@vritti/api-sdk 0.1.0 → 0.1.2

package/dist/index.js

@@ -1,6 +1,93 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
+// src/config/index.ts
+var defaultConfig = {
+  cookie: {
+    refreshCookieName: "vritti_refresh",
+    refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1e3,
+    refreshCookiePath: "/",
+    refreshCookieSecure: process.env.NODE_ENV === "production",
+    refreshCookieSameSite: "strict"
+  },
+  jwt: {
+    accessTokenExpiry: "15m",
+    refreshTokenExpiry: "30d",
+    onboardingTokenExpiry: "24h",
+    validateTokenBinding: true
+  },
+  guard: {
+    tenantHeaderName: "x-tenant-id",
+    authHeaderName: "authorization",
+    tokenPrefix: "Bearer"
+  }
+};
+var currentConfig = {
+  ...defaultConfig
+};
+function defineConfig(config) {
+  return config;
+}
+__name(defineConfig, "defineConfig");
+function configureApiSdk(userConfig) {
+  currentConfig = {
+    cookie: {
+      ...defaultConfig.cookie,
+      ...userConfig.cookie || {}
+    },
+    jwt: {
+      ...defaultConfig.jwt,
+      ...userConfig.jwt || {}
+    },
+    guard: {
+      ...defaultConfig.guard,
+      ...userConfig.guard || {}
+    }
+  };
+}
+__name(configureApiSdk, "configureApiSdk");
+function getConfig() {
+  return currentConfig;
+}
+__name(getConfig, "getConfig");
+function resetConfig() {
+  currentConfig = {
+    ...defaultConfig
+  };
+}
+__name(resetConfig, "resetConfig");
+function getRefreshCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: currentConfig.cookie.refreshCookieSecure,
+    sameSite: currentConfig.cookie.refreshCookieSameSite,
+    path: currentConfig.cookie.refreshCookiePath,
+    maxAge: currentConfig.cookie.refreshCookieMaxAge
+  };
+}
+__name(getRefreshCookieOptions, "getRefreshCookieOptions");
+function getJwtExpiry() {
+  return {
+    access: currentConfig.jwt.accessTokenExpiry,
+    refresh: currentConfig.jwt.refreshTokenExpiry,
+    onboarding: currentConfig.jwt.onboardingTokenExpiry
+  };
+}
+__name(getJwtExpiry, "getJwtExpiry");
+
+// src/auth/utils/token-hash.util.ts
+import * as crypto from "crypto";
+function hashToken(token) {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+__name(hashToken, "hashToken");
+function verifyTokenHash(token, expectedHash) {
+  const computedHash = hashToken(token);
+  if (computedHash.length !== expectedHash.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(computedHash, "hex"), Buffer.from(expectedHash, "hex"));
+}
+__name(verifyTokenHash, "verifyTokenHash");
+
 // src/auth/auth-config.module.ts
 import { Global as Global2, Module as Module2 } from "@nestjs/common";
 import { ConfigModule, ConfigService as ConfigService2 } from "@nestjs/config";
@@ -64,17 +151,18 @@ var RequestService = class {
     return type === "Bearer" && token ? token : null;
   }
   /**
-  * Extract refresh token from session-id cookie
-  * Cookie name: session-id
+  * Extract refresh token from httpOnly cookie
+  * Cookie name is configurable via api-sdk config
   * @returns Refresh token or null if not found
   */
   getRefreshToken() {
     try {
       const cookies = this.request.cookies;
       if (cookies && typeof cookies === "object") {
-        const sessionId = cookies["session-id"];
-        if (sessionId) {
-          return sessionId;
+        const config = getConfig();
+        const refreshToken = cookies[config.cookie.refreshCookieName];
+        if (refreshToken) {
+          return refreshToken;
         }
       }
       return null;
@@ -139,7 +227,6 @@ import { Injectable as Injectable3, Logger as Logger2, Scope as Scope2, Unauthor
 import { ConfigService } from "@nestjs/config";
 import { Reflector } from "@nestjs/core";
 import { JwtService } from "@nestjs/jwt";
-import * as jwt from "jsonwebtoken";
 
 // src/database/services/primary-database.service.ts
 import { Inject as Inject2, Injectable as Injectable2, InternalServerErrorException, Logger } from "@nestjs/common";
@@ -201,10 +288,14 @@ var PrimaryDatabaseService = class _PrimaryDatabaseService {
         connectionString: databaseUrl,
         max: this.options.maxConnections || 10
       });
+      this.logger.debug(`Schema keys passed to drizzle: [${Object.keys(this.options.drizzleSchema || {}).join(", ")}]`);
+      this.logger.debug(`Relations keys passed to drizzle: [${Object.keys(this.options.drizzleRelations || {}).join(", ")}]`);
       this.db = drizzle({
         client: this.pool,
-        schema: this.options.drizzleSchema
+        schema: this.options.drizzleSchema,
+        relations: this.options.drizzleRelations
       });
+      this.logger.debug(`Drizzle query keys after init: [${Object.keys(this.db.query || {}).join(", ")}]`);
       await this.pool.query("SELECT 1");
       this.logger.log("Connected to primary database (tenant registry)");
     } catch (error) {
@@ -435,6 +526,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
         }
         const validatedToken2 = this.validateAccessToken(accessToken);
         this.logger.debug("Onboarding token validated successfully");
+        this.validateRefreshTokenBinding(context, validatedToken2);
         const userId2 = validatedToken2.userId;
         request.user = {
           id: userId2
