@vritti/api-sdk 0.1.0 → 0.1.2

package/dist/index.cjs

@@ -71,18 +71,113 @@ __export(index_exports, {
   ValidationException: () => ValidationException,
   VrittiAuthGuard: () => VrittiAuthGuard,
   addCorrelationIdToResponse: () => addCorrelationIdToResponse,
+  configureApiSdk: () => configureApiSdk,
   correlationStorage: () => correlationStorage,
+  defineConfig: () => defineConfig,
   generateCorrelationId: () => generateCorrelationId,
+  getConfig: () => getConfig,
   getCorrelationContext: () => getCorrelationContext,
   getHttpStatusTitle: () => getHttpStatusTitle,
+  getJwtExpiry: () => getJwtExpiry,
+  getRefreshCookieOptions: () => getRefreshCookieOptions,
+  hashToken: () => hashToken,
+  resetConfig: () => resetConfig,
   runWithCorrelationContext: () => runWithCorrelationContext,
-  updateCorrelationContext: () => updateCorrelationContext
+  updateCorrelationContext: () => updateCorrelationContext,
+  verifyTokenHash: () => verifyTokenHash
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/config/index.ts
+var defaultConfig = {
+  cookie: {
+    refreshCookieName: "vritti_refresh",
+    refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1e3,
+    refreshCookiePath: "/",
+    refreshCookieSecure: process.env.NODE_ENV === "production",
+    refreshCookieSameSite: "strict"
+  },
+  jwt: {
+    accessTokenExpiry: "15m",
+    refreshTokenExpiry: "30d",
+    onboardingTokenExpiry: "24h",
+    validateTokenBinding: true
+  },
+  guard: {
+    tenantHeaderName: "x-tenant-id",
+    authHeaderName: "authorization",
+    tokenPrefix: "Bearer"
+  }
+};
+var currentConfig = {
+  ...defaultConfig
+};
+function defineConfig(config) {
+  return config;
+}
+__name(defineConfig, "defineConfig");
+function configureApiSdk(userConfig) {
+  currentConfig = {
+    cookie: {
+      ...defaultConfig.cookie,
+      ...userConfig.cookie || {}
+    },
+    jwt: {
+      ...defaultConfig.jwt,
+      ...userConfig.jwt || {}
+    },
+    guard: {
+      ...defaultConfig.guard,
+      ...userConfig.guard || {}
+    }
+  };
+}
+__name(configureApiSdk, "configureApiSdk");
+function getConfig() {
+  return currentConfig;
+}
+__name(getConfig, "getConfig");
+function resetConfig() {
+  currentConfig = {
+    ...defaultConfig
+  };
+}
+__name(resetConfig, "resetConfig");
+function getRefreshCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: currentConfig.cookie.refreshCookieSecure,
+    sameSite: currentConfig.cookie.refreshCookieSameSite,
+    path: currentConfig.cookie.refreshCookiePath,
+    maxAge: currentConfig.cookie.refreshCookieMaxAge
+  };
+}
+__name(getRefreshCookieOptions, "getRefreshCookieOptions");
+function getJwtExpiry() {
+  return {
+    access: currentConfig.jwt.accessTokenExpiry,
+    refresh: currentConfig.jwt.refreshTokenExpiry,
+    onboarding: currentConfig.jwt.onboardingTokenExpiry
+  };
+}
+__name(getJwtExpiry, "getJwtExpiry");
+
+// src/auth/utils/token-hash.util.ts
+var crypto = __toESM(require("crypto"), 1);
+function hashToken(token) {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+__name(hashToken, "hashToken");
+function verifyTokenHash(token, expectedHash) {
+  const computedHash = hashToken(token);
+  if (computedHash.length !== expectedHash.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(computedHash, "hex"), Buffer.from(expectedHash, "hex"));
+}
+__name(verifyTokenHash, "verifyTokenHash");
+
 // src/auth/auth-config.module.ts
 var import_common5 = require("@nestjs/common");
-var import_config2 = require("@nestjs/config");
+var import_config4 = require("@nestjs/config");
 var import_core3 = require("@nestjs/core");
 var import_jwt2 = require("@nestjs/jwt");
 
@@ -143,17 +238,18 @@ var RequestService = class {
     return type === "Bearer" && token ? token : null;
   }
   /**
-  * Extract refresh token from session-id cookie
