rl-core-api 0.11.4 → 0.13.0

package/dist/core/config/env.schema.d.ts

@@ -30,6 +30,8 @@ export declare const envSchema: z.ZodObject<{
     JWT_ACCESS_EXPIRES: z.ZodDefault<z.ZodString>;
     JWT_PENDING_EXPIRES: z.ZodDefault<z.ZodString>;
     JWT_REFRESH_EXPIRES_MINUTES: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    JWT_REFRESH_MOBILE_EXPIRES_MINUTES: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    DEVICE_TRUST_EXPIRES_MINUTES: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     TOTP_ENC_KEY: z.ZodString;
     COOKIE_SECURE: z.ZodDefault<z.ZodPipe<z.ZodEnum<{
         true: "true";

package/dist/core/config/env.schema.js

@@ -37,6 +37,16 @@ exports.envSchema = zod_1.z
         .int()
         .positive()
         .default(360),
+    JWT_REFRESH_MOBILE_EXPIRES_MINUTES: zod_1.z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(43_200),
+    DEVICE_TRUST_EXPIRES_MINUTES: zod_1.z.coerce
+        .number()
+        .int()
+        .positive()
+        .default(259_200),
     TOTP_ENC_KEY: zod_1.z
         .string()
         .length(64, "TOTP_ENC_KEY deve ter 64 chars hex (32 bytes)"),

package/dist/features/auth/domain/auth.service.d.ts

@@ -4,6 +4,7 @@ import { EnvService } from "../../../core/config/env.service";
 import { MailerService } from "../../../core/mailer/mailer.service";
 import { PasswordTokenPurpose, PasswordTokenStatus, TokenService } from "./token.service";
 import { TotpSetup, TwoFactorService } from "./twoFactor.service";
+import { ClientType } from "../presentation/commands/clientType.enum";
 import { LoginCommand } from "../presentation/commands/login.command";
 import { VerifyTwoFactorCommand } from "../presentation/commands/twoFactor.command";
 import { RbacService } from "../../rbac/domain/rbac.service";
@@ -27,6 +28,18 @@ export interface LoginSession {
 }
 export interface VerifiedSession extends LoginSession {
     backupCodes?: string[];
+    deviceToken?: string;
+}
+export interface DeviceSession extends LoginSession {
+    deviceToken: string;
+}
+export interface TrustedDevice {
+    id: string;
+    family: string;
+    createdAt: Date;
+    expiresAt: Date;
+    ipAddress?: string | null;
+    userAgent?: string | null;
 }
 export interface RefreshedTokens {
     accessToken: string;
@@ -54,8 +67,11 @@ export declare class AuthService {
     }>;
     verifyTwoFactor(dto: VerifyTwoFactorCommand, ctx: RequestCtx): Promise<VerifiedSession>;
     regenerateBackupCodes(userId: string, code: string): Promise<string[]>;
-    refresh(rawToken: string | undefined, ctx: RequestCtx): Promise<RefreshedTokens>;
-    logout(rawRefreshToken?: string): Promise<void>;
+    refresh(rawToken: string | undefined, ctx: RequestCtx, client?: ClientType): Promise<RefreshedTokens>;
+    loginWithDevice(rawToken: string | undefined, ctx: RequestCtx): Promise<DeviceSession>;
+    listTrustedDevices(userId: string): Promise<TrustedDevice[]>;
+    forgetTrustedDevice(userId: string, family: string): Promise<void>;
+    logout(rawRefreshToken?: string, rawDeviceToken?: string): Promise<void>;
     forgotPassword(email: string): Promise<void>;
     inspectPasswordToken(token: string): Promise<PasswordTokenCheck>;
     resetPassword(token: string, newPassword: string): Promise<void>;

