@casual-simulation/aux-records 3.4.6-alpha.14668890889 → 3.5.0-alpha.15119114602

package/AuthController.js

@@ -4,34 +4,13 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
 import { v4 as uuid } from 'uuid';
 import { randomBytes } from 'tweetnacl';
 import { hashHighEntropyPasswordWithSalt, hashLowEntropyPasswordWithSalt, verifyPasswordAgainstHashes, } from './InstrumentedHashHelpers';
 import { fromByteArray } from 'base64-js';
 import { cleanupObject, isActiveSubscription, isStringValid } from './Utils';
-import { formatV1ConnectionKey, formatV1SessionKey, isSuperUserRole, parseSessionKey, verifyConnectionToken, } from './AuthUtils';
 import { randomCode } from './CryptoUtils';
-import { parseConnectionToken } from '@casual-simulation/aux-common';
+import { parseConnectionToken, formatV1ConnectionKey, formatV1SessionKey, isSuperUserRole, parseSessionKey, verifyConnectionToken, } from '@casual-simulation/aux-common';
 import { DateTime } from 'luxon';
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse, } from '@simplewebauthn/server';
 import { base64URLStringToBuffer, bufferToBase64URLString, } from './Base64UrlUtils';
@@ -135,2191 +114,2176 @@ export class AuthController {
     set privoEnabled(value) {
         this._privoEnabled = value;
     }
-    createAccount(request) {
+    async createAccount(request) {
         var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const createSession = (_a = request.createSession) !== null && _a !== void 0 ? _a : true;
-                if (!isSuperUserRole(request.userRole)) {
-                    return {
-                        success: false,
-                        errorCode: 'not_authorized',
-                        errorMessage: 'You are not authorized to perform this action.',
-                    };
-                }
-                const newUser = {
-                    id: uuid(),
-                    email: null,
-                    phoneNumber: null,
-                    allSessionRevokeTimeMs: null,
-                    currentLoginRequestId: null,
-                };
-                const result = yield this._store.saveNewUser(newUser);
-                if (result.success === false) {
-                    return result;
-                }
-                if (createSession) {
-                    const { info } = yield this._issueSession({
-                        userId: newUser.id,
-                        lifetimeMs: null,
-                        ipAddress: request.ipAddress,
-                        revocable: false,
-                    });
-                    return Object.assign({ success: true }, info);
-                }
-                else {
-                    return {
-                        success: true,
-                        userId: newUser.id,
-                        sessionKey: null,
-                        connectionKey: null,
-                        expireTimeMs: null,
-                        metadata: {
-                            hasUserAuthenticator: false,
-                            userAuthenticatorCredentialIds: [],
-                            hasPushSubscription: false,
-                            pushSubscriptionIds: [],
-                        },
-                    };
-                }
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error occurred while creating account', err);
+        try {
+            const createSession = (_a = request.createSession) !== null && _a !== void 0 ? _a : true;
+            if (!isSuperUserRole(request.userRole)) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_authorized',
+                    errorMessage: 'You are not authorized to perform this action.',
                 };
             }
-        });
-    }
-    issueSession(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (request.requestingUserRole !== 'system') {
-                    return {
-                        success: false,
-                        errorCode: 'not_authorized',
-                        errorMessage: 'You are not authorized to perform this action.',
-                    };
-                }
-                const lifetimeMs = request.lifetimeMs === undefined
-                    ? SESSION_LIFETIME_MS
-                    : request.lifetimeMs;
-                const { info } = yield this._issueSession({
-                    userId: request.userId,
-                    lifetimeMs,
+            const newUser = {
+                id: uuid(),
+                email: null,
+                phoneNumber: null,
+                allSessionRevokeTimeMs: null,
+                currentLoginRequestId: null,
+            };
+            const result = await this._store.saveNewUser(newUser);
+            if (result.success === false) {
+                return result;
+            }
+            if (createSession) {
+                const { info } = await this._issueSession({
+                    userId: newUser.id,
+                    lifetimeMs: null,
                     ipAddress: request.ipAddress,
+                    revocable: false,
                 });
-                return Object.assign({ success: true }, info);
+                return {
+                    success: true,
+                    ...info,
+                };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error occurred while issuing session', err);
+            else {
                 return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    success: true,
+                    userId: newUser.id,
+                    sessionKey: null,
+                    connectionKey: null,
+                    expireTimeMs: null,
+                    metadata: {
+                        hasUserAuthenticator: false,
+                        userAuthenticatorCredentialIds: [],
+                        hasPushSubscription: false,
+                        pushSubscriptionIds: [],
+                    },
                 };
             }
-        });
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error occurred while creating account', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async issueSession(request) {
+        try {
+            if (request.requestingUserRole !== 'system') {
+                return {
+                    success: false,
+                    errorCode: 'not_authorized',
+                    errorMessage: 'You are not authorized to perform this action.',
+                };
+            }
+            const lifetimeMs = request.lifetimeMs === undefined
+                ? SESSION_LIFETIME_MS
+                : request.lifetimeMs;
+            const { info } = await this._issueSession({
+                userId: request.userId,
+                lifetimeMs,
+                ipAddress: request.ipAddress,
+            });
+            return {
+                success: true,
+                ...info,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error occurred while issuing session', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     _hashHighEntropyPasswordWithSalt(sessionSecret, sessionId) {
         return hashHighEntropyPasswordWithSalt(sessionSecret, sessionId);
     }
-    requestLogin(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof request.address !== 'string' || request.address === '') {
+    async requestLogin(request) {
+        if (typeof request.address !== 'string' || request.address === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_address',
+                errorMessage: 'The given address is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.addressType !== 'string' ||
+            !(request.addressType === 'email' ||
+                request.addressType === 'phone')) {
+            return {
+                success: false,
+                errorCode: 'unacceptable_address_type',
+                errorMessage: 'The given address type is invalid. It must be a string containing either "email" or "phone".',
+            };
+        }
+        else if (typeof request.ipAddress !== 'string' ||
+            request.ipAddress === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_ip_address',
+                errorMessage: 'The given IP address is invalid. It must be a string.',
+            };
+        }
+        if (request.addressType === 'email') {
+            if (request.address.length > MAX_EMAIL_ADDRESS_LENGTH) {
                 return {
                     success: false,
                     errorCode: 'unacceptable_address',
-                    errorMessage: 'The given address is invalid. It must be a string.',
+                    errorMessage: `The given email address is too long. It must be ${MAX_EMAIL_ADDRESS_LENGTH} characters or shorter in length.`,
                 };
             }
-            else if (typeof request.addressType !== 'string' ||
-                !(request.addressType === 'email' ||
-                    request.addressType === 'phone')) {
+        }
+        else if (request.addressType === 'phone') {
+            if (request.address.length > MAX_SMS_ADDRESS_LENGTH) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_address_type',
-                    errorMessage: 'The given address type is invalid. It must be a string containing either "email" or "phone".',
+                    errorCode: 'unacceptable_address',
+                    errorMessage: `The given SMS address is too long. It must be ${MAX_SMS_ADDRESS_LENGTH} digits or shorter in length.`,
                 };
             }
-            else if (typeof request.ipAddress !== 'string' ||
-                request.ipAddress === '') {
+        }
+        try {
+            let newUser = false;
+            const supported = await this._messenger.supportsAddressType(request.addressType);
+            if (!supported) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_ip_address',
-                    errorMessage: 'The given IP address is invalid. It must be a string.',
+                    errorCode: 'address_type_not_supported',
+                    errorMessage: request.addressType === 'email'
+                        ? 'Email addresses are not supported.'
+                        : 'Phone numbers are not supported',
                 };
             }
-            if (request.addressType === 'email') {
-                if (request.address.length > MAX_EMAIL_ADDRESS_LENGTH) {
-                    return {
-                        success: false,
-                        errorCode: 'unacceptable_address',
-                        errorMessage: `The given email address is too long. It must be ${MAX_EMAIL_ADDRESS_LENGTH} characters or shorter in length.`,
-                    };
-                }
-            }
-            else if (request.addressType === 'phone') {
-                if (request.address.length > MAX_SMS_ADDRESS_LENGTH) {
+            let user = await this._store.findUserByAddress(request.address, request.addressType);
+            if (!user) {
+                newUser = true;
+                user = {
+                    id: uuid(),
+                    email: request.addressType === 'email'
+                        ? request.address
+                        : null,
+                    phoneNumber: request.addressType === 'phone'
+                        ? request.address
+                        : null,
+                    allSessionRevokeTimeMs: null,
+                    currentLoginRequestId: null,
+                };
+                if (!(await this._validateAddress(request.address, request.addressType))) {
+                    console.log(`[AuthController] [requestLogin] Login attempt rejected for new user with address (type: ${request.addressType}) that is not allowed.`);
                     return {
                         success: false,
                         errorCode: 'unacceptable_address',
-                        errorMessage: `The given SMS address is too long. It must be ${MAX_SMS_ADDRESS_LENGTH} digits or shorter in length.`,
+                        errorMessage: 'The given address is not accepted.',
                     };
                 }
             }
-            try {
-                let newUser = false;
-                const supported = yield this._messenger.supportsAddressType(request.addressType);
-                if (!supported) {
-                    return {
-                        success: false,
-                        errorCode: 'address_type_not_supported',
-                        errorMessage: request.addressType === 'email'
-                            ? 'Email addresses are not supported.'
-                            : 'Phone numbers are not supported',
-                    };
-                }
-                let user = yield this._store.findUserByAddress(request.address, request.addressType);
-                if (!user) {
-                    newUser = true;
-                    user = {
-                        id: uuid(),
-                        email: request.addressType === 'email'
-                            ? request.address
-                            : null,
-                        phoneNumber: request.addressType === 'phone'
-                            ? request.address
-                            : null,
-                        allSessionRevokeTimeMs: null,
-                        currentLoginRequestId: null,
-                    };
-                    if (!(yield this._validateAddress(request.address, request.addressType))) {
-                        console.log(`[AuthController] [requestLogin] Login attempt rejected for new user with address (type: ${request.addressType}) that is not allowed.`);
-                        return {
-                            success: false,
-                            errorCode: 'unacceptable_address',
-                            errorMessage: 'The given address is not accepted.',
-                        };
+            if (user.banTimeMs > 0) {
+                return {
+                    success: false,
+                    errorCode: 'user_is_banned',
+                    errorMessage: 'The user has been banned.',
+                    banReason: user.banReason,
+                };
+            }
+            const requestTime = Date.now();
+            const requestId = fromByteArray(randomBytes(LOGIN_REQUEST_ID_BYTE_LENGTH));
+            const code = randomCode();
+            const hash = hashLowEntropyPasswordWithSalt(code, requestId);
+            const loginRequest = {
+                userId: user.id,
+                requestId: requestId,
+                secretHash: hash,
+                address: request.address,
+                addressType: request.addressType,
+                attemptCount: 0,
+                requestTimeMs: requestTime,
+                expireTimeMs: requestTime + LOGIN_REQUEST_LIFETIME_MS,
+                completedTimeMs: null,
+                ipAddress: request.ipAddress,
+            };
+            const result = await this._messenger.sendCode(loginRequest.address, loginRequest.addressType, code);
+            if (result.success === true) {
+                if (newUser) {
+                    const result = await this._store.saveNewUser(user);
+                    if (result.success === false) {
+                        user = await this._store.findUserByAddress(request.address, request.addressType);
+                        if (!user) {
+                            console.log('[AuthController] Could not find user even though it is supposed to already exist.');
+                            return {
+                                success: false,
+                                errorCode: 'server_error',
+                                errorMessage: 'The server encountered an error.',
+                            };
+                        }
+                        loginRequest.userId = user.id;
                     }
                 }
-                if (user.banTimeMs > 0) {
-                    return {
-                        success: false,
-                        errorCode: 'user_is_banned',
-                        errorMessage: 'The user has been banned.',
-                        banReason: user.banReason,
-                    };
-                }
-                const requestTime = Date.now();
-                const requestId = fromByteArray(randomBytes(LOGIN_REQUEST_ID_BYTE_LENGTH));
-                const code = randomCode();
-                const hash = hashLowEntropyPasswordWithSalt(code, requestId);
-                const loginRequest = {
-                    userId: user.id,
-                    requestId: requestId,
-                    secretHash: hash,
+                await this._store.saveLoginRequest(loginRequest);
+                await this._store.setCurrentLoginRequest(loginRequest.userId, loginRequest.requestId);
+                return {
+                    success: true,
+                    requestId: loginRequest.requestId,
+                    userId: loginRequest.userId,
                     address: request.address,
                     addressType: request.addressType,
-                    attemptCount: 0,
-                    requestTimeMs: requestTime,
-                    expireTimeMs: requestTime + LOGIN_REQUEST_LIFETIME_MS,
-                    completedTimeMs: null,
-                    ipAddress: request.ipAddress,
+                    expireTimeMs: loginRequest.expireTimeMs,
                 };
-                const result = yield this._messenger.sendCode(loginRequest.address, loginRequest.addressType, code);
-                if (result.success === true) {
-                    if (newUser) {
-                        const result = yield this._store.saveNewUser(user);
-                        if (result.success === false) {
-                            user = yield this._store.findUserByAddress(request.address, request.addressType);
-                            if (!user) {
-                                console.log('[AuthController] Could not find user even though it is supposed to already exist.');
-                                return {
-                                    success: false,
-                                    errorCode: 'server_error',
-                                    errorMessage: 'The server encountered an error.',
-                                };
-                            }
-                            loginRequest.userId = user.id;
-                        }
-                    }
-                    yield this._store.saveLoginRequest(loginRequest);
-                    yield this._store.setCurrentLoginRequest(loginRequest.userId, loginRequest.requestId);
-                    return {
-                        success: true,
-                        requestId: loginRequest.requestId,
-                        userId: loginRequest.userId,
-                        address: request.address,
-                        addressType: request.addressType,
-                        expireTimeMs: loginRequest.expireTimeMs,
-                    };
-                }
-                else {
-                    return {
-                        success: false,
-                        errorCode: result.errorCode,
-                        errorMessage: result.errorMessage,
-                    };
-                }
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error Occurred while Creating Login Request', err);
+            else {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: result.errorCode,
+                    errorMessage: result.errorMessage,
                 };
             }
-        });
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error Occurred while Creating Login Request', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    _validateAddress(address, addressType) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const rules = addressType === 'email'
-                    ? yield this._store.listEmailRules()
-                    : yield this._store.listSmsRules();
-                if (rules) {
-                    return isStringValid(address, rules);
-                }
-                else {
-                    return true;
-                }
+    async _validateAddress(address, addressType) {
+        try {
+            const rules = addressType === 'email'
+                ? await this._store.listEmailRules()
+                : await this._store.listSmsRules();
+            if (rules) {
+                return isStringValid(address, rules);
             }
-            catch (err) {
-                console.error(`[AuthController] Error occurred while validating address`, err);
-                return false;
+            else {
+                return true;
             }
-        });
+        }
+        catch (err) {
+            console.error(`[AuthController] Error occurred while validating address`, err);
+            return false;
+        }
     }
-    completeLogin(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof request.userId !== 'string' || request.userId === '') {
+    async completeLogin(request) {
+        if (typeof request.userId !== 'string' || request.userId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_user_id',
+                errorMessage: 'The given userId is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.requestId !== 'string' ||
+            request.requestId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_request_id',
+                errorMessage: 'The given requestId is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.code !== 'string' || request.code === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_code',
+                errorMessage: 'The given code is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.ipAddress !== 'string' ||
+            request.ipAddress === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_ip_address',
+                errorMessage: 'The given IP address is invalid. It must be a string.',
+            };
+        }
+        try {
+            const loginRequest = await this._store.findLoginRequest(request.userId, request.requestId);
+            if (!loginRequest) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_user_id',
-                    errorMessage: 'The given userId is invalid. It must be a string.',
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
                 };
             }
-            else if (typeof request.requestId !== 'string' ||
-                request.requestId === '') {
+            let validRequest = true;
+            if (Date.now() >= loginRequest.expireTimeMs) {
+                validRequest = false;
+            }
+            else if (loginRequest.completedTimeMs > 0) {
+                validRequest = false;
+            }
+            else if (loginRequest.attemptCount >= MAX_LOGIN_REQUEST_ATTEMPTS) {
+                validRequest = false;
+            }
+            else if (loginRequest.ipAddress !== request.ipAddress) {
+                validRequest = false;
+            }
+            if (!validRequest) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_request_id',
