@vynelix/nestjs-multi-auth 0.0.2

package/dist/auth/jwt-payload-interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-payload-interface.js","sourceRoot":"","sources":["../../src/auth/jwt-payload-interface.ts"],"names":[],"mappings":""}

package/dist/auth/jwt.strategy.d.ts

@@ -0,0 +1,13 @@
+import { Strategy } from 'passport-jwt';
+import { AuthModuleOptions } from './interfaces/auth-module-options.interface';
+import { JwtPayload } from './jwt-payload-interface';
+declare const JwtStrategy_base: new (...args: [opt: import("passport-jwt").StrategyOptionsWithoutRequest] | [opt: import("passport-jwt").StrategyOptionsWithRequest]) => Strategy & {
+    validate(...args: any[]): unknown;
+};
+export declare class JwtStrategy extends JwtStrategy_base {
+    private options;
+    private readonly logger;
+    constructor(options: AuthModuleOptions);
+    validate(payload: JwtPayload): Promise<any>;
+}
+export {};

package/dist/auth/jwt.strategy.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var JwtStrategy_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtStrategy = void 0;
+// src/auth/jwt.strategy.ts
+const common_1 = require("@nestjs/common");
+const passport_1 = require("@nestjs/passport");
+const passport_jwt_1 = require("passport-jwt");
+const auth_module_options_interface_1 = require("./interfaces/auth-module-options.interface");
+const common_2 = require("@nestjs/common");
+let JwtStrategy = JwtStrategy_1 = class JwtStrategy extends (0, passport_1.PassportStrategy)(passport_jwt_1.Strategy) {
+    constructor(options) {
+        const cookieExtractor = (req) => {
+            if (!req || !req.cookies) {
+                return null;
+            }
+            const cookies = req.cookies;
+            const token = cookies?.access_token ?? null;
+            return typeof token === 'string' ? token : null;
+        };
+        super({
+            jwtFromRequest: passport_jwt_1.ExtractJwt.fromExtractors([
+                cookieExtractor,
+                passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
+            ]),
+            ignoreExpiration: false,
+            secretOrKey: options.jwtSecret || process.env.JWT_SECRET || 'changeme',
+        });
+        this.options = options;
+        this.logger = new common_1.Logger(JwtStrategy_1.name);
+    }
+    async validate(payload) {
+        this.logger.log(`JWT payload: ${JSON.stringify(payload)}`);
+        // In Identity-Only mode, req.user is the token payload.
+        // The application uses the 'sub' (uid) to link to its own user record.
+        return {
+            uid: payload.sub,
+            sessionId: payload.sessionId,
+        };
+    }
+};
+exports.JwtStrategy = JwtStrategy;
+exports.JwtStrategy = JwtStrategy = JwtStrategy_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_2.Inject)(auth_module_options_interface_1.AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], JwtStrategy);
+//# sourceMappingURL=jwt.strategy.js.map

package/dist/auth/jwt.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../src/auth/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2BAA2B;AAC3B,2CAAoD;AACpD,+CAAoD;AACpD,+CAAoD;AACpD,8FAAoG;AACpG,2CAAwC;AAKjC,IAAM,WAAW,mBAAjB,MAAM,WAAY,SAAQ,IAAA,2BAAgB,EAAC,uBAAQ,CAAC;IAGzD,YAC+B,OAAkC;QAE/D,MAAM,eAAe,GAAG,CAAC,GAAY,EAAiB,EAAE;YACtD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,GAAG,CAAC,OAAwC,CAAC;YAC7D,MAAM,KAAK,GAAG,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;YAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC;QACF,KAAK,CAAC;YACJ,cAAc,EAAE,yBAAU,CAAC,cAAc,CAAC;gBACxC,eAAe;gBACf,yBAAU,CAAC,2BAA2B,EAAE;aACzC,CAAC;YACF,gBAAgB,EAAE,KAAK;YACvB,WAAW,EAAE,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,UAAU;SACvE,CAAC,CAAC;QAlBkC,YAAO,GAAP,OAAO,CAAmB;QAHhD,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAsBvD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAmB;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE3D,wDAAwD;QACxD,uEAAuE;QACvE,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;IACJ,CAAC;CACF,CAAA;AAnCY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,mDAAmB,CAAC,CAAA;;GAJnB,WAAW,CAmCvB"}

package/dist/auth/strategies/company.strategy.js

@@ -0,0 +1 @@
+//# sourceMappingURL=company.strategy.js.map

package/dist/auth/strategies/company.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"company.strategy.js","sourceRoot":"","sources":["../../../src/auth/strategies/company.strategy.ts"],"names":[],"mappings":""}

package/dist/auth/strategies/google.strategy.d.ts

@@ -0,0 +1,7 @@
+import { LoginDto } from '../dto/login.dto';
+import { SignupDto } from '../dto/signup.dto';
+import { Auth } from '../entities/auth.entity';
+export declare class GoogleAuthStrategy {
+    registerCredentials(dto: SignupDto, uid?: string): Promise<Auth>;
+    login(dto: LoginDto): Promise<Auth>;
+}

