@vritti/api-sdk 0.1.1 → 0.1.2

package/dist/index.cjs

@@ -71,18 +71,113 @@ __export(index_exports, {
   ValidationException: () => ValidationException,
   VrittiAuthGuard: () => VrittiAuthGuard,
   addCorrelationIdToResponse: () => addCorrelationIdToResponse,
+  configureApiSdk: () => configureApiSdk,
   correlationStorage: () => correlationStorage,
+  defineConfig: () => defineConfig,
   generateCorrelationId: () => generateCorrelationId,
+  getConfig: () => getConfig,
   getCorrelationContext: () => getCorrelationContext,
   getHttpStatusTitle: () => getHttpStatusTitle,
+  getJwtExpiry: () => getJwtExpiry,
+  getRefreshCookieOptions: () => getRefreshCookieOptions,
+  hashToken: () => hashToken,
+  resetConfig: () => resetConfig,
   runWithCorrelationContext: () => runWithCorrelationContext,
-  updateCorrelationContext: () => updateCorrelationContext
+  updateCorrelationContext: () => updateCorrelationContext,
+  verifyTokenHash: () => verifyTokenHash
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/config/index.ts
+var defaultConfig = {
+  cookie: {
+    refreshCookieName: "vritti_refresh",
+    refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1e3,
+    refreshCookiePath: "/",
+    refreshCookieSecure: process.env.NODE_ENV === "production",
+    refreshCookieSameSite: "strict"
+  },
+  jwt: {
+    accessTokenExpiry: "15m",
+    refreshTokenExpiry: "30d",
+    onboardingTokenExpiry: "24h",
+    validateTokenBinding: true
+  },
+  guard: {
+    tenantHeaderName: "x-tenant-id",
+    authHeaderName: "authorization",
+    tokenPrefix: "Bearer"
+  }
+};
+var currentConfig = {
+  ...defaultConfig
+};
+function defineConfig(config) {
+  return config;
+}
+__name(defineConfig, "defineConfig");
+function configureApiSdk(userConfig) {
+  currentConfig = {
+    cookie: {
+      ...defaultConfig.cookie,
+      ...userConfig.cookie || {}
+    },
+    jwt: {
+      ...defaultConfig.jwt,
+      ...userConfig.jwt || {}
+    },
+    guard: {
+      ...defaultConfig.guard,
+      ...userConfig.guard || {}
+    }
+  };
+}
+__name(configureApiSdk, "configureApiSdk");
+function getConfig() {
+  return currentConfig;
+}
+__name(getConfig, "getConfig");
+function resetConfig() {
+  currentConfig = {
+    ...defaultConfig
+  };
+}
+__name(resetConfig, "resetConfig");
+function getRefreshCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: currentConfig.cookie.refreshCookieSecure,
+    sameSite: currentConfig.cookie.refreshCookieSameSite,
+    path: currentConfig.cookie.refreshCookiePath,
+    maxAge: currentConfig.cookie.refreshCookieMaxAge
+  };
+}
+__name(getRefreshCookieOptions, "getRefreshCookieOptions");
+function getJwtExpiry() {
+  return {
+    access: currentConfig.jwt.accessTokenExpiry,
+    refresh: currentConfig.jwt.refreshTokenExpiry,
+    onboarding: currentConfig.jwt.onboardingTokenExpiry
+  };
+}
+__name(getJwtExpiry, "getJwtExpiry");
+
+// src/auth/utils/token-hash.util.ts
+var crypto = __toESM(require("crypto"), 1);
+function hashToken(token) {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+__name(hashToken, "hashToken");
+function verifyTokenHash(token, expectedHash) {
+  const computedHash = hashToken(token);
+  if (computedHash.length !== expectedHash.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(computedHash, "hex"), Buffer.from(expectedHash, "hex"));
+}
+__name(verifyTokenHash, "verifyTokenHash");
+
 // src/auth/auth-config.module.ts
 var import_common5 = require("@nestjs/common");
-var import_config2 = require("@nestjs/config");
+var import_config4 = require("@nestjs/config");
 var import_core3 = require("@nestjs/core");
 var import_jwt2 = require("@nestjs/jwt");
 