-                    errorMessage: 'The given requestId is invalid. It must be a string.',
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
                 };
             }
-            else if (typeof request.code !== 'string' || request.code === '') {
+            let validCode = false;
+            try {
+                if (this.verifyPasswordAgainstHashes(request.code, loginRequest.requestId, [loginRequest.secretHash])) {
+                    validCode = true;
+                }
+            }
+            catch (err) {
+                console.error('[AuthController] Error occurred while verifying login request code', err);
+            }
+            if (!validCode) {
+                await this._store.incrementLoginRequestAttemptCount(loginRequest.userId, loginRequest.requestId);
                 return {
                     success: false,
-                    errorCode: 'unacceptable_code',
-                    errorMessage: 'The given code is invalid. It must be a string.',
+                    errorCode: 'invalid_code',
+                    errorMessage: 'The code is invalid.',
                 };
             }
-            else if (typeof request.ipAddress !== 'string' ||
-                request.ipAddress === '') {
+            const user = await this._store.findUser(loginRequest.userId);
+            if (!user) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_ip_address',
-                    errorMessage: 'The given IP address is invalid. It must be a string.',
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
                 };
             }
-            try {
-                const loginRequest = yield this._store.findLoginRequest(request.userId, request.requestId);
-                if (!loginRequest) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                let validRequest = true;
-                if (Date.now() >= loginRequest.expireTimeMs) {
-                    validRequest = false;
-                }
-                else if (loginRequest.completedTimeMs > 0) {
-                    validRequest = false;
-                }
-                else if (loginRequest.attemptCount >= MAX_LOGIN_REQUEST_ATTEMPTS) {
-                    validRequest = false;
-                }
-                else if (loginRequest.ipAddress !== request.ipAddress) {
-                    validRequest = false;
-                }
-                if (!validRequest) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                let validCode = false;
-                try {
-                    if (this.verifyPasswordAgainstHashes(request.code, loginRequest.requestId, [loginRequest.secretHash])) {
-                        validCode = true;
-                    }
-                }
-                catch (err) {
-                    console.error('[AuthController] Error occurred while verifying login request code', err);
-                }
-                if (!validCode) {
-                    yield this._store.incrementLoginRequestAttemptCount(loginRequest.userId, loginRequest.requestId);
-                    return {
-                        success: false,
-                        errorCode: 'invalid_code',
-                        errorMessage: 'The code is invalid.',
-                    };
-                }
-                const user = yield this._store.findUser(loginRequest.userId);
-                if (!user) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                if (user.currentLoginRequestId !== loginRequest.requestId) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                const { info } = yield this._issueSession({
-                    userId: loginRequest.userId,
-                    lifetimeMs: SESSION_LIFETIME_MS,
-                    requestId: loginRequest.requestId,
-                    ipAddress: request.ipAddress,
-                });
-                return Object.assign({ success: true }, info);
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error occurred while completing login request', err);
+            if (user.currentLoginRequestId !== loginRequest.requestId) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
                 };
             }
-        });
+            const { info } = await this._issueSession({
+                userId: loginRequest.userId,
+                lifetimeMs: SESSION_LIFETIME_MS,
+                requestId: loginRequest.requestId,
+                ipAddress: request.ipAddress,
+            });
+            return {
+                success: true,
+                ...info,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error occurred while completing login request', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    requestOpenIDLogin(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (request.provider !== PRIVO_OPEN_ID_PROVIDER) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'The given provider is not supported.',
-                    };
-                }
-                if (!this._privoClient) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const config = yield this._config.getPrivoConfiguration();
-                if (!config) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const requestId = uuid();
-                const state = uuid();
-                const result = yield this._privoClient.generateAuthorizationUrl(state);
-                const loginRequest = {
-                    requestId: requestId,
-                    state: state,
-                    provider: PRIVO_OPEN_ID_PROVIDER,
-                    codeMethod: result.codeMethod,
-                    codeVerifier: result.codeVerifier,
-                    authorizationUrl: result.authorizationUrl,
-                    redirectUrl: result.redirectUrl,
-                    completedTimeMs: null,
-                    ipAddress: request.ipAddress,
-                    scope: result.scope,
-                    requestTimeMs: Date.now(),
-                    expireTimeMs: Date.now() + OPEN_ID_LOGIN_REQUEST_LIFETIME_MS,
-                };
-                yield this._store.saveOpenIDLoginRequest(loginRequest);
+    async requestOpenIDLogin(request) {
+        try {
+            if (request.provider !== PRIVO_OPEN_ID_PROVIDER) {
                 return {
-                    success: true,
-                    authorizationUrl: result.authorizationUrl,
-                    requestId: requestId,
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'The given provider is not supported.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error occurred while requesting Privo login', err);
+            if (!this._privoClient) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
                 };
             }
-        });
+            const config = await this._config.getPrivoConfiguration();
+            if (!config) {
+                return {
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
+                };
+            }
+            const requestId = uuid();
+            const state = uuid();
+            const result = await this._privoClient.generateAuthorizationUrl(state);
+            const loginRequest = {
+                requestId: requestId,
+                state: state,
+                provider: PRIVO_OPEN_ID_PROVIDER,
+                codeMethod: result.codeMethod,
+                codeVerifier: result.codeVerifier,
+                authorizationUrl: result.authorizationUrl,
+                redirectUrl: result.redirectUrl,
+                completedTimeMs: null,
+                ipAddress: request.ipAddress,
+                scope: result.scope,
+                requestTimeMs: Date.now(),
+                expireTimeMs: Date.now() + OPEN_ID_LOGIN_REQUEST_LIFETIME_MS,
+            };
+            await this._store.saveOpenIDLoginRequest(loginRequest);
+            return {
+                success: true,
+                authorizationUrl: result.authorizationUrl,
+                requestId: requestId,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error occurred while requesting Privo login', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    processOpenIDAuthorizationCode(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (!this._privoClient) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const config = yield this._config.getPrivoConfiguration();
-                if (!config) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const state = request.state;
-                const loginRequest = yield this._store.findOpenIDLoginRequestByState(state);
-                if (!loginRequest) {
-                    console.log('[AuthController] Could not find login request.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_AUTHORIZATION_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                let validRequest = true;
-                if (Date.now() >= loginRequest.expireTimeMs) {
-                    validRequest = false;
-                }
-                else if (loginRequest.completedTimeMs > 0) {
-                    validRequest = false;
-                }
-                else if (loginRequest.authorizationTimeMs > 0) {
-                    validRequest = false;
-                }
-                else if (loginRequest.ipAddress !== request.ipAddress) {
-                    validRequest = false;
-                }
-                if (!validRequest) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_AUTHORIZATION_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                if (loginRequest.provider !== PRIVO_OPEN_ID_PROVIDER) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_AUTHORIZATION_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                yield this._store.saveOpenIDLoginRequestAuthorizationCode(loginRequest.requestId, request.authorizationCode, Date.now());
+    async processOpenIDAuthorizationCode(request) {
+        try {
+            if (!this._privoClient) {
                 return {
-                    success: true,
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error occurred while processing Privo authorization code', err);
+            const config = await this._config.getPrivoConfiguration();
+            if (!config) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
+                };
+            }
+            const state = request.state;
+            const loginRequest = await this._store.findOpenIDLoginRequestByState(state);
+            if (!loginRequest) {
+                console.log('[AuthController] Could not find login request.');
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_AUTHORIZATION_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            let validRequest = true;
+            if (Date.now() >= loginRequest.expireTimeMs) {
+                validRequest = false;
+            }
+            else if (loginRequest.completedTimeMs > 0) {
+                validRequest = false;
+            }
+            else if (loginRequest.authorizationTimeMs > 0) {
+                validRequest = false;
+            }
+            else if (loginRequest.ipAddress !== request.ipAddress) {
+                validRequest = false;
+            }
+            if (!validRequest) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_AUTHORIZATION_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            if (loginRequest.provider !== PRIVO_OPEN_ID_PROVIDER) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_AUTHORIZATION_REQUEST_ERROR_MESSAGE,
                 };
             }
-        });
+            await this._store.saveOpenIDLoginRequestAuthorizationCode(loginRequest.requestId, request.authorizationCode, Date.now());
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error occurred while processing Privo authorization code', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    completeOpenIDLogin(request) {
+    async completeOpenIDLogin(request) {
         var _a, _b, _c, _d;
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (!this._privoClient) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const config = yield this._config.getPrivoConfiguration();
-                if (!config) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const requestId = request.requestId;
-                const loginRequest = yield this._store.findOpenIDLoginRequest(requestId);
-                if (!loginRequest) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                let validRequest = true;
-                if (Date.now() >= loginRequest.expireTimeMs) {
-                    validRequest = false;
-                }
-                else if (loginRequest.completedTimeMs > 0) {
-                    validRequest = false;
-                }
-                else if (loginRequest.ipAddress !== request.ipAddress) {
-                    validRequest = false;
-                }
-                if (!validRequest) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                if (loginRequest.provider !== PRIVO_OPEN_ID_PROVIDER) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                if (!loginRequest.authorizationTimeMs ||
-                    !loginRequest.authorizationCode) {
-                    return {
-                        success: false,
-                        errorCode: 'not_completed',
-                        errorMessage: 'The login request has not been completed.',
-                    };
-                }
-                const result = yield this._privoClient.processAuthorizationCallback({
-                    code: loginRequest.authorizationCode,
-                    state: loginRequest.state,
-                    codeVerifier: loginRequest.codeVerifier,
-                    redirectUrl: loginRequest.redirectUrl,
-                });
-                const serviceId = result.userInfo.serviceId;
-                const email = result.userInfo.email;
-                if (result.userInfo.roleIdentifier !== config.roleIds.adult &&
-                    result.userInfo.roleIdentifier !== config.roleIds.child) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: "The login request is invalid. You attempted to sign into an account that is associated with a parent email address. This is not allowed because we don't ask consent for parent accounts, but all accounts must have consent. Please sign up with a new account instead.",
-                    };
-                }
-                let user;
-                if (serviceId) {
-                    user = yield this._store.findUserByPrivoServiceId(result.userInfo.serviceId);
-                }
-                if (!user && email) {
-                    user = yield this._store.findUserByAddress(email, 'email');
-                }
-                if (!user) {
-                    console.log('[AuthController] [completeOpenIDLogin] Could not find user.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                if (!user.privoServiceId) {
-                    console.log(`[AuthController] [completeOpenIDLogin] Updating user service ID.`);
-                    user = Object.assign(Object.assign({}, user), { privoServiceId: serviceId });
-                    yield this._store.saveUser(Object.assign({}, user));
-                }
-                else if (user.privoServiceId !== serviceId) {
-                    console.log(`[AuthController] [completeOpenIDLogin] User's service ID (${user.privoServiceId}) doesnt match the one returned by Privo (${serviceId}).`);
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                const privacyFeatures = getPrivacyFeaturesFromPermissions(config.featureIds, result.userInfo.permissions);
-                if (((_a = user.privacyFeatures) === null || _a === void 0 ? void 0 : _a.publishData) !==
-                    privacyFeatures.publishData ||
-                    ((_b = user.privacyFeatures) === null || _b === void 0 ? void 0 : _b.allowPublicData) !==
-                        privacyFeatures.allowPublicData ||
-                    ((_c = user.privacyFeatures) === null || _c === void 0 ? void 0 : _c.allowAI) !== privacyFeatures.allowAI ||
-                    ((_d = user.privacyFeatures) === null || _d === void 0 ? void 0 : _d.allowPublicInsts) !==
-                        privacyFeatures.allowPublicInsts) {
-                    console.log(`[AuthController] [completeOpenIDLogin] Updating user privacy features.`);
-                    user = Object.assign(Object.assign({}, user), { privacyFeatures });
-                    yield this._store.saveUser(Object.assign({}, user));
-                }
-                const now = Date.now();
-                const expiry = now + result.expiresIn * 1000;
-                const { info } = yield this._issueSession({
-                    userId: user.id,
-                    lifetimeMs: SESSION_LIFETIME_MS,
-                    oidRequestId: loginRequest.requestId,
-                    oidAccessToken: result.accessToken,
-                    oidRefreshToken: result.refreshToken,
-                    oidIdToken: result.idToken,
-                    oidScope: loginRequest.scope,
-                    oidTokenType: result.tokenType,
-                    oidExpiresAtMs: expiry,
-                    oidProvider: loginRequest.provider,
-                    ipAddress: request.ipAddress,
-                });
-                return Object.assign({ success: true }, info);
+        try {
+            if (!this._privoClient) {
+                return {
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
+                };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error occurred while completing Privo login', err);
+            const config = await this._config.getPrivoConfiguration();
+            if (!config) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
                 };
             }
-        });
-    }
-    requestPrivoSignUp(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (!this._privoClient) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const config = yield this._config.getPrivoConfiguration();
-                if (!config) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const lowercaseName = request.name.trim().toLowerCase();
-                const lowercaseDisplayName = request.displayName
-                    .trim()
-                    .toLowerCase();
-                if (lowercaseDisplayName.includes(lowercaseName)) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_display_name',
-                        errorMessage: 'The display name cannot contain your name.',
-                    };
-                }
-                if (request.email &&
-                    request.parentEmail &&
-                    request.parentEmail.localeCompare(request.email, undefined, {
-                        sensitivity: 'base',
-                    }) === 0) {
-                    return {
-                        success: false,
-                        errorCode: 'unacceptable_request',
-                        errorMessage: 'The parent email must be different from the child email.',
-                    };
-                }
-                const now = new Date(Date.now());
-                const years = Math.floor(-DateTime.fromJSDate(request.dateOfBirth)
-                    .diff(DateTime.fromJSDate(now), 'years')
-                    .as('years'));
-                let updatePasswordUrl;
-                let serviceId;
-                let parentServiceId;
-                let consentUrl;
-                if (years < 0) {
-                    return {
-                        success: false,
-                        errorCode: 'unacceptable_request',
-                        errorMessage: 'The given date of birth cannot be in the future.',
-                    };
-                }
-                let privacyFeatures;
-                if (years < config.ageOfConsent) {
-                    if (!request.parentEmail) {
-                        return {
-                            success: false,
-                            errorCode: 'parent_email_required',
-                            errorMessage: 'A parent email is required to sign up a child.',
-                        };
-                    }
-                    const result = yield this._privoClient.createChildAccount({
-                        childFirstName: request.name,
-                        childDateOfBirth: request.dateOfBirth,
-                        childEmail: request.email,
-                        childDisplayName: request.displayName,
-                        parentEmail: request.parentEmail,
-                        featureIds: [
-                            config.featureIds.childPrivoSSO,
-                            config.featureIds.joinAndCollaborate,
-                            config.featureIds.projectDevelopment,
-                            config.featureIds.publishProjects,
-                            config.featureIds.buildAIEggs,
-                        ],
-                    });
-                    if (result.success === false) {
-                        return result;
-                    }
-                    serviceId = result.childServiceId;
-                    parentServiceId = result.parentServiceId;
-                    updatePasswordUrl = result.updatePasswordLink;
-                    consentUrl = result.consentUrl;
-                    privacyFeatures = getPrivacyFeaturesFromPermissions(config.featureIds, result.features);
-                }
-                else {
-                    if (!request.email) {
-                        return {
-                            success: false,
-                            errorCode: 'unacceptable_request',
-                            errorMessage: 'An email is required to sign up an adult.',
-                        };
-                    }
-                    const result = yield this._privoClient.createAdultAccount({
-                        adultFirstName: request.name,
-                        adultEmail: request.email,
-                        adultDateOfBirth: request.dateOfBirth,
-                        adultDisplayName: request.displayName,
-                        featureIds: [
-                            config.featureIds.adultPrivoSSO,
-                            config.featureIds.joinAndCollaborate,
-                            config.featureIds.projectDevelopment,
-                            config.featureIds.publishProjects,
-                            config.featureIds.buildAIEggs,
-                        ],
-                    });
-                    if (result.success === false) {
-                        return result;
-                    }
-                    serviceId = result.adultServiceId;
-                    updatePasswordUrl = result.updatePasswordLink;
-                    consentUrl = result.consentUrl;
-                    privacyFeatures = getPrivacyFeaturesFromPermissions(config.featureIds, result.features);
-                }
-                const user = {
-                    id: uuid(),
-                    email: null, // We don't store the email because it is stored in Privo.
