@aneuhold/be-ts-db-lib 4.2.18 → 4.2.20

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
+## 🔖 [4.2.20] (2026-03-19)
+
+### ✅ Added
+
+- Added `GoogleAuthService.verifyAndFindUser` method that returns `null` when no matching user exists (does not create one).
+
+### 🏗️ Changed
+
+- Refactored `GoogleAuthService`: extracted private `verifyToken` helper and restructured `verifyAndFindOrCreateUser` to delegate to `verifyAndFindUser`.
+- Refactored `MigrationService` to fill in missing `projectAccess` fields with safe defaults instead of patching `refreshTokenHashes`.
+- Updated dependencies on `@aneuhold/be-ts-lib` to `^3.1.7` and `@aneuhold/core-ts-db-lib` to `^5.0.2`.
+
+## 🔖 [4.2.19] (2026-03-18)
+
+### ✅ Added
+
+- Added `UserRepository.getUserByRefreshTokenHash()` to look up a user by a SHA-256 hashed refresh token stored in `auth.refreshTokenHashes`.
+
+### 🏗️ Changed
+
+- `MigrationService` updated to backfill `auth.refreshTokenHashes` for users missing the field; removed the previous large ObjectId-to-UUID migration logic.
+
 ## 🔖 [4.2.18] (2026-03-15)
 
 ### ✅ Added
@@ -338,6 +360,8 @@ Updated dependencies: now requires `@aneuhold/core-ts-db-lib@^3.0.0`, `@aneuhold
 
 <!-- Link References -->
 
+[4.2.20]: https://github.com/aneuhold/ts-libs/compare/be-ts-db-lib-v4.2.19...be-ts-db-lib-v4.2.20
+[4.2.19]: https://github.com/aneuhold/ts-libs/compare/be-ts-db-lib-v4.2.18...be-ts-db-lib-v4.2.19
 [4.2.18]: https://github.com/aneuhold/ts-libs/compare/be-ts-db-lib-v4.2.17...be-ts-db-lib-v4.2.18
 [4.2.17]: https://github.com/aneuhold/ts-libs/compare/be-ts-db-lib-v4.2.16...be-ts-db-lib-v4.2.17
 [4.2.16]: https://github.com/aneuhold/ts-libs/compare/be-ts-db-lib-v4.2.15...be-ts-db-lib-v4.2.16

package/lib/repositories/common/UserRepository.d.ts

@@ -14,6 +14,12 @@ export default class UserRepository extends BaseRepository<User> {
      */
     static getRepo(): UserRepository;
     getUserCTOByUsername(userName: string): Promise<UserCTO | null>;
+    /**
+     * Finds a user that has a refresh token with the given SHA-256 hash.
+     *
+     * @param tokenHash - The SHA-256 hash of the refresh token.
+     */
+    getUserByRefreshTokenHash(tokenHash: string): Promise<User | null>;
     getUserCTOsByIds(userIds: UUID[]): Promise<UserCTO[]>;
 }
 //# sourceMappingURL=UserRepository.d.ts.map

package/lib/repositories/common/UserRepository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserRepository.d.ts","sourceRoot":"","sources":["../../../src/repositories/common/UserRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAalD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IAC9D,OAAO,CAAC,MAAM,CAAC,eAAe,CAAW;IAEzC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAE7D,OAAO;IAIP,SAAS,CAAC,gBAAgB,IAAI,IAAI;IAclC;;OAEG;IACH,MAAM,CAAC,OAAO,IAAI,cAAc;IAO1B,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAW/D,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAO5D"}
+{"version":3,"file":"UserRepository.d.ts","sourceRoot":"","sources":["../../../src/repositories/common/UserRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAEnC,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAalD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,cAAc,CAAC,IAAI,CAAC;IAC9D,OAAO,CAAC,MAAM,CAAC,eAAe,CAAW;IAEzC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAE7D,OAAO;IAIP,SAAS,CAAC,gBAAgB,IAAI,IAAI;IAclC;;OAEG;IACH,MAAM,CAAC,OAAO,IAAI,cAAc;IAO1B,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAWrE;;;;OAIG;IACG,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAQlE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAO5D"}

