mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 05:26:47 +00:00
Maurice
93bbc65520
invite_tokens gates signup. Its consumer is the registration path in AuthService, not anything in admin/, which held the four management methods only because the routes sit under /api/admin. Worth spelling out because the names invite it: invite_tokens and trip_invite_tokens are different tables for different jobs, and this one has nothing to do with adding a member to a trip. An earlier reading of the plan had these going to trip-invite/, which would have been the wrong home. The routes keep their paths and their admin guard; AdminController injects the service instead of carrying another domain's SQL. Also recorded, in the file, why the app-settings pair did NOT move to settings/ with the other app_settings readers: updateAppSettings runs the lockout guard that stops an admin disabling every login method, and that guard is auth's own resolveAuthToggles. Moving it would put an AuthModule import inside a leaf module half the container pulls in.
47 lines
2.7 KiB
TypeScript
47 lines
2.7 KiB
TypeScript
import { RateLimitModule } from '../common/rate-limit.module';
|
|
import { Module } from '@nestjs/common';
|
|
import { TokensModule } from '../tokens/tokens.module';
|
|
import { AuthPublicController } from './auth-public.controller';
|
|
import { AuthController } from './auth.controller';
|
|
import { PasskeyController } from './passkey.controller';
|
|
import { AuthService } from './auth.service';
|
|
import { UserProfileService } from './user-profile.service';
|
|
import { RegistrationInvitesService } from './registration-invites.service';
|
|
import { PasskeyService } from './passkey.service';
|
|
import { AuthMcp } from './auth.mcp';
|
|
import { UserCleanupService } from './user-cleanup.service';
|
|
import { WebauthnConfigService } from './webauthn-config.service';
|
|
import { AppConfigModule } from '../app-config/app-config.module';
|
|
import { AuditModule } from '../audit/audit.module';
|
|
import { MailerModule } from '../notifications/mailer/mailer.module';
|
|
import { PermissionsModule } from '../permissions/permissions.module';
|
|
import { TripMembershipModule } from '../trip-membership/trip-membership.module';
|
|
|
|
/**
|
|
* Auth module — public flows (login/register/reset/mfa-verify/logout) and the
|
|
* authenticated account/MFA/token endpoints. The OIDC sub-mount (/api/auth/oidc)
|
|
* is a separate, not-yet-migrated route, so the strangler lists the auth
|
|
* sub-paths explicitly rather than claiming all of /api/auth.
|
|
*
|
|
* PermissionsModule feeds getAppConfig's permissions block; MailerModule sends
|
|
* the password-reset mail. It is a leaf module of its own precisely so this
|
|
* import does not become AuthModule -> NotificationsModule -> AuthModule.
|
|
*
|
|
* AtlasModule is deliberately absent. getTravelStats was the only reason for it
|
|
* and now belongs to AtlasService; the direction is reversed, so AtlasModule
|
|
* imports AuthModule and atlas.mcp.ts can inject AuthService instead of routing
|
|
* through auth.bridge. AuthService is
|
|
* exported for the in-container consumers (the domain *.mcp.ts demo guards,
|
|
* OidcService, PasskeyEnabledGuard); PasskeyService for AdminService's passkey
|
|
* reset; UserCleanupService for the two account-deletion paths (AdminService)
|
|
* and the guest deletion in TripsService; everything outside the container goes
|
|
* through auth.bridge.ts.
|
|
*/
|
|
@Module({
|
|
imports: [RateLimitModule, AuditModule, PermissionsModule, TripMembershipModule, MailerModule, AppConfigModule, TokensModule],
|
|
controllers: [AuthPublicController, AuthController, PasskeyController],
|
|
providers: [AuthService, UserProfileService, RegistrationInvitesService, PasskeyService, UserCleanupService, WebauthnConfigService, AuthMcp],
|
|
exports: [AuthService, RegistrationInvitesService, PasskeyService, UserCleanupService],
|
|
})
|
|
export class AuthModule {}
|