@ackplus/nest-auth 0.1.51 → 1.1.1

package/src/lib/auth/services/auth.service.ts

@@ -0,0 +1,947 @@
+import { Injectable, UnauthorizedException, BadRequestException, Inject, ForbiddenException, InternalServerErrorException } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { NestAuthUser } from '../../user/entities/user.entity';
+import { NestAuthOTP } from '../../auth/entities/otp.entity';
+import { OTPTypeEnum } from '../../core/interfaces/otp.interface';
+import {
+    EMAIL_AUTH_PROVIDER,
+    PHONE_AUTH_PROVIDER,
+    REFRESH_TOKEN_EXPIRED,
+    REFRESH_TOKEN_INVALID,
+    SESSION_NOT_FOUND_ERROR,
+    INVALID_MFA_EXCEPTION_CODE,
+    NestAuthEvents,
+    USER_NOT_ACTIVE_ERROR,
+} from '../../auth.constants';
+import { MoreThan } from 'typeorm';
+import { MfaService } from './mfa.service';
+import { JwtService } from '../../core/services/jwt.service';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { SessionManagerService } from '../../session/services/session-manager.service';
+import { RequestContext } from '../../request-context/request-context';
+import { SignupRequestDto } from '../dto/requests/signup.request.dto';
+import { AuthResponseDto } from '../dto/responses/auth.response.dto';
+import { LoginRequestDto } from '../dto/requests/login.request.dto';
+import { Verify2faRequestDto } from '../dto/requests/verify-2fa.request.dto';
+import { MFAMethodEnum } from '../../core/interfaces/mfa-options.interface';
+import { JWTTokenPayload, SessionPayload } from '../../core/interfaces/token-payload.interface';
+import { ForgotPasswordRequestDto } from '../dto/requests/forgot-password.request.dto';
+import { generateOtp } from '../../utils/otp';
+import { ResetPasswordRequestDto } from '../dto/requests/reset-password.request.dto';
+import { UserRegisteredEvent } from '../events/user-registered.event';
+import { UserLoggedInEvent } from '../events/user-logged-in.event';
+import { User2faVerifiedEvent } from '../events/user-2fa-verified.event';
+import { UserRefreshTokenEvent } from '../events/user-refresh-token.event';
+import { LoggedOutEvent } from '../events/logged-out.event';
+import { LoggedOutAllEvent } from '../events/logged-out-all.event';
+import { PasswordResetRequestedEvent } from '../events/password-reset-requested.event';
+import { PasswordResetEvent } from '../events/password-reset.event';
+import { AuthProviderUser, BaseAuthProvider } from '../../core/providers/base-auth.provider';
+import { AuthProviderRegistryService } from '../../core/services/auth-provider-registry.service';
+import { TenantService } from '../../tenant/services/tenant.service';
+import { DebugLoggerService } from '../../core/services/debug-logger.service';
+import moment from 'moment';
+import { VerifyForgotPasswordOtpRequestDto } from '../dto/requests/verify-forgot-password-otp-request-dto';
+import { ResetPasswordWithTokenRequestDto } from '../dto/requests/reset-password-with-token.request.dto';
+import { ChangePasswordRequestDto } from '../dto/requests/change-password.request.dto';
+import { VerifyOtpResponseDto } from '../dto/responses/verify-otp.response.dto';
+import { SendEmailVerificationRequestDto } from '../dto/requests/send-email-verification.request.dto';
+import { VerifyEmailRequestDto } from '../dto/requests/verify-email.request.dto';
+
+@Injectable()
+export class AuthService {
+
+    constructor(
+        @InjectRepository(NestAuthUser)
+        private readonly userRepository: Repository<NestAuthUser>,
+
+        @InjectRepository(NestAuthOTP)
+        private otpRepository: Repository<NestAuthOTP>,
+
+        private readonly authProviderRegistry: AuthProviderRegistryService,
+
+        private readonly mfaService: MfaService,
+
+        private readonly sessionManager: SessionManagerService,
+
+        private readonly jwtService: JwtService,
+
+        private readonly eventEmitter: EventEmitter2,
+
+        private readonly tenantService: TenantService,
+
+        private readonly debugLogger: DebugLoggerService,
+    ) {
+
+    }
+
+    getUserWithRolesAndPermissions(userId: string, relations: string[] = []): Promise<NestAuthUser> {
+        return this.userRepository.findOne({
+            where: { id: userId },
+            relations: [
+                'roles',
+                ...relations
+            ],
+        });
+    }
+
+    async getUser() {
+        const user = RequestContext.currentUser();
+        if (!user) {
+            return null
+        }
+        return this.getUserWithRolesAndPermissions(user.id);
+    }
+
+    async signup(input: SignupRequestDto): Promise<AuthResponseDto> {
