@diagramers/cli 1.0.23 → 1.0.24

package/templates/api/src/helpers/auth.ts

@@ -0,0 +1,971 @@
+import firebase from 'firebase/compat/app';
+import * as firebaseAdmin from 'firebase-admin'
+import 'firebase/compat/auth';
+import { initializeApp, App } from 'firebase-admin/app';
+import { Auth as IAuth, getAuth } from 'firebase-admin/auth';
+import { getStorage, getDownloadURL, Storage } from 'firebase-admin/storage';
+import { Config } from '../config';
+import { AuditMessageType, ResponseCode, Status, AuthProvider, AuthMethod } from './enums';
+import { Result } from './result';
+const path = require('path');
+import { Http2ServerRequest } from 'http2';
+import { IUser, AuthProviderInfo, UserSession, OTPCode } from '../entities/user';
+import mime = require('mime');
+import { UUID, ObjectId } from 'bson';
+import * as jwt from 'jsonwebtoken';
+import * as crypto from 'crypto';
+import { v4 as uuidv4 } from 'uuid';
+import dbcontext from './dbcontext';
+import { MailHelper } from './mailer';
+import { EncryptionHelper } from './encryptionHelper';
+import { frameworkHelper } from './FrameworkHelper';
+
+export class AuthHelper {
+
+    app: App;
+    auth: IAuth;
+    authProvider: any
+    appProvider: any;
+    result: Result;
+    className = 'helpers/auth';
+    storageProvider: Storage;
+    defaultBucketName = 'gs://sendifier-web-app';
+    private encryptionHelper: EncryptionHelper;
+    private frameworkHelper: any;
+
+    constructor(result: Result) {
+        try {
+            this.result = result;
+            this.encryptionHelper = new EncryptionHelper();
+            this.frameworkHelper = frameworkHelper;
+            
+            // Initialize Firebase if enabled
+            if (Config.props.auth.firebase.enabled) {
+                var certPath = path.resolve(Config.props.auth.firebase.private_key_path);
+                result.addMessage(AuditMessageType.trace, this.className, this.className + '- ctor', `certification path ${certPath}`)
+                var cred = firebaseAdmin.credential.cert(certPath);
+                if (firebaseAdmin.apps.length > 0) {
+                    this.app = firebaseAdmin.apps[0];
+                }
+                else {
+                    firebaseAdmin.initializeApp({
+                        credential: cred
+                    });
+                    console.log('firebase config is', Config.props.auth.firebase)
+                    this.app = firebaseAdmin.app();
+                }
+                this.auth = getAuth(this.app);
+                this.storageProvider = firebaseAdmin.storage(this.app);
+            }
+
+        }
+        catch (ex) {
+            console.log(ex);
+            // this.result?.addException(this.className, this.className + '- ctor', ex);
+            // this.result.Data = null;
+            // this.result.Status = ResponseCode.Unauthorized;
+        }
+    }
+
+    async GetUser(uid: string):
+        Promise<Result> {
+        try {
+            var result = await this.auth.getUser(uid);
+            return new Result(result, ResponseCode.Ok, null, ['firebase user exists']);
+        }
+        catch (ex) {
+            return new Result(null, ResponseCode.Error, [ex], [ex.errorInfo.message]);
+        }
+    }
+
+    async CreateUser(user: any):
+        Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'CreateUser', 'Started')
+            var response = await this.auth.createUser(user);
+            this.result.Data = response;
+            this.result.Status = ResponseCode.Ok;
+            this.result.addMessage(AuditMessageType.info, this.className, 'CreateUser', 'Finished');
+            return this.result;
+        }
+        catch (ex) {
+            this.result.addException(this.className, 'CreateUser', ex);
+            return this.result;
+        }
+    }
+
+    GetUserProfile(req): any {
+        try {
+            console.log("authHelper*GetUserProfile** GetUserProfile****      ", req.headers["user-profile"]);
+            var userProfileHeaderStringified = req.headers["user-profile"].toString();
+            console.log("*auth**GetUserProfile*** Start checking auth for user**** ", userProfileHeaderStringified)
+            var userProfileHeader: any = null;
+            if (userProfileHeaderStringified)
+                userProfileHeader = JSON.parse(userProfileHeaderStringified);
+            else
+                userProfileHeader = null;
+            return userProfileHeader;
+        }
+        catch (ex) {
+            console.log("authHelper*GetUserProfile** exception****      " + JSON.stringify(ex));
+            return null;
+        }
+    }
+
+    async CheckAuth(req: Http2ServerRequest, res) {
+        console.log("authHelper*CheckAuth** requestHeaders****      ", req.headers);
+        var userProfileHeaderStringified = req.headers["user-profile"].toString();
+        console.log("*auth**CheckAuth*** Start checking auth for user**** ", userProfileHeaderStringified)
+        var userProfileHeader: any = null;
