@vritti/api-sdk 0.1.1 → 0.1.2

package/dist/index.js

@@ -1,6 +1,93 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
+// src/config/index.ts
+var defaultConfig = {
+  cookie: {
+    refreshCookieName: "vritti_refresh",
+    refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1e3,
+    refreshCookiePath: "/",
+    refreshCookieSecure: process.env.NODE_ENV === "production",
+    refreshCookieSameSite: "strict"
+  },
+  jwt: {
+    accessTokenExpiry: "15m",
+    refreshTokenExpiry: "30d",
+    onboardingTokenExpiry: "24h",
+    validateTokenBinding: true
+  },
+  guard: {
+    tenantHeaderName: "x-tenant-id",
+    authHeaderName: "authorization",
+    tokenPrefix: "Bearer"
+  }
+};
+var currentConfig = {
+  ...defaultConfig
+};
+function defineConfig(config) {
+  return config;
+}
+__name(defineConfig, "defineConfig");
+function configureApiSdk(userConfig) {
+  currentConfig = {
+    cookie: {
+      ...defaultConfig.cookie,
+      ...userConfig.cookie || {}
+    },
+    jwt: {
+      ...defaultConfig.jwt,
+      ...userConfig.jwt || {}
+    },
+    guard: {
+      ...defaultConfig.guard,
+      ...userConfig.guard || {}
+    }
+  };
+}
+__name(configureApiSdk, "configureApiSdk");
+function getConfig() {
+  return currentConfig;
+}
+__name(getConfig, "getConfig");
+function resetConfig() {
+  currentConfig = {
+    ...defaultConfig
+  };
+}
+__name(resetConfig, "resetConfig");
+function getRefreshCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: currentConfig.cookie.refreshCookieSecure,
+    sameSite: currentConfig.cookie.refreshCookieSameSite,
+    path: currentConfig.cookie.refreshCookiePath,
+    maxAge: currentConfig.cookie.refreshCookieMaxAge
+  };
+}
+__name(getRefreshCookieOptions, "getRefreshCookieOptions");
+function getJwtExpiry() {
+  return {
+    access: currentConfig.jwt.accessTokenExpiry,
+    refresh: currentConfig.jwt.refreshTokenExpiry,
+    onboarding: currentConfig.jwt.onboardingTokenExpiry
+  };
+}
+__name(getJwtExpiry, "getJwtExpiry");
+
+// src/auth/utils/token-hash.util.ts
+import * as crypto from "crypto";
+function hashToken(token) {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+__name(hashToken, "hashToken");
+function verifyTokenHash(token, expectedHash) {
+  const computedHash = hashToken(token);
+  if (computedHash.length !== expectedHash.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(computedHash, "hex"), Buffer.from(expectedHash, "hex"));
+}
+__name(verifyTokenHash, "verifyTokenHash");
+
 // src/auth/auth-config.module.ts
 import { Global as Global2, Module as Module2 } from "@nestjs/common";
 import { ConfigModule, ConfigService as ConfigService2 } from "@nestjs/config";
@@ -64,17 +151,18 @@ var RequestService = class {
     return type === "Bearer" && token ? token : null;
   }
   /**
-  * Extract refresh token from session-id cookie
-  * Cookie name: session-id
+  * Extract refresh token from httpOnly cookie
+  * Cookie name is configurable via api-sdk config
   * @returns Refresh token or null if not found
   */
   getRefreshToken() {
     try {
       const cookies = this.request.cookies;
       if (cookies && typeof cookies === "object") {
-        const sessionId = cookies["session-id"];
-        if (sessionId) {
-          return sessionId;
+        const config = getConfig();
+        const refreshToken = cookies[config.cookie.refreshCookieName];
+        if (refreshToken) {
+          return refreshToken;
         }
       }
       return null;
@@ -139,7 +227,6 @@ import { Injectable as Injectable3, Logger as Logger2, Scope as Scope2, Unauthor
 import { ConfigService } from "@nestjs/config";
 import { Reflector } from "@nestjs/core";
 import { JwtService } from "@nestjs/jwt";
-import * as jwt from "jsonwebtoken";
 