package/lib/repositories/common/UserRepository.js

@@ -52,6 +52,18 @@ export default class UserRepository extends BaseRepository {
         }
         return null;
     }
+    /**
+     * Finds a user that has a refresh token with the given SHA-256 hash.
+     *
+     * @param tokenHash - The SHA-256 hash of the refresh token.
+     */
+    async getUserByRefreshTokenHash(tokenHash) {
+        const collection = await this.getCollection();
+        const result = await collection.findOne({
+            'auth.refreshTokenHashes.tokenHash': tokenHash
+        });
+        return result;
+    }
     async getUserCTOsByIds(userIds) {
         const users = await this.getList(userIds);
         return users.map((user) => ({

package/lib/repositories/common/UserRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserRepository.js","sourceRoot":"","sources":["../../../src/repositories/common/UserRepository.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,MAAM,0CAA0C,CAAC;AACrE,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,qCAAqC,MAAM,uDAAuD,CAAC;AAC1G,OAAO,wCAAwC,MAAM,0DAA0D,CAAC;AAChH,OAAO,uBAAuB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,6BAA6B,MAAM,+CAA+C,CAAC;AAC1F,OAAO,8BAA8B,MAAM,8CAA8C,CAAC;AAC1F,OAAO,oCAAoC,MAAM,oDAAoD,CAAC;AACtG,OAAO,yBAAyB,MAAM,yCAAyC,CAAC;AAChF,OAAO,0BAA0B,MAAM,0CAA0C,CAAC;AAClF,OAAO,2BAA2B,MAAM,2CAA2C,CAAC;AACpF,OAAO,4BAA4B,MAAM,4CAA4C,CAAC;AACtF,OAAO,gBAAgB,MAAM,uBAAuB,CAAC;AAErD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,cAAoB;IACtD,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC;IAEjC,MAAM,CAAC,iBAAiB,CAA6B;IAE7D;QACE,KAAK,CAAC,cAAc,CAAC,eAAe,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;IAC7D,CAAC;IAES,gBAAgB;QACxB,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,kBAAkB,CAAC,wCAAwC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO;QACZ,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAC;YACtC,cAAc,CAAC,iBAAiB,GAAG,IAAI,cAAc,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,cAAc,CAAC,iBAAiB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC,CAAC;IACN,CAAC"}
+{"version":3,"file":"UserRepository.js","sourceRoot":"","sources":["../../../src/repositories/common/UserRepository.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,MAAM,0CAA0C,CAAC;AACrE,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,qCAAqC,MAAM,uDAAuD,CAAC;AAC1G,OAAO,wCAAwC,MAAM,0DAA0D,CAAC;AAChH,OAAO,uBAAuB,MAAM,yCAAyC,CAAC;AAC9E,OAAO,6BAA6B,MAAM,+CAA+C,CAAC;AAC1F,OAAO,8BAA8B,MAAM,8CAA8C,CAAC;AAC1F,OAAO,oCAAoC,MAAM,oDAAoD,CAAC;AACtG,OAAO,yBAAyB,MAAM,yCAAyC,CAAC;AAChF,OAAO,0BAA0B,MAAM,0CAA0C,CAAC;AAClF,OAAO,2BAA2B,MAAM,2CAA2C,CAAC;AACpF,OAAO,4BAA4B,MAAM,4CAA4C,CAAC;AACtF,OAAO,gBAAgB,MAAM,uBAAuB,CAAC;AAErD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,cAAoB;IACtD,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC;IAEjC,MAAM,CAAC,iBAAiB,CAA6B;IAE7D;QACE,KAAK,CAAC,cAAc,CAAC,eAAe,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;IAC7D,CAAC;IAES,gBAAgB;QACxB,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,6BAA6B,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,kBAAkB,CAAC,wCAAwC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,kBAAkB,CAAC,4BAA4B,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,CAAC,yBAAyB,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,kBAAkB,CAAC,2BAA2B,CAAC,uBAAuB,EAAE,CAAC,CAAC;IACjF,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,OAAO;QACZ,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAC;YACtC,cAAc,CAAC,iBAAiB,GAAG,IAAI,cAAc,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,cAAc,CAAC,iBAAiB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,QAAgB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,yBAAyB,CAAC,SAAiB;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YACtC,mCAAmC,EAAE,SAAS;SAC/C,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,OAAe;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC,CAAC;IACN,CAAC"}

