@bernierllc/auth-suite 1.0.0

package/dist/suite.js

@@ -0,0 +1,1145 @@
+"use strict";
+/*
+Copyright (c) 2025 Bernier LLC
+
+This file is licensed to the client under a limited-use license.
+The client may use and modify this code *only within the scope of the project it was delivered for*.
+Redistribution or use in other products or commercial offerings is not permitted without written consent from Bernier LLC.
+*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthSuite = void 0;
+const auth_service_1 = require("@bernierllc/auth-service");
+const logger_1 = require("@bernierllc/logger");
+const email_sender_1 = require("@bernierllc/email-sender");
+const crypto_utils_1 = require("@bernierllc/crypto-utils");
+const session_manager_1 = require("./managers/session-manager");
+const rbac_manager_1 = require("./managers/rbac-manager");
+const mfa_manager_1 = require("./managers/mfa-manager");
+const audit_manager_1 = require("./managers/audit-manager");
+/**
+ * Complete authentication suite providing comprehensive auth functionality
+ *
+ * Features:
+ * - Full authentication service capabilities
+ * - Enhanced session management with cleanup
+ * - Role-based access control (RBAC)
+ * - Multi-factor authentication (MFA)
+ * - Comprehensive audit logging
+ * - OAuth/SAML/LDAP integration support
+ * - Advanced security features
+ */
+class AuthSuite {
+    authService;
+    sessionManager;
+    rbacManager;
+    mfaManager;
+    auditManager;
+    logger;
+    config;
+    emailSender;
+    neverhubAdapter;
+    verificationTokens = new Map();
+    constructor(config) {
+        this.config = this.mergeWithDefaults(config);
+        this.logger = (0, logger_1.createLogger)({
+            level: logger_1.LogLevel.INFO,
+            context: { service: 'auth-suite' }
+        });
+        // Initialize core auth service
+        this.authService = new auth_service_1.AuthService(this.config);
+        // Initialize managers based on configuration
+        this.initializeManagers();
+        // Initialize email sender if configured
+        if (this.config.email?.enabled && this.config.email.provider) {
+            try {
+                this.emailSender = new email_sender_1.EmailSender(this.config.email.provider);
+                this.logger.info('Email sender initialized successfully');
+            }
+            catch (error) {
+                this.logger.warn('Failed to initialize email sender', { error });
+                if (this.config.email.fallback?.disableOnError) {
+                    this.config.email.enabled = false;
+                    this.logger.info('Email integration disabled due to initialization error');
+                }
+            }
+        }
+        // Initialize NeverHub adapter if configured
+        this.initializeNeverHub();
+        this.logger.info('AuthSuite initialized', {
+            features: {
+                sessions: !!this.config.sessions?.enabled,
+                rbac: !!this.config.rbac?.enabled,
+                mfa: !!this.config.mfaEnhanced?.enabled,
+                auditing: !!this.config.auditing?.enabled,
+                email: !!this.config.email?.enabled,
+                neverhub: !!this.neverhubAdapter
+            }
+        });
+    }
+    /**
+     * Register a new user with enhanced features
+     */
+    async register(credentials) {
+        try {
+            // Audit the registration attempt
+            await this.auditManager.log({
+                event: 'register_attempt',
+                level: 'info',
+                details: { email: credentials.email, username: credentials.username }
+            });
+            // Register user through auth service
+            const result = await this.authService.register(credentials);
+            if (result.success && result.user) {
+                // Create session if enabled
+                let session;
+                if (this.config.sessions?.enabled !== false) {
+                    session = await this.sessionManager.create(result.user.id, {
+                        registrationMethod: 'direct'
+                    });
+                }
+                // Assign default role if RBAC is enabled
+                if (this.config.rbac?.enabled && this.config.rbac.roles.length > 0) {
+                    const defaultRole = this.config.rbac.roles.find(r => r.name === 'user') || this.config.rbac.roles[0];
+                    await this.rbacManager.assignRole(result.user.id, defaultRole.name);
+                }
+                // Get user permissions
+                const permissions = this.config.rbac?.enabled
+                    ? await this.getUserPermissions(result.user.id)
+                    : [];
+                // Send verification email if email integration is enabled
+                let emailVerificationRequired = false;
+                let verificationTokenSent = false;
+                if (this.shouldSendVerificationEmail()) {
+                    try {
+                        const verificationSent = await this.sendVerificationEmail(result.user.id, credentials.email);
+                        emailVerificationRequired = this.config.email?.verification?.required ?? false;
+                        verificationTokenSent = verificationSent;
+                    }
+                    catch (error) {
+                        this.logger.warn('Failed to send verification email', { error, userId: result.user.id });
+                        // Handle email error gracefully
+                        if (this.config.email?.fallback?.disableOnError) {
+                            this.logger.info('Disabling email verification due to send error');
+                            emailVerificationRequired = false;
+                        }
+                    }
+                }
+                // Send welcome email if configured
+                if (this.shouldSendWelcomeEmail('registration')) {
+                    try {
+                        await this.sendWelcomeEmail(result.user.id, credentials.email, 'registration');
+                    }
+                    catch (error) {
