@digitaldefiance/node-express-suite-mongo 4.23.0

package/src/schemas/user-role.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * @fileoverview User-role relationship schema factory for MongoDB.
+ * Creates schema for many-to-many user-role associations.
+ * @module schemas/user-role
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserRoleSchema = void 0;
+exports.createUserRoleSchema = createUserRoleSchema;
+const mongoose_types_1 = require("@digitaldefiance/mongoose-types");
+const enumerations_1 = require("../enumerations");
+/**
+ * Factory function to create an extensible user-role schema.
+ * Includes compound unique index and separate indexes for queries.
+ * @template TModelName - Model name type (defaults to BaseModelName)
+ * @template TConstants - Constants type (defaults to IConstants)
+ * @param {UserRoleSchemaOptions<TModelName>} options - Schema configuration options
+ * @param {TConstants} [_constants] - Optional constants (reserved for future use)
+ * @returns {Schema} Configured user-role schema with indexes
+ */
+function createUserRoleSchema(options = {}, _constants) {
+    const { userModelName = enumerations_1.BaseModelName.User, roleModelName = enumerations_1.BaseModelName.Role, idType = mongoose_types_1.Schema.Types.ObjectId, } = options;
+    const definition = {
+        userId: {
+            type: idType,
+            ref: userModelName,
+            required: true,
+        },
+        roleId: {
+            type: idType,
+            ref: roleModelName,
+            required: true,
+        },
+        createdBy: {
+            type: idType,
+            ref: userModelName,
+            required: true,
+            immutable: true,
+        },
+        updatedBy: {
+            type: idType,
+            ref: userModelName,
+            required: true,
+        },
+        deletedAt: {
+            type: Date,
+            optional: true,
+        },
+        deletedBy: {
+            type: idType,
+            ref: userModelName,
+            required: false,
+            optional: true,
+        },
+    };
+    const schema = new mongoose_types_1.Schema(definition, { timestamps: true });
+    schema.index({ userId: 1, roleId: 1 }, { unique: true });
+    schema.index({ userId: 1 });
+    schema.index({ roleId: 1 });
+    return schema;
+}
+/**
+ * Default user-role schema with base configuration.
+ * Pre-configured schema with compound unique index on userId and roleId.
+ */
+exports.UserRoleSchema = createUserRoleSchema();
+//# sourceMappingURL=user-role.js.map

package/src/schemas/user-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-role.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite-mongo/src/schemas/user-role.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA8BH,oDAoDC;AAhFD,oEAAyD;AACzD,kDAAgD;AAkBhD;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAIlC,UAA6C,EAAE,EAC/C,UAAuB;IAEvB,MAAM,EACJ,aAAa,GAAG,4BAAa,CAAC,IAAkB,EAChD,aAAa,GAAG,4BAAa,CAAC,IAAkB,EAChD,MAAM,GAAG,uBAAM,CAAC,KAAK,CAAC,QAAQ,GAC/B,GAAG,OAAO,CAAC;IAEZ,MAAM,UAAU,GAAG;QACjB,MAAM,EAAE;YACN,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,IAAI;SACf;QACD,MAAM,EAAE;YACN,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,IAAI;SACf;QACD,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;SAChB;QACD,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,IAAI;SACf;QACD,SAAS,EAAE;YACT,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,IAAI;SACf;QACD,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,aAAa;YAClB,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;SACf;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,uBAAM,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACU,QAAA,cAAc,GAAG,oBAAoB,EAAE,CAAC"}

package/src/schemas/user.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @fileoverview User schema factory for MongoDB with comprehensive validation.
+ * Creates schema for user management with authentication and preferences.
+ * @module schemas/user
+ */
+import { Schema } from '@digitaldefiance/mongoose-types';
+import { IConstants } from '@digitaldefiance/node-express-suite';
+/**
+ * Creates a user schema with custom or default constants.
+ * Includes validation for username, email, timezone, currency, and language.
+ * @template T - Constants type extending IConstants
+ * @param {Function} [usernameValidationMessage] - Custom username validation message
+ * @param {Function} [emailValidationMessage] - Custom email validation message
+ * @param {Function} [timezoneValidationMessage] - Custom timezone validation message
+ * @param {Function} [currencyValidationMessage] - Custom currency validation message
+ * @param {readonly string[]} [supportedLanguages] - Supported language codes
+ * @param {any} idType - ID type for references (defaults to ObjectId)
+ * @param {T} constants - Constants for validation (defaults to AppConstants)
+ * @returns {Schema} Configured user schema with timestamps
+ */
+export declare function createUserSchema<T extends IConstants = IConstants>(usernameValidationMessage?: () => string, emailValidationMessage?: () => string, timezoneValidationMessage?: () => string, currencyValidationMessage?: () => string, supportedLanguages?: readonly string[], idType?: any, constants?: T): Schema;
+/**
+ * Default user schema with base configuration.
+ * Pre-configured schema with standard validation and supported languages.
+ */
+export declare const UserSchema: Schema<any, import("mongoose").Model<any, any, any, any, any, any>, {}, {}, {}, {}, import("mongoose").DefaultSchemaOptions, {
+    [x: number]: unknown;
+    [x: symbol]: unknown;
+    [x: string]: unknown;
+}, import("mongoose").Document<unknown, {}, import("mongoose").FlatRecord<{
+    [x: number]: unknown;
+    [x: symbol]: unknown;
+    [x: string]: unknown;
+}>, {}, import("mongoose").ResolveSchemaOptions<import("mongoose").DefaultSchemaOptions>> & import("mongoose").FlatRecord<{
+    [x: number]: unknown;
+    [x: symbol]: unknown;
+    [x: string]: unknown;
+}> & Required<{
+    _id: unknown;
+}> & {
+    __v: number;
+}>;
+//# sourceMappingURL=user.d.ts.map