package/lib/repositories/common/UserRepository.ts

@@ -61,6 +61,19 @@ export default class UserRepository extends BaseRepository<User> {
     return null;
   }
 
+  /**
+   * Finds a user that has a refresh token with the given SHA-256 hash.
+   *
+   * @param tokenHash - The SHA-256 hash of the refresh token.
+   */
+  async getUserByRefreshTokenHash(tokenHash: string): Promise<User | null> {
+    const collection = await this.getCollection();
+    const result = await collection.findOne({
+      'auth.refreshTokenHashes.tokenHash': tokenHash
+    });
+    return result;
+  }
+
   async getUserCTOsByIds(userIds: UUID[]): Promise<UserCTO[]> {
     const users = await this.getList(userIds);
     return users.map((user) => ({

package/lib/services/GoogleAuthService.d.ts

@@ -6,6 +6,16 @@ import type { ApiKey, User } from '@aneuhold/core-ts-db-lib';
  */
 export default class GoogleAuthService {
     private static readonly client;
+    /**
+     * Verifies a Google ID token and finds the associated user. Returns
+     * `null` if no matching user exists (does **not** create one).
+     *
+     * @param googleCredentialToken - The Google ID token string from the client.
+     */
+    static verifyAndFindUser(googleCredentialToken: string): Promise<{
+        user: User;
+        apiKey: ApiKey;
+    } | null>;
     /**
      * Verifies a Google ID token and finds or creates the associated user.
      *
@@ -15,5 +25,11 @@ export default class GoogleAuthService {
         user: User;
         apiKey: ApiKey;
     }>;
+    /**
+     * Verifies a Google ID token and returns the Google ID and email.
+     *
+     * @param googleCredentialToken - The Google ID token string from the client.
+     */
+    private static verifyToken;
 }
 //# sourceMappingURL=GoogleAuthService.d.ts.map

package/lib/services/GoogleAuthService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleAuthService.d.ts","sourceRoot":"","sources":["../../src/services/GoogleAuthService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAM7D;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAEpE;;;;OAIG;WACU,yBAAyB,CACpC,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAsD3C"}
+{"version":3,"file":"GoogleAuthService.d.ts","sourceRoot":"","sources":["../../src/services/GoogleAuthService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAM7D;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IACpC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAEpE;;;;;OAKG;WACU,iBAAiB,CAC5B,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IA+BjD;;;;OAIG;WACU,yBAAyB,CACpC,qBAAqB,EAAE,MAAM,GAC5B,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA+B1C;;;;OAIG;mBACkB,WAAW;CAmBjC"}

