Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Split `src/core/auth/enhanced-auth.service.ts` (570 lines) by authentication concern

Open
  • Is something wrong?
#204 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Refactor
Clarity
Mostly clear
Activity status
Active
Tech stack
nodejs, typescript
Domain
authentication, backend

Research direction

Start with src/core/auth/enhanced-auth.service.ts and src/core/auth/auth.service.ts, comparing how each issues tokens (generateTokens() and the expiresIn arguments) and where bcrypt is called. Read closed issue #8 before choosing which service becomes the main implementation. Done means token issuance lives in one place, no file in src/core/auth/ exceeds about 350 lines, and the e2e specs under test/ pass without changed assertions. Confirm those specs run first, because the issue says some are not run by npm test.

Written by the indexing model from the issue text.

Description

advanced help wanted refactor security

Problem

src/core/auth/enhanced-auth.service.ts is 570 lines and handles at least four concerns:

  1. Login/registration (bcrypt at lines 88, 166, 462, 526)
  2. Token generation (generateTokens() at line 549) and refresh-token persistence
  3. Two-factor flows (twoFactorVerified threaded through the token payload, line 562)
  4. Delegation and email-linking (it imports email.service.ts and email-linking.service.ts)

It also overlaps with src/core/auth/auth.service.ts — both inject JwtService, both do bcrypt password work (auth.service.ts:137), and both mint access tokens. They disagree on expiry: auth.service.ts:99,151 passes expiresIn: "15m", while enhanced-auth.service.ts:564 passes nothing. That divergence is the subject of a separate issue, but it is a direct consequence of the overlap.

Why it matters

Authentication is the highest-stakes code in the repository, and it is spread across two overlapping services with inconsistent behaviour. Reviewing a security change means reviewing 570 lines to find out what actually changed. The overlap is also how the token-expiry divergence went unnoticed.

Suggested Direction

  1. Extract the token concern first — it is the most self-contained and the most security-relevant: 
    src/core/auth/services/token.service.ts      // issue/refresh/verify, TTL constants
src/core/auth/services/refresh-token.service.ts  // persistence, rotation, revocation
    Both belong behind one implementation, so auth.service.ts and enhanced-auth.service.ts cannot disagree about expiry again.
  2. Extract two-factor into two-factor.service.ts, covering the twoFactorVerified claim.
  3. Resolve the service overlap — decide whether enhanced-auth.service.ts is the intended implementation and auth.service.ts a thin wrapper, or the reverse. There is a closed issue (#8, "Align core/auth Module — Token Blacklist Injection & Strategy Pattern Consolidation") that may already have established a direction; read it before proposing a new one.

Constraints

  • Do not change token semantics in this refactor. Fixing the missing expiry is a separate, deliberate change (see the dedicated issue) — mixing it into a refactor makes both harder to review and harder to roll back.
  • Existing auth e2e specs must pass: test/wallet-auth.spec.ts, test/enhanced-auth.service.spec.ts, test/recovery.spec.ts, test/auth/wallet-advanced.e2e-spec.ts, test/traditional-auth.e2e-spec.ts. Note that five of these live under test/ and are not currently executed by npm test — see the unreachable-specs issue; fix that first or verify against npm run test:e2e.
  • Keep session behaviour (the ipAddress/userAgent recorded on refresh tokens) unchanged.

Acceptance Criteria

  • No file in src/core/auth/ exceeds ~350 lines.
  • Token issuance exists in exactly one place; both auth services call it.
  • Refresh-token persistence is fully encapsulated in its own service.
  • All auth e2e suites pass with unchanged assertions.
  • No token behaviour change is bundled into this PR.
Dominant language
TypeScript
Stars
7
Forks
55
Avg merge
1d 17h
Merged PRs (30d)
5

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from SourceXXL/alian_structure-api

All issues in SourceXXL/alian_structure-api

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.