@appweaver/core 1.0.0

package/security/auth-service.js

@@ -0,0 +1,272 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = void 0;
+const common_1 = require("@appweaver/common");
+const helper_1 = require("./helper");
+const context_1 = require("../context");
+const cache_1 = require("../cache");
+const errors_1 = require("../errors");
+const AUTH_KEY = 'auth';
+class AuthService {
+    /** @internal */
+    _securityStore = (0, context_1.inject)(common_1.SecurityStore);
+    /** @internal */
+    _cacheService = (0, context_1.inject)(cache_1.CacheService);
+    /** @internal */
+    _authUserService = (0, helper_1.resourceAuthService)();
+    /**
+     * Finds an authenticated user by their unique identifier.
+     *
+     * @param {number} id - The unique identifier of the authenticated user to find.
+     * @return {Promise<AuthUser | null>} A promise that resolves to the authenticated user object if found, otherwise
+     * null.
+     */
+    async findById(id) {
+        try {
+            if (!common_1.config.CACHE_ENABLED || common_1.config.SECURITY_CACHE_TTL < 0) {
+                return this._authUserService.find(id);
+            }
+            const cacheKey = this._cacheService.buildCacheKey({
+                baseKey: `${AUTH_KEY}:${id}`,
+                modelName: this._authUserService.modelName
+            });
+            const value = await this._cacheService.getCachedValue(cacheKey);
+            if (value) {
+                return value;
+            }
+            const authUser = await this._authUserService.find(id);
+            await this._cacheService.addToCache(cacheKey, authUser, common_1.config.SECURITY_CACHE_TTL);
+            return authUser;
+        }
+        catch (e) {
+            throw new errors_1.HttpError('Auth user find error', 500, e);
+        }
+    }
+    /**
+     * Retrieves a user by their username.
+     *
+     * @param {string} username - The username to search for.
+     * @return {Promise<AuthUser | null>} A promise that resolves to the user object if found, or null if not found.
+     */
+    async findByUsername(username) {
+        try {
+            if (!common_1.config.CACHE_ENABLED || common_1.config.SECURITY_CACHE_TTL < 0) {
+                const result = await this._authUserService.query({ email: username });
+                return result.items[0] ?? null;
+            }
+            const cacheKey = this._cacheService.buildCacheKey({
+                baseKey: `${AUTH_KEY}:${username}`,
+                modelName: this._authUserService.modelName
+            });
+            const value = await this._cacheService.getCachedValue(cacheKey);
+            if (value) {
+                return value;
+            }
+            const result = await this._authUserService.query({ email: username });
+            const authUser = result.items[0] ?? null;
+            if (authUser) {
+                await this._cacheService.addToCache(cacheKey, authUser, common_1.config.SECURITY_CACHE_TTL);
+            }
+            return authUser;
+        }
+        catch (e) {
+            throw new errors_1.HttpError('Auth user find error', 500, e);
+        }
+    }
+    /**
+     * Updates an authenticated user's information in the system.
+     *
+     * @param {number} id - The unique identifier of the authenticated user to be updated.
+     * @param {Partial<AuthUser> & { password?: string }} data - The partial user data to update, optionally including a
+     * password.
+     * @return {Promise<AuthUser>} A promise that resolves to the updated authenticated user object.
+     */
+    async updateAuthUser(id, data) {
+        try {
+            return await this._authUserService.update(id, data);
+        }
+        catch (e) {
+            throw new errors_1.HttpError('Auth user update error', 500, e);
+        }
+    }
+    /**
+     * Registers a new authenticated user based on the provided authentication source, email, and optional password and
+     * additional data.
+     *
+     * @param {AuthSource} source - The authentication source to register the user, e.g., password, google, custom.
+     * @param {string} email - The email address of the user to be registered.
+     * @param {string} [password] - The optional password for the user, used when the authentication type requires it.
+     * @param {Partial<UserAdditionalData>} [data] - Optional additional data related to the user to be stored during
+     * registration.
+     * @return {Promise<AuthUser>} A promise resolving to the registered authentication user object.
+     * @throws {HttpError} Throws an error if the registration process fails.
+     */
+    async registerAuthUser(source, email, password, data) {
+        try {