package/lib/services/GoogleAuthService.js

@@ -1,4 +1,4 @@
-import { GOOGLE_CLIENT_ID, UserSchema } from '@aneuhold/core-ts-db-lib';
+import { GOOGLE_CLIENT_ID, ProjectName, UserSchema } from '@aneuhold/core-ts-db-lib';
 import { OAuth2Client } from 'google-auth-library';
 import ApiKeyRepository from '../repositories/common/ApiKeyRepository.js';
 import UserRepository from '../repositories/common/UserRepository.js';
@@ -10,23 +10,13 @@ import UserRepository from '../repositories/common/UserRepository.js';
 export default class GoogleAuthService {
     static client = new OAuth2Client(GOOGLE_CLIENT_ID);
     /**
-     * Verifies a Google ID token and finds or creates the associated user.
+     * Verifies a Google ID token and finds the associated user. Returns
+     * `null` if no matching user exists (does **not** create one).
      *
      * @param googleCredentialToken - The Google ID token string from the client.
      */
-    static async verifyAndFindOrCreateUser(googleCredentialToken) {
-        const ticket = await this.client.verifyIdToken({
-            idToken: googleCredentialToken,
-            audience: GOOGLE_CLIENT_ID
-        });
-        const payload = ticket.getPayload();
-        if (!payload) {
-            throw new Error('Invalid Google token payload');
-        }
-        const { sub: googleId, email } = payload;
-        if (!email) {
-            throw new Error('Google account has no email');
-        }
+    static async verifyAndFindUser(googleCredentialToken) {
+        const { googleId, email } = await this.verifyToken(googleCredentialToken);
         const userRepo = UserRepository.getRepo();
         const apiKeyRepo = ApiKeyRepository.getRepo();
         // 1. Look up by googleId
@@ -40,20 +30,8 @@ export default class GoogleAuthService {
                 user.auth.googleId = googleId;
             }
         }
-        // 3. Create new user if neither match. The ApiKey subscriber on
-        //    UserRepository automatically creates an API key on user insertion.
         if (!user) {
-            const newUser = UserSchema.parse({
-                userName: email,
-                email,
-                auth: { googleId },
-                projectAccess: { dashboard: false, workout: true }
-            });
-            const insertedUser = await userRepo.insertNew(newUser);
-            if (!insertedUser) {
-                throw new Error('Failed to create user');
-            }
-            user = insertedUser;
+            return null;
         }
         const apiKey = await apiKeyRepo.get({ userId: user._id });
         if (!apiKey) {
@@ -61,5 +39,56 @@ export default class GoogleAuthService {
         }
         return { user, apiKey };
     }
+    /**
+     * Verifies a Google ID token and finds or creates the associated user.
+     *
+     * @param googleCredentialToken - The Google ID token string from the client.
+     */
+    static async verifyAndFindOrCreateUser(googleCredentialToken) {
+        const result = await this.verifyAndFindUser(googleCredentialToken);
+        if (result) {
+            return result;
+        }
+        // Create new user. The ApiKey subscriber on UserRepository automatically
+        // creates an API key on user insertion.
+        const { googleId, email } = await this.verifyToken(googleCredentialToken);
+        const userRepo = UserRepository.getRepo();
+        const apiKeyRepo = ApiKeyRepository.getRepo();
+        const newUser = UserSchema.parse({
+            userName: email,
+            email,
+            auth: { googleId },
+            projectAccess: { [ProjectName.Dashboard]: false, [ProjectName.Workout]: true }
+        });
+        const insertedUser = await userRepo.insertNew(newUser);
+        if (!insertedUser) {
+            throw new Error('Failed to create user');
+        }
+        const apiKey = await apiKeyRepo.get({ userId: insertedUser._id });
+        if (!apiKey) {
+            throw new Error(`No API key found for user ${insertedUser._id}`);
+        }
+        return { user: insertedUser, apiKey };
+    }
+    /**
+     * Verifies a Google ID token and returns the Google ID and email.
+     *
+     * @param googleCredentialToken - The Google ID token string from the client.
+     */
+    static async verifyToken(googleCredentialToken) {
+        const ticket = await this.client.verifyIdToken({
+            idToken: googleCredentialToken,
+            audience: GOOGLE_CLIENT_ID
+        });
+        const payload = ticket.getPayload();
+        if (!payload) {
+            throw new Error('Invalid Google token payload');
+        }
+        const { sub: googleId, email } = payload;
+        if (!email) {
+            throw new Error('Google account has no email');
+        }
+        return { googleId, email };
+    }
 }
 //# sourceMappingURL=GoogleAuthService.js.map

