@vynelix/nestjs-multi-auth 0.3.1 → 1.0.0

package/fix-imports.js

@@ -0,0 +1,46 @@
+const fs = require('fs');
+const path = require('path');
+
+const specsDir = path.join(__dirname, 'src', 'auth', 'specs');
+
+const filesToFix = ['auth.controller.spec.ts', 'jwt.strategy.spec.ts', 'account-linking.spec.ts'];
+
+for (const file of filesToFix) {
+  const filePath = path.join(specsDir, file);
+  if (fs.existsSync(filePath)) {
+    let content = fs.readFileSync(filePath, 'utf8');
+    if (!content.includes('SESSION_LOG_REPOSITORY_TOKEN } from')) {
+       content = `import { SESSION_LOG_REPOSITORY_TOKEN } from '../interfaces/repository-tokens';\n` + content;
+       fs.writeFileSync(filePath, content, 'utf8');
+       console.log(`Fixed import in ${file}`);
+    }
+  }
+}
+
+// Also fix mfa-logic.spec.ts syntax again because it was badly formatted:
+const mfaPath = path.join(specsDir, 'mfa-logic.spec.ts');
+let mfaContent = fs.readFileSync(mfaPath, 'utf8');
+if (mfaContent.includes('useValue: { }, { provide: AUTH_IDENTIFIER_REPOSITORY_TOKEN')) {
+    mfaContent = mfaContent.replace(/useValue: { }, { provide: AUTH_IDENTIFIER_REPOSITORY_TOKEN/g, 'useValue: { } }, { provide: AUTH_IDENTIFIER_REPOSITORY_TOKEN');
+    fs.writeFileSync(mfaPath, mfaContent, 'utf8');
+    console.log(`Fixed mfa-logic.spec.ts syntax again`);
+}
+
+// Ensure IdentifierType is in login-verification.spec.ts
+const lvPath = path.join(specsDir, 'login-verification.spec.ts');
+let lvContent = fs.readFileSync(lvPath, 'utf8');
+if (!lvContent.includes('IdentifierType')) {
+    lvContent = lvContent.replace(/import { AuthStrategy } from '\.\.\/enums\/auth-type.enum';/, "import { AuthStrategy } from '../enums/auth-type.enum';\nimport { IdentifierType } from '../enums/identifier-type.enum';");
+    fs.writeFileSync(lvPath, lvContent, 'utf8');
+    console.log(`Fixed IdentifierType import`);
+}
+
+// Ensure MfaType is in mfa-logic.spec.ts
+if (!mfaContent.includes('MfaType')) {
+    mfaContent = mfaContent.replace(/import { AuthStrategy } from '\.\.\/enums\/auth-type.enum';/, "import { AuthStrategy } from '../enums/auth-type.enum';\nimport { MfaType } from '../enums/mfa-type.enum';");
+    if (!mfaContent.includes('MfaType')) {
+       mfaContent = `import { MfaType } from '../enums/mfa-type.enum';\n` + mfaContent;
+    }
+    fs.writeFileSync(mfaPath, mfaContent, 'utf8');
+    console.log(`Fixed MfaType import`);
+}

