mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-22 06:56:35 +00:00
jubnl
45564b0a8a
Fold the 1497-line services/authService.ts into the DI-native nest/auth
domain (Wave-5 chain opener, unblocked by the atlas fold):
- Pure crypto half (backup-code hash/match/generate, stripUserForClient,
key masking, the import-time DUMMY_PASSWORD_HASH timing equaliser and
avatarDir mkdir — documented parity exceptions) moves verbatim to the
plain module nest/auth/auth.helpers.ts.
- DB half folds into AuthService over DatabaseService + injected
PermissionsService (ex permissions.bridge) + AtlasService (ex
atlas.bridge, deleted on schedule). mfaSetupPending and the per-email
reset throttle stay module-scoped so the bridge and container instances
share them; avatarDir and require('../../../package.json') re-anchor one
directory deeper — with the two injection swaps, the only non-verbatim
lines. Controller-facing method surface unchanged.
- New 8-export auth.bridge.ts for out-of-container consumers: mcp/index.ts
token verification, the journey/notifications/transports registrars'
isDemoUser, and the still-legacy adminService/oidcService/passkeyService.
- 15 domain *.mcp.ts demo guards now inject AuthService (their modules
import AuthModule); atlas.mcp.ts alone stays on the bridge because
AuthService injects AtlasService and the reverse module edge would close
an AuthModule<->AtlasModule cycle (places.mcp precedent). OidcService and
PasskeyEnabledGuard inject AuthService too.
- Tests move with case IDs preserved: authService.test.ts ->
auth.helpers.test.ts, authServiceDb.test.ts -> auth.service.test.ts
(+ AUTH-BR-001..007 bridge delegation, + AUTH-DB-050..088 pinning the
previously untested getAppConfig/login/MFA/reset/admin-settings branches
now under the src/nest coverage gate). auth.e2e converts DI-native (real
bcrypt, real audit rows); oidc.e2e swaps its dead path mock for an
instance spy; websocket/integration suites repoint to bridge/helpers.
Quirks preserved byte-for-byte (0-coord drop in getTravelStats,
un-transactioned registerUser/verifyMfaLogin multi-writes, unguarded
revokeUserSessions in deleteMcpToken, current! assertions in
updateApiKeys) — fixes land separately.
25 lines
947 B
TypeScript
25 lines
947 B
TypeScript
import { CanActivate, HttpException, Injectable } from '@nestjs/common';
|
|
import { AuthService } from './auth.service';
|
|
|
|
/**
|
|
* Server-side enforcement of the instance-wide `passkey_login` toggle. Placed
|
|
* BEFORE the auth guard on every passkey ceremony route so a disabled feature
|
|
* returns 404 (not "auth required") and cannot be driven by direct API calls —
|
|
* hiding the button in the UI is not enough. Mirrors JourneyAddonGuard.
|
|
*
|
|
* The credential-management routes (list/rename/delete) are deliberately NOT
|
|
* gated by this guard so users can still clean up their passkeys after an admin
|
|
* turns the feature off.
|
|
*/
|
|
@Injectable()
|
|
export class PasskeyEnabledGuard implements CanActivate {
|
|
constructor(private readonly auth: AuthService) {}
|
|
|
|
canActivate(): boolean {
|
|
if (!this.auth.resolveAuthToggles().passkey_login) {
|
|
throw new HttpException({ error: 'Passkey login is not enabled' }, 404);
|
|
}
|
|
return true;
|
|
}
|
|
}
|