@vritti/api-sdk 0.3.2 → 0.3.5

package/dist/auth.cjs

@@ -0,0 +1,942 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/auth/index.ts
+var auth_exports = {};
+__export(auth_exports, {
+  AUTH_CONFIG: () => AUTH_CONFIG,
+  AUTH_CONFIG_DEFAULTS: () => AUTH_CONFIG_DEFAULTS,
+  AccessToken: () => AccessToken,
+  AuthConfigModule: () => AuthConfigModule,
+  ClientIp: () => ClientIp,
+  CookieDomain: () => CookieDomain,
+  CookieName: () => CookieName,
+  Hostname: () => Hostname,
+  Public: () => Public,
+  REQUIRE_SESSION_KEY: () => REQUIRE_SESSION_KEY,
+  RefreshCookieOptions: () => RefreshCookieOptions,
+  RefreshTokenCookie: () => RefreshTokenCookie,
+  RequireSession: () => RequireSession,
+  SKIP_CSRF_KEY: () => SKIP_CSRF_KEY,
+  SessionData: () => SessionData,
+  SkipCsrf: () => SkipCsrf,
+  Subdomain: () => Subdomain,
+  TokenService: () => TokenService,
+  TokenType: () => TokenType,
+  UserAgent: () => UserAgent,
+  UserId: () => UserId,
+  VrittiAuthGuard: () => VrittiAuthGuard,
+  hashToken: () => hashToken,
+  verifyTokenHash: () => verifyTokenHash
+});
+module.exports = __toCommonJS(auth_exports);
+
+// src/auth/auth.config.ts
+var AUTH_CONFIG = Symbol("AUTH_CONFIG");
+var AUTH_CONFIG_DEFAULTS = {
+  cookie: {
+    refreshCookieName: "vritti_refresh",
+    refreshCookieMaxAge: 30 * 24 * 60 * 60 * 1e3,
+    refreshCookiePath: "/",
+    refreshCookieSecure: process.env.NODE_ENV === "production",
+    refreshCookieSameSite: "strict",
+    refreshCookieDomain: "localhost"
+  },
+  guard: {
+    authHeaderName: "authorization",
+    tokenPrefix: "Bearer",
+    csrfExemptSessionTypes: [],
+    csrfExemptTransports: [],
+    refreshTokenBindingExemptSessionTypes: []
+  }
+};
+var TokenType = /* @__PURE__ */ (function(TokenType2) {
+  TokenType2["ACCESS"] = "access";
+  TokenType2["REFRESH"] = "refresh";
+  return TokenType2;
+})({});
+
+// src/auth/auth-config.module.ts
+var import_common7 = require("@nestjs/common");
+var import_config = require("@nestjs/config");
+var import_core3 = require("@nestjs/core");
+var import_jwt2 = require("@nestjs/jwt");
+
+// src/request/request.module.ts
+var import_common2 = require("@nestjs/common");
+
+// src/request/services/request.service.ts
+var import_common = require("@nestjs/common");
+var import_core = require("@nestjs/core");
+
+// src/context/resolve-request.ts
+function resolveInjectedRequest(injected) {
+  const candidate = injected;
+  if (candidate && candidate.headers === void 0 && candidate.req) {
+    return candidate.req;
+  }
+  return injected;
+}
+__name(resolveInjectedRequest, "resolveInjectedRequest");
+
+// src/request/services/request.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var RequestService = class {
+  static {
+    __name(this, "RequestService");
+  }
+  injectedRequest;
+  config;
+  constructor(injectedRequest, config) {
+    this.injectedRequest = injectedRequest;
+    this.config = config;
+  }
+  // Unwraps the GraphQL { req, reply } context wrapper so every accessor below works across both transports
+  get request() {
+    return resolveInjectedRequest(this.injectedRequest);
+  }
+  // Extracts the bearer access token from the Authorization header
+  getAccessToken() {
+    const authHeader = this.request.headers?.[this.config.guard.authHeaderName];
+    if (!authHeader || typeof authHeader !== "string") {
+      return null;
+    }
+    const [type, token] = authHeader.split(" ") ?? [];
+    return type === this.config.guard.tokenPrefix && token ? token : null;
+  }
+  // Extracts the refresh token from the configured httpOnly cookie
+  getRefreshToken() {
+    try {
+      const cookies = this.request.cookies;
+      if (cookies && typeof cookies === "object") {
