@pixel-brewery/archipel-platform-authentication

Enumerations

Enumeration	Description
SessionRefreshOutcome	Result of exchanging a refresh token.

Classes

Class	Description
AnonymousAuthGuard	The AnonymousAuthGuard protects routes using anonymous authentication.
AppleConnector	The AppleConnector integrates Apple Sign In authentication.
AuthenticationHealthIndicator	Health indicator for the authentication infrastructure.
AuthModule	The AuthModule handles JWT-based authentication, including token creation and validation.
AuthSubjectPort	Abstract port for resolving authentication subjects by identity. Used by the JWT, Local, and Anonymous strategies.
AuthTokenService	Generic service responsible for creating JWT access tokens. Builds a base payload from IAuthSubject and optionally enriches it via the TokenEnricherPort with product-specific claims.
ChallengeService	Stores and validates MFA login challenges.
ChallengeStorePort	Abstract port for persisting MFA challenge state.
GithubConnector	-
GoogleConnector	The GoogleConnector integrates Google OAuth authentication.
InvalidMfaCodeError	Error thrown when a code does not confirm the setup of a multi-factor authentication method.
JwtAuthGuard	The JwtAuthGuard protects routes using JWT-based authentication. It checks for the @Public() decorator metadata. When registered as APP_GUARD, all routes require JWT authentication by default. Routes decorated with @Public() are exempt.
JwtPayloadBase	Abstract base class for JWT payloads. Products extend this to add their own claims (e.g. profileId, isPro). Used as both a serialization contract and NestJS injection token.
LastActiveMiddleware	Middleware to automatically update the lastActive timestamp for authenticated sessions. Reads the session identifier from the bearer token and updates the session asynchronously.
LocalAuthGuard	The LocalAuthGuard protects routes using local authentication.
MfaChannelNotEnabledError	Error thrown when a sign-in challenge is issued for a multi-factor authentication channel the person has not enabled.
MfaCodeExpiredError	Error thrown when a sign-in challenge code is verified after it expired.
MfaCodeNotIssuedError	Error thrown when a sign-in challenge code is verified although none was issued.
MfaCodeRecentlySentError	Error thrown when a new multi-factor authentication code is requested before the resend interval has passed.
MfaCodeRequiredError	Error thrown when a multi-factor authentication code is missing.
MfaEmailRequiredError	Error thrown when email-based multi-factor authentication has no email address to send codes to.
MfaMethodAlreadyEnabledError	Error thrown when the setup of a multi-factor authentication method starts although the method is already enabled.
MfaMethodNotEnabledError	Error thrown when a multi-factor authentication method that is not enabled is chosen as the preferred method.
MfaNotEnabledError	Error thrown when an operation requires multi-factor authentication that the person has not enabled.
MfaPhoneNumberRequiredError	Error thrown when SMS-based multi-factor authentication has no phone number to send codes to.
MfaService	Orchestrates MFA channels, backup codes, and user preferences.
MfaSetupExpiredError	Error thrown when the code or approval that confirms a multi-factor authentication setup has expired.
MfaSetupNotInitializedError	Error thrown when the setup of a multi-factor authentication method is confirmed before it was started.
MfaSubjectNotFoundError	Error thrown when the MfaSubjectPort does not find the person of a multi-factor authentication operation.
MfaSubjectPort	Abstract port for reading and writing MFA state on the underlying subject entity. Used by the MfaService and all MFA channel implementations.
MicrosoftConnector	The MicrosoftConnector integrates Microsoft OAuth authentication.
RolesGuard	-
SessionMappingProfile	Mapping profile for Session entity to response transformations.
SessionPersistencePort	Abstract port for persisting and querying sessions.
SessionResponse	The SessionResponse class.
SessionService	Manages user sessions via the SessionPersistencePort.
SocialAuthGuard	-
SocialAuthPort	Abstract port for resolving or creating subjects from social / OAuth profiles. Used by all social strategies (GitHub, Google, Microsoft, Apple).
TokenEnricherPort	Abstract port for enriching JWT claims with product-specific data. This is an optional port: when not provided, the token contains only base claims.
TotpMfaChannel	-
UnsupportedMfaMethodError	Error thrown when no channel is registered for a multi-factor authentication method.
VerificationService	Manages email / PIN verification tokens via the VerificationSubjectPort.
VerificationSubjectPort	Abstract port for verifiable subject persistence. Used by the VerificationService to manage email/PIN verification.

Interfaces

Interface	Description
IAuthMiddlewareOptions	Configuration for the auth module's middleware registration.
IAuthModuleOptions	Options for configuring the AuthModule.
IAuthSubject	Generic authentication subject returned by the AuthSubjectPort. Represents any entity that can authenticate (user, service account, etc.).
ICreateSessionArgs	Arguments for creating a new session.
IIssuedSession	A newly opened session together with the refresh token issued for it.
IMfaChallengePayload	Represents the MFA challenge payload encoded in a challenge token.
IMfaChallengeState	-
IMfaConfirmation	Represents the activation result for multi-factor authentication.
IMfaSetup	Represents the data required to onboard a multi-factor authenticator.
IMfaSubject	Represents an MFA-enabled subject. Contains the data the MFA subsystem needs to read and write MFA state on the underlying user-like entity.
IMfaSubjectUpdate	Data payload for updating MFA state on the underlying entity. All properties are optional - only the provided ones are applied.
IRotateRefreshTokenArgs	Arguments for replacing the refresh token of an existing session.
ISessionRecord	Represents a persisted session record.
ISessionRefreshResult	Outcome of a refresh-token exchange.
ISignInResult	Represents the outcome of a sign-in attempt.
ISocialProfile	Profile data received from a social / OAuth provider.
IVerifiableSubject	Represents a verifiable authentication subject. Used by the VerificationService to verify email / PIN.