package/dist/features/auth/domain/auth.service.js

@@ -20,6 +20,7 @@ const codedError_util_1 = require("../../../core/utils/codedError.util");
 const hash_util_1 = require("../../../core/utils/hash.util");
 const token_service_1 = require("./token.service");
 const twoFactor_service_1 = require("./twoFactor.service");
+const clientType_enum_1 = require("../presentation/commands/clientType.enum");
 const rbac_service_1 = require("../../rbac/domain/rbac.service");
 const users_service_1 = require("../../users/domain/users.service");
 const BACKUP_FORMAT = /^[A-Za-z0-9]{4}-[A-Za-z0-9]{4}$/;
@@ -150,8 +151,12 @@ let AuthService = class AuthService {
             user.backupCodes = remainingBackup;
         }
         await this.users.save(user);
-        const tokens = await this.finalizeLogin(user, ctx);
-        return { ...tokens, backupCodes };
+        const client = dto.client ?? clientType_enum_1.ClientType.WEB;
+        const tokens = await this.finalizeLogin(user, ctx, client);
+        const deviceToken = client === clientType_enum_1.ClientType.MOBILE
+            ? await this.tokens.issueDeviceToken(user.id, ctx)
+            : undefined;
+        return { ...tokens, backupCodes, deviceToken };
     }
     async regenerateBackupCodes(userId, code) {
         const user = await this.users.findById(userId);
@@ -170,11 +175,11 @@ let AuthService = class AuthService {
         await this.users.save(user);
         return generated.plain;
     }
-    async refresh(rawToken, ctx) {
+    async refresh(rawToken, ctx, client = clientType_enum_1.ClientType.WEB) {
         if (!rawToken) {
             throw new common_1.UnauthorizedException("Refresh token ausente");
         }
-        const { userId, rawToken: newRefresh } = await this.tokens.rotateRefreshToken(rawToken, ctx);
+        const { userId, rawToken: newRefresh } = await this.tokens.rotateRefreshToken(rawToken, ctx, client);
         const user = await this.users.findById(userId);
         if (!user.isActive) {
             throw accountInactive();
@@ -182,11 +187,43 @@ let AuthService = class AuthService {
         const accessToken = await this.signAccessToken(user);
         return { accessToken, refreshToken: newRefresh };
     }
-    async logout(rawRefreshToken) {
-        if (!rawRefreshToken) {
-            return;
+    async loginWithDevice(rawToken, ctx) {
+        if (!rawToken) {
+            throw new common_1.UnauthorizedException("Aparelho não reconhecido");
+        }
+        const { userId, rawToken: renewed } = await this.tokens.rotateDeviceToken(rawToken, ctx);
+        const user = await this.users.findById(userId);
+        if (!user.isActive) {
+            throw accountInactive();
+        }
+        if (user.isLocked(this.env.get("LOGIN_MAX_ATTEMPTS"))) {
+            throw accountLocked();
+        }
+        (0, auditContext_1.setAuditUser)(user.id);
+        const session = await this.finalizeLogin(user, ctx, clientType_enum_1.ClientType.MOBILE);
+        return { ...session, deviceToken: renewed };
+    }
+    async listTrustedDevices(userId) {
+        const devices = await this.tokens.listTrustedDevices(userId);
+        return devices.map((device) => ({
+            id: device.id,
+            family: device.family ?? device.id,
+            createdAt: device.createdAt,
+            expiresAt: device.expiresAt,
+            ipAddress: device.ipAddress,
+            userAgent: device.userAgent,
+        }));
+    }
+    async forgetTrustedDevice(userId, family) {
+        await this.tokens.revokeTrustedDevice(userId, family);
+    }
+    async logout(rawRefreshToken, rawDeviceToken) {
+        if (rawRefreshToken) {
+            await this.tokens.revokeByRawToken(rawRefreshToken);
+        }
+        if (rawDeviceToken) {
+            await this.tokens.revokeDeviceByRawToken(rawDeviceToken);
         }
-        await this.tokens.revokeByRawToken(rawRefreshToken);
     }
     async forgotPassword(email) {
         const user = await this.users.findByEmail(email);
@@ -284,9 +321,9 @@ let AuthService = class AuthService {
             mustChangePassword: user.mustChangePassword,
         };
     }
-    async finalizeLogin(user, ctx) {
+    async finalizeLogin(user, ctx, client) {
         const accessToken = await this.signAccessToken(user);
-        const { rawToken } = await this.tokens.issueRefreshToken(user.id, undefined, ctx);
+        const { rawToken } = await this.tokens.issueRefreshToken(user.id, undefined, ctx, client);
         return {
             accessToken,
             refreshToken: rawToken,