+        const refreshToken = cookies[this.config.cookie.refreshCookieName];
+        if (refreshToken) {
+          return refreshToken;
+        }
+      }
+      return null;
+    } catch (_error) {
+      return null;
+    }
+  }
+  // Returns the value of a specific request header by key
+  getHeader(key) {
+    return this.request.headers?.[key];
+  }
+  // Returns the request hostname (without port)
+  getHostname() {
+    return this.request.hostname ?? "";
+  }
+  // Returns all request headers
+  getAllHeaders() {
+    return this.request.headers || {};
+  }
+};
+RequestService = _ts_decorate([
+  (0, import_common.Injectable)({
+    scope: import_common.Scope.REQUEST
+  }),
+  _ts_param(0, (0, import_common.Inject)(import_core.REQUEST)),
+  _ts_param(1, (0, import_common.Inject)(AUTH_CONFIG)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof FastifyRequest === "undefined" ? Object : FastifyRequest,
+    typeof AuthConfig === "undefined" ? Object : AuthConfig
+  ])
+], RequestService);
+
+// src/request/request.module.ts
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+var RequestModule = class {
+  static {
+    __name(this, "RequestModule");
+  }
+};
+RequestModule = _ts_decorate2([
+  (0, import_common2.Global)(),
+  (0, import_common2.Module)({
+    providers: [
+      RequestService
+    ],
+    exports: [
+      RequestService
+    ]
+  })
+], RequestModule);
+
+// src/auth/guards/vritti-auth.guard.ts
+var import_common6 = require("@nestjs/common");
+var import_constants = require("@nestjs/common/constants");
+var import_core2 = require("@nestjs/core");
+
+// src/context/extractors/graphql.extractor.ts
+var graphqlExtractor = {
+  getRequest: /* @__PURE__ */ __name((host) => host.getArgByIndex(2).req, "getRequest"),
+  getResponse: /* @__PURE__ */ __name((host) => host.getArgByIndex(2).reply, "getResponse")
+};
+
+// src/context/extractors/http.extractor.ts
+var httpExtractor = {
+  getRequest: /* @__PURE__ */ __name((host) => host.switchToHttp().getRequest(), "getRequest"),
+  getResponse: /* @__PURE__ */ __name((host) => host.switchToHttp().getResponse(), "getResponse")
+};
+
+// src/context/context.registry.ts
+var registry = /* @__PURE__ */ new Map([
+  [
+    "http",
+    httpExtractor
+  ],
+  [
+    "graphql",
+    graphqlExtractor
+  ]
+]);
+function resolveExtractor(type) {
+  return registry.get(type) ?? httpExtractor;
+}
+__name(resolveExtractor, "resolveExtractor");
+
+// src/context/get-request.ts
+function getRequestFromContext(host) {
+  return resolveExtractor(host.getType()).getRequest(host);
+}
+__name(getRequestFromContext, "getRequestFromContext");
+
+// src/context/get-response.ts
+function getResponseFromContext(host) {
+  return resolveExtractor(host.getType()).getResponse(host);
+}
+__name(getResponseFromContext, "getResponseFromContext");
+
+// src/auth/decorators/require-session.decorator.ts
+var import_common3 = require("@nestjs/common");
+var REQUIRE_SESSION_KEY = "requiredSessionTypes";
+var RequireSession = /* @__PURE__ */ __name((...types) => (0, import_common3.SetMetadata)(REQUIRE_SESSION_KEY, types), "RequireSession");
+
+// src/auth/decorators/skip-csrf.decorator.ts
+var import_common4 = require("@nestjs/common");
+var SKIP_CSRF_KEY = "skipCsrf";
+var SkipCsrf = /* @__PURE__ */ __name(() => (0, import_common4.SetMetadata)(SKIP_CSRF_KEY, true), "SkipCsrf");
+
+// src/auth/services/token.service.ts
+var import_common5 = require("@nestjs/common");
+var import_jwt = require("@nestjs/jwt");
+
+// src/utils/time.utils.ts
+function parseExpiryToMs(expiry) {
+  const match = expiry.match(/^(\d+)([smhdwy])$/);
+  if (!match) throw new Error(`Invalid expiry format: ${expiry}`);
+  const [, digits = "", unit = ""] = match;
+  const value = Number.parseInt(digits, 10);