+        this.debugLogger.logFunctionEntry('signup', 'AuthService', { email: input.email, phone: input.phone, hasPassword: !!input.password });
+
+        try {
+
+            const { email, phone, password } = input;
+
+            let { tenantId = null } = input;
+
+            // Resolve tenant ID - use provided or default
+            tenantId = await this.tenantService.resolveTenantId(tenantId);
+            this.debugLogger.logAuthOperation('signup', 'email|phone', undefined, { email, phone, resolvedTenantId: tenantId });
+
+            if (!email && !phone) {
+                this.debugLogger.error('Signup failed: Neither email nor phone provided', 'AuthService');
+                throw new BadRequestException('Either email or phone must be provided');
+            }
+
+            let provider: BaseAuthProvider | null = null;
+            let providerUserId: string | null = null;
+
+            if (email) {
+                provider = this.authProviderRegistry.getProvider(EMAIL_AUTH_PROVIDER);
+                providerUserId = email;
+            } else if (phone) {
+                provider = this.authProviderRegistry.getProvider(PHONE_AUTH_PROVIDER);
+                providerUserId = phone;
+            }
+
+            if (!provider) {
+                this.debugLogger.error('Provider not found for signup', 'AuthService', { email: !!email, phone: !!phone });
+                throw new InternalServerErrorException('Phone or email authentication is not enabled');
+            }
+
+            this.debugLogger.debug('Checking for existing identity', 'AuthService', { providerUserId });
+            const identity = await provider.findIdentity(providerUserId);
+
+            if (identity) {
+                this.debugLogger.warn('Identity already exists', 'AuthService', { email: !!email, phone: !!phone, tenantId });
+                if (email) {
+                    throw new BadRequestException('Email already exists in this tenant');
+                }
+                if (phone) {
+                    throw new BadRequestException('Phone number already exists in this tenant');
+                }
+            }
+
+            this.debugLogger.debug('Creating new user', 'AuthService', { email: !!email, phone: !!phone, tenantId });
+            let user = this.userRepository.create({
+                email,
+                phone,
+                tenantId,
+                isVerified: false,
+            });
+            await user.setPassword(password);
+            await this.userRepository.save(user);
+            this.debugLogger.info('User created successfully', 'AuthService', { userId: user.id, tenantId });
+
+            user = await this.getUserWithRolesAndPermissions(user.id);
+
+            this.debugLogger.debug('Linking user to provider', 'AuthService', { userId: user.id, providerName: provider.providerName });
+            await provider.linkToUser(user.id, providerUserId);
+
+            this.debugLogger.debug('Creating session for new user', 'AuthService', { userId: user.id });
+            const session = await this.sessionManager.createSessionFromUser(user);
+            const tokens = await this.generateTokensFromSession(session);
+            const isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+            this.debugLogger.debug('Signup tokens generated', 'AuthService', { userId: user.id, isRequiresMfa });
+
+            // Emit registration event
+            this.debugLogger.debug('Emitting user registration event', 'AuthService', { userId: user.id });
+            await this.eventEmitter.emitAsync(
+                NestAuthEvents.REGISTERED,
+                new UserRegisteredEvent({
+                    user,
+                    tenantId: user.tenantId,
+                    input,
+                    provider,
+                    session,
+                    tokens,
+                    isRequiresMfa
+                })
+            );
+
+            this.debugLogger.logFunctionExit('signup', 'AuthService', { userId: user.id, isRequiresMfa });
+            return {
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                isRequiresMfa: isRequiresMfa,
+            };
+
+        } catch (error) {
+            this.debugLogger.logError(error, 'signup', { email: input.email, phone: input.phone });
+            throw error;
+        }
+    }
+
+    async login(input: LoginRequestDto): Promise<AuthResponseDto> {
+        const { credentials, providerName, createUserIfNotExists = false } = input;
+        this.debugLogger.logFunctionEntry('login', 'AuthService', { providerName, createUserIfNotExists });