package/dist/features/auth/domain/token.service.d.ts

@@ -1,6 +1,7 @@
 import { EnvService } from "../../../core/config/env.service";
 import { AuthTokenRepository } from "../infra/repositories/authToken.repository";
-import { TokenType } from "../infra/schema/authToken.schema";
+import { AuthToken, TokenType } from "../infra/schema/authToken.schema";
+import { ClientType } from "../presentation/commands/clientType.enum";
 export interface RotationResult {
     userId: string;
     rawToken: string;
@@ -29,17 +30,33 @@ export declare class TokenService {
     constructor(repo: AuthTokenRepository, env: EnvService);
     private persist;
     private minutesFromNow;
+    private refreshMinutes;
     issueRefreshToken(userId: string, family?: string, ctx?: {
         ipAddress?: string;
         userAgent?: string;
-    }): Promise<{
+    }, client?: ClientType): Promise<{
         rawToken: string;
         family: string;
     }>;
     rotateRefreshToken(rawToken: string, ctx?: {
         ipAddress?: string;
         userAgent?: string;
-    }): Promise<RotationResult>;
+    }, client?: ClientType): Promise<RotationResult>;
+    issueDeviceToken(userId: string, ctx?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }, family?: string): Promise<string>;
+    rotateDeviceToken(rawToken: string, ctx?: {
+        ipAddress?: string;
+        userAgent?: string;
+    }): Promise<{
+        userId: string;
+        rawToken: string;
+    }>;
+    listTrustedDevices(userId: string): Promise<AuthToken[]>;
+    revokeAllDevices(userId: string): Promise<void>;
+    revokeTrustedDevice(userId: string, family: string): Promise<void>;
+    revokeDeviceByRawToken(rawToken: string): Promise<void>;
     revokeFamily(family: string): Promise<void>;
     revokeAllRefresh(userId: string): Promise<void>;
     revokeByRawToken(rawToken: string): Promise<void>;