package/dist/auth/strategies/google.strategy.js

@@ -0,0 +1,23 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoogleAuthStrategy = void 0;
+const common_1 = require("@nestjs/common");
+let GoogleAuthStrategy = class GoogleAuthStrategy {
+    async registerCredentials(dto, uid) {
+        throw new Error('Not implemented');
+    }
+    async login(dto) {
+        throw new Error('Not implemented');
+    }
+};
+exports.GoogleAuthStrategy = GoogleAuthStrategy;
+exports.GoogleAuthStrategy = GoogleAuthStrategy = __decorate([
+    (0, common_1.Injectable)()
+], GoogleAuthStrategy);
+//# sourceMappingURL=google.strategy.js.map

package/dist/auth/strategies/google.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.strategy.js","sourceRoot":"","sources":["../../../src/auth/strategies/google.strategy.ts"],"names":[],"mappings":";;;;;;;;;AAEA,2CAA4C;AAMrC,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,KAAK,CAAC,mBAAmB,CAAC,GAAc,EAAE,GAAY;QAGpD,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAa;QAEvB,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;CACF,CAAA;AAXY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;GACA,kBAAkB,CAW9B"}

package/dist/auth/strategies/local-auth.strategy.d.ts

@@ -0,0 +1,24 @@
+import { DataSource, Repository } from 'typeorm';
+import { LoginDto } from '../dto/requests/login.dto';
+import { SignupDto } from '../dto/requests/signup.dto';
+import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
+import { Auth } from '../entities/auth.entity';
+import { AuthIdentifier } from '../entities/auth-identify.entity';
+export declare class LocalAuthStrategy {
+    private readonly dataSource;
+    private authRepo;
+    private identifierRepo;
+    private options;
+    constructor(dataSource: DataSource, authRepo: Repository<Auth>, identifierRepo: Repository<AuthIdentifier>, options: AuthModuleOptions);
+    private readonly logger;
+    private validatePhoneFormat;
+    private requiresPassword;
+    registerCredentials(dto: SignupDto, uid?: string): Promise<{
+        auth: Auth;
+        identifier?: AuthIdentifier;
+    }>;
+    login(dto: LoginDto): Promise<{
+        auth: Auth;
+        identifier?: AuthIdentifier;
+    }>;
+}