-                    phoneNumber: null,
-                    name: null, // We don't store the name because it is stored in Privo.
-                    allSessionRevokeTimeMs: null,
-                    currentLoginRequestId: null,
+            const requestId = request.requestId;
+            const loginRequest = await this._store.findOpenIDLoginRequest(requestId);
+            if (!loginRequest) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            let validRequest = true;
+            if (Date.now() >= loginRequest.expireTimeMs) {
+                validRequest = false;
+            }
+            else if (loginRequest.completedTimeMs > 0) {
+                validRequest = false;
+            }
+            else if (loginRequest.ipAddress !== request.ipAddress) {
+                validRequest = false;
+            }
+            if (!validRequest) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            if (loginRequest.provider !== PRIVO_OPEN_ID_PROVIDER) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            if (!loginRequest.authorizationTimeMs ||
+                !loginRequest.authorizationCode) {
+                return {
+                    success: false,
+                    errorCode: 'not_completed',
+                    errorMessage: 'The login request has not been completed.',
+                };
+            }
+            const result = await this._privoClient.processAuthorizationCallback({
+                code: loginRequest.authorizationCode,
+                state: loginRequest.state,
+                codeVerifier: loginRequest.codeVerifier,
+                redirectUrl: loginRequest.redirectUrl,
+            });
+            const serviceId = result.userInfo.serviceId;
+            const email = result.userInfo.email;
+            if (result.userInfo.roleIdentifier !== config.roleIds.adult &&
+                result.userInfo.roleIdentifier !== config.roleIds.child) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: "The login request is invalid. You attempted to sign into an account that is associated with a parent email address. This is not allowed because we don't ask consent for parent accounts, but all accounts must have consent. Please sign up with a new account instead.",
+                };
+            }
+            let user;
+            if (serviceId) {
+                user = await this._store.findUserByPrivoServiceId(result.userInfo.serviceId);
+            }
+            if (!user && email) {
+                user = await this._store.findUserByAddress(email, 'email');
+            }
+            if (!user) {
+                console.log('[AuthController] [completeOpenIDLogin] Could not find user.');
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            if (!user.privoServiceId) {
+                console.log(`[AuthController] [completeOpenIDLogin] Updating user service ID.`);
+                user = {
+                    ...user,
                     privoServiceId: serviceId,
-                    privoParentServiceId: parentServiceId,
-                    privoConsentUrl: consentUrl,
-                    privacyFeatures,
                 };
-                // TODO: Add user to DB
-                const saveUserResult = yield this._store.saveNewUser(user);
-                if (saveUserResult.success === false) {
-                    console.error('[AuthController] Error saving new user', saveUserResult);
-                    return {
-                        success: false,
-                        errorCode: 'server_error',
-                        errorMessage: 'A server error occurred.',
-                    };
-                }
-                const userId = user.id;
-                const { info } = yield this._issueSession({
-                    userId,
-                    lifetimeMs: SESSION_LIFETIME_MS,
-                    ipAddress: request.ipAddress,
+                await this._store.saveUser({
+                    ...user,
                 });
-                return Object.assign(Object.assign({ success: true }, info), { updatePasswordUrl });
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error(`[AuthController] Error occurred while requesting Privo sign up`, err);
+            else if (user.privoServiceId !== serviceId) {
+                console.log(`[AuthController] [completeOpenIDLogin] User's service ID (${user.privoServiceId}) doesnt match the one returned by Privo (${serviceId}).`);
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            const privacyFeatures = getPrivacyFeaturesFromPermissions(config.featureIds, result.userInfo.permissions);
+            if (((_a = user.privacyFeatures) === null || _a === void 0 ? void 0 : _a.publishData) !==
+                privacyFeatures.publishData ||
+                ((_b = user.privacyFeatures) === null || _b === void 0 ? void 0 : _b.allowPublicData) !==
+                    privacyFeatures.allowPublicData ||
+                ((_c = user.privacyFeatures) === null || _c === void 0 ? void 0 : _c.allowAI) !== privacyFeatures.allowAI ||
+                ((_d = user.privacyFeatures) === null || _d === void 0 ? void 0 : _d.allowPublicInsts) !==
+                    privacyFeatures.allowPublicInsts) {
+                console.log(`[AuthController] [completeOpenIDLogin] Updating user privacy features.`);
+                user = {
+                    ...user,
+                    privacyFeatures,
                 };
+                await this._store.saveUser({
+                    ...user,
+                });
             }
-        });
+            const now = Date.now();
+            const expiry = now + result.expiresIn * 1000;
+            const { info } = await this._issueSession({
+                userId: user.id,
+                lifetimeMs: SESSION_LIFETIME_MS,
+                oidRequestId: loginRequest.requestId,
+                oidAccessToken: result.accessToken,
+                oidRefreshToken: result.refreshToken,
+                oidIdToken: result.idToken,
+                oidScope: loginRequest.scope,
+                oidTokenType: result.tokenType,
+                oidExpiresAtMs: expiry,
+                oidProvider: loginRequest.provider,
+                ipAddress: request.ipAddress,
+            });
+            return {
+                success: true,
+                ...info,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error occurred while completing Privo login', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    requestWebAuthnRegistration(request) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (this._webAuthNRelyingParties.length <= 0) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'WebAuthn is not supported on this server.',
-                    };
-                }
-                const relyingParty = findRelyingPartyForOrigin(this._webAuthNRelyingParties, request.originOrHost);
-                if (!relyingParty) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_origin',
-                        errorMessage: 'The request must be made from an authorized origin.',
-                    };
-                }
-                const user = yield this._store.findUser(request.userId);
-                if (!user) {
-                    return {
-                        success: false,
-                        errorCode: 'not_logged_in',
-                        errorMessage: 'You need to be logged in for the operation to work.',
-                    };
-                }
-                const authenticators = yield this._store.listUserAuthenticators(user.id);
-                const options = yield generateRegistrationOptions({
-                    rpName: relyingParty.name,
-                    rpID: relyingParty.id,
-                    userID: user.id,
-                    userName: (_a = user.email) !== null && _a !== void 0 ? _a : user.phoneNumber,
-                    attestationType: 'none',
-                    excludeCredentials: authenticators.map((auth) => ({
-                        id: base64URLStringToBuffer(auth.credentialId),
-                        type: 'public-key',
-                        transports: auth.transports,
-                    })),
-                    authenticatorSelection: {
-                        residentKey: 'preferred',
-                        userVerification: 'preferred',
-                        authenticatorAttachment: 'platform',
-                    },
-                });
-                yield this._store.setCurrentWebAuthnChallenge(user.id, options.challenge);
+    async requestPrivoSignUp(request) {
+        try {
+            if (!this._privoClient) {
                 return {
-                    success: true,
-                    options,
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error(`[AuthController] Error occurred while requesting WebAuthn registration options`, err);
+            const config = await this._config.getPrivoConfiguration();
+            if (!config) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
                 };
             }
-        });
-    }
-    completeWebAuthnRegistration(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (this._webAuthNRelyingParties.length <= 0) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'WebAuthn is not supported on this server.',
-                    };
-                }
-                const relyingParty = findRelyingPartyForOrigin(this._webAuthNRelyingParties, request.originOrHost);
-                if (!relyingParty) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_origin',
-                        errorMessage: 'The request must be made from an authorized origin.',
-                    };
-                }
-                const user = yield this._store.findUser(request.userId);
-                if (!user) {
+            const lowercaseName = request.name.trim().toLowerCase();
+            const lowercaseDisplayName = request.displayName
+                .trim()
+                .toLowerCase();
+            if (lowercaseDisplayName.includes(lowercaseName)) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_display_name',
+                    errorMessage: 'The display name cannot contain your name.',
+                };
+            }
+            if (request.email &&
+                request.parentEmail &&
+                request.parentEmail.localeCompare(request.email, undefined, {
+                    sensitivity: 'base',
+                }) === 0) {
+                return {
+                    success: false,
+                    errorCode: 'unacceptable_request',
+                    errorMessage: 'The parent email must be different from the child email.',
+                };
+            }
+            const now = new Date(Date.now());
+            const years = Math.floor(-DateTime.fromJSDate(request.dateOfBirth)
+                .diff(DateTime.fromJSDate(now), 'years')
+                .as('years'));
+            let updatePasswordUrl;
+            let serviceId;
+            let parentServiceId;
+            let consentUrl;
+            if (years < 0) {
+                return {
+                    success: false,
+                    errorCode: 'unacceptable_request',
+                    errorMessage: 'The given date of birth cannot be in the future.',
+                };
+            }
+            let privacyFeatures;
+            if (years < config.ageOfConsent) {
+                if (!request.parentEmail) {
                     return {
                         success: false,
-                        errorCode: 'not_logged_in',
-                        errorMessage: 'You need to be logged in for the operation to work.',
+                        errorCode: 'parent_email_required',
+                        errorMessage: 'A parent email is required to sign up a child.',
                     };
                 }
-                const currentChallenge = user.currentWebAuthnChallenge;
-                try {
-                    const verification = yield verifyRegistrationResponse({
-                        response: request.response,
-                        expectedChallenge: currentChallenge,
-                        expectedOrigin: relyingParty.origin,
-                        expectedRPID: relyingParty.id,
-                    });
-                    if (verification.verified) {
-                        const registration = verification.registrationInfo;
-                        const credentialId = bufferToBase64URLString(registration.credentialID);
-                        const authenticator = {
-                            id: uuid(),
-                            userId: user.id,
-                            credentialId,
-                            credentialPublicKey: registration.credentialPublicKey,
-                            counter: registration.counter,
-                            credentialBackedUp: registration.credentialBackedUp,
-                            credentialDeviceType: registration.credentialDeviceType,
-                            transports: request.response.response.transports,
-                            aaguid: verification.registrationInfo.aaguid,
-                            registeringUserAgent: request.userAgent,
-                            createdAtMs: Date.now(),
-                        };
-                        yield this._store.setCurrentWebAuthnChallenge(user.id, null);
-                        yield this._store.saveUserAuthenticator(authenticator);
-                        return {
-                            success: true,
-                        };
-                    }
-                    else {
-                        return {
-                            success: false,
-                            errorCode: 'not_authorized',
-                            errorMessage: 'The registration response was not authorized.',
-                        };
-                    }
+                const result = await this._privoClient.createChildAccount({
+                    childFirstName: request.name,
+                    childDateOfBirth: request.dateOfBirth,
+                    childEmail: request.email,
+                    childDisplayName: request.displayName,
+                    parentEmail: request.parentEmail,
+                    featureIds: [
+                        config.featureIds.childPrivoSSO,
+                        config.featureIds.joinAndCollaborate,
+                        config.featureIds.projectDevelopment,
+                        config.featureIds.publishProjects,
+                        config.featureIds.buildAIEggs,
+                    ],
+                });
+                if (result.success === false) {
+                    return result;
                 }
-                catch (err) {
-                    console.error(`[AuthController] Error occurred while verifying WebAuthn registration response`, err);
+                serviceId = result.childServiceId;
+                parentServiceId = result.parentServiceId;
+                updatePasswordUrl = result.updatePasswordLink;
+                consentUrl = result.consentUrl;
+                privacyFeatures = getPrivacyFeaturesFromPermissions(config.featureIds, result.features);
+            }
+            else {
+                if (!request.email) {
                     return {
                         success: false,
                         errorCode: 'unacceptable_request',
-                        errorMessage: err.message,
-                    };
+                        errorMessage: 'An email is required to sign up an adult.',
+                    };
+                }
+                const result = await this._privoClient.createAdultAccount({
+                    adultFirstName: request.name,
+                    adultEmail: request.email,
+                    adultDateOfBirth: request.dateOfBirth,
+                    adultDisplayName: request.displayName,
+                    featureIds: [
+                        config.featureIds.adultPrivoSSO,
+                        config.featureIds.joinAndCollaborate,
+                        config.featureIds.projectDevelopment,
+                        config.featureIds.publishProjects,
+                        config.featureIds.buildAIEggs,
+                    ],
+                });
+                if (result.success === false) {
+                    return result;
                 }
+                serviceId = result.adultServiceId;
+                updatePasswordUrl = result.updatePasswordLink;
+                consentUrl = result.consentUrl;
+                privacyFeatures = getPrivacyFeaturesFromPermissions(config.featureIds, result.features);
+            }
+            const user = {
+                id: uuid(),
+                email: null, // We don't store the email because it is stored in Privo.