package/dist/features/auth/domain/token.service.js

@@ -18,6 +18,7 @@ const env_service_1 = require("../../../core/config/env.service");
 const hash_util_1 = require("../../../core/utils/hash.util");
 const authToken_repository_1 = require("../infra/repositories/authToken.repository");
 const authToken_schema_1 = require("../infra/schema/authToken.schema");
+const clientType_enum_1 = require("../presentation/commands/clientType.enum");
 var PasswordTokenStatus;
 (function (PasswordTokenStatus) {
     PasswordTokenStatus["VALID"] = "valid";
@@ -49,7 +50,12 @@ let TokenService = TokenService_1 = class TokenService {
     minutesFromNow(minutes) {
         return new Date(Date.now() + minutes * 60_000);
     }
-    async issueRefreshToken(userId, family, ctx) {
+    refreshMinutes(client) {
+        return client === clientType_enum_1.ClientType.MOBILE
+            ? this.env.get("JWT_REFRESH_MOBILE_EXPIRES_MINUTES")
+            : this.env.get("JWT_REFRESH_EXPIRES_MINUTES");
+    }
+    async issueRefreshToken(userId, family, ctx, client = clientType_enum_1.ClientType.WEB) {
         const rawToken = (0, hash_util_1.randomToken)(48);
         const fam = family ?? (0, uuid_1.v7)();
         await this.persist({
@@ -57,13 +63,13 @@ let TokenService = TokenService_1 = class TokenService {
             rawToken,
             type: authToken_schema_1.TokenType.REFRESH_TOKEN,
             family: fam,
-            expiresAt: this.minutesFromNow(this.env.get("JWT_REFRESH_EXPIRES_MINUTES")),
+            expiresAt: this.minutesFromNow(this.refreshMinutes(client)),
             ipAddress: ctx?.ipAddress,
             userAgent: ctx?.userAgent,
         });
         return { rawToken, family: fam };
     }
-    async rotateRefreshToken(rawToken, ctx) {
+    async rotateRefreshToken(rawToken, ctx, client = clientType_enum_1.ClientType.WEB) {
         const tokenHash = (0, hash_util_1.sha256)(rawToken);
         const stored = await this.repo.findOne({
             where: { tokenHash, type: authToken_schema_1.TokenType.REFRESH_TOKEN },
@@ -83,9 +89,80 @@ let TokenService = TokenService_1 = class TokenService {
         }
         stored.used = true;
         await this.repo.save(stored);
-        const { rawToken: newRaw, family } = await this.issueRefreshToken(stored.userId, stored.family ?? undefined, ctx);
+        const { rawToken: newRaw, family } = await this.issueRefreshToken(stored.userId, stored.family ?? undefined, ctx, client);
         return { userId: stored.userId, rawToken: newRaw, family };
     }
+    async issueDeviceToken(userId, ctx, family) {
+        if (!family) {
+            await this.revokeAllDevices(userId);
+        }
+        const rawToken = (0, hash_util_1.randomToken)(48);
+        await this.persist({
+            userId,
+            rawToken,
+            type: authToken_schema_1.TokenType.DEVICE_TRUST,
+            family: family ?? (0, uuid_1.v7)(),
+            expiresAt: this.minutesFromNow(this.env.get("DEVICE_TRUST_EXPIRES_MINUTES")),
+            ipAddress: ctx?.ipAddress,
+            userAgent: ctx?.userAgent,
+        });
+        return rawToken;
+    }
+    async rotateDeviceToken(rawToken, ctx) {
+        const stored = await this.repo.findOne({
+            where: { tokenHash: (0, hash_util_1.sha256)(rawToken), type: authToken_schema_1.TokenType.DEVICE_TRUST },
+        });
+        if (!stored) {
+            throw new common_1.UnauthorizedException("Aparelho não reconhecido");
+        }
+        if (stored.used || stored.revoked) {
+            this.logger.warn(`Reuso de vínculo de aparelho detectado (família ${stored.family})`);
+            if (stored.family) {
+                await this.revokeFamily(stored.family);
+            }
+            throw new common_1.UnauthorizedException("Aparelho revogado por segurança");
+        }
+        if (stored.isExpired()) {
+            throw new common_1.UnauthorizedException("Vínculo do aparelho expirado");
+        }
+        stored.used = true;
+        await this.repo.save(stored);
+        const renewed = await this.issueDeviceToken(stored.userId, ctx, stored.family ?? undefined);
+        return { userId: stored.userId, rawToken: renewed };
+    }
+    async listTrustedDevices(userId) {
+        const tokens = await this.repo.find({
+            where: { userId, type: authToken_schema_1.TokenType.DEVICE_TRUST, revoked: false },
+            order: { createdAt: "DESC" },
+        });
+        const latestByFamily = new Map();
+        for (const token of tokens) {
+            const key = token.family ?? token.id;
+            if (!latestByFamily.has(key) && !token.isExpired()) {
+                latestByFamily.set(key, token);
+            }
+        }
+        return [...latestByFamily.values()];
+    }
+    async revokeAllDevices(userId) {
+        await this.repo.update({ userId, type: authToken_schema_1.TokenType.DEVICE_TRUST, revoked: false }, { revoked: true });
+    }
+    async revokeTrustedDevice(userId, family) {
+        await this.repo.update({ userId, family, type: authToken_schema_1.TokenType.DEVICE_TRUST }, { revoked: true });
+    }
+    async revokeDeviceByRawToken(rawToken) {
+        const stored = await this.repo.findOne({
+            where: { tokenHash: (0, hash_util_1.sha256)(rawToken), type: authToken_schema_1.TokenType.DEVICE_TRUST },
+        });
+        if (!stored) {
+            return;
+        }
+        if (stored.family) {
+            await this.revokeFamily(stored.family);
+            return;
+        }
+        await this.repo.update({ id: stored.id }, { revoked: true });
+    }
     async revokeFamily(family) {
         await this.repo.update({ family }, { revoked: true });
     }

package/dist/features/auth/infra/schema/authToken.schema.d.ts

@@ -4,7 +4,8 @@ export declare enum TokenType {
     FIRST_ACCESS = 1,
     TWO_FACTOR_EMAIL = 2,
     REFRESH_TOKEN = 3,
-    TOTP_USED = 4
+    TOTP_USED = 4,
+    DEVICE_TRUST = 5
 }
 export declare class AuthToken extends BaseEntity {
     userId: string;