package/dist/auth/strategies/local-auth.strategy.js

@@ -0,0 +1,244 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var LocalAuthStrategy_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalAuthStrategy = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const typeorm_2 = require("@nestjs/typeorm");
+const bcrypt = require("bcrypt");
+const crypto = require("crypto");
+const auth_module_options_interface_1 = require("../interfaces/auth-module-options.interface");
+const common_2 = require("@nestjs/common");
+// Entities
+const auth_entity_1 = require("../entities/auth.entity");
+const auth_identify_entity_1 = require("../entities/auth-identify.entity");
+// Enums
+const auth_type_enum_1 = require("../enums/auth-type.enum"); // Ensure this path is correct
+// Services / DTOs
+let LocalAuthStrategy = LocalAuthStrategy_1 = class LocalAuthStrategy {
+    constructor(dataSource, authRepo, identifierRepo, options) {
+        this.dataSource = dataSource;
+        this.authRepo = authRepo;
+        this.identifierRepo = identifierRepo;
+        this.options = options;
+        this.logger = new common_1.Logger(LocalAuthStrategy_1.name);
+    }
+    validatePhoneFormat(phone) {
+        const prefixes = this.options.allowedPhonePrefixes;
+        if (!prefixes || prefixes.length === 0)
+            return;
+        const matches = prefixes.some((prefix) => phone.startsWith(prefix));
+        if (!matches) {
+            throw new common_1.BadRequestException(`Phone number must start with ${prefixes.length > 1 ? 'one of these prefixes' : 'this prefix'}: ${prefixes.join(', ')}`);
+        }
+    }
+    requiresPassword(type) {
+        switch (type) {
+            case auth_identify_entity_1.IdentifierType.EMAIL:
+            case 'EMAIL':
+                return this.options.emailRequiresPassword ?? true;
+            case auth_identify_entity_1.IdentifierType.PHONE:
+            case 'PHONE':
+                return this.options.phoneRequiresPassword ?? false;
+            case auth_identify_entity_1.IdentifierType.USERNAME:
+            case 'USERNAME':
+                return this.options.usernameRequiresPassword ?? true;
+            default:
+                return true;
+        }
+    }
+    async registerCredentials(dto, uid) {
+        const enabledStrategies = this.options.enabledStrategies || Object.values(auth_type_enum_1.AuthStrategy);
+        // 1. Validation of identifiers against enabled strategies
+        if (dto.email && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.EMAIL) && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.LOCAL)) {
+            throw new common_1.BadRequestException('Email authentication is currently disabled.');
+        }
+        if (dto.phone && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.PHONE) && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.LOCAL)) {
+            throw new common_1.BadRequestException('Phone authentication is currently disabled.');
+        }
+        if (dto.username && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.USERNAME) && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.LOCAL)) {
+            throw new common_1.BadRequestException('Username authentication is currently disabled.');
+        }
+        if (!dto.email && !dto.phone && !dto.username) {
+            throw new common_1.BadRequestException('Email, phone or username is required');
+        }
+        if (dto.phone) {
+            this.validatePhoneFormat(dto.phone);
+        }
+        const emailReq = dto.email ? this.requiresPassword('EMAIL') : false;
+        const phoneReq = dto.phone ? this.requiresPassword('PHONE') : false;
+        const userReq = dto.username ? this.requiresPassword('USERNAME') : false;
+        const passwordRequired = emailReq || phoneReq || userReq;
+        if (!dto.password && passwordRequired) {
+            throw new common_1.BadRequestException('Password is required');
+        }
+        // 2. Prepare the list of identifiers we want to claim
+        const identifiersToCheck = [];
+        if (dto.email)
+            identifiersToCheck.push(dto.email.toLowerCase());
+        if (dto.phone)
+            identifiersToCheck.push(dto.phone);
+        if (dto.username)
+            identifiersToCheck.push(dto.username.toLowerCase());
+        return this.dataSource.transaction(async (manager) => {
+            const authIdentifierRepo = manager.getRepository(auth_identify_entity_1.AuthIdentifier);
+            const authRepo = manager.getRepository(auth_entity_1.Auth);
+            // 3. 🔒 Check uniqueness
+            const existing = await authIdentifierRepo.findOne({
+                where: { value: (0, typeorm_1.In)(identifiersToCheck) },
+            });
+            if (existing) {
+                if (existing.type === auth_identify_entity_1.IdentifierType.PHONE) {
+                    throw new common_1.BadRequestException('Unable to signup with those credentials. Try changing phone number');
+                }
+                if (existing.type === auth_identify_entity_1.IdentifierType.EMAIL) {
+                    throw new common_1.BadRequestException('Unable to signup with those credentials. Try changing email');
+                }
+                if (existing.type === auth_identify_entity_1.IdentifierType.USERNAME) {
+                    throw new common_1.BadRequestException('Unable to signup with those credentials. Try changing username');
+                }
+            }
+            // 4. Hash Password (if provided)
+            const hash = dto.password ? await bcrypt.hash(dto.password, 10) : undefined;
+            // 5. Create the Auth Identity
+            // If no uid is provided, this is a completely new account.
+            // Generation will happen here or in AuthService if we want more control.
+            // Let's generate it here if missing.
+            const identityUid = uid || crypto.randomUUID();
+            const newAuth = authRepo.create({
+                uid: identityUid,
+                strategy: dto.method || auth_type_enum_1.AuthStrategy.LOCAL,
+                secretHash: hash,
+                isActive: true,
+                isPrimary: true,
+            });
+            // 7. Create the Identifiers (The "Lookups")
+            const newIdentifiers = [];