+                        this.logger.warn('Failed to send welcome email', { error, userId: result.user.id });
+                    }
+                }
+                // Audit successful registration
+                await this.auditManager.log({
+                    userId: result.user.id,
+                    sessionId: session?.sessionId,
+                    event: 'register',
+                    level: 'info',
+                    details: {
+                        email: credentials.email,
+                        emailVerificationRequired,
+                        verificationTokenSent
+                    }
+                });
+                return {
+                    ...result,
+                    session,
+                    permissions,
+                    emailVerificationRequired,
+                    verificationTokenSent
+                };
+            }
+            // Audit failed registration
+            await this.auditManager.log({
+                event: 'register_failed',
+                level: 'warn',
+                details: { email: credentials.email, error: result.error }
+            });
+            return result;
+        }
+        catch (error) {
+            this.logger.error('Registration error', error instanceof Error ? error : undefined);
+            await this.auditManager.log({
+                event: 'register_error',
+                level: 'error',
+                details: { error: error instanceof Error ? error.message : String(error) }
+            });
+            return {
+                success: false,
+                error: 'Registration failed due to internal error'
+            };
+        }
+    }
+    /**
+     * Login user with enhanced security features
+     */
+    async login(credentials) {
+        try {
+            // Audit login attempt
+            await this.auditManager.log({
+                event: 'login_attempt',
+                level: 'info',
+                details: { identifier: credentials.email || credentials.username }
+            });
+            // Attempt authentication
+            const result = await this.authService.login(credentials);
+            if (result.success && result.user) {
+                // Check if MFA is required
+                const mfaRequired = this.config.mfaEnhanced?.enabled && await this.isMfaRequired(result.user.id);
+                if (mfaRequired) {
+                    // Generate MFA challenge
+                    const mfaChallenge = await this.mfaManager.generateChallenge(result.user.id);
+                    await this.auditManager.log({
+                        userId: result.user.id,
+                        event: 'mfa_required',
+                        level: 'info',
+                        details: { challengeType: mfaChallenge.type }
+                    });
+                    return {
+                        ...result,
+                        mfaRequired: true,
+                        mfaChallenge
+                    };
+                }
+                // Complete login process
+                return await this.completeLogin(result);
+            }
+            // Audit failed login
+            await this.auditManager.log({
+                event: 'login_failed',
+                level: 'warn',
+                details: {
+                    identifier: credentials.email || credentials.username,
+                    error: result.error
+                }
+            });
+            return result;
+        }
+        catch (error) {
+            this.logger.error('Login error', error instanceof Error ? error : undefined);
+            await this.auditManager.log({
+                event: 'login_error',
+                level: 'error',
+                details: { error: error instanceof Error ? error.message : String(error) }
+            });
+            return {
+                success: false,
+                error: 'Login failed due to internal error'
+            };
+        }
+    }
+    /**
+     * Complete MFA verification and finish login
+     */
+    async completeMfaLogin(challengeId, response) {
+        try {
+            const verified = await this.mfaManager.verifyChallenge(challengeId, response);
+            if (!verified) {
+                await this.auditManager.log({
+                    event: 'mfa_failed',
+                    level: 'warn',
+                    details: { challengeId }
+                });
+                return {
+                    success: false,
+                    error: 'Invalid MFA code'
+                };
+            }
+            // Get user from challenge (implementation depends on MFA manager)
+            // For now, return success - this would need proper user retrieval
+            await this.auditManager.log({
+                event: 'mfa_success',
+                level: 'info',
+                details: { challengeId }
+            });
+            return {
+                success: true,
+                user: {}, // Would retrieve actual user
+                token: '', // Would generate actual token
+                refreshToken: ''
+            };
+        }
+        catch (error) {
+            this.logger.error('MFA completion error', error instanceof Error ? error : undefined);
+            return {
+                success: false,
+                error: 'MFA verification failed'
+            };
+        }
+    }
+    /**
+     * Verify token with enhanced session management
+     */
+    async verifyToken(token) {
+        try {
+            const user = await this.authService.verifyToken(token);
+            if (user && this.config.sessions?.enabled !== false) {
+                // Update session last accessed time
+                // Note: This would require session ID from token or separate lookup
+            }
+            return user;
+        }
+        catch (error) {
+            this.logger.error('Token verification error', error instanceof Error ? error : undefined);
+            return null;
+        }
+    }
+    /**
+     * Check user permission with RBAC
+     */
+    async checkPermission(check) {
+        if (!this.config.rbac?.enabled) {
