords/password-policy.service");
+const session_service_1 = require("./features/sessions/session.service");
+const settings_service_1 = require("./features/settings/settings.service");
+const sign_in_challenges_service_1 = require("./features/sign-in/sign-in-challenges.service");
+const sign_in_service_1 = require("./features/sign-in/sign-in.service");
+const jwks_controller_1 = require("./features/signing-keys/jwks.controller");
+const signing_keys_service_1 = require("./features/signing-keys/signing-keys.service");
+const social_auth_service_1 = require("./features/social/social-auth.service");
+const social_controller_1 = require("./features/social/social.controller");
+const social_providers_service_1 = require("./features/social/social-providers.service");
+const two_factor_controller_1 = require("./features/two-factor/two-factor.controller");
+const two_factor_service_1 = require("./features/two-factor/two-factor.service");
+const sign_in_methods_service_1 = require("./features/users/sign-in-methods.service");
+const users_service_1 = require("./features/users/users.service");
+const webhook_delivery_worker_1 = require("./features/webhooks/webhook-delivery.worker");
+const webhooks_service_1 = require("./features/webhooks/webhooks.service");
+const auth_guard_1 = require("./guards/auth.guard");
+/** Services your app may inject (e.g. UsersService in a profile module, OrganizationsService in a billing module). */
+const PUBLIC_SERVICES = [
+    settings_service_1.SettingsService,
+    users_service_1.UsersService,
+    session_service_1.SessionService,
+    sign_in_service_1.SignInService,
+    auth_events_service_1.AuthEventsService,
+    api_keys_service_1.ApiKeysService,
+    organizations_service_1.OrganizationsService,
+    two_factor_service_1.TwoFactorService,
+    signing_keys_service_1.SigningKeysService,
+    webhooks_service_1.WebhooksService,
+    data_retention_service_1.DataRetentionService,
+    auth_guard_1.AuthGuard,
+];
+const INTERNAL_SERVICES = [
+    encryption_service_1.EncryptionService,
+    rate_limiter_service_1.RateLimiterService,
+    notifications_service_1.NotificationsService,
+    link_tokens_service_1.LinkTokensService,
+    one_time_codes_service_1.OneTimeCodesService,
+    sign_in_challenges_service_1.SignInChallengesService,
+    sign_in_methods_service_1.SignInMethodsService,
+    password_policy_service_1.PasswordPolicyService,
+    password_auth_service_1.PasswordAuthService,
+    email_verification_service_1.EmailVerificationService,
+    passwordless_auth_service_1.PasswordlessAuthService,
+    social_providers_service_1.SocialProvidersService,
+    social_auth_service_1.SocialAuthService,
+    passkeys_service_1.PasskeysService,
+    admin_service_1.AdminService,
+    webhook_delivery_worker_1.WebhookDeliveryWorker,
+    email_change_service_1.EmailChangeService,
+    data_export_service_1.DataExportService,
+    health_service_1.HealthService,
+];
+const CONTROLLERS = [
+    password_controller_1.PasswordController,
+    passwordless_controller_1.PasswordlessController,
+    account_controller_1.AccountController,
+    email_change_controller_1.EmailChangeController,
+    social_controller_1.SocialController,
+    passkeys_controller_1.PasskeysController,
+    two_factor_controller_1.TwoFactorController,
+    organizations_controller_1.OrganizationsController,
+    admin_controller_1.AdminController,
+    jwks_controller_1.JwksController,
+];
+/**
+ * Add authentication to a NestJS app:
+ *
+ *   @Module({
+ *     imports: [
+ *       AuthModule.forRoot({
+ *         inject: [DataSource, ConfigService],
+ *         useFactory: (dataSource: DataSource, config: ConfigService) => ({
+ *           dataSource,
+ *           issuer: 'https://api.myapp.com',
+ *           encryption: { awsKmsKeyId: config.getOrThrow('KMS_KEY_ID'), awsRegion: 'ap-south-1' },
+ *           emailSender: myEmailSender,
+ *           settings: { emailOtp: { enabled: true } },
+ *         }),
+ *       }),
+ *     ],
+ *   })
+ *
+ * What you get:
+ * - every /auth/* endpoint (see each controller for the list),
+ * - every route in your app protected by default (open one with @Public()),
+ * - errors in the { success: false, code, message } format,
+ * - the background worker that delivers webhooks.
+ */
+let AuthModule = AuthModule_1 = class AuthModule {
+    /**
+     * Registers the library in your app.
+     *
+     * @param config - `useFactory` returns the AuthOptions (data source, issuer, encryption, senders,
+     *   settings); `inject` and `imports` work as in any Nest async module. Set
+     *   `protectAllRoutes: false` to opt routes in with @UseGuards(AuthGuard) instead.
+     * @returns The configured, global module.
+     * @throws At start-up, when the options are invalid (every problem is listed).
+     */
+    static forRoot(config) {
+        const optionsProvider = {
+            provide: constants_1.AUTH_OPTIONS_TOKEN,
+            inject: config.inject ?? [],
+            useFactory: async (...dependencies) => {
+                const options = await config.useFactory(...dependencies);
+                (0, auth_options_validation_1.assertValidAuthOptions)(options);
+                return options;
+            },
+        };
+        const appWideProviders = [
+            { provide: core_1.APP_FILTER, useClass: auth_exception_filter_1.AuthExceptionFilter },
+            // Inert unless refreshTokenCookie is set, and only ever acts on the library's own routes.
+            { provide: core_1.APP_INTERCEPTOR, useClass: refresh_token_cookie_1.RefreshTokenCookieInterceptor },
+        ];
+        // Protect every route by default; apps that prefer opt-in use @UseGuards(AuthGuard) themselves.
+        if (config.protectAllRoutes !== false)
+            appWideProviders.push({ provide: core_1.APP_GUARD, useExisting: auth_guard_1.AuthGuard });
+        return {
+            module: AuthModule_1,
+            global: true,
+            imports: config.imports ?? [],
+            controllers: CONTROLLERS,
+            providers: [optionsProvider, ...PUBLIC_SERVICES, ...INTERNAL_SERVICES, ...appWideProviders],
+            exports: [constants_1.AUTH_OPTIONS_TOKEN, ...PUBLIC_SERVICES],
+        };
+    }
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = AuthModule_1 = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], AuthModule);
+//# sourceMappingURL=auth.module.js.map