+            if (dto.email) {
+                newIdentifiers.push(authIdentifierRepo.create({
+                    type: auth_identify_entity_1.IdentifierType.EMAIL,
+                    value: dto.email.toLowerCase(),
+                }));
+            }
+            if (dto.phone) {
+                newIdentifiers.push(authIdentifierRepo.create({
+                    type: auth_identify_entity_1.IdentifierType.PHONE,
+                    value: dto.phone,
+                }));
+            }
+            if (dto.username) {
+                newIdentifiers.push(authIdentifierRepo.create({
+                    type: auth_identify_entity_1.IdentifierType.USERNAME,
+                    value: dto.username.toLowerCase(),
+                }));
+            }
+            // Attach identifiers to auth to save them together (Cascade)
+            newAuth.identifiers = newIdentifiers;
+            // 8. Save (Cascade will save Auth + Identifiers)
+            const auth = await authRepo.save(newAuth);
+            return { auth, identifier: auth.identifiers?.[0] };
+        });
+    }
+    async login(dto) {
+        const enabledStrategies = this.options.enabledStrategies || Object.values(auth_type_enum_1.AuthStrategy);
+        const identifierValue = dto.emailOrPhone || dto.email || dto.phone || dto.username;
+        if (!identifierValue) {
+            throw new common_1.BadRequestException('Email, phone or username is required');
+        }
+        // Validate identifier type against enabled strategies
+        const isEmail = !!dto.email || (!!dto.emailOrPhone && dto.emailOrPhone.includes('@'));
+        const isPhone = !!dto.phone || (!!dto.emailOrPhone && /^\+?[0-9]+$/.test(dto.emailOrPhone));
+        const isUsername = !!dto.username || (!isEmail && !isPhone);
+        const passwordRequired = (isEmail && this.requiresPassword('EMAIL')) ||
+            (isPhone && this.requiresPassword('PHONE')) ||
+            (isUsername && this.requiresPassword('USERNAME'));
+        if (!dto.password && passwordRequired) {
+            throw new common_1.BadRequestException('Password is required');
+        }
+        if (isEmail && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.EMAIL) && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.LOCAL)) {
+            throw new common_1.BadRequestException('Email authentication is currently disabled.');
+        }
+        if (isPhone && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.PHONE) && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.LOCAL)) {
+            throw new common_1.BadRequestException('Phone authentication is currently disabled.');
+        }
+        if (isPhone) {
+            this.validatePhoneFormat(identifierValue);
+        }
+        if (isUsername && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.USERNAME) && !enabledStrategies.includes(auth_type_enum_1.AuthStrategy.LOCAL)) {
+            throw new common_1.BadRequestException('Username authentication is currently disabled.');
+        }
+        // 1. Look up the Identifier first (e.g., find row where value = "john@gmail.com")
+        // We join 'auth' and 'auth.user' so we have everything we need.
+        const identifier = await this.identifierRepo.findOne({
+            where: { value: identifierValue.toLowerCase() },
+            relations: ['auth'],
+        });
+        if (!identifier || !identifier.auth) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        const auth = identifier.auth;
+        // 2. Safety Check: Ensure this identifier is actually linked to a Password/Local account
+        const localStrategies = [
+            auth_type_enum_1.AuthStrategy.EMAIL,
+            auth_type_enum_1.AuthStrategy.PHONE,
+            auth_type_enum_1.AuthStrategy.USERNAME,
+            auth_type_enum_1.AuthStrategy.LOCAL,
+        ];
+        if (!localStrategies.includes(auth.strategy)) {
+            throw new common_1.UnauthorizedException('Please login with your Social Account');
+        }
+        // 3. Retrieve the password hash
+        // (Since select: false, it wasn't loaded in the relation above. We must explicitly fetch it)
+        const authWithSecret = await this.authRepo.findOne({
+            where: { id: auth.id },
+            select: ['id', 'secretHash'], // Explicitly select the hidden column
+        });
+        if (!authWithSecret) {
+            throw new common_1.UnauthorizedException('Invalid credentials');
+        }
+        // 4. Verify password (if password was provided or required)
+        if (dto.password && authWithSecret.secretHash) {
+            const valid = await bcrypt.compare(dto.password, authWithSecret.secretHash);
+            if (!valid) {
+                throw new common_1.UnauthorizedException('Invalid credentials');
+            }
+        }
+        else if (dto.password && !authWithSecret.secretHash) {
+            // Identity has no password, but one was provided
+            throw new common_1.UnauthorizedException('This account does not have a password set. Please use another method.');
+        }
+        else if (!dto.password && authWithSecret.secretHash) {
+            // Identity has a password, but none was provided
+            throw new common_1.UnauthorizedException('Password is required for this account');
+        }
+        // If neither has a password, it's a password-less login (allowed for phone if verified elsewhere/contextually)
+        // 5. Update usage stats
+        // We update the original 'auth' object which has the User loaded, to return full context
+        auth.lastUsedAt = new Date();
+        await this.authRepo.save(auth);
+        return { auth, identifier };
+    }
+};
+exports.LocalAuthStrategy = LocalAuthStrategy;
+exports.LocalAuthStrategy = LocalAuthStrategy = LocalAuthStrategy_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, typeorm_2.InjectRepository)(auth_entity_1.Auth)),
+    __param(2, (0, typeorm_2.InjectRepository)(auth_identify_entity_1.AuthIdentifier)),
+    __param(3, (0, common_2.Inject)(auth_module_options_interface_1.AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [typeorm_1.DataSource,
+        typeorm_1.Repository,
+        typeorm_1.Repository, Object])
+], LocalAuthStrategy);
+//# sourceMappingURL=local-auth.strategy.js.map