+            return { allowed: true, reason: 'RBAC disabled' };
+        }
+        try {
+            return await this.rbacManager.checkPermission(check);
+        }
+        catch (error) {
+            this.logger.error('Permission check error', error instanceof Error ? error : undefined);
+            return { allowed: false, reason: 'Permission check failed' };
+        }
+    }
+    /**
+     * Get user roles
+     */
+    async getUserRoles(userId) {
+        if (!this.config.rbac?.enabled) {
+            return [];
+        }
+        try {
+            return await this.rbacManager.getUserRoles(userId);
+        }
+        catch (error) {
+            this.logger.error('Get user roles error', error instanceof Error ? error : undefined);
+            return [];
+        }
+    }
+    /**
+     * Get user permissions (all permissions from all roles)
+     */
+    async getUserPermissions(userId) {
+        if (!this.config.rbac?.enabled) {
+            return [];
+        }
+        try {
+            const roles = await this.rbacManager.getUserRoles(userId);
+            const permissionSets = await Promise.all(roles.map(role => this.rbacManager.getRolePermissions(role)));
+            // Flatten and deduplicate permissions
+            return [...new Set(permissionSets.flat())];
+        }
+        catch (error) {
+            this.logger.error('Get user permissions error', error instanceof Error ? error : undefined);
+            return [];
+        }
+    }
+    /**
+     * Logout user and cleanup session
+     */
+    async logout(sessionId) {
+        try {
+            if (sessionId && this.config.sessions?.enabled !== false) {
+                const destroyed = await this.sessionManager.destroy(sessionId);
+                await this.auditManager.log({
+                    sessionId,
+                    event: 'logout',
+                    level: 'info',
+                    details: { sessionDestroyed: destroyed }
+                });
+            }
+            return { success: true };
+        }
+        catch (error) {
+            this.logger.error('Logout error', error instanceof Error ? error : undefined);
+            return { success: false };
+        }
+    }
+    /**
+     * Setup MFA for user
+     */
+    async setupMfa(userId, type) {
+        if (!this.config.mfaEnhanced?.enabled) {
+            throw new Error('MFA is not enabled');
+        }
+        try {
+            const result = await this.mfaManager.setupMfa(userId, type);
+            await this.auditManager.log({
+                userId,
+                event: 'mfa_setup',
+                level: 'info',
+                details: { type }
+            });
+            return result;
+        }
+        catch (error) {
+            this.logger.error('MFA setup error', error instanceof Error ? error : undefined);
+            throw error;
+        }
+    }
+    /**
+     * Get audit logs with filtering
+     */
+    async getAuditLogs(filters) {
+        if (!this.config.auditing?.enabled) {
+            return [];
+        }
+        try {
+            return await this.auditManager.query(filters);
+        }
+        catch (error) {
+            this.logger.error('Get audit logs error', error instanceof Error ? error : undefined);
+            return [];
+        }
+    }
+    /**
+     * Cleanup expired sessions and audit logs
+     */
+    async cleanup() {
+        try {
+            const sessionsCleaned = this.config.sessions?.enabled !== false
+                ? await this.sessionManager.cleanup()
+                : 0;
+            const auditLogsCleaned = this.config.auditing?.enabled && this.config.auditing.retention?.days
+                ? await this.auditManager.cleanup(this.config.auditing.retention.days)
+                : 0;
+            this.logger.info('Cleanup completed', { sessionsCleaned, auditLogsCleaned });
+            return { sessions: sessionsCleaned, auditLogs: auditLogsCleaned };
+        }
+        catch (error) {
+            this.logger.error('Cleanup error', error instanceof Error ? error : undefined);
+            return { sessions: 0, auditLogs: 0 };
+        }
+    }
+    /**
+     * Send verification email to user
+     */
+    async sendVerificationEmail(userId, email) {
+        if (!this.emailSender)
+            return false;
+        try {
+            // Generate verification token
+            const token = await (0, crypto_utils_1.generateSessionToken)();
+            const expiryHours = this.config.email?.verification?.tokenExpiry ?? 24;
+            const expiresAt = new Date(Date.now() + expiryHours * 60 * 60 * 1000);
+            // Store token for verification
+            this.verificationTokens.set(token, {
+                userId,
+                token,
+                expiresAt,
+                type: 'verification'
+            });
+            // Get template configuration with enhanced defaults
+            const template = this.config.email?.templates?.verification;
+            const defaultSubject = 'Verify your email address';
+            const defaultHtmlContent = `
+        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
+          <h1 style="color: #333;">Email Verification Required</h1>
+          <p>Hello,</p>
+          <p>Please verify your email address by clicking the button below:</p>
+          <div style="text-align: center; margin: 20px 0;">
+            <a href="{{verificationUrl}}" 
+               style="background-color: #007bff; color: white; padding: 12px 24px; 
+                      text-decoration: none; border-radius: 4px; display: inline-block;">
+              Verify Email Address
+            </a>
+          </div>
+          <p>Or copy and paste this link into your browser:</p>
+          <p style="word-break: break-all; color: #666;">{{verificationUrl}}</p>
+          <p><strong>This link will expire in {{expiryHours}} hours.</strong></p>
+          <hr style="margin: 20px 0; border: none; border-top: 1px solid #eee;">
+          <p style="font-size: 12px; color: #666;">
+            If you didn't create an account, you can safely ignore this email.