+                phoneNumber: null,
+                name: null, // We don't store the name because it is stored in Privo.
+                allSessionRevokeTimeMs: null,
+                currentLoginRequestId: null,
+                privoServiceId: serviceId,
+                privoParentServiceId: parentServiceId,
+                privoConsentUrl: consentUrl,
+                privacyFeatures,
+            };
+            // TODO: Add user to DB
+            const saveUserResult = await this._store.saveNewUser(user);
+            if (saveUserResult.success === false) {
+                console.error('[AuthController] Error saving new user', saveUserResult);
+                return {
+                    success: false,
+                    errorCode: 'server_error',
+                    errorMessage: 'A server error occurred.',
+                };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error(`[AuthController] Error occurred while completing WebAuthn registration`, err);
+            const userId = user.id;
+            const { info } = await this._issueSession({
+                userId,
+                lifetimeMs: SESSION_LIFETIME_MS,
+                ipAddress: request.ipAddress,
+            });
+            return {
+                success: true,
+                ...info,
+                updatePasswordUrl,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error(`[AuthController] Error occurred while requesting Privo sign up`, err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async requestWebAuthnRegistration(request) {
+        var _a;
+        try {
+            if (this._webAuthNRelyingParties.length <= 0) {
+                return {
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'WebAuthn is not supported on this server.',
+                };
+            }
+            const relyingParty = findRelyingPartyForOrigin(this._webAuthNRelyingParties, request.originOrHost);
+            if (!relyingParty) {
+                return {
+                    success: false,
+                    errorCode: 'invalid_origin',
+                    errorMessage: 'The request must be made from an authorized origin.',
+                };
+            }
+            const user = await this._store.findUser(request.userId);
+            if (!user) {
+                return {
+                    success: false,
+                    errorCode: 'not_logged_in',
+                    errorMessage: 'You need to be logged in for the operation to work.',
+                };
+            }
+            const authenticators = await this._store.listUserAuthenticators(user.id);
+            const options = await generateRegistrationOptions({
+                rpName: relyingParty.name,
+                rpID: relyingParty.id,
+                userID: user.id,
+                userName: (_a = user.email) !== null && _a !== void 0 ? _a : user.phoneNumber,
+                attestationType: 'none',
+                excludeCredentials: authenticators.map((auth) => ({
+                    id: base64URLStringToBuffer(auth.credentialId),
+                    type: 'public-key',
+                    transports: auth.transports,
+                })),
+                authenticatorSelection: {
+                    residentKey: 'preferred',
+                    userVerification: 'preferred',
+                    authenticatorAttachment: 'platform',
+                },
+            });
+            await this._store.setCurrentWebAuthnChallenge(user.id, options.challenge);
+            return {
+                success: true,
+                options,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error(`[AuthController] Error occurred while requesting WebAuthn registration options`, err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async completeWebAuthnRegistration(request) {
+        try {
+            if (this._webAuthNRelyingParties.length <= 0) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_supported',
+                    errorMessage: 'WebAuthn is not supported on this server.',
                 };
             }
-        });
-    }
-    requestWebAuthnLogin(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (this._webAuthNRelyingParties.length <= 0) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'WebAuthn is not supported on this server.',
-                    };
-                }
-                const relyingParty = findRelyingPartyForOrigin(this._webAuthNRelyingParties, request.originOrHost);
-                if (!relyingParty) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_origin',
-                        errorMessage: 'The request must be made from an authorized origin.',
-                    };
-                }
-                const options = yield generateAuthenticationOptions({
-                    rpID: relyingParty.id,
-                    userVerification: 'preferred',
-                });
-                const requestId = uuid();
-                const nowMs = Date.now();
-                yield this._store.saveWebAuthnLoginRequest({
-                    requestId: requestId,
-                    challenge: options.challenge,
-                    requestTimeMs: nowMs,
-                    expireTimeMs: nowMs + WEB_AUTHN_LOGIN_REQUEST_LIFETIME_MS,
-                    completedTimeMs: null,
-                    ipAddress: request.ipAddress,
-                    userId: null,
-                });
+            const relyingParty = findRelyingPartyForOrigin(this._webAuthNRelyingParties, request.originOrHost);
+            if (!relyingParty) {
                 return {
-                    success: true,
-                    requestId,
-                    options,
+                    success: false,
+                    errorCode: 'invalid_origin',
+                    errorMessage: 'The request must be made from an authorized origin.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error(`[AuthController] Error occurred while requesting WebAuthn login`, err);
+            const user = await this._store.findUser(request.userId);
+            if (!user) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_logged_in',
+                    errorMessage: 'You need to be logged in for the operation to work.',
                 };
             }
-        });
-    }
-    completeWebAuthnLogin(request) {
-        return __awaiter(this, void 0, void 0, function* () {
+            const currentChallenge = user.currentWebAuthnChallenge;
             try {
-                if (this._webAuthNRelyingParties.length <= 0) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'WebAuthn is not supported on this server.',
-                    };
-                }
-                const relyingParty = findRelyingPartyForOrigin(this._webAuthNRelyingParties, request.originOrHost);
-                if (!relyingParty) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_origin',
-                        errorMessage: 'The request must be made from an authorized origin.',
-                    };
-                }
-                const loginRequest = yield this._store.findWebAuthnLoginRequest(request.requestId);
-                if (!loginRequest) {
-                    console.error('could not find login request!');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                let validRequest = true;
-                if (Date.now() >= loginRequest.expireTimeMs) {
-                    console.error('Expired!');
-                    validRequest = false;
-                }
-                else if (loginRequest.completedTimeMs > 0) {
-                    console.error('Completed!');
-                    validRequest = false;
-                }
-                else if (loginRequest.ipAddress !== request.ipAddress) {
-                    console.error('Wrong IP!');
-                    validRequest = false;
-                }
-                if (!validRequest) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                const { authenticator, user } = yield this._store.findUserAuthenticatorByCredentialId(request.response.id);
-                if (!authenticator) {
-                    console.error('No Authenticator!');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                    };
-                }
-                if (user.banTimeMs > 0) {
+                const verification = await verifyRegistrationResponse({
+                    response: request.response,
+                    expectedChallenge: currentChallenge,
+                    expectedOrigin: relyingParty.origin,
+                    expectedRPID: relyingParty.id,
+                });
+                if (verification.verified) {
+                    const registration = verification.registrationInfo;
+                    const credentialId = bufferToBase64URLString(registration.credentialID);
+                    const authenticator = {
+                        id: uuid(),
+                        userId: user.id,
+                        credentialId,
+                        credentialPublicKey: registration.credentialPublicKey,
+                        counter: registration.counter,
+                        credentialBackedUp: registration.credentialBackedUp,
+                        credentialDeviceType: registration.credentialDeviceType,
+                        transports: request.response.response.transports,
+                        aaguid: verification.registrationInfo.aaguid,
+                        registeringUserAgent: request.userAgent,
+                        createdAtMs: Date.now(),
+                    };
+                    await this._store.setCurrentWebAuthnChallenge(user.id, null);
+                    await this._store.saveUserAuthenticator(authenticator);
                     return {
-                        success: false,
-                        errorCode: 'user_is_banned',
-                        errorMessage: 'The user has been banned.',
-                        banReason: user.banReason,
+                        success: true,
                     };
                 }
-                try {
-                    const options = yield verifyAuthenticationResponse({
-                        response: request.response,
-                        expectedChallenge: loginRequest.challenge,
-                        expectedOrigin: relyingParty.origin,
-                        expectedRPID: relyingParty.id,
-                        authenticator: {
-                            credentialID: new Uint8Array(base64URLStringToBuffer(authenticator.credentialId)),
-                            counter: authenticator.counter,
-                            credentialPublicKey: authenticator.credentialPublicKey,
-                            transports: authenticator.transports,
-                        },
-                    });
-                    if (!options.verified) {
-                        console.error('Not verified!');
-                        return {
-                            success: false,
-                            errorCode: 'invalid_request',
-                            errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
-                        };
-                    }
-                    yield this._store.saveUserAuthenticatorCounter(authenticator.id, options.authenticationInfo.newCounter);
-                }
-                catch (err) {
-                    console.error(`[AuthController] Error occurred while verifying WebAuthn login response`, err);
+                else {
                     return {
                         success: false,
-                        errorCode: 'invalid_request',
-                        errorMessage: err.message,
+                        errorCode: 'not_authorized',
+                        errorMessage: 'The registration response was not authorized.',
                     };
                 }
-                const { info } = yield this._issueSession({
-                    userId: user.id,
-                    lifetimeMs: SESSION_LIFETIME_MS,
-                    ipAddress: request.ipAddress,
-                    webauthnRequestId: loginRequest.requestId,
-                    oidRequestId: null,
-                });
-                return Object.assign({ success: true }, info);
             }
             catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error(`[AuthController] Error occurred while requesting WebAuthn login`, err);
+                console.error(`[AuthController] Error occurred while verifying WebAuthn registration response`, err);
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'unacceptable_request',
+                    errorMessage: err.message,
                 };
             }
-        });
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error(`[AuthController] Error occurred while completing WebAuthn registration`, err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    listUserAuthenticators(userId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (!userId) {
-                    return {
-                        success: false,
-                        errorCode: 'not_logged_in',
-                        errorMessage: 'You need to be logged in for the operation to work.',
-                    };
-                }
-                const authenticators = yield this._store.listUserAuthenticators(userId);
+    async requestWebAuthnLogin(request) {
+        try {
+            if (this._webAuthNRelyingParties.length <= 0) {
                 return {
-                    success: true,
-                    authenticators: authenticators.map((a) => ({
-                        id: a.id,
-                        aaguid: a.aaguid,
-                        userId: a.userId,
-                        credentialId: a.credentialId,
-                        credentialDeviceType: a.credentialDeviceType,
-                        credentialBackedUp: a.credentialBackedUp,
-                        counter: a.counter,
-                        transports: a.transports,
-                        registeringUserAgent: a.registeringUserAgent,
-                        createdAtMs: a.createdAtMs,
-                    })),
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'WebAuthn is not supported on this server.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error(`[AuthController] Error occurred while listing user authenticators`, err);
+            const relyingParty = findRelyingPartyForOrigin(this._webAuthNRelyingParties, request.originOrHost);
+            if (!relyingParty) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_origin',
+                    errorMessage: 'The request must be made from an authorized origin.',
+                };
+            }
+            const options = await generateAuthenticationOptions({
+                rpID: relyingParty.id,
+                userVerification: 'preferred',
+            });
+            const requestId = uuid();
+            const nowMs = Date.now();
+            await this._store.saveWebAuthnLoginRequest({
+                requestId: requestId,
+                challenge: options.challenge,
+                requestTimeMs: nowMs,
+                expireTimeMs: nowMs + WEB_AUTHN_LOGIN_REQUEST_LIFETIME_MS,
+                completedTimeMs: null,
+                ipAddress: request.ipAddress,
+                userId: null,
+            });
+            return {
+                success: true,
+                requestId,
+                options,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error(`[AuthController] Error occurred while requesting WebAuthn login`, err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async completeWebAuthnLogin(request) {
+        try {
+            if (this._webAuthNRelyingParties.length <= 0) {
+                return {
+                    success: false,
+                    errorCode: 'not_supported',
+                    errorMessage: 'WebAuthn is not supported on this server.',
                 };
             }
-        });
-    }
-    deleteUserAuthenticator(userId, authenticatorId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (!userId) {
-                    return {
-                        success: false,
-                        errorCode: 'not_logged_in',
-                        errorMessage: 'You need to be logged in for the operation to work.',
-                    };
-                }
-                const numDeleted = yield this._store.deleteUserAuthenticator(userId, authenticatorId);
-                if (numDeleted <= 0) {
-                    return {
-                        success: false,
-                        errorCode: 'not_found',
-                        errorMessage: 'The given authenticator was not found.',
-                    };
-                }
+            const relyingParty = findRelyingPartyForOrigin(this._webAuthNRelyingParties, request.originOrHost);
+            if (!relyingParty) {
                 return {
-                    success: true,
+                    success: false,
+                    errorCode: 'invalid_origin',
+                    errorMessage: 'The request must be made from an authorized origin.',
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error(`[AuthController] Error occurred while deleting a user authenticator`, err);
+            const loginRequest = await this._store.findWebAuthnLoginRequest(request.requestId);
+            if (!loginRequest) {
+                console.error('could not find login request!');
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
                 };
             }
-        });
-    }
-    validateSessionKey(key) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof key !== 'string' || key === '') {
+            let validRequest = true;
+            if (Date.now() >= loginRequest.expireTimeMs) {
+                console.error('Expired!');
+                validRequest = false;
+            }
+            else if (loginRequest.completedTimeMs > 0) {
+                console.error('Completed!');
+                validRequest = false;
+            }
+            else if (loginRequest.ipAddress !== request.ipAddress) {
+                console.error('Wrong IP!');
+                validRequest = false;
+            }
+            if (!validRequest) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_session_key',
-                    errorMessage: 'The given session key is invalid. It must be a correctly formatted string.',
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            const { authenticator, user } = await this._store.findUserAuthenticatorByCredentialId(request.response.id);
+            if (!authenticator) {
+                console.error('No Authenticator!');
+                return {
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
+                };
+            }
+            if (user.banTimeMs > 0) {
+                return {
+                    success: false,
+                    errorCode: 'user_is_banned',
+                    errorMessage: 'The user has been banned.',
+                    banReason: user.banReason,
                 };
             }
             try {
-                const keyValues = parseSessionKey(key);
-                if (!keyValues) {
-                    console.log('[AuthController] [validateSessionKey] Could not parse key.');
-                    return {
