rl-core-api 0.1.0

package/dist/features/auth/domain/token.service.d.ts

@@ -0,0 +1,56 @@
+import { EnvService } from "../../../core/config/env.service";
+import { AuthTokenRepository } from "../infra/repositories/authToken.repository";
+import { TokenType } from "../infra/schema/authToken.schema";
+export interface RotationResult {
+    userId: string;
+    rawToken: string;
+    family: string;
+}
+export declare enum PasswordTokenStatus {
+    VALID = "valid",
+    INVALID = "invalid",
+    EXPIRED = "expired",
+    USED = "used"
+}
+export type PasswordTokenPurpose = TokenType.PASSWORD_RESET | TokenType.FIRST_ACCESS;
+export interface PasswordTokenInspection {
+    status: PasswordTokenStatus;
+    purpose?: PasswordTokenPurpose;
+    userId?: string;
+}
+export interface ConsumedPasswordToken {
+    userId: string;
+    purpose: PasswordTokenPurpose;
+}
+export declare class TokenService {
+    private readonly repo;
+    private readonly env;
+    private readonly logger;
+    constructor(repo: AuthTokenRepository, env: EnvService);
+    private persist;
+    private minutesFromNow;
+    issueRefreshToken(userId: string, family?: string, ctx?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }): Promise<{
+        rawToken: string;
+        family: string;
+    }>;
+    rotateRefreshToken(rawToken: string, ctx?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }): Promise<RotationResult>;
+    revokeFamily(family: string): Promise<void>;
+    revokeAllRefresh(userId: string): Promise<void>;
+    revokeByRawToken(rawToken: string): Promise<void>;
+    issueTwoFactorEmailCode(userId: string): Promise<string>;
+    consumeTwoFactorEmailCode(userId: string, code: string): Promise<boolean>;
+    private issuePasswordToken;
+    issuePasswordReset(userId: string): Promise<string>;
+    issueFirstAccess(userId: string): Promise<string>;
+    inspectPasswordToken(rawToken: string): Promise<PasswordTokenInspection>;
+    consumePasswordToken(rawToken: string): Promise<ConsumedPasswordToken | null>;
+    isTotpCodeUsed(userId: string, code: string): Promise<boolean>;
+    markTotpCodeUsed(userId: string, code: string): Promise<void>;
+    cleanExpired(): Promise<number>;
+}