package/dist/auth/strategies/local-auth.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-auth.strategy.js","sourceRoot":"","sources":["../../../src/auth/strategies/local-auth.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAKwB;AACxB,qCAAqD;AACrD,6CAAmD;AACnD,iCAAiC;AAGjC,iCAAiC;AACjC,+FAAqG;AACrG,2CAAwC;AAExC,WAAW;AACX,yDAA+C;AAC/C,2EAG0C;AAE1C,QAAQ;AACR,4DAAuD,CAAC,8BAA8B;AAEtF,kBAAkB;AAIX,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAC5B,YACmB,UAAsB,EACf,QAAkC,EAE1D,cAAkD,EACrB,OAAkC;QAJ9C,eAAU,GAAV,UAAU,CAAY;QACP,aAAQ,GAAR,QAAQ,CAAkB;QAElD,mBAAc,GAAd,cAAc,CAA4B;QACb,YAAO,GAAP,OAAO,CAAmB;QAGhD,WAAM,GAAW,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAFjE,CAAC;IAIG,mBAAmB,CAAC,KAAa;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAC3B,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxH,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,IAAqD;QAC5E,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,qCAAc,CAAC,KAAK,CAAC;YAC1B,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,IAAI,CAAC;YACpD,KAAK,qCAAc,CAAC,KAAK,CAAC;YAC1B,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,KAAK,CAAC;YACrD,KAAK,qCAAc,CAAC,QAAQ,CAAC;YAC7B,KAAK,UAAU;gBACb,OAAO,IAAI,CAAC,OAAO,CAAC,wBAAwB,IAAI,IAAI,CAAC;YACvD;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAc,EAAE,GAAY;QACpD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,6BAAY,CAAC,CAAC;QAExF,0DAA0D;QAC1D,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACpH,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1H,MAAM,IAAI,4BAAmB,CAAC,gDAAgD,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC9C,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpE,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpE,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAEzE,MAAM,gBAAgB,GAAG,QAAQ,IAAI,QAAQ,IAAI,OAAO,CAAC;QAEzD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,sDAAsD;QACtD,MAAM,kBAAkB,GAAa,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,KAAK;YAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,KAAK;YAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,QAAQ;YAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAEtE,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACnD,MAAM,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,qCAAc,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,kBAAI,CAAC,CAAC;YAE7C,yBAAyB;YACzB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC;gBAChD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,YAAE,EAAC,kBAAkB,CAAC,EAAE;aACzC,CAAC,CAAC;YAEH,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,IAAI,KAAK,qCAAc,CAAC,KAAK,EAAE,CAAC;oBAC3C,MAAM,IAAI,4BAAmB,CAC3B,oEAAoE,CACrE,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,qCAAc,CAAC,KAAK,EAAE,CAAC;oBAC3C,MAAM,IAAI,4BAAmB,CAC3B,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,IAAI,KAAK,qCAAc,CAAC,QAAQ,EAAE,CAAC;oBAC9C,MAAM,IAAI,4BAAmB,CAC3B,gEAAgE,CACjE,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,iCAAiC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE5E,8BAA8B;YAC9B,2DAA2D;YAC3D,yEAAyE;YACzE,qCAAqC;YACrC,MAAM,WAAW,GAAG,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAE/C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC9B,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,GAAG,CAAC,MAAM,IAAI,6BAAY,CAAC,KAAK;gBAC1C,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YAEH,4CAA4C;YAC5C,MAAM,cAAc,GAAqB,EAAE,CAAC;YAE5C,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,cAAc,CAAC,IAAI,CACjB,kBAAkB,CAAC,MAAM,CAAC;oBACxB,IAAI,EAAE,qCAAc,CAAC,KAAK;oBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE;iBAC/B,CAAC,CACH,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBACd,cAAc,CAAC,IAAI,CACjB,kBAAkB,CAAC,MAAM,CAAC;oBACxB,IAAI,EAAE,qCAAc,CAAC,KAAK;oBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;iBACjB,CAAC,CACH,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACjB,cAAc,CAAC,IAAI,CACjB,kBAAkB,CAAC,MAAM,CAAC;oBACxB,IAAI,EAAE,qCAAc,CAAC,QAAQ;oBAC7B,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE;iBAClC,CAAC,CACH,CAAC;YACJ,CAAC;YAED,6DAA6D;YAC7D,OAAO,CAAC,WAAW,GAAG,cAAc,CAAC;YAErC,iDAAiD;YACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAa;QACvB,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC,MAAM,CAAC,6BAAY,CAAC,CAAC;QACxF,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC;QAEnF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxE,CAAC;QAED,sDAAsD;QACtD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QAE5D,MAAM,gBAAgB,GACpB,CAAC,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;QAEpD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAClH,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAClH,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,6BAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxH,MAAM,IAAI,4BAAmB,CAAC,gDAAgD,CAAC,CAAC;QAClF,CAAC;QAED,kFAAkF;QAClF,gEAAgE;QAChE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YACnD,KAAK,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE;YAC/C,SAAS,EAAE,CAAC,MAAM,CAAC;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAE7B,yFAAyF;QACzF,MAAM,eAAe,GAAG;YACtB,6BAAY,CAAC,KAAK;YAClB,6BAAY,CAAC,KAAK;YAClB,6BAAY,CAAC,QAAQ;YACrB,6BAAY,CAAC,KAAK;SACnB,CAAC;QAEF,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,8BAAqB,CAAC,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QAED,gCAAgC;QAChC,6FAA6F;QAC7F,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,sCAAsC;SACrE,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;QACzD,CAAC;QAED,4DAA4D;QAC5D,IAAI,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;YAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAAC,qBAAqB,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;YACtD,iDAAiD;YACjD,MAAM,IAAI,8BAAqB,CAAC,uEAAuE,CAAC,CAAC;QAC3G,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;YACtD,iDAAiD;YACjD,MAAM,IAAI,8BAAqB,CAAC,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QACD,+GAA+G;QAE/G,wBAAwB;QACxB,yFAAyF;QACzF,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9B,CAAC;CACF,CAAA;AA7PY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,0BAAgB,EAAC,kBAAI,CAAC,CAAA;IACtB,WAAA,IAAA,0BAAgB,EAAC,qCAAc,CAAC,CAAA;IAEhC,WAAA,IAAA,eAAM,EAAC,mDAAmB,CAAC,CAAA;qCAJC,oBAAU;QACG,oBAAU;QAE5B,oBAAU;GALzB,iBAAiB,CA6P7B"}