-                        success: false,
-                        errorCode: 'unacceptable_session_key',
-                        errorMessage: 'The given session key is invalid. It must be a correctly formatted string.',
-                    };
-                }
-                const [userId, sessionId, sessionSecret] = keyValues;
-                const session = yield this._store.findSession(userId, sessionId);
-                if (!session) {
-                    console.log('[AuthController] [validateSessionKey] Could not find session.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                if (!this.verifyPasswordAgainstHashes(sessionSecret, session.sessionId, [session.secretHash])) {
-                    console.log('[AuthController] [validateSessionKey] Session secret was invalid.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                const now = Date.now();
-                if (session.revokeTimeMs && now >= session.revokeTimeMs) {
-                    console.log('[AuthController] [validateSessionKey] Session has been revoked.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                if (typeof session.expireTimeMs === 'number' &&
-                    now >= session.expireTimeMs) {
-                    console.log('[AuthController] [validateSessionKey] Session has expired.', session);
-                    return {
-                        success: false,
-                        errorCode: 'session_expired',
-                        errorMessage: 'The session has expired.',
-                    };
-                }
-                const userInfo = yield this._store.findUser(userId);
-                if (!userInfo) {
-                    console.log('[AuthController] [validateSessionKey] Unable to find user!');
+                const options = await verifyAuthenticationResponse({
+                    response: request.response,
+                    expectedChallenge: loginRequest.challenge,
+                    expectedOrigin: relyingParty.origin,
+                    expectedRPID: relyingParty.id,
+                    authenticator: {
+                        credentialID: new Uint8Array(base64URLStringToBuffer(authenticator.credentialId)),
+                        counter: authenticator.counter,
+                        credentialPublicKey: authenticator.credentialPublicKey,
+                        transports: authenticator.transports,
+                    },
+                });
+                if (!options.verified) {
+                    console.error('Not verified!');
                     return {
                         success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
+                        errorCode: 'invalid_request',
+                        errorMessage: INVALID_REQUEST_ERROR_MESSAGE,
                     };
                 }
-                else {
-                    if (typeof userInfo.allSessionRevokeTimeMs === 'number') {
-                        if (userInfo.allSessionRevokeTimeMs >=
-                            session.grantedTimeMs &&
-                            (session.revocable !== false || !!session.revokeTimeMs)) {
-                            return {
-                                success: false,
-                                errorCode: 'invalid_key',
-                                errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                            };
-                        }
-                    }
-                    if (userInfo.banTimeMs > 0) {
-                        return {
-                            success: false,
-                            errorCode: 'user_is_banned',
-                            errorMessage: 'The user has been banned.',
-                            banReason: userInfo.banReason,
-                        };
-                    }
-                }
-                const { subscriptionId, subscriptionTier } = yield this._getSubscriptionInfo(userInfo);
+                await this._store.saveUserAuthenticatorCounter(authenticator.id, options.authenticationInfo.newCounter);
+            }
+            catch (err) {
+                console.error(`[AuthController] Error occurred while verifying WebAuthn login response`, err);
                 return {
-                    success: true,
-                    userId: session.userId,
-                    sessionId: session.sessionId,
-                    allSessionsRevokedTimeMs: userInfo.allSessionRevokeTimeMs,
-                    subscriptionId: subscriptionId !== null && subscriptionId !== void 0 ? subscriptionId : undefined,
-                    subscriptionTier: subscriptionTier !== null && subscriptionTier !== void 0 ? subscriptionTier : undefined,
-                    privacyFeatures: userInfo.privacyFeatures,
-                    role: userInfo.role,
+                    success: false,
+                    errorCode: 'invalid_request',
+                    errorMessage: err.message,
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while validating a session key', err);
+            const { info } = await this._issueSession({
+                userId: user.id,
+                lifetimeMs: SESSION_LIFETIME_MS,
+                ipAddress: request.ipAddress,
+                webauthnRequestId: loginRequest.requestId,
+                oidRequestId: null,
+            });
+            return {
+                success: true,
+                ...info,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error(`[AuthController] Error occurred while requesting WebAuthn login`, err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async listUserAuthenticators(userId) {
+        try {
+            if (!userId) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_logged_in',
+                    errorMessage: 'You need to be logged in for the operation to work.',
                 };
             }
-        });
+            const authenticators = await this._store.listUserAuthenticators(userId);
+            return {
+                success: true,
+                authenticators: authenticators.map((a) => ({
+                    id: a.id,
+                    aaguid: a.aaguid,
+                    userId: a.userId,
+                    credentialId: a.credentialId,
+                    credentialDeviceType: a.credentialDeviceType,
+                    credentialBackedUp: a.credentialBackedUp,
+                    counter: a.counter,
+                    transports: a.transports,
+                    registeringUserAgent: a.registeringUserAgent,
+                    createdAtMs: a.createdAtMs,
+                })),
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error(`[AuthController] Error occurred while listing user authenticators`, err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    verifyPasswordAgainstHashes(sessionSecret, sessionId, hashes) {
-        return verifyPasswordAgainstHashes(sessionSecret, sessionId, hashes);
+    async deleteUserAuthenticator(userId, authenticatorId) {
+        try {
+            if (!userId) {
+                return {
+                    success: false,
+                    errorCode: 'not_logged_in',
+                    errorMessage: 'You need to be logged in for the operation to work.',
+                };
+            }
+            const numDeleted = await this._store.deleteUserAuthenticator(userId, authenticatorId);
+            if (numDeleted <= 0) {
+                return {
+                    success: false,
+                    errorCode: 'not_found',
+                    errorMessage: 'The given authenticator was not found.',
+                };
+            }
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error(`[AuthController] Error occurred while deleting a user authenticator`, err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    validateConnectionToken(token) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof token !== 'string' || token === '') {
+    async validateSessionKey(key) {
+        if (typeof key !== 'string' || key === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_session_key',
+                errorMessage: 'The given session key is invalid. It must be a correctly formatted string.',
+            };
+        }
+        try {
+            const keyValues = parseSessionKey(key);
+            if (!keyValues) {
+                console.log('[AuthController] [validateSessionKey] Could not parse key.');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_connection_token',
-                    errorMessage: 'The given connection token is invalid. It must be a correctly formatted string.',
+                    errorCode: 'unacceptable_session_key',
+                    errorMessage: 'The given session key is invalid. It must be a correctly formatted string.',
                 };
             }
-            try {
-                const tokenValues = parseConnectionToken(token);
-                if (!tokenValues) {
-                    console.log('[AuthController] [validateConnectionToken] Could not parse token.');
-                    return {
-                        success: false,
-                        errorCode: 'unacceptable_connection_token',
-                        errorMessage: 'The given connection token is invalid. It must be a correctly formatted string.',
-                    };
-                }
-                const [userId, sessionId, connectionId, recordName, inst, hash] = tokenValues;
-                const session = yield this._store.findSession(userId, sessionId);
-                if (!session) {
-                    console.log('[AuthController] [validateConnectionToken] Could not find session.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_token',
-                        errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
-                    };
-                }
-                if (!verifyConnectionToken(token, session.connectionSecret)) {
-                    console.log('[AuthController] [validateConnectionToken] Connection token was invalid.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_token',
-                        errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
-                    };
-                }
-                const now = Date.now();
-                if (session.revokeTimeMs && now >= session.revokeTimeMs) {
-                    console.log('[AuthController] [validateConnectionToken] Session has been revoked.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_token',
-                        errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
-                    };
-                }
-                if (typeof session.expireTimeMs === 'number' &&
-                    now >= session.expireTimeMs) {
-                    console.log('[AuthController] [validateConnectionToken] Session has expired.');
-                    return {
-                        success: false,
-                        errorCode: 'session_expired',
-                        errorMessage: 'The session has expired.',
-                    };
-                }
-                const userInfo = yield this._store.findUser(userId);
-                if (!userInfo) {
-                    console.log('[AuthController] [validateConnectionToken] Unable to find user!');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_token',
-                        errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
-                    };
-                }
-                else {
-                    if (typeof userInfo.allSessionRevokeTimeMs === 'number') {
-                        if (userInfo.allSessionRevokeTimeMs >=
-                            session.grantedTimeMs &&
-                            (session.revocable !== false || !!session.revokeTimeMs)) {
-                            return {
-                                success: false,
-                                errorCode: 'invalid_token',
-                                errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
-                            };
-                        }
-                    }
-                    if (userInfo.banTimeMs > 0) {
-                        return {
-                            success: false,
-                            errorCode: 'user_is_banned',
-                            errorMessage: 'The user has been banned.',
-                            banReason: userInfo.banReason,
-                        };
-                    }
-                }
-                const { subscriptionId, subscriptionTier } = yield this._getSubscriptionInfo(userInfo);
+            const [userId, sessionId, sessionSecret] = keyValues;
+            const session = await this._store.findSession(userId, sessionId);
+            if (!session) {
+                console.log('[AuthController] [validateSessionKey] Could not find session.');
                 return {
-                    success: true,
-                    userId: session.userId,
-                    sessionId: session.sessionId,
-                    connectionId: connectionId,
-                    recordName: recordName,
-                    inst: inst,
-                    allSessionsRevokedTimeMs: userInfo.allSessionRevokeTimeMs,
-                    subscriptionId: subscriptionId !== null && subscriptionId !== void 0 ? subscriptionId : undefined,
-                    subscriptionTier: subscriptionTier !== null && subscriptionTier !== void 0 ? subscriptionTier : undefined,
-                    privacyFeatures: userInfo.privacyFeatures,
+                    success: false,
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while validating a connection token', err);
+            if (!this.verifyPasswordAgainstHashes(sessionSecret, session.sessionId, [session.secretHash])) {
+                console.log('[AuthController] [validateSessionKey] Session secret was invalid.');
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-        });
-    }
-    revokeSession(request) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof request.userId !== 'string' || request.userId === '') {
+            const now = Date.now();
+            if (session.revokeTimeMs && now >= session.revokeTimeMs) {
+                console.log('[AuthController] [validateSessionKey] Session has been revoked.');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_user_id',
-                    errorMessage: 'The given userId is invalid. It must be a string.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-            else if (typeof request.sessionId !== 'string' ||
-                request.sessionId === '') {
+            if (typeof session.expireTimeMs === 'number' &&
+                now >= session.expireTimeMs) {
+                console.log('[AuthController] [validateSessionKey] Session has expired.', session);
                 return {
                     success: false,
-                    errorCode: 'unacceptable_session_id',
-                    errorMessage: 'The given sessionId is invalid. It must be a string.',
+                    errorCode: 'session_expired',
+                    errorMessage: 'The session has expired.',
                 };
             }
-            else if (typeof request.sessionKey !== 'string' ||
-                request.sessionKey === '') {
+            const userInfo = await this._store.findUser(userId);
+            if (!userInfo) {
+                console.log('[AuthController] [validateSessionKey] Unable to find user!');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_session_key',
-                    errorMessage: 'The given session key is invalid. It must be a string.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-            try {
-                const keyResult = yield this.validateSessionKey(request.sessionKey);
-                if (keyResult.success === false) {
-                    return keyResult;
-                }
-                else if (keyResult.userId !== request.userId) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                const session = yield this._store.findSession(request.userId, request.sessionId);
-                if (!session) {
-                    return {
-                        success: false,
-                        errorCode: 'session_not_found',
-                        errorMessage: 'The session was not found.',
-                    };
-                }
-                if (session.revokeTimeMs) {
-                    return {
-                        success: false,
-                        errorCode: 'session_already_revoked',
-                        errorMessage: 'The session has already been revoked.',
-                    };
+            else {
+                if (typeof userInfo.allSessionRevokeTimeMs === 'number') {
+                    if (userInfo.allSessionRevokeTimeMs >=
+                        session.grantedTimeMs &&
+                        (session.revocable !== false || !!session.revokeTimeMs)) {
+                        return {
+                            success: false,
+                            errorCode: 'invalid_key',
+                            errorMessage: INVALID_KEY_ERROR_MESSAGE,
+                        };
+                    }
                 }
-                if (session.revocable === false) {
+                if (userInfo.banTimeMs > 0) {
                     return {
                         success: false,
-                        errorCode: 'session_is_not_revokable',
-                        errorMessage: 'The session cannot be revoked.',
+                        errorCode: 'user_is_banned',
+                        errorMessage: 'The user has been banned.',
+                        banReason: userInfo.banReason,
                     };
                 }
-                const newSession = Object.assign(Object.assign({}, session), { revokeTimeMs: Date.now() });
-                yield this._store.saveSession(newSession);
-                let logoutUrl;
-                if (session.oidProvider === PRIVO_OPEN_ID_PROVIDER) {
-                    logoutUrl = yield this._privoClient.generateLogoutUrl((_a = session.oidIdToken) !== null && _a !== void 0 ? _a : session.oidAccessToken);
-                }
-                return {
-                    success: true,
-                    logoutUrl,
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while revoking session', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error ocurred.',
-                };
             }
-        });
+            const { subscriptionId, subscriptionTier } = await this._getSubscriptionInfo(userInfo);
+            return {
+                success: true,
+                userId: session.userId,
+                sessionId: session.sessionId,
+                allSessionsRevokedTimeMs: userInfo.allSessionRevokeTimeMs,
+                subscriptionId: subscriptionId !== null && subscriptionId !== void 0 ? subscriptionId : undefined,
+                subscriptionTier: subscriptionTier !== null && subscriptionTier !== void 0 ? subscriptionTier : undefined,
+                privacyFeatures: userInfo.privacyFeatures,
+                role: userInfo.role,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while validating a session key', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    /**
-     * Attempts to revoke all the sessions for the specified user.