+          </p>
+        </div>
+      `;
+            // Build template variables
+            const verificationUrl = this.buildVerificationUrl(token);
+            const templateVariables = {
+                verificationUrl,
+                expiryHours: expiryHours.toString(),
+                userId,
+                email,
+                ...template?.customVariables
+            };
+            // Process template content
+            const subject = this.processTemplate(template?.subject || defaultSubject, templateVariables);
+            const htmlContent = this.processTemplate(template?.htmlContent || defaultHtmlContent, templateVariables);
+            const textContent = template?.textContent ?
+                this.processTemplate(template.textContent, templateVariables) :
+                `Please verify your email address by visiting: ${verificationUrl} (expires in ${expiryHours} hours)`;
+            // Prepare email message with template overrides
+            const emailMessage = {
+                toEmail: email,
+                subject,
+                htmlContent,
+                textContent,
+                fromName: template?.fromName,
+                fromEmail: template?.fromEmail,
+                replyTo: template?.replyTo
+            };
+            // Send email with NeverHub integration and fallback logic
+            const result = await this.sendEmailWithNeverHubFallback(emailMessage, 'verification');
+            if (result.success) {
+                this.logger.info('Verification email sent successfully', {
+                    userId,
+                    email,
+                    tokenExpiry: expiresAt.toISOString()
+                });
+                return true;
+            }
+            else {
+                this.logger.error('Failed to send verification email', undefined, {
+                    userId,
+                    email,
+                    errorMessage: result.errorMessage
+                });
+                return false;
+            }
+        }
+        catch (error) {
+            this.logger.error('Error sending verification email', error instanceof Error ? error : undefined, { userId, email });
+            return false;
+        }
+    }
+    /**
+     * Manually send verification email to a user
+     */
+    async sendVerificationEmailManually(userId, email) {
+        if (!this.config.email?.enabled) {
+            return { success: false, error: 'Email functionality is disabled' };
+        }
+        if (!this.config.email.verification?.enabled) {
+            return { success: false, error: 'Email verification is disabled' };
+        }
+        if (!this.emailSender) {
+            return { success: false, error: 'Email sender not configured' };
+        }
+        try {
+            await this.auditManager.log({
+                userId,
+                event: 'manual_verification_email_sent',
+                level: 'info',
+                details: { email }
+            });
+            const result = await this.sendVerificationEmail(userId, email);
+            return { success: result };
+        }
+        catch (error) {
+            this.logger.error('Error sending manual verification email', error instanceof Error ? error : undefined, { userId, email });
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : 'Unknown error'
+            };
+        }
+    }
+    /**
+     * Get email configuration status
+     */
+    getEmailConfiguration() {
+        return {
+            enabled: this.config.email?.enabled ?? false,
+            verification: {
+                enabled: this.config.email?.verification?.enabled ?? false,
+                required: this.config.email?.verification?.required ?? false,
+                automaticSend: this.config.email?.verification?.automaticSend ?? false
+            },
+            welcome: {
+                enabled: this.config.email?.welcome?.enabled ?? false,
+                sendOnRegistration: this.config.email?.welcome?.sendOnRegistration ?? false,
+                sendOnFirstLogin: this.config.email?.welcome?.sendOnFirstLogin ?? false
+            },
+            passwordReset: {
+                enabled: this.config.email?.passwordReset?.enabled ?? false
+            },
+            providerConfigured: !!this.emailSender,
+            neverhub: {
+                enabled: this.config.email?.neverhub?.enabled ?? false,
+                available: !!this.neverhubAdapter,
+                overrideDirect: this.config.email?.neverhub?.overrideDirect ?? false,
+                fallbackToDirect: this.config.email?.neverhub?.fallbackToDirect ?? true,
+                serviceName: this.config.email?.neverhub?.serviceName ?? 'email'
+            }
+        };
+    }
+    /**
+     * Verify user email with token
+     */
+    async verifyEmail(token) {
+        const tokenData = this.verificationTokens.get(token);
+        if (!tokenData) {
+            return {
+                success: false,
+                error: 'Invalid verification token'
+            };
+        }
+        if (tokenData.expiresAt < new Date()) {
+            this.verificationTokens.delete(token);
+            return {
+                success: false,
+                error: 'Verification token has expired'
+            };
+        }
+        if (tokenData.type !== 'verification') {
+            return {
+                success: false,
+                error: 'Invalid token type'
+            };
+        }
+        try {
+            // Mark user as verified (this would depend on your user storage implementation)