package/dist/features/auth/domain/token.service.js

@@ -0,0 +1,205 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TokenService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenService = exports.PasswordTokenStatus = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const uuid_1 = require("uuid");
+const env_service_1 = require("../../../core/config/env.service");
+const hash_util_1 = require("../../../core/utils/hash.util");
+const authToken_repository_1 = require("../infra/repositories/authToken.repository");
+const authToken_schema_1 = require("../infra/schema/authToken.schema");
+var PasswordTokenStatus;
+(function (PasswordTokenStatus) {
+    PasswordTokenStatus["VALID"] = "valid";
+    PasswordTokenStatus["INVALID"] = "invalid";
+    PasswordTokenStatus["EXPIRED"] = "expired";
+    PasswordTokenStatus["USED"] = "used";
+})(PasswordTokenStatus || (exports.PasswordTokenStatus = PasswordTokenStatus = {}));
+const PASSWORD_TOKEN_TYPES = [
+    authToken_schema_1.TokenType.PASSWORD_RESET,
+    authToken_schema_1.TokenType.FIRST_ACCESS,
+];
+let TokenService = TokenService_1 = class TokenService {
+    constructor(repo, env) {
+        this.repo = repo;
+        this.env = env;
+        this.logger = new common_1.Logger(TokenService_1.name);
+    }
+    async persist(params) {
+        return this.repo.save(this.repo.create({
+            userId: params.userId,
+            tokenHash: (0, hash_util_1.sha256)(params.rawToken),
+            type: params.type,
+            family: params.family ?? null,
+            expiresAt: params.expiresAt,
+            ipAddress: params.ipAddress,
+            userAgent: params.userAgent,
+        }));
+    }
+    minutesFromNow(minutes) {
+        return new Date(Date.now() + minutes * 60_000);
+    }
+    async issueRefreshToken(userId, family, ctx) {
+        const rawToken = (0, hash_util_1.randomToken)(48);
+        const fam = family ?? (0, uuid_1.v7)();
+        await this.persist({
+            userId,
+            rawToken,
+            type: authToken_schema_1.TokenType.REFRESH_TOKEN,
+            family: fam,
+            expiresAt: this.minutesFromNow(this.env.get("JWT_REFRESH_EXPIRES_MINUTES")),
+            ipAddress: ctx?.ipAddress,
+            userAgent: ctx?.userAgent,
+        });
+        return { rawToken, family: fam };
+    }
+    async rotateRefreshToken(rawToken, ctx) {
+        const tokenHash = (0, hash_util_1.sha256)(rawToken);
+        const stored = await this.repo.findOne({
+            where: { tokenHash, type: authToken_schema_1.TokenType.REFRESH_TOKEN },
+        });
+        if (!stored) {
+            throw new common_1.UnauthorizedException("Refresh token inválido");
+        }
+        if (stored.used || stored.revoked) {
+            this.logger.warn(`Reuso de refresh token detectado (família ${stored.family})`);
+            if (stored.family) {
+                await this.revokeFamily(stored.family);
+            }
+            throw new common_1.UnauthorizedException("Refresh token reutilizado — sessão revogada");
+        }
+        if (stored.isExpired()) {
+            throw new common_1.UnauthorizedException("Refresh token expirado");
+        }
+        stored.used = true;
+        await this.repo.save(stored);
+        const { rawToken: newRaw, family } = await this.issueRefreshToken(stored.userId, stored.family ?? undefined, ctx);
+        return { userId: stored.userId, rawToken: newRaw, family };
+    }
+    async revokeFamily(family) {
+        await this.repo.update({ family }, { revoked: true });
+    }
+    async revokeAllRefresh(userId) {
+        await this.repo.update({ userId, type: authToken_schema_1.TokenType.REFRESH_TOKEN }, { revoked: true });
+    }
+    async revokeByRawToken(rawToken) {
+        const stored = await this.repo.findOne({
+            where: { tokenHash: (0, hash_util_1.sha256)(rawToken), type: authToken_schema_1.TokenType.REFRESH_TOKEN },
+        });
+        if (!stored) {
+            return;
+        }
+        if (stored.family) {
+            await this.revokeFamily(stored.family);
+        }
+        else {
+            await this.repo.update({ id: stored.id }, { revoked: true });
+        }
+    }
+    async issueTwoFactorEmailCode(userId) {
+        await this.repo.update({ userId, type: authToken_schema_1.TokenType.TWO_FACTOR_EMAIL, used: false }, { used: true });
+        const code = (0, hash_util_1.numericCode)();
+        await this.persist({
+            userId,
+            rawToken: code,
+            type: authToken_schema_1.TokenType.TWO_FACTOR_EMAIL,
+            expiresAt: this.minutesFromNow(this.env.get("TWO_FACTOR_EMAIL_CODE_EXPIRY")),
+        });
+        return code;
+    }
+    async consumeTwoFactorEmailCode(userId, code) {
+        const stored = await this.repo.findOne({
+            where: { userId, tokenHash: (0, hash_util_1.sha256)(code), type: authToken_schema_1.TokenType.TWO_FACTOR_EMAIL },
+        });
+        if (!stored || !stored.isValid()) {
+            return false;
+        }
+        stored.used = true;
+        await this.repo.save(stored);
+        return true;
+    }
+    async issuePasswordToken(userId, type, expiryMinutes) {
+        await this.repo.update({ userId, type, used: false }, { used: true });
+        const rawToken = (0, hash_util_1.randomToken)(32);
+        await this.persist({
+            userId,
+            rawToken,
+            type,
+            expiresAt: this.minutesFromNow(expiryMinutes),
+        });
+        return rawToken;
+    }
+    async issuePasswordReset(userId) {
+        return this.issuePasswordToken(userId, authToken_schema_1.TokenType.PASSWORD_RESET, this.env.get("PASSWORD_RESET_TOKEN_EXPIRY"));
+    }
+    async issueFirstAccess(userId) {
+        return this.issuePasswordToken(userId, authToken_schema_1.TokenType.FIRST_ACCESS, this.env.get("FIRST_ACCESS_TOKEN_EXPIRY"));
+    }
+    async inspectPasswordToken(rawToken) {
+        const stored = await this.repo.findOne({
+            where: { tokenHash: (0, hash_util_1.sha256)(rawToken), type: (0, typeorm_1.In)(PASSWORD_TOKEN_TYPES) },
+        });
+        if (!stored) {
+            return { status: PasswordTokenStatus.INVALID };
+        }
+        if (stored.used || stored.revoked) {
+            return { status: PasswordTokenStatus.USED };
+        }
+        if (stored.isExpired()) {
+            return { status: PasswordTokenStatus.EXPIRED };
+        }
+        return {
+            status: PasswordTokenStatus.VALID,
+            purpose: stored.type,
+            userId: stored.userId,
+        };
+    }
+    async consumePasswordToken(rawToken) {
+        const stored = await this.repo.findOne({
+            where: { tokenHash: (0, hash_util_1.sha256)(rawToken), type: (0, typeorm_1.In)(PASSWORD_TOKEN_TYPES) },
+        });
+        if (!stored || !stored.isValid()) {
+            return null;
+        }
+        stored.used = true;
+        await this.repo.save(stored);
+        return {
+            userId: stored.userId,
+            purpose: stored.type,
+        };
+    }
+    async isTotpCodeUsed(userId, code) {
+        const stored = await this.repo.findOne({
+            where: { userId, tokenHash: (0, hash_util_1.sha256)(code), type: authToken_schema_1.TokenType.TOTP_USED },
+        });
+        return !!stored && !stored.isExpired();
+    }
+    async markTotpCodeUsed(userId, code) {
+        await this.persist({
+            userId,
+            rawToken: code,
+            type: authToken_schema_1.TokenType.TOTP_USED,
+            expiresAt: this.minutesFromNow(2),
+        });
+    }
+    async cleanExpired() {
+        const result = await this.repo.delete({ expiresAt: (0, typeorm_1.LessThan)(new Date()) });
+        return result.affected ?? 0;
+    }
+};
+exports.TokenService = TokenService;
+exports.TokenService = TokenService = TokenService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [authToken_repository_1.AuthTokenRepository,
+        env_service_1.EnvService])
+], TokenService);