+        let { tenantId = null } = input;
+
+        // Resolve tenant ID - use provided or default
+        tenantId = await this.tenantService.resolveTenantId(tenantId);
+        this.debugLogger.logAuthOperation('login', providerName, undefined, { resolvedTenantId: tenantId, createUserIfNotExists });
+
+        const provider = this.authProviderRegistry.getProvider(providerName);
+
+        if (!provider) {
+            throw new UnauthorizedException('Invalid authentication providerName or provider is not enabled');
+        }
+
+        const requiredFields = provider.getRequiredFields();
+
+        if (!requiredFields.every(field => credentials[field])) {
+            throw new BadRequestException(`Missing ${requiredFields.join(', ')} required fields`);
+        }
+
+        const authProviderUser = await provider.validate(credentials);
+
+        const identity = await provider.findIdentity(authProviderUser.userId);
+
+        let user: NestAuthUser | null = identity?.user || null;
+
+        if (!user) {
+            if (!createUserIfNotExists) {
+                throw new UnauthorizedException('Invalid credentials');
+            }
+            // Create new user if not exists and link to provider
+            user = await this.handleSocialLogin(provider, authProviderUser, tenantId);
+        }
+
+        if (user.isActive === false) {
+            throw new UnauthorizedException({
+                message: 'Your account is suspended, please contact support',
+                code: USER_NOT_ACTIVE_ERROR,
+            });
+        }
+
+        user = await this.getUserWithRolesAndPermissions(user.id);
+
+        const session = await this.sessionManager.createSessionFromUser(user);
+        const tokens = await this.generateTokensFromSession(session);
+
+        const isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+
+        // Emit login event
+        await this.eventEmitter.emitAsync(
+            NestAuthEvents.LOGGED_IN,
+            new UserLoggedInEvent({
+                user,
+                tenantId: user.tenantId,
+                input,
+                provider,
+                session,
+                tokens,
+                isRequiresMfa
+            })
+        );
+
+        return {
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            isRequiresMfa: isRequiresMfa,
+        };
+    }
+
+    async verify2fa(input: Verify2faRequestDto) {
+        this.debugLogger.logFunctionEntry('verify2fa', 'AuthService', { method: input.method });
+
+        try {
+            const session = RequestContext.currentSession();
+
+            if (!session) {
+                this.debugLogger.error('Session not found for 2FA verification', 'AuthService');
+                throw new UnauthorizedException({
+                    message: 'Session not found',
+                    code: SESSION_NOT_FOUND_ERROR,
+                });
+            }
+
+            this.debugLogger.debug('Verifying MFA code', 'AuthService', { userId: session.userId, method: input.method });
+            const isValid = await this.mfaService.verifyMfa(session.userId, input.otp, input.method);
+            if (!isValid) {
+                this.debugLogger.warn('Invalid MFA code provided', 'AuthService', { userId: session.userId, method: input.method });
+                throw new UnauthorizedException({
+                    message: 'Invalid MFA code',
+                    code: INVALID_MFA_EXCEPTION_CODE,
+                });
+            }
+
+            this.debugLogger.debug('Updating session with MFA verification', 'AuthService', { sessionId: session.id });
+            const payload = await this.sessionManager.updateSession(session.id, {
+                data: {
+                    ...session.data,
+                    isMfaVerified: true,
+                }
+            });
+            const tokens = await this.generateTokensFromSession(payload);
+
+            const user = await this.getUser();
+
+            // Emit 2FA verified event
+            this.debugLogger.debug('Emitting 2FA verified event', 'AuthService', { userId: user.id });
+            await this.eventEmitter.emitAsync(
+                NestAuthEvents.TWO_FACTOR_VERIFIED,
+                new User2faVerifiedEvent({
+                    user,
+                    tenantId: user.tenantId,
+                    input,
+                    session,
+                    tokens
+                })
+            );
+
+            this.debugLogger.logFunctionExit('verify2fa', 'AuthService', { userId: user.id });
+            return {