@@ -143,17 +238,18 @@ var RequestService = class {
     return type === "Bearer" && token ? token : null;
   }
   /**
-  * Extract refresh token from session-id cookie
-  * Cookie name: session-id
+  * Extract refresh token from httpOnly cookie
+  * Cookie name is configurable via api-sdk config
   * @returns Refresh token or null if not found
   */
   getRefreshToken() {
     try {
       const cookies = this.request.cookies;
       if (cookies && typeof cookies === "object") {
-        const sessionId = cookies["session-id"];
-        if (sessionId) {
-          return sessionId;
+        const config = getConfig();
+        const refreshToken = cookies[config.cookie.refreshCookieName];
+        if (refreshToken) {
+          return refreshToken;
         }
       }
       return null;
@@ -215,10 +311,9 @@ RequestModule = _ts_decorate2([
 
 // src/auth/guards/vritti-auth.guard.ts
 var import_common4 = require("@nestjs/common");
-var import_config = require("@nestjs/config");
+var import_config2 = require("@nestjs/config");
 var import_core2 = require("@nestjs/core");
 var import_jwt = require("@nestjs/jwt");
-var jwt = __toESM(require("jsonwebtoken"), 1);
 
 // src/database/services/primary-database.service.ts
 var import_common3 = require("@nestjs/common");
@@ -518,6 +613,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
         }
         const validatedToken2 = this.validateAccessToken(accessToken);
         this.logger.debug("Onboarding token validated successfully");
+        this.validateRefreshTokenBinding(context, validatedToken2);
         const userId2 = validatedToken2.userId;
         request.user = {
           id: userId2
@@ -530,13 +626,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       }
       const validatedToken = this.validateAccessToken(accessToken);
       this.logger.debug("Access token validated successfully");
-      const refreshToken = this.requestService.getRefreshToken();
-      if (!refreshToken) {
-        this.logger.warn("Refresh token (session-id) not found in cookies");
-        throw new import_common4.UnauthorizedException("Refresh token not found");
-      }
-      this.validateRefreshToken(refreshToken);
-      this.logger.debug("Refresh token validated successfully");
+      this.validateRefreshTokenBinding(context, validatedToken);
       const userId = validatedToken.userId;
       request.user = {
         id: userId
@@ -607,60 +697,36 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     }
   }
   /**
-  * Validate refresh token with proper expiry checks
-  * Throws UnauthorizedException if token is invalid or expired
-  */
-  validateRefreshToken(token) {
-    const jwtSecret = this.configService.get("JWT_REFRESH_SECRET") || this.configService.get("JWT_SECRET");
-    this.validateRefreshTokenWithSecret(token, jwtSecret);
-  }
-  /**
-  * Helper to validate refresh token with specific secret
+  * Validate that the access token is bound to the refresh token in the cookie.
+  * This prevents token theft - a stolen access token is useless without the
+  * corresponding refresh token cookie.
+  *
+  * @param context - The execution context containing the request
+  * @param validatedToken - The decoded and validated JWT token
+  * @throws UnauthorizedException if token binding validation fails
   */
-  validateRefreshTokenWithSecret(token, secret) {
-    if (!secret) {
-      this.logger.error("JWT secret not configured for refresh token validation");
-      throw new import_common4.UnauthorizedException("Server configuration error");
+  validateRefreshTokenBinding(context, validatedToken) {
+    const config = getConfig();
+    if (!config.jwt.validateTokenBinding) {
+      this.logger.debug("Token binding validation is disabled");
+      return;
     }
-    try {
-      const decoded = jwt.verify(token, secret, {
-        algorithms: [
-          "HS256",
-          "HS512",
-          "RS256"
-        ]
-      });
-      this.logger.debug(`Refresh token decoded for user: ${decoded.userId}`);
-      if (decoded.exp) {
-        const expiryTime = decoded.exp * 1e3;
-        const currentTime = Date.now();
-        if (currentTime > expiryTime) {
-          this.logger.warn("Refresh token has expired");
-          throw new import_common4.UnauthorizedException("Refresh token has expired. Please login again");
-        }
-        const timeRemaining = expiryTime - currentTime;
-        this.logger.debug(`Refresh token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
-      }
-    } catch (error) {
-      if (error instanceof import_common4.UnauthorizedException) {
-        throw error;
-      }
-      const jwtError = error;
-      if (jwtError?.name === "TokenExpiredError") {
-        this.logger.warn(`Refresh token expired at: ${jwtError?.expiredAt}`);