package/dist/features/auth/domain/twoFactor.service.d.ts

@@ -0,0 +1,19 @@
+import { EnvService } from "../../../core/config/env.service";
+export interface TotpSetup {
+    secret: string;
+    otpauthUrl: string;
+    qrDataUrl: string;
+}
+export declare class TwoFactorService {
+    private readonly env;
+    private readonly logger;
+    constructor(env: EnvService);
+    generateSetup(accountEmail: string): Promise<TotpSetup>;
+    encrypt(secret: string): string;
+    verifyTotp(code: string, storedSecret: string): Promise<boolean>;
+    generateBackupCodes(): Promise<{
+        plain: string[];
+        hashed: string[];
+    }>;
+    consumeBackupCode(code: string, hashedCodes: string[]): Promise<string[] | null>;
+}

package/dist/features/auth/domain/twoFactor.service.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TwoFactorService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorService = void 0;
+const common_1 = require("@nestjs/common");
+const otplib_1 = require("otplib");
+const QRCode = __importStar(require("qrcode"));
+const env_service_1 = require("../../../core/config/env.service");
+const crypto_util_1 = require("../../../core/utils/crypto.util");
+const hash_util_1 = require("../../../core/utils/hash.util");
+let TwoFactorService = TwoFactorService_1 = class TwoFactorService {
+    constructor(env) {
+        this.env = env;
+        this.logger = new common_1.Logger(TwoFactorService_1.name);
+    }
+    async generateSetup(accountEmail) {
+        const secret = (0, otplib_1.generateSecret)();
+        const issuer = this.env.get("TOTP_ISSUER");
+        const otpauthUrl = (0, otplib_1.generateURI)({ issuer, label: accountEmail, secret });
+        const qrDataUrl = await QRCode.toDataURL(otpauthUrl);
+        return { secret, otpauthUrl, qrDataUrl };
+    }
+    encrypt(secret) {
+        return (0, crypto_util_1.encryptSecret)(secret);
+    }
+    async verifyTotp(code, storedSecret) {
+        if (!storedSecret) {
+            return false;
+        }
+        try {
+            const result = await (0, otplib_1.verify)({
+                token: code,
+                secret: (0, crypto_util_1.decryptSecret)(storedSecret),
+            });
+            return result.valid;
+        }
+        catch (err) {
+            this.logger.warn(`Falha ao verificar código TOTP: ${err.message}`);
+            return false;
+        }
+    }
+    async generateBackupCodes() {
+        const count = this.env.get("BACKUP_CODES_COUNT");
+        const plain = Array.from({ length: count }, () => (0, hash_util_1.backupCode)());
+        const hashed = await Promise.all(plain.map((c) => (0, hash_util_1.hashPassword)(c)));
+        return { plain, hashed };
+    }
+    async consumeBackupCode(code, hashedCodes) {
+        for (let i = 0; i < hashedCodes.length; i++) {
+            if (await (0, hash_util_1.verifyPassword)(hashedCodes[i], code)) {
+                return hashedCodes.filter((_, idx) => idx !== i);
+            }
+        }
+        return null;
+    }
+};
+exports.TwoFactorService = TwoFactorService;
+exports.TwoFactorService = TwoFactorService = TwoFactorService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [env_service_1.EnvService])
+], TwoFactorService);