package/dist/features/auth/infra/schema/authToken.schema.js

@@ -19,6 +19,7 @@ var TokenType;
     TokenType[TokenType["TWO_FACTOR_EMAIL"] = 2] = "TWO_FACTOR_EMAIL";
     TokenType[TokenType["REFRESH_TOKEN"] = 3] = "REFRESH_TOKEN";
     TokenType[TokenType["TOTP_USED"] = 4] = "TOTP_USED";
+    TokenType[TokenType["DEVICE_TRUST"] = 5] = "DEVICE_TRUST";
 })(TokenType || (exports.TokenType = TokenType = {}));
 let AuthToken = class AuthToken extends base_schema_1.BaseEntity {
     isExpired() {

package/dist/features/auth/presentation/auth.controller.d.ts

@@ -5,16 +5,19 @@ import { AuthService } from "../domain/auth.service";
 import { PasswordTokenCheck } from "../domain/auth.service";
 import { SessionUser } from "../domain/auth.service";
 import { LoginChallenge } from "../domain/auth.service";
+import { DeviceSession, TrustedDevice } from "../domain/auth.service";
 import { TotpSetup } from "../domain/twoFactor.service";
+import { DeviceLoginCommand } from "./commands/deviceLogin.command";
 import { LoginCommand } from "./commands/login.command";
 import { ForgotPasswordCommand, ResetPasswordCommand } from "./commands/password.command";
-import { RefreshTokenCommand } from "./commands/refreshToken.command";
+import { LogoutCommand, RefreshTokenCommand } from "./commands/refreshToken.command";
 import { PendingTokenCommand, RegenerateBackupCommand, VerifyTwoFactorCommand } from "./commands/twoFactor.command";
 export interface VerifyResponse {
     user: SessionUser;
     backupCodes?: string[];
     accessToken?: string;
     refreshToken?: string;
+    deviceToken?: string;
 }
 export interface RefreshResponse {
     ok: boolean;
@@ -32,7 +35,12 @@ export declare class AuthController {
     }>;
     verify(dto: VerifyTwoFactorCommand, req: Request, res: Response): Promise<VerifyResponse>;
     refresh(dto: RefreshTokenCommand, req: Request, res: Response): Promise<RefreshResponse>;
-    logout(dto: RefreshTokenCommand, req: Request, res: Response): Promise<{
+    logout(dto: LogoutCommand, req: Request, res: Response): Promise<{
+        ok: boolean;
+    }>;
+    deviceLogin(dto: DeviceLoginCommand, req: Request): Promise<DeviceSession>;
+    devices(user: AuthenticatedUser): Promise<TrustedDevice[]>;
+    forgetDevice(user: AuthenticatedUser, family: string): Promise<{
         ok: boolean;
     }>;
     profile(user: AuthenticatedUser): AuthenticatedUser;

