arkos 2.0.0-next.3 → 2.0.0-next.30

package/dist/esm/modules/auth/auth.service.js

@@ -1,34 +1,33 @@
-import jwt from "jsonwebtoken";
-import bcrypt from "bcryptjs";
-import catchAsync from "../error-handler/utils/catch-async.js";
-import AppError from "../error-handler/utils/app-error.js";
-import { callNext } from "../base/base.middlewares.js";
-import { getArkosConfig } from "../../server.js";
-import arkosEnv from "../../utils/arkos-env.js";
-import { getPrismaInstance } from "../../utils/helpers/prisma.helpers.js";
-import { toMs } from "./utils/helpers/auth.controller.helpers.js";
-import { invaliAuthTokenError, loginRequiredError, } from "./utils/auth-error-objects.js";
-import authActionService from "./utils/services/auth-action.service.js";
-import { isAuthenticationEnabled, isUsingAuthentication, } from "../../utils/helpers/arkos-config.helpers.js";
+import jwt from 'jsonwebtoken';
+import bcrypt from 'bcryptjs';
+import catchAsync from '../error-handler/utils/catch-async.js';
+import AppError from '../error-handler/utils/app-error.js';
+import arkosEnv from '../../utils/arkos-env.js';
+import { getPrismaInstance } from '../../utils/helpers/prisma.helpers.js';
+import { toMs, createPrismaWhereClause, getDefaultUsernameField, } from './utils/helpers/auth.controller.helpers.js';
+import { ArkosPrismaService } from '../base/base.service.js';
+import { invaliAuthTokenError, loginRequiredError, } from './utils/auth-error-objects.js';
+import authActionService from './utils/services/auth-action.service.js';
+import { getArkosConfig, isAuthenticationEnabled, isUsingAuthentication, } from '../../utils/helpers/arkos-config.helpers.js';
+import { getUserFileExtension } from '../../utils/helpers/fs.helpers.js';
+import { authenticationDocsLinks } from './utils/docs-links.js';
+import authHookManager from './utils/auth-hooks-manager.js';
+import { resolveRequestToken, resolveSocketToken, } from './utils/token-extraction.js';
+import { BadRequestError, UnauthorizedError, } from '../error-handler/utils/errors.js';
 export class AuthService {
-    constructor() {
-        this.actionsPerResource = {};
-        this.authenticate = catchAsync(async (req, _, next) => {
-            if (isAuthenticationEnabled()) {
-                const user = (await this.getAuthenticatedUser(req));
-                if (!user)
-                    throw loginRequiredError;
-                req.user = user;
-            }
-            next();
-        });
+    actionsPerResource = {};
+    _userService;
+    get userService() {
+        if (!this._userService)
+            this._userService = new ArkosPrismaService('user');
+        return this._userService;
     }
     signJwtToken(id, expiresIn, secret) {
         const { authentication: configs } = getArkosConfig();
-        if (process.env.ARKOS_BUILD === "true" &&
+        if (process.env.ARKOS_BUILD === 'true' &&
             !process.env.JWT_SECRET &&
             !configs?.jwt?.secret)
-            throw new AppError("Missing JWT secret on production!", 500, "MissingJWTOnProduction");
+            throw new AppError('Missing JWT secret on production!', 500, 'MissingJWTOnProduction');
         secret =
             secret ||
                 configs?.jwt?.secret ||
@@ -46,10 +45,10 @@ export class AuthService {
         const arkosConfig = getArkosConfig();
         const authConfigs = arkosConfig?.authentication;
         if (!req)
-            throw new Error("Missing req object in order get jwt cookie options");
+            throw new Error('Missing req object in order get jwt cookie options');
         const sameSite = authConfigs?.jwt?.cookie?.sameSite ||
             process.env.JWT_COOKIE_SAME_SITE ||
-            "lax";
+            'lax';
         return {
             expires: new Date(Date.now() +
                 Number(toMs(authConfigs?.jwt?.expiresIn ||
@@ -57,18 +56,20 @@ export class AuthService {
                     arkosEnv.JWT_EXPIRES_IN))),
             httpOnly: authConfigs?.jwt?.cookie?.httpOnly ??
                 (process.env.JWT_COOKIE_HTTP_ONLY !== undefined
-                    ? process.env.JWT_COOKIE_HTTP_ONLY === "true"
+                    ? process.env.JWT_COOKIE_HTTP_ONLY === 'true'
                     : undefined) ??
                 true,
             secure: (() => {
                 if (authConfigs?.jwt?.cookie?.secure !== undefined)
                     return authConfigs?.jwt?.cookie?.secure;
                 else if (process.env.JWT_COOKIE_SECURE !== undefined)
-                    return process.env.JWT_COOKIE_SECURE === "true";
+                    return process.env.JWT_COOKIE_SECURE === 'true';
                 else
-                    return req.secure || req.headers["x-forwarded-proto"] === "https";
+                    return req.secure || req.headers['x-forwarded-proto'] === 'https';
             })(),
             sameSite,
+            domain: authConfigs?.jwt?.cookie?.domain || process.env.JWT_COOKIE_DOMAIN,
+            ...arkosConfig?.authentication?.jwt?.cookie,
         };
     }
     isPasswordHashed(password) {
@@ -80,60 +81,62 @@ export class AuthService {
     async hashPassword(password) {
         return await bcrypt.hash(password, 12);
     }
-    isPasswordStrong(password) {
-        const initAuthConfigs = getArkosConfig()?.authentication;
-        const strongPasswordRegex = initAuthConfigs?.passwordValidation?.regex ||
-            /^(?=.*[A-Z])(?=.*[a-z])(?=.*\d).+$/;
-        return strongPasswordRegex.test(password);
-    }
     userChangedPasswordAfter(user, JWTTimestamp) {
         if (user.passwordChangedAt) {
-            const convertedTimestamp = parseInt(String(user.passwordChangedAt.getTime() / 1000), 10);
+            const convertedTimestamp = parseInt(String(new Date(user.passwordChangedAt).getTime() / 1000), 10);
             return JWTTimestamp < convertedTimestamp;
         }
         return false;
     }
     async verifyJwtToken(token, secret) {
         const { authentication: configs } = getArkosConfig();
-        if (process.env.ARKOS_BUILD === "true" &&
+        if (process.env.ARKOS_BUILD === 'true' &&
             !process.env.JWT_SECRET &&
             !configs?.jwt?.secret)
-            throw new AppError("Missing JWT secret in production", 500, "MissingJWTSecretInProduction");
+            throw new AppError('Missing JWT secret in production', 500, 'MissingJWTSecretInProduction');
         secret =
             secret ||
                 configs?.jwt?.secret ||
                 process.env.JWT_SECRET ||
                 arkosEnv.JWT_SECRET;
-        return new Promise((resolve, reject) => {
-            jwt.verify(token, secret, (err, decoded) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve(decoded);
-            });
-        });
+        try {
+            const decoded = (await new Promise((resolve, reject) => {
+                jwt.verify(token, secret, (err, decoded) => {
+                    if (err)
+                        reject(err);
+                    else
+                        resolve(decoded);
+                });
+            }));
+            if (!decoded?.id)
+                throw invaliAuthTokenError;
+            return decoded;
+        }
+        catch (err) {
+            throw invaliAuthTokenError;
+        }
     }
     isWildcardAccess(config) {
-        return config === "*";
+        return config === '*';
     }
     isRoleList(config) {
         return Array.isArray(config);
     }
     isAccessRules(config) {
-        return (typeof config === "object" && config !== null && !Array.isArray(config));
+        return (typeof config === 'object' && config !== null && !Array.isArray(config));
     }
     normalizeRuleToRoles(rule) {
         if (!rule)
             return [];
-        if (rule === "*")
-            return ["*"];
+        if (rule === '*')
+            return ['*'];
         if (Array.isArray(rule))
             return rule;
-        return rule.roles === "*" ? ["*"] : (rule.roles ?? []);
+        return rule.roles === '*' ? ['*'] : (rule.roles ?? []);
     }
     resolveAuthorizedRoles(action, accessControl) {
         if (this.isWildcardAccess(accessControl))
-            return ["*"];
+            return ['*'];
         if (this.isRoleList(accessControl))
             return accessControl;
         if (this.isAccessRules(accessControl))
@@ -142,122 +145,185 @@ export class AuthService {
     }
     checkStaticAccessControl(user, action, accessControl) {
         if (!user?.role && !user.roles)
-            throw Error("Validation Error: In order to use static authentication user needs at least role field or roles for multiple roles.");
+            throw Error('Validation Error: In order to use static authentication user needs at least role field or roles for multiple roles.');
         let authorizedRoles = this.resolveAuthorizedRoles(action, accessControl);
         const userRoles = Array.isArray(user?.roles) ? user.roles : [user.role];
-        return (authorizedRoles?.[0] === "*" ||
+        return (authorizedRoles?.[0] === '*' ||
             !!userRoles.some((role) => authorizedRoles.includes(role)));
     }
     async checkDynamicAccessControl(userId, action, resource) {
         const prisma = getPrismaInstance();
-        return !!(await prisma.userRole.findFirst({
-            where: {
-                userId,
-                role: {
-                    permissions: {
-                        some: {
-                            resource,
-                            action,
+        const [userPermission, hasRolePermission] = await Promise.all([
+            prisma.userPermission
+                ? prisma.userPermission.findFirst({
+                    where: { userId, permission: { resource, action } },
+                    select: { effect: true },
+                })
+                : Promise.resolve(null),
+            prisma.userRole.findFirst({
+                where: {
+                    userId,
+                    role: {
+                        permissions: {
+                            some: { resource, action },
                         },
                     },
                 },
-            },
-            select: { id: true },
-        }));
+                select: { id: true },
+            }),
+        ]);
+        if (userPermission)
+            return userPermission.effect === 'Allow';
+        return !!hasRolePermission;
     }
-    handleAccessControl(action, resource, accessControl) {
-        authActionService.add(action, resource, accessControl);
-        return catchAsync(async (req, _, next) => {
-            if (req.user) {
-                const user = req.user;
-                const configs = getArkosConfig();
-                if (user.isSuperUser) {
-                    next();
-                    return;
-                }
-                const notEnoughPermissionsError = new AppError("You do not have permission to perfom this action", 403, "NotEnoughPermissions");
-                if (configs?.authentication?.mode === "dynamic") {
-                    const hasPermission = await this.checkDynamicAccessControl(user.id, action, resource);
-                    if (!hasPermission)
-                        return next(notEnoughPermissionsError);
-                }
-                else if (configs?.authentication?.mode === "static") {
-                    if (!accessControl)
-                        return next(notEnoughPermissionsError);