package/dist/features/auth/domain/wsUserResolver.service.d.ts

@@ -0,0 +1,10 @@
+import { AuthenticatedUser } from "../../../core/auth/authenticatedUser.interface";
+import { WsUserResolver } from "../../../core/websocket/wsUserResolver.interface";
+import { AuthService } from "./auth.service";
+import { UsersService } from "../../users/domain/users.service";
+export declare class WsUserResolverService implements WsUserResolver {
+    private readonly users;
+    private readonly auth;
+    constructor(users: UsersService, auth: AuthService);
+    resolve(userId: string): Promise<AuthenticatedUser | null>;
+}

package/dist/features/auth/domain/wsUserResolver.service.js

@@ -0,0 +1,34 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WsUserResolverService = void 0;
+const common_1 = require("@nestjs/common");
+const auth_service_1 = require("./auth.service");
+const users_service_1 = require("../../users/domain/users.service");
+let WsUserResolverService = class WsUserResolverService {
+    constructor(users, auth) {
+        this.users = users;
+        this.auth = auth;
+    }
+    async resolve(userId) {
+        const user = await this.users.findById(userId).catch(() => null);
+        if (!user || !user.isActive) {
+            return null;
+        }
+        return await this.auth.toSessionUser(user);
+    }
+};
+exports.WsUserResolverService = WsUserResolverService;
+exports.WsUserResolverService = WsUserResolverService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [users_service_1.UsersService,
+        auth_service_1.AuthService])
+], WsUserResolverService);

package/dist/features/auth/infra/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./repositories/authToken.repository";
+export * from "./schema/authToken.schema";

package/dist/features/auth/infra/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./repositories/authToken.repository"), exports);
+__exportStar(require("./schema/authToken.schema"), exports);

package/dist/features/auth/infra/repositories/authToken.repository.d.ts

@@ -0,0 +1,5 @@
+import { DataSource, Repository } from "typeorm";
+import { AuthToken } from "../schema/authToken.schema";
+export declare class AuthTokenRepository extends Repository<AuthToken> {
+    constructor(dataSource: DataSource);
+}

package/dist/features/auth/infra/repositories/authToken.repository.js

@@ -0,0 +1,25 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthTokenRepository = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const authToken_schema_1 = require("../schema/authToken.schema");
+let AuthTokenRepository = class AuthTokenRepository extends typeorm_1.Repository {
+    constructor(dataSource) {
+        super(authToken_schema_1.AuthToken, dataSource.createEntityManager());
+    }
+};
+exports.AuthTokenRepository = AuthTokenRepository;
+exports.AuthTokenRepository = AuthTokenRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [typeorm_1.DataSource])
+], AuthTokenRepository);

package/dist/features/auth/infra/schema/authToken.schema.d.ts

@@ -0,0 +1,21 @@
+import { BaseEntity } from "../../../../core/database/base.schema";
+export declare enum TokenType {
+    PASSWORD_RESET = "password_reset",
+    FIRST_ACCESS = "first_access",
+    TWO_FACTOR_EMAIL = "two_factor_email",
+    REFRESH_TOKEN = "refresh_token",
+    TOTP_USED = "totp_used"
+}
+export declare class AuthToken extends BaseEntity {
+    userId: string;
+    tokenHash: string;
+    type: TokenType;
+    family?: string | null;
+    expiresAt: Date;
+    used: boolean;
+    revoked: boolean;
+    ipAddress?: string | null;
+    userAgent?: string | null;
+    isExpired(): boolean;
+    isValid(): boolean;
+}