+        if (userProfileHeaderStringified)
+            userProfileHeader = JSON.parse(userProfileHeaderStringified);
+        else
+            userProfileHeader = null;
+        if (userProfileHeader) {
+            var verifyToken = await this.VerifyToken(userProfileHeader.token);
+            if (verifyToken.Status == ResponseCode.Ok) {
+                var result = new Result(verifyToken.Data, ResponseCode.Ok);
+                return result;
+            }
+            else {
+                var result = new Result(null, ResponseCode.Unauthorized);
+                res.json(result);
+            }
+        }
+        else {
+            var result = new Result(null, ResponseCode.Unauthorized);
+            res.json(result);
+        }
+    }
+
+    async VerifyToken(token: string) {
+        try {
+            return new Result(true, ResponseCode.Ok);
+        }
+        catch (ex) {
+            console.log("authhelper*verifytoken** exception****", ex);
+            return new Result(ex.message, ResponseCode.Unauthorized);
+        }
+    }
+
+    async RemoveUser(userEmail: string) {
+        try {
+            console.log("authhelper*RemoveUser** delete user with email****", userEmail);
+            var result = await this.auth.getUserByEmail(userEmail);
+            await this.auth.deleteUser(result.uid);
+            console.log("authhelper*RemoveUser** delete user done****", result);
+            return new Result(result, ResponseCode.Ok, null, ['User deleted successfully']);
+        }
+        catch (ex) {
+            console.log("authhelper*RemoveUser** exception****", ex);
+            return new Result(ex.message, ResponseCode.Error, [ex], [ex.message]);
+        }
+    }
+
+    async UploadFileByPath(path: string = null, name: string = null, bucket: string = null) {
+        try {
+            if (!bucket)
+                bucket = this.defaultBucketName;
+            var storage = getStorage(this.app).bucket(bucket);
+            return await storage.upload(path);
+        }
+        catch (ex) {
+            this.result.addException(this.className, 'UploadFile', ex);
+            this.result.Data = null;
+            this.result.Status = ResponseCode.Error;
+            return this.result;
+        }
+    }
+
+
+    async UploadFileByContent(fileBase64: string = null, name: string = null, path: string = null, contentType = null): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'UploadFileByContent', 'Started');
+
+            const storageBucket = this.storageProvider.bucket(this.defaultBucketName);
+            const file = storageBucket.file(`${path}/${new Date().getTime()}_${name}`);
+            const uuid = new UUID();
+            const stream = file.createWriteStream({
+                resumable: true,
+
+                metadata: {
+                    contentType: contentType,
+                    contentDisposition: 'inline', // Allows the file to be viewed in the browser
+                    firebaseStorageDownloadTokens: uuid,
+                }
+            });
+
+            await new Promise<any>((resolve, reject) => {
+                // Handle errors during the upload
+                stream.on('error', (err) => {
+                    this.result.addException(this.className, 'UploadFileByContent', `Error during upload: ${err}`);
+                    this.result.Data = null;
+                    this.result.Status = ResponseCode.Error;
+                    reject(this.result);
+                });
+
+                // Handle the upload completion
+                stream.on('finish', async () => {
+                    try {
+                        await file.generateSignedPostPolicyV2({
+                            expires: '03-09-2025', // Set an expiration date for the URL
+                        })
+                        const downloadUrl = await getDownloadURL(file);
+                        // const [downloadUrl] = await file.getSignedUrl({
+                        //     action: 'read',
+                        //     expires: '03-09-2025'
+                        // });
+
+                        if (downloadUrl) {
+                            this.result.addMessage(AuditMessageType.info, this.className, 'UploadFileByContent', 'Media uploaded');
+                            this.result.Data = downloadUrl;
+                            this.result.Status = ResponseCode.Ok;
+                            resolve(this.result);
+                        } else {
+                            this.result.addMessage(AuditMessageType.error, this.className, 'UploadFileByContent', 'Download URL is null.');
+                            this.result.Data = null;
+                            this.result.Status = ResponseCode.Error;
+                            reject(this.result);
+                        }
+                    } catch (error) {
+                        this.result.addException(this.className, 'UploadFileByContent', `Error getting signed URL: ${error}`);