package/dist/features/auth/presentation/auth.controller.js

@@ -26,6 +26,7 @@ const ip_util_1 = require("../../../core/utils/ip.util");
 const auditable_decorator_1 = require("../../audit/presentation/decorators/auditable.decorator");
 const auth_service_1 = require("../domain/auth.service");
 const clientType_enum_1 = require("./commands/clientType.enum");
+const deviceLogin_command_1 = require("./commands/deviceLogin.command");
 const login_command_1 = require("./commands/login.command");
 const password_command_1 = require("./commands/password.command");
 const refreshToken_command_1 = require("./commands/refreshToken.command");
@@ -52,10 +53,10 @@ let AuthController = class AuthController {
         return this.auth.requestEmailCode(dto.pendingToken);
     }
     async verify(dto, req, res) {
-        const { accessToken, refreshToken, user, backupCodes } = await this.auth.verifyTwoFactor(dto, ctxFrom(req));
+        const { accessToken, refreshToken, user, backupCodes, deviceToken } = await this.auth.verifyTwoFactor(dto, ctxFrom(req));
         (0, requestLog_context_1.setRequestLogUser)(req, user.id);
         if (dto.client === clientType_enum_1.ClientType.MOBILE) {
-            return { user, backupCodes, accessToken, refreshToken };
+            return { user, backupCodes, accessToken, refreshToken, deviceToken };
         }
         (0, cookie_util_1.setAuthCookies)(res, this.env, { accessToken, refreshToken });
         return { user, backupCodes };
@@ -63,7 +64,8 @@ let AuthController = class AuthController {
     async refresh(dto, req, res) {
         const cookies = req.cookies;
         const raw = dto.refreshToken ?? cookies?.[cookie_util_1.REFRESH_COOKIE];
-        const tokens = await this.auth.refresh(raw, ctxFrom(req));
+        const client = dto.refreshToken ? clientType_enum_1.ClientType.MOBILE : clientType_enum_1.ClientType.WEB;
+        const tokens = await this.auth.refresh(raw, ctxFrom(req), client);
         if (dto.refreshToken) {
             return { ok: true, ...tokens };
         }
@@ -72,10 +74,22 @@ let AuthController = class AuthController {
     }
     async logout(dto, req, res) {
         const cookies = req.cookies;
-        await this.auth.logout(dto.refreshToken ?? cookies?.[cookie_util_1.REFRESH_COOKIE]);
+        await this.auth.logout(dto.refreshToken ?? cookies?.[cookie_util_1.REFRESH_COOKIE], dto.deviceToken);
         (0, cookie_util_1.clearAuthCookies)(res, this.env);
         return { ok: true };
     }
+    async deviceLogin(dto, req) {
+        const session = await this.auth.loginWithDevice(dto.deviceToken, ctxFrom(req));
+        (0, requestLog_context_1.setRequestLogUser)(req, session.user.id);
+        return session;
+    }
+    devices(user) {
+        return this.auth.listTrustedDevices(user.id);
+    }
+    async forgetDevice(user, family) {
+        await this.auth.forgetTrustedDevice(user.id, family);
+        return { ok: true };
+    }
     profile(user) {
         return user;
     }
@@ -170,9 +184,50 @@ __decorate([
     __param(1, (0, common_1.Req)()),
     __param(2, (0, common_1.Res)({ passthrough: true })),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [refreshToken_command_1.RefreshTokenCommand, Object, Object]),
+    __metadata("design:paramtypes", [refreshToken_command_1.LogoutCommand, Object, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "logout", null);
+__decorate([
+    (0, public_decorator_1.Public)(),
+    (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60_000 } }),
+    (0, auditable_decorator_1.Auditable)("Login pelo aparelho confiável"),
+    (0, common_1.Post)("device/login"),
+    (0, swagger_1.ApiOperation)({
+        summary: "Login pelo aparelho confiável: sem senha e sem 2FA",
+        description: "O app apresenta o vínculo criado num login completo, depois de destravá-lo com a biometria. O vínculo rotaciona a cada uso.",
+    }),
+    (0, swagger_1.ApiOkResponse)({ type: sessionUser_response_1.DeviceLoginResponse }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [deviceLogin_command_1.DeviceLoginCommand, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "deviceLogin", null);
+__decorate([
+    (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Get)("devices"),
+    (0, swagger_1.ApiOperation)({ summary: "Aparelhos confiáveis da conta" }),
+    (0, swagger_1.ApiOkResponse)({ type: sessionUser_response_1.TrustedDeviceResponse, isArray: true }),
+    __param(0, (0, currentUser_decorator_1.CurrentUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "devices", null);
+__decorate([
+    (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, auditable_decorator_1.Auditable)("Esquecer aparelho confiável"),
+    (0, common_1.Delete)("devices/:family"),
+    (0, swagger_1.ApiOperation)({
+        summary: "Esquece um aparelho: o próximo acesso dele exige senha + 2FA",
+    }),
+    __param(0, (0, currentUser_decorator_1.CurrentUser)()),
+    __param(1, (0, common_1.Param)("family")),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "forgetDevice", null);
 __decorate([
     (0, common_1.UseGuards)(jwtAuth_guard_1.JwtAuthGuard),
     (0, swagger_1.ApiBearerAuth)(),

package/dist/features/auth/presentation/commands/deviceLogin.command.d.ts

@@ -0,0 +1,3 @@
+export declare class DeviceLoginCommand {
+    deviceToken: string;
+}

package/dist/features/auth/presentation/commands/deviceLogin.command.js

@@ -0,0 +1,23 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceLoginCommand = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class DeviceLoginCommand {
+}
+exports.DeviceLoginCommand = DeviceLoginCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: "Vínculo do aparelho, guardado no Keychain" }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MinLength)(32),
+    __metadata("design:type", String)
+], DeviceLoginCommand.prototype, "deviceToken", void 0);