package/fix-syntax.js

@@ -0,0 +1,66 @@
+const fs = require('fs');
+const path = require('path');
+
+const specsDir = path.join(__dirname, 'src', 'auth', 'specs');
+const files = fs.readdirSync(specsDir).filter(f => f.endsWith('.spec.ts'));
+
+for (const file of files) {
+  const filePath = path.join(specsDir, file);
+  let content = fs.readFileSync(filePath, 'utf8');
+  let changed = false;
+
+  // Fix syntax error from previous AI
+  if (content.includes('useValue: { }, { provide: AUTH_IDENTIFIER_REPOSITORY_TOKEN')) {
+    content = content.replace(/useValue: { }, { provide: AUTH_IDENTIFIER_REPOSITORY_TOKEN/g, 'useValue: { } }, { provide: AUTH_IDENTIFIER_REPOSITORY_TOKEN');
+    changed = true;
+  }
+  
+  if (content.includes('useValue: mockRepo }, { provide: AUTH_IDENTIFIER_REPOSITORY_TOKEN')) {
+      // This one is actually syntactically okay but might be weirdly formatted:
+      // { provide: AUTH_REPOSITORY_TOKEN, useValue: mockRepo }, { provide: AUTH_IDENTIFIER_REPOSITORY_TOKEN, ... },
+      // Wait, in events.spec.ts it was:
+      // { provide: AUTH_REPOSITORY_TOKEN, useValue: mockRepo }, { provide: ... }
+      // This is two elements on one line, which is valid JS!
+  }
+
+  // Fix IdentifierType missing
+  if (file === 'login-verification.spec.ts' && !content.includes('IdentifierType')) {
+    content = content.replace(/import { AuthStrategy } from '\.\.\/enums\/auth-type.enum';/, "import { AuthStrategy } from '../enums/auth-type.enum';\nimport { IdentifierType } from '../enums/identifier-type.enum';");
+    changed = true;
+  }
+
+  // Fix MfaType missing
+  if (file === 'mfa-logic.spec.ts' && !content.includes('MfaType')) {
+    content = content.replace(/import { AuthStrategy } from '\.\.\/enums\/auth-type.enum';/, "import { AuthStrategy } from '../enums/auth-type.enum';\nimport { MfaType } from '../enums/mfa-type.enum';");
+    if (!content.includes('MfaType')) {
+       // if AuthStrategy wasn't imported
+       content = `import { MfaType } from '../enums/mfa-type.enum';\n` + content;
+    }
+    changed = true;
+  }
+  
+  // Fix missing imports in auth.controller.spec.ts
+  if (file === 'auth.controller.spec.ts' && !content.includes('SESSION_LOG_REPOSITORY_TOKEN')) {
+     content = content.replace(/import\s+{([^}]+)}\s+from\s+['"]\.\.\/interfaces\/repository-tokens['"];/, (match, p1) => {
+      return `import { ${p1.trim()}, SESSION_LOG_REPOSITORY_TOKEN } from '../interfaces/repository-tokens';`;
+    });
+    changed = true;
+  }
+  if (file === 'jwt.strategy.spec.ts' && !content.includes('SESSION_LOG_REPOSITORY_TOKEN')) {
+     content = content.replace(/import\s+{([^}]+)}\s+from\s+['"]\.\.\/interfaces\/repository-tokens['"];/, (match, p1) => {
+      return `import { ${p1.trim()}, SESSION_LOG_REPOSITORY_TOKEN } from '../interfaces/repository-tokens';`;
+    });
+    changed = true;
+  }