package/lib/services/GoogleAuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GoogleAuthService.js","sourceRoot":"","sources":["../../src/services/GoogleAuthService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,gBAAgB,MAAM,4CAA4C,CAAC;AAC1E,OAAO,cAAc,MAAM,0CAA0C,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IAC5B,MAAM,CAAU,MAAM,GAAG,IAAI,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAEpE;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,yBAAyB,CACpC,qBAA6B;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC7C,OAAO,EAAE,qBAAqB;YAC9B,QAAQ,EAAE,gBAAgB;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE9C,yBAAyB;QACzB,IAAI,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEtD,iDAAiD;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,CAAC;gBACT,qCAAqC;gBACrC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC3E,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAChC,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,wEAAwE;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC;gBAC/B,QAAQ,EAAE,KAAK;gBACf,KAAK;gBACL,IAAI,EAAE,EAAE,QAAQ,EAAE;gBAClB,aAAa,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE;aACnD,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,GAAG,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC"}
+{"version":3,"file":"GoogleAuthService.js","sourceRoot":"","sources":["../../src/services/GoogleAuthService.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,gBAAgB,MAAM,4CAA4C,CAAC;AAC1E,OAAO,cAAc,MAAM,0CAA0C,CAAC;AAEtE;;;;GAIG;AACH,MAAM,CAAC,OAAO,OAAO,iBAAiB;IAC5B,MAAM,CAAU,MAAM,GAAG,IAAI,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAEpE;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAC5B,qBAA6B;QAE7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAE1E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE9C,yBAAyB;QACzB,IAAI,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEtD,iDAAiD;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACrC,IAAI,IAAI,EAAE,CAAC;gBACT,qCAAqC;gBACrC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC3E,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,yBAAyB,CACpC,qBAA6B;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,yEAAyE;QACzE,wCAAwC;QACxC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;QAE9C,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC;YAC/B,QAAQ,EAAE,KAAK;YACf,KAAK;YACL,IAAI,EAAE,EAAE,QAAQ,EAAE;YAClB,aAAa,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE;SAC/E,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,KAAK,CAAC,WAAW,CAC9B,qBAA6B;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC7C,OAAO,EAAE,qBAAqB;YAC9B,QAAQ,EAAE,gBAAgB;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC"}

package/lib/services/GoogleAuthService.ts

@@ -1,5 +1,5 @@
 import type { ApiKey, User } from '@aneuhold/core-ts-db-lib';
-import { GOOGLE_CLIENT_ID, UserSchema } from '@aneuhold/core-ts-db-lib';
+import { GOOGLE_CLIENT_ID, ProjectName, UserSchema } from '@aneuhold/core-ts-db-lib';
 import { OAuth2Client } from 'google-auth-library';
 import ApiKeyRepository from '../repositories/common/ApiKeyRepository.js';
 import UserRepository from '../repositories/common/UserRepository.js';
@@ -13,26 +13,15 @@ export default class GoogleAuthService {
   private static readonly client = new OAuth2Client(GOOGLE_CLIENT_ID);
 
   /**
-   * Verifies a Google ID token and finds or creates the associated user.
+   * Verifies a Google ID token and finds the associated user. Returns
+   * `null` if no matching user exists (does **not** create one).
    *
    * @param googleCredentialToken - The Google ID token string from the client.
    */
-  static async verifyAndFindOrCreateUser(
+  static async verifyAndFindUser(
     googleCredentialToken: string
-  ): Promise<{ user: User; apiKey: ApiKey }> {
-    const ticket = await this.client.verifyIdToken({
-      idToken: googleCredentialToken,
-      audience: GOOGLE_CLIENT_ID
-    });
-    const payload = ticket.getPayload();
-    if (!payload) {
-      throw new Error('Invalid Google token payload');
-    }
-
-    const { sub: googleId, email } = payload;
-    if (!email) {
-      throw new Error('Google account has no email');
-    }
+  ): Promise<{ user: User; apiKey: ApiKey } | null> {
+    const { googleId, email } = await this.verifyToken(googleCredentialToken);
 
     const userRepo = UserRepository.getRepo();
     const apiKeyRepo = ApiKeyRepository.getRepo();
@@ -50,20 +39,8 @@ export default class GoogleAuthService {
       }
     }
 