+            // For now, we'll just return success
+            this.verificationTokens.delete(token);
+            await this.auditManager.log({
+                userId: tokenData.userId,
+                event: 'email_verified',
+                level: 'info',
+                details: { token: token.substring(0, 8) + '...' }
+            });
+            return {
+                success: true,
+                verified: true
+            };
+        }
+        catch (err) {
+            this.logger.error('Email verification error', err instanceof Error ? err : new Error(String(err)), { userId: tokenData.userId });
+            return {
+                success: false,
+                error: 'Email verification failed'
+            };
+        }
+    }
+    /**
+     * Send password reset email
+     */
+    async sendPasswordResetEmail(email) {
+        if (!this.emailSender) {
+            return { success: false, error: 'Email functionality not configured' };
+        }
+        try {
+            // This would typically look up user by email first
+            // For now, we'll generate a reset token
+            const token = await (0, crypto_utils_1.generateSessionToken)();
+            const expiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
+            // Store token for password reset
+            this.verificationTokens.set(token, {
+                userId: 'unknown', // Would be actual user ID
+                token,
+                expiresAt,
+                type: 'password_reset'
+            });
+            // Get template configuration
+            const template = this.config.email?.templates?.passwordReset;
+            const subject = template?.subject || 'Reset your password';
+            const htmlContent = template?.htmlContent || `
+        <h1>Password Reset</h1>
+        <p>Click the link below to reset your password:</p>
+        <a href="{{resetUrl}}">Reset Password</a>
+        <p>This link will expire in 1 hour.</p>
+      `;
+            // Prepare email message
+            const emailMessage = {
+                toEmail: email,
+                subject,
+                htmlContent: htmlContent.replace('{{resetUrl}}', `${this.config.email?.provider?.endpoint || ''}/reset?token=${token}`),
+                textContent: template?.textContent
+            };
+            // Send email
+            const result = await this.emailSender.sendEmail(emailMessage);
+            if (result.success) {
+                this.logger.info('Password reset email sent', { email });
+                await this.auditManager.log({
+                    event: 'password_reset_requested',
+                    level: 'info',
+                    details: { email }
+                });
+                return { success: true };
+            }
+            else {
+                this.logger.error('Failed to send password reset email', undefined, { emailAddress: email, errorMessage: result.errorMessage });
+                return { success: false, error: result.errorMessage };
+            }
+        }
+        catch (err) {
+            this.logger.error('Error sending password reset email', err instanceof Error ? err : new Error(String(err)), { emailAddress: email });
+            return { success: false, error: 'Failed to send password reset email' };
+        }
+    }
+    // Private methods
+    mergeWithDefaults(config) {
+        return {
+            ...config,
+            sessions: {
+                enabled: true,
+                storage: 'memory',
+                cleanup: {
+                    enabled: true,
+                    intervalMs: 60000, // 1 minute
+                    maxIdleMs: 24 * 60 * 60 * 1000 // 24 hours
+                },
+                persistence: {
+                    enabled: false,
+                    ttl: 7 * 24 * 60 * 60 * 1000 // 7 days
+                },
+                ...config.sessions
+            },
+            rbac: {
+                enabled: false,
+                roles: [],
+                permissions: [],
+                hierarchical: false,
+                ...config.rbac
+            },
+            mfaEnhanced: {
+                enabled: false,
+                providers: [],
+                requirements: [],
+                backup: {
+                    enabled: true,
+                    codeCount: 10,
+                    codeLength: 8
+                },
+                ...config.mfaEnhanced
+            },
+            auditing: {
+                enabled: true,
+                events: [{
+                        type: 'login',
+                        level: 'info',
+                        includeMetadata: true
+                    }, {
+                        type: 'logout',
+                        level: 'info',
+                        includeMetadata: true
+                    }, {
+                        type: 'register',
+                        level: 'info',
+                        includeMetadata: true
+                    }, {
+                        type: 'password_change',
+                        level: 'info',
+                        includeMetadata: true
+                    }],
+                storage: 'file',
+                retention: {
+                    days: 90,
+                    maxSize: '100MB'
+                },
+                ...config.auditing
+            },
+            email: config.email ? {
+                enabled: config.email.enabled || false,
+                provider: config.email.provider,
+                neverhub: {
+                    enabled: false,
