rl-core-api 0.1.0

package/dist/features/auth/presentation/auth.controller.js

@@ -0,0 +1,242 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const throttler_1 = require("@nestjs/throttler");
+const cookie_util_1 = require("../../../core/auth/cookie.util");
+const currentUser_decorator_1 = require("../../../core/auth/decorators/currentUser.decorator");
+const public_decorator_1 = require("../../../core/auth/decorators/public.decorator");
+const jwtAuth_guard_1 = require("../../../core/auth/guards/jwtAuth.guard");
+const env_service_1 = require("../../../core/config/env.service");
+const ip_util_1 = require("../../../core/utils/ip.util");
+const auth_service_1 = require("../domain/auth.service");
+const clientType_enum_1 = require("./commands/clientType.enum");
+const login_command_1 = require("./commands/login.command");
+const password_command_1 = require("./commands/password.command");
+const refreshToken_command_1 = require("./commands/refreshToken.command");
+const twoFactor_command_1 = require("./commands/twoFactor.command");
+const sessionUser_response_1 = require("./responses/sessionUser.response");
+function ctxFrom(req) {
+    return {
+        ipAddress: (0, ip_util_1.normalizeIp)(req.ip),
+        userAgent: req.headers["user-agent"],
+    };
+}
+let AuthController = class AuthController {
+    constructor(auth, env) {
+        this.auth = auth;
+        this.env = env;
+    }
+    login(dto) {
+        return this.auth.login(dto);
+    }
+    setupTotp(dto) {
+        return this.auth.setupTotp(dto.pendingToken);
+    }
+    requestEmailCode(dto) {
+        return this.auth.requestEmailCode(dto.pendingToken);
+    }
+    async verify(dto, req, res) {
+        const { accessToken, refreshToken, user, backupCodes } = await this.auth.verifyTwoFactor(dto, ctxFrom(req));
+        if (dto.client === clientType_enum_1.ClientType.MOBILE) {
+            return { user, backupCodes, accessToken, refreshToken };
+        }
+        (0, cookie_util_1.setAuthCookies)(res, this.env, { accessToken, refreshToken });
+        return { user, backupCodes };
+    }
+    async refresh(dto, req, res) {
+        const cookies = req.cookies;
+        const raw = dto.refreshToken ?? cookies?.[cookie_util_1.REFRESH_COOKIE];
+        const tokens = await this.auth.refresh(raw, ctxFrom(req));
+        if (dto.refreshToken) {
+            return { ok: true, ...tokens };
+        }
+        (0, cookie_util_1.setAuthCookies)(res, this.env, tokens);
+        return { ok: true };
+    }
+    async logout(dto, req, res) {
+        const cookies = req.cookies;
+        await this.auth.logout(dto.refreshToken ?? cookies?.[cookie_util_1.REFRESH_COOKIE]);
+        (0, cookie_util_1.clearAuthCookies)(res, this.env);
+        return { ok: true };
+    }
+    profile(user) {
+        return user;
+    }
+    myPermissions(user) {
+        return { roles: user.roles, permissions: user.permissions };
+    }
+    async regenerateBackup(userId, dto) {
+        const backupCodes = await this.auth.regenerateBackupCodes(userId, dto.code);
+        return { backupCodes };
+    }
+    async forgotPassword(dto) {
+        await this.auth.forgotPassword(dto.email);
+        return { ok: true };
+    }
+    inspectPasswordToken(token) {
+        return this.auth.inspectPasswordToken(token);
+    }
+    async resetPassword(dto) {
+        await this.auth.resetPassword(dto.token, dto.newPassword);
+        return { ok: true };
+    }
+};
+exports.AuthController = AuthController;
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60_000 } }),
+    (0, common_1.Post)("login"),
+    (0, swagger_1.ApiOperation)({ summary: "Login (passo 1): valida email+senha e exige 2FA" }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [login_command_1.LoginCommand]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "login", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Post)("2fa/setup"),
+    (0, swagger_1.ApiOperation)({ summary: "Gera segredo/QR TOTP no primeiro acesso" }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [twoFactor_command_1.PendingTokenCommand]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "setupTotp", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60_000 } }),
+    (0, common_1.Post)("2fa/email"),
+    (0, swagger_1.ApiOperation)({ summary: "Fallback: envia código 2FA por email" }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [twoFactor_command_1.PendingTokenCommand]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "requestEmailCode", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60_000 } }),
+    (0, common_1.Post)("2fa/verify"),
+    (0, swagger_1.ApiOperation)({
+        summary: "Login (passo 2): valida código 2FA e emite tokens",
+    }),
+    (0, swagger_1.ApiOkResponse)({ type: sessionUser_response_1.VerifyTwoFactorResponse }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __param(2, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [twoFactor_command_1.VerifyTwoFactorCommand, Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "verify", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Post)("refresh"),
+    (0, swagger_1.ApiOperation)({ summary: "Rotaciona o refresh token (detecta reuso)" }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __param(2, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [refreshToken_command_1.RefreshTokenCommand, Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Post)("logout"),
+    (0, common_1.HttpCode)(200),
+    (0, swagger_1.ApiOperation)({
+        summary: "Logout: revoga o refresh token e limpa cookies (funciona mesmo com access token expirado)",
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __param(2, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [refreshToken_command_1.RefreshTokenCommand, Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "logout", null);
+__decorate([
+    (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Get)("profile"),
+    (0, swagger_1.ApiOperation)({ summary: "Dados do usuário autenticado + permissões" }),
+    (0, swagger_1.ApiOkResponse)({ type: sessionUser_response_1.SessionUserResponse }),
+    __param(0, (0, currentUser_decorator_1.CurrentUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Object)
+], AuthController.prototype, "profile", null);
+__decorate([
+    (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Get)("my-permissions"),
+    (0, swagger_1.ApiOperation)({
+        summary: "Lista os códigos de permissão e papéis do usuário",
+    }),
+    __param(0, (0, currentUser_decorator_1.CurrentUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Object)
+], AuthController.prototype, "myPermissions", null);
+__decorate([
+    (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Post)("2fa/backup/regenerate"),
+    (0, swagger_1.ApiOperation)({
+        summary: "Regenera os códigos de backup (confirma com código TOTP)",
+    }),
+    __param(0, (0, currentUser_decorator_1.CurrentUser)("id")),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, twoFactor_command_1.RegenerateBackupCommand]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "regenerateBackup", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60_000 } }),
+    (0, common_1.Post)("forgot-password"),
+    (0, common_1.HttpCode)(200),
+    (0, swagger_1.ApiOperation)({ summary: "Solicita email de redefinição de senha" }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_command_1.ForgotPasswordCommand]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "forgotPassword", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 20, ttl: 60_000 } }),
+    (0, common_1.Get)("password-token/:token"),
+    (0, swagger_1.ApiOperation)({
+        summary: "Verifica a validade do link de senha sem consumi-lo",
+    }),
+    __param(0, (0, common_1.Param)("token")),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "inspectPasswordToken", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, common_1.Post)("reset-password"),
+    (0, common_1.HttpCode)(200),
+    (0, swagger_1.ApiOperation)({ summary: "Redefine a senha usando o token do email" }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [password_command_1.ResetPasswordCommand]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "resetPassword", null);
+exports.AuthController = AuthController = __decorate([
+    (0, swagger_1.ApiTags)("Auth"),
+    (0, common_1.Controller)({ path: "auth", version: "1" }),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        env_service_1.EnvService])
+], AuthController);