-                    const hasPermission = this.checkStaticAccessControl(user, action, accessControl);
-                    if (!hasPermission)
-                        return next(notEnoughPermissionsError);
-                }
-            }
-            next();
+    sanitizeUser(user) {
+        const { password: _password, ...sanitized } = user;
+        return sanitized;
+    }
+    withPasswordIncluded(queryOptions) {
+        const options = { ...(queryOptions || {}) };
+        if (options.select)
+            options.select = { ...options.select, password: true };
+        if (options.omit) {
+            const { password: _password, ...omit } = options.omit;
+            options.omit = omit;
+        }
+        return options;
+    }
+    async getMe(userId, queryOptions) {
+        const user = await this.userService.findOne({ id: userId }, queryOptions || {});
+        return user ? this.sanitizeUser(user) : null;
+    }
+    async updateMe(userId, data, queryOptions) {
+        if ("password" in data)
+            throw new BadRequestError("In order to update password use the update-password endpoint.", "InvalidFieldPassword");
+        const user = await this.userService.updateOne({ id: userId }, data, queryOptions || {});
+        return this.sanitizeUser(user);
+    }
+    async signup(data, queryOptions) {
+        const user = await this.userService.createOne(data, queryOptions || {});
+        return this.sanitizeUser(user);
+    }
+    async deleteMe(userId, queryOptions) {
+        const user = await this.userService.updateOne({ id: userId }, { deletedSelfAccountAt: new Date().toISOString() }, queryOptions || {});
+        return this.sanitizeUser(user);
+    }
+    async login(input, queryOptions) {
+        const { password } = input;
+        const usernameField = input.usernameField ||
+            Object.keys(input).find((key) => key !== "password" && key !== "usernameField") ||
+            getDefaultUsernameField();
+        const allowedUsernames = getArkosConfig()?.authentication?.login?.allowedUsernames;
+        if (allowedUsernames?.length && !allowedUsernames.includes(usernameField))
+            throw new BadRequestError(`Invalid username field, expected one of: ${allowedUsernames.join(", ")}`, "InvalidUsernameField");
+        const lastField = usernameField.split(".").pop();
+        const username = input[lastField];
+        if (!username || !password)
+            throw new BadRequestError(`Please provide both ${lastField} and password`, `MissingCredentialFields`);
+        const user = (await this.userService.findOne(createPrismaWhereClause(usernameField, username), this.withPasswordIncluded(queryOptions)));
+        if (!user || !(await this.isCorrectPassword(password, user.password)))
+            throw new UnauthorizedError(`Incorrect ${lastField} or password`, `IncorrectCredentials`);
+        return {
+            user: this.sanitizeUser(user),
+            accessToken: this.signJwtToken(user.id),
+        };
+    }
+    async updatePassword(userId, input) {
+        const { currentPassword, newPassword } = input;
+        if (!currentPassword || !newPassword)
+            throw new AppError("currentPassword and newPassword are required", 400, "SameCurrentAndNewPassword");
+        const user = (await this.userService.findOne({ id: userId }, this.withPasswordIncluded()));
+        if (!user || user.isActive === false || user.deletedSelfAccountAt)
+            throw new AppError("User not found!", 404);
+        if (!(await this.isCorrectPassword(String(currentPassword), String(user.password))))
+            throw new AppError("Current password is incorrect", 400, "IncorrentCurrentPassword");
+        await this.userService.updateOne({ id: userId }, {
+            password: await this.hashPassword(String(newPassword)),
+            passwordChangedAt: new Date(Date.now()).toISOString(),
         });
+        return { accessToken: this.signJwtToken(userId) };
     }
-    async getAuthenticatedUser(req) {
-        if (!isAuthenticationEnabled())
-            throw Error("ValidationError: Trying to call AuthService.getAuthenticatedUser without setting up authentication");
+    async logout(_userId, _accessToken) { }
+    extractRequestToken(req, cookie = "arkos_access_token") {
+        return resolveRequestToken({
+            authorization: req?.headers?.authorization,
+            cookies: req?.cookies,
+            cookieName: cookie,
+        });
+    }
+    extractSocketToken(socket, key = "token") {
+        const requestCookie = socket.request?.headers?.cookie;
+        return resolveSocketToken({
+            auth: socket.handshake?.auth,
+            key,
+            headers: socket.handshake?.headers,
+            cookies: socket.handshake?.cookies,
+            cookieHeader: requestCookie,
+        });
+    }
+    async validateDecodedUser(decoded, action = 'default') {
         const prisma = getPrismaInstance();
-        let token;
-        if (req?.headers?.authorization &&
-            req?.headers?.authorization.startsWith("Bearer") &&
-            req?.headers?.authorization.split?.(" ")?.[1])
-            token = req?.headers?.authorization.split(" ")[1];
-        if (!token &&
-            req?.cookies?.arkos_access_token !== "no-token" &&
-            req.cookies) {
-            token = req?.cookies?.arkos_access_token;
-        }
-        if (!token)
-            return null;
-        let decoded;
-        try {
-            decoded = await this.verifyJwtToken(token);
-        }
-        catch (err) {
-            throw invaliAuthTokenError;
-        }
-        if (!decoded?.id)
-            throw invaliAuthTokenError;
         const user = await prisma.user.findUnique({
-            where: { id: String(decoded.id) },
+            where: { id: decoded.id },
         });
         if (!user)
-            throw new AppError("The user belonging to this token does no longer exists", 401, "UserNoLongerExists");
-        if (this.userChangedPasswordAfter(user, decoded.iat) &&
-            !req.path?.includes?.("logout"))
-            throw new AppError("User recently changed password! Please log in again.", 401, "PasswordChanged");
-        req.accessToken = token;
+            throw new AppError('The user belonging to this token no longer exists', 401, 'UserNoLongerExists');
+        if (action !== 'logout' &&
+            this.userChangedPasswordAfter(user, decoded.iat))
+            throw new AppError('User recently changed password! Please log in again.', 401, 'PasswordChanged');
         return user;
     }
-    handleAuthenticationControl(action, authenticationControl) {
-        if (authenticationControl && typeof authenticationControl === "object") {
-            if (authenticationControl[action] === false)
-                return callNext;
-            else if (authenticationControl[action] === true)
-                return this.authenticate;
-        }
-        else
-            return this.authenticate;
-        return this.authenticate;
+    async getAuthenticatedUser(ctx, action = 'default') {
+        if (!isAuthenticationEnabled())
+            throw Error(`Trying to call authService.getAuthenticatedUser without setting up authentication in arkos.config.${getUserFileExtension()}, see ${authenticationDocsLinks.setup}`);
+        let token = null;
+        if ('headers' in ctx)
+            token = this.extractRequestToken(ctx);
+        else if ('join' in ctx)
+            token = this.extractSocketToken(ctx);
+        if (!token)
+            return null;
+        const decoded = await this.verifyJwtToken(token);
+        ctx.accessToken = token;
+        return this.validateDecodedUser(decoded, action);
+    }
+    authenticate = catchAsync(async (req, _, next) => {
+        await authHookManager.runAuthenticate({ context: req, done: next }, async (req) => {
+            if (!isAuthenticationEnabled())
+                return null;
+            const user = (await this.getAuthenticatedUser(req, req.path.includes('logout') ? 'logout' : 'default'));
+            if (!user)
+                throw loginRequiredError;
+            return user;
+        });
+    });
+    authorize(action, resource, rule) {
+        const authAction = authActionService.add(action, resource, {
+            [action]: rule,
+        });
+        return catchAsync(async (req, _, next) => {
+            await authHookManager.runAuthorize({ context: req, done: next }, authAction);
+        });
     }
     permission(action, resource, accessControl) {
         const stack = new Error().stack;
-        if (stack?.includes("node_modules/express/lib/router/index.js"))
-            throw new Error("authService.permission() should be called during application initialization level.");
+        if (stack?.includes('node_modules/express/lib/router/index.js'))
+            throw new Error('authService.permission() should be called during application initialization level.');
         authActionService.add(action, resource, accessControl);
         return async (user) => {
             const configs = getArkosConfig();
             if (!isUsingAuthentication())
-                throw Error("Validation Error: Trying to use authService.permission without setting up authentication.");
+                throw Error('Validation Error: Trying to use authService.permission without setting up authentication.');
             if (!isAuthenticationEnabled())
                 return false;
             if (!user)
                 throw loginRequiredError;
             if (user?.isSuperUser)
                 return true;
-            if (configs?.authentication?.mode === "dynamic") {
+            if (configs?.authentication?.mode === 'dynamic') {
                 return await this.checkDynamicAccessControl(user?.id, action, resource);
             }
-            else if (configs?.authentication?.mode === "static") {
+            else if (configs?.authentication?.mode === 'static') {
                 return (!!accessControl &&
                     this.checkStaticAccessControl(user, action, accessControl));
             }