package/dist/features/auth/infra/schema/authToken.schema.js

@@ -0,0 +1,73 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthToken = exports.TokenType = void 0;
+const typeorm_1 = require("typeorm");
+const base_schema_1 = require("../../../../core/database/base.schema");
+var TokenType;
+(function (TokenType) {
+    TokenType["PASSWORD_RESET"] = "password_reset";
+    TokenType["FIRST_ACCESS"] = "first_access";
+    TokenType["TWO_FACTOR_EMAIL"] = "two_factor_email";
+    TokenType["REFRESH_TOKEN"] = "refresh_token";
+    TokenType["TOTP_USED"] = "totp_used";
+})(TokenType || (exports.TokenType = TokenType = {}));
+let AuthToken = class AuthToken extends base_schema_1.BaseEntity {
+    isExpired() {
+        return new Date() > this.expiresAt;
+    }
+    isValid() {
+        return !this.used && !this.revoked && !this.isExpired();
+    }
+};
+exports.AuthToken = AuthToken;
+__decorate([
+    (0, typeorm_1.Column)({ name: "user_id", type: "char", length: 36 }),
+    __metadata("design:type", String)
+], AuthToken.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: "token_hash", type: "varchar", length: 255 }),
+    __metadata("design:type", String)
+], AuthToken.prototype, "tokenHash", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "enum", enum: TokenType }),
+    __metadata("design:type", String)
+], AuthToken.prototype, "type", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: "family", type: "char", length: 36, nullable: true }),
+    __metadata("design:type", Object)
+], AuthToken.prototype, "family", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: "expires_at", type: "datetime" }),
+    __metadata("design:type", Date)
+], AuthToken.prototype, "expiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "boolean", default: false }),
+    __metadata("design:type", Boolean)
+], AuthToken.prototype, "used", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "boolean", default: false }),
+    __metadata("design:type", Boolean)
+], AuthToken.prototype, "revoked", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: "ip_address", type: "varchar", length: 45, nullable: true }),
+    __metadata("design:type", Object)
+], AuthToken.prototype, "ipAddress", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: "user_agent", type: "text", nullable: true }),
+    __metadata("design:type", Object)
+], AuthToken.prototype, "userAgent", void 0);
+exports.AuthToken = AuthToken = __decorate([
+    (0, typeorm_1.Entity)("auth_tokens"),
+    (0, typeorm_1.Index)(["tokenHash", "type"]),
+    (0, typeorm_1.Index)(["userId", "type"]),
+    (0, typeorm_1.Index)(["family"])
+], AuthToken);

package/dist/features/auth/presentation/auth.controller.d.ts

@@ -0,0 +1,56 @@
+import { Request, Response } from "express";
+import { AuthenticatedUser } from "../../../core/auth/authenticatedUser.interface";
+import { EnvService } from "../../../core/config/env.service";
+import { AuthService } from "../domain/auth.service";
+import { PasswordTokenCheck } from "../domain/auth.service";
+import { SessionUser } from "../domain/auth.service";
+import { LoginStatus } from "../domain/auth.service";
+import { TotpSetup } from "../domain/twoFactor.service";
+import { LoginCommand } from "./commands/login.command";
+import { ForgotPasswordCommand, ResetPasswordCommand } from "./commands/password.command";
+import { RefreshTokenCommand } from "./commands/refreshToken.command";
+import { PendingTokenCommand, RegenerateBackupCommand, VerifyTwoFactorCommand } from "./commands/twoFactor.command";
+export interface VerifyResponse {
+    user: SessionUser;
+    backupCodes?: string[];
+    accessToken?: string;
+    refreshToken?: string;
+}
+export interface RefreshResponse {
+    ok: boolean;
+    accessToken?: string;
+    refreshToken?: string;
+}
+export declare class AuthController {
+    private readonly auth;
+    private readonly env;
+    constructor(auth: AuthService, env: EnvService);
+    login(dto: LoginCommand): Promise<{
+        status: LoginStatus;
+        pendingToken: string;
+    }>;
+    setupTotp(dto: PendingTokenCommand): Promise<TotpSetup>;
+    requestEmailCode(dto: PendingTokenCommand): Promise<{
+        sent: boolean;
+    }>;
+    verify(dto: VerifyTwoFactorCommand, req: Request, res: Response): Promise<VerifyResponse>;
+    refresh(dto: RefreshTokenCommand, req: Request, res: Response): Promise<RefreshResponse>;
+    logout(dto: RefreshTokenCommand, req: Request, res: Response): Promise<{
+        ok: boolean;
+    }>;
+    profile(user: AuthenticatedUser): AuthenticatedUser;
+    myPermissions(user: AuthenticatedUser): {
+        roles: string[];
+        permissions: string[];
+    };
+    regenerateBackup(userId: string, dto: RegenerateBackupCommand): Promise<{
+        backupCodes: string[];
+    }>;
+    forgotPassword(dto: ForgotPasswordCommand): Promise<{
+        ok: boolean;
+    }>;
+    inspectPasswordToken(token: string): Promise<PasswordTokenCheck>;
+    resetPassword(dto: ResetPasswordCommand): Promise<{
+        ok: boolean;
+    }>;
+}