+                        this.result.Data = null;
+                        this.result.Status = ResponseCode.Error;
+                        reject(this.result);
+                    }
+                });
+
+                // Write the buffer to the stream
+                stream.end(fileBase64);
+            });
+
+            return this.result;
+        } catch (ex) {
+            this.result.addException(this.className, 'UploadFileByContent', `Error during file upload: ${ex}`);
+            this.result.Data = null;
+            this.result.Status = ResponseCode.Error;
+            return this.result;
+        }
+    }
+
+    async UploadFile(fileBase64: string, name, path, contentType): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'UploadFile', `Started`);
+            const storageBucket = this.storageProvider.bucket(this.defaultBucketName);
+            const audioBuffer = Buffer.from(fileBase64, 'base64');
+
+            const audioFile = storageBucket.file(`${this.result.user._defaultCompanyId}/${path}/${name}`);
+            await audioFile.save(audioBuffer, { contentType: contentType, resumable: true });
+            const url = await getDownloadURL(audioFile);
+            this.result.addMessage(AuditMessageType.info, this.className, 'UploadFile', `Finished`);
+            this.result.Data = url;
+            this.result.Status = ResponseCode.Ok;
+            return this.result
+        }
+        catch (ex) {
+            this.result.addException(this.className, 'UploadFile', ex);
+            this.result.Data = null;
+            this.result.Status = ResponseCode.Error;
+            return this.result;
+        }
+    }
+
+    async UploadFileSigned(fileBase64: string, name: string, path: string, contentType: string): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'UploadFile', `Started`);
+            const storageBucket = this.storageProvider.bucket(this.defaultBucketName);
+            const audioBuffer = Buffer.from(fileBase64, 'base64');
+
+            const audioFile = storageBucket.file(`${this.result.user._defaultCompanyId}/${path}/${name}`);
+            await audioFile.save(audioBuffer, { contentType: 'audio/ogg; codecs=opus' });
+
+            type action = "read"
+            // Correcting the action type to match the GetSignedUrlConfig expected type
+
+            var url = await audioFile.getSignedUrl({ action: 'read', expires: '03-12-2094' })
+            this.result.addMessage(AuditMessageType.info, this.className, 'UploadFile', `Finished`);
+            this.result.Data = url[0];
+            this.result.Status = ResponseCode.Ok;
+            return this.result;
+        } catch (ex) {
+            console.error(`Error in UploadFile: ${ex}`);
+            this.result.addException(this.className, 'UploadFile', ex);
+            this.result.Data = null;
+            this.result.Status = ResponseCode.Error;
+            return this.result;
+        }
+    }
+
+    // ===== MULTI-PROVIDER AUTHENTICATION METHODS =====
+
+    // Internal Authentication
+    async registerWithPassword(userData: any): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'RegisterWithPassword', 'Started');
+            
+            // Validate password strength
+            const passwordValidation = this.validatePassword(userData.password);
+            if (!passwordValidation.isValid) {
+                this.result.Status = ResponseCode.Error;
+                this.result.Errors.push(...passwordValidation.errors);
+                return this.result;
+            }
+
+            // Check if user already exists
+            const existingUser = await dbcontext.UserEntity.findOne({ email: userData.email.toLowerCase() });
+            if (existingUser) {
+                this.result.Status = ResponseCode.Duplicate;
+                this.result.Errors.push('User with this email already exists');
+                return this.result;
+            }
+
+            // Create user with internal auth provider
+            const authProviderInfo: AuthProviderInfo = {
+                provider: AuthProvider.INTERNAL,
+                is_verified: false,
+                last_used: new Date(),
+                created_at: new Date()
+            };
+
+            const userEntity = new dbcontext.UserEntity({
+                _id: new ObjectId(),
+                name: userData.name,
+                email: userData.email.toLowerCase(),
+                username: userData.email.toLowerCase(),
+                emailVerified: false,
+                phone: userData.phone || null,
+                phoneVerified: false,
+                auth_providers: [authProviderInfo],
+                primary_auth_provider: AuthProvider.INTERNAL,
+                hashedPassword: this.encryptionHelper.encryptUserLogin(userData.password),
+                identity: uuidv4(),
+                invitationCode: this.frameworkHelper.generateRandomString(6),
+                status: 2, // PendingConfirmation
+                userType: "NOR"
+            });
+