package/dist/esm/modules/auth/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAoB,MAAM,cAAc,CAAC;AAChD,OAAO,MAAM,MAAM,UAAU,CAAC;AAE9B,OAAO,UAAU,MAAM,oCAAoC,CAAC;AAC5D,OAAO,QAAQ,MAAM,kCAAkC,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,QAAQ,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAevE,OAAO,EAAc,IAAI,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,iBAAiB,MAAM,sCAAsC,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAKlD,MAAM,OAAO,WAAW;IAAxB;QAIE,uBAAkB,GAAgC,EAAE,CAAC;QA2crD,iBAAY,GAAG,UAAU,CACvB,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,IAAI,uBAAuB,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAS,CAAC;gBAC5D,IAAI,CAAC,IAAI;oBAAE,MAAM,kBAAkB,CAAC;gBACpC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IAmFJ,CAAC;IA7hBC,YAAY,CACV,EAAmB,EACnB,SAA+B,EAC/B,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,QAAQ,CAChB,mCAAmC,EACnC,GAAG,EACH,wBAAwB,CACzB,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,QAAQ,CAAC,UAAU,CAAC;QAEtB,SAAS,GAAG,CAAC,SAAS;YACpB,OAAO,EAAE,GAAG,EAAE,SAAS;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc;YAC1B,QAAQ,CAAC,cAAc,CAAmC,CAAC;QAE7D,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YAC9B,SAAS,EAAE,SAAuB;SACnC,CAAC,CAAC;IACL,CAAC;IAoBD,mBAAmB,CAAC,GAAiB;QACnC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,WAAW,EAAE,cAAc,CAAC;QAEhD,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAExE,MAAM,QAAQ,GACZ,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;YACjC,OAAO,CAAC,GAAG,CAAC,oBAIC;YACd,KAAK,CAAC;QAER,OAAO;YACL,OAAO,EAAE,IAAI,IAAI,CACf,IAAI,CAAC,GAAG,EAAE;gBACR,MAAM,CACJ,IAAI,CACF,WAAW,EAAE,GAAG,EAAE,SAAS;oBACxB,OAAO,CAAC,GAAG,CAAC,cAA6B;oBACzC,QAAQ,CAAC,cAA6B,CAC1C,CACF,CACJ;YACD,QAAQ,EACN,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;gBAClC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS;oBAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI;YACN,MAAM,EAAE,CAAC,GAAG,EAAE;gBACZ,IAAI,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS;oBAChD,OAAO,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;qBACrC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBAClD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;;oBAC7C,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;YACzE,CAAC,CAAC,EAAE;YACJ,QAAQ;SACT,CAAC;IACJ,CAAC;IAaD,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IASD,KAAK,CAAC,iBAAiB,CACrB,iBAAyB,EACzB,YAAoB;QAEpB,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAQD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAmBM,gBAAgB,CAAC,QAAgB;QACtC,MAAM,eAAe,GAAG,cAAc,EAAE,EAAE,cAAc,CAAC;QAEzD,MAAM,mBAAmB,GACvB,eAAe,EAAE,kBAAkB,EAAE,KAAK;YAC1C,oCAAoC,CAAC;QACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IASD,wBAAwB,CAAC,IAAU,EAAE,YAAoB;QACvD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,kBAAkB,GAAG,QAAQ,CACjC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAC/C,EAAE,CACH,CAAC;YAEF,OAAO,YAAY,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAUD,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,QAAQ,CAChB,kCAAkC,EAClC,GAAG,EACH,8BAA8B,CAC/B,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,QAAQ,CAAC,UAAU,CAAC;QAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;gBACzC,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,OAAyB,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,MAA2B;QAClD,OAAO,MAAM,KAAK,GAAG,CAAC;IACxB,CAAC;IAEO,UAAU,CAAC,MAA2B;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAEO,aAAa,CACnB,MAA2B;QAE3B,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CACxE,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAC1B,IAA4D;QAE5D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAEO,sBAAsB,CAC5B,MAAoB,EACpB,aAAkC;QAElC,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,aAAa,CAAC;QACzD,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;YACnC,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IAYS,wBAAwB,CAChC,IAAU,EACV,MAAc,EACd,aAAkC;QAElC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAC5B,MAAM,KAAK,CACT,qHAAqH,CACtH,CAAC;QAEJ,IAAI,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAEzE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExE,OAAO,CACL,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG;YAC5B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IAWS,KAAK,CAAC,yBAAyB,CACvC,MAAc,EACd,MAAc,EACd,QAAgB;QAEhB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACxC,KAAK,EAAE;gBACL,MAAM;gBACN,IAAI,EAAE;oBACJ,WAAW,EAAE;wBACX,IAAI,EAAE;4BACJ,QAAQ;4BACR,MAAM;yBACP;qBACF;iBACF;aACF;YACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC,CAAC;IACN,CAAC;IAUD,mBAAmB,CACjB,MAAoB,EACpB,QAAgB,EAChB,aAAmC;QAEnC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEvD,OAAO,UAAU,CACf,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAY,CAAC;gBAC9B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;gBAEjC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBAED,MAAM,yBAAyB,GAAG,IAAI,QAAQ,CAC5C,kDAAkD,EAClD,GAAG,EACH,sBAAsB,CACvB,CAAC;gBAEF,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBAChD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,yBAAyB,CACxD,IAAI,CAAC,EAAE,EACP,MAAM,EACN,QAAQ,CACT,CAAC;oBAEF,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,CAAC;qBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACtD,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAE3D,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CACjD,IAAI,EACJ,MAAM,EACN,aAAa,CACd,CAAC;oBAEF,IAAI,CAAC,aAAa;wBAAE,OAAO,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAC7D,CAAC;YACH,CAAC;YAED,IAAI,EAAE,CAAC;QACT,CAAC,CACF,CAAC;IACJ,CAAC;IAQD,KAAK,CAAC,oBAAoB,CAAC,GAAiB;QAC1C,IAAI,CAAC,uBAAuB,EAAE;YAC5B,MAAM,KAAK,CACT,oGAAoG,CACrG,CAAC;QAEJ,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAEnC,IAAI,KAAyB,CAAC;QAE9B,IACE,GAAG,EAAE,OAAO,EAAE,aAAa;YAC3B,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChD,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7C,KAAK,GAAG,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpD,IACE,CAAC,KAAK;YACN,GAAG,EAAE,OAAO,EAAE,kBAAkB,KAAK,UAAU;YAC/C,GAAG,CAAC,OAAO,EACX,CAAC;YACD,KAAK,GAAG,GAAG,EAAE,OAAO,EAAE,kBAAkB,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,oBAAoB,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,EAAE;YAAE,MAAM,oBAAoB,CAAC;QAC7C,MAAM,IAAI,GAAe,MAAO,MAAc,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7D,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;SAClC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,QAAQ,CAChB,wDAAwD,EACxD,GAAG,EACH,oBAAoB,CACrB,CAAC;QAEJ,IACE,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAI,CAAC;YACjD,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC;YAE/B,MAAM,IAAI,QAAQ,CAChB,sDAAsD,EACtD,GAAG,EACH,iBAAiB,CAClB,CAAC;QAEJ,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IA4BD,2BAA2B,CACzB,MAAoB,EACpB,qBAA+D;QAE/D,IAAI,qBAAqB,IAAI,OAAO,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YACvE,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAC;iBACxD,IAAI,qBAAqB,CAAC,MAAM,CAAC,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAC5E,CAAC;;YAAM,OAAO,IAAI,CAAC,YAAY,CAAC;QAEhC,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAyBD,UAAU,CACR,MAAc,EACd,QAAgB,EAChB,aAAmC;QAGnC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC;QAEhC,IAAI,KAAK,EAAE,QAAQ,CAAC,0CAA0C,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QAEJ,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEvD,OAAO,KAAK,EAAE,IAAsB,EAAoB,EAAE;YAExD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YAEjC,IAAI,CAAC,qBAAqB,EAAE;gBAC1B,MAAM,KAAK,CACT,2FAA2F,CAC5F,CAAC;YAEJ,IAAI,CAAC,uBAAuB,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,MAAM,kBAAkB,CAAC;YACpC,IAAI,IAAI,EAAE,WAAW;gBAAE,OAAO,IAAI,CAAC;YAEnC,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChD,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,OAAO,CACL,CAAC,CAAC,aAAa;oBACf,IAAI,CAAC,wBAAwB,CAAC,IAAW,EAAE,MAAM,EAAE,aAAa,CAAC,CAClE,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;IACJ,CAAC;CACF;AAKD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,eAAe,WAAW,CAAC","sourcesContent":["import jwt, { SignOptions } from \"jsonwebtoken\";\nimport bcrypt from \"bcryptjs\";\nimport { User } from \"../../types\";\nimport catchAsync from \"../error-handler/utils/catch-async\";\nimport AppError from \"../error-handler/utils/app-error\";\nimport { callNext } from \"../base/base.middlewares\";\nimport { getArkosConfig } from \"../../server\";\nimport arkosEnv from \"../../utils/arkos-env\";\nimport { getPrismaInstance } from \"../../utils/helpers/prisma.helpers\";\nimport {\n  ArkosRequest,\n  ArkosResponse,\n  ArkosNextFunction,\n  ArkosRequestHandler,\n} from \"../../types\";\nimport {\n  AuthJwtPayload,\n  AccessAction,\n  AccessControlConfig,\n  AuthenticationControlConfig,\n  AccessControlRules,\n  DetailedAccessControlRule,\n} from \"../../types/auth\";\nimport { MsDuration, toMs } from \"./utils/helpers/auth.controller.helpers\";\nimport {\n  invaliAuthTokenError,\n  loginRequiredError,\n} from \"./utils/auth-error-objects\";\nimport authActionService from \"./utils/services/auth-action.service\";\nimport {\n  isAuthenticationEnabled,\n  isUsingAuthentication,\n} from \"../../utils/helpers/arkos-config.helpers\";\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nexport class AuthService {\n  /**\n   * Object containing a combination of actions per resource, tracked by each set of calls of `authService.handleAccessControl`, this can be accessed through the `authService` object or through the endpoint\n   */\n  actionsPerResource: Record<string, Set<string>> = {};\n\n  /**\n   * Signs a JWT token for the user.\n   *\n   * @param {number | string} id - The unique identifier of the user to generate the token for.\n   * @param {string | number} [expiresIn] - The expiration time for the token. Defaults to environment variable `JWT_EXPIRES_IN`.\n   * @param {string} [secret] - The secret key used to sign the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {string} The signed JWT token.\n   */\n  signJwtToken(\n    id: number | string,\n    expiresIn?: MsDuration | number,\n    secret?: string\n  ): string {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === \"true\" &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        \"Missing JWT secret on production!\",\n        500,\n        \"MissingJWTOnProduction\"\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    expiresIn = (expiresIn ||\n      configs?.jwt?.expiresIn ||\n      process.env.JWT_EXPIRES_IN ||\n      arkosEnv.JWT_EXPIRES_IN) as keyof SignOptions[\"expiresIn\"];\n\n    return jwt.sign({ id }, secret, {\n      expiresIn: expiresIn as MsDuration,\n    });\n  }\n\n  /**\n   * Retrieves cookie configuration options for JWT authentication.\n   *\n   * Merges configuration from multiple sources in order of precedence:\n   * 1. Arkos configuration file\n   * 2. Environment variables\n   * 3. Request properties (for secure flag)\n   * 4. Default fallback values\n   *\n   * @param req - ArkosRequest object used to determine if the connection is secure\n   * @returns Cookie options object with expires, httpOnly, secure, and sameSite properties\n   *\n   * @example\n   * ```typescript\n   * const cookieOptions = authService.getJwtCookieOptions(req);\n   * res.cookie('jwt', token, cookieOptions);\n   * ```\n   */\n  getJwtCookieOptions(req: ArkosRequest) {\n    const arkosConfig = getArkosConfig();\n    const authConfigs = arkosConfig?.authentication;\n\n    if (!req)\n      throw new Error(\"Missing req object in order get jwt cookie options\");\n\n    const sameSite =\n      authConfigs?.jwt?.cookie?.sameSite ||\n      (process.env.JWT_COOKIE_SAME_SITE as\n        | \"none\"\n        | \"lax\"\n        | \"strict\"\n        | undefined) ||\n      \"lax\";\n\n    return {\n      expires: new Date(\n        Date.now() +\n          Number(\n            toMs(\n              authConfigs?.jwt?.expiresIn ||\n                (process.env.JWT_EXPIRES_IN as MsDuration) ||\n                (arkosEnv.JWT_EXPIRES_IN as MsDuration)\n            )\n          )\n      ),\n      httpOnly:\n        authConfigs?.jwt?.cookie?.httpOnly ??\n        (process.env.JWT_COOKIE_HTTP_ONLY !== undefined\n          ? process.env.JWT_COOKIE_HTTP_ONLY === \"true\"\n          : undefined) ??\n        true,\n      secure: (() => {\n        if (authConfigs?.jwt?.cookie?.secure !== undefined)\n          return authConfigs?.jwt?.cookie?.secure;\n        else if (process.env.JWT_COOKIE_SECURE !== undefined)\n          return process.env.JWT_COOKIE_SECURE === \"true\";\n        else return req.secure || req.headers[\"x-forwarded-proto\"] === \"https\";\n      })(),\n      sameSite,\n    };\n  }\n\n  /**\n   * Is used by default internally by Arkos under `BaseService` class to check if the password is already hashed.