+  const multipliers = {
+    s: 1e3,
+    m: 6e4,
+    h: 36e5,
+    d: 864e5,
+    w: 6048e5,
+    y: 31536e6
+  };
+  const multiplier = multipliers[unit];
+  if (multiplier === void 0) throw new Error(`Invalid expiry format: ${expiry}`);
+  return value * multiplier;
+}
+__name(parseExpiryToMs, "parseExpiryToMs");
+
+// src/auth/utils/token-hash.util.ts
+var crypto = __toESM(require("crypto"), 1);
+function hashToken(token) {
+  return crypto.createHash("sha256").update(token).digest("hex");
+}
+__name(hashToken, "hashToken");
+function verifyTokenHash(token, expectedHash) {
+  const computedHash = hashToken(token);
+  if (computedHash.length !== expectedHash.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(computedHash, "hex"), Buffer.from(expectedHash, "hex"));
+}
+__name(verifyTokenHash, "verifyTokenHash");
+
+// src/auth/services/token.service.ts
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var TokenService = class _TokenService {
+  static {
+    __name(this, "TokenService");
+  }
+  jwtService;
+  config;
+  logger = new import_common5.Logger(_TokenService.name);
+  constructor(jwtService, config) {
+    this.jwtService = jwtService;
+    this.config = config;
+  }
+  // ---- Generation ----
+  // Generates an access token bound to the given refresh token
+  generateAccessToken(sessionInfo, refreshToken) {
+    const { userId, sessionId, sessionType, ...metadata } = sessionInfo;
+    return this.jwtService.sign({
+      sessionType,
+      tokenType: TokenType.ACCESS,
+      userId,
+      sessionId,
+      refreshTokenHash: hashToken(refreshToken),
+      ...metadata
+    }, {
+      expiresIn: this.config.tokenExpiry.access
+    });
+  }
+  // Generates a refresh token for session persistence
+  generateRefreshToken(sessionInfo) {
+    const { userId, sessionId, sessionType, ...metadata } = sessionInfo;
+    return this.jwtService.sign({
+      sessionType,
+      tokenType: TokenType.REFRESH,
+      userId,
+      sessionId,
+      ...metadata
+    }, {
+      expiresIn: this.config.tokenExpiry.refresh
+    });
+  }
+  // Signs an arbitrary payload with optional JWT options
+  sign(payload, options) {
+    return this.jwtService.sign(payload, options);
+  }
+  // Verifies a token and ensures it matches the expected token type
+  verify(token, expectedType) {
+    try {
+      const payload = this.jwtService.verify(token);
+      if (payload.tokenType !== expectedType) {
+        throw new Error(`Expected ${expectedType} token, got ${payload.tokenType}`);
+      }
+      return payload;
+    } catch (error) {
+      this.logger.error(`Failed to verify ${expectedType} token`, error);
+      throw error;
+    }
+  }
+  // Returns the expiry as a Date for the given token type
+  getExpiryTime(type) {
+    return new Date(Date.now() + parseExpiryToMs(this.config.tokenExpiry[type]));
+  }
+  // Returns the token lifetime in seconds for the given type
+  getExpiryInSeconds(type) {
+    return Math.floor(parseExpiryToMs(this.config.tokenExpiry[type]) / 1e3);
+  }
+  // ---- Validation ----
+  // Decodes and validates an access token JWT
+  validateAccessToken(token) {
+    try {
+      const decoded = this.jwtService.verify(token);
+      if (decoded.tokenType !== TokenType.ACCESS) {
+        throw new import_common5.UnauthorizedException("Invalid token type");
+      }
+      return decoded;
+    } catch (error) {
+      if (error instanceof import_common5.UnauthorizedException) throw error;
+      const jwtError = error;
+      switch (jwtError.name) {
+        case "TokenExpiredError":
+          throw new import_common5.UnauthorizedException("Access token has expired");
+        case "JsonWebTokenError":
+          throw new import_common5.UnauthorizedException("Invalid access token");