+            const createdUser = await dbcontext.UserEntity.create(userEntity);
+            
+            if (createdUser) {
+                // Send email verification if required
+                if (Config.props.auth.internal.require_email_verification) {
+                    await this.sendEmailVerification(createdUser);
+                }
+                
+                this.result.Data = { user_id: createdUser._id, message: 'User registered successfully' };
+                this.result.Status = ResponseCode.Ok;
+            } else {
+                this.result.Status = ResponseCode.Error;
+                this.result.Errors.push('Failed to create user');
+            }
+
+            return this.result;
+        } catch (ex) {
+            this.result.addException(this.className, 'RegisterWithPassword', ex);
+            return this.result;
+        }
+    }
+
+    async loginWithPassword(email: string, password: string, ipAddress: string, userAgent: string): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'LoginWithPassword', 'Started');
+            
+            const encryptedPassword = this.encryptionHelper.encryptUserLogin(password);
+            const user = await dbcontext.UserEntity.findOne({ 
+                email: email.toLowerCase(), 
+                hashedPassword: encryptedPassword 
+            });
+
+            if (!user) {
+                this.result.Status = ResponseCode.Unauthorized;
+                this.result.Errors.push('Invalid credentials');
+                return this.result;
+            }
+
+            // Check if user is active
+            if (user.status !== 1) {
+                this.result.Status = ResponseCode.Unauthorized;
+                this.result.Errors.push('Account is not active');
+                return this.result;
+            }
+
+            // Create session and generate tokens
+            const sessionResult = await this.createSession(user, AuthProvider.INTERNAL, AuthMethod.PASSWORD, ipAddress, userAgent);
+            if (sessionResult.Status !== ResponseCode.Ok) {
+                return sessionResult;
+            }
+
+            this.result.Data = {
+                user: this.sanitizeUserData(user),
+                session: sessionResult.Data,
+                message: 'Login successful'
+            };
+            this.result.Status = ResponseCode.Ok;
+            
+            return this.result;
+        } catch (ex) {
+            this.result.addException(this.className, 'LoginWithPassword', ex);
+            return this.result;
+        }
+    }
+
+    // Firebase Authentication
+    async authenticateWithFirebase(firebaseToken: string, ipAddress: string, userAgent: string): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'AuthenticateWithFirebase', 'Started');
+            
+            if (!Config.props.auth.firebase.enabled) {
+                this.result.Status = ResponseCode.Error;
+                this.result.Errors.push('Firebase authentication is not enabled');
+                return this.result;
+            }
+
+            // Verify Firebase token
+            const decodedToken = await this.auth.verifyIdToken(firebaseToken);
+            
+            // Find or create user
+            let user = await dbcontext.UserEntity.findOne({ 
+                'auth_providers.provider': AuthProvider.FIREBASE,
+                'auth_providers.provider_user_id': decodedToken.uid 
+            });
+
+            if (!user) {
+                // Create new user with Firebase auth
+                const authProviderInfo: AuthProviderInfo = {
+                    provider: AuthProvider.FIREBASE,
+                    provider_user_id: decodedToken.uid,
+                    is_verified: decodedToken.email_verified || false,
+                    last_used: new Date(),
+                    created_at: new Date(),
+                    provider_metadata: {
+                        email: decodedToken.email,
+                        name: decodedToken.name,
+                        picture: decodedToken.picture
+                    }
+                };
+
+                user = new dbcontext.UserEntity({
+                    _id: new ObjectId(),
+                    name: decodedToken.name || decodedToken.email,
+                    email: decodedToken.email,
+                    username: decodedToken.email,
+                    emailVerified: decodedToken.email_verified || false,
+                    auth_providers: [authProviderInfo],
+                    primary_auth_provider: AuthProvider.FIREBASE,
+                    firebaseUID: decodedToken.uid,
+                    identity: uuidv4(),
+                    status: 1, // Active
+                    userType: "NOR"
+                });
+
+                await dbcontext.UserEntity.create(user);
+            } else {
+                // Update last used
+                await dbcontext.UserEntity.updateOne(
+                    { _id: user._id, 'auth_providers.provider': AuthProvider.FIREBASE },