\n   *\n   * This was just added to prevent unwanted errors when someone just forgets that the `BaseService` class will automatically hash the password field using `authService.hashPassword` by default.\n   *\n   * So now before `BaseService` hashes it will test it.\n   *\n   *\n   * @param password The password to be tested if is hashed\n   * @returns\n   */\n  isPasswordHashed(password: string) {\n    return !Number.isNaN(bcrypt.getRounds(password) * 1);\n  }\n\n  /**\n   * Compares a candidate password with the stored user password to check if they match.\n   *\n   * @param {string} candidatePassword - The password provided by the user during login.\n   * @param {string} userPassword - The password stored in the database.\n   * @returns {Promise<boolean>} Returns true if the passwords match, otherwise false.\n   */\n  async isCorrectPassword(\n    candidatePassword: string,\n    userPassword: string\n  ): Promise<boolean> {\n    return await bcrypt.compare(candidatePassword, userPassword);\n  }\n\n  /**\n   * Hashes a plain text password using bcrypt.\n   *\n   * @param {string} password - The password to be hashed.\n   * @returns {Promise<string>} Returns the hashed password.\n   */\n  async hashPassword(password: string): Promise<string> {\n    return await bcrypt.hash(password, 12);\n  }\n\n  /**\n   * Checks if a password is strong, requiring uppercase, lowercase, and numeric characters as the default.\n   *\n   * **NB**: You must pay attention when using custom validation with zod or class-validator, try to use the same regex always.\n   *\n   * **Note**: You can define it when calling arkos.init()\n   * ```ts\n   * arkos.init({\n   *  authentication: {\n   *    passwordValidation:{ regex: /your-desired-regex/, message: 'password must contain...'}\n   *  }\n   * })\n   * ```\n   *\n   * @param {string} password - The password to check.\n   * @returns {boolean} Returns true if the password meets the strength criteria, otherwise false.\n   */\n  public isPasswordStrong(password: string): boolean {\n    const initAuthConfigs = getArkosConfig()?.authentication;\n\n    const strongPasswordRegex =\n      initAuthConfigs?.passwordValidation?.regex ||\n      /^(?=.*[A-Z])(?=.*[a-z])(?=.*\\d).+$/;\n    return strongPasswordRegex.test(password);\n  }\n\n  /**\n   * Checks if a user has changed their password after the JWT was issued.\n   *\n   * @param {User} user - The user object containing the passwordChangedAt field.\n   * @param {number} JWTTimestamp - The timestamp when the JWT was issued.\n   * @returns {boolean} Returns true if the user changed their password after the JWT was issued, otherwise false.\n   */\n  userChangedPasswordAfter(user: User, JWTTimestamp: number): boolean {\n    if (user.passwordChangedAt) {\n      const convertedTimestamp = parseInt(\n        String(user.passwordChangedAt.getTime() / 1000),\n        10\n      );\n\n      return JWTTimestamp < convertedTimestamp;\n    }\n    return false;\n  }\n\n  /**\n   * Verifies the authenticity of a JWT token.\n   *\n   * @param {string} token - The JWT token to verify.\n   * @param {string} [secret] - The secret key used to verify the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {Promise<AuthJwtPayload>} Returns the decoded JWT payload if the token is valid.\n   * @throws {Error} Throws an error if the token is invalid or expired.\n   */\n  async verifyJwtToken(\n    token: string,\n    secret?: string\n  ): Promise<AuthJwtPayload> {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === \"true\" &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        \"Missing JWT secret in production\",\n        500,\n        \"MissingJWTSecretInProduction\"\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    return new Promise((resolve, reject) => {\n      jwt.verify(token, secret, (err, decoded) => {\n        if (err) reject(err);\n        else resolve(decoded as AuthJwtPayload);\n      });\n    });\n  }\n\n  private isWildcardAccess(config: AccessControlConfig): config is \"*\" {\n    return config === \"*\";\n  }\n\n  private isRoleList(config: AccessControlConfig): config is string[] {\n    return Array.isArray(config);\n  }\n\n  private isAccessRules(\n    config: AccessControlConfig\n  ): config is Partial<AccessControlRules> {\n    return (\n      typeof config === \"object\" && config !== null && !Array.isArray(config)\n    );\n  }\n\n  private normalizeRuleToRoles(\n    rule: string[] | DetailedAccessControlRule | \"*\" | undefined\n  ): string[] {\n    if (!rule) return [];\n    if (rule === \"*\") return [\"*\"];\n    if (Array.isArray(rule)) return rule;\n    return rule.roles === \"*\" ? [\"*\"] : (rule.roles ?? []);\n  }\n\n  private resolveAuthorizedRoles(\n    action: AccessAction,\n    accessControl: AccessControlConfig\n  ): string[] {\n    if (this.isWildcardAccess(accessControl)) return [\"*\"];\n    if (this.isRoleList(accessControl)) return accessControl;\n    if (this.isAccessRules(accessControl))\n      return this.normalizeRuleToRoles(accessControl[action]);\n    return [];\n  }\n\n  /**\n   * Checks if a user has permission for a specific action using static access control rules.\n   * Validates user roles against predefined access control configuration.\n   *\n   * @param user - The user object containing role or roles field\n   * @param action - The action being performed\n   * @param accessControl - Access control configuration (array of roles or object with action-role mappings)\n   * @returns True if user has permission, false otherwise\n   * @throws Error if user doesn't have role/roles field\n   */\n  protected checkStaticAccessControl(\n    user: User,\n    action: string,\n    accessControl: AccessControlConfig\n  ) {\n    if (!user?.role && !user.roles)\n      throw Error(\n        \"Validation Error: In order to use static authentication user needs at least role field or roles for multiple roles.\"\n      );\n\n    let authorizedRoles = this.resolveAuthorizedRoles(action, accessControl);\n\n    const userRoles = Array.isArray(user?.roles) ? user.roles : [user.role];\n\n    return (\n      authorizedRoles?.[0] === \"*\" ||\n      !!userRoles.some((role: string) => authorizedRoles.includes(role))\n    );\n  }\n\n  /**\n   * Checks if a user has permission for a specific action and resource using dynamic access control.\n   * Queries the database to verify user's role permissions.\n   *\n   * @param userId - The unique identifier of the user\n   * @param action - The action being performed\n   * @param resource - The resource being accessed\n   * @returns Promise resolving to true if user has permission, false otherwise\n   */\n  protected async checkDynamicAccessControl(\n    userId: string,\n    action: string,\n    resource: string\n  ) {\n    const prisma = getPrismaInstance();\n    return !!(await prisma.userRole.findFirst({\n      where: {\n        userId,\n        role: {\n          permissions: {\n            some: {\n              resource,\n              action,\n            },\n          },\n        },\n      },\n      select: { id: true },\n    }));\n  }\n\n  /**\n   * Middleware function to handle access control based on user roles and permissions.\n   *\n   * @param {AccessAction} action - The action being performed (e.g., create, update, delete, view).\n   * @param {string} resource - The resource name that the action is being performed on (e.g., \"User\", \"Post\").\n   * @param {AccessControlConfig} accessControl - The access control configuration.\n   * @returns {ArkosRequestHandler} The middleware function that checks if the user has permission to perform the action.\n   */\n  handleAccessControl(\n    action: AccessAction,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ): ArkosRequestHandler {\n    authActionService.add(action, resource, accessControl);\n\n    return catchAsync(\n      async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        if (req.user) {\n          const user = req.user as User;\n          const configs = getArkosConfig();\n\n          if (user.isSuperUser) {\n            next();\n            return;\n          }\n\n          const notEnoughPermissionsError = new AppError(\n            \"You do not have permission to perfom this action\",\n            403,\n            \"NotEnoughPermissions\"\n          );\n\n          if (configs?.authentication?.mode === \"dynamic\") {\n            const hasPermission = await this.checkDynamicAccessControl(\n              user.id,\n              action,\n              resource\n            );\n\n            if (!hasPermission) return next(notEnoughPermissionsError);\n          } else if (configs?.authentication?.mode === \"static\") {\n            if (!accessControl) return next(notEnoughPermissionsError);\n\n            const hasPermission = this.checkStaticAccessControl(\n              user,\n              action,\n              accessControl\n            );\n\n            if (!hasPermission) return next(notEnoughPermissionsError);\n          }\n        }\n\n        next();\n      }\n    );\n  }\n\n  /**\n   * Processes the cookies or authoriation token and returns the user.\n   * @param req\n   * @returns {Promise<User | null>} - if authentication is turned off in arkosConfig it returns null\n   * @throws {AppError} Throws an error if the token is invalid or the user is not logged in.\n   */\n  async getAuthenticatedUser(req: ArkosRequest): Promise<User | null> {\n    if (!isAuthenticationEnabled())\n      throw Error(\n        \"ValidationError: Trying to call AuthService.getAuthenticatedUser without setting up authentication\"\n      );\n\n    const prisma = getPrismaInstance();\n\n    let token: string | undefined;\n\n    if (\n      req?.headers?.authorization &&\n      req?.headers?.authorization.startsWith(\"Bearer\") &&\n      req?.headers?.authorization.split?.(\" \")?.[1]\n    )\n      token = req?.headers?.authorization.split(\" \")[1];\n\n    if (\n      !token &&\n      req?.cookies?.arkos_access_token !== \"no-token\" &&\n      req.cookies\n    ) {\n      token = req?.cookies?.arkos_access_token;\n    }\n\n    if (!token) return null;\n\n    let decoded: AuthJwtPayload | undefined;\n\n    try {\n      decoded = await this.verifyJwtToken(token);\n    } catch (err) {\n      throw invaliAuthTokenError;\n    }\n\n    if (!decoded?.id) throw invaliAuthTokenError;\n    const user: any | null = await (prisma as any).user.findUnique({\n      where: { id: String(decoded.id) },\n    });\n\n    if (!user)\n      throw new AppError(\n        \"The user belonging to this token does no longer exists\",\n        401,\n        \"UserNoLongerExists\"\n      );\n\n    if (\n      this.userChangedPasswordAfter(user, decoded.iat!) &&\n      !req.path?.includes?.(\"logout\")\n    )\n      throw new AppError(\n        \"User recently changed password! Please log in again.\",\n        401,\n        \"PasswordChanged\"\n      );\n\n    req.accessToken = token;\n    return user;\n  }\n\n  /**\n   * Middleware function to authenticate the user based on the JWT token.\n   *\n   * @param {ArkosRequest} req - The request object.\n   * @param {ArkosResponse} res - The response object.\n   * @param {ArkosNextFunction} next - The next middleware function to be called.