+        case "NotBeforeError":
+          throw new import_common5.UnauthorizedException("Access token not yet valid");
+        default:
+          throw new import_common5.UnauthorizedException("Access token validation failed");
+      }
+    }
+  }
+  // Decodes and validates a refresh token JWT
+  validateRefreshToken(token) {
+    try {
+      const decoded = this.jwtService.verify(token);
+      if (decoded.tokenType !== TokenType.REFRESH) {
+        throw new import_common5.UnauthorizedException("Invalid token type");
+      }
+      return decoded;
+    } catch (error) {
+      if (error instanceof import_common5.UnauthorizedException) throw error;
+      throw new import_common5.UnauthorizedException("Invalid or expired session");
+    }
+  }
+  // Validates that the access token is bound to the refresh token
+  validateTokenBinding(accessToken, refreshToken) {
+    if (!verifyTokenHash(refreshToken, accessToken.refreshTokenHash)) {
+      throw new import_common5.UnauthorizedException("Session validation failed");
+    }
+  }
+};
+TokenService = _ts_decorate3([
+  (0, import_common5.Injectable)(),
+  _ts_param2(1, (0, import_common5.Inject)(AUTH_CONFIG)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof import_jwt.JwtService === "undefined" ? Object : import_jwt.JwtService,
+    typeof AuthConfig === "undefined" ? Object : AuthConfig
+  ])
+], TokenService);
+
+// src/auth/guards/vritti-auth.guard.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var VrittiAuthGuard = class _VrittiAuthGuard {
+  static {
+    __name(this, "VrittiAuthGuard");
+  }
+  reflector;
+  requestService;
+  tokenService;
+  config;
+  logger = new import_common6.Logger(_VrittiAuthGuard.name);
+  constructor(reflector, requestService, tokenService, config) {
+    this.reflector = reflector;
+    this.requestService = requestService;
+    this.tokenService = tokenService;
+    this.config = config;
+  }
+  async canActivate(context) {
+    const request = getRequestFromContext(context);
+    const reply = getResponseFromContext(context);
+    const route = `${request.method} ${request.url}`;
+    request.authConfig = this.config;
+    const csrfExemptTransports = this.config.guard.csrfExemptTransports ?? [];
+    const skipCsrf = this.reflector.getAllAndOverride(SKIP_CSRF_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]) || csrfExemptTransports.includes(context.getType());
+    const isPublic = this.reflector.getAllAndOverride("isPublic", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (isPublic) {
+      if (!skipCsrf) {
+        await this.validateCsrf(request, reply);
+      }
+      this.logger.debug(`${route} \u2014 public endpoint, skipping auth`);
+      return true;
+    }
+    const requiredSessionTypes = this.reflector.getAllAndOverride(REQUIRE_SESSION_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    const isSseEndpoint = this.reflector.get(import_constants.SSE_METADATA, context.getHandler());
+    if (isSseEndpoint) {
+      this.logger.debug(`${route} \u2014 SSE endpoint, authenticating via refresh cookie`);
+      return this.handleSseAuth(request, requiredSessionTypes);
+    }
+    const sessionType = await this.handleHttpAuth(request, requiredSessionTypes);
+    const csrfExemptSessionTypes = this.config.guard.csrfExemptSessionTypes ?? [];
+    if (!skipCsrf && !csrfExemptSessionTypes.includes(sessionType)) {
+      await this.validateCsrf(request, reply);
+    }
+    return true;
+  }
+  // Authenticates standard HTTP requests using the access token from Authorization header
+  async handleHttpAuth(request, requiredSessionTypes) {
+    const route = `${request.method} ${request.url}`;
+    const accessToken = this.requestService.getAccessToken();
