rl-core-api 0.11.3 → 0.12.0

package/dist/core/config/env.schema.d.ts

@@ -30,6 +30,7 @@ export declare const envSchema: z.ZodObject<{
     JWT_ACCESS_EXPIRES: z.ZodDefault<z.ZodString>;
     JWT_PENDING_EXPIRES: z.ZodDefault<z.ZodString>;
     JWT_REFRESH_EXPIRES_MINUTES: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    JWT_REFRESH_MOBILE_EXPIRES_MINUTES: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     TOTP_ENC_KEY: z.ZodString;
     COOKIE_SECURE: z.ZodDefault<z.ZodPipe<z.ZodEnum<{
         true: "true";

package/dist/core/config/env.schema.js

@@ -37,6 +37,11 @@ exports.envSchema = zod_1.z
         .int()
         .positive()
         .default(360),
+    JWT_REFRESH_MOBILE_EXPIRES_MINUTES: zod_1.z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(43_200),
     TOTP_ENC_KEY: zod_1.z
         .string()
         .length(64, "TOTP_ENC_KEY deve ter 64 chars hex (32 bytes)"),

package/dist/features/auth/domain/auth.service.d.ts

@@ -4,6 +4,7 @@ import { EnvService } from "../../../core/config/env.service";
 import { MailerService } from "../../../core/mailer/mailer.service";
 import { PasswordTokenPurpose, PasswordTokenStatus, TokenService } from "./token.service";
 import { TotpSetup, TwoFactorService } from "./twoFactor.service";
+import { ClientType } from "../presentation/commands/clientType.enum";
 import { LoginCommand } from "../presentation/commands/login.command";
 import { VerifyTwoFactorCommand } from "../presentation/commands/twoFactor.command";
 import { RbacService } from "../../rbac/domain/rbac.service";
@@ -54,7 +55,7 @@ export declare class AuthService {
     }>;
     verifyTwoFactor(dto: VerifyTwoFactorCommand, ctx: RequestCtx): Promise<VerifiedSession>;
     regenerateBackupCodes(userId: string, code: string): Promise<string[]>;
-    refresh(rawToken: string | undefined, ctx: RequestCtx): Promise<RefreshedTokens>;
+    refresh(rawToken: string | undefined, ctx: RequestCtx, client?: ClientType): Promise<RefreshedTokens>;
     logout(rawRefreshToken?: string): Promise<void>;
     forgotPassword(email: string): Promise<void>;
     inspectPasswordToken(token: string): Promise<PasswordTokenCheck>;

package/dist/features/auth/domain/auth.service.js

@@ -20,6 +20,7 @@ const codedError_util_1 = require("../../../core/utils/codedError.util");
 const hash_util_1 = require("../../../core/utils/hash.util");
 const token_service_1 = require("./token.service");
 const twoFactor_service_1 = require("./twoFactor.service");
+const clientType_enum_1 = require("../presentation/commands/clientType.enum");
 const rbac_service_1 = require("../../rbac/domain/rbac.service");
 const users_service_1 = require("../../users/domain/users.service");
 const BACKUP_FORMAT = /^[A-Za-z0-9]{4}-[A-Za-z0-9]{4}$/;
@@ -150,7 +151,7 @@ let AuthService = class AuthService {
             user.backupCodes = remainingBackup;
         }
         await this.users.save(user);
-        const tokens = await this.finalizeLogin(user, ctx);
+        const tokens = await this.finalizeLogin(user, ctx, dto.client ?? clientType_enum_1.ClientType.WEB);
         return { ...tokens, backupCodes };
     }
     async regenerateBackupCodes(userId, code) {
@@ -170,11 +171,11 @@ let AuthService = class AuthService {
         await this.users.save(user);
         return generated.plain;
     }
-    async refresh(rawToken, ctx) {
+    async refresh(rawToken, ctx, client = clientType_enum_1.ClientType.WEB) {
         if (!rawToken) {
             throw new common_1.UnauthorizedException("Refresh token ausente");
         }
-        const { userId, rawToken: newRefresh } = await this.tokens.rotateRefreshToken(rawToken, ctx);
+        const { userId, rawToken: newRefresh } = await this.tokens.rotateRefreshToken(rawToken, ctx, client);
         const user = await this.users.findById(userId);
         if (!user.isActive) {
             throw accountInactive();
@@ -284,9 +285,9 @@ let AuthService = class AuthService {
             mustChangePassword: user.mustChangePassword,
         };
     }
-    async finalizeLogin(user, ctx) {
+    async finalizeLogin(user, ctx, client) {
         const accessToken = await this.signAccessToken(user);
-        const { rawToken } = await this.tokens.issueRefreshToken(user.id, undefined, ctx);
+        const { rawToken } = await this.tokens.issueRefreshToken(user.id, undefined, ctx, client);
         return {
             accessToken,
             refreshToken: rawToken,