package/dist/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../src/auth.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAyE;AACzE,uCAAsE;AAEtE,uEAAmE;AACnE,0EAAqE;AACrE,oEAAgE;AAChE,wEAAmE;AACnE,wEAA8E;AAC9E,gFAA2E;AAC3E,sEAAkE;AAClE,6FAAwF;AACxF,uFAAkF;AAClF,2CAAiD;AACjD,8EAA0E;AAC1E,wEAAoE;AACpE,kEAA8D;AAC9D,2EAAsE;AACtE,kGAA6F;AAC7F,oFAA+E;AAC/E,0FAAqF;AACrF,+EAA0E;AAC1E,0FAAsF;AACtF,6FAAuF;AACvF,gGAA4F;AAC5F,0FAAsF;AACtF,iFAA6E;AAC7E,2EAAuE;AACvE,6FAAyF;AACzF,iGAA4F;AAC5F,sFAAiF;AACjF,kFAA8E;AAC9E,0FAAqF;AACrF,yEAAqE;AACrE,2EAAuE;AACvE,8FAAwF;AACxF,wEAAmE;AACnE,6EAAyE;AACzE,uFAAkF;AAClF,+EAA0E;AAC1E,2EAAuE;AACvE,yFAAoF;AACpF,uFAAkF;AAClF,iFAA4E;AAC5E,sFAAgF;AAChF,kEAA8D;AAC9D,yFAAoF;AACpF,2EAAuE;AACvE,oDAAgD;AAEhD,sHAAsH;AACtH,MAAM,eAAe,GAAG;IACtB,kCAAe;IACf,4BAAY;IACZ,gCAAc;IACd,+BAAa;IACb,uCAAiB;IACjB,iCAAc;IACd,4CAAoB;IACpB,qCAAgB;IAChB,yCAAkB;IAClB,kCAAe;IACf,6CAAoB;IACpB,sBAAS;CACV,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACxB,sCAAiB;IACjB,yCAAkB;IAClB,4CAAoB;IACpB,uCAAiB;IACjB,4CAAmB;IACnB,oDAAuB;IACvB,8CAAoB;IACpB,+CAAqB;IACrB,2CAAmB;IACnB,qDAAwB;IACxB,mDAAuB;IACvB,iDAAsB;IACtB,uCAAiB;IACjB,kCAAe;IACf,4BAAY;IACZ,+CAAqB;IACrB,yCAAkB;IAClB,uCAAiB;IACjB,8BAAa;CACd,CAAC;AAEF,MAAM,WAAW,GAAG;IAClB,wCAAkB;IAClB,gDAAsB;IACtB,sCAAiB;IACjB,+CAAqB;IACrB,oCAAgB;IAChB,wCAAkB;IAClB,2CAAmB;IACnB,kDAAuB;IACvB,kCAAe;IACf,gCAAc;CACf,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGI,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CAAC,MAAwB;QACrC,MAAM,eAAe,GAAa;YAChC,OAAO,EAAE,8BAAkB;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC3B,UAAU,EAAE,KAAK,EAAE,GAAG,YAAuB,EAAwB,EAAE;gBACrE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,CAAC;gBACzD,IAAA,gDAAsB,EAAC,OAAO,CAAC,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC;SACF,CAAC;QAEF,MAAM,gBAAgB,GAAe;YACnC,EAAE,OAAO,EAAE,iBAAU,EAAE,QAAQ,EAAE,2CAAmB,EAAE;YACtD,0FAA0F;YAC1F,EAAE,OAAO,EAAE,sBAAe,EAAE,QAAQ,EAAE,oDAA6B,EAAE;SACtE,CAAC;QACF,gGAAgG;QAChG,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK;YAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAS,EAAE,WAAW,EAAE,sBAAS,EAAE,CAAC,CAAC;QAE7G,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;YAC7B,WAAW,EAAE,WAAW;YACxB,SAAS,EAAE,CAAC,eAAe,EAAE,GAAG,eAAe,EAAE,GAAG,iBAAiB,EAAE,GAAG,gBAAgB,CAAC;YAC3F,OAAO,EAAE,CAAC,8BAAkB,EAAE,GAAG,eAAe,CAAC;SAClD,CAAC;IACJ,CAAC;CACF,CAAA;AAtCY,gCAAU;qBAAV,UAAU;IAFtB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,UAAU,CAsCtB"}