+                    { $set: { 'auth_providers.$.last_used': new Date() } }
+                );
+            }
+
+            // Create session
+            const sessionResult = await this.createSession(user, AuthProvider.FIREBASE, AuthMethod.OAUTH, ipAddress, userAgent);
+            if (sessionResult.Status !== ResponseCode.Ok) {
+                return sessionResult;
+            }
+
+            this.result.Data = {
+                user: this.sanitizeUserData(user),
+                session: sessionResult.Data,
+                message: 'Firebase authentication successful'
+            };
+            this.result.Status = ResponseCode.Ok;
+            
+            return this.result;
+        } catch (ex) {
+            this.result.addException(this.className, 'AuthenticateWithFirebase', ex);
+            return this.result;
+        }
+    }
+
+    // OAuth Authentication
+    async authenticateWithOAuth(provider: string, accessToken: string, ipAddress: string, userAgent: string): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'AuthenticateWithOAuth', `Started with ${provider}`);
+            
+            if (!Config.props.auth.oauth.enabled_providers.includes(provider as any)) {
+                this.result.Status = ResponseCode.Error;
+                this.result.Errors.push(`${provider} OAuth is not enabled`);
+                return this.result;
+            }
+
+            // Get user info from OAuth provider
+            const userInfo = await this.getOAuthUserInfo(provider, accessToken);
+            if (!userInfo) {
+                this.result.Status = ResponseCode.Unauthorized;
+                this.result.Errors.push('Failed to get user info from OAuth provider');
+                return this.result;
+            }
+
+            // Find or create user
+            let user = await dbcontext.UserEntity.findOne({ 
+                'auth_providers.provider': provider,
+                'auth_providers.provider_user_id': userInfo.id 
+            });
+
+            if (!user) {
+                // Create new user with OAuth auth
+                const authProviderInfo: AuthProviderInfo = {
+                    provider: provider as AuthProvider,
+                    provider_user_id: userInfo.id,
+                    provider_access_token: accessToken,
+                    is_verified: true,
+                    last_used: new Date(),
+                    created_at: new Date(),
+                    provider_metadata: userInfo
+                };
+
+                user = new dbcontext.UserEntity({
+                    _id: new ObjectId(),
+                    name: userInfo.name,
+                    email: userInfo.email,
+                    username: userInfo.email,
+                    emailVerified: userInfo.email_verified || true,
+                    auth_providers: [authProviderInfo],
+                    primary_auth_provider: provider as AuthProvider,
+                    identity: uuidv4(),
+                    status: 1, // Active
+                    userType: "NOR"
+                });
+
+                await dbcontext.UserEntity.create(user);
+            } else {
+                // Update access token and last used
+                await dbcontext.UserEntity.updateOne(
+                    { _id: user._id, 'auth_providers.provider': provider },
+                    { 
+                        $set: { 
+                            'auth_providers.$.provider_access_token': accessToken,
+                            'auth_providers.$.last_used': new Date() 
+                        } 
+                    }
+                );
+            }
+
+            // Create session
+            const sessionResult = await this.createSession(user, provider as AuthProvider, AuthMethod.OAUTH, ipAddress, userAgent);
+            if (sessionResult.Status !== ResponseCode.Ok) {
+                return sessionResult;
+            }
+
+            this.result.Data = {
+                user: this.sanitizeUserData(user),
+                session: sessionResult.Data,
+                message: `${provider} authentication successful`
+            };
+            this.result.Status = ResponseCode.Ok;
+            
+            return this.result;
+        } catch (ex) {
+            this.result.addException(this.className, 'AuthenticateWithOAuth', ex);
+            return this.result;
+        }
+    }
+
+    // SMS OTP Authentication
+    async sendSMSOTP(phone: string, purpose: string): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'SendSMSOTP', 'Started');
+            
+            if (!Config.props.auth.sms_otp.enabled) {
+                this.result.Status = ResponseCode.Error;
+                this.result.Errors.push('SMS OTP is not enabled');
+                return this.result;
+            }
+
+            // Generate OTP
+            const otp = this.generateOTP(Config.props.auth.sms_otp.otp_length);
+            const expiresAt = new Date(Date.now() + Config.props.auth.sms_otp.otp_expiry_minutes * 60 * 1000);