+            const serviceConfig = this._authUserService[common_1.CONFIG];
+            const registrationData = serviceConfig.registrationData(source, email, password, data);
+            return this._authUserService.create({
+                ...registrationData,
+                verifiedEmail: source !== common_1.AuthSource.Password
+            });
+        }
+        catch (e) {
+            throw new errors_1.HttpError('Auth user registration error', 500, e);
+        }
+    }
+    /**
+     * Changes the password for the authenticated user.
+     *
+     * @param {AuthUser} authUser - The authenticated user object containing user details.
+     * @param {string} currentPassword - The current password of the authenticated user.
+     * @param {string} newPassword - The new password to be set for the authenticated user.
+     * @return {Promise<AuthTokens>} A promise that resolves to the new authentication tokens after the password is
+     * successfully changed.
+     * @throws {HttpError} If the current password does not match the stored password hash.
+     */
+    async changePassword(authUser, currentPassword, newPassword) {
+        if (!common_1.config.SECURITY_PASSWORD_ENABLED) {
+            throw new errors_1.HttpError('Password update is not supported', 403);
+        }
+        if (!authUser.passwordHash ||
+            !(await (0, helper_1.checkPassword)(currentPassword, authUser.passwordHash))) {
+            throw new errors_1.HttpError('Auth user current password invalid', 403);
+        }
+        const result = (0, helper_1.validatePasswordComplexity)(newPassword);
+        if (!result.valid) {
+            throw new errors_1.HttpError(result.message, 400);
+        }
+        await this.updateAuthUser(authUser.id, {
+            logoutAt: new Date(),
+            passwordHash: await (0, helper_1.hashPassword)(newPassword)
+        });
+        common_1.logger.debug({ id: authUser.id }, 'Password changed successfully');
+        return this.login(authUser.email, newPassword);
+    }
+    /**
+     * Authenticates a user by verifying their username and password.
+     *
+     * @param {string} username - The username of the user attempting to authenticate.
+     * @param {string} password - The password of the user attempting to authenticate.
+     * @return {Promise<AuthUser>} A promise that resolves to an authenticated user object if the credentials are valid.
+     * @throws {HttpError} If the user does not exist, is disabled, or if the provided credentials are invalid.
+     */
+    async authenticate(username, password) {
+        const authUser = await this.findByUsername(username);
+        if (!authUser || !authUser.enabled || !authUser.passwordHash) {
+            throw new errors_1.HttpError('Auth user does not exist or is disabled', 400);
+        }
+        if (!(await (0, helper_1.checkPassword)(password, authUser.passwordHash))) {
+            throw new errors_1.HttpError('Invalid user credentials', 401);
+        }
+        common_1.logger.debug({ id: authUser.id }, 'User authenticated');
+        return authUser;
+    }
+    /**
+     * Authorizes a user based on provided authentication details, route configuration, and JWT payload
+     * (if JWT auth type is used).
+     *
+     * @param {AuthUser | null} authUser - The authenticated user object. Can be null if no user is authenticated.
+     * @param {string} url - The URL of the resource being accessed.
+     * @param {RouteConfig} [routeConfig={}] - The route configuration object specifying required roles and permissions.
+     * @param {JwtPayload} [jwtPayload] - The JWT payload containing additional authentication information.
+     * @throws {HttpError} If the user is not authorized to access url based on route config and JWT payload.
+     */
+    authorize(authUser, url, routeConfig = {}, jwtPayload) {
+        if (!authUser ||
+            !authUser.enabled ||
+            (authUser.logoutAt &&
+                jwtPayload &&
+                new Date(authUser.logoutAt).getTime() > jwtPayload?.iat)) {
+            throw new errors_1.HttpError('Unauthorized access', 401);
+        }
+        if (jwtPayload && !(0, helper_1.checkScopeAccess)(url, jwtPayload.scope)) {
+            throw new errors_1.HttpError(`JWT token is not authorized to access requested URL`, 403);
+        }
+        const { roles, permissions } = routeConfig;
+        if (!(0, helper_1.hasRoles)(authUser, roles) || !(0, helper_1.hasPermissions)(authUser, permissions)) {
+            throw new errors_1.HttpError('Forbidden access', 403);
+        }
+    }
+    /**
+     * Authenticates a user based on the provided username and password and generate access tokens.