@@ -447,13 +539,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       }
       const validatedToken = this.validateAccessToken(accessToken);
       this.logger.debug("Access token validated successfully");
-      const refreshToken = this.requestService.getRefreshToken();
-      if (!refreshToken) {
-        this.logger.warn("Refresh token (session-id) not found in cookies");
-        throw new UnauthorizedException("Refresh token not found");
-      }
-      this.validateRefreshToken(refreshToken);
-      this.logger.debug("Refresh token validated successfully");
+      this.validateRefreshTokenBinding(context, validatedToken);
       const userId = validatedToken.userId;
       request.user = {
         id: userId
@@ -524,60 +610,36 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     }
   }
   /**
-  * Validate refresh token with proper expiry checks
-  * Throws UnauthorizedException if token is invalid or expired
-  */
-  validateRefreshToken(token) {
-    const jwtSecret = this.configService.get("JWT_REFRESH_SECRET") || this.configService.get("JWT_SECRET");
-    this.validateRefreshTokenWithSecret(token, jwtSecret);
-  }
-  /**
-  * Helper to validate refresh token with specific secret
+  * Validate that the access token is bound to the refresh token in the cookie.
+  * This prevents token theft - a stolen access token is useless without the
+  * corresponding refresh token cookie.
+  *
+  * @param context - The execution context containing the request
+  * @param validatedToken - The decoded and validated JWT token
+  * @throws UnauthorizedException if token binding validation fails
   */
-  validateRefreshTokenWithSecret(token, secret) {
-    if (!secret) {
-      this.logger.error("JWT secret not configured for refresh token validation");
-      throw new UnauthorizedException("Server configuration error");
+  validateRefreshTokenBinding(context, validatedToken) {
+    const config = getConfig();
+    if (!config.jwt.validateTokenBinding) {
+      this.logger.debug("Token binding validation is disabled");
+      return;
     }
-    try {
-      const decoded = jwt.verify(token, secret, {
-        algorithms: [
-          "HS256",
-          "HS512",
-          "RS256"
-        ]
-      });
-      this.logger.debug(`Refresh token decoded for user: ${decoded.userId}`);
-      if (decoded.exp) {
-        const expiryTime = decoded.exp * 1e3;
-        const currentTime = Date.now();
-        if (currentTime > expiryTime) {
-          this.logger.warn("Refresh token has expired");
-          throw new UnauthorizedException("Refresh token has expired. Please login again");
-        }
-        const timeRemaining = expiryTime - currentTime;
-        this.logger.debug(`Refresh token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
-      }
-    } catch (error) {
-      if (error instanceof UnauthorizedException) {
-        throw error;
-      }
-      const jwtError = error;
-      if (jwtError?.name === "TokenExpiredError") {
-        this.logger.warn(`Refresh token expired at: ${jwtError?.expiredAt}`);
-        throw new UnauthorizedException("Refresh token has expired. Please login again");
-      }
-      if (jwtError?.name === "JsonWebTokenError") {
-        this.logger.warn(`Refresh token verification failed: ${jwtError?.message}`);
-        throw new UnauthorizedException("Invalid refresh token");
-      }
-      if (jwtError?.name === "NotBeforeError") {
-        this.logger.warn("Refresh token used before valid (nbf claim)");
-        throw new UnauthorizedException("Refresh token not yet valid");
-      }
-      this.logger.error("Unexpected error validating refresh token", error);
-      throw new UnauthorizedException("Refresh token validation failed");
+    if (!validatedToken.refreshTokenHash) {
+      this.logger.debug("Token does not contain refreshTokenHash, skipping binding validation");
+      return;
+    }
+    const request = context.switchToHttp().getRequest();
+    const cookies = request.cookies || {};
+    const refreshToken = cookies[config.cookie.refreshCookieName];
+    if (!refreshToken) {
+      this.logger.warn("Session validation failed - refresh token cookie not found");
+      throw new UnauthorizedException("Session validation failed");
     }
+    if (!verifyTokenHash(refreshToken, validatedToken.refreshTokenHash)) {
+      this.logger.warn("Session validation failed - token binding mismatch");
+      throw new UnauthorizedException("Session validation failed");
+    }
+    this.logger.debug("Token binding validated successfully");
   }
 };
 VrittiAuthGuard = _ts_decorate4([
@@ -1226,6 +1288,10 @@ DatabaseModule = _ts_decorate10([
 // src/database/repositories/primary-base.repository.ts
 import { Logger as Logger6 } from "@nestjs/common";
 import { eq as eq2, sql, getTableName } from "drizzle-orm";
+function snakeToCamel(str) {
+  return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+__name(snakeToCamel, "snakeToCamel");
 var PrimaryBaseRepository = class {
   static {
     __name(this, "PrimaryBaseRepository");
@@ -1235,7 +1301,8 @@ var PrimaryBaseRepository = class {
   logger;
   /**
   * The table name extracted from the Drizzle table at runtime.