package/dist/features/auth/presentation/commands/refreshToken.command.d.ts

@@ -1,3 +1,6 @@
 export declare class RefreshTokenCommand {
     refreshToken?: string;
 }
+export declare class LogoutCommand extends RefreshTokenCommand {
+    deviceToken?: string;
+}

package/dist/features/auth/presentation/commands/refreshToken.command.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RefreshTokenCommand = void 0;
+exports.LogoutCommand = exports.RefreshTokenCommand = void 0;
 const swagger_1 = require("@nestjs/swagger");
 const class_validator_1 = require("class-validator");
 class RefreshTokenCommand {
@@ -24,3 +24,15 @@ __decorate([
     (0, class_validator_1.IsString)(),
     __metadata("design:type", String)
 ], RefreshTokenCommand.prototype, "refreshToken", void 0);
+class LogoutCommand extends RefreshTokenCommand {
+}
+exports.LogoutCommand = LogoutCommand;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        required: false,
+        description: "Enviar apenas para esquecer o aparelho junto com a saída",
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], LogoutCommand.prototype, "deviceToken", void 0);

package/dist/features/auth/presentation/responses/sessionUser.response.d.ts

@@ -16,4 +16,19 @@ export declare class VerifyTwoFactorResponse {
     backupCodes?: string[];
     accessToken?: string;
     refreshToken?: string;
+    deviceToken?: string;
+}
+export declare class DeviceLoginResponse {
+    user: SessionUserResponse;
+    accessToken: string;
+    refreshToken: string;
+    deviceToken: string;
+}
+export declare class TrustedDeviceResponse {
+    id: string;
+    family: string;
+    createdAt: Date;
+    expiresAt: Date;
+    ipAddress?: string | null;
+    userAgent?: string | null;
 }

package/dist/features/auth/presentation/responses/sessionUser.response.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VerifyTwoFactorResponse = exports.SessionUserResponse = void 0;
+exports.TrustedDeviceResponse = exports.DeviceLoginResponse = exports.VerifyTwoFactorResponse = exports.SessionUserResponse = void 0;
 const swagger_1 = require("@nestjs/swagger");
 class SessionUserResponse {
 }
@@ -88,3 +88,60 @@ __decorate([
     }),
     __metadata("design:type", String)
 ], VerifyTwoFactorResponse.prototype, "refreshToken", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: String,
+        required: false,
+        description: "Vínculo do aparelho (client=mobile). Guardar no Keychain: é o que abre os próximos acessos sem senha e sem 2FA",
+    }),
+    __metadata("design:type", String)
+], VerifyTwoFactorResponse.prototype, "deviceToken", void 0);
+class DeviceLoginResponse {
+}
+exports.DeviceLoginResponse = DeviceLoginResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: SessionUserResponse }),
+    __metadata("design:type", SessionUserResponse)
+], DeviceLoginResponse.prototype, "user", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    __metadata("design:type", String)
+], DeviceLoginResponse.prototype, "accessToken", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    __metadata("design:type", String)
+], DeviceLoginResponse.prototype, "refreshToken", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: "O vínculo rotaciona a cada uso: guarde este" }),
+    __metadata("design:type", String)
+], DeviceLoginResponse.prototype, "deviceToken", void 0);
+class TrustedDeviceResponse {
+}
+exports.TrustedDeviceResponse = TrustedDeviceResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ format: "uuid" }),
+    __metadata("design:type", String)
+], TrustedDeviceResponse.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        format: "uuid",
+        description: "Identifica o aparelho ao longo das rotações — é o que se revoga",
+    }),
+    __metadata("design:type", String)
+], TrustedDeviceResponse.prototype, "family", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    __metadata("design:type", Date)
+], TrustedDeviceResponse.prototype, "createdAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    __metadata("design:type", Date)
+], TrustedDeviceResponse.prototype, "expiresAt", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false, nullable: true }),
+    __metadata("design:type", Object)
+], TrustedDeviceResponse.prototype, "ipAddress", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false, nullable: true }),
+    __metadata("design:type", Object)
+], TrustedDeviceResponse.prototype, "userAgent", void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rl-core-api",
-  "version": "0.11.4",
+  "version": "0.13.0",
   "description": "Core NestJS: autenticação com 2FA, RBAC, auditoria, notificações e listagens com filtro dinâmico",
   "author": "Rodrigo Liberti",
   "license": "MIT",