+     * If 2FA is forced at configuration level or auth user has enabled 2FA, then generate JWT with 2FA scope,
+     * otherwise return regular JWT with authentication scope.
+     *
+     * @param {string} username - The username of the user attempting to log in.
+     * @param {string} password - The password of the user attempting to log in.
+     * @return {Promise<AuthTokens>} A promise that resolves to an object containing authentication tokens if login is
+     * successful.
+     * @throws {HttpError} If the user does not exist, is disabled, or provides invalid credentials.
+     */
+    async login(username, password) {
+        const authUser = await this.authenticate(username, password);
+        if (common_1.config.SECURITY_ACCOUNT_2FA_ENABLED &&
+            (common_1.config.SECURITY_ACCOUNT_2FA_FORCED || authUser.twoFactorAuth !== 'None')) {
+            return this.generateAuthTokens(authUser, common_1.AuthScope.TwoFA);
+        }
+        return this.generateAuthTokens(authUser);
+    }
+    /**
+     * Exchanges an existing token for new authentication tokens.
+     *
+     * @param {string} token - The token to be exchanged for new authentication tokens.
+     * @return {Promise<AuthTokens>} A promise that resolves to a set of new authentication tokens.
+     * @throws {HttpError} If the token is invalid, expired, or associated with a non-existent or disabled user.
+     */
+    async exchangeToken(token) {
+        const { authUserId, authSource } = await this._securityStore.useOneTimeToken(token, common_1.AuthOTTPurpose.Authentication);
+        const authUser = await this.findById(authUserId);
+        if (!authUser || !authUser.enabled) {
+            throw new errors_1.HttpError('Auth user does not exist or is disabled', 400);
+        }
+        common_1.logger.debug({ id: authUser.id, token }, 'User token exchanged');
+        return this.generateAuthTokens(authUser, common_1.AuthScope.Auth, authSource);
+    }
+    /**
+     * Generates authentication tokens (access and refresh tokens) for a given authenticated user.
+     *
+     * @param {AuthUser} authUser - The authenticated user for whom the tokens are to be generated.
+     *                              Contains user identification and authentication details.
+     * @param {AuthScope} [scope=AuthScope.Auth] - The scope for which the tokens are generated.
+     * @param {AuthSource} [source=AuthSource.Password] - The authentication source used to generate access tokens.
+     * @return {Promise<AuthTokens>} A promise that resolves to an object containing the generated authentication tokens:
+     *                                - `accessToken` (string): The access token for API access.
+     *                                - `refreshToken` (string): The refresh token for acquiring new access tokens.
+     *                                - `expiresIn` (number): The expiration time (in seconds) of the access token.
+     *                                - `refreshExpiresIn` (number): The expiration time (in seconds) of the refresh token.
+     * @throws {HttpError} If the server instance is not initialized.
+     */
+    async generateAuthTokens(authUser, scope = common_1.AuthScope.Auth, source = common_1.AuthSource.Password) {
+        const server = context_1.context.server;
+        if (!server) {
+            throw new errors_1.HttpError('Server instance not initialized');
+        }
+        const jwtPayload = {
+            scope,
+            source,
+            username: authUser.email,
+            sub: authUser.id,
+            iat: new Date().getTime()
+        };
+        const expiresIn = common_1.config.SECURITY_JWT_EXPIRES_IN;
+        const refreshExpiresIn = common_1.config.SECURITY_JWT_REFRESH_EXPIRES_IN;
+        const accessToken = server.jwt.sign(jwtPayload, { expiresIn });
+        const refreshToken = server.jwt.sign({ ...jwtPayload, scope: common_1.AuthScope.Refresh }, { expiresIn: refreshExpiresIn });
+        common_1.logger.debug({ id: authUser.id }, 'Access tokens generated');
+        return { accessToken, refreshToken, expiresIn, refreshExpiresIn };
+    }
+    /**
+     * Logs out a user by updating their authentication information with a logout timestamp.
+     *
+     * @param {number} id - The unique identifier of the user to be logged out.
+     * @return {Promise<boolean>} A promise that resolves to a boolean indicating whether the logout operation was
+     * successful.
+     */
+    async logout(id) {
+        await this._cacheService.removeCachedValue(`${AUTH_KEY}:${id}`);
+        common_1.logger.debug({ id }, 'User logout');
+        return !!(await this.updateAuthUser(id, { logoutAt: new Date() }));
+    }
+}
+exports.AuthService = AuthService;