package/dist/features/auth/domain/token.service.d.ts

@@ -1,6 +1,7 @@
 import { EnvService } from "../../../core/config/env.service";
 import { AuthTokenRepository } from "../infra/repositories/authToken.repository";
 import { TokenType } from "../infra/schema/authToken.schema";
+import { ClientType } from "../presentation/commands/clientType.enum";
 export interface RotationResult {
     userId: string;
     rawToken: string;
@@ -29,17 +30,18 @@ export declare class TokenService {
     constructor(repo: AuthTokenRepository, env: EnvService);
     private persist;
     private minutesFromNow;
+    private refreshMinutes;
     issueRefreshToken(userId: string, family?: string, ctx?: {
         ipAddress?: string;
         userAgent?: string;
-    }): Promise<{
+    }, client?: ClientType): Promise<{
         rawToken: string;
         family: string;
     }>;
     rotateRefreshToken(rawToken: string, ctx?: {
         ipAddress?: string;
         userAgent?: string;
-    }): Promise<RotationResult>;
+    }, client?: ClientType): Promise<RotationResult>;
     revokeFamily(family: string): Promise<void>;
     revokeAllRefresh(userId: string): Promise<void>;
     revokeByRawToken(rawToken: string): Promise<void>;

package/dist/features/auth/domain/token.service.js

@@ -18,6 +18,7 @@ const env_service_1 = require("../../../core/config/env.service");
 const hash_util_1 = require("../../../core/utils/hash.util");
 const authToken_repository_1 = require("../infra/repositories/authToken.repository");
 const authToken_schema_1 = require("../infra/schema/authToken.schema");
+const clientType_enum_1 = require("../presentation/commands/clientType.enum");
 var PasswordTokenStatus;
 (function (PasswordTokenStatus) {
     PasswordTokenStatus["VALID"] = "valid";
@@ -49,7 +50,12 @@ let TokenService = TokenService_1 = class TokenService {
     minutesFromNow(minutes) {
         return new Date(Date.now() + minutes * 60_000);
     }
-    async issueRefreshToken(userId, family, ctx) {
+    refreshMinutes(client) {
+        return client === clientType_enum_1.ClientType.MOBILE
+            ? this.env.get("JWT_REFRESH_MOBILE_EXPIRES_MINUTES")
+            : this.env.get("JWT_REFRESH_EXPIRES_MINUTES");
+    }
+    async issueRefreshToken(userId, family, ctx, client = clientType_enum_1.ClientType.WEB) {
         const rawToken = (0, hash_util_1.randomToken)(48);
         const fam = family ?? (0, uuid_1.v7)();
         await this.persist({
@@ -57,13 +63,13 @@ let TokenService = TokenService_1 = class TokenService {
             rawToken,
             type: authToken_schema_1.TokenType.REFRESH_TOKEN,
             family: fam,
-            expiresAt: this.minutesFromNow(this.env.get("JWT_REFRESH_EXPIRES_MINUTES")),
+            expiresAt: this.minutesFromNow(this.refreshMinutes(client)),
             ipAddress: ctx?.ipAddress,
             userAgent: ctx?.userAgent,
         });
         return { rawToken, family: fam };
     }
-    async rotateRefreshToken(rawToken, ctx) {
+    async rotateRefreshToken(rawToken, ctx, client = clientType_enum_1.ClientType.WEB) {
         const tokenHash = (0, hash_util_1.sha256)(rawToken);
         const stored = await this.repo.findOne({
             where: { tokenHash, type: authToken_schema_1.TokenType.REFRESH_TOKEN },
@@ -83,7 +89,7 @@ let TokenService = TokenService_1 = class TokenService {
         }
         stored.used = true;
         await this.repo.save(stored);
-        const { rawToken: newRaw, family } = await this.issueRefreshToken(stored.userId, stored.family ?? undefined, ctx);
+        const { rawToken: newRaw, family } = await this.issueRefreshToken(stored.userId, stored.family ?? undefined, ctx, client);
         return { userId: stored.userId, rawToken: newRaw, family };
     }
     async revokeFamily(family) {

package/dist/features/auth/presentation/auth.controller.js

@@ -63,7 +63,8 @@ let AuthController = class AuthController {
     async refresh(dto, req, res) {
         const cookies = req.cookies;
         const raw = dto.refreshToken ?? cookies?.[cookie_util_1.REFRESH_COOKIE];
-        const tokens = await this.auth.refresh(raw, ctxFrom(req));
+        const client = dto.refreshToken ? clientType_enum_1.ClientType.MOBILE : clientType_enum_1.ClientType.WEB;
+        const tokens = await this.auth.refresh(raw, ctxFrom(req), client);
         if (dto.refreshToken) {
             return { ok: true, ...tokens };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rl-core-api",
-  "version": "0.11.3",
+  "version": "0.12.0",
   "description": "Core NestJS: autenticação com 2FA, RBAC, auditoria, notificações e listagens com filtro dinâmico",
   "author": "Rodrigo Liberti",
   "license": "MIT",