package/dist/auth/strategies/oauth/apple.strategy.d.ts

@@ -0,0 +1,27 @@
+import { DataSource, Repository } from 'typeorm';
+import { LoginDto } from '../../dto/requests/login.dto';
+import { SignupDto } from '../../dto/requests/signup.dto';
+import { Auth } from '../../entities/auth.entity';
+import { OAuthProvider } from '../../entities/oauth-provider.entity';
+import { AuthIdentifier } from '../../entities/auth-identify.entity';
+import { AuthModuleOptions } from '../../interfaces/auth-module-options.interface';
+import { IOAuthStrategy } from '../../interfaces/oauth-strategy.interface';
+export declare class AppleAuthStrategy implements IOAuthStrategy {
+    private readonly dataSource;
+    private authRepo;
+    private oauthProviderRepo;
+    private options;
+    private applePublicKeys;
+    private lastKeysFetch;
+    constructor(dataSource: DataSource, authRepo: Repository<Auth>, oauthProviderRepo: Repository<OAuthProvider>, options: AuthModuleOptions);
+    private getApplePublicKeys;
+    private verifyToken;
+    registerCredentials(dto: SignupDto, uid?: string): Promise<{
+        auth: Auth;
+        identifier?: AuthIdentifier;
+    }>;
+    login(dto: LoginDto): Promise<{
+        auth: Auth;
+        identifier?: AuthIdentifier;
+    }>;
+}