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+            };
+
+        } catch (error) {
+            this.debugLogger.logError(error, 'verify2fa', { method: input.method });
+            throw error;
+        }
+    }
+
+    async send2faCode(userId: string, method: MFAMethodEnum) {
+        const user = await this.userRepository.findOne({ where: { id: userId } });
+
+        if (!user) {
+            throw new UnauthorizedException('User not found');
+        }
+
+        await this.mfaService.sendMfaCode(user.id, method);
+
+        return true;
+    }
+
+    private async handleSocialLogin(
+        provider: BaseAuthProvider,
+        providerUser: AuthProviderUser,
+        tenantId?: string | null,
+    ): Promise<NestAuthUser> {
+
+        // Check if identity exists
+        let identity = await provider.findIdentity(providerUser.userId);
+
+        if (identity) {
+            return identity.user;
+        }
+
+        const linkUserWith = provider.linkUserWith();
+
+        let user = await this.userRepository.findOne({ where: { [linkUserWith]: providerUser.userId } });
+
+        if (!user) {
+            // Create new user
+            user = this.userRepository.create({
+                [linkUserWith]: providerUser.userId,
+                isVerified: true,
+                metadata: providerUser.metadata || {},
+                tenantId: tenantId,
+            });
+            await this.userRepository.save(user);
+        }
+
+        await provider.linkToUser(user.id, providerUser.userId, providerUser.metadata || {});
+
+        return user;
+    }
+
+    async refreshToken(refreshToken: string) {
+        this.debugLogger.logFunctionEntry('refreshToken', 'AuthService', { hasRefreshToken: !!refreshToken });
+
+        try {
+            if (!refreshToken) {
+                this.debugLogger.error('No refresh token provided', 'AuthService');
+                throw new UnauthorizedException({
+                    message: 'No refresh token provided',
+                    code: REFRESH_TOKEN_INVALID,
+                });
+            }
+
+            this.debugLogger.debug('Verifying refresh token', 'AuthService');
+            let payload: JWTTokenPayload;
+            try {
+                payload = await this.jwtService.verifyToken(refreshToken);
+            } catch (error) {
+                this.debugLogger.warn('Invalid or expired refresh token', 'AuthService');
+                throw new UnauthorizedException({
+                    message: 'Invalid or expired refresh token',
+                    code: REFRESH_TOKEN_EXPIRED,
+                });
+            }
+
+            const session = await this.sessionManager.getSession(payload.sessionId);
+
+            if (!session) {
+                throw new UnauthorizedException({
+                    message: 'Invalid refresh token',
+                    code: REFRESH_TOKEN_INVALID,
+                });
+            }
+
+            // Generate new session
+            const newSession = await this.sessionManager.createSessionFromSession(session);
+
+            // Revoke old session
+            await this.sessionManager.revokeSession(session.id);
+
+            // Generate new tokens
+            this.debugLogger.debug('Generating new tokens from refreshed session', 'AuthService', { sessionId: newSession.id });
+            const tokens = await this.generateTokensFromSession(newSession);
+
+            // Emit refresh token event
+            this.debugLogger.debug('Emitting refresh token event', 'AuthService', { sessionId: newSession.id });
+            await this.eventEmitter.emitAsync(
+                NestAuthEvents.REFRESH_TOKEN,
+                new UserRefreshTokenEvent({
+                    oldRefreshToken: refreshToken,
+                    session: newSession,
+                    tokens,
+                })
+            );
+
+            this.debugLogger.logFunctionExit('refreshToken', 'AuthService', { sessionId: newSession.id });
+            return tokens;
+
+        } catch (error) {
+            this.debugLogger.logError(error, 'refreshToken', { hasRefreshToken: !!refreshToken });
+            throw error;
+        }
+    }
+
+
+    async changePassword(input: ChangePasswordRequestDto): Promise<AuthResponseDto> {
+        this.debugLogger.logFunctionEntry('changePassword', 'AuthService');
+
+        try {
+            const currentUser = RequestContext.currentUser();
+
+            if (!currentUser?.id) {
+                throw new UnauthorizedException('User not found');
+            }
+
+            const user = await this.userRepository.findOne({
