Refactor Phase 3: Auth Session - #53
Merged
Merged
Conversation
- Add common/utils/codes.ts: generateSecureOtp (6-digit zero-padded crypto-random), generateUniqueCode, generateTripCode and generateTrackingCode (base32) - Keep legacy generateCode as a deprecated export (trip delivery code migrates in Phase 4) - utilities.ts re-exports all generators for backward compatibility
- Make generateAccessToken/generateTempToken/generateProgressToken public with dedicated payload types (token.types.ts); keep verifyToken unchanged - Read JWT_*_EXPIRES_IN via ConfigService with defaults 20d/20m/1d (fixes C-2: no hardcoded expiries); register optional keys in config-names + env validation - Regroup private helpers at the end of the class
- Define S3StoragePort (interim port, full StoragePort lands in Phase 5) and inject it via the S3_STORAGE_PORT symbol - Bind the port to S3Service with useExisting in user.module.ts - Keep presigned-URL building behavior identical
- Extract OtpService (domain): owns send/verify, attempt tracking, blocking and the send window. Reads limits through an injected OTP_CONFIG value object so only the canonical MAX_SEND_ATTEMPTS key is used (fixes C-1), and accesses the OTP cache through the named OTP_CACHE provider (fixes C-3) - Extract AuthStateMachine (domain): pure transporter auth-state computation - Extract TransporterSignupService (application): sender + transporter stage-1 signup orchestration - Extract session-utils: setUserState/setSessionAuth/clearAuthData session helpers - Includes unit specs for each extracted unit (fake timers for OTP, mocked cache)
…cted services - Slim AuthService to a thin facade delegating to OtpService, AuthStateMachine and TransporterSignupService; inject the state machine and signup service in AuthModule with OtpService (OTP_CACHE, OTP_CONFIG factory providers) - Switch the OTP contract from a 5-digit number to a zero-padded 6-digit string: CheckOtpDto validates a 6-char numeric string, SmsService.sendOtp takes a string, OtpData.code becomes string - Move cookie/session wiring to the controller and set state via session-utils; remove dead code (unused maxAge/config reads) - Rewrite controller/service specs against the new collaborators with all guards mocked via overrideGuard
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.