+    if (!accessToken) {
+      this.logger.warn(`${route} \u2014 no access token found`);
+      throw new import_common6.UnauthorizedException("Access token not found");
+    }
+    const decoded = this.tokenService.validateAccessToken(accessToken);
+    const refreshTokenBindingExemptSessionTypes = this.config.guard.refreshTokenBindingExemptSessionTypes ?? [];
+    if (!refreshTokenBindingExemptSessionTypes.includes(decoded.sessionType)) {
+      const refreshToken = this.requestService.getRefreshToken();
+      if (!refreshToken) {
+        throw new import_common6.UnauthorizedException("Session validation failed");
+      }
+      this.tokenService.validateTokenBinding(decoded, refreshToken);
+    }
+    if (requiredSessionTypes?.length && !requiredSessionTypes.includes(decoded.sessionType)) {
+      this.logger.warn(`${route} \u2014 session type ${decoded.sessionType} not in allowed: [${requiredSessionTypes.join(", ")}]`);
+      throw new import_common6.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
+    }
+    const { tokenType: _tokenType, refreshTokenHash: _hash, exp: _exp, iat: _iat, ...sessionInfo } = decoded;
+    request.sessionInfo = sessionInfo;
+    const onAuthenticated = this.config.guard.onAuthenticated;
+    if (onAuthenticated) {
+      await onAuthenticated(this.requestService, request.sessionInfo);
+    }
+    this.logger.debug(`${route} \u2014 authenticated user: ${decoded.userId} (${decoded.sessionType})`);
+    return decoded.sessionType;
+  }
+  // Authenticates SSE connections using the refresh token httpOnly cookie
+  handleSseAuth(request, requiredSessionTypes) {
+    const refreshToken = this.requestService.getRefreshToken();
+    if (!refreshToken) {
+      this.logger.warn(`SSE ${request.url} \u2014 no refresh token cookie`);
+      throw new import_common6.UnauthorizedException("Authentication required");
+    }
+    const decoded = this.tokenService.validateRefreshToken(refreshToken);
+    if (requiredSessionTypes?.length && !requiredSessionTypes.includes(decoded.sessionType)) {
+      this.logger.warn(`SSE ${request.url} \u2014 session type ${decoded.sessionType} not allowed`);
+      throw new import_common6.UnauthorizedException(`${decoded.sessionType} sessions cannot access this endpoint`);
+    }
+    const { tokenType: _tokenType, exp: _exp, iat: _iat, ...sessionInfo } = decoded;
+    request.sessionInfo = sessionInfo;
+    this.logger.debug(`SSE ${request.url} \u2014 authenticated user: ${decoded.userId} (${decoded.sessionType})`);
+    return true;
+  }
+  // Validates CSRF token for state-changing requests
+  async validateCsrf(request, reply) {
+    const safeMethods = [
+      "GET",
+      "HEAD",
+      "OPTIONS"
+    ];
+    if (safeMethods.includes(request.method)) return;
+    try {
+      const fastifyInstance = request.server;
+      const csrfProtection = fastifyInstance.csrfProtection;
+      if (!csrfProtection) {
+        throw new import_common6.ForbiddenException("CSRF protection not configured");
+      }
+      await new Promise((resolve, reject) => {
+        const originalSend = reply.send.bind(reply);
+        reply.send = () => {
+          reply.send = originalSend;
+          reject(new Error("CSRF validation failed"));
+          return reply;
+        };
+        csrfProtection(request, reply, (err) => {
+          reply.send = originalSend;
+          if (err) reject(err);
+          else resolve();
+        });
+      });
+    } catch (_error) {
+      this.logger.warn(`${request.method} ${request.url} \u2014 CSRF validation failed`);
+      throw new import_common6.ForbiddenException({
+        errors: [
+          {
+            field: "csrf",
+            message: "Invalid or missing CSRF token"
+          }
+        ],