+                where: { id: currentUser.id },
+            });
+
+            if (!user) {
+                throw new UnauthorizedException('User not found');
+            }
+
+            const isValid = await user.validatePassword(input.currentPassword);
+            if (!isValid) {
+                throw new BadRequestException('Current password is incorrect');
+            }
+
+            if (input.currentPassword === input.newPassword) {
+                throw new BadRequestException('New password must be different from the current password');
+            }
+
+            await user.setPassword(input.newPassword);
+            await this.userRepository.save(user);
+
+            await this.sessionManager.revokeAllUserSessions(user.id);
+
+            const hydratedUser = await this.getUserWithRolesAndPermissions(user.id);
+            const session = await this.sessionManager.createSessionFromUser(hydratedUser);
+            const tokens = await this.generateTokensFromSession(session);
+            const isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+
+            this.debugLogger.logFunctionExit('changePassword', 'AuthService', { userId: user.id });
+            return {
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                isRequiresMfa,
+            };
+        } catch (error) {
+            this.debugLogger.logError(error, 'changePassword');
+            throw error;
+        }
+    }
+
+    async forgotPassword(input: ForgotPasswordRequestDto) {
+        this.debugLogger.logFunctionEntry('forgotPassword', 'AuthService', { email: input.email, phone: input.phone });
+
+        try {
+            const { email, phone } = input;
+            let { tenantId = null } = input;
+
+            // Resolve tenant ID - use provided or default
+            tenantId = await this.tenantService.resolveTenantId(tenantId);
+            let provider: BaseAuthProvider | null = null;
+
+            if (phone) {
+                provider = this.authProviderRegistry.getProvider(PHONE_AUTH_PROVIDER);
+            } else if (email) {
+                provider = this.authProviderRegistry.getProvider(EMAIL_AUTH_PROVIDER);
+            } else {
+                throw new BadRequestException('Either email or phone must be provided');
+            }
+
+            if (!provider) {
+                throw new BadRequestException('Phone or email authentication is not enabled');
+            }
+
+            if (!provider.enabled) {
+                if (email) {
+                    throw new BadRequestException('Email authentication is not enabled');
+                } else if (phone) {
+                    throw new BadRequestException('Phone authentication is not enabled');
+                }
+            }
+
+            const identity = await provider.findIdentity(email || phone);
+
+            if (!identity) {
+                // Return success even if user not found to prevent email/phone enumeration
+                return { message: 'If the account exists, a password reset code has been sent' };
+            }
+
+            // Generate OTP
+            const otp = generateOtp();
+            const expiresAt = new Date();
+            expiresAt.setMinutes(expiresAt.getMinutes() + 15); // OTP expires in 15 minutes
+
+            // Save OTP to database
+            const otpEntity = await this.otpRepository.save({
+                userId: identity.user?.id,
+                code: otp,
+                expiresAt,
+                type: OTPTypeEnum.PASSWORD_RESET
+            });
+
+
+            // Emit refresh token event, Send OTP via email or SMS should be handled by the event listener
+            await this.eventEmitter.emitAsync(
+                NestAuthEvents.PASSWORD_RESET_REQUESTED,
+                new PasswordResetRequestedEvent({
+                    user: identity.user,
+                    tenantId: identity.user?.tenantId,
+                    input,
+                    otp: otpEntity,
+                    provider,
+                })
+            );
+
+            this.debugLogger.logFunctionExit('forgotPassword', 'AuthService', { email: !!email, phone: !!phone });
+            return true;
+
+        } catch (error) {
+            this.debugLogger.logError(error, 'forgotPassword', { email: input.email, phone: input.phone });
+            throw error;
+        }
+    }
+
+    async verifyForgotPasswordOtp(input: VerifyForgotPasswordOtpRequestDto): Promise<VerifyOtpResponseDto> {
+        this.debugLogger.logFunctionEntry('verifyForgotPasswordOtp', 'AuthService', { email: input.email, phone: input.phone });
+        try {