\n   * @returns {void}\n   */\n  authenticate = catchAsync(\n    async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n      if (isAuthenticationEnabled()) {\n        const user = (await this.getAuthenticatedUser(req)) as User;\n        if (!user) throw loginRequiredError;\n        req.user = user;\n      }\n      next();\n    }\n  );\n\n  /**\n   * Handles authentication control by checking the `authenticationControl` configuration in the `authConfigs`.\n   *\n   * @param {ControllerActions} action - The action being performed (e.g., create, update, delete, view).\n   * @param {AuthenticationControlConfig} authenticationControl - The authentication configuration object.\n   * @returns {ArkosRequestHandler} The middleware function that checks if authentication is required.\n   */\n  handleAuthenticationControl(\n    action: AccessAction,\n    authenticationControl?: AuthenticationControlConfig | undefined\n  ): ArkosRequestHandler {\n    if (authenticationControl && typeof authenticationControl === \"object\") {\n      if (authenticationControl[action] === false) return callNext;\n      else if (authenticationControl[action] === true) return this.authenticate;\n    } else return this.authenticate;\n\n    return this.authenticate;\n  }\n\n  /**\n   * Creates a permission checker function for a specific action and resource.\n   *\n   * PS: This method should be called during application initialization to build permission validators.\n   *\n   * @see {@link https://www.arkosjs.com/docs/advanced-guide/fine-grained-access-control}\n   *\n   * @param action - The action to check permission for (e.g., 'View', 'Create', 'Delete')\n   * @param resource - The resource being accessed, must be in kebabCase (e.g., 'user', 'cart-item', 'order')\n   * @param accessControl - Access control rules (required for static authentication mode), and it is automatically loaded for known modules such as all prisma models, auth and file-upload.\n   * @returns A function that takes a user object and returns a boolean indicating permission status\n   *\n   * @example\n   * ```typescript\n   * const hasViewProductPermission = await authService.permission('View', 'product');\n   *\n   * // Later in handler:\n   * const canAccess = await hasViewProductPermission(user);\n   * if (canAccess) {\n   *   // User has permission\n   * }\n   * ```\n   */\n  permission(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig\n  ) {\n    // Check if called during request handling (deep call stack indicates handler execution)\n    const stack = new Error().stack;\n\n    if (stack?.includes(\"node_modules/express/lib/router/index.js\"))\n      throw new Error(\n        \"authService.permission() should be called during application initialization level.\"\n      );\n\n    authActionService.add(action, resource, accessControl);\n\n    return async (user: User | undefined): Promise<boolean> => {\n      // getArkosConfig must not be called the same time as arkos.init()\n      const configs = getArkosConfig();\n\n      if (!isUsingAuthentication())\n        throw Error(\n          \"Validation Error: Trying to use authService.permission without setting up authentication.\"\n        );\n\n      if (!isAuthenticationEnabled()) return false;\n      if (!user) throw loginRequiredError;\n      if (user?.isSuperUser) return true;\n\n      if (configs?.authentication?.mode === \"dynamic\") {\n        return await this.checkDynamicAccessControl(user?.id, action, resource);\n      } else if (configs?.authentication?.mode === \"static\") {\n        return (\n          !!accessControl &&\n          this.checkStaticAccessControl(user as any, action, accessControl)\n        );\n      }\n      return false;\n    };\n  }\n}\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nconst authService = new AuthService();\n\nexport default authService;\n"]}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,GAAoB,MAAM,cAAc,CAAC;AAChD,OAAO,MAAM,MAAM,UAAU,CAAC;AAE9B,OAAO,UAAU,MAAM,oCAAoC,CAAC;AAC5D,OAAO,QAAQ,MAAM,kCAAkC,CAAC;AACxD,OAAO,QAAQ,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAcvE,OAAO,EAEL,IAAI,EACJ,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAa1D,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,iBAAiB,MAAM,sCAAsC,CAAC;AACrE,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,eAAe,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,eAAe,EACf,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAKvC,MAAM,OAAO,WAAW;IAItB,kBAAkB,GAAgC,EAAE,CAAC;IAE7C,YAAY,CAA8B;IAElD,IAAc,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAUD,YAAY,CACV,EAAmB,EACnB,SAA+B,EAC/B,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,QAAQ,CAChB,mCAAmC,EACnC,GAAG,EACH,wBAAwB,CACzB,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,QAAQ,CAAC,UAAU,CAAC;QAEtB,SAAS,GAAG,CAAC,SAAS;YACpB,OAAO,EAAE,GAAG,EAAE,SAAS;YACvB,OAAO,CAAC,GAAG,CAAC,cAAc;YAC1B,QAAQ,CAAC,cAAc,CAAmC,CAAC;QAE7D,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YAC9B,SAAS,EAAE,SAAuB;SACnC,CAAC,CAAC;IACL,CAAC;IAoBD,mBAAmB,CAAC,GAAiB;QACnC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,WAAW,EAAE,cAAc,CAAC;QAEhD,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAExE,MAAM,QAAQ,GACZ,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;YACjC,OAAO,CAAC,GAAG,CAAC,oBAC2B;YACxC,KAAK,CAAC;QAER,OAAO;YACL,OAAO,EAAE,IAAI,IAAI,CACf,IAAI,CAAC,GAAG,EAAE;gBACR,MAAM,CACJ,IAAI,CACF,WAAW,EAAE,GAAG,EAAE,SAAS;oBACxB,OAAO,CAAC,GAAG,CAAC,cAA6B;oBACzC,QAAQ,CAAC,cAA6B,CAC1C,CACF,CACJ;YACD,QAAQ,EACN,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ;gBAClC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS;oBAC7C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM;oBAC7C,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI;YACN,MAAM,EAAE,CAAC,GAAG,EAAE;gBACZ,IAAI,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS;oBAChD,OAAO,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC;qBACrC,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBAClD,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;;oBAC7C,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAC;YACzE,CAAC,CAAC,EAAE;YACJ,QAAQ;YACR,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACzE,GAAG,WAAW,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM;SAC3B,CAAC;IACrB,CAAC;IAaD,gBAAgB,CAAC,QAAgB;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;IASD,KAAK,CAAC,iBAAiB,CACrB,iBAAyB,EACzB,YAAoB;QAEpB,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAC/D,CAAC;IAQD,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IASD,wBAAwB,CAAC,IAAU,EAAE,YAAoB;QACvD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,kBAAkB,GAAG,QAAQ,CACjC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EACzD,EAAE,CACH,CAAC;YAEF,OAAO,YAAY,GAAG,kBAAkB,CAAC;QAC3C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAUD,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,MAAe;QAEf,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;QAErD,IACE,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM;YAClC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YACvB,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM;YAErB,MAAM,IAAI,QAAQ,CAChB,kCAAkC,EAClC,GAAG,EACH,8BAA8B,CAC/B,CAAC;QAEJ,MAAM;YACJ,MAAM;gBACN,OAAO,EAAE,GAAG,EAAE,MAAM;gBACpB,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,QAAQ,CAAC,UAAU,CAAC;QAEtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACrD,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;oBACzC,IAAI,GAAG;wBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;wBAChB,OAAO,CAAC,OAAyB,CAAC,CAAC;gBAC1C,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAmB,CAAC;YAEtB,IAAI,CAAC,OAAO,EAAE,EAAE;gBAAE,MAAM,oBAAoB,CAAC;YAE7C,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,oBAAoB,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,MAA2B;QAClD,OAAO,MAAM,KAAK,GAAG,CAAC;IACxB,CAAC;IAEO,UAAU,CAAC,MAA2B;QAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAEO,aAAa,CACnB,MAA2B;QAE3B,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CACxE,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAC1B,IAA4D;QAE5D,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAEO,sBAAsB,CAC5B,MAAoB,EACpB,aAAkC;QAElC,IAAI,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,OAAO,aAAa,CAAC;QACzD,IAAI,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC;YACnC,OAAO,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IAYD,wBAAwB,CACtB,IAAU,EACV,MAAc,EACd,aAAkC;QAElC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK;YAC5B,MAAM,KAAK,CACT,qHAAqH,CACtH,CAAC;QAEJ,IAAI,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAEzE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExE,OAAO,CACL,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG;YAC5B,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IAWD,KAAK,CAAC,yBAAyB,CAC7B,MAAc,EACd,MAAc,EACd,QAAgB;QAEhB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAEnC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5D,MAAM,CAAC,cAAc;gBACnB,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;oBAC9B,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;oBACnD,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACzB,CAAC;gBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAEzB,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACxB,KAAK,EAAE;oBACL,MAAM;oBACN,IAAI,EAAE;wBACJ,WAAW,EAAE;4BACX,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;yBAC3B;qBACF;iBACF;gBACD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;aACrB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC,MAAM,KAAK,OAAO,CAAC;QAC7D,OAAO,CAAC,CAAC,iBAAiB,CAAC;IAC7B,CAAC;IAEO,YAAY,CAAC,IAAyB;QAC5C,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC;QACnD,OAAO,SAAqB,CAAC;IAC/B,CAAC;IAEO,oBAAoB,CAC1B,YAAgB;QAEhB,MAAM,OAAO,GAAwB,EAAE,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;QAEjE,IAAI,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAE3E,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YACtD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAWD,KAAK,CAAC,KAAK,CACT,MAAkB,EAClB,YAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CACzC,EAAE,EAAE,EAAE,MAAM,EAAE,EACd,YAAY,IAAI,EAAE,CACnB,CAAC;QAEF,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAaD,KAAK,CAAC,QAAQ,CACZ,MAAkB,EAClB,IAAiB,EACjB,YAA8B;QAE9B,IAAI,UAAU,IAAK,IAA4B;YAC7C,MAAM,IAAI,eAAe,CACvB,+DAA+D,EAC/D,sBAAsB,CACvB,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAC3C,EAAE,EAAE,EAAE,MAAM,EAAE,EACd,IAAI,EACJ,YAAY,IAAI,EAAE,CACnB,CAAC;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAWD,KAAK,CAAC,MAAM,CACV,IAAe,EACf,YAA4B;QAE5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;QAExE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAYD,KAAK,CAAC,QAAQ,CACZ,MAAkB,EAClB,YAA8B;QAE9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAC3C,EAAE,EAAE,EAAE,MAAM,EAAE,EACd,EAAE,oBAAoB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAClD,YAAY,IAAI,EAAE,CACnB,CAAC;QAEF,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAoBD,KAAK,CAAC,KAAK,CACT,KAAiB,EACjB,YAA2B;QAE3B,MAAM,EAAE,QAAQ,EAAE,GAAG,KAA6B,CAAC;QACnD,MAAM,aAAa,GAChB,KAAoC,CAAC,aAAa;YACnD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,eAAe,CACvD;YACD,uBAAuB,EAAE,CAAC;QAE5B,MAAM,gBAAgB,GACpB,cAAc,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,CAAC;QAE5D,IAAI,gBAAgB,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,aAAa,CAAC;YACvE,MAAM,IAAI,eAAe,CACvB,4CAA4C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACzE,sBAAsB,CACvB,CAAC;QAEJ,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;QAClD,MAAM,QAAQ,GAAI,KAA6B,CAAC,SAAS,CAAC,CAAC;QAE3D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YACxB,MAAM,IAAI,eAAe,CACvB,uBAAuB,SAAS,eAAe,EAC/C,yBAAyB,CAC1B,CAAC;QAEJ,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAC1C,uBAAuB,CAAC,aAAa,EAAE,QAAQ,CAAC,EAChD,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CACxC,CAA+B,CAAC;QAEjC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,IAAI,iBAAiB,CACzB,aAAa,SAAS,cAAc,EACpC,sBAAsB,CACvB,CAAC;QAEJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC7B,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC;IAYD,KAAK,CAAC,cAAc,CAClB,MAAkB,EAClB,KAA0B;QAE1B,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAE/C,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW;YAClC,MAAM,IAAI,QAAQ,CAChB,8CAA8C,EAC9C,GAAG,EACH,2BAA2B,CAC5B,CAAC;QAEJ,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAC1C,EAAE,EAAE,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,oBAAoB,EAAE,CAC5B,CAA+B,CAAC;QAEjC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,oBAAoB;YAC/D,MAAM,IAAI,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAE7C,IACE,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAC5B,MAAM,CAAC,eAAe,CAAC,EACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CACtB,CAAC;YAEF,MAAM,IAAI,QAAQ,CAChB,+BAA+B,EAC/B,GAAG,EACH,0BAA0B,CAC3B,CAAC;QAEJ,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAC9B,EAAE,EAAE,EAAE,MAAM,EAAE,EACd;YACE,QAAQ,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACtD,iBAAiB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;SACtD,CACF,CAAC;QAEF,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;IACpD,CAAC;IAOD,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,YAAoB,IAAkB,CAAC;IAEjE,mBAAmB,CACzB,GAAiB,EACjB,SAA+B,oBAAoB;QAEnD,OAAO,mBAAmB,CAAC;YACzB,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa;YAC1C,OAAO,EAAE,GAAG,EAAE,OAAO;YACrB,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAEO,kBAAkB,CAAC,MAAmB,EAAE,MAAe,OAAO;QACpE,MAAM,aAAa,GAAI,MAAM,CAAC,OAAe,EAAE,OAAO,EAAE,MAAM,CAAC;QAE/D,OAAO,kBAAkB,CAAC;YACxB,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI;YAC5B,GAAG;YACH,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO;YAClC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO;YAClC,YAAY,EAAE,aAAa;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,OAAuB,EACvB,SAA+B,SAAS;QAExC,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,QAAQ,CAChB,mDAAmD,EACnD,GAAG,EACH,oBAAoB,CACrB,CAAC;QAEJ,IACE,MAAM,KAAK,QAAQ;YACnB,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,OAAO,CAAC,GAAI,CAAC;YAEjD,MAAM,IAAI,QAAQ,CAChB,sDAAsD,EACtD,GAAG,EACH,iBAAiB,CAClB,CAAC;QAEJ,OAAO,IAAI,CAAC;IACd,CAAC;IASD,KAAK,CAAC,oBAAoB,CACxB,GAA+B,EAC/B,SAA+B,SAAS;QAExC,IAAI,CAAC,uBAAuB,EAAE;YAC5B,MAAM,KAAK,CACT,qGAAqG,oBAAoB,EAAE,SAAS,uBAAuB,CAAC,KAAK,EAAE,CACpK,CAAC;QAEJ,IAAI,KAAK,GAAkB,IAAI,CAAC;QAEhC,IAAI,SAAS,IAAI,GAAG;YAAE,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;aACvD,IAAI,MAAM,IAAI,GAAG;YAAE,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAE7D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjD,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC;QAExB,OAAO,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAkCD,YAAY,GAAG,UAAU,CACvB,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;QACrE,MAAM,eAAe,CAAC,eAAe,CACnC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAC5B,KAAK,EAAE,GAAG,EAAgB,EAAE;YAC1B,IAAI,CAAC,uBAAuB,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAC3C,GAAG,EACH,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CACnD,CAAS,CAAC;YACX,IAAI,CAAC,IAAI;gBAAE,MAAM,kBAAkB,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CACF,CAAC;IAwCF,SAAS,CACP,MAAoB,EACpB,QAAgB,EAChB,IAAiD;QAEjD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE;YACzD,CAAC,MAAM,CAAC,EAAE,IAAI;SACf,CAAC,CAAC;QAEH,OAAO,UAAU,CACf,KAAK,EAAE,GAAiB,EAAE,CAAgB,EAAE,IAAuB,EAAE,EAAE;YACrE,MAAM,eAAe,CAAC,YAAY,CAChC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAC5B,UAAU,CACX,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAyBD,UAAU,CACR,MAAc,EACd,QAAgB,EAChB,aAAmC;QAGnC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,KAAK,CAAC;QAEhC,IAAI,KAAK,EAAE,QAAQ,CAAC,0CAA0C,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;QAEJ,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEvD,OAAO,KAAK,EAAE,IAAsB,EAAoB,EAAE;YAExD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;YAEjC,IAAI,CAAC,qBAAqB,EAAE;gBAC1B,MAAM,KAAK,CACT,2FAA2F,CAC5F,CAAC;YAEJ,IAAI,CAAC,uBAAuB,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,MAAM,kBAAkB,CAAC;YACpC,IAAI,IAAI,EAAE,WAAW;gBAAE,OAAO,IAAI,CAAC;YAEnC,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBAChD,OAAO,MAAM,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,OAAO,EAAE,cAAc,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtD,OAAO,CACL,CAAC,CAAC,aAAa;oBACf,IAAI,CAAC,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAC3D,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;IACJ,CAAC;CACF;AAKD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,eAAe,WAAW,CAAC","sourcesContent":["import jwt, { SignOptions } from 'jsonwebtoken';\nimport bcrypt from 'bcryptjs';\nimport { User } from '../../types';\nimport catchAsync from '../error-handler/utils/catch-async';\nimport AppError from '../error-handler/utils/app-error';\nimport arkosEnv from '../../utils/arkos-env';\nimport { getPrismaInstance } from '../../utils/helpers/prisma.helpers';\nimport {\n  ArkosRequest,\n  ArkosResponse,\n  ArkosNextFunction,\n  ArkosRequestHandler,\n} from '../../types';\nimport {\n  AuthJwtPayload,\n  AccessAction,\n  AccessControlConfig,\n  AccessControlRules,\n  DetailedAccessControlRule,\n} from '../../types/auth';\nimport {\n  MsDuration,\n  toMs,\n  createPrismaWhereClause,\n  getDefaultUsernameField,\n} from './utils/helpers/auth.controller.helpers';\nimport { ArkosPrismaService } from '../base/base.service';\nimport {\n  AuthUser,\n  DeleteMeOptions,\n  GetMeOptions,\n  LoginInput,\n  LoginOptions,\n  SignupDto,\n  SignupOptions,\n  UpdateMeDto,\n  UpdateMeOptions,\n  UpdatePasswordInput,\n} from './auth.types';\nimport {\n  invaliAuthTokenError,\n  loginRequiredError,\n} from './utils/auth-error-objects';\nimport authActionService from './utils/services/auth-action.service';\nimport {\n  getArkosConfig,\n  isAuthenticationEnabled,\n  isUsingAuthentication,\n} from '../../utils/helpers/arkos-config.helpers';\nimport { CookieOptions } from 'express';\nimport { getUserFileExtension } from '../../utils/helpers/fs.helpers';\nimport { authenticationDocsLinks } from './utils/docs-links';\nimport authHookManager from './utils/auth-hooks-manager';\nimport { ArkosSocket } from '../../components/arkos-gateway/types';\nimport {\n  resolveRequestToken,\n  resolveSocketToken,\n} from './utils/token-extraction';\nimport {\n  BadRequestError,\n  UnauthorizedError,\n} from '../error-handler/utils/errors';\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nexport class AuthService {\n  /**\n   * Object containing a combination of actions per resource, tracked by each set of calls of `authService.handleAccessControl`, this can be accessed through the `authService` object or through the endpoint\n   */\n  actionsPerResource: Record<string, Set<string>> = {};\n\n  private _userService?: ArkosPrismaService<'user'>;\n\n  protected get userService(): ArkosPrismaService<'user'> {\n    if (!this._userService) this._userService = new ArkosPrismaService('user');\n    return this._userService;\n  }\n\n  /**\n   * Signs a JWT token for the user.\n   *\n   * @param {number | string} id - The unique identifier of the user to generate the token for.\n   * @param {string | number} [expiresIn] - The expiration time for the token. Defaults to environment variable `JWT_EXPIRES_IN`.\n   * @param {string} [secret] - The secret key used to sign the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {string} The signed JWT token.\n   */\n  signJwtToken(\n    id: number | string,\n    expiresIn?: MsDuration | number,\n    secret?: string,\n  ): string {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === 'true' &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        'Missing JWT secret on production!',\n        500,\n        'MissingJWTOnProduction',\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    expiresIn = (expiresIn ||\n      configs?.jwt?.expiresIn ||\n      process.env.JWT_EXPIRES_IN ||\n      arkosEnv.JWT_EXPIRES_IN) as keyof SignOptions['expiresIn'];\n\n    return jwt.sign({ id }, secret, {\n      expiresIn: expiresIn as MsDuration,\n    });\n  }\n\n  /**\n   * Retrieves cookie configuration options for JWT authentication.\n   *\n   * Merges configuration from multiple sources in order of precedence:\n   * 1. Arkos configuration file\n   * 2. Environment variables\n   * 3. Request properties (for secure flag)\n   * 4. Default fallback values\n   *\n   * @param req - ArkosRequest object used to determine if the connection is secure\n   * @returns Cookie options object with expires, httpOnly, secure, and sameSite properties\n   *\n   * @example\n   * ```typescript\n   * const cookieOptions = authService.getJwtCookieOptions(req);\n   * res.cookie('jwt', token, cookieOptions);\n   * ```\n   */\n  getJwtCookieOptions(req: ArkosRequest) {\n    const arkosConfig = getArkosConfig();\n    const authConfigs = arkosConfig?.authentication;\n\n    if (!req)\n      throw new Error('Missing req object in order get jwt cookie options');\n\n    const sameSite =\n      authConfigs?.jwt?.cookie?.sameSite ||\n      (process.env.JWT_COOKIE_SAME_SITE as\n        'none' | 'lax' | 'strict' | undefined) ||\n      'lax';\n\n    return {\n      expires: new Date(\n        Date.now() +\n          Number(\n            toMs(\n              authConfigs?.jwt?.expiresIn ||\n                (process.env.JWT_EXPIRES_IN as MsDuration) ||\n                (arkosEnv.JWT_EXPIRES_IN as MsDuration),\n            ),\n          ),\n      ),\n      httpOnly:\n        authConfigs?.jwt?.cookie?.httpOnly ??\n        (process.env.JWT_COOKIE_HTTP_ONLY !== undefined\n          ? process.env.JWT_COOKIE_HTTP_ONLY === 'true'\n          : undefined) ??\n        true,\n      secure: (() => {\n        if (authConfigs?.jwt?.cookie?.secure !== undefined)\n          return authConfigs?.jwt?.cookie?.secure;\n        else if (process.env.JWT_COOKIE_SECURE !== undefined)\n          return process.env.JWT_COOKIE_SECURE === 'true';\n        else return req.secure || req.headers['x-forwarded-proto'] === 'https';\n      })(),\n      sameSite,\n      domain: authConfigs?.jwt?.cookie?.domain || process.env.JWT_COOKIE_DOMAIN,\n      ...arkosConfig?.authentication?.jwt?.cookie,\n    } as CookieOptions;\n  }\n\n  /**\n   * Is used by default internally by Arkos under `ArkosPrismaService` class to check if the password is already hashed.\n   *\n   * This was just added to prevent unwanted errors when someone just forgets that the `ArkosPrismaService` class will automatically hash the password field using `authService.hashPassword` by default.\n   *\n   * So now before `ArkosPrismaService` hashes it will test it.\n   *\n   *\n   * @param password The password to be tested if is hashed\n   * @returns\n   */\n  isPasswordHashed(password: string) {\n    return !Number.isNaN(bcrypt.getRounds(password) * 1);\n  }\n\n  /**\n   * Compares a candidate password with the stored user password to check if they match.\n   *\n   * @param {string} candidatePassword - The password provided by the user during login.\n   * @param {string} userPassword - The password stored in the database.\n   * @returns {Promise<boolean>} Returns true if the passwords match, otherwise false.