+        message: "CSRF validation failed"
+      });
+    }
+  }
+};
+VrittiAuthGuard = _ts_decorate4([
+  (0, import_common6.Injectable)({
+    scope: import_common6.Scope.REQUEST
+  }),
+  _ts_param3(3, (0, import_common6.Inject)(AUTH_CONFIG)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof import_core2.Reflector === "undefined" ? Object : import_core2.Reflector,
+    typeof RequestService === "undefined" ? Object : RequestService,
+    typeof TokenService === "undefined" ? Object : TokenService,
+    typeof AuthConfig === "undefined" ? Object : AuthConfig
+  ])
+], VrittiAuthGuard);
+
+// src/auth/auth-config.module.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+function mergeWithDefaults(input) {
+  return {
+    tokenExpiry: input.tokenExpiry,
+    cookie: {
+      ...AUTH_CONFIG_DEFAULTS.cookie,
+      ...input.cookie ?? {}
+    },
+    guard: {
+      ...AUTH_CONFIG_DEFAULTS.guard,
+      ...input.guard ?? {}
+    }
+  };
+}
+__name(mergeWithDefaults, "mergeWithDefaults");
+var AuthConfigModule = class _AuthConfigModule {
+  static {
+    __name(this, "AuthConfigModule");
+  }
+  // Registers JWT, TokenService, and global VrittiAuthGuard
+  static forRootAsync(options) {
+    return {
+      module: _AuthConfigModule,
+      imports: [
+        import_config.ConfigModule,
+        RequestModule,
+        import_jwt2.JwtModule.registerAsync({
+          imports: [
+            import_config.ConfigModule
+          ],
+          inject: [
+            import_config.ConfigService
+          ],
+          useFactory: /* @__PURE__ */ __name((config) => ({
+            secret: config.getOrThrow("JWT_SECRET"),
+            signOptions: {
+              algorithm: "HS256"
+            }
+          }), "useFactory")
+        })
+      ],
+      providers: [
+        {
+          provide: import_core3.Reflector,
+          useClass: import_core3.Reflector
+        },
+        {
+          provide: import_core3.APP_GUARD,
+          useClass: VrittiAuthGuard
+        },
+        {
+          provide: AUTH_CONFIG,
+          useFactory: /* @__PURE__ */ __name(async (...args) => {
+            const input = await options.useFactory(...args);
+            return mergeWithDefaults(input);
+          }, "useFactory"),
+          inject: options.inject || []
+        },
+        TokenService
+      ],
+      exports: [
+        import_jwt2.JwtModule,
+        TokenService,
+        AUTH_CONFIG
+      ]
+    };
+  }
+};
+AuthConfigModule = _ts_decorate5([
+  (0, import_common7.Global)(),
+  (0, import_common7.Module)({})
+], AuthConfigModule);
+
+// src/auth/decorators/access-token.decorator.ts
+var import_common8 = require("@nestjs/common");
+var AccessToken = (0, import_common8.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  const authHeader = request.headers.authorization;
+  return authHeader?.replace("Bearer ", "") || "";
+});
+
+// src/auth/decorators/client-ip.decorator.ts
+var import_common9 = require("@nestjs/common");
+var ClientIp = (0, import_common9.createParamDecorator)((_data, ctx) => {
+  return getRequestFromContext(ctx).ip;
+});
+
+// src/auth/decorators/cookie-domain.decorator.ts
+var import_common10 = require("@nestjs/common");
+var CookieDomain = (0, import_common10.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  const forwarded = request.headers["x-forwarded-host"];
+  const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+  const hostStr = raw ?? request.hostname;
+  const domain = hostStr.split(":")[0] ?? hostStr;
+  const baseDomain = request.authConfig?.cookie.refreshCookieDomain ?? AUTH_CONFIG_DEFAULTS.cookie.refreshCookieDomain ?? "";
+  return domain.endsWith(`.${baseDomain}`) ? domain : baseDomain;
+});
+
+// src/auth/decorators/cookie-name.decorator.ts