+            const { email, phone, otp } = input;
+            let { tenantId = null } = input;
+
+            // Resolve tenant ID - use provided or default
+            tenantId = await this.tenantService.resolveTenantId(tenantId);
+
+            if (!email && !phone) {
+                throw new BadRequestException('Either email or phone must be provided');
+            }
+
+            let provider: BaseAuthProvider | null = null;
+
+            if (phone) {
+                provider = this.authProviderRegistry.getProvider(PHONE_AUTH_PROVIDER);
+            } else if (email) {
+                provider = this.authProviderRegistry.getProvider(EMAIL_AUTH_PROVIDER);
+            }
+
+            if (!provider) {
+                throw new BadRequestException('Phone or email authentication is not enabled');
+            }
+
+            const identity = await provider.findIdentity(email || phone);
+
+            if (!identity) {
+                throw new BadRequestException('Invalid reset request');
+            }
+
+            const validOtp = await this.otpRepository.findOne({
+                where: {
+                    userId: identity.user?.id,
+                    code: otp,
+                    type: OTPTypeEnum.PASSWORD_RESET,
+                    used: false
+                },
+                relations: ['user']
+            });
+
+            if (!validOtp) {
+                throw new BadRequestException('Invalid OTP code');
+            }
+            if (moment(validOtp.expiresAt).isBefore(new Date())) {
+                throw new BadRequestException('OTP code expired');
+            }
+
+            const user = validOtp.user;
+
+            // Generate JWT-based password reset token
+            // Include password hash prefix to invalidate token if password changes
+            const passwordHashPrefix = user.passwordHash ? user.passwordHash.substring(0, 10) : '';
+            const resetToken = await this.jwtService.generatePasswordResetToken({
+                userId: user.id,
+                passwordHashPrefix,
+                type: 'password-reset'
+            });
+
+            // Delete the OTP since it's been verified
+            await this.otpRepository.remove(validOtp);
+
+            this.debugLogger.logFunctionExit('verifyForgotPasswordOtp', 'AuthService', { email: input.email, phone: input.phone });
+            return {
+                message: 'OTP verified successfully',
+                resetToken
+            };
+        } catch (error) {
+            this.debugLogger.logError(error, 'verifyForgotPasswordOtp', { email: input.email, phone: input.phone });
+            throw error;
+        }
+    }
+
+    async resetPassword(input: ResetPasswordRequestDto) {
+        this.debugLogger.logFunctionEntry('resetPassword', 'AuthService', { email: input.email, phone: input.phone });
+
+        try {
+            const { email, phone, otp, newPassword } = input;
+            let { tenantId = null } = input;
+
+            // Resolve tenant ID - use provided or default
+            tenantId = await this.tenantService.resolveTenantId(tenantId);
+
+            if (!email && !phone) {
+                throw new BadRequestException('Either email or phone must be provided');
+            }
+
+            // Find user by email or phone
+            const user = await this.userRepository.findOne({
+                where: [
+                    ...(email ? [{ email, tenantId }] : []),
+                    ...(phone ? [{ phone, tenantId }] : [])
+                ]
+            });
+
+            if (!user) {
+                throw new BadRequestException('Invalid reset request');
+            }
+
+            // Find valid OTP
+            const validOtp = await this.otpRepository.findOne({
+                where: {
+                    userId: user.id,
+                    code: otp,
+                    type: OTPTypeEnum.PASSWORD_RESET,
+                    expiresAt: MoreThan(new Date()),
+                    used: false
+                }
+            });
+
+            if (!validOtp) {
+                throw new BadRequestException('Invalid or expired OTP');
+            }
+
+            // Update password
+            await user.setPassword(newPassword);
+            await this.userRepository.save(user);
+
+            // Mark OTP as used
+            validOtp.used = true;
+            await this.otpRepository.save(validOtp);
+
+            // Emit refresh token event, If we want to send email or SMS should be handled by the event listener
+            await this.eventEmitter.emitAsync(