+                    serviceName: 'email',
+                    overrideDirect: true,
+                    fallbackToDirect: true,
+                    timeout: 5000,
+                    ...config.email.neverhub
+                },
+                verification: {
+                    enabled: true,
+                    required: false,
+                    tokenExpiry: 24,
+                    automaticSend: true,
+                    ...config.email.verification
+                },
+                passwordReset: {
+                    enabled: true,
+                    tokenExpiry: 1,
+                    ...config.email.passwordReset
+                },
+                welcome: {
+                    enabled: false,
+                    sendOnRegistration: false,
+                    sendOnFirstLogin: false,
+                    ...config.email.welcome
+                },
+                templates: {
+                    verification: {
+                        subject: 'Verify your email address',
+                        htmlContent: '<h1>Email Verification</h1><p>Please verify your email address by clicking the link: {{verificationUrl}}</p>',
+                        textContent: 'Please verify your email address by visiting: {{verificationUrl}}'
+                    },
+                    passwordReset: {
+                        subject: 'Reset your password',
+                        htmlContent: '<h1>Password Reset</h1><p>Click the link to reset your password: {{resetUrl}}</p>',
+                        textContent: 'Click the link to reset your password: {{resetUrl}}'
+                    },
+                    welcome: {
+                        subject: 'Welcome!',
+                        htmlContent: '<h1>Welcome</h1><p>Thank you for joining us!</p>',
+                        textContent: 'Welcome! Thank you for joining us!'
+                    },
+                    ...config.email.templates
+                },
+                fallback: {
+                    disableOnError: false,
+                    retryAttempts: 3,
+                    ...config.email.fallback
+                }
+            } : undefined
+        };
+    }
+    /**
+     * Initialize NeverHub adapter if configured and available
+     */
+    async initializeNeverHub() {
+        if (!this.config.email?.neverhub?.enabled) {
+            return;
+        }
+        try {
+            // Try to dynamically import NeverHub adapter
+            // eslint-disable-next-line @typescript-eslint/no-require-imports
+            const neverhubModule = await Promise.resolve(`${'@bernierllc/neverhub-adapter'}`).then(s => __importStar(require(s))).catch(() => null);
+            if (!neverhubModule) {
+                this.logger.info('NeverHub adapter not available, using direct email integration only');
+                return;
+            }
+            const { NeverHubAdapter: Adapter } = neverhubModule;
+            // Check if NeverHub is available
+            if (await Adapter.detect()) {
+                this.neverhubAdapter = new Adapter();
+                // Register with NeverHub
+                await this.neverhubAdapter.register({
+                    type: 'auth-service',
+                    name: '@bernierllc/auth-suite',
+                    version: '1.0.0',
+                    capabilities: [
+                        { type: 'email', name: 'email-sending', version: '1.0.0' }
+                    ],
+                    dependencies: [this.config.email.neverhub.serviceName || 'email']
+                });
+                this.logger.info('NeverHub adapter initialized successfully for auth-suite', {
+                    serviceName: this.config.email.neverhub.serviceName || 'email'
+                });
+            }
+            else {
+                this.logger.info('NeverHub not available, using direct email integration only');
+            }
+        }
+        catch (error) {
+            this.logger.warn('Failed to initialize NeverHub adapter', { error });
+            if (!this.config.email.neverhub.fallbackToDirect) {
+                this.logger.warn('NeverHub fallback disabled, email functionality may be limited');
+            }
+        }
+    }
+    initializeManagers() {
+        // Initialize session manager
+        this.sessionManager = new session_manager_1.MemorySessionManager(this.config.sessions || {});
+        // Initialize RBAC manager
+        this.rbacManager = new rbac_manager_1.BasicRBACManager(this.config.rbac || { enabled: false, roles: [], permissions: [], hierarchical: false });
+        // Initialize MFA manager
+        this.mfaManager = new mfa_manager_1.TOTPMfaManager(this.config.mfaEnhanced || { enabled: false, providers: [], requirements: [], backup: { enabled: false, codeCount: 0, codeLength: 0 } });
+        // Initialize audit manager
+        this.auditManager = new audit_manager_1.FileAuditManager(this.config.auditing || { enabled: false, events: [], storage: 'file', retention: { days: 0, maxSize: '' } });
+    }
+    async completeLogin(result) {
+        // Create session
+        let session;
+        if (this.config.sessions?.enabled !== false) {
+            session = await this.sessionManager.create(result.user.id, {
+                loginMethod: 'password'
+            });
+        }
+        // Get permissions
+        const permissions = this.config.rbac?.enabled
+            ? await this.getUserPermissions(result.user.id)
+            : [];
+        // Send welcome email if configured for first login