 // src/database/services/primary-database.service.ts
 import { Inject as Inject2, Injectable as Injectable2, InternalServerErrorException, Logger } from "@nestjs/common";
@@ -439,6 +526,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
         }
         const validatedToken2 = this.validateAccessToken(accessToken);
         this.logger.debug("Onboarding token validated successfully");
+        this.validateRefreshTokenBinding(context, validatedToken2);
         const userId2 = validatedToken2.userId;
         request.user = {
           id: userId2
@@ -451,13 +539,7 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
       }
       const validatedToken = this.validateAccessToken(accessToken);
       this.logger.debug("Access token validated successfully");
-      const refreshToken = this.requestService.getRefreshToken();
-      if (!refreshToken) {
-        this.logger.warn("Refresh token (session-id) not found in cookies");
-        throw new UnauthorizedException("Refresh token not found");
-      }
-      this.validateRefreshToken(refreshToken);
-      this.logger.debug("Refresh token validated successfully");
+      this.validateRefreshTokenBinding(context, validatedToken);
       const userId = validatedToken.userId;
       request.user = {
         id: userId
@@ -528,60 +610,36 @@ var VrittiAuthGuard = class _VrittiAuthGuard {
     }
   }
   /**
-  * Validate refresh token with proper expiry checks
-  * Throws UnauthorizedException if token is invalid or expired
-  */
-  validateRefreshToken(token) {
-    const jwtSecret = this.configService.get("JWT_REFRESH_SECRET") || this.configService.get("JWT_SECRET");
-    this.validateRefreshTokenWithSecret(token, jwtSecret);
-  }
-  /**
-  * Helper to validate refresh token with specific secret
+  * Validate that the access token is bound to the refresh token in the cookie.
+  * This prevents token theft - a stolen access token is useless without the
+  * corresponding refresh token cookie.
+  *
+  * @param context - The execution context containing the request
+  * @param validatedToken - The decoded and validated JWT token
+  * @throws UnauthorizedException if token binding validation fails
   */
-  validateRefreshTokenWithSecret(token, secret) {
-    if (!secret) {
-      this.logger.error("JWT secret not configured for refresh token validation");
-      throw new UnauthorizedException("Server configuration error");
+  validateRefreshTokenBinding(context, validatedToken) {
+    const config = getConfig();
+    if (!config.jwt.validateTokenBinding) {
+      this.logger.debug("Token binding validation is disabled");
+      return;
     }
-    try {
-      const decoded = jwt.verify(token, secret, {
-        algorithms: [
-          "HS256",
-          "HS512",
-          "RS256"
-        ]
-      });
-      this.logger.debug(`Refresh token decoded for user: ${decoded.userId}`);
-      if (decoded.exp) {
-        const expiryTime = decoded.exp * 1e3;
-        const currentTime = Date.now();
-        if (currentTime > expiryTime) {
-          this.logger.warn("Refresh token has expired");
-          throw new UnauthorizedException("Refresh token has expired. Please login again");
-        }
-        const timeRemaining = expiryTime - currentTime;
-        this.logger.debug(`Refresh token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
-      }
-    } catch (error) {
-      if (error instanceof UnauthorizedException) {
-        throw error;
-      }
-      const jwtError = error;
-      if (jwtError?.name === "TokenExpiredError") {
-        this.logger.warn(`Refresh token expired at: ${jwtError?.expiredAt}`);
-        throw new UnauthorizedException("Refresh token has expired. Please login again");
-      }
-      if (jwtError?.name === "JsonWebTokenError") {
-        this.logger.warn(`Refresh token verification failed: ${jwtError?.message}`);
-        throw new UnauthorizedException("Invalid refresh token");
-      }
-      if (jwtError?.name === "NotBeforeError") {
-        this.logger.warn("Refresh token used before valid (nbf claim)");
-        throw new UnauthorizedException("Refresh token not yet valid");
-      }
-      this.logger.error("Unexpected error validating refresh token", error);
-      throw new UnauthorizedException("Refresh token validation failed");
+    if (!validatedToken.refreshTokenHash) {
+      this.logger.debug("Token does not contain refreshTokenHash, skipping binding validation");
+      return;
+    }
+    const request = context.switchToHttp().getRequest();
+    const cookies = request.cookies || {};
+    const refreshToken = cookies[config.cookie.refreshCookieName];
+    if (!refreshToken) {
+      this.logger.warn("Session validation failed - refresh token cookie not found");
+      throw new UnauthorizedException("Session validation failed");
     }
+    if (!verifyTokenHash(refreshToken, validatedToken.refreshTokenHash)) {
+      this.logger.warn("Session validation failed - token binding mismatch");
+      throw new UnauthorizedException("Session validation failed");
+    }
+    this.logger.debug("Token binding validated successfully");
   }
 };
 VrittiAuthGuard = _ts_decorate4([
@@ -1230,6 +1288,10 @@ DatabaseModule = _ts_decorate10([
 // src/database/repositories/primary-base.repository.ts
 import { Logger as Logger6 } from "@nestjs/common";
 import { eq as eq2, sql, getTableName } from "drizzle-orm";
+function snakeToCamel(str) {
+  return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+__name(snakeToCamel, "snakeToCamel");
 var PrimaryBaseRepository = class {
   static {
     __name(this, "PrimaryBaseRepository");
@@ -1239,7 +1301,8 @@ var PrimaryBaseRepository = class {
   logger;
   /**
   * The table name extracted from the Drizzle table at runtime.
-  * Used to access the query API for this repository's table.
+  * Stored in camelCase to match Drizzle's query object keys.
+  * Example: 'email_verifications' -> 'emailVerifications'
   */
   tableName;
   /**
@@ -1292,10 +1355,11 @@ var PrimaryBaseRepository = class {
   constructor(database, table) {
     this.database = database;
     this.table = table;
-    this.tableName = getTableName(table);
+    const dbTableName = getTableName(table);
+    this.tableName = snakeToCamel(dbTableName);
     this.logger = new Logger6(this.constructor.name);
     this.logger.debug(`Initialized ${this.constructor.name}`);
-    this.logger.debug(`Table name from getTableName: '${this.tableName}'`);
+    this.logger.debug(`Table name: '${dbTableName}' -> query key: '${this.tableName}'`);
   }
   /**
   * Create a new record
@@ -3334,11 +3398,19 @@ export {
   ValidationException,
   VrittiAuthGuard,
   addCorrelationIdToResponse,
+  configureApiSdk,
   correlationStorage,
+  defineConfig,
   generateCorrelationId,
+  getConfig,
   getCorrelationContext,
   getHttpStatusTitle,
+  getJwtExpiry,
+  getRefreshCookieOptions,
+  hashToken,
+  resetConfig,
   runWithCorrelationContext,
-  updateCorrelationContext
+  updateCorrelationContext,
+  verifyTokenHash
 };
 //# sourceMappingURL=index.js.map