-     * @param request The request.
-     */
-    revokeAllSessions(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof request.userId !== 'string' || request.userId === '') {
+    verifyPasswordAgainstHashes(sessionSecret, sessionId, hashes) {
+        return verifyPasswordAgainstHashes(sessionSecret, sessionId, hashes);
+    }
+    async validateConnectionToken(token) {
+        if (typeof token !== 'string' || token === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_connection_token',
+                errorMessage: 'The given connection token is invalid. It must be a correctly formatted string.',
+            };
+        }
+        try {
+            const tokenValues = parseConnectionToken(token);
+            if (!tokenValues) {
+                console.log('[AuthController] [validateConnectionToken] Could not parse token.');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_user_id',
-                    errorMessage: 'The given userId is invalid. It must be a string.',
+                    errorCode: 'unacceptable_connection_token',
+                    errorMessage: 'The given connection token is invalid. It must be a correctly formatted string.',
                 };
             }
-            else if (typeof request.sessionKey !== 'string' ||
-                request.sessionKey === '') {
+            const [userId, sessionId, connectionId, recordName, inst, hash] = tokenValues;
+            const session = await this._store.findSession(userId, sessionId);
+            if (!session) {
+                console.log('[AuthController] [validateConnectionToken] Could not find session.');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_session_key',
-                    errorMessage: 'The given session key is invalid. It must be a string.',
+                    errorCode: 'invalid_token',
+                    errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
                 };
             }
-            try {
-                const keyResult = yield this.validateSessionKey(request.sessionKey);
-                if (keyResult.success === false) {
-                    return keyResult;
-                }
-                else if (keyResult.userId !== request.userId) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                yield this._store.setRevokeAllSessionsTimeForUser(request.userId, Date.now());
+            if (!verifyConnectionToken(token, session.connectionSecret)) {
+                console.log('[AuthController] [validateConnectionToken] Connection token was invalid.');
                 return {
-                    success: true,
+                    success: false,
+                    errorCode: 'invalid_token',
+                    errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while revoking all sessions', err);
+            const now = Date.now();
+            if (session.revokeTimeMs && now >= session.revokeTimeMs) {
+                console.log('[AuthController] [validateConnectionToken] Session has been revoked.');
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_token',
+                    errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
                 };
             }
-        });
-    }
-    /**
-     * Attempts to replace the given session key with a new key.
-     * @param request The request.
-     */
-    replaceSession(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof request.sessionKey !== 'string' ||
-                request.sessionKey === '') {
+            if (typeof session.expireTimeMs === 'number' &&
+                now >= session.expireTimeMs) {
+                console.log('[AuthController] [validateConnectionToken] Session has expired.');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_session_key',
-                    errorMessage: 'The given sessionKey is invalid. It must be a string.',
+                    errorCode: 'session_expired',
+                    errorMessage: 'The session has expired.',
                 };
             }
-            else if (typeof request.ipAddress !== 'string' ||
-                request.ipAddress === '') {
+            const userInfo = await this._store.findUser(userId);
+            if (!userInfo) {
+                console.log('[AuthController] [validateConnectionToken] Unable to find user!');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_ip_address',
-                    errorMessage: 'The given IP address is invalid. It must be a string.',
+                    errorCode: 'invalid_token',
+                    errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
                 };
             }
-            try {
-                const keyResult = yield this.validateSessionKey(request.sessionKey);
-                if (keyResult.success === false) {
-                    return keyResult;
-                }
-                const userId = keyResult.userId;
-                const session = yield this._store.findSession(userId, keyResult.sessionId);
-                if (!session) {
-                    console.log('[AuthController] [replaceSession] Could not find session.');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
+            else {
+                if (typeof userInfo.allSessionRevokeTimeMs === 'number') {
+                    if (userInfo.allSessionRevokeTimeMs >=
+                        session.grantedTimeMs &&
+                        (session.revocable !== false || !!session.revokeTimeMs)) {
+                        return {
+                            success: false,
+                            errorCode: 'invalid_token',
+                            errorMessage: INVALID_TOKEN_ERROR_MESSAGE,
+                        };
+                    }
                 }
-                if (session.revocable === false) {
-                    console.log('[AuthController] [replaceSession] Session is irrevokable.');
+                if (userInfo.banTimeMs > 0) {
                     return {
                         success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
+                        errorCode: 'user_is_banned',
+                        errorMessage: 'The user has been banned.',
+                        banReason: userInfo.banReason,
                     };
                 }
-                const { info } = yield this._issueSession({
-                    userId,
-                    lifetimeMs: SESSION_LIFETIME_MS,
-                    previousSession: session,
-                    ipAddress: request.ipAddress,
-                });
-                return Object.assign({ success: true }, info);
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while replacing session', err);
+            const { subscriptionId, subscriptionTier } = await this._getSubscriptionInfo(userInfo);
+            return {
+                success: true,
+                userId: session.userId,
+                sessionId: session.sessionId,
+                connectionId: connectionId,
+                recordName: recordName,
+                inst: inst,
+                allSessionsRevokedTimeMs: userInfo.allSessionRevokeTimeMs,
+                subscriptionId: subscriptionId !== null && subscriptionId !== void 0 ? subscriptionId : undefined,
+                subscriptionTier: subscriptionTier !== null && subscriptionTier !== void 0 ? subscriptionTier : undefined,
+                privacyFeatures: userInfo.privacyFeatures,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while validating a connection token', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async revokeSession(request) {
+        var _a;
+        if (typeof request.userId !== 'string' || request.userId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_user_id',
+                errorMessage: 'The given userId is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.sessionId !== 'string' ||
+            request.sessionId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_session_id',
+                errorMessage: 'The given sessionId is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.sessionKey !== 'string' ||
+            request.sessionKey === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_session_key',
+                errorMessage: 'The given session key is invalid. It must be a string.',
+            };
+        }
+        try {
+            const keyResult = await this.validateSessionKey(request.sessionKey);
+            if (keyResult.success === false) {
+                return keyResult;
+            }
+            else if (keyResult.userId !== request.userId) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error ocurred.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-        });
-    }
-    /**
-     * Lists all the sessions for a given user.
-     * @param request The request.
-     */
-    listSessions(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof request.userId !== 'string' || request.userId === '') {
+            const session = await this._store.findSession(request.userId, request.sessionId);
+            if (!session) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_user_id',
-                    errorMessage: 'The given userId is invalid. It must be a string.',
+                    errorCode: 'session_not_found',
+                    errorMessage: 'The session was not found.',
                 };
             }
-            else if (typeof request.expireTimeMs !== 'number' &&
-                request.expireTimeMs !== null &&
-                typeof request.expireTimeMs !== 'undefined') {
+            if (session.revokeTimeMs) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_expire_time',
-                    errorMessage: 'The given expiration time is invalid. It must be a number or null.',
+                    errorCode: 'session_already_revoked',
+                    errorMessage: 'The session has already been revoked.',
                 };
             }
-            else if (typeof request.sessionKey !== 'string' ||
-                request.sessionKey === '') {
+            if (session.revocable === false) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_session_key',
-                    errorMessage: 'The given session key is invalid. It must be a string.',
+                    errorCode: 'session_is_not_revokable',
+                    errorMessage: 'The session cannot be revoked.',
                 };
             }
-            try {
-                const keyResult = yield this.validateSessionKey(request.sessionKey);
-                if (keyResult.success === false) {
-                    return keyResult;
-                }
-                else if (!isSuperUserRole(keyResult.role) &&
-                    keyResult.userId !== request.userId) {
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                const result = yield this._store.listSessions(request.userId, request.expireTimeMs);
-                if (result.success === false) {
-                    return result;
-                }
-                return {
-                    success: true,
-                    sessions: result.sessions.map((s) => ({
-                        userId: s.userId,
-                        sessionId: s.sessionId,
-                        grantedTimeMs: s.grantedTimeMs,
-                        expireTimeMs: s.expireTimeMs,
-                        revokeTimeMs: keyResult.allSessionsRevokedTimeMs >= s.grantedTimeMs &&
-                            (!s.revokeTimeMs ||
-                                s.revokeTimeMs > keyResult.allSessionsRevokedTimeMs)
-                            ? keyResult.allSessionsRevokedTimeMs
-                            : s.revokeTimeMs,
-                        currentSession: s.sessionId === keyResult.sessionId,
-                        ipAddress: s.ipAddress,
-                        nextSessionId: s.nextSessionId,
-                    })),
-                };
+            const newSession = {
+                ...session,
+                revokeTimeMs: Date.now(),
+            };
+            await this._store.saveSession(newSession);
+            let logoutUrl;
+            if (session.oidProvider === PRIVO_OPEN_ID_PROVIDER) {
+                logoutUrl = await this._privoClient.generateLogoutUrl((_a = session.oidIdToken) !== null && _a !== void 0 ? _a : session.oidAccessToken);
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while listing sessions', err);
+            return {
+                success: true,
+                logoutUrl,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while revoking session', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error ocurred.',
+            };
+        }
+    }
+    /**
+     * Attempts to revoke all the sessions for the specified user.
+     * @param request The request.
+     */
+    async revokeAllSessions(request) {
+        if (typeof request.userId !== 'string' || request.userId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_user_id',
+                errorMessage: 'The given userId is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.sessionKey !== 'string' ||
+            request.sessionKey === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_session_key',
+                errorMessage: 'The given session key is invalid. It must be a string.',
+            };
+        }
+        try {
+            const keyResult = await this.validateSessionKey(request.sessionKey);
+            if (keyResult.success === false) {
+                return keyResult;
+            }
+            else if (keyResult.userId !== request.userId) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-        });
+            await this._store.setRevokeAllSessionsTimeForUser(request.userId, Date.now());
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while revoking all sessions', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
-     * Gets the information for a specific user.
+     * Attempts to replace the given session key with a new key.
      * @param request The request.
      */
-    getUserInfo(request) {
-        var _a, _b, _c, _d, _e;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof request.userId !== 'string' || request.userId === '') {
+    async replaceSession(request) {
+        if (typeof request.sessionKey !== 'string' ||
+            request.sessionKey === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_session_key',
+                errorMessage: 'The given sessionKey is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.ipAddress !== 'string' ||
+            request.ipAddress === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_ip_address',
+                errorMessage: 'The given IP address is invalid. It must be a string.',
+            };
+        }
+        try {
+            const keyResult = await this.validateSessionKey(request.sessionKey);
+            if (keyResult.success === false) {
+                return keyResult;
+            }
+            const userId = keyResult.userId;
+            const session = await this._store.findSession(userId, keyResult.sessionId);
+            if (!session) {
+                console.log('[AuthController] [replaceSession] Could not find session.');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_user_id',
-                    errorMessage: 'The given userId is invalid. It must be a string.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-            else if (typeof request.sessionKey !== 'string' ||
-                request.sessionKey === '') {
+            if (session.revocable === false) {
+                console.log('[AuthController] [replaceSession] Session is irrevokable.');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_session_key',
-                    errorMessage: 'The given session key is invalid. It must be a string.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-            try {
-                const keyResult = yield this.validateSessionKey(request.sessionKey);
-                if (keyResult.success === false) {
-                    return keyResult;
-                }
-                else if (!isSuperUserRole(keyResult.role) &&
-                    keyResult.userId !== request.userId) {
-                    console.log('[AuthController] [getUserInfo] Request User ID doesnt match session key User ID!');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                const result = yield this._store.findUser(request.userId);
-                if (!result) {
-                    throw new Error('Unable to find user even though a valid session key was presented!');
-                }
-                const { hasActiveSubscription, subscriptionTier: tier } = yield this._getSubscriptionInfo(result);
-                let privacyFeatures;
-                let displayName = null;
-                let email = result.email;
-                let name = result.name;
-                const privoConfig = yield this._config.getPrivoConfiguration();
-                if (privoConfig && result.privoServiceId) {
-                    const userInfo = yield this._privoClient.getUserInfo(result.privoServiceId);
-                    privacyFeatures = getPrivacyFeaturesFromPermissions(privoConfig.featureIds, userInfo.permissions);
-                    displayName = userInfo.displayName;
-                    email = userInfo.email;
-                    name = userInfo.givenName;
-                    if (((_a = result.privacyFeatures) === null || _a === void 0 ? void 0 : _a.publishData) !==
-                        privacyFeatures.publishData ||
-                        ((_b = result.privacyFeatures) === null || _b === void 0 ? void 0 : _b.allowPublicData) !==
-                            privacyFeatures.allowPublicData ||
-                        ((_c = result.privacyFeatures) === null || _c === void 0 ? void 0 : _c.allowAI) !==
-                            privacyFeatures.allowAI ||
-                        ((_d = result.privacyFeatures) === null || _d === void 0 ? void 0 : _d.allowPublicInsts) !==
-                            privacyFeatures.allowPublicInsts) {
-                        yield this._store.saveUser(Object.assign(Object.assign({}, result), { privacyFeatures: Object.assign({}, privacyFeatures) }));
-                    }
-                }
-                else if (result.privacyFeatures) {
-                    privacyFeatures = Object.assign({}, result.privacyFeatures);
-                }
-                else {
-                    privacyFeatures = {
-                        publishData: true,
-                        allowPublicData: true,
-                        allowAI: true,
-                        allowPublicInsts: true,
-                    };
-                }
+            const { info } = await this._issueSession({
+                userId,
+                lifetimeMs: SESSION_LIFETIME_MS,
+                previousSession: session,
+                ipAddress: request.ipAddress,
+            });
+            return {
+                success: true,
+                ...info,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while replacing session', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error ocurred.',
+            };
+        }
+    }
+    /**
+     * Lists all the sessions for a given user.
+     * @param request The request.