Variables

Variable	Description
APPLE_AUTH_CONFIG_ENTRIES	Configuration entries required by Apple Sign-In authentication.
AUTH_APPLE_CALLBACK_URL	Apple Sign-In callback URL.
AUTH_APPLE_CLIENT_ID	Apple Sign-In client (service) ID.
AUTH_APPLE_KEY_ID	Apple Sign-In key ID.
AUTH_APPLE_PRIVATE_KEY	Apple Sign-In private key (PEM string).
AUTH_APPLE_SCOPE	Comma-separated list of Apple Sign-In scopes (e.g. 'name,email').
AUTH_APPLE_STATE	Whether to enable the OAuth state parameter for CSRF protection on the Apple connector. Requires a persistent session store (e.g. Redis) to verify state on callback. Disable ('false') for stateless / serverless environments without a shared session store.
AUTH_APPLE_TEAM_ID	Apple developer team ID.
AUTH_GITHUB_CALLBACK_URL	GitHub OAuth callback URL.
AUTH_GITHUB_CLIENT_ID	GitHub OAuth client ID.
AUTH_GITHUB_CLIENT_SECRET	GitHub OAuth client secret.
AUTH_GITHUB_SCOPE	Comma-separated list of GitHub OAuth scopes (e.g. 'user:email,read:user').
AUTH_GITHUB_STATE	Whether to enable the OAuth state parameter for CSRF protection on the GitHub connector. Requires a persistent session store (e.g. Redis) to verify state on callback. Disable ('false') for stateless / serverless environments without a shared session store.
AUTH_GOOGLE_CALLBACK_URL	Google OAuth2 callback URL.
AUTH_GOOGLE_CLIENT_ID	Google OAuth2 client ID.
AUTH_GOOGLE_CLIENT_SECRET	Google OAuth2 client secret.
AUTH_GOOGLE_SCOPE	Comma-separated list of Google OAuth scopes (e.g. 'email,profile').
AUTH_GOOGLE_STATE	Whether to enable the OAuth state parameter for CSRF protection on the Google connector. Requires a persistent session store (e.g. Redis) to verify state on callback. Disable ('false') for stateless / serverless environments without a shared session store.
AUTH_JWT_EXPIRES_IN	Lifetime of access tokens (e.g. '15m', '1h').
AUTH_JWT_SECRET	Secret used to sign JWTs.
AUTH_MFA_CHALLENGE_EXPIRES_IN	How long an MFA challenge stays valid (e.g. '5m').
AUTH_MFA_EMAIL_CODE_TTL	Time-to-live for email OTP codes (e.g. '10m').
AUTH_MFA_EMAIL_MIN_RESEND	Minimum interval between email OTP resend requests (e.g. '30s').
AUTH_MFA_ENCRYPTION_KEY	AES encryption key used to encrypt MFA secrets at rest.
AUTH_MFA_ISSUER	Issuer name shown in authenticator apps for TOTP MFA.
AUTH_MFA_MAX_ATTEMPTS	Maximum number of failed MFA attempts before lockout.
AUTH_MFA_PUSH_CODE_TTL	Time-to-live for push OTP codes (e.g. '10m').
AUTH_MFA_PUSH_MIN_RESEND	Minimum interval between push OTP resend requests (e.g. '30s').
AUTH_MFA_SMS_CODE_TTL	Time-to-live for SMS OTP codes (e.g. '10m').
AUTH_MFA_SMS_MIN_RESEND	Minimum interval between SMS resend requests (e.g. '30s').
AUTH_MICROSOFT_CALLBACK_URL	Microsoft OAuth2 callback URL.
AUTH_MICROSOFT_CLIENT_ID	Microsoft OAuth2 client ID.
AUTH_MICROSOFT_CLIENT_SECRET	Microsoft OAuth2 client secret.
AUTH_MICROSOFT_SCOPE	Comma-separated list of Microsoft OAuth scopes (e.g. 'user.read,mail.read').
AUTH_MICROSOFT_STATE	Whether to enable the OAuth state parameter for CSRF protection on the Microsoft connector. Requires a persistent session store (e.g. Redis) to verify state on callback. Disable ('false') for stateless / serverless environments without a shared session store.
AUTH_MICROSOFT_TENANT	Microsoft tenant ID or 'common' for multi-tenant.
AUTH_VERIFY_JWT_EXPIRES_IN	Lifetime of email-verification JWTs.
GITHUB_AUTH_CONFIG_ENTRIES	Configuration entries required by GitHub OAuth authentication.
GOOGLE_AUTH_CONFIG_ENTRIES	Configuration entries required by Google OAuth authentication.
MICROSOFT_AUTH_CONFIG_ENTRIES	Configuration entries required by Microsoft OAuth authentication.
PLATFORM_AUTHENTICATION_CONFIG_ENTRIES	Core configuration entries required by platform-authentication.
ROLES_KEY	Represents the key for the UseRoles decorator.
SEED_ANONYMOUS_USERNAME	Username used for the anonymous seed user.
SESSION_LIST_MAPPING_KEY	Type-safe mapping key for Session entity list to response list transformation.
SESSION_MAPPING_KEY	Type-safe mapping key for Session entity to response transformation.
TOTP_MFA_PROVIDERS	Providers required by the TotpMfaChannel.
User	Represents the User decorator.

Functions

Function	Description
socialAuthGuardFactory	-
Token	Represents the Token decorator.
UseRoles	Represents the UseRoles decorator.