+  if (file === 'account-linking.spec.ts' && !content.includes('SESSION_LOG_REPOSITORY_TOKEN')) {
+     content = content.replace(/import\s+{([^}]+)}\s+from\s+['"]\.\.\/interfaces\/repository-tokens['"];/, (match, p1) => {
+      return `import { ${p1.trim()}, SESSION_LOG_REPOSITORY_TOKEN } from '../interfaces/repository-tokens';`;
+    });
+    changed = true;
+  }
+
+  if (changed) {
+    fs.writeFileSync(filePath, content, 'utf8');
+    console.log(`Fixed syntax in ${file}`);
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vynelix/nestjs-multi-auth",
-  "version": "0.3.1",
+  "version": "1.0.0",
   "description": "An authentication service/module for NestJs that supports multiple authentication methods such as email, phone, username, OAuth, SSO, etc",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -55,47 +55,49 @@
     "@nestjs/jwt": "^11.0.2",
     "@nestjs/passport": "^11.0.5",
     "@nestjs/swagger": "^11.2.6",
-    "@nestjs/typeorm": "^11.0.0",
     "@nestjs/throttler": "^6.5.0",
+    "@nestjs/typeorm": "^11.0.0",
     "@types/passport-jwt": "^4.0.1",
+    "class-transformer": "^0.5.1",
     "class-validator": "^0.15.1",
     "crypto": "^1.0.1",
     "express": "^5.2.1",
     "google-auth-library": "^9.15.1",
-    "passport-jwt": "^4.0.1",
     "otplib": "^12.0.1",
-    "class-transformer": "^0.5.1",
+    "passport-jwt": "^4.0.1",
     "typeorm": "^0.3.28"
   },
   "devDependencies": {
+    "@nestjs/common": "^11.1.15",
+    "@nestjs/config": "^4.0.3",
+    "@nestjs/core": "^11.1.15",
     "@nestjs/event-emitter": "^3.0.1",
+    "@nestjs/jwt": "^11.0.2",
+    "@nestjs/passport": "^11.0.5",
+    "@nestjs/swagger": "^11.2.6",
     "@nestjs/testing": "^11.1.15",
+    "@nestjs/typeorm": "^11.0.0",
+    "@prisma/client": "^6.19.3",
     "@types/bcrypt": "^6.0.0",
     "@types/jest": "^30.0.0",
+    "@types/passport-jwt": "^4.0.1",
     "@types/supertest": "^7.2.0",
     "bcrypt": "^6.0.0",
+    "class-validator": "^0.15.1",
+    "express": "^5.2.1",
+    "google-auth-library": "^9.15.1",
     "jest": "^30.2.0",
+    "passport-jwt": "^4.0.1",
+    "prisma": "^6.19.3",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
     "supertest": "^7.2.2",
     "ts-jest": "^29.4.6",
-    "typescript": "^5.7.3",
-    "@nestjs/common": "^11.1.15",
-    "@nestjs/core": "^11.1.15",
-    "@nestjs/jwt": "^11.0.2",
-    "@nestjs/typeorm": "^11.0.0",
     "typeorm": "^0.3.28",
-    "reflect-metadata": "^0.2.2",
-    "rxjs": "^7.8.1",
-    "@nestjs/swagger": "^11.2.6",
-    "@nestjs/config": "^4.0.3",
-    "@nestjs/passport": "^11.0.5",
-    "google-auth-library": "^9.15.1",
-    "class-validator": "^0.15.1",
-    "express": "^5.2.1",
-    "passport-jwt": "^4.0.1",
-    "@types/passport-jwt": "^4.0.1"
+    "typescript": "^5.7.3"
   },
   "dependencies": {
     "commander": "^14.0.3",
     "ts-node": "^10.9.2"
   }
-}
+}