+     */
+    async listSessions(request) {
+        if (typeof request.userId !== 'string' || request.userId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_user_id',
+                errorMessage: 'The given userId is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.expireTimeMs !== 'number' &&
+            request.expireTimeMs !== null &&
+            typeof request.expireTimeMs !== 'undefined') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_expire_time',
+                errorMessage: 'The given expiration time is invalid. It must be a number or null.',
+            };
+        }
+        else if (typeof request.sessionKey !== 'string' ||
+            request.sessionKey === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_session_key',
+                errorMessage: 'The given session key is invalid. It must be a string.',
+            };
+        }
+        try {
+            const keyResult = await this.validateSessionKey(request.sessionKey);
+            if (keyResult.success === false) {
+                return keyResult;
+            }
+            else if (!isSuperUserRole(keyResult.role) &&
+                keyResult.userId !== request.userId) {
                 return {
-                    success: true,
-                    userId: result.id,
-                    name: name,
-                    displayName,
-                    email: email,
-                    phoneNumber: result.phoneNumber,
-                    avatarPortraitUrl: result.avatarPortraitUrl,
-                    avatarUrl: result.avatarUrl,
-                    hasActiveSubscription: hasActiveSubscription,
-                    subscriptionTier: tier !== null && tier !== void 0 ? tier : null,
-                    privacyFeatures: privacyFeatures,
-                    role: (_e = result.role) !== null && _e !== void 0 ? _e : 'none',
+                    success: false,
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while getting user info', err);
+            const result = await this._store.listSessions(request.userId, request.expireTimeMs);
+            if (result.success === false) {
+                return result;
+            }
+            return {
+                success: true,
+                sessions: result.sessions.map((s) => ({
+                    userId: s.userId,
+                    sessionId: s.sessionId,
+                    grantedTimeMs: s.grantedTimeMs,
+                    expireTimeMs: s.expireTimeMs,
+                    revokeTimeMs: keyResult.allSessionsRevokedTimeMs >= s.grantedTimeMs &&
+                        (!s.revokeTimeMs ||
+                            s.revokeTimeMs > keyResult.allSessionsRevokedTimeMs)
+                        ? keyResult.allSessionsRevokedTimeMs
+                        : s.revokeTimeMs,
+                    currentSession: s.sessionId === keyResult.sessionId,
+                    ipAddress: s.ipAddress,
+                    nextSessionId: s.nextSessionId,
+                })),
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while listing sessions', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    /**
+     * Gets the information for a specific user.
+     * @param request The request.
+     */
+    async getUserInfo(request) {
+        var _a, _b, _c, _d, _e;
+        if (typeof request.userId !== 'string' || request.userId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_user_id',
+                errorMessage: 'The given userId is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.sessionKey !== 'string' ||
+            request.sessionKey === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_session_key',
+                errorMessage: 'The given session key is invalid. It must be a string.',
+            };
+        }
+        try {
+            const keyResult = await this.validateSessionKey(request.sessionKey);
+            if (keyResult.success === false) {
+                return keyResult;
+            }
+            else if (!isSuperUserRole(keyResult.role) &&
+                keyResult.userId !== request.userId) {
+                console.log('[AuthController] [getUserInfo] Request User ID doesnt match session key User ID!');
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
+                };
+            }
+            const result = await this._store.findUser(request.userId);
+            if (!result) {
+                throw new Error('Unable to find user even though a valid session key was presented!');
+            }
+            const { hasActiveSubscription, subscriptionTier: tier } = await this._getSubscriptionInfo(result);
+            let privacyFeatures;
+            let displayName = null;
+            let email = result.email;
+            let name = result.name;
+            const privoConfig = await this._config.getPrivoConfiguration();
+            if (privoConfig && result.privoServiceId) {
+                const userInfo = await this._privoClient.getUserInfo(result.privoServiceId);
+                privacyFeatures = getPrivacyFeaturesFromPermissions(privoConfig.featureIds, userInfo.permissions);
+                displayName = userInfo.displayName;
+                email = userInfo.email;
+                name = userInfo.givenName;
+                if (((_a = result.privacyFeatures) === null || _a === void 0 ? void 0 : _a.publishData) !==
+                    privacyFeatures.publishData ||
+                    ((_b = result.privacyFeatures) === null || _b === void 0 ? void 0 : _b.allowPublicData) !==
+                        privacyFeatures.allowPublicData ||
+                    ((_c = result.privacyFeatures) === null || _c === void 0 ? void 0 : _c.allowAI) !==
+                        privacyFeatures.allowAI ||
+                    ((_d = result.privacyFeatures) === null || _d === void 0 ? void 0 : _d.allowPublicInsts) !==
+                        privacyFeatures.allowPublicInsts) {
+                    await this._store.saveUser({
+                        ...result,
+                        privacyFeatures: {
+                            ...privacyFeatures,
+                        },
+                    });
+                }
+            }
+            else if (result.privacyFeatures) {
+                privacyFeatures = {
+                    ...result.privacyFeatures,
+                };
+            }
+            else {
+                privacyFeatures = {
+                    publishData: true,
+                    allowPublicData: true,
+                    allowAI: true,
+                    allowPublicInsts: true,
                 };
             }
-        });
+            return {
+                success: true,
+                userId: result.id,
+                name: name,
+                displayName,
+                email: email,
+                phoneNumber: result.phoneNumber,
+                avatarPortraitUrl: result.avatarPortraitUrl,
+                avatarUrl: result.avatarUrl,
+                hasActiveSubscription: hasActiveSubscription,
+                subscriptionTier: tier !== null && tier !== void 0 ? tier : null,
+                privacyFeatures: privacyFeatures,
+                role: (_e = result.role) !== null && _e !== void 0 ? _e : 'none',
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while getting user info', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Gets the public information for a specific user.
      * @param userId The ID of the user whose information is being requested.
      */
-    getPublicUserInfo(userId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof userId !== 'string' || userId === '') {
-                return {
-                    success: false,
-                    errorCode: 'unacceptable_user_id',
-                    errorMessage: 'The given userId is invalid. It must be a string.',
-                };
-            }
-            try {
-                const result = yield this._store.findUser(userId);
-                if (!result) {
-                    return {
-                        success: true,
-                        user: null,
-                    };
-                }
-                let displayName = null;
-                const privoConfig = yield this._config.getPrivoConfiguration();
-                if (privoConfig && result.privoServiceId) {
-                    const userInfo = yield this._privoClient.getUserInfo(result.privoServiceId);
-                    displayName = userInfo.displayName;
-                }
+    async getPublicUserInfo(userId) {
+        if (typeof userId !== 'string' || userId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_user_id',
+                errorMessage: 'The given userId is invalid. It must be a string.',
+            };
+        }
+        try {
+            const result = await this._store.findUser(userId);
+            if (!result) {
                 return {
                     success: true,
-                    user: {
-                        userId: result.id,
-                        name: result.name,
-                        email: result.email,
-                        displayName,
-                    },
+                    user: null,
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while getting user info', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+            let displayName = null;
+            const privoConfig = await this._config.getPrivoConfiguration();
+            if (privoConfig && result.privoServiceId) {
+                const userInfo = await this._privoClient.getUserInfo(result.privoServiceId);
+                displayName = userInfo.displayName;
             }
-        });
+            return {
+                success: true,
+                user: {
+                    userId: result.id,
+                    name: result.name,
+                    email: result.email,
+                    displayName,
+                },
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while getting user info', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    _getSubscriptionInfo(user) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const hasActiveSubscription = this._forceAllowSubscriptionFeatures ||
-                isActiveSubscription(user.subscriptionStatus);
-            let tier = null;
-            let sub = null;
-            const subscriptionConfig = yield this._config.getSubscriptionConfiguration();
-            if (hasActiveSubscription) {
-                if (user.subscriptionId) {
-                    sub = subscriptionConfig === null || subscriptionConfig === void 0 ? void 0 : subscriptionConfig.subscriptions.find((s) => s.id === user.subscriptionId);
-                }
-                if (!sub) {
-                    sub = subscriptionConfig === null || subscriptionConfig === void 0 ? void 0 : subscriptionConfig.subscriptions[0];
-                    if (sub) {
-                        console.log('[AuthController] [getUserInfo] Using first subscription for user.');
-                    }
-                }
-                tier = 'beta';
+    async _getSubscriptionInfo(user) {
+        const hasActiveSubscription = this._forceAllowSubscriptionFeatures ||
+            isActiveSubscription(user.subscriptionStatus);
+        let tier = null;
+        let sub = null;
+        const subscriptionConfig = await this._config.getSubscriptionConfiguration();
+        if (hasActiveSubscription) {
+            if (user.subscriptionId) {
+                sub = subscriptionConfig === null || subscriptionConfig === void 0 ? void 0 : subscriptionConfig.subscriptions.find((s) => s.id === user.subscriptionId);
             }
             if (!sub) {
-                sub = subscriptionConfig === null || subscriptionConfig === void 0 ? void 0 : subscriptionConfig.subscriptions.find((s) => s.defaultSubscription);
+                sub = subscriptionConfig === null || subscriptionConfig === void 0 ? void 0 : subscriptionConfig.subscriptions[0];
                 if (sub) {
-                    console.log('[AuthController] [getUserInfo] Using default subscription for user.');
+                    console.log('[AuthController] [getUserInfo] Using first subscription for user.');
                 }
             }
+            tier = 'beta';
+        }
+        if (!sub) {
+            sub = subscriptionConfig === null || subscriptionConfig === void 0 ? void 0 : subscriptionConfig.subscriptions.find((s) => s.defaultSubscription);
             if (sub) {
-                tier = sub.tier || 'beta';
+                console.log('[AuthController] [getUserInfo] Using default subscription for user.');
             }
-            return {
-                hasActiveSubscription,
-                subscriptionId: sub === null || sub === void 0 ? void 0 : sub.id,
-                subscriptionTier: tier,
-            };
-        });
+        }
+        if (sub) {
+            tier = sub.tier || 'beta';
+        }
+        return {
+            hasActiveSubscription,
+            subscriptionId: sub === null || sub === void 0 ? void 0 : sub.id,
+            subscriptionTier: tier,
+        };
     }
     /**
      * Attempts to update a user's metadata.
      * @param request The request for the operation.
      */
-    updateUserInfo(request) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (typeof request.userId !== 'string' || request.userId === '') {
+    async updateUserInfo(request) {
+        if (typeof request.userId !== 'string' || request.userId === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_user_id',
+                errorMessage: 'The given userId is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.sessionKey !== 'string' ||
+            request.sessionKey === '') {
+            return {
+                success: false,
+                errorCode: 'unacceptable_session_key',
+                errorMessage: 'The given session key is invalid. It must be a string.',
+            };
+        }
+        else if (typeof request.update !== 'object' ||
+            request.update === null ||
+            Array.isArray(request.update)) {
+            return {
+                success: false,
+                errorCode: 'unacceptable_update',
+                errorMessage: 'The given update is invalid. It must be an object.',
+            };
+        }
+        try {
+            const keyResult = await this.validateSessionKey(request.sessionKey);
+            if (keyResult.success === false) {
+                return keyResult;
+            }
+            else if (keyResult.userId !== request.userId) {
+                console.log('[AuthController] [updateUserInfo] Request User ID doesnt match session key User ID!');
                 return {
                     success: false,
-                    errorCode: 'unacceptable_user_id',
-                    errorMessage: 'The given userId is invalid. It must be a string.',
-                };
-            }
-            else if (typeof request.sessionKey !== 'string' ||
-                request.sessionKey === '') {
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
+                };
+            }
+            const user = await this._store.findUser(request.userId);
+            if (!user) {
+                throw new Error('Unable to find user even though a valid session key was presented!');
+            }
+            const cleaned = cleanupObject({
+                name: request.update.name,
+                avatarUrl: request.update.avatarUrl,
+                avatarPortraitUrl: request.update.avatarPortraitUrl,
+                email: request.update.email,
+                phoneNumber: request.update.phoneNumber,
+            });
+            await this._store.saveUser({
+                ...user,
+                ...cleaned,
+            });
+            return {
+                success: true,
+                userId: user.id,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while getting user info', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    /**
+     * Attempts to request a change in privacy features for a user.
+     */
+    async requestPrivacyFeaturesChange(request) {
+        var _a;
+        try {
+            if (!this._privoClient) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_session_key',
-                    errorMessage: 'The given session key is invalid. It must be a string.',
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
                 };
             }
-            else if (typeof request.update !== 'object' ||
-                request.update === null ||
-                Array.isArray(request.update)) {
+            const config = await this._config.getPrivoConfiguration();
+            if (!config) {
                 return {
                     success: false,
-                    errorCode: 'unacceptable_update',
-                    errorMessage: 'The given update is invalid. It must be an object.',
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
                 };
             }
-            try {
-                const keyResult = yield this.validateSessionKey(request.sessionKey);
-                if (keyResult.success === false) {
-                    return keyResult;
-                }
-                else if (keyResult.userId !== request.userId) {
-                    console.log('[AuthController] [updateUserInfo] Request User ID doesnt match session key User ID!');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                const user = yield this._store.findUser(request.userId);
-                if (!user) {
-                    throw new Error('Unable to find user even though a valid session key was presented!');
-                }
-                const cleaned = cleanupObject({
-                    name: request.update.name,
-                    avatarUrl: request.update.avatarUrl,
-                    avatarPortraitUrl: request.update.avatarPortraitUrl,
-                    email: request.update.email,
-                    phoneNumber: request.update.phoneNumber,
-                });
-                yield this._store.saveUser(Object.assign(Object.assign({}, user), cleaned));
-                return {
-                    success: true,
-                    userId: user.id,
-                };
+            const keyResult = await this.validateSessionKey(request.sessionKey);
+            if (keyResult.success === false) {
+                return keyResult;
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while getting user info', err);
+            else if (keyResult.userId !== request.userId &&
+                keyResult.role !== 'superUser') {
+                console.log('[AuthController] [requestPrivacyFeaturesChange] Request User ID doesnt match session key User ID!');
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'invalid_key',
+                    errorMessage: INVALID_KEY_ERROR_MESSAGE,
                 };
             }
-        });
-    }
-    /**
-     * Attempts to request a change in privacy features for a user.
