2266167467
- Introduced support for previous JWT secrets in the environment configuration to facilitate key rotation. - Refactored the JoseJwtService to manage multiple signing and verification keys, improving security during token validation. - Updated the AuthTokenService to include family identifiers for refresh tokens, enhancing session management and security. - Modified the PasswordWorkflowService and SignupWorkflowService to return session metadata instead of token strings, aligning with security best practices. - Improved error handling and token revocation logic in the TokenBlacklistService and AuthTokenService to prevent replay attacks. - Updated documentation to reflect changes in the authentication architecture and security model.
82 lines
2.3 KiB
TypeScript
82 lines
2.3 KiB
TypeScript
/**
|
|
* Auth Domain - Contract
|
|
*
|
|
* Constants and types for the authentication domain.
|
|
* All validated types are derived from schemas (see schema.ts).
|
|
*/
|
|
|
|
// ============================================================================
|
|
// Authentication Error Codes
|
|
// ============================================================================
|
|
|
|
export const AUTH_ERROR_CODE = {
|
|
INVALID_CREDENTIALS: "INVALID_CREDENTIALS",
|
|
EMAIL_NOT_VERIFIED: "EMAIL_NOT_VERIFIED",
|
|
ACCOUNT_LOCKED: "ACCOUNT_LOCKED",
|
|
MFA_REQUIRED: "MFA_REQUIRED",
|
|
INVALID_TOKEN: "INVALID_TOKEN",
|
|
TOKEN_EXPIRED: "TOKEN_EXPIRED",
|
|
PASSWORD_TOO_WEAK: "PASSWORD_TOO_WEAK",
|
|
EMAIL_ALREADY_EXISTS: "EMAIL_ALREADY_EXISTS",
|
|
WHMCS_ACCOUNT_NOT_FOUND: "WHMCS_ACCOUNT_NOT_FOUND",
|
|
SALESFORCE_ACCOUNT_NOT_FOUND: "SALESFORCE_ACCOUNT_NOT_FOUND",
|
|
LINKING_FAILED: "LINKING_FAILED",
|
|
} as const;
|
|
|
|
export type AuthErrorCode = (typeof AUTH_ERROR_CODE)[keyof typeof AUTH_ERROR_CODE];
|
|
|
|
// ============================================================================
|
|
// Token Type Constants
|
|
// ============================================================================
|
|
|
|
export const TOKEN_TYPE = {
|
|
BEARER: "Bearer",
|
|
} as const;
|
|
|
|
export type TokenTypeValue = (typeof TOKEN_TYPE)[keyof typeof TOKEN_TYPE];
|
|
|
|
// ============================================================================
|
|
// Gender Constants
|
|
// ============================================================================
|
|
|
|
export const GENDER = {
|
|
MALE: "male",
|
|
FEMALE: "female",
|
|
OTHER: "other",
|
|
} as const;
|
|
|
|
export type GenderValue = (typeof GENDER)[keyof typeof GENDER];
|
|
|
|
// ============================================================================
|
|
// Re-export Types from Schema (Schema-First Approach)
|
|
// ============================================================================
|
|
|
|
export type {
|
|
// Request types
|
|
LoginRequest,
|
|
SignupRequest,
|
|
PasswordResetRequest,
|
|
ResetPasswordRequest,
|
|
SetPasswordRequest,
|
|
ChangePasswordRequest,
|
|
LinkWhmcsRequest,
|
|
ValidateSignupRequest,
|
|
UpdateCustomerProfileRequest,
|
|
AccountStatusRequest,
|
|
SsoLinkRequest,
|
|
CheckPasswordNeededRequest,
|
|
RefreshTokenRequest,
|
|
// Token types
|
|
AuthTokens,
|
|
AuthSession,
|
|
// Response types
|
|
AuthResponse,
|
|
SignupResult,
|
|
PasswordChangeResult,
|
|
SsoLinkResponse,
|
|
CheckPasswordNeededResponse,
|
|
LinkWhmcsResponse,
|
|
// Error types
|
|
AuthError,
|
|
} from "./schema.js";
|