-  * Cookie name: session-id
+  * Extract refresh token from httpOnly cookie
+  * Cookie name is configurable via api-sdk config
   * @returns Refresh token or null if not found
   */
   getRefreshToken() {
     try {
       const cookies = this.request.cookies;
       if (cookies && typeof cookies === "object") {
-        const sessionId = cookies["session-id"];
-        if (sessionId) {
-          return sessionId;
+        const config = getConfig();
+        const refreshToken = cookies[config.cookie.refreshCookieName];
+        if (refreshToken) {
+          return refreshToken;
         }
       }
       return null;
@@ -215,10 +311,9 @@ RequestModule = _ts_decorate2([
 
 // src/auth/guards/vritti-auth.guard.ts
 var import_common4 = require("@nestjs/common");
-var import_config = require("@nestjs/config");
+var import_config2 = require("@nestjs/config");
 var import_core2 = require("@nestjs/core");
 var import_jwt = require("@nestjs/jwt");
-var jwt = __toESM(require("jsonwebtoken"), 1);
 
 // src/database/services/primary-database.service.ts
 var import_common3 = require("@nestjs/common");
@@ -280,10 +375,14 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
         connectionString: databaseUrl,
         max: this.options.maxConnections || 10
       });
+      this.logger.debug(`Schema keys passed to drizzle: [${Object.keys(this.options.drizzleSchema || {}).join(", ")}]`);
+      this.logger.debug(`Relations keys passed to drizzle: [${Object.keys(this.options.drizzleRelations || {}).join(", ")}]`);
       this.db = (0, import_node_postgres.drizzle)({
         client: this.pool,
-        schema: this.options.drizzleSchema
+        schema: this.options.drizzleSchema,
+        relations: this.options.drizzleRelations
       });
+      this.logger.debug(`Drizzle query keys after init: [${Object.keys(this.db.query || {}).join(", ")}]`);
       await this.pool.query("SELECT 1");
       this.logger.log("Connected to primary database (tenant registry)");
     } catch (error) {
@@ -514,6 +613,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
         }
         const validatedToken2 = this.validateAccessToken(accessToken);
         this.logger.debug("Onboarding token validated successfully");
+        this.validateRefreshTokenBinding(context, validatedToken2);
         const userId2 = validatedToken2.userId;
         request.user = {
           id: userId2
@@ -526,13 +626,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       }
       const validatedToken = this.validateAccessToken(accessToken);
       this.logger.debug("Access token validated successfully");
-      const refreshToken = this.requestService.getRefreshToken();
-      if (!refreshToken) {
-        this.logger.warn("Refresh token (session-id) not found in cookies");
-        throw new import_common4.UnauthorizedException("Refresh token not found");
-      }
-      this.validateRefreshToken(refreshToken);
-      this.logger.debug("Refresh token validated successfully");
+      this.validateRefreshTokenBinding(context, validatedToken);
       const userId = validatedToken.userId;
       request.user = {
         id: userId
@@ -603,60 +697,36 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     }
   }
   /**
-  * Validate refresh token with proper expiry checks
-  * Throws UnauthorizedException if token is invalid or expired
-  */
-  validateRefreshToken(token) {
-    const jwtSecret = this.configService.get("JWT_REFRESH_SECRET") || this.configService.get("JWT_SECRET");
-    this.validateRefreshTokenWithSecret(token, jwtSecret);
-  }
-  /**
-  * Helper to validate refresh token with specific secret
+  * Validate that the access token is bound to the refresh token in the cookie.
+  * This prevents token theft - a stolen access token is useless without the
+  * corresponding refresh token cookie.