package/dist/features/auth/presentation/commands/clientType.enum.d.ts

@@ -0,0 +1,4 @@
+export declare enum ClientType {
+    WEB = "web",
+    MOBILE = "mobile"
+}

package/dist/features/auth/presentation/commands/clientType.enum.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientType = void 0;
+var ClientType;
+(function (ClientType) {
+    ClientType["WEB"] = "web";
+    ClientType["MOBILE"] = "mobile";
+})(ClientType || (exports.ClientType = ClientType = {}));

package/dist/features/auth/presentation/commands/login.command.d.ts

@@ -0,0 +1,4 @@
+export declare class LoginCommand {
+    email: string;
+    password: string;
+}

package/dist/features/auth/presentation/commands/login.command.js

@@ -0,0 +1,28 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginCommand = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class LoginCommand {
+}
+exports.LoginCommand = LoginCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: "admin@admin.com" }),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], LoginCommand.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: "admin@123" }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MinLength)(1),
+    __metadata("design:type", String)
+], LoginCommand.prototype, "password", void 0);

package/dist/features/auth/presentation/commands/password.command.d.ts

@@ -0,0 +1,7 @@
+export declare class ForgotPasswordCommand {
+    email: string;
+}
+export declare class ResetPasswordCommand {
+    token: string;
+    newPassword: string;
+}