package/dist/common/auth-error.d.ts

@@ -0,0 +1,16 @@
+import { HttpException } from '@nestjs/common';
+import { AuthErrorDefinition } from '../constants.js';
+/**
+ * The one error type the library throws for expected problems (wrong password, expired code...).
+ * Every error is defined once, in AUTH_ERRORS (constants.ts), with its HTTP status, code and message.
+ *
+ * Sent to the client as:
+ *   { "success": false, "code": "INVALID_CREDENTIALS", "message": "Invalid email or password." }
+ *
+ * Usage: throw new AuthError(AUTH_ERRORS.invalidCredentials)
+ *        throw new AuthError(AUTH_ERRORS.tooManyRequests, { retryAfterSeconds: 60 })
+ */
+export declare class AuthError extends HttpException {
+    readonly code: string;
+    constructor(error: AuthErrorDefinition, extraDetails?: Record<string, unknown>);
+}

package/dist/common/auth-error.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthError = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * The one error type the library throws for expected problems (wrong password, expired code...).
+ * Every error is defined once, in AUTH_ERRORS (constants.ts), with its HTTP status, code and message.
+ *
+ * Sent to the client as:
+ *   { "success": false, "code": "INVALID_CREDENTIALS", "message": "Invalid email or password." }
+ *
+ * Usage: throw new AuthError(AUTH_ERRORS.invalidCredentials)
+ *        throw new AuthError(AUTH_ERRORS.tooManyRequests, { retryAfterSeconds: 60 })
+ */
+class AuthError extends common_1.HttpException {
+    code;
+    constructor(error, extraDetails = {}) {
+        super({ statusCode: error.status, code: error.code, message: error.message, ...extraDetails }, error.status);
+        this.code = error.code;
+    }
+}
+exports.AuthError = AuthError;
+//# sourceMappingURL=auth-error.js.map

package/dist/common/auth-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-error.js","sourceRoot":"","sources":["../../src/common/auth-error.ts"],"names":[],"mappings":";;;AAAA,2CAA+C;AAG/C;;;;;;;;;GASG;AACH,MAAa,SAAU,SAAQ,sBAAa;IACjC,IAAI,CAAS;IAEtB,YAAY,KAA0B,EAAE,eAAwC,EAAE;QAChF,KAAK,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,YAAY,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7G,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;CACF;AAPD,8BAOC"}

package/dist/common/auth-exception.filter.d.ts

@@ -0,0 +1,24 @@
+import { ArgumentsHost, ExceptionFilter } from '@nestjs/common';
+/**
+ * Turns every error into one response format:
+ *   { "success": false, "code": "INVALID_CREDENTIALS", "message": "Invalid email or password." }
+ *
+ * - AuthError: sent as is (plus extra fields such as retryAfterSeconds).
+ * - Validation errors from DTOs: code VALIDATION_ERROR with the list of problems.
+ * - Other Nest HTTP errors (404 route not found...): their status with a generic code.
+ * - Anything unexpected: logged on the server, and only "INTERNAL_SERVER_ERROR" is sent back,
+ *   so stack traces and internal details never reach the client.
+ *
+ * AuthModule registers it app-wide (APP_FILTER), so your own routes get the same error format.
+ * Throw AuthError or any Nest HttpException from your code and it is formatted the same way.
+ */
+export declare class AuthExceptionFilter implements ExceptionFilter {
+    private readonly logger;
+    /**
+     * Formats any thrown error into the library's response shape and sends it.
+     *
+     * @param exception - Whatever was thrown.
+     * @param host - Gives access to the HTTP response.
+     */
+    catch(exception: unknown, host: ArgumentsHost): any;
+}