package/security/auth.d.ts

@@ -0,0 +1,3 @@
+import { Server } from '../types';
+declare const _default: (server: Server) => void;
+export default _default;

package/security/auth.js

@@ -0,0 +1,127 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
+const auth_1 = __importDefault(require("@fastify/auth"));
+const common_1 = require("@appweaver/common");
+const errors_1 = require("../errors");
+const helper_1 = require("./helper");
+const auth_routes_1 = require("./auth-routes");
+const account_1 = require("./account");
+const recaptcha_1 = require("./recaptcha");
+const basic_1 = require("./basic");
+const api_key_1 = require("./api-key");
+const jwt_1 = require("./jwt");
+const oauth2Plugins = __importStar(require("./oauth2"));
+exports.default = (0, fastify_plugin_1.default)((server) => {
+    server.register(auth_1.default);
+    if (common_1.config.SECURITY_RECAPTCHA_ENABLED) {
+        server.register(recaptcha_1.recaptcha);
+    }
+    if (common_1.config.SECURITY_BASIC_ENABLED) {
+        server.register(basic_1.basicAuth);
+    }
+    if (common_1.config.SECURITY_API_KEY_ENABLED) {
+        server.register(api_key_1.apiKeyAuth);
+    }
+    server.register(jwt_1.jwtAuth);
+    // Load and register all plugins exported from oauth2 dir, plugin-enabled
+    // status and required config values are checked at plugin initialization
+    for (const oauth2Plugin of Object.values(oauth2Plugins)) {
+        server.register(oauth2Plugin);
+    }
+    server.register(auth_routes_1.authRoutes, { prefix: common_1.config.SECURITY_ROUTE_PREFIX });
+    server.register(account_1.accountRoutes, {
+        prefix: common_1.config.SECURITY_ACCOUNT_ROUTE_PREFIX
+    });
+    server.decorate('authenticate', (authTypes) => {
+        const { auth, authenticateJWT, authenticateApiKey, basicAuth } = server;
+        const authHandlers = [];
+        const optionalHandler = (hasAuthCredentials, handler) => async (req, reply) => {
+            if (hasAuthCredentials(req)) {
+                await handler(req, reply);
+            }
+        };
+        // Register enabled authentication handlers. Each handler executes only when
+        // the request contains credentials matching its authentication flow; otherwise,
+        // it is skipped. At least one handler must succeed for the request to be
+        // authenticated; if all handlers are skipped, a 401 error is returned
+        for (const authType of authTypes ?? Object.values(common_1.AuthType)) {
+            switch (authType) {
+                case common_1.AuthType.Jwt:
+                    authHandlers.push(optionalHandler(jwt_1.hasBearerAuth, authenticateJWT));
+                    break;
+                case common_1.AuthType.ApiKey:
+                    if (common_1.config.SECURITY_API_KEY_ENABLED) {
+                        authHandlers.push(optionalHandler(api_key_1.hasApiKey, authenticateApiKey));
+                    }
+                    break;
+                case common_1.AuthType.Basic:
+                    if (common_1.config.SECURITY_BASIC_ENABLED) {
+                        authHandlers.push([
+                            // Use OR condition since Basic auth plugin throws an error before
+                            // the validation function is called. Also, the Basic auth plugin
+                            // is using a callback-based handler
+                            async (req) => {
+                                if ((0, basic_1.hasBasicAuth)(req)) {
+                                    throw new errors_1.HttpError('Invalid authorization header', 401);
+                                }
+                            },
+                            basicAuth
+                        ]);
+                    }
+                    break;
+            }
+        }
+        // If a user has not been authenticated using any of the provided methods,
+        // then throw 401 error
+        authHandlers.push(async () => {
+            if (!(0, helper_1.currentAuthUser)()) {
+                throw new errors_1.HttpError('Unauthorized', 401);
+            }
+        });
+        return auth(authHandlers, { relation: 'and' });
+    });
+    server.decorate('currentUser', () => {
+        const authUser = (0, helper_1.currentAuthUser)();
+        if (!authUser) {
+            throw new errors_1.HttpError('Unauthorized', 401);
+        }
+        return authUser;
+    });
+});

package/security/basic/basic-auth.d.ts

@@ -0,0 +1,4 @@
+import { FastifyRequest } from 'fastify';
+import { Server } from '../../types';
+export declare const basicAuth: (server: Server) => Promise<void>;
+export declare function hasBasicAuth(request: FastifyRequest): boolean;

package/security/basic/basic-auth.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.basicAuth = void 0;
+exports.hasBasicAuth = hasBasicAuth;
+const fastify_plugin_1 = __importDefault(require("fastify-plugin"));
+const basic_auth_1 = __importDefault(require("@fastify/basic-auth"));
+const request_context_1 = require("@fastify/request-context");
+const common_1 = require("@appweaver/common");
+const context_1 = require("../../context");
+const auth_service_1 = require("../auth-service");
+exports.basicAuth = (0, fastify_plugin_1.default)(async (server) => {
+    const authService = (0, context_1.inject)(auth_service_1.AuthService);
+    server.register(basic_auth_1.default, {
+        authenticate: common_1.config.SECURITY_BASIC_REALM
+            ? { realm: common_1.config.SECURITY_BASIC_REALM }
+            : true,
+        proxyMode: common_1.config.SECURITY_BASIC_PROXY_MODE,
+        validate: async (username, password, request) => {
+            const authUser = await authService.authenticate(username, password);
+            authService.authorize(authUser, request.url, request.routeOptions.config);
+            request_context_1.requestContext.set('authUser', authUser);
+            request_context_1.requestContext.set('authType', common_1.AuthType.Basic);
+            request_context_1.requestContext.set('authSource', common_1.AuthSource.Password);
+        }
+    });
+});
+function hasBasicAuth(request) {
+    return (request.headers.authorization?.toLowerCase().startsWith('basic') === true);
+}