package/dist/features/auth/presentation/commands/password.command.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResetPasswordCommand = exports.ForgotPasswordCommand = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+const password_constants_1 = require("../../../../core/utils/password.constants");
+class ForgotPasswordCommand {
+}
+exports.ForgotPasswordCommand = ForgotPasswordCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], ForgotPasswordCommand.prototype, "email", void 0);
+class ResetPasswordCommand {
+}
+exports.ResetPasswordCommand = ResetPasswordCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ResetPasswordCommand.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Matches)(password_constants_1.STRONG_PASSWORD_REGEX, { message: password_constants_1.WEAK_PASSWORD_MESSAGE }),
+    __metadata("design:type", String)
+], ResetPasswordCommand.prototype, "newPassword", void 0);

package/dist/features/auth/presentation/commands/refreshToken.command.d.ts

@@ -0,0 +1,3 @@
+export declare class RefreshTokenCommand {
+    refreshToken?: string;
+}

package/dist/features/auth/presentation/commands/refreshToken.command.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshTokenCommand = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class RefreshTokenCommand {
+}
+exports.RefreshTokenCommand = RefreshTokenCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        required: false,
+        description: "Refresh token do cliente mobile. No web vem pelo cookie.",
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], RefreshTokenCommand.prototype, "refreshToken", void 0);

package/dist/features/auth/presentation/commands/twoFactor.command.d.ts

@@ -0,0 +1,12 @@
+import { ClientType } from "./clientType.enum";
+export declare class PendingTokenCommand {
+    pendingToken: string;
+}
+export declare class VerifyTwoFactorCommand extends PendingTokenCommand {
+    code: string;
+    method?: "totp" | "email" | "backup";
+    client?: ClientType;
+}
+export declare class RegenerateBackupCommand {
+    code: string;
+}

package/dist/features/auth/presentation/commands/twoFactor.command.js

@@ -0,0 +1,68 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RegenerateBackupCommand = exports.VerifyTwoFactorCommand = exports.PendingTokenCommand = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+const clientType_enum_1 = require("./clientType.enum");
+class PendingTokenCommand {
+}
+exports.PendingTokenCommand = PendingTokenCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: "pendingToken retornado pelo /auth/login" }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], PendingTokenCommand.prototype, "pendingToken", void 0);
+class VerifyTwoFactorCommand extends PendingTokenCommand {
+    constructor() {
+        super(...arguments);
+        this.client = clientType_enum_1.ClientType.WEB;
+    }
+}
+exports.VerifyTwoFactorCommand = VerifyTwoFactorCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: "Código TOTP, código de email (6 dígitos) ou backup (XXXX-XXXX)",
+    }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(6, 9),
+    __metadata("design:type", String)
+], VerifyTwoFactorCommand.prototype, "code", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        required: false,
+        enum: ["totp", "email", "backup"],
+        description: "Método usado (default: totp/email auto-detectado)",
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsIn)(["totp", "email", "backup"]),
+    __metadata("design:type", String)
+], VerifyTwoFactorCommand.prototype, "method", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        required: false,
+        enum: clientType_enum_1.ClientType,
+        default: clientType_enum_1.ClientType.WEB,
+        description: "mobile recebe os tokens no corpo; web recebe cookies httpOnly",
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(clientType_enum_1.ClientType),
+    __metadata("design:type", String)
+], VerifyTwoFactorCommand.prototype, "client", void 0);
+class RegenerateBackupCommand {
+}
+exports.RegenerateBackupCommand = RegenerateBackupCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: "Código TOTP atual (6 dígitos)" }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(6, 6),
+    __metadata("design:type", String)
+], RegenerateBackupCommand.prototype, "code", void 0);

package/dist/features/auth/presentation/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./auth.controller";
+export * from "./commands/clientType.enum";
+export * from "./commands/login.command";
+export * from "./commands/password.command";
+export * from "./commands/refreshToken.command";
+export * from "./commands/twoFactor.command";
+export * from "./strategies/jwt.strategy";

package/dist/features/auth/presentation/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.controller"), exports);
+__exportStar(require("./commands/clientType.enum"), exports);
+__exportStar(require("./commands/login.command"), exports);
+__exportStar(require("./commands/password.command"), exports);
+__exportStar(require("./commands/refreshToken.command"), exports);
+__exportStar(require("./commands/twoFactor.command"), exports);
+__exportStar(require("./strategies/jwt.strategy"), exports);