-    // 3. Create new user if neither match. The ApiKey subscriber on
-    //    UserRepository automatically creates an API key on user insertion.
     if (!user) {
-      const newUser = UserSchema.parse({
-        userName: email,
-        email,
-        auth: { googleId },
-        projectAccess: { dashboard: false, workout: true }
-      });
-      const insertedUser = await userRepo.insertNew(newUser);
-      if (!insertedUser) {
-        throw new Error('Failed to create user');
-      }
-      user = insertedUser;
+      return null;
     }
 
     const apiKey = await apiKeyRepo.get({ userId: user._id });
@@ -73,4 +50,67 @@ export default class GoogleAuthService {
 
     return { user, apiKey };
   }
+
+  /**
+   * Verifies a Google ID token and finds or creates the associated user.
+   *
+   * @param googleCredentialToken - The Google ID token string from the client.
+   */
+  static async verifyAndFindOrCreateUser(
+    googleCredentialToken: string
+  ): Promise<{ user: User; apiKey: ApiKey }> {
+    const result = await this.verifyAndFindUser(googleCredentialToken);
+    if (result) {
+      return result;
+    }
+
+    // Create new user. The ApiKey subscriber on UserRepository automatically
+    // creates an API key on user insertion.
+    const { googleId, email } = await this.verifyToken(googleCredentialToken);
+    const userRepo = UserRepository.getRepo();
+    const apiKeyRepo = ApiKeyRepository.getRepo();
+
+    const newUser = UserSchema.parse({
+      userName: email,
+      email,
+      auth: { googleId },
+      projectAccess: { [ProjectName.Dashboard]: false, [ProjectName.Workout]: true }
+    });
+    const insertedUser = await userRepo.insertNew(newUser);
+    if (!insertedUser) {
+      throw new Error('Failed to create user');
+    }
+
+    const apiKey = await apiKeyRepo.get({ userId: insertedUser._id });
+    if (!apiKey) {
+      throw new Error(`No API key found for user ${insertedUser._id}`);
+    }
+
+    return { user: insertedUser, apiKey };
+  }
+
+  /**
+   * Verifies a Google ID token and returns the Google ID and email.
+   *
+   * @param googleCredentialToken - The Google ID token string from the client.
+   */
+  private static async verifyToken(
+    googleCredentialToken: string
+  ): Promise<{ googleId: string; email: string }> {
+    const ticket = await this.client.verifyIdToken({
+      idToken: googleCredentialToken,
+      audience: GOOGLE_CLIENT_ID
+    });
+    const payload = ticket.getPayload();
+    if (!payload) {
+      throw new Error('Invalid Google token payload');
+    }
+
+    const { sub: googleId, email } = payload;
+    if (!email) {
+      throw new Error('Google account has no email');
+    }
+
+    return { googleId, email };
+  }
 }

package/lib/services/MigrationService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MigrationService.d.ts","sourceRoot":"","sources":["../../src/services/MigrationService.ts"],"names":[],"mappings":"AAoBA;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAgB;IACnC;;;;;;;;OAQG;WACU,SAAS,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAkHtD"}
+{"version":3,"file":"MigrationService.d.ts","sourceRoot":"","sources":["../../src/services/MigrationService.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,OAAO,gBAAgB;IACnC;;;;;;;;OAQG;WACU,SAAS,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAkDtD"}