+  *
+  * @param context - The execution context containing the request
+  * @param validatedToken - The decoded and validated JWT token
+  * @throws UnauthorizedException if token binding validation fails
   */
-  validateRefreshTokenWithSecret(token, secret) {
-    if (!secret) {
-      this.logger.error("JWT secret not configured for refresh token validation");
-      throw new import_common4.UnauthorizedException("Server configuration error");
+  validateRefreshTokenBinding(context, validatedToken) {
+    const config = getConfig();
+    if (!config.jwt.validateTokenBinding) {
+      this.logger.debug("Token binding validation is disabled");
+      return;
     }
-    try {
-      const decoded = jwt.verify(token, secret, {
-        algorithms: [
-          "HS256",
-          "HS512",
-          "RS256"
-        ]
-      });
-      this.logger.debug(`Refresh token decoded for user: ${decoded.userId}`);
-      if (decoded.exp) {
-        const expiryTime = decoded.exp * 1e3;
-        const currentTime = Date.now();
-        if (currentTime > expiryTime) {
-          this.logger.warn("Refresh token has expired");
-          throw new import_common4.UnauthorizedException("Refresh token has expired. Please login again");
-        }
-        const timeRemaining = expiryTime - currentTime;
-        this.logger.debug(`Refresh token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
-      }
-    } catch (error) {
-      if (error instanceof import_common4.UnauthorizedException) {
-        throw error;
-      }
-      const jwtError = error;
-      if (jwtError?.name === "TokenExpiredError") {
-        this.logger.warn(`Refresh token expired at: ${jwtError?.expiredAt}`);
-        throw new import_common4.UnauthorizedException("Refresh token has expired. Please login again");
-      }
-      if (jwtError?.name === "JsonWebTokenError") {
-        this.logger.warn(`Refresh token verification failed: ${jwtError?.message}`);
-        throw new import_common4.UnauthorizedException("Invalid refresh token");
-      }
-      if (jwtError?.name === "NotBeforeError") {
-        this.logger.warn("Refresh token used before valid (nbf claim)");
-        throw new import_common4.UnauthorizedException("Refresh token not yet valid");
-      }
-      this.logger.error("Unexpected error validating refresh token", error);
-      throw new import_common4.UnauthorizedException("Refresh token validation failed");
+    if (!validatedToken.refreshTokenHash) {
+      this.logger.debug("Token does not contain refreshTokenHash, skipping binding validation");
+      return;
+    }
+    const request = context.switchToHttp().getRequest();
+    const cookies = request.cookies || {};
+    const refreshToken = cookies[config.cookie.refreshCookieName];
+    if (!refreshToken) {
+      this.logger.warn("Session validation failed - refresh token cookie not found");
+      throw new import_common4.UnauthorizedException("Session validation failed");
+    }
+    if (!verifyTokenHash(refreshToken, validatedToken.refreshTokenHash)) {
+      this.logger.warn("Session validation failed - token binding mismatch");
+      throw new import_common4.UnauthorizedException("Session validation failed");
     }
+    this.logger.debug("Token binding validated successfully");
   }
 };
 VrittiAuthGuard = _ts_decorate4([
@@ -666,7 +736,7 @@ VrittiAuthGuard = _ts_decorate4([
   _ts_metadata3("design:type", Function),
   _ts_metadata3("design:paramtypes", [
     typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
-    typeof import_config.ConfigService === "undefined" ? Object : import_config.ConfigService,
+    typeof import_config2.ConfigService === "undefined" ? Object : import_config2.ConfigService,
     typeof import_jwt.JwtService === "undefined" ? Object : import_jwt.JwtService,
     typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
     typeof RequestService === "undefined" ? Object : RequestService
@@ -699,14 +769,14 @@ var AuthConfigModule = class _AuthConfigModule {
     return {
       module: _AuthConfigModule,
       imports: [
-        import_config2.ConfigModule,
+        import_config4.ConfigModule,
         RequestModule,
         import_jwt2.JwtModule.registerAsync({
           imports: [
-            import_config2.ConfigModule
+            import_config4.ConfigModule
           ],
           inject: [
-            import_config2.ConfigService
+            import_config4.ConfigService
           ],
           useFactory: /* @__PURE__ */ __name((config) => ({
             secret: config.get("JWT_SECRET"),
@@ -1305,6 +1375,10 @@ DatabaseModule = _ts_decorate10([
 // src/database/repositories/primary-base.repository.ts
 var import_common11 = require("@nestjs/common");
 var import_drizzle_orm2 = require("drizzle-orm");
+function snakeToCamel(str) {
+  return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+__name(snakeToCamel, "snakeToCamel");
 var PrimaryBaseRepository = class {
   static {
     __name(this, "PrimaryBaseRepository");
@@ -1314,7 +1388,8 @@ var PrimaryBaseRepository = class {
   logger;
   /**
   * The table name extracted from the Drizzle table at runtime.
-  * Used to access the query API for this repository's table.
+  * Stored in camelCase to match Drizzle's query object keys.
+  * Example: 'email_verifications' -> 'emailVerifications'
   */
   tableName;
   /**
@@ -1326,21 +1401,28 @@ var PrimaryBaseRepository = class {
     return this.database.drizzleClient;
   }
   /**
-  * Model query API for THIS repository's table (Prisma-like syntax)
+  * Model query API for THIS repository's table (Drizzle v2 relational queries)
   * Scoped to only the table this repository manages.
   * Returns a type-safe wrapper around Drizzle's RelationalQueryBuilder.