package/patch-local-specs.js

@@ -0,0 +1,52 @@
+const fs = require('fs');
+const path = require('path');
+
+const specsToPatch = [
+  'local-auth.strategy.spec.ts',
+  'password-features.spec.ts',
+  'mfa-logic.spec.ts'
+];
+
+specsToPatch.forEach(file => {
+  const filePath = path.join('/home/isaiah/devspace/my-open-source-projects/nestjs-multi-auth/src/auth/specs', file);
+  if (!fs.existsSync(filePath)) return;
+  let content = fs.readFileSync(filePath, 'utf8');
+
+  // Add findByValue
+  if (!content.includes('findByValue: jest.fn(),')) {
+    content = content.replace('findByUidAndNamespace: jest.fn(),', 'findByUidAndNamespace: jest.fn(),\n    findByValue: jest.fn(),');
+  }
+  
+  // Add findByUidAndStrategies
+  if (!content.includes('findByUidAndStrategies: jest.fn(),')) {
+    content = content.replace('findByValue: jest.fn(),', 'findByValue: jest.fn(),\n    findByUidAndStrategies: jest.fn(),');
+  }
+
+  // Add findByUidAndType
+  if (!content.includes('findByUidAndType: jest.fn(),')) {
+    content = content.replace('findByUidAndStrategies: jest.fn(),', 'findByUidAndStrategies: jest.fn(),\n    findByUidAndType: jest.fn(),');
+  }
+
+  // For password-features.spec.ts
+  if (file === 'password-features.spec.ts') {
+    // otpProvider.verify should return success: true
+    content = content.replace(
+      /otpProvider\.verify\.mockResolvedValue\(\{ valid: true \}\);/g, 
+      'otpProvider.verify.mockResolvedValue({ success: true, valid: true });'
+    );
+    content = content.replace(
+      /expect\(otpRepo\.save\)\.toHaveBeenCalled\(\);/g,
+      'expect(otpProvider.issue).toHaveBeenCalled();'
+    );
+    // authIdentifierRepo.findWithAuthByValue
+    if (!content.includes('authIdentifierRepo.findWithAuthByValue.mockResolvedValue')) {
+       content = content.replace(
+         /authRepo\.query\.mockResolvedValue\(\[\{ value: 'test@test\.com'/g,
+         "authIdentifierRepo.findWithAuthByValue.mockResolvedValue({ identifier: { value: 'test@test.com', type: 'EMAIL' }, auth: { id: 'auth-id', uid: 'user-uid' } });\n      authRepo.query.mockResolvedValue([{ value: 'test@test.com'"
+       );
+    }
+  }
+
+  fs.writeFileSync(filePath, content);
+  console.log('Patched', file);
+});

package/patch-oauth-specs.js

@@ -0,0 +1,41 @@
+const fs = require('fs');
+const path = require('path');
+
+const specs = [
+  'apple.strategy.spec.ts',
+  'facebook.strategy.spec.ts',
+  'google.strategy.spec.ts'
+];
+
+specs.forEach(file => {
+  const filePath = path.join('/home/isaiah/devspace/my-open-source-projects/nestjs-multi-auth/src/auth/specs', file);
+  let content = fs.readFileSync(filePath, 'utf8');
+
+  // Add findByValue, findWithAuthByValue, findWithIdentifiers to createMockRepo
+  if (!content.includes('findByValue: jest.fn(),')) {
+    content = content.replace('findWithAuthByValue: jest.fn(),', 'findWithAuthByValue: jest.fn(),\n    findByValue: jest.fn(),\n    findWithIdentifiers: jest.fn(),');
+  } else if (!content.includes('findWithIdentifiers: jest.fn(),')) {
+    content = content.replace('findByValue: jest.fn(),', 'findByValue: jest.fn(),\n    findWithIdentifiers: jest.fn(),');
+  }
+
+  if (!content.includes('findWithIdentifiers: jest.fn(),')) {
+    content = content.replace('findByUidAndEnabled: jest.fn(),', 'findByUidAndEnabled: jest.fn(),\n    findWithIdentifiers: jest.fn(),');
+  }
+
+  // Google specific mocks
+  if (file === 'google.strategy.spec.ts') {
+    content = content.replace(
+      'findOne: jest.fn(),',
+      'findOne: jest.fn(),\n        findWithAuthByValue: jest.fn(),\n        findByValue: jest.fn(),'
+    );
+  }
+
+  // Also replace `authRepo.findWithIdentifiers` in google test to avoid error
+  content = content.replace(
+    'const updatedAuth = await this.authRepo.findWithIdentifiers(auth.id);',
+    'const updatedAuth = await this.authRepo.findWithIdentifiers(auth.id);'
+  );
+
+  fs.writeFileSync(filePath, content);
+  console.log('Patched', file);
+});