+                NestAuthEvents.PASSWORD_RESET,
+                new PasswordResetEvent({
+                    user,
+                    tenantId: user.tenantId,
+                    input,
+                })
+            );
+
+            this.debugLogger.logFunctionExit('resetPassword', 'AuthService', { email: !!email, phone: !!phone });
+            return true;
+
+        } catch (error) {
+            this.debugLogger.logError(error, 'resetPassword', { email: input.email, phone: input.phone });
+            throw error;
+        }
+    }
+
+
+    async resetPasswordWithToken(input: ResetPasswordWithTokenRequestDto) {
+        this.debugLogger.logFunctionEntry('resetPasswordWithToken', 'AuthService', { token: '***' });
+
+        try {
+            const { token, newPassword } = input;
+
+            // Verify JWT token
+            let decoded: any;
+            try {
+                decoded = await this.jwtService.verifyPasswordResetToken(token);
+            } catch (error) {
+                throw new BadRequestException('Invalid or expired reset token');
+            }
+
+            if (decoded.type !== 'password-reset') {
+                throw new BadRequestException('Invalid token type');
+            }
+
+            // Get user
+            const user = await this.userRepository.findOne({
+                where: { id: decoded.userId }
+            });
+
+            if (!user) {
+                throw new BadRequestException('User not found');
+            }
+
+            // Verify password hasn't changed since token was issued
+            // This makes the token single-use in practice
+            const currentPasswordHashPrefix = user.passwordHash ? user.passwordHash.substring(0, 10) : '';
+            if (decoded.passwordHashPrefix !== currentPasswordHashPrefix) {
+                throw new BadRequestException('Reset token is no longer valid');
+            }
+
+            // Update password
+            await user.setPassword(newPassword);
+            await this.userRepository.save(user);
+
+            // Emit password reset event
+            await this.eventEmitter.emitAsync(
+                NestAuthEvents.PASSWORD_RESET,
+                new PasswordResetEvent({
+                    user,
+                    tenantId: user.tenantId,
+                    input: { token, newPassword } as any,
+                })
+            );
+
+            this.debugLogger.logFunctionExit('resetPasswordWithToken', 'AuthService');
+            return true;
+
+        } catch (error) {
+            this.debugLogger.logError(error, 'resetPasswordWithToken');
+            throw error;
+        }
+    }
+
+    async logout(logoutType: 'user' | 'admin' | 'system' = 'user', reason?: string) {
+        const session = RequestContext.currentSession();
+
+        const user = await this.getUser();
+
+        // Emit logout event
+        await this.eventEmitter.emitAsync(
+            NestAuthEvents.LOGGED_OUT,
+            new LoggedOutEvent({
+                user,
+                tenantId: user?.tenantId,
+                session,
+                logoutType,
+                reason,
+            })
+        );
+
+        if (session) {
+            await this.sessionManager.revokeSession(session.id);
+        }
+
+        return true;
+    }
+
+    async logoutAll(userId: string, logoutType: 'user' | 'admin' | 'system' = 'user', reason?: string) {
+        const session = RequestContext.currentSession();
+        if (!session) {
+            throw new UnauthorizedException('Session not found');
+        }
+
+        const sessions = await this.sessionManager.getUserSessions(userId);
+
+        await this.sessionManager.revokeAllUserSessions(userId);
+
+        const user = await this.getUser();
+
+        // Emit logout event
+        await this.eventEmitter.emitAsync(
+            NestAuthEvents.LOGGED_OUT_ALL,
+            new LoggedOutAllEvent({
+                user,
+                tenantId: user?.tenantId,
+                logoutType,
+                reason,
+                currentSessionId: session.id,
+                sessions,
+            })
+        );
+
+        return true;
+    }
+
+    async sendEmailVerification(input: SendEmailVerificationRequestDto) {
+        this.debugLogger.logFunctionEntry('sendEmailVerification', 'AuthService');
+
+        try {
+            const user = RequestContext.currentUser();
+            if (!user) {
+                throw new UnauthorizedException('User not authenticated');
+            }
+
+            const fullUser = await this.getUserWithRolesAndPermissions(user.id);
+
