@breadstone/archipel-platform-authentication

Classes

Class	Description
AnonymousAuthGuard	The AnonymousAuthGuard protects routes using anonymous authentication.
AuthModule	The AuthModule handles JWT-based authentication, including token creation and validation.
AuthSubjectPort	Abstract port for resolving authentication subjects by identity. Used by the JWT, Local, and Anonymous strategies.
AuthTokenService	Generic service responsible for creating JWT access tokens. Builds a base payload from IAuthSubject and optionally enriches it via the TokenEnricherPort with product-specific claims.
ChallengeService	Stores and validates MFA login challenges.
GithubAuthGuard	The GithubAuthGuard protects routes using GitHub authentication.
JwtAuthGuard	The JwtAuthGuard protects routes using JWT-based authentication.
JwtPayloadBase	Abstract base class for JWT payloads. Products extend this to add their own claims (e.g. profileId, isPro). Used as both a serialization contract and NestJS injection token.
LastActiveMiddleware	Middleware to automatically update the lastActive timestamp for authenticated sessions. Extracts the JWT token from the Authorization header and updates the session asynchronously.
LocalAuthGuard	The LocalAuthGuard protects routes using local authentication.
MfaService	Orchestrates MFA channels, backup codes, and user preferences.
MfaSubjectPort	Abstract port for reading and writing MFA state on the underlying subject entity. Used by the MfaService and all MFA channel implementations.
RolesGuard	-
SessionMappingProfile	Mapping profile for Session entity to response transformations.
SessionPersistencePort	Abstract port for persisting and querying sessions. Used by the SessionService and LastActiveMiddleware.
SessionResponse	The SessionResponse class.
SessionService	Manages user sessions via the SessionPersistencePort.
SocialAuthGuard	-
SocialAuthPort	Abstract port for resolving or creating subjects from social / OAuth profiles. Used by all social strategies (GitHub, Google, Microsoft, Apple).
TokenEnricherPort	Abstract port for enriching JWT claims with product-specific data. This is an optional port: when not provided, the token contains only base claims.
VerificationService	Manages email / PIN verification tokens via the VerificationSubjectPort.
VerificationSubjectPort	Abstract port for verifiable subject persistence. Used by the VerificationService to manage email/PIN verification.

Interfaces

Interface	Description
IAuthModuleOptions	Options for configuring the AuthModule.
IAuthSubject	Generic authentication subject returned by the AuthSubjectPort. Represents any entity that can authenticate (user, service account, etc.).
IMfaChallengePayload	Represents the MFA challenge payload encoded in a challenge token.
IMfaChallengeState	-
IMfaConfirmation	Represents the activation result for multi-factor authentication.
IMfaSetup	Represents the data required to onboard a multi-factor authenticator.
IMfaSubject	Represents an MFA-enabled subject. Contains the data the MFA subsystem needs to read and write MFA state on the underlying user-like entity.
IMfaSubjectUpdate	Data payload for updating MFA state on the underlying entity. All properties are optional — only the provided ones are applied.
ISessionRecord	Represents a persisted session record.
ISignInResult	Represents the outcome of a sign-in attempt.
ISocialProfile	Profile data received from a social / OAuth provider.
IStoreSessionArgs	Arguments for storing a new session.
IVerifiableSubject	Represents a verifiable authentication subject. Used by the VerificationService to verify email / PIN.

Variables

Variable	Description
AUTH_APPLE_CALLBACK_URL	Apple Sign-In callback URL.
AUTH_APPLE_CLIENT_ID	Apple Sign-In client (service) ID.
AUTH_APPLE_KEY_ID	Apple Sign-In key ID.
AUTH_APPLE_PRIVATE_KEY	Apple Sign-In private key (PEM string).
AUTH_APPLE_TEAM_ID	Apple developer team ID.
AUTH_GITHUB_CLIENT_ID	GitHub OAuth client ID.
AUTH_GITHUB_CLIENT_SECRET	GitHub OAuth client secret.
AUTH_GOOGLE_CALLBACK_URL	Google OAuth2 callback URL.
AUTH_GOOGLE_CLIENT_ID	Google OAuth2 client ID.
AUTH_GOOGLE_CLIENT_SECRET	Google OAuth2 client secret.
AUTH_JWT_EXPIRES_IN	Lifetime of access tokens (e.g. '15m', '1h').
AUTH_JWT_SECRET	Secret used to sign JWTs.
AUTH_MFA_CHALLENGE_EXPIRES_IN	How long an MFA challenge stays valid (e.g. '5m').
AUTH_MFA_EMAIL_CODE_TTL	Time-to-live for email OTP codes (e.g. '10m').
AUTH_MFA_EMAIL_MIN_RESEND	Minimum interval between email OTP resend requests (e.g. '30s').
AUTH_MFA_ENCRYPTION_KEY	AES encryption key used to encrypt MFA secrets at rest.
AUTH_MFA_MAX_ATTEMPTS	Maximum number of failed MFA attempts before lockout.
AUTH_MFA_PUSH_CODE_TTL	Time-to-live for push OTP codes (e.g. '10m').
AUTH_MFA_PUSH_MIN_RESEND	Minimum interval between push OTP resend requests (e.g. '30s').
AUTH_MFA_SMS_CODE_TTL	Time-to-live for SMS OTP codes (e.g. '10m').
AUTH_MFA_SMS_MIN_RESEND	Minimum interval between SMS resend requests (e.g. '30s').
AUTH_MICROSOFT_CALLBACK_URL	Microsoft OAuth2 callback URL.
AUTH_MICROSOFT_CLIENT_ID	Microsoft OAuth2 client ID.
AUTH_MICROSOFT_CLIENT_SECRET	Microsoft OAuth2 client secret.
AUTH_MICROSOFT_TENANT	Microsoft tenant ID or 'common' for multi-tenant.
AUTH_VERIFY_JWT_EXPIRES_IN	Lifetime of email-verification JWTs.
PLATFORM_AUTHENTICATION_CONFIG_ENTRIES	All configuration entries required by platform-authentication.
ROLES_KEY	Represents the key for the UseRoles decorator.
SEED_ANONYMOUS_USERNAME	Username used for the anonymous seed user.
SESSION_LIST_MAPPING_KEY	Type-safe mapping key for Session entity list to response list transformation.
SESSION_MAPPING_KEY	Type-safe mapping key for Session entity to response transformation.
User	Represents the User decorator.

Functions

Function	Description
socialAuthGuardFactory	-
Token	Represents the Token decorator.
UseRoles	Represents the UseRoles decorator.