package/patch-specs.js

@@ -0,0 +1,36 @@
+const fs = require('fs');
+const path = require('path');
+
+const specsDir = path.join(__dirname, 'src', 'auth', 'specs');
+const files = fs.readdirSync(specsDir).filter(f => f.endsWith('.spec.ts'));
+
+for (const file of files) {
+  const filePath = path.join(specsDir, file);
+  let content = fs.readFileSync(filePath, 'utf8');
+  let changed = false;
+
+  // 1. Add import
+  if (content.includes('interfaces/repository-tokens') && !content.includes('SESSION_LOG_REPOSITORY_TOKEN')) {
+    content = content.replace(/import\s+{([^}]+)}\s+from\s+['"]\.\.\/interfaces\/repository-tokens['"];/, (match, p1) => {
+      return `import { ${p1.trim()}, SESSION_LOG_REPOSITORY_TOKEN } from '../interfaces/repository-tokens';`;
+    });
+    changed = true;
+  }
+
+  // 2. Add provider
+  if (content.includes('Test.createTestingModule') && content.includes('providers:') && !content.includes('SESSION_LOG_REPOSITORY_TOKEN,')) {
+    const useValueStr = content.includes('mockRepo') ? 'mockRepo' : '{}';
+    content = content.replace(/providers:\s*\[([\s\S]*?)\]/, (match, p1) => {
+      if (!p1.includes('SESSION_LOG_REPOSITORY_TOKEN')) {
+        return `providers: [${p1}  { provide: SESSION_LOG_REPOSITORY_TOKEN, useValue: ${useValueStr} },\n      ]`;
+      }
+      return match;
+    });
+    changed = true;
+  }
+
+  if (changed) {
+    fs.writeFileSync(filePath, content, 'utf8');
+    console.log(`Patched ${file}`);
+  }
+}