package/dist/features/auth/presentation/responses/sessionUser.response.d.ts

@@ -0,0 +1,19 @@
+import { AuthenticatedUser } from "../../../../core/auth/authenticatedUser.interface";
+export declare class SessionUserResponse implements AuthenticatedUser {
+    id: string;
+    email: string;
+    name: string;
+    lastName?: string | null;
+    avatar?: string | null;
+    roles: string[];
+    permissions: string[];
+    twoFactorEnabled: boolean;
+    passwordExpired: boolean;
+    mustChangePassword: boolean;
+}
+export declare class VerifyTwoFactorResponse {
+    user: SessionUserResponse;
+    backupCodes?: string[];
+    accessToken?: string;
+    refreshToken?: string;
+}

package/dist/features/auth/presentation/responses/sessionUser.response.js

@@ -0,0 +1,90 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VerifyTwoFactorResponse = exports.SessionUserResponse = void 0;
+const swagger_1 = require("@nestjs/swagger");
+class SessionUserResponse {
+}
+exports.SessionUserResponse = SessionUserResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "uuid" }),
+    __metadata("design:type", String)
+], SessionUserResponse.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: "admin@admin.com" }),
+    __metadata("design:type", String)
+], SessionUserResponse.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    __metadata("design:type", String)
+], SessionUserResponse.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], SessionUserResponse.prototype, "lastName", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: String, required: false, nullable: true }),
+    __metadata("design:type", Object)
+], SessionUserResponse.prototype, "avatar", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: [String] }),
+    __metadata("design:type", Array)
+], SessionUserResponse.prototype, "roles", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: [String],
+        description: "Códigos de permissão (resource:action:scope)",
+    }),
+    __metadata("design:type", Array)
+], SessionUserResponse.prototype, "permissions", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    __metadata("design:type", Boolean)
+], SessionUserResponse.prototype, "twoFactorEnabled", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: "Senha passou da validade — front força troca" }),
+    __metadata("design:type", Boolean)
+], SessionUserResponse.prototype, "passwordExpired", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: "Senha provisória: precisa trocar no 1º acesso" }),
+    __metadata("design:type", Boolean)
+], SessionUserResponse.prototype, "mustChangePassword", void 0);
+class VerifyTwoFactorResponse {
+}
+exports.VerifyTwoFactorResponse = VerifyTwoFactorResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: SessionUserResponse }),
+    __metadata("design:type", SessionUserResponse)
+], VerifyTwoFactorResponse.prototype, "user", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: [String],
+        required: false,
+        description: "Só na primeira configuração do 2FA",
+    }),
+    __metadata("design:type", Array)
+], VerifyTwoFactorResponse.prototype, "backupCodes", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: String,
+        required: false,
+        description: "Apenas para client=mobile",
+    }),
+    __metadata("design:type", String)
+], VerifyTwoFactorResponse.prototype, "accessToken", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: String,
+        required: false,
+        description: "Apenas para client=mobile",
+    }),
+    __metadata("design:type", String)
+], VerifyTwoFactorResponse.prototype, "refreshToken", void 0);

package/dist/features/auth/presentation/strategies/jwt.strategy.d.ts

@@ -0,0 +1,18 @@
+import { Strategy } from "passport-jwt";
+import { AuthenticatedUser } from "../../../../core/auth/authenticatedUser.interface";
+import { EnvService } from "../../../../core/config/env.service";
+import { AuthService } from "../../domain/auth.service";
+import { AccessTokenPayload } from "../../domain/jwtPayload.interface";
+import { UsersService } from "../../../users/domain/users.service";
+declare const JwtStrategy_base: new (...args: [opt: import("passport-jwt").StrategyOptionsWithRequest] | [opt: import("passport-jwt").StrategyOptionsWithoutRequest]) => Strategy & {
+    validate(...args: any[]): unknown;
+};
+export declare class JwtStrategy extends JwtStrategy_base {
+    private readonly env;
+    private readonly users;
+    private readonly auth;
+    private readonly logger;
+    constructor(env: EnvService, users: UsersService, auth: AuthService);
+    validate(payload: AccessTokenPayload): Promise<AuthenticatedUser>;
+}
+export {};