+        if (this.shouldSendWelcomeEmail('login')) {
+            try {
+                await this.sendWelcomeEmail(result.user.id, result.user.email, 'login');
+            }
+            catch (error) {
+                this.logger.warn('Failed to send welcome email on login', { error, userId: result.user.id });
+            }
+        }
+        // Audit successful login
+        await this.auditManager.log({
+            userId: result.user.id,
+            sessionId: session?.sessionId,
+            event: 'login',
+            level: 'info',
+            details: { method: 'password' }
+        });
+        return {
+            ...result,
+            session,
+            permissions
+        };
+    }
+    async isMfaRequired(userId) {
+        // Check MFA requirements based on configuration
+        // This is a simplified implementation
+        return this.config.mfaEnhanced?.requirements.some(req => req.trigger === 'login') || false;
+    }
+    /**
+     * Check if verification email should be sent
+     */
+    shouldSendVerificationEmail() {
+        return !!(this.emailSender &&
+            this.config.email?.enabled &&
+            this.config.email.verification?.enabled !== false &&
+            this.config.email.verification?.automaticSend !== false);
+    }
+    /**
+     * Check if welcome email should be sent
+     */
+    shouldSendWelcomeEmail(trigger) {
+        if (!this.emailSender || !this.config.email?.enabled || !this.config.email.welcome?.enabled) {
+            return false;
+        }
+        if (trigger === 'registration') {
+            return this.config.email.welcome.sendOnRegistration !== false;
+        }
+        if (trigger === 'login') {
+            return this.config.email.welcome.sendOnFirstLogin === true;
+        }
+        return false;
+    }
+    /**
+     * Build verification URL with token
+     */
+    buildVerificationUrl(token) {
+        const baseUrl = this.config.email?.provider?.endpoint || 'https://example.com';
+        return `${baseUrl}/verify?token=${token}`;
+    }
+    /**
+     * Process template variables in content
+     */
+    processTemplate(content, variables) {
+        let processed = content;
+        Object.entries(variables).forEach(([key, value]) => {
+            const pattern = new RegExp(`{{${key}}}`, 'g');
+            processed = processed.replace(pattern, value || '');
+        });
+        return processed;
+    }
+    /**
+     * Send email with NeverHub integration and fallback logic
+     */
+    async sendEmailWithNeverHubFallback(emailMessage, type) {
+        // Check if NeverHub should be used
+        if (this.shouldUseNeverHub()) {
+            try {
+                this.logger.debug('Attempting to send email via NeverHub', { type, toEmail: emailMessage.toEmail });
+                const neverhubResult = await this.sendEmailViaNeverHub(emailMessage, type);
+                if (neverhubResult.success) {
+                    this.logger.info('Email sent successfully via NeverHub', { type, method: 'neverhub' });
+                    return { ...neverhubResult, method: 'neverhub' };
+                }
+                else {
+                    this.logger.warn('NeverHub email sending failed', {
+                        type,
+                        error: neverhubResult.errorMessage,
+                        fallbackEnabled: this.config.email?.neverhub?.fallbackToDirect
+                    });
+                    // Fall back to direct email if configured
+                    if (this.config.email?.neverhub?.fallbackToDirect && this.emailSender) {
+                        this.logger.info('Falling back to direct email sending', { type });
+                        return this.sendEmailWithRetry(emailMessage, type);
+                    }
+                    else {
+                        return neverhubResult;
+                    }
+                }
+            }
+            catch (err) {
+                this.logger.error('Error sending email via NeverHub', err instanceof Error ? err : new Error(String(err)), { emailType: type });
+                // Fall back to direct email if configured
+                if (this.config.email?.neverhub?.fallbackToDirect && this.emailSender) {
+                    this.logger.info('Falling back to direct email due to NeverHub error', { type });
+                    return this.sendEmailWithRetry(emailMessage, type);
+                }
+                else {
+                    return {
+                        success: false,
+                        errorMessage: err instanceof Error ? err.message : 'NeverHub email error'
+                    };
+                }
+            }
+        }
+        // Use direct email sending
+        if (this.emailSender) {
+            return this.sendEmailWithRetry(emailMessage, type);
+        }
+        return { success: false, errorMessage: 'No email sending method available' };
+    }
+    /**
+     * Send email via NeverHub service discovery
+     */
+    async sendEmailViaNeverHub(emailMessage, type) {
+        if (!this.neverhubAdapter) {
+            return { success: false, errorMessage: 'NeverHub adapter not initialized' };
+        }
+        try {
+            const serviceName = this.config.email?.neverhub?.serviceName || 'email';
+            const timeout = this.config.email?.neverhub?.timeout || 5000;
+            // Get email service from NeverHub
+            const emailService = await this.neverhubAdapter.getService(serviceName);
+            if (!emailService) {
+                return { success: false, errorMessage: `Email service '${serviceName}' not found in NeverHub` };