\n   */\n  async isCorrectPassword(\n    candidatePassword: string,\n    userPassword: string,\n  ): Promise<boolean> {\n    return await bcrypt.compare(candidatePassword, userPassword);\n  }\n\n  /**\n   * Hashes a plain text password using bcrypt.\n   *\n   * @param {string} password - The password to be hashed.\n   * @returns {Promise<string>} Returns the hashed password.\n   */\n  async hashPassword(password: string): Promise<string> {\n    return await bcrypt.hash(password, 12);\n  }\n\n  /**\n   * Checks if a user has changed their password after the JWT was issued.\n   *\n   * @param {User} user - The user object containing the passwordChangedAt field.\n   * @param {number} JWTTimestamp - The timestamp when the JWT was issued.\n   * @returns {boolean} Returns true if the user changed their password after the JWT was issued, otherwise false.\n   */\n  userChangedPasswordAfter(user: User, JWTTimestamp: number): boolean {\n    if (user.passwordChangedAt) {\n      const convertedTimestamp = parseInt(\n        String(new Date(user.passwordChangedAt).getTime() / 1000),\n        10,\n      );\n\n      return JWTTimestamp < convertedTimestamp;\n    }\n    return false;\n  }\n\n  /**\n   * Verifies the authenticity of a JWT token.\n   *\n   * @param {string} token - The JWT token to verify.\n   * @param {string} [secret] - The secret key used to verify the token. Defaults to environment variable `JWT_SECRET`.\n   * @returns {Promise<AuthJwtPayload>} Returns the decoded JWT payload if the token is valid.\n   * @throws {Error} Throws an error if the token is invalid or expired.\n   */\n  async verifyJwtToken(\n    token: string,\n    secret?: string,\n  ): Promise<AuthJwtPayload> {\n    const { authentication: configs } = getArkosConfig();\n\n    if (\n      process.env.ARKOS_BUILD === 'true' &&\n      !process.env.JWT_SECRET &&\n      !configs?.jwt?.secret\n    )\n      throw new AppError(\n        'Missing JWT secret in production',\n        500,\n        'MissingJWTSecretInProduction',\n      );\n\n    secret =\n      secret ||\n      configs?.jwt?.secret ||\n      process.env.JWT_SECRET ||\n      arkosEnv.JWT_SECRET;\n\n    try {\n      const decoded = (await new Promise((resolve, reject) => {\n        jwt.verify(token, secret, (err, decoded) => {\n          if (err) reject(err);\n          else resolve(decoded as AuthJwtPayload);\n        });\n      })) as AuthJwtPayload;\n\n      if (!decoded?.id) throw invaliAuthTokenError;\n\n      return decoded;\n    } catch (err) {\n      throw invaliAuthTokenError;\n    }\n  }\n\n  private isWildcardAccess(config: AccessControlConfig): config is '*' {\n    return config === '*';\n  }\n\n  private isRoleList(config: AccessControlConfig): config is string[] {\n    return Array.isArray(config);\n  }\n\n  private isAccessRules(\n    config: AccessControlConfig,\n  ): config is Partial<AccessControlRules> {\n    return (\n      typeof config === 'object' && config !== null && !Array.isArray(config)\n    );\n  }\n\n  private normalizeRuleToRoles(\n    rule: string[] | DetailedAccessControlRule | '*' | undefined,\n  ): string[] {\n    if (!rule) return [];\n    if (rule === '*') return ['*'];\n    if (Array.isArray(rule)) return rule;\n    return rule.roles === '*' ? ['*'] : (rule.roles ?? []);\n  }\n\n  private resolveAuthorizedRoles(\n    action: AccessAction,\n    accessControl: AccessControlConfig,\n  ): string[] {\n    if (this.isWildcardAccess(accessControl)) return ['*'];\n    if (this.isRoleList(accessControl)) return accessControl;\n    if (this.isAccessRules(accessControl))\n      return this.normalizeRuleToRoles(accessControl[action]);\n    return [];\n  }\n\n  /**\n   * Checks if a user has permission for a specific action using static access control rules.\n   * Validates user roles against predefined access control configuration.\n   *\n   * @param user - The user object containing role or roles field\n   * @param action - The action being performed\n   * @param accessControl - Access control configuration (array of roles or object with action-role mappings)\n   * @returns True if user has permission, false otherwise\n   * @throws Error if user doesn't have role/roles field\n   */\n  checkStaticAccessControl(\n    user: User,\n    action: string,\n    accessControl: AccessControlConfig,\n  ) {\n    if (!user?.role && !user.roles)\n      throw Error(\n        'Validation Error: In order to use static authentication user needs at least role field or roles for multiple roles.',\n      );\n\n    let authorizedRoles = this.resolveAuthorizedRoles(action, accessControl);\n\n    const userRoles = Array.isArray(user?.roles) ? user.roles : [user.role];\n\n    return (\n      authorizedRoles?.[0] === '*' ||\n      !!userRoles.some((role: string) => authorizedRoles.includes(role))\n    );\n  }\n\n  /**\n   * Checks if a user has permission for a specific action and resource using dynamic access control.\n   * Queries the database to verify user's role permissions.\n   *\n   * @param userId - The unique identifier of the user\n   * @param action - The action being performed\n   * @param resource - The resource being accessed\n   * @returns Promise resolving to true if user has permission, false otherwise\n   */\n  async checkDynamicAccessControl(\n    userId: string,\n    action: string,\n    resource: string,\n  ) {\n    const prisma = getPrismaInstance();\n\n    const [userPermission, hasRolePermission] = await Promise.all([\n      prisma.userPermission\n        ? prisma.userPermission.findFirst({\n            where: { userId, permission: { resource, action } },\n            select: { effect: true },\n          })\n        : Promise.resolve(null),\n\n      prisma.userRole.findFirst({\n        where: {\n          userId,\n          role: {\n            permissions: {\n              some: { resource, action },\n            },\n          },\n        },\n        select: { id: true },\n      }),\n    ]);\n\n    if (userPermission) return userPermission.effect === 'Allow';\n    return !!hasRolePermission;\n  }\n\n  private sanitizeUser(user: Record<string, any>): AuthUser {\n    const { password: _password, ...sanitized } = user;\n    return sanitized as AuthUser;\n  }\n\n  private withPasswordIncluded<T extends Record<string, any>>(\n    queryOptions?: T,\n  ): Record<string, any> {\n    const options: Record<string, any> = { ...(queryOptions || {}) };\n\n    if (options.select) options.select = { ...options.select, password: true };\n\n    if (options.omit) {\n      const { password: _password, ...omit } = options.omit;\n      options.omit = omit;\n    }\n\n    return options;\n  }\n\n  /**\n   * Retrieves the authenticated user by id without the password field.\n   *\n   * Can be overridden through `ArkosRouteHook(\"auth\", { service })`.\n   *\n   * @param userId - The id of the authenticated user\n   * @param queryOptions - Optional Prisma query options (select, include, etc.)\n   * @since 1.8.0-rc\n   */\n  async getMe(\n    userId: User[\"id\"],\n    queryOptions?: GetMeOptions,\n  ): Promise<AuthUser | null> {\n    const user = await this.userService.findOne(\n      { id: userId },\n      queryOptions || {},\n    );\n\n    return user ? this.sanitizeUser(user) : null;\n  }\n\n  /**\n   * Updates the authenticated user without the password field in the result.\n   * Password changes are rejected, use `updatePassword` instead.\n   *\n   * Can be overridden through `ArkosRouteHook(\"auth\", { service })`.\n   *\n   * @param userId - The id of the authenticated user\n   * @param data - The fields to update\n   * @param queryOptions - Optional Prisma query options (select, include, etc.)\n   * @since 1.8.0-rc\n   */\n  async updateMe(\n    userId: User[\"id\"],\n    data: UpdateMeDto,\n    queryOptions?: UpdateMeOptions,\n  ): Promise<AuthUser> {\n    if (\"password\" in (data as Record<string, any>))\n      throw new BadRequestError(\n        \"In order to update password use the update-password endpoint.\",\n        \"InvalidFieldPassword\",\n      );\n\n    const user = await this.userService.updateOne(\n      { id: userId },\n      data,\n      queryOptions || {},\n    );\n\n    return this.sanitizeUser(user);\n  }\n\n  /**\n   * Creates a new user account without the password field in the result.\n   *\n   * Can be overridden through `ArkosRouteHook(\"auth\", { service })`.\n   *\n   * @param data - The user data, the password is hashed automatically\n   * @param queryOptions - Optional Prisma query options (select, include, etc.)\n   * @since 1.8.0-rc\n   */\n  async signup(\n    data: SignupDto,\n    queryOptions?: SignupOptions,\n  ): Promise<AuthUser> {\n    const user = await this.userService.createOne(data, queryOptions || {});\n\n    return this.sanitizeUser(user);\n  }\n\n  /**\n   * Marks the authenticated user's account as self-deleted by setting\n   * `deletedSelfAccountAt`, the result never includes the password field.\n   *\n   * Can be overridden through `ArkosRouteHook(\"auth\", { service })`.\n   *\n   * @param userId - The id of the authenticated user\n   * @param queryOptions - Optional Prisma query options (select, include, etc.)\n   * @since 1.8.0-rc\n   */\n  async deleteMe(\n    userId: User[\"id\"],\n    queryOptions?: DeleteMeOptions,\n  ): Promise<AuthUser> {\n    const user = await this.userService.updateOne(\n      { id: userId },\n      { deletedSelfAccountAt: new Date().toISOString() },\n      queryOptions || {},\n    );\n\n    return this.sanitizeUser(user);\n  }\n\n  /**\n   * Authenticates a user with the given username field and password.\n   *\n   * The username field is inferred from the username key present in `input`\n   * (the only key besides `password`), can be overridden explicitly with\n   * `usernameField` for nested paths such as `\"profile.nickname\"`, and falls\n   * back to `authentication.login.allowedUsernames[0] || \"username\"`. When\n   * `authentication.login.allowedUsernames` is configured, the resolved field\n   * must be one of its entries. The password is always loaded for the\n   * comparison and never returned.\n   *\n   * Can be overridden through `ArkosRouteHook(\"auth\", { service })`.\n   *\n   * @param input - Its username key and the password\n   * @param queryOptions - Optional Prisma query options (select, include, etc.)\n   * @returns The sanitized user and a signed access token\n   * @since 1.8.0-rc\n   */\n  async login(\n    input: LoginInput,\n    queryOptions?: LoginOptions,\n  ): Promise<{ user: AuthUser; accessToken: string }> {\n    const { password } = input as { password: string };\n    const usernameField =\n      (input as { usernameField?: string }).usernameField ||\n      Object.keys(input).find(\n        (key) => key !== \"password\" && key !== \"usernameField\",\n      ) ||\n      getDefaultUsernameField();\n\n    const allowedUsernames =\n      getArkosConfig()?.authentication?.login?.allowedUsernames;\n\n    if (allowedUsernames?.length && !allowedUsernames.includes(usernameField))\n      throw new BadRequestError(\n        `Invalid username field, expected one of: ${allowedUsernames.join(\", \")}`,\n        \"InvalidUsernameField\",\n      );\n\n    const lastField = usernameField.split(\".\").pop()!;\n    const username = (input as Record<string, any>)[lastField];\n\n    if (!username || !password)\n      throw new BadRequestError(\n        `Please provide both ${lastField} and password`,\n        `MissingCredentialFields`,\n      );\n\n    const user = (await this.userService.findOne(\n      createPrismaWhereClause(usernameField, username),\n      this.withPasswordIncluded(queryOptions),\n    )) as Record<string, any> | null;\n\n    if (!user || !