+
+            // Find user by phone
+            const user = await dbcontext.UserEntity.findOne({ phone });
+            if (!user) {
+                this.result.Status = ResponseCode.NotExist;
+                this.result.Errors.push('User not found with this phone number');
+                return this.result;
+            }
+
+            // Create OTP record
+            const otpEntity = new dbcontext.OTPEntity({
+                code: otp,
+                user_id: user._id,
+                auth_provider: AuthProvider.SMS_OTP,
+                purpose: purpose,
+                expires_at: expiresAt,
+                max_attempts: Config.props.auth.sms_otp.max_attempts
+            });
+
+            await dbcontext.OTPEntity.create(otpEntity);
+
+            // Send SMS
+            await this.sendSMS(phone, `Your OTP is: ${otp}. Valid for ${Config.props.auth.sms_otp.otp_expiry_minutes} minutes.`);
+
+            this.result.Data = { message: 'OTP sent successfully' };
+            this.result.Status = ResponseCode.Ok;
+            
+            return this.result;
+        } catch (ex) {
+            this.result.addException(this.className, 'SendSMSOTP', ex);
+            return this.result;
+        }
+    }
+
+    async verifySMSOTP(phone: string, otp: string, ipAddress: string, userAgent: string): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'VerifySMSOTP', 'Started');
+            
+            // Find user by phone
+            const user = await dbcontext.UserEntity.findOne({ phone });
+            if (!user) {
+                this.result.Status = ResponseCode.NotExist;
+                this.result.Errors.push('User not found');
+                return this.result;
+            }
+
+            // Find and verify OTP
+            const otpRecord = await dbcontext.OTPEntity.findOne({
+                user_id: user._id,
+                auth_provider: AuthProvider.SMS_OTP,
+                code: otp,
+                is_used: false,
+                expires_at: { $gt: new Date() }
+            });
+
+            if (!otpRecord) {
+                this.result.Status = ResponseCode.Unauthorized;
+                this.result.Errors.push('Invalid or expired OTP');
+                return this.result;
+            }
+
+            // Check attempts
+            if (otpRecord.attempts >= otpRecord.max_attempts) {
+                this.result.Status = ResponseCode.Unauthorized;
+                this.result.Errors.push('Maximum OTP attempts exceeded');
+                return this.result;
+            }
+
+            // Mark OTP as used
+            await dbcontext.OTPEntity.updateOne(
+                { _id: otpRecord._id },
+                { $set: { is_used: true, attempts: otpRecord.attempts + 1 } }
+            );
+
+            // Update user phone verification
+            await dbcontext.UserEntity.updateOne(
+                { _id: user._id },
+                { $set: { phoneVerified: true } }
+            );
+
+            // Create session
+            const sessionResult = await this.createSession(user, AuthProvider.SMS_OTP, AuthMethod.OTP, ipAddress, userAgent);
+            if (sessionResult.Status !== ResponseCode.Ok) {
+                return sessionResult;
+            }
+
+            this.result.Data = {
+                user: this.sanitizeUserData(user),
+                session: sessionResult.Data,
+                message: 'SMS OTP verification successful'
+            };
+            this.result.Status = ResponseCode.Ok;
+            
+            return this.result;
+        } catch (ex) {
+            this.result.addException(this.className, 'VerifySMSOTP', ex);
+            return this.result;
+        }
+    }
+
+    // Email OTP Authentication
+    async sendEmailOTP(email: string, purpose: string): Promise<Result> {
+        try {
+            this.result.addMessage(AuditMessageType.info, this.className, 'SendEmailOTP', 'Started');
+            
+            if (!Config.props.auth.email_otp.enabled) {
+                this.result.Status = ResponseCode.Error;
+                this.result.Errors.push('Email OTP is not enabled');
+                return this.result;
+            }
+
+            // Generate OTP
+            const otp = this.generateOTP(Config.props.auth.email_otp.otp_length);
+            const expiresAt = new Date(Date.now() + Config.props.auth.email_otp.otp_expiry_minutes * 60 * 1000);
+
+            // Find user by email
+            const user = await dbcontext.UserEntity.findOne({ email: email.toLowerCase() });
+            if (!user) {
+                this.result.Status = ResponseCode.NotExist;
+                this.result.Errors.push('User not found with this email');
+                return this.result;
+            }
+
+            // Create OTP record
+            const otpEntity = new dbcontext.OTPEntity({
+                code: otp,
+                user_id: user._id,
+                auth_provider: AuthProvider.EMAIL_OTP,
+                purpose: purpose,