-  * Used to access the query API for this repository's table.
+  * Stored in camelCase to match Drizzle's query object keys.
+  * Example: 'email_verifications' -> 'emailVerifications'
   */
   tableName;
   /**
@@ -1247,21 +1314,28 @@ var PrimaryBaseRepository = class {
     return this.database.drizzleClient;
   }
   /**
-  * Model query API for THIS repository's table (Prisma-like syntax)
+  * Model query API for THIS repository's table (Drizzle v2 relational queries)
   * Scoped to only the table this repository manages.
   * Returns a type-safe wrapper around Drizzle's RelationalQueryBuilder.
   *
   * @example
   * ```typescript
-  * // Use relational queries with type safety
+  * // Use relational queries with v2 object-based where syntax
   * const user = await this.model.findFirst({
-  *   where: eq(users.id, id),
+  *   where: { id },
   *   with: { posts: true, profile: true }
   * });
   * ```
   */
   get model() {
-    return this.database.drizzleClient.query[this.tableName];
+    const query = this.database.drizzleClient.query;
+    const queryKeys = Object.keys(query || {});
+    this.logger.debug(`Looking for '${this.tableName}' in query keys: [${queryKeys.join(", ")}]`);
+    const model = query[this.tableName];
+    if (!model) {
+      this.logger.error(`Table '${this.tableName}' not found in query object. Available: [${queryKeys.join(", ")}]`);
+    }
+    return model;
   }
   /**
   * Create a new repository instance
@@ -1281,9 +1355,11 @@ var PrimaryBaseRepository = class {
   constructor(database, table) {
     this.database = database;
     this.table = table;
-    this.tableName = getTableName(table);
+    const dbTableName = getTableName(table);
+    this.tableName = snakeToCamel(dbTableName);
     this.logger = new Logger6(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
+    this.logger.debug(`Table name: '${dbTableName}' -> query key: '${this.tableName}'`);
   }
   /**
   * Create a new record
@@ -1317,21 +1393,31 @@ var PrimaryBaseRepository = class {
   */
   async findById(id) {
     this.logger.debug(`Finding record by ID: ${id}`);
-    const idColumn = this.table.id;
     return this.model.findFirst({
-      where: eq2(idColumn, id)
+      where: {
+        id
+      }
     });
   }
   /**
-  * Find a single record with custom where clause
+  * Find a single record with custom where clause (Drizzle v2 object-based syntax)
   *
-  * @param where - SQL condition
+  * @param where - Object-based filter condition
   * @returns Promise resolving to the record or undefined if not found
   *
   * @example
   * ```typescript
-  * import { eq } from 'drizzle-orm';
-  * const user = await userRepository.findOne(eq(users.email, 'user@example.com'));
+  * // Simple equality
+  * const user = await userRepository.findOne({ email: 'user@example.com' });
+  *
+  * // With operators
+  * const user = await userRepository.findOne({ age: { gte: 18 } });
+  *
+  * // Multiple conditions (AND)
+  * const user = await userRepository.findOne({
+  *   email: 'user@example.com',
+  *   status: 'ACTIVE'
+  * });
   * ```
   */
   async findOne(where) {
@@ -1341,25 +1427,33 @@ var PrimaryBaseRepository = class {
     });
   }
   /**
-  * Find multiple records
+  * Find multiple records (Drizzle v2 object-based syntax)
   *
   * @param options - Query options (where, orderBy, limit, offset)
   * @returns Promise resolving to an array of records
   *
   * @example
   * ```typescript
-  * import { eq, desc } from 'drizzle-orm';
-  *
   * // Find all users
   * const users = await userRepository.findMany();
   *
-  * // Find with filtering and pagination
+  * // Find with filtering and pagination (v2 object syntax)
   * const users = await userRepository.findMany({
-  *   where: eq(users.accountStatus, 'ACTIVE'),
-  *   orderBy: desc(users.createdAt),
+  *   where: { accountStatus: 'ACTIVE' },
+  *   orderBy: { createdAt: 'desc' },
   *   limit: 10,
   *   offset: 0
   * });
+  *
+  * // Multiple conditions
+  * const users = await userRepository.findMany({
+  *   where: {
+  *     AND: [
+  *       { status: 'ACTIVE' },
+  *       { age: { gte: 18 } }
+  *     ]
+  *   }
+  * });
   * ```
   */
   async findMany(options) {
@@ -3304,11 +3398,19 @@ export {
   ValidationException,
   VrittiAuthGuard,
   addCorrelationIdToResponse,
+  configureApiSdk,
   correlationStorage,
+  defineConfig,
   generateCorrelationId,
+  getConfig,
   getCorrelationContext,
   getHttpStatusTitle,
+  getJwtExpiry,
+  getRefreshCookieOptions,
+  hashToken,
+  resetConfig,
   runWithCorrelationContext,
-  updateCorrelationContext
+  updateCorrelationContext,
+  verifyTokenHash
 };
 //# sourceMappingURL=index.js.map