+            if (!fullUser.email) {
+                throw new BadRequestException('User does not have an email address');
+            }
+
+            if (fullUser.emailVerifiedAt) {
+                throw new BadRequestException('Email is already verified');
+            }
+
+            // Generate OTP
+            const otp = generateOtp();
+            const expiresAt = new Date();
+            expiresAt.setMinutes(expiresAt.getMinutes() + 30); // OTP expires in 30 minutes
+
+            // Save OTP to database
+            const otpEntity = await this.otpRepository.save({
+                userId: fullUser.id,
+                code: otp,
+                expiresAt,
+                type: OTPTypeEnum.VERIFICATION
+            });
+
+            // Emit email verification event - email sending should be handled by event listener
+            await this.eventEmitter.emitAsync(
+                NestAuthEvents.EMAIL_VERIFICATION_REQUESTED,
+                {
+                    user: fullUser,
+                    tenantId: fullUser.tenantId,
+                    otp: otpEntity,
+                }
+            );
+
+            this.debugLogger.logFunctionExit('sendEmailVerification', 'AuthService');
+            return { message: 'Verification email sent successfully' };
+
+        } catch (error) {
+            this.debugLogger.logError(error, 'sendEmailVerification');
+            throw error;
+        }
+    }
+
+    async verifyEmail(input: VerifyEmailRequestDto) {
+        this.debugLogger.logFunctionEntry('verifyEmail', 'AuthService');
+
+        try {
+            const user = RequestContext.currentUser();
+            if (!user) {
+                throw new UnauthorizedException('User not authenticated');
+            }
+
+            const fullUser = await this.getUserWithRolesAndPermissions(user.id);
+
+            if (!fullUser.email) {
+                throw new BadRequestException('User does not have an email address');
+            }
+
+            if (fullUser.emailVerifiedAt) {
+                throw new BadRequestException('Email is already verified');
+            }
+
+            // Find valid OTP
+            const validOtp = await this.otpRepository.findOne({
+                where: {
+                    userId: fullUser.id,
+                    code: input.otp,
+                    type: OTPTypeEnum.VERIFICATION,
+                    used: false
+                }
+            });
+
+            if (!validOtp) {
+                throw new BadRequestException('Invalid verification code');
+            }
+
+            if (moment(validOtp.expiresAt).isBefore(new Date())) {
+                throw new BadRequestException('Verification code has expired');
+            }
+
+            // Mark OTP as used
+            validOtp.used = true;
+            await this.otpRepository.save(validOtp);
+
+            // Verify user email
+            fullUser.emailVerifiedAt = new Date();
+            fullUser.isVerified = true;
+            await this.userRepository.save(fullUser);
+
+            // Emit email verified event
+            await this.eventEmitter.emitAsync(
+                NestAuthEvents.EMAIL_VERIFIED,
+                {
+                    user: fullUser,
+                    tenantId: fullUser.tenantId,
+                }
+            );
+
+            this.debugLogger.logFunctionExit('verifyEmail', 'AuthService');
+            return { message: 'Email verified successfully' };
+
+        } catch (error) {
+            this.debugLogger.logError(error, 'verifyEmail');
+            throw error;
+        }
+    }
+
+
+
+    private generateTokensPayload(session: SessionPayload, otherPayload: Partial<JWTTokenPayload> = {}): JWTTokenPayload {
+
+        const payload: JWTTokenPayload = {
+            id: session.userId,
+            sub: session.userId,
+            sessionId: session.id,
+            email: session.data?.user?.email,
+            phone: session.data?.user?.phone,
+            isVerified: session.data?.user?.isVerified,
+            roles: session.data?.roles,
+            tenantId: session.data?.user?.tenantId,
+            isMfaEnabled: session.data?.user?.isMfaEnabled,
+            isMfaVerified: session.data?.isMfaVerified,
+            ...otherPayload,
+        };
+
+        return payload;
+    }
+
+    private async generateTokensFromSession(session: SessionPayload): Promise<{ accessToken: string; refreshToken: string }> {
+        const payload = this.generateTokensPayload(session);
+        const tokens = await this.jwtService.generateTokens(payload);
+        return tokens
+    }
+}