(await this.isCorrectPassword(password, user.password)))\n      throw new UnauthorizedError(\n        `Incorrect ${lastField} or password`,\n        `IncorrectCredentials`,\n      );\n\n    return {\n      user: this.sanitizeUser(user),\n      accessToken: this.signJwtToken(user.id),\n    };\n  }\n\n  /**\n   * Updates the password of the given user after validating the current one.\n   *\n   * Can be overridden through `ArkosRouteHook(\"auth\", { service })`.\n   *\n   * @param userId - The id of the authenticated user\n   * @param input - The current and the new password\n   * @returns A fresh access token valid after the password change\n   * @since 1.8.0-rc\n   */\n  async updatePassword(\n    userId: User[\"id\"],\n    input: UpdatePasswordInput,\n  ): Promise<{ accessToken: string }> {\n    const { currentPassword, newPassword } = input;\n\n    if (!currentPassword || !newPassword)\n      throw new AppError(\n        \"currentPassword and newPassword are required\",\n        400,\n        \"SameCurrentAndNewPassword\",\n      );\n\n    const user = (await this.userService.findOne(\n      { id: userId },\n      this.withPasswordIncluded(),\n    )) as Record<string, any> | null;\n\n    if (!user || user.isActive === false || user.deletedSelfAccountAt)\n      throw new AppError(\"User not found!\", 404);\n\n    if (\n      !(await this.isCorrectPassword(\n        String(currentPassword),\n        String(user.password),\n      ))\n    )\n      throw new AppError(\n        \"Current password is incorrect\",\n        400,\n        \"IncorrentCurrentPassword\",\n      );\n\n    await this.userService.updateOne(\n      { id: userId },\n      {\n        password: await this.hashPassword(String(newPassword)),\n        passwordChangedAt: new Date(Date.now()).toISOString(),\n      },\n    );\n\n    return { accessToken: this.signJwtToken(userId) };\n  }\n\n  /**\n   * Runs on logout. Override through `ArkosRouteHook(\"auth\", { service })`.\n   *\n   * @since 1.8.0-rc\n   */\n  async logout(_userId: User[\"id\"], _accessToken: string): Promise<void> {}\n\n  private extractRequestToken(\n    req: ArkosRequest,\n    cookie: \"arkos_access_token\" = \"arkos_access_token\",\n  ) {\n    return resolveRequestToken({\n      authorization: req?.headers?.authorization,\n      cookies: req?.cookies,\n      cookieName: cookie,\n    });\n  }\n\n  private extractSocketToken(socket: ArkosSocket, key: \"token\" = \"token\") {\n    const requestCookie = (socket.request as any)?.headers?.cookie;\n\n    return resolveSocketToken({\n      auth: socket.handshake?.auth,\n      key,\n      headers: socket.handshake?.headers,\n      cookies: socket.handshake?.cookies,\n      cookieHeader: requestCookie,\n    });\n  }\n\n  async validateDecodedUser(\n    decoded: AuthJwtPayload,\n    action: 'logout' | 'default' = 'default',\n  ): Promise<User> {\n    const prisma = getPrismaInstance();\n    const user = await prisma.user.findUnique({\n      where: { id: decoded.id },\n    });\n\n    if (!user)\n      throw new AppError(\n        'The user belonging to this token no longer exists',\n        401,\n        'UserNoLongerExists',\n      );\n\n    if (\n      action !== 'logout' &&\n      this.userChangedPasswordAfter(user, decoded.iat!)\n    )\n      throw new AppError(\n        'User recently changed password! Please log in again.',\n        401,\n        'PasswordChanged',\n      );\n\n    return user;\n  }\n\n  /**\n   * Processes the cookies or authoriation token and returns the user.\n   *\n   * @param ctx | socket\n   * @returns {Promise<User | null>} - if authentication is turned off in arkosConfig it returns null\n   * @throws {AppError} Throws an error if the token is invalid or the user is not logged in.\n   */\n  async getAuthenticatedUser(\n    ctx: ArkosRequest | ArkosSocket,\n    action: 'logout' | 'default' = 'default',\n  ): Promise<User | null> {\n    if (!isAuthenticationEnabled())\n      throw Error(\n        `Trying to call authService.getAuthenticatedUser without setting up authentication in arkos.config.${getUserFileExtension()}, see ${authenticationDocsLinks.setup}`,\n      );\n\n    let token: string | null = null;\n\n    if ('headers' in ctx) token = this.extractRequestToken(ctx);\n    else if ('join' in ctx) token = this.extractSocketToken(ctx);\n\n    if (!token) return null;\n\n    const decoded = await this.verifyJwtToken(token);\n    ctx.accessToken = token;\n\n    return this.validateDecodedUser(decoded, action);\n  }\n\n  /**\n   * Middleware to authenticate the request by extracting and verifying the JWT token and setting `req.user`.\n   *\n   * Runs `authentication.hooks.authenticate` before/after the authentication logic.\n   *\n   * Hook execution flow:\n   * - `before` hooks run first — call `ctx.skip()` to bypass core logic and jump to `after` hooks,\n   *   call `ctx.next()` to stop the chain early, or return without calling anything to continue.\n   * - Core logic runs — extracts and verifies the JWT token, sets `req.user`.\n   * - `after` hooks run — call `ctx.next(err)` to abort or return without calling anything to continue.\n   * - `onError` hooks run if core logic throws — call `ctx.skip()` to suppress the error and jump to\n   *   `after` hooks, or call `ctx.next(err)` to forward it to the global error handler.\n   *\n   * On custom routes, hooks defined in `arkosConfig` still apply since they are baked into this method.\n   *\n   * @example\n   * ```ts\n   * // custom route - hooks still run\n   * router.get(\"/custom\", authService.authenticate, handler);\n   * ```\n   *\n   * @example\n   * ```ts\n   * // skip built-in auth from a before hook\n   * before: (ctx) => {\n   *   ctx.req.user = myCustomAuth(ctx.req);\n   *   ctx.skip();\n   * }\n   * ```\n   *\n   * @see {@link https://www.arkosjs.com/docs/core-concepts/authentication/hooks}\n   */\n  authenticate = catchAsync(\n    async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n      await authHookManager.runAuthenticate(\n        { context: req, done: next },\n        async (req): Promise<any> => {\n          if (!isAuthenticationEnabled()) return null;\n          const user = (await this.getAuthenticatedUser(\n            req,\n            req.path.includes('logout') ? 'logout' : 'default',\n          )) as User;\n          if (!user) throw loginRequiredError;\n          return user;\n        },\n      );\n    },\n  );\n\n  /**\n   * Middleware to authorize the authenticated user for a given action on a resource.\n   *\n   * Runs `authentication.hooks.authorize` before/after the authorization logic.\n   *\n   * Hook execution flow:\n   * - `before` hooks run first — call `ctx.skip()` to bypass core logic and jump to `after` hooks,\n   *   call `ctx.next()` to stop the chain early, or return without calling anything to continue.\n   * - Core logic runs — checks user role/permissions against the access control rules.\n   * - `after` hooks run — call `ctx.next(err)` to abort or return without calling anything to continue.\n   * - `onError` hooks run if authorization fails — call `ctx.skip()` to suppress the error and jump to\n   *   `after` hooks, or call `ctx.next(err)` to forward it to the global error handler.\n   *\n   * @param resource - The resource being accessed, in kebabCase (e.g. `\"product\"`, `\"cart-item\"`)\n   * @param action - The action being performed (e.g. `\"View\"`, `\"Create\"`, `\"Delete\"`)\n   * @param rule - Access control rules for this action. Accepts a role list, a wildcard, or a `DetailedAccessControlRule`.\n   *\n   * @example\n   * ```ts\n   * router.delete(\"/products/:id\",\n   *   authService.authenticate,\n   *   authService.authorize(\"product\", \"Delete\", [\"admin\"]),\n   *   handler\n   * );\n   * ```\n   *\n   * @example\n   * ```ts\n   * // skip built-in authorization from a before hook\n   * before: (ctx) => {\n   *   ctx.req.user.role = myCustomRoleResolver(ctx.req);\n   *   ctx.skip();\n   * }\n   * ```\n   *\n   * @see {@link https://www.arkosjs.com/docs/core-concepts/authentication/hooks#authorize}\n   * @since v1.6.0-beta\n   */\n  authorize(\n    action: AccessAction,\n    resource: string,\n    rule?: string[] | DetailedAccessControlRule | '*',\n  ): ArkosRequestHandler {\n    const authAction = authActionService.add(action, resource, {\n      [action]: rule,\n    });\n\n    return catchAsync(\n      async (req: ArkosRequest, _: ArkosResponse, next: ArkosNextFunction) => {\n        await authHookManager.runAuthorize(\n          { context: req, done: next },\n          authAction,\n        );\n      },\n    );\n  }\n\n  /**\n   * Creates a permission checker function for a specific action and resource.\n   *\n   * PS: This method should be called during application initialization to build permission validators.\n   *\n   * @see {@link https://www.arkosjs.com/docs/advanced-guide/fine-grained-access-control}\n   *\n   * @param action - The action to check permission for (e.g., 'View', 'Create', 'Delete')\n   * @param resource - The resource being accessed, must be in kebabCase (e.g., 'user', 'cart-item', 'order')\n   * @param accessControl - Access control rules (required for static authentication mode), and it is automatically loaded for known modules such as all prisma models, auth and file-upload.\n   * @returns A function that takes a user object and returns a boolean indicating permission status\n   *\n   * @example\n   * ```typescript\n   * const hasViewProductPermission = await authService.permission('View', 'product');\n   *\n   * // Later in handler:\n   * const canAccess = await hasViewProductPermission(user);\n   * if (canAccess) {\n   *   // User has permission\n   * }\n   * ```\n   */\n  permission(\n    action: string,\n    resource: string,\n    accessControl?: AccessControlConfig,\n  ) {\n    // Check if called during request handling (deep call stack indicates handler execution)\n    const stack = new Error().stack;\n\n    if (stack?.includes('node_modules/express/lib/router/index.js'))\n      throw new Error(\n        'authService.permission() should be called during application initialization level.',\n      );\n\n    authActionService.add(action, resource, accessControl);\n\n    return async (user: User | undefined): Promise<boolean> => {\n      // getArkosConfig must not be called the same time as arkos()\n      const configs = getArkosConfig();\n\n      if (!isUsingAuthentication())\n        throw Error(\n          'Validation Error: Trying to use authService.permission without setting up authentication.',\n        );\n\n      if (!isAuthenticationEnabled()) return false;\n      if (!user) throw loginRequiredError;\n      if (user?.isSuperUser) return true;\n\n      if (configs?.authentication?.mode === 'dynamic') {\n        return await this.checkDynamicAccessControl(user?.id, action, resource);\n      } else if (configs?.authentication?.mode === 'static') {\n        return (\n          !!accessControl &&\n          this.checkStaticAccessControl(user, action, accessControl)\n        );\n      }\n      return false;\n    };\n  }\n}\n\n/**\n * Handles various authentication-related tasks such as JWT signing, password hashing, and verifying user credentials.\n */\nconst authService = new AuthService();\n\nexport default authService;\n\n"]}