package/prompts/database_adapter.md

@@ -0,0 +1,157 @@
+# Decouple the Authentication Core from TypeORM — nestjs-multi-auth
+
+## Context
+
+You are working on **nestjs-multi-auth**, a production-grade authentication library for NestJS.
+
+## Objective
+
+Refactor the authentication library so that **all persistence is abstracted behind repository interfaces**, removing any hard dependency on TypeORM from the authentication core.
+
+## Problem
+
+The authentication core currently depends directly on TypeORM. It imports and uses:
+
+- `Repository`
+- `Entity`
+- `QueryBuilder`
+- TypeORM decorators
+- Raw SQL
+
+This couples core authentication logic to a single ORM, making it difficult or impossible for developers to use **Prisma**, **Drizzle ORM**, **MikroORM**, **Sequelize**, **MongoDB**, or a custom data store without forking the library.
+
+## Design Principles
+
+### The authentication core IS responsible for
+
+- Authentication and authorization business logic
+- Identity verification workflows
+- Session lifecycle rules
+- OTP orchestration
+- MFA orchestration
+- OAuth provider linking logic
+- All validation and decision-making
+
+### The authentication core is NOT responsible for
+
+- How data is queried or persisted
+- Which database or ORM is used
+- Schema definitions
+- Query construction, connection management, or transactions specific to any ORM
+
+Persistence mechanics are the responsibility of a **repository adapter**, never the core.
+
+---
+
+## New Architecture
+
+### 1. Repository Interfaces (NEW)
+
+Define abstract repository interfaces for every persisted concern in the library, including at minimum:
+
+- `AuthMethodRepository`
+- `IdentifierRepository`
+- `SessionRepository`
+- `OtpRepository`
+- `MfaRepository`
+- `OAuthProviderRepository`
+
+Each interface should:
+
+- Expose only the operations the authentication core actually needs (e.g. `findByIdentifier`, `create`, `update`, `delete`, `markUsed`) — not generic ORM-style methods.
+- Use plain domain types (not ORM entities) for inputs and outputs.
+- Contain no TypeORM types, decorators, or query-builder references anywhere in their signatures.
+
+**Example shape:**
+
+```typescript
+export interface SessionRepository {
+  create(session: CreateSessionInput): Promise<AuthSession>;
+  findById(id: string): Promise<AuthSession | null>;
+  revoke(id: string): Promise<void>;
+  findActiveByAuthId(authId: string): Promise<AuthSession[]>;
+}
+```
+
+### 2. Domain Models (NEW)
+
+Introduce plain TypeScript interfaces/types (e.g. `AuthSession`, `AuthMethod`, `AuthIdentifier`, `OtpRecord`, `MfaFactor`, `OAuthLink`) that represent persisted data within the core. These types must be:
+
+- Free of TypeORM decorators (`@Entity`, `@Column`, `@ManyToOne`, etc.)
+- The only shapes the authentication core ever operates on
+- Mapped to and from ORM entities exclusively inside adapters
+
+### 3. First-Party TypeORM Adapter
+
+Provide a `TypeOrmAuthAdapter` package/module that:
+
+- Implements every repository interface using TypeORM `Repository`, `Entity`, and `QueryBuilder` as needed.
+- Preserves 100% of current behavior — this is the default, drop-in implementation.
+- Contains all TypeORM-specific code, entity definitions, and migrations.
+- Is the **only** place in the library where TypeORM is imported.
+
+### 4. Adapter Extensibility
+
+The architecture must make it straightforward to build equivalent adapters for:
+
+- Prisma
+- Drizzle ORM
+- MikroORM
+- Sequelize
+- MongoDB (or other non-relational stores)
+- Fully custom data stores
+
+An adapter author should only need to implement the repository interfaces and provide domain-model mapping — no changes to the authentication core should ever be required.
+
+---
+
+## Dependency Injection
+
+- Introduce injection tokens for each repository interface (e.g. `SESSION_REPOSITORY`, `OTP_REPOSITORY`, `AUTH_METHOD_REPOSITORY`, etc.), following the same pattern as existing tokens like `AUTH_NOTIFICATION_PROVIDER`.
+- If no adapter is registered, automatically register the `TypeOrmAuthAdapter` implementations so existing applications continue to work without any change.
+- Allow applications to override individual repositories independently (e.g. use the TypeORM adapter for sessions but a custom repository for OTPs), rather than forcing an all-or-nothing swap.
+
+---
+
+## `AuthService` and Core Changes
+
+- Remove all direct TypeORM imports, `@InjectRepository()` usages, and query-builder calls from the authentication core.
+- Replace all persistence calls with calls to the appropriate repository interface.
+- Ensure business logic (validation, expiration checks, state transitions, error handling) stays in the core services — adapters should contain **no business logic**, only data access and mapping.
+
+**Before:**
+
+```typescript
+const session = await this.sessionRepo
+  .createQueryBuilder('session')
+  .where('session.authId = :authId', { authId })
+  .getOne();
+```
+
+**After:**
+
+```typescript
+const session = await this.sessionRepository.findActiveByAuthId(authId);
+```
+
+---
+
+## Backward Compatibility
+
+This refactor must **not** break existing applications.
+
+- Applications using the library today (implicitly relying on TypeORM) should continue to work with **zero configuration changes**, since `TypeOrmAuthAdapter` is registered by default.
+- Only developers who wish to switch persistence layers need to provide alternate repository implementations.
+- Public authentication API surface (methods, DTOs, module configuration options unrelated to persistence) must remain unchanged.
+
+---
+
+## Code Quality Requirements
+
+- Follow SOLID principles, in particular the Dependency Inversion Principle — the core depends on abstractions, not on TypeORM.
+- Keep all TypeORM-specific code isolated inside the `TypeOrmAuthAdapter`; no leakage into shared/core packages.
+- Avoid leaking ORM-specific types (entities, query builders, decorators) across the core/adapter boundary in either direction.
+- Ensure each repository interface is small and focused (Interface Segregation) rather than one large generic repository.
+- Ensure the authentication core is fully unit testable using in-memory or mock repository implementations, with no database required.
+- Preserve all current tests and behavior where possible; add adapter-level tests against the interfaces.
+- Document the repository interfaces clearly enough that a third party could implement a new adapter without reading the core source.