package/dist/auth/strategies/oauth/apple.strategy.js

@@ -0,0 +1,176 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppleAuthStrategy = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const typeorm_2 = require("@nestjs/typeorm");
+const auth_entity_1 = require("../../entities/auth.entity");
+const oauth_provider_entity_1 = require("../../entities/oauth-provider.entity");
+const auth_identify_entity_1 = require("../../entities/auth-identify.entity");
+const auth_type_enum_1 = require("../../enums/auth-type.enum");
+const auth_module_options_interface_1 = require("../../interfaces/auth-module-options.interface");
+const crypto_1 = require("crypto");
+const jwt = require("jsonwebtoken");
+let AppleAuthStrategy = class AppleAuthStrategy {
+    constructor(dataSource, authRepo, oauthProviderRepo, options) {
+        this.dataSource = dataSource;
+        this.authRepo = authRepo;
+        this.oauthProviderRepo = oauthProviderRepo;
+        this.options = options;
+        this.applePublicKeys = [];
+        this.lastKeysFetch = 0;
+    }
+    async getApplePublicKeys() {
+        // Cache keys for 24 hours
+        const now = Date.now();
+        if (this.applePublicKeys.length > 0 && now - this.lastKeysFetch < 24 * 60 * 60 * 1000) {
+            return this.applePublicKeys;
+        }
+        try {
+            const response = await fetch('https://appleid.apple.com/auth/keys');
+            const data = await response.json();
+            this.applePublicKeys = data.keys;
+            this.lastKeysFetch = now;
+            return this.applePublicKeys;
+        }
+        catch (error) {
+            throw new common_1.BadRequestException('Failed to fetch Apple public keys');
+        }
+    }
+    async verifyToken(token) {
+        try {
+            const decoded = jwt.decode(token, { complete: true });
+            if (!decoded || !decoded.header || !decoded.header.kid) {
+                throw new common_1.BadRequestException('Invalid Apple token header');
+            }
+            const keys = await this.getApplePublicKeys();
+            const jwk = keys.find(k => k.kid === decoded.header.kid);
+            if (!jwk) {
+                throw new common_1.BadRequestException('Apple public key not found');
+            }
+            // Using Node.js native crypto to convert JWK to PublicKey object
+            const publicKey = (0, crypto_1.createPublicKey)({
+                key: jwk,
+                format: 'jwk',
+            });
+            const payload = jwt.verify(token, publicKey, {
+                algorithms: ['RS256'],
+                audience: this.options.appleClientId,
+                issuer: 'https://appleid.apple.com',
+            });
+            if (!payload || !payload.sub) {
+                throw new common_1.BadRequestException('Invalid Apple token payload');
+            }
+            return payload;
+        }
+        catch (error) {
+            if (error instanceof common_1.BadRequestException)
+                throw error;
+            throw new common_1.BadRequestException(`Apple token verification failed: ${error.message}`);
+        }
+    }
+    async registerCredentials(dto, uid) {
+        if (!dto.token) {
+            throw new common_1.BadRequestException('Apple ID token is required');
+        }
+        const payload = await this.verifyToken(dto.token);
+        const appleId = payload.sub;
+        const email = payload.email?.toLowerCase();
+        return this.dataSource.transaction(async (manager) => {
+            const authRepo = manager.getRepository(auth_entity_1.Auth);
+            const oauthProviderRepo = manager.getRepository(oauth_provider_entity_1.OAuthProvider);
+            const identifierRepo = manager.getRepository(auth_identify_entity_1.AuthIdentifier);
+            // Check if this Apple account is already linked
+            const existingProvider = await oauthProviderRepo.findOne({
+                where: { provider: auth_type_enum_1.OAuthProviderType.APPLE, providerUserId: appleId },
+                relations: ['auth'],
+            });
+            if (existingProvider) {
+                throw new common_1.BadRequestException('This Apple account is already linked to a user');
+            }
+            // Check if email identifier is already taken
+            if (email) {
+                const existingIdentifier = await identifierRepo.findOne({
+                    where: { value: email, type: auth_identify_entity_1.IdentifierType.EMAIL },
+                });
+                if (existingIdentifier) {
+                    throw new common_1.BadRequestException('A user with this email already exists');
+                }
+            }
+            const identityUid = uid || (0, crypto_1.randomUUID)();
+            const newAuth = authRepo.create({
+                uid: identityUid,
+                strategy: auth_type_enum_1.AuthStrategy.OAUTH,
+                isActive: true,
+                isVerified: payload.email_verified === 'true' || payload.email_verified === true,
+                isPrimary: true,
+            });
+            const identifiers = [];
+            if (email) {
+                identifiers.push(identifierRepo.create({
+                    type: auth_identify_entity_1.IdentifierType.EMAIL,
+                    value: email,
+                    isVerified: payload.email_verified === 'true' || payload.email_verified === true,
+                    source: auth_identify_entity_1.IdentifierSource.APPLE,
+                    verifiedBy: payload.email_verified ? 'PROVIDER' : undefined,
+                }));
+            }
+            newAuth.identifiers = identifiers;
+            const oauthProvider = oauthProviderRepo.create({
+                provider: auth_type_enum_1.OAuthProviderType.APPLE,
+                providerUserId: appleId,
+                expiresAt: payload.exp ? new Date(payload.exp * 1000) : undefined,
+                rawProfile: payload,
+                emailVerified: payload.email_verified === 'true' || payload.email_verified === true,
+                displayName: payload.name?.displayName,
+                avatarUrl: payload.picture,
+            });
+            newAuth.oauthProviders = [...(newAuth.oauthProviders || []), oauthProvider];
+            const savedAuth = await authRepo.save(newAuth);
+            return { auth: savedAuth, identifier: savedAuth.identifiers?.[0] };
+        });
+    }
+    async login(dto) {
+        if (!dto.token) {
+            throw new common_1.BadRequestException('Apple ID token is required');
+        }
+        const payload = await this.verifyToken(dto.token);
+        const appleId = payload.sub;
+        const oauthProvider = await this.oauthProviderRepo.findOne({
+            where: { provider: auth_type_enum_1.OAuthProviderType.APPLE, providerUserId: appleId },
+            relations: ['auth', 'auth.identifiers'],
+        });
+        if (!oauthProvider || !oauthProvider.auth) {
+            throw new common_1.BadRequestException('No account found linked to this Apple account');
+        }
+        const auth = oauthProvider.auth;
+        auth.lastUsedAt = new Date();
+        await this.authRepo.save(auth);
+        const email = payload.email?.toLowerCase();
+        const identifier = auth.identifiers?.find(id => id.value === email);
+        return { auth, identifier };
+    }
+};
+exports.AppleAuthStrategy = AppleAuthStrategy;
+exports.AppleAuthStrategy = AppleAuthStrategy = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, typeorm_2.InjectRepository)(auth_entity_1.Auth)),
+    __param(2, (0, typeorm_2.InjectRepository)(oauth_provider_entity_1.OAuthProvider)),
+    __param(3, (0, common_1.Inject)(auth_module_options_interface_1.AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [typeorm_1.DataSource,
+        typeorm_1.Repository,
+        typeorm_1.Repository, Object])
+], AppleAuthStrategy);
+//# sourceMappingURL=apple.strategy.js.map