+                expires_at: expiresAt,
+                max_attempts: Config.props.auth.email_otp.max_attempts
+            });
+
+            await dbcontext.OTPEntity.create(otpEntity);
+
+            // Send email
+            const emailContent = MailHelper.GetEmailConfirmationTemplate(user.name, `Your OTP is: ${otp}. Valid for ${Config.props.auth.email_otp.otp_expiry_minutes} minutes.`, 'Verify OTP');
+            await MailHelper.SendEmail(email, emailContent, 'Email OTP Verification');
+
+            this.result.Data = { message: 'Email OTP sent successfully' };
+            this.result.Status = ResponseCode.Ok;
+            
+            return this.result;
+        } catch (ex) {
+            this.result.addException(this.className, 'SendEmailOTP', ex);
+            return this.result;
+        }
+    }
+
+    // Session Management
+    async createSession(user: IUser, authProvider: AuthProvider, authMethod: AuthMethod, ipAddress: string, userAgent: string): Promise<Result> {
+        try {
+            // Check session limits
+            const activeSessions = await dbcontext.SessionEntity.countDocuments({
+                user_id: user._id,
+                is_active: true
+            });
+
+            if (activeSessions >= Config.props.auth.session.max_sessions_per_user && !Config.props.auth.session.concurrent_login_allowed) {
+                // Deactivate oldest session
+                const oldestSession = await dbcontext.SessionEntity.findOne({
+                    user_id: user._id,
+                    is_active: true
+                }).sort({ created_at: 1 });
+
+                if (oldestSession) {
+                    await dbcontext.SessionEntity.updateOne(
+                        { _id: oldestSession._id },
+                        { $set: { is_active: false } }
+                    );
+                }
+            }
+
+            // Create new session
+            const sessionId = uuidv4();
+            const expiresAt = new Date(Date.now() + Config.props.auth.session.session_timeout_minutes * 60 * 1000);
+
+            const sessionEntity = new dbcontext.SessionEntity({
+                session_id: sessionId,
+                user_id: user._id,
+                auth_provider: authProvider,
+                auth_method: authMethod,
+                ip_address: ipAddress,
+                user_agent: userAgent,
+                expires_at: expiresAt
+            });
+
+            await dbcontext.SessionEntity.create(sessionEntity);
+
+            // Generate JWT token
+            const token = jwt.sign(
+                {
+                    user_id: user._id.toString(),
+                    session_id: sessionId,
+                    auth_provider: authProvider,
+                    auth_method: authMethod
+                },
+                Config.props.auth.jwt.secret,
+                {
+                    expiresIn: Config.props.auth.jwt.expires_in,
+                    issuer: Config.props.auth.jwt.issuer,
+                    audience: Config.props.auth.jwt.audience
+                } as any
+            );
+
+            const refreshToken = jwt.sign(
+                {
+                    user_id: user._id.toString(),
+                    session_id: sessionId,
+                    type: 'refresh'
+                },
+                Config.props.auth.jwt.secret,
+                {
+                    expiresIn: Config.props.auth.jwt.refresh_token_expires_in,
+                    issuer: Config.props.auth.jwt.issuer,
+                    audience: Config.props.auth.jwt.audience
+                } as any
+            );
+
+            return new Result({
+                session_id: sessionId,
+                token: token,
+                refresh_token: refreshToken,
+                expires_at: expiresAt
+            }, ResponseCode.Ok);
+        } catch (ex) {
+            return new Result(null, ResponseCode.Error, [ex], [ex.message]);
+        }
+    }
+
+    async verifySession(sessionId: string, token: string): Promise<Result> {
+        try {
+            // Verify JWT token
+            const decoded = jwt.verify(token, Config.props.auth.jwt.secret) as any;
+            
+            // Check session
+            const session = await dbcontext.SessionEntity.findOne({
+                session_id: sessionId,
+                user_id: decoded.user_id,
+                is_active: true,
+                expires_at: { $gt: new Date() }
+            });
+
+            if (!session) {
+                return new Result(null, ResponseCode.Unauthorized, [], ['Invalid or expired session']);
+            }
+
+            // Update last activity
+            await dbcontext.SessionEntity.updateOne(
+                { _id: session._id },
+                { $set: { last_activity: new Date() } }
+            );
+
+            // Get user
+            const user = await dbcontext.UserEntity.findById(decoded.user_id);
+            if (!user) {