package/security/basic/index.d.ts

@@ -0,0 +1 @@
+export * from './basic-auth';

package/security/basic/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./basic-auth"), exports);

package/security/create-auth-resources.d.ts

@@ -0,0 +1,6 @@
+import { Ctor, IResourceService, ResourceModel, ResourceModelConfig, ResourceServiceConfig } from '@appweaver/common';
+import { RegistrationDataFn } from '../types';
+export declare function createAuthModel(config: ResourceModelConfig): ResourceModel;
+export declare function createAuthService<T = any, C = any, U = any>(config: ResourceServiceConfig<T, C, U> & {
+    registrationData?: RegistrationDataFn<T>;
+}): Ctor<IResourceService<T, T, C, U>>;

package/security/create-auth-resources.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthModel = createAuthModel;
+exports.createAuthService = createAuthService;
+const common_1 = require("@appweaver/common");
+const helper_1 = require("./helper");
+const factory_1 = require("../factory");
+function createAuthModel(config) {
+    const authModelScalars = {
+        email: {
+            type: 'string',
+            unique: true,
+            maxLength: 255,
+            format: 'email'
+        },
+        passwordHash: {
+            type: 'string',
+            required: false,
+            hidden: true
+        },
+        verifiedEmail: {
+            type: 'boolean',
+            default: false
+        },
+        twoFactorAuth: {
+            type: 'enum',
+            values: ['None', 'Email'],
+            default: 'None'
+        },
+        enabled: {
+            type: 'boolean',
+            default: true
+        },
+        logoutAt: {
+            type: 'dateTime',
+            required: false
+        }
+    };
+    // Override email properties if already present in the model config
+    if (config.scalars?.email?.type === 'string') {
+        authModelScalars.email = {
+            ...authModelScalars.email,
+            ...config.scalars.email
+        };
+    }
+    const authModelVirtual = {
+        password: {
+            type: 'string',
+            required: true,
+            input: {
+                type: 'all'
+            },
+            output: {
+                type: 'none'
+            }
+        }
+    };
+    const authModelRelations = {
+        roles: {
+            model: 'Role',
+            array: true,
+            input: {
+                type: 'all'
+            },
+            output: {
+                type: 'always',
+                include: {
+                    permissions: {
+                        type: 'always'
+                    }
+                }
+            }
+        },
+        ...(common_1.config.SECURITY_API_KEY_ENABLED
+            ? {
+                apiKeys: {
+                    model: 'ApiKey',
+                    mappedBy: (0, common_1.uncapitalize)(config.name),
+                    array: true,
+                    input: {
+                        type: 'none'
+                    },
+                    output: {
+                        type: 'none'
+                    }
+                }
+            }
+            : {})
+    };
+    const authModelInputOmit = ['verifiedEmail', 'logoutAt'];
+    config.scalars = { ...config.scalars, ...authModelScalars };
+    config.virtual = { ...config.virtual, ...authModelVirtual };
+    config.relations = { ...config.relations, ...authModelRelations };
+    config.create = {
+        ...(config.create ?? {}),
+        omit: [...(config.create?.omit ?? []), ...authModelInputOmit]
+    };
+    config.update = {
+        ...(config.update ?? {}),
+        omit: [...(config.update?.omit ?? []), ...authModelInputOmit]
+    };
+    const model = (0, factory_1.createModel)(config);
+    model[common_1.RESOURCE_AUTH] = true;
+    return model;
+}
+function createAuthService(config) {
+    // Capture original functions to invoke after new auth logic
+    const beforeCreate = config.beforeCreate;
+    const beforeUpdate = config.beforeUpdate;
+    config.beforeCreate = async (data) => {
+        await (0, helper_1.updatePasswordHash)(data, data['password']);
+        await beforeCreate?.(data);
+    };
+    config.beforeUpdate = async (id, data) => {
+        await (0, helper_1.updatePasswordHash)(data, data['password'], true);
+        await beforeUpdate?.(id, data);
+    };
+    if (!config.registrationData) {
+        config.registrationData = (_, email, password) => {
+            return {
+                email,
+                password
+            };
+        };
+    }
+    const service = (0, factory_1.createService)(config);
+    service[common_1.RESOURCE_AUTH] = true;
+    return service;
+}