+var import_common11 = require("@nestjs/common");
+var CookieName = (0, import_common11.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  return request.authConfig?.cookie.refreshCookieName ?? AUTH_CONFIG_DEFAULTS.cookie.refreshCookieName;
+});
+
+// src/auth/decorators/hostname.decorator.ts
+var import_common12 = require("@nestjs/common");
+var Hostname = (0, import_common12.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  const forwarded = request.headers["x-forwarded-host"];
+  const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+  const hostStr = raw ?? request.hostname;
+  return hostStr.split(":")[0] ?? hostStr;
+});
+
+// src/auth/decorators/public.decorator.ts
+var import_common13 = require("@nestjs/common");
+var Public = /* @__PURE__ */ __name(() => (0, import_common13.SetMetadata)("isPublic", true), "Public");
+
+// src/auth/decorators/refresh-cookie-options.decorator.ts
+var import_common33 = require("@nestjs/common");
+
+// src/exceptions/bad-gateway.exception.ts
+var import_common15 = require("@nestjs/common");
+
+// src/exceptions/base-field.exception.ts
+var import_common14 = require("@nestjs/common");
+var HttpProblemException = class extends import_common14.HttpException {
+  static {
+    __name(this, "HttpProblemException");
+  }
+  constructor(detailOrOptions, httpStatus) {
+    const options = typeof detailOrOptions === "string" ? {
+      detail: detailOrOptions
+    } : detailOrOptions;
+    super({
+      type: options.type ?? "about:blank",
+      label: options.label,
+      detail: options.detail,
+      errors: options.errors ?? []
+    }, httpStatus);
+  }
+};
+
+// src/exceptions/bad-request.exception.ts
+var import_common16 = require("@nestjs/common");
+
+// src/exceptions/conflict.exception.ts
+var import_common17 = require("@nestjs/common");
+
+// src/exceptions/forbidden.exception.ts
+var import_common18 = require("@nestjs/common");
+
+// src/exceptions/gone.exception.ts
+var import_common19 = require("@nestjs/common");
+
+// src/exceptions/internal-server-error.exception.ts
+var import_common20 = require("@nestjs/common");
+
+// src/exceptions/method-not-allowed.exception.ts
+var import_common21 = require("@nestjs/common");
+
+// src/exceptions/not-acceptable.exception.ts
+var import_common22 = require("@nestjs/common");
+
+// src/exceptions/not-found.exception.ts
+var import_common23 = require("@nestjs/common");
+
+// src/exceptions/not-implemented.exception.ts
+var import_common24 = require("@nestjs/common");
+
+// src/exceptions/payload-too-large.exception.ts
+var import_common25 = require("@nestjs/common");
+
+// src/exceptions/request-timeout.exception.ts
+var import_common26 = require("@nestjs/common");
+
+// src/exceptions/service-unavailable.exception.ts
+var import_common27 = require("@nestjs/common");
+
+// src/exceptions/too-many-requests.exception.ts
+var import_common28 = require("@nestjs/common");
+
+// src/exceptions/unauthorized.exception.ts
+var import_common29 = require("@nestjs/common");
+var UnauthorizedException3 = class extends HttpProblemException {
+  static {
+    __name(this, "UnauthorizedException");
+  }
+  constructor(detailOrOptions) {
+    super(detailOrOptions ?? "Unauthorized", import_common29.HttpStatus.UNAUTHORIZED);
+  }
+};
+
+// src/exceptions/unprocessable-entity.exception.ts
+var import_common30 = require("@nestjs/common");
+
+// src/exceptions/unsupported-media-type.exception.ts
+var import_common31 = require("@nestjs/common");
+
+// src/exceptions/validation.exception.ts
+var import_common32 = require("@nestjs/common");
+
+// src/auth/decorators/refresh-cookie-options.decorator.ts
+function buildCookieOptionsForHost(cookieConfig, hostname) {
+  const baseDomain = cookieConfig.refreshCookieDomain;