   *
   * @example
   * ```typescript
-  * // Use relational queries with type safety
+  * // Use relational queries with v2 object-based where syntax
   * const user = await this.model.findFirst({
-  *   where: eq(users.id, id),
+  *   where: { id },
   *   with: { posts: true, profile: true }
   * });
   * ```
   */
   get model() {
-    return this.database.drizzleClient.query[this.tableName];
+    const query = this.database.drizzleClient.query;
+    const queryKeys = Object.keys(query || {});
+    this.logger.debug(`Looking for '${this.tableName}' in query keys: [${queryKeys.join(", ")}]`);
+    const model = query[this.tableName];
+    if (!model) {
+      this.logger.error(`Table '${this.tableName}' not found in query object. Available: [${queryKeys.join(", ")}]`);
+    }
+    return model;
   }
   /**
   * Create a new repository instance
@@ -1360,9 +1442,11 @@ var PrimaryBaseRepository = class {
   constructor(database, table) {
     this.database = database;
     this.table = table;
-    this.tableName = (0, import_drizzle_orm2.getTableName)(table);
+    const dbTableName = (0, import_drizzle_orm2.getTableName)(table);
+    this.tableName = snakeToCamel(dbTableName);
     this.logger = new import_common11.Logger(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
+    this.logger.debug(`Table name: '${dbTableName}' -> query key: '${this.tableName}'`);
   }
   /**
   * Create a new record
@@ -1396,21 +1480,31 @@ var PrimaryBaseRepository = class {
   */
   async findById(id) {
     this.logger.debug(`Finding record by ID: ${id}`);
-    const idColumn = this.table.id;
     return this.model.findFirst({
-      where: (0, import_drizzle_orm2.eq)(idColumn, id)
+      where: {
+        id
+      }
     });
   }
   /**
-  * Find a single record with custom where clause
+  * Find a single record with custom where clause (Drizzle v2 object-based syntax)
   *
-  * @param where - SQL condition
+  * @param where - Object-based filter condition
   * @returns Promise resolving to the record or undefined if not found
   *
   * @example
   * ```typescript
-  * import { eq } from 'drizzle-orm';
-  * const user = await userRepository.findOne(eq(users.email, 'user@example.com'));
+  * // Simple equality
+  * const user = await userRepository.findOne({ email: 'user@example.com' });
+  *
+  * // With operators
+  * const user = await userRepository.findOne({ age: { gte: 18 } });
+  *
+  * // Multiple conditions (AND)
+  * const user = await userRepository.findOne({
+  *   email: 'user@example.com',
+  *   status: 'ACTIVE'
+  * });
   * ```
   */
   async findOne(where) {
@@ -1420,25 +1514,33 @@ var PrimaryBaseRepository = class {
     });
   }
   /**
-  * Find multiple records
+  * Find multiple records (Drizzle v2 object-based syntax)
   *
   * @param options - Query options (where, orderBy, limit, offset)
   * @returns Promise resolving to an array of records
   *
   * @example
   * ```typescript
-  * import { eq, desc } from 'drizzle-orm';
-  *
   * // Find all users
   * const users = await userRepository.findMany();
   *
-  * // Find with filtering and pagination
+  * // Find with filtering and pagination (v2 object syntax)
   * const users = await userRepository.findMany({
-  *   where: eq(users.accountStatus, 'ACTIVE'),
-  *   orderBy: desc(users.createdAt),
+  *   where: { accountStatus: 'ACTIVE' },
+  *   orderBy: { createdAt: 'desc' },
   *   limit: 10,
   *   offset: 0
   * });
+  *
+  * // Multiple conditions
+  * const users = await userRepository.findMany({
+  *   where: {
+  *     AND: [
+  *       { status: 'ACTIVE' },
+  *       { age: { gte: 18 } }
+  *     ]
+  *   }
+  * });
   * ```
   */
   async findMany(options) {
@@ -3384,11 +3486,19 @@ LoggerModule = _ts_decorate17([
   ValidationException,
   VrittiAuthGuard,
   addCorrelationIdToResponse,
+  configureApiSdk,
   correlationStorage,
+  defineConfig,
   generateCorrelationId,
+  getConfig,
   getCorrelationContext,
   getHttpStatusTitle,
+  getJwtExpiry,
+  getRefreshCookieOptions,
+  hashToken,
+  resetConfig,
   runWithCorrelationContext,
-  updateCorrelationContext
+  updateCorrelationContext,
+  verifyTokenHash
 });
 //# sourceMappingURL=index.cjs.map