package/dist/common/auth-exception.filter.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../constants.js");
+/**
+ * Turns every error into one response format:
+ *   { "success": false, "code": "INVALID_CREDENTIALS", "message": "Invalid email or password." }
+ *
+ * - AuthError: sent as is (plus extra fields such as retryAfterSeconds).
+ * - Validation errors from DTOs: code VALIDATION_ERROR with the list of problems.
+ * - Other Nest HTTP errors (404 route not found...): their status with a generic code.
+ * - Anything unexpected: logged on the server, and only "INTERNAL_SERVER_ERROR" is sent back,
+ *   so stack traces and internal details never reach the client.
+ *
+ * AuthModule registers it app-wide (APP_FILTER), so your own routes get the same error format.
+ * Throw AuthError or any Nest HttpException from your code and it is formatted the same way.
+ */
+let AuthExceptionFilter = class AuthExceptionFilter {
+    logger = new common_1.Logger(constants_1.LOG_CONTEXT.exceptionFilter);
+    /**
+     * Formats any thrown error into the library's response shape and sends it.
+     *
+     * @param exception - Whatever was thrown.
+     * @param host - Gives access to the HTTP response.
+     */
+    catch(exception, host) {
+        const response = host.switchToHttp().getResponse();
+        if (exception instanceof common_1.HttpException) {
+            const status = exception.getStatus();
+            const body = exception.getResponse();
+            if (typeof body === 'object' && typeof body.code === 'string') {
+                const { statusCode: _statusCode, ...rest } = body;
+                if (typeof rest.retryAfterSeconds === 'number')
+                    response.setHeader(constants_1.HTTP_HEADER.retryAfter, String(rest.retryAfterSeconds));
+                return response.status(status).json({ success: false, ...rest });
+            }
+            // ValidationPipe puts its list of problems in `message` as an array.
+            if (status === common_1.HttpStatus.BAD_REQUEST && typeof body === 'object' && Array.isArray(body.message)) {
+                return response.status(common_1.HttpStatus.BAD_REQUEST).json({
+                    success: false,
+                    code: constants_1.AUTH_ERRORS.validationFailed.code,
+                    message: constants_1.AUTH_ERRORS.validationFailed.message,
+                    problems: body.message,
+                });
+            }
+            const message = typeof body === 'string' ? body : (body.message ?? exception.message);
+            return response.status(status).json({ success: false, code: constants_1.ERROR_CODE_BY_HTTP_STATUS[status] ?? constants_1.AUTH_ERRORS.internalError.code, message: String(message) });
+        }
+        this.logger.error(exception instanceof Error ? exception.stack : String(exception));
+        return response
+            .status(constants_1.AUTH_ERRORS.internalError.status)
+            .json({ success: false, code: constants_1.AUTH_ERRORS.internalError.code, message: constants_1.AUTH_ERRORS.internalError.message });
+    }
+};
+exports.AuthExceptionFilter = AuthExceptionFilter;
+exports.AuthExceptionFilter = AuthExceptionFilter = __decorate([
+    (0, common_1.Catch)()
+], AuthExceptionFilter);
+//# sourceMappingURL=auth-exception.filter.js.map

package/dist/common/auth-exception.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-exception.filter.js","sourceRoot":"","sources":["../../src/common/auth-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA0G;AAC1G,2CAA+F;AAE/F;;;;;;;;;;;;GAYG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IACb,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAW,CAAC,eAAe,CAAC,CAAC;IAElE;;;;;OAKG;IACH,KAAK,CAAC,SAAkB,EAAE,IAAmB;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;QAEnD,IAAI,SAAS,YAAY,sBAAa,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,EAAkC,CAAC;YAErE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9D,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ;oBAAE,QAAQ,CAAC,SAAS,CAAC,uBAAW,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBAC3H,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,qEAAqE;YACrE,IAAI,MAAM,KAAK,mBAAU,CAAC,WAAW,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjG,OAAO,QAAQ,CAAC,MAAM,CAAC,mBAAU,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;oBAClD,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,uBAAW,CAAC,gBAAgB,CAAC,IAAI;oBACvC,OAAO,EAAE,uBAAW,CAAC,gBAAgB,CAAC,OAAO;oBAC7C,QAAQ,EAAE,IAAI,CAAC,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;YACtF,OAAO,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,qCAAyB,CAAC,MAAM,CAAC,IAAI,uBAAW,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/J,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACpF,OAAO,QAAQ;aACZ,MAAM,CAAC,uBAAW,CAAC,aAAa,CAAC,MAAM,CAAC;aACxC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAW,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,uBAAW,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAChH,CAAC;CACF,CAAA;AAzCY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,cAAK,GAAE;GACK,mBAAmB,CAyC/B"}