-     */
-    requestPrivacyFeaturesChange(request) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (!this._privoClient) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const config = yield this._config.getPrivoConfiguration();
-                if (!config) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const keyResult = yield this.validateSessionKey(request.sessionKey);
-                if (keyResult.success === false) {
-                    return keyResult;
-                }
-                else if (keyResult.userId !== request.userId &&
-                    keyResult.role !== 'superUser') {
-                    console.log('[AuthController] [requestPrivacyFeaturesChange] Request User ID doesnt match session key User ID!');
-                    return {
-                        success: false,
-                        errorCode: 'invalid_key',
-                        errorMessage: INVALID_KEY_ERROR_MESSAGE,
-                    };
-                }
-                const user = yield this._store.findUser(request.userId);
-                if (!user) {
-                    throw new Error('Unable to find user even though a valid session key was presented!');
-                }
-                if (!user.privoServiceId) {
-                    return {
-                        success: false,
-                        errorCode: 'not_supported',
-                        errorMessage: 'Privo features are not supported on this server.',
-                    };
-                }
-                const result = yield this._privoClient.resendConsentRequest(user.privoServiceId, (_a = user.privoParentServiceId) !== null && _a !== void 0 ? _a : user.privoServiceId);
-                if (result.success === false) {
-                    return result;
-                }
-                console.log(`[AuthController] [requestPrivacyFeaturesChange] [userId: ${request.userId}] Requested privacy features change.`);
-                return {
-                    success: true,
-                };
+            const user = await this._store.findUser(request.userId);
+            if (!user) {
+                throw new Error('Unable to find user even though a valid session key was presented!');
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while requesting a change in privacy features', err);
+            if (!user.privoServiceId) {
                 return {
                     success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
+                    errorCode: 'not_supported',
+                    errorMessage: 'Privo features are not supported on this server.',
                 };
             }
-        });
+            const result = await this._privoClient.resendConsentRequest(user.privoServiceId, (_a = user.privoParentServiceId) !== null && _a !== void 0 ? _a : user.privoServiceId);
+            if (result.success === false) {
+                return result;
+            }
+            console.log(`[AuthController] [requestPrivacyFeaturesChange] [userId: ${request.userId}] Requested privacy features change.`);
+            return {
+                success: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while requesting a change in privacy features', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Lists the email rules that should be used.
      */
-    listEmailRules() {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const rules = yield this._store.listEmailRules();
-                return {
-                    success: true,
-                    rules,
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while listing email rules', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
-            }
-        });
+    async listEmailRules() {
+        try {
+            const rules = await this._store.listEmailRules();
+            return {
+                success: true,
+                rules,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while listing email rules', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Lists the SMS rules that should be used.
      */
-    listSmsRules() {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const rules = yield this._store.listSmsRules();
+    async listSmsRules() {
+        try {
+            const rules = await this._store.listSmsRules();
+            return {
+                success: true,
+                rules,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while listing email rules', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
+    }
+    async isValidEmailAddress(email) {
+        try {
+            const valid = await this._validateAddress(email, 'email');
+            if (!valid) {
                 return {
                     success: true,
-                    rules,
+                    allowed: false,
                 };
             }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while listing email rules', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
-            }
-        });
-    }
-    isValidEmailAddress(email) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const valid = yield this._validateAddress(email, 'email');
-                if (!valid) {
+            if (this._privoClient) {
+                const config = await this._config.getPrivoConfiguration();
+                if (config) {
+                    const result = await this._privoClient.checkEmail(email);
+                    const allowed = result.available && !result.profanity;
                     return {
                         success: true,
-                        allowed: false,
+                        allowed,
+                        suggestions: result.suggestions,
+                        profanity: result.profanity,
                     };
                 }
-                if (this._privoClient) {
-                    const config = yield this._config.getPrivoConfiguration();
-                    if (config) {
-                        const result = yield this._privoClient.checkEmail(email);
-                        const allowed = result.available && !result.profanity;
-                        return {
-                            success: true,
-                            allowed,
-                            suggestions: result.suggestions,
-                            profanity: result.profanity,
-                        };
-                    }
-                }
-                return {
-                    success: true,
-                    allowed: true,
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while checking if email address is valid', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
             }
-        });
+            return {
+                success: true,
+                allowed: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while checking if email address is valid', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
-    isValidDisplayName(displayName, name) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (this._privoClient) {
-                    if (name) {
-                        const lowercaseName = name.trim().toLowerCase();
-                        const lowercaseDisplayName = displayName
-                            .trim()
-                            .toLowerCase();
-                        if (lowercaseDisplayName.includes(lowercaseName)) {
-                            return {
-                                success: true,
-                                allowed: false,
-                                containsName: true,
-                            };
-                        }
-                    }
-                    const config = yield this._config.getPrivoConfiguration();
-                    if (config) {
-                        const result = yield this._privoClient.checkDisplayName(displayName);
-                        const allowed = result.available && !result.profanity;
+    async isValidDisplayName(displayName, name) {
+        try {
+            if (this._privoClient) {
+                if (name) {
+                    const lowercaseName = name.trim().toLowerCase();
+                    const lowercaseDisplayName = displayName
+                        .trim()
+                        .toLowerCase();
+                    if (lowercaseDisplayName.includes(lowercaseName)) {
                         return {
                             success: true,
-                            allowed,
-                            suggestions: result.suggestions,
-                            profanity: result.profanity,
+                            allowed: false,
+                            containsName: true,
                         };
                     }
                 }
-                return {
-                    success: true,
-                    allowed: true,
-                };
-            }
-            catch (err) {
-                const span = trace.getActiveSpan();
-                span === null || span === void 0 ? void 0 : span.recordException(err);
-                span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
-                console.error('[AuthController] Error ocurred while checking if display name is valid', err);
-                return {
-                    success: false,
-                    errorCode: 'server_error',
-                    errorMessage: 'A server error occurred.',
-                };
+                const config = await this._config.getPrivoConfiguration();
+                if (config) {
+                    const result = await this._privoClient.checkDisplayName(displayName);
+                    const allowed = result.available && !result.profanity;
+                    return {
+                        success: true,
+                        allowed,
+                        suggestions: result.suggestions,
+                        profanity: result.profanity,
+                    };
+                }
             }
-        });
+            return {
+                success: true,
+                allowed: true,
+            };
+        }
+        catch (err) {
+            const span = trace.getActiveSpan();
+            span === null || span === void 0 ? void 0 : span.recordException(err);
+            span === null || span === void 0 ? void 0 : span.setStatus({ code: SpanStatusCode.ERROR });
+            console.error('[AuthController] Error ocurred while checking if display name is valid', err);
+            return {
+                success: false,
+                errorCode: 'server_error',
+                errorMessage: 'A server error occurred.',
+            };
+        }
     }
     /**
      * Issues a new session for the given user.
@@ -2328,48 +2292,59 @@ export class AuthController {
      * @param previousSession The previous session that this session is replacing. If null, then this session is not related to another session.
      * @param ipAddress The IP address that the session is being issued to. Should be null if the ip address is not known.
      */
-    _issueSession(_a) {
-        var _b, _c, _d, _e, _f;
-        var { userId, lifetimeMs, previousSession, ipAddress, requestId } = _a, rest = __rest(_a, ["userId", "lifetimeMs", "previousSession", "ipAddress", "requestId"]);
-        return __awaiter(this, void 0, void 0, function* () {
-            const now = Date.now();
-            const newSessionId = fromByteArray(randomBytes(SESSION_ID_BYTE_LENGTH));
-            const newSessionSecret = fromByteArray(randomBytes(SESSION_SECRET_BYTE_LENGTH));
-            const newConnectionSecret = fromByteArray(randomBytes(SESSION_SECRET_BYTE_LENGTH));
-            const newSession = Object.assign(Object.assign({}, rest), { userId: userId, sessionId: newSessionId, requestId: requestId !== null && requestId !== void 0 ? requestId : null, secretHash: this._hashHighEntropyPasswordWithSalt(newSessionSecret, newSessionId), connectionSecret: newConnectionSecret, grantedTimeMs: now, revokeTimeMs: null, expireTimeMs: lifetimeMs ? now + lifetimeMs : null, previousSessionId: (_b = previousSession === null || previousSession === void 0 ? void 0 : previousSession.sessionId) !== null && _b !== void 0 ? _b : null, nextSessionId: null, ipAddress: ipAddress });
-            if (requestId) {
-                yield this._store.markLoginRequestComplete(userId, requestId, now);
-            }
-            if (rest.webauthnRequestId) {
-                yield this._store.markWebAuthnLoginRequestComplete(rest.webauthnRequestId, userId, now);
-            }
-            if (rest.oidRequestId) {
-                yield this._store.markOpenIDLoginRequestComplete(rest.oidRequestId, now);
-            }
-            if (previousSession) {
-                yield this._store.replaceSession(previousSession, newSession, now);
-            }
-            else {
-                yield this._store.saveSession(newSession);
-            }
-            const metadata = yield this._store.findUserLoginMetadata(userId);
-            const info = {
-                userId,
-                sessionKey: formatV1SessionKey(userId, newSessionId, newSessionSecret, newSession.expireTimeMs),
-                connectionKey: formatV1ConnectionKey(userId, newSessionId, newConnectionSecret, newSession.expireTimeMs),
-                expireTimeMs: newSession.expireTimeMs,
-                metadata: {
-                    hasUserAuthenticator: (_c = metadata === null || metadata === void 0 ? void 0 : metadata.hasUserAuthenticator) !== null && _c !== void 0 ? _c : false,
-                    userAuthenticatorCredentialIds: (_d = metadata === null || metadata === void 0 ? void 0 : metadata.userAuthenticatorCredentialIds) !== null && _d !== void 0 ? _d : [],
-                    hasPushSubscription: (_e = metadata === null || metadata === void 0 ? void 0 : metadata.hasPushSubscription) !== null && _e !== void 0 ? _e : false,
-                    pushSubscriptionIds: (_f = metadata === null || metadata === void 0 ? void 0 : metadata.pushSubscriptionIds) !== null && _f !== void 0 ? _f : [],
-                },
-            };
-            return {
-                newSession,
-                info,
-            };
-        });
+    async _issueSession({ userId, lifetimeMs, previousSession, ipAddress, requestId, ...rest }) {
+        var _a, _b, _c, _d, _e;
+        const now = Date.now();
+        const newSessionId = fromByteArray(randomBytes(SESSION_ID_BYTE_LENGTH));
+        const newSessionSecret = fromByteArray(randomBytes(SESSION_SECRET_BYTE_LENGTH));
+        const newConnectionSecret = fromByteArray(randomBytes(SESSION_SECRET_BYTE_LENGTH));
+        const newSession = {
+            ...rest,
+            userId: userId,
+            sessionId: newSessionId,
+            requestId: requestId !== null && requestId !== void 0 ? requestId : null,
+            secretHash: this._hashHighEntropyPasswordWithSalt(newSessionSecret, newSessionId),
+            connectionSecret: newConnectionSecret,
+            grantedTimeMs: now,
+            revokeTimeMs: null,
+            expireTimeMs: lifetimeMs ? now + lifetimeMs : null,
+            previousSessionId: (_a = previousSession === null || previousSession === void 0 ? void 0 : previousSession.sessionId) !== null && _a !== void 0 ? _a : null,
+            nextSessionId: null,
+            ipAddress: ipAddress,
+        };
+        if (requestId) {
+            await this._store.markLoginRequestComplete(userId, requestId, now);
+        }
+        if (rest.webauthnRequestId) {
+            await this._store.markWebAuthnLoginRequestComplete(rest.webauthnRequestId, userId, now);
+        }
+        if (rest.oidRequestId) {
+            await this._store.markOpenIDLoginRequestComplete(rest.oidRequestId, now);
+        }
+        if (previousSession) {
+            await this._store.replaceSession(previousSession, newSession, now);
+        }
+        else {
+            await this._store.saveSession(newSession);
+        }
+        const metadata = await this._store.findUserLoginMetadata(userId);
+        const info = {
+            userId,
+            sessionKey: formatV1SessionKey(userId, newSessionId, newSessionSecret, newSession.expireTimeMs),
+            connectionKey: formatV1ConnectionKey(userId, newSessionId, newConnectionSecret, newSession.expireTimeMs),
+            expireTimeMs: newSession.expireTimeMs,
+            metadata: {
+                hasUserAuthenticator: (_b = metadata === null || metadata === void 0 ? void 0 : metadata.hasUserAuthenticator) !== null && _b !== void 0 ? _b : false,
+                userAuthenticatorCredentialIds: (_c = metadata === null || metadata === void 0 ? void 0 : metadata.userAuthenticatorCredentialIds) !== null && _c !== void 0 ? _c : [],
+                hasPushSubscription: (_d = metadata === null || metadata === void 0 ? void 0 : metadata.hasPushSubscription) !== null && _d !== void 0 ? _d : false,
+                pushSubscriptionIds: (_e = metadata === null || metadata === void 0 ? void 0 : metadata.pushSubscriptionIds) !== null && _e !== void 0 ? _e : [],
+            },
+        };
+        console.log(`[AuthController] [issueSession userId: ${userId} newSessionId: ${newSessionId} expiresAt: ${newSession.expireTimeMs}] Issued session.`);
+        return {
+            newSession,
+            info,
+        };
     }
 }
 __decorate([
@@ -2466,32 +2441,31 @@ __decorate([
  * Validates the given session key using the given auth controller.
  * @param sessionKey The session key to validate.
  */
-export function validateSessionKey(auth, sessionKey) {
-    return __awaiter(this, void 0, void 0, function* () {
-        if (!sessionKey) {
-            return {
-                success: false,
-                userId: null,
-                errorCode: 'no_session_key',
-                errorMessage: 'A session key was not provided, but it is required for this operation.',
-            };
-        }
-        const result = yield auth.validateSessionKey(sessionKey);
-        if (result.success === true) {
-            const span = trace.getActiveSpan();
-            if (span) {
-                span.setAttributes({
-                    [SEMATTRS_ENDUSER_ID]: result.userId,
-                    ['request.userId']: result.userId,
-                    ['request.userRole']: result.role,
-                    ['request.sessionId']: result.sessionId,
-                    ['request.subscriptionId']: result.subscriptionId,
-                    ['request.subscriptionTier']: result.subscriptionTier,
-                });
-            }
+export async function validateSessionKey(auth, sessionKey) {
+    if (!sessionKey) {
+        return {
+            success: false,
+            userId: null,
+            role: null,
+            errorCode: 'no_session_key',
+            errorMessage: 'A session key was not provided, but it is required for this operation.',
+        };
+    }
+    const result = await auth.validateSessionKey(sessionKey);
+    if (result.success === true) {
+        const span = trace.getActiveSpan();
+        if (span) {
+            span.setAttributes({
+                [SEMATTRS_ENDUSER_ID]: result.userId,
+                ['request.userId']: result.userId,
+                ['request.userRole']: result.role,
+                ['request.sessionId']: result.sessionId,
+                ['request.subscriptionId']: result.subscriptionId,
+                ['request.subscriptionTier']: result.subscriptionTier,
+            });
         }
-        return result;
-    });
+    }
+    return result;
 }
 export function getPrivacyFeaturesFromPermissions(featureIds, permissions) {
     const publishData = permissions.some((p) => p.on && p.featureId === featureIds.projectDevelopment);