+  if (!baseDomain) {
+    throw new Error("refreshCookieDomain must be configured before using @RefreshCookieOptions()");
+  }
+  if (!hostname.endsWith(`.${baseDomain}`)) {
+    throw new UnauthorizedException3("Invalid request host.");
+  }
+  return {
+    httpOnly: true,
+    secure: cookieConfig.refreshCookieSecure,
+    sameSite: cookieConfig.refreshCookieSameSite,
+    path: cookieConfig.refreshCookiePath,
+    maxAge: cookieConfig.refreshCookieMaxAge,
+    domain: hostname
+  };
+}
+__name(buildCookieOptionsForHost, "buildCookieOptionsForHost");
+var RefreshCookieOptions = (0, import_common33.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  const forwarded = request.headers["x-forwarded-host"];
+  const raw = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+  const hostStr = raw ?? request.hostname;
+  const domain = hostStr.split(":")[0] ?? hostStr;
+  const cookieConfig = request.authConfig?.cookie ?? AUTH_CONFIG_DEFAULTS.cookie;
+  return buildCookieOptionsForHost(cookieConfig, domain);
+});
+
+// src/auth/decorators/refresh-token-cookie.decorator.ts
+var import_common34 = require("@nestjs/common");
+var RefreshTokenCookie = (0, import_common34.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  const cookies = request.cookies ?? {};
+  const cookieName = request.authConfig?.cookie.refreshCookieName ?? AUTH_CONFIG_DEFAULTS.cookie.refreshCookieName;
+  return cookies[cookieName];
+});
+
+// src/auth/decorators/session-data.decorator.ts
+var import_common35 = require("@nestjs/common");
+var SessionData = (0, import_common35.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  const sessionInfo = request.sessionInfo;
+  if (!sessionInfo?.sessionId) {
+    throw new Error("Session info not found on request. Ensure route is protected by auth guard.");
+  }
+  return {
+    userId: sessionInfo.userId,
+    sessionId: sessionInfo.sessionId,
+    sessionType: sessionInfo.sessionType
+  };
+});
+
+// src/auth/decorators/subdomain.decorator.ts
+var import_common36 = require("@nestjs/common");
+var Subdomain = (0, import_common36.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  const origin = request.headers.origin;
+  if (origin) {
+    try {
+      const url = new URL(origin);
+      return url.hostname.split(".")[0];
+    } catch {
+    }
+  }
+  const forwarded = request.headers["x-forwarded-host"];
+  const host = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+  if (host) return host.split(".")[0];
+  return void 0;
+});
+
+// src/auth/decorators/user-agent.decorator.ts
+var import_common37 = require("@nestjs/common");
+var UserAgent = (0, import_common37.createParamDecorator)((_data, ctx) => {
+  const userAgent = getRequestFromContext(ctx).headers["user-agent"];
+  return Array.isArray(userAgent) ? userAgent[0] : userAgent;
+});
+
+// src/auth/decorators/user-id.decorator.ts
+var import_common38 = require("@nestjs/common");
+var UserId = (0, import_common38.createParamDecorator)((_data, ctx) => {
+  const request = getRequestFromContext(ctx);
+  const sessionInfo = request.sessionInfo;
+  if (!sessionInfo?.userId) {
+    throw new Error("User ID not found on request. Ensure route is protected by auth guard.");
+  }
+  return sessionInfo.userId;
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AUTH_CONFIG,
+  AUTH_CONFIG_DEFAULTS,
+  AccessToken,
+  AuthConfigModule,
+  ClientIp,
+  CookieDomain,
+  CookieName,
+  Hostname,
+  Public,
+  REQUIRE_SESSION_KEY,
+  RefreshCookieOptions,
+  RefreshTokenCookie,
+  RequireSession,
+  SKIP_CSRF_KEY,
+  SessionData,
+  SkipCsrf,
+  Subdomain,
+  TokenService,
+  TokenType,
+  UserAgent,
+  UserId,
+  VrittiAuthGuard,
+  hashToken,
+  verifyTokenHash
+});
+//# sourceMappingURL=auth.cjs.map