+                return new Result(null, ResponseCode.NotExist, [], ['User not found']);
+            }
+
+            return new Result({
+                user: this.sanitizeUserData(user),
+                session: session
+            }, ResponseCode.Ok);
+        } catch (ex) {
+            return new Result(null, ResponseCode.Unauthorized, [ex], [ex.message]);
+        }
+    }
+
+    async logout(sessionId: string): Promise<Result> {
+        try {
+            await dbcontext.SessionEntity.updateOne(
+                { session_id: sessionId },
+                { $set: { is_active: false } }
+            );
+
+            return new Result({ message: 'Logged out successfully' }, ResponseCode.Ok);
+        } catch (ex) {
+            return new Result(null, ResponseCode.Error, [ex], [ex.message]);
+        }
+    }
+
+    // Utility Methods
+    private validatePassword(password: string): { isValid: boolean; errors: string[] } {
+        const errors: string[] = [];
+        const config = Config.props.auth.internal;
+
+        if (password.length < config.password_min_length) {
+            errors.push(`Password must be at least ${config.password_min_length} characters long`);
+        }
+
+        if (config.password_require_uppercase && !/[A-Z]/.test(password)) {
+            errors.push('Password must contain at least one uppercase letter');
+        }
+
+        if (config.password_require_lowercase && !/[a-z]/.test(password)) {
+            errors.push('Password must contain at least one lowercase letter');
+        }
+
+        if (config.password_require_numbers && !/\d/.test(password)) {
+            errors.push('Password must contain at least one number');
+        }
+
+        if (config.password_require_special_chars && !/[!@#$%^&*(),.?":{}|<>]/.test(password)) {
+            errors.push('Password must contain at least one special character');
+        }
+
+        return { isValid: errors.length === 0, errors };
+    }
+
+    private generateOTP(length: number): string {
+        return Math.random().toString().substr(2, length);
+    }
+
+    private sanitizeUserData(user: IUser): any {
+        return {
+            _id: user._id,
+            name: user.name,
+            email: user.email,
+            username: user.username,
+            emailVerified: user.emailVerified,
+            phone: user.phone,
+            phoneVerified: user.phoneVerified,
+            primary_auth_provider: user.primary_auth_provider,
+            auth_providers: user.auth_providers.map(provider => ({
+                provider: provider.provider,
+                is_verified: provider.is_verified,
+                last_used: provider.last_used
+            })),
+            userType: user.userType,
+            status: user.status,
+            createdAt: user.createdAt,
+            updatedAt: user.updatedAt
+        };
+    }
+
+    private async sendEmailVerification(user: IUser): Promise<void> {
+        const verificationLink = `${Config.props.base_site_url}/verify-email?token=${this.encryptionHelper.encryptUserLogin(user.invitationCode)}&email=${this.encryptionHelper.encryptUserLogin(user.email)}&usrStat=${this.encryptionHelper.encryptUserLogin(user.status)}`;
+        const emailContent = MailHelper.GetEmailConfirmationTemplate(user.name, verificationLink, 'Verify Email');
+        await MailHelper.SendEmail(user.email, emailContent, 'Email Verification');
+    }
+
+    private async getOAuthUserInfo(provider: string, accessToken: string): Promise<any> {
+        // Implementation would vary by provider
+        // This is a placeholder - you'd implement specific OAuth provider APIs
+        switch (provider) {
+            case 'google':
+                // Call Google OAuth API
+                break;
+            case 'facebook':
+                // Call Facebook OAuth API
+                break;
+            case 'github':
+                // Call GitHub OAuth API
+                break;
+            // ... other providers
+        }
+        return null;
+    }
+
+    private async sendSMS(phone: string, message: string): Promise<void> {
+        const config = Config.props.auth.sms_otp;
+        
+        if (config.provider === 'twilio' && config.twilio) {
+            const twilio = require('twilio');
+            const client = twilio(config.twilio.account_sid, config.twilio.auth_token);
+            await client.messages.create({
+                body: message,
+                from: config.twilio.from_number,
+                to: phone
+            });
+        } else if (config.provider === 'aws_sns' && config.aws_sns) {
+            const AWS = require('aws-sdk');
+            const sns = new AWS.SNS({
+                accessKeyId: config.aws_sns.access_key_id,
+                secretAccessKey: config.aws_sns.secret_access_key,
+                region: config.aws_sns.region
+            });
+            await sns.publish({
+                Message: message,
+                PhoneNumber: phone
+            }).promise();
+        }
+    }
+}