package/dist/auth/strategies/oauth/apple.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.strategy.js","sourceRoot":"","sources":["../../../../src/auth/strategies/oauth/apple.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAyE;AACzE,qCAAiD;AACjD,6CAAmD;AAGnD,4DAAkD;AAClD,gFAAqE;AACrE,8EAAuG;AACvG,+DAA6E;AAC7E,kGAAwG;AAExG,mCAAqD;AACrD,oCAAoC;AAG7B,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAI1B,YACqB,UAAsB,EACf,QAAkC,EACzB,iBAAoD,EACxD,OAAkC;QAH9C,eAAU,GAAV,UAAU,CAAY;QACP,aAAQ,GAAR,QAAQ,CAAkB;QACjB,sBAAiB,GAAjB,iBAAiB,CAA2B;QAChD,YAAO,GAAP,OAAO,CAAmB;QAP3D,oBAAe,GAAU,EAAE,CAAC;QAC5B,kBAAa,GAAG,CAAC,CAAC;IAOtB,CAAC;IAEG,KAAK,CAAC,kBAAkB;QAC5B,0BAA0B;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,aAAa,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,eAAe,CAAC;QAChC,CAAC;QAED,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC;YACjC,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;YACzB,OAAO,IAAI,CAAC,eAAe,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,mCAAmC,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,KAAa;QACnC,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBACrD,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEzD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACP,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;YAChE,CAAC;YAED,iEAAiE;YACjE,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC;gBAC9B,GAAG,EAAE,GAAG;gBACR,MAAM,EAAE,KAAK;aAChB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE;gBACzC,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;gBACpC,MAAM,EAAE,2BAA2B;aACtC,CAAQ,CAAC;YAEV,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC3B,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,OAAO,OAAO,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,4BAAmB;gBAAE,MAAM,KAAK,CAAC;YACtD,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,GAAc,EAAE,GAAY;QAClD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QAE3C,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,kBAAI,CAAC,CAAC;YAC7C,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,qCAAa,CAAC,CAAC;YAC/D,MAAM,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,qCAAc,CAAC,CAAC;YAE7D,gDAAgD;YAChD,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC;gBACrD,KAAK,EAAE,EAAE,QAAQ,EAAE,kCAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE;gBACrE,SAAS,EAAE,CAAC,MAAM,CAAC;aACtB,CAAC,CAAC;YAEH,IAAI,gBAAgB,EAAE,CAAC;gBACnB,MAAM,IAAI,4BAAmB,CAAC,gDAAgD,CAAC,CAAC;YACpF,CAAC;YAED,6CAA6C;YAC7C,IAAI,KAAK,EAAE,CAAC;gBACR,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;oBACpD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,qCAAc,CAAC,KAAK,EAAE;iBACtD,CAAC,CAAC;gBACH,IAAI,kBAAkB,EAAE,CAAC;oBACrB,MAAM,IAAI,4BAAmB,CAAC,uCAAuC,CAAC,CAAC;gBAC3E,CAAC;YACL,CAAC;YAED,MAAM,WAAW,GAAG,GAAG,IAAI,IAAA,mBAAU,GAAE,CAAC;YAExC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC;gBAC5B,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,6BAAY,CAAC,KAAK;gBAC5B,QAAQ,EAAE,IAAI;gBACd,UAAU,EAAE,OAAO,CAAC,cAAc,KAAK,MAAM,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI;gBAChF,SAAS,EAAE,IAAI;aAClB,CAAC,CAAC;YAEH,MAAM,WAAW,GAAqB,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,CAAC;gBACR,WAAW,CAAC,IAAI,CACZ,cAAc,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,qCAAc,CAAC,KAAK;oBAC1B,KAAK,EAAE,KAAK;oBACZ,UAAU,EAAE,OAAO,CAAC,cAAc,KAAK,MAAM,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI;oBAChF,MAAM,EAAE,uCAAgB,CAAC,KAAK;oBAC9B,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;iBAC9D,CAAC,CACL,CAAC;YACN,CAAC;YAED,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;YAElC,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,CAAC;gBAC3C,QAAQ,EAAE,kCAAiB,CAAC,KAAK;gBACjC,cAAc,EAAE,OAAO;gBACvB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjE,UAAU,EAAE,OAAO;gBACnB,aAAa,EAAE,OAAO,CAAC,cAAc,KAAK,MAAM,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI;gBACnF,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW;gBACtC,SAAS,EAAE,OAAO,CAAC,OAAO;aAC7B,CAAC,CAAC;YAEH,OAAO,CAAC,cAAc,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;YAE5E,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAa;QACrB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAE5B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACvD,KAAK,EAAE,EAAE,QAAQ,EAAE,kCAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE;YACrE,SAAS,EAAE,CAAC,MAAM,EAAE,kBAAkB,CAAC;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;QAChC,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAEpE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAChC,CAAC;CACJ,CAAA;AAxKY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAOJ,WAAA,IAAA,0BAAgB,EAAC,kBAAI,CAAC,CAAA;IACtB,WAAA,IAAA,0BAAgB,EAAC,qCAAa,CAAC,CAAA;IAC/B,WAAA,IAAA,eAAM,EAAC,mDAAmB,CAAC,CAAA;qCAHC,oBAAU;QACG,oBAAU;QACQ,oBAAU;GAPjE,iBAAiB,CAwK7B"}