-        throw new import_common4.UnauthorizedException("Refresh token has expired. Please login again");
-      }
-      if (jwtError?.name === "JsonWebTokenError") {
-        this.logger.warn(`Refresh token verification failed: ${jwtError?.message}`);
-        throw new import_common4.UnauthorizedException("Invalid refresh token");
-      }
-      if (jwtError?.name === "NotBeforeError") {
-        this.logger.warn("Refresh token used before valid (nbf claim)");
-        throw new import_common4.UnauthorizedException("Refresh token not yet valid");
-      }
-      this.logger.error("Unexpected error validating refresh token", error);
-      throw new import_common4.UnauthorizedException("Refresh token validation failed");
+    if (!validatedToken.refreshTokenHash) {
+      this.logger.debug("Token does not contain refreshTokenHash, skipping binding validation");
+      return;
+    }
+    const request = context.switchToHttp().getRequest();
+    const cookies = request.cookies || {};
+    const refreshToken = cookies[config.cookie.refreshCookieName];
+    if (!refreshToken) {
+      this.logger.warn("Session validation failed - refresh token cookie not found");
+      throw new import_common4.UnauthorizedException("Session validation failed");
     }
+    if (!verifyTokenHash(refreshToken, validatedToken.refreshTokenHash)) {
+      this.logger.warn("Session validation failed - token binding mismatch");
+      throw new import_common4.UnauthorizedException("Session validation failed");
+    }
+    this.logger.debug("Token binding validated successfully");
   }
 };
 VrittiAuthGuard = _ts_decorate4([
@@ -670,7 +736,7 @@ VrittiAuthGuard = _ts_decorate4([
   _ts_metadata3("design:type", Function),
   _ts_metadata3("design:paramtypes", [
     typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
-    typeof import_config.ConfigService === "undefined" ? Object : import_config.ConfigService,
+    typeof import_config2.ConfigService === "undefined" ? Object : import_config2.ConfigService,
     typeof import_jwt.JwtService === "undefined" ? Object : import_jwt.JwtService,
     typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
     typeof RequestService === "undefined" ? Object : RequestService
@@ -703,14 +769,14 @@ var AuthConfigModule = class _AuthConfigModule {
     return {
       module: _AuthConfigModule,
       imports: [
-        import_config2.ConfigModule,
+        import_config4.ConfigModule,
         RequestModule,
         import_jwt2.JwtModule.registerAsync({
           imports: [
-            import_config2.ConfigModule
+            import_config4.ConfigModule
           ],
           inject: [
-            import_config2.ConfigService
+            import_config4.ConfigService
           ],
           useFactory: /* @__PURE__ */ __name((config) => ({
             secret: config.get("JWT_SECRET"),
@@ -1309,6 +1375,10 @@ DatabaseModule = _ts_decorate10([
 // src/database/repositories/primary-base.repository.ts
 var import_common11 = require("@nestjs/common");
 var import_drizzle_orm2 = require("drizzle-orm");
+function snakeToCamel(str) {
+  return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+__name(snakeToCamel, "snakeToCamel");
 var PrimaryBaseRepository = class {
   static {
     __name(this, "PrimaryBaseRepository");
@@ -1318,7 +1388,8 @@ var PrimaryBaseRepository = class {
   logger;
   /**
   * The table name extracted from the Drizzle table at runtime.
-  * Used to access the query API for this repository's table.
+  * Stored in camelCase to match Drizzle's query object keys.
+  * Example: 'email_verifications' -> 'emailVerifications'
   */
   tableName;
   /**
@@ -1371,10 +1442,11 @@ var PrimaryBaseRepository = class {
   constructor(database, table) {
     this.database = database;
     this.table = table;
-    this.tableName = (0, import_drizzle_orm2.getTableName)(table);
+    const dbTableName = (0, import_drizzle_orm2.getTableName)(table);
+    this.tableName = snakeToCamel(dbTableName);
     this.logger = new import_common11.Logger(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
-    this.logger.debug(`Table name from getTableName: '${this.tableName}'`);
+    this.logger.debug(`Table name: '${dbTableName}' -> query key: '${this.tableName}'`);
   }
   /**
   * Create a new record
@@ -3414,11 +3486,19 @@ LoggerModule = _ts_decorate17([
   ValidationException,
   VrittiAuthGuard,
   addCorrelationIdToResponse,
+  configureApiSdk,
   correlationStorage,
+  defineConfig,
   generateCorrelationId,
+  getConfig,
   getCorrelationContext,
   getHttpStatusTitle,
+  getJwtExpiry,
+  getRefreshCookieOptions,
+  hashToken,
+  resetConfig,
   runWithCorrelationContext,
-  updateCorrelationContext
+  updateCorrelationContext,
+  verifyTokenHash
 });
 //# sourceMappingURL=index.cjs.map