+            }
+            // Send email message via NeverHub
+            const result = await Promise.race([
+                this.neverhubAdapter.publishEvent({
+                    type: 'email.send',
+                    data: {
+                        ...emailMessage,
+                        metadata: {
+                            source: 'auth-suite',
+                            emailType: type,
+                            timestamp: new Date().toISOString()
+                        }
+                    },
+                    targetService: serviceName
+                }),
+                new Promise((_, reject) => setTimeout(() => reject(new Error('NeverHub email timeout')), timeout))
+            ]);
+            return { success: true };
+        }
+        catch (error) {
+            return {
+                success: false,
+                errorMessage: error instanceof Error ? error.message : 'NeverHub communication error'
+            };
+        }
+    }
+    /**
+     * Check if NeverHub should be used for email sending
+     */
+    shouldUseNeverHub() {
+        return !!(this.neverhubAdapter &&
+            this.config.email?.neverhub?.enabled &&
+            this.config.email.neverhub.overrideDirect);
+    }
+    /**
+     * Send email with retry logic
+     */
+    async sendEmailWithRetry(emailMessage, type) {
+        const maxRetries = this.config.email?.fallback?.retryAttempts ?? 3;
+        let lastError;
+        for (let attempt = 1; attempt <= maxRetries; attempt++) {
+            try {
+                const result = await this.emailSender.sendEmail(emailMessage);
+                if (result.success) {
+                    if (attempt > 1) {
+                        this.logger.info(`Email sent successfully on attempt ${attempt}`, { type });
+                    }
+                    return { ...result, method: 'direct' };
+                }
+                else {
+                    lastError = result.errorMessage;
+                    if (attempt < maxRetries) {
+                        this.logger.warn(`Email send attempt ${attempt} failed, retrying...`, {
+                            type,
+                            error: result.errorMessage
+                        });
+                        await new Promise(resolve => setTimeout(resolve, 1000 * attempt)); // Exponential backoff
+                    }
+                }
+            }
+            catch (error) {
+                lastError = error instanceof Error ? error.message : String(error);
+                if (attempt < maxRetries) {
+                    this.logger.warn(`Email send attempt ${attempt} error, retrying...`, { type, error });
+                    await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
+                }
+            }
+        }
+        this.logger.error(`Failed to send email after ${maxRetries} attempts`, undefined, { emailType: type, lastError });
+        return { success: false, errorMessage: lastError, method: 'direct' };
+    }
+    /**
+     * Send welcome email to user
+     */
+    async sendWelcomeEmail(userId, email, trigger) {
+        if (!this.emailSender)
+            return false;
+        try {
+            const template = this.config.email?.templates?.welcome;
+            const defaultSubject = 'Welcome to our platform!';
+            const defaultHtmlContent = `
+        <div style="font-family: Arial, sans-serif; max-width: 600px; margin: 0 auto;">
+          <h1 style="color: #333;">Welcome!</h1>
+          <p>Thank you for joining our platform. We're excited to have you on board!</p>
+          <p>If you have any questions, feel free to reach out to our support team.</p>
+          <p>Best regards,<br>The Team</p>
+        </div>
+      `;
+            const templateVariables = {
+                userId,
+                email,
+                trigger,
+                ...template?.customVariables
+            };
+            const subject = this.processTemplate(template?.subject || defaultSubject, templateVariables);
+            const htmlContent = this.processTemplate(template?.htmlContent || defaultHtmlContent, templateVariables);
+            const textContent = template?.textContent ?
+                this.processTemplate(template.textContent, templateVariables) :
+                'Welcome to our platform! Thank you for joining us.';
+            const emailMessage = {
+                toEmail: email,
+                subject,
+                htmlContent,
+                textContent,
+                fromName: template?.fromName,
+                fromEmail: template?.fromEmail,
+                replyTo: template?.replyTo
+            };
+            const result = await this.sendEmailWithNeverHubFallback(emailMessage, 'welcome');
+            if (result.success) {
+                this.logger.info('Welcome email sent successfully', { userIdValue: userId, emailAddress: email, triggerType: trigger });
+                return true;
+            }
+            else {
+                this.logger.error('Failed to send welcome email', undefined, { userIdValue: userId, emailAddress: email, errorMessage: result.errorMessage });
+                return false;
+            }
+        }
+        catch (err) {
+            this.logger.error('Error sending welcome email', err instanceof Error ? err : new Error(String(err)), { userIdValue: userId, emailAddress: email });
+            return false;
+        }
+    }
+}
+exports.AuthSuite = AuthSuite;
+//# sourceMappingURL=suite.js.map