package/src/schemas/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite-mongo/src/schemas/user.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAQzD,OAAO,EAEL,UAAU,EACX,MAAM,qCAAqC,CAAC;AAG7C;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,UAAU,GAAG,UAAU,EAChE,yBAAyB,CAAC,EAAE,MAAM,MAAM,EACxC,sBAAsB,CAAC,EAAE,MAAM,MAAM,EACrC,yBAAyB,CAAC,EAAE,MAAM,MAAM,EACxC,yBAAyB,CAAC,EAAE,MAAM,MAAM,EACxC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,EACtC,MAAM,GAAE,GAA2B,EACnC,SAAS,GAAE,CAAqB,GAC/B,MAAM,CAqMR;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;EAAqB,CAAC"}

package/src/schemas/user.js

@@ -0,0 +1,214 @@
+"use strict";
+/**
+ * @fileoverview User schema factory for MongoDB with comprehensive validation.
+ * Creates schema for user management with authentication and preferences.
+ * @module schemas/user
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserSchema = void 0;
+exports.createUserSchema = createUserSchema;
+const tslib_1 = require("tslib");
+const i18n_lib_1 = require("@digitaldefiance/i18n-lib");
+const mongoose_types_1 = require("@digitaldefiance/mongoose-types");
+const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
+const currency_codes_1 = require("currency-codes");
+const validator_1 = tslib_1.__importDefault(require("validator"));
+const node_express_suite_1 = require("@digitaldefiance/node-express-suite");
+const enumerations_1 = require("../enumerations");
+/**
+ * Creates a user schema with custom or default constants.
+ * Includes validation for username, email, timezone, currency, and language.
+ * @template T - Constants type extending IConstants
+ * @param {Function} [usernameValidationMessage] - Custom username validation message
+ * @param {Function} [emailValidationMessage] - Custom email validation message
+ * @param {Function} [timezoneValidationMessage] - Custom timezone validation message
+ * @param {Function} [currencyValidationMessage] - Custom currency validation message
+ * @param {readonly string[]} [supportedLanguages] - Supported language codes
+ * @param {any} idType - ID type for references (defaults to ObjectId)
+ * @param {T} constants - Constants for validation (defaults to AppConstants)
+ * @returns {Schema} Configured user schema with timestamps
+ */
+function createUserSchema(usernameValidationMessage, emailValidationMessage, timezoneValidationMessage, currencyValidationMessage, supportedLanguages, idType = mongoose_types_1.Schema.Types.ObjectId, constants = node_express_suite_1.LocalhostConstants) {
+    const definition = {
+        /**
+         * The unique identifier for the user
+         */
+        username: {
+            type: String,
+            required: true,
+            unique: true,
+            validate: {
+                validator: (v) => constants.UsernameRegex.test(v),
+                message: usernameValidationMessage ||
+                    (() => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_UsernameRegexErrorTemplate)),
+            },
+        },
+        /**
+         * The email address for the user
+         */
+        email: {
+            type: String,
+            required: true,
+            unique: true,
+            validate: {
+                validator: (v) => validator_1.default.isEmail(v),
+                message: emailValidationMessage ||
+                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Error_InvalidEmailTemplate, { email: props.value })),
+            },
+        },
+        /**
+         * The user's public key, stored in hex format.
+         */
+        publicKey: {
+            type: String,
+            required: true,
+            unique: true,
+        },
+        /**
+         * The timezone for the user
+         */
+        timezone: {
+            type: String,
+            required: true,
+            default: 'UTC',
+            validate: {
+                validator: function (v) {
+                    return (0, i18n_lib_1.isValidTimezone)(v);
+                },
+                message: timezoneValidationMessage ||
+                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_NotValidTimeZoneTemplate, { timezone: props.value })),
+            },
+        },
+        currency: {
+            type: String,
+            required: true,
+            default: 'USD',
+            validate: {
+                validator: function (v) {
+                    return (0, currency_codes_1.codes)().includes(v);
+                },
+                message: currencyValidationMessage ||
+                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_NotValidCurrencyTemplate, { currency: props.value })),
+            },
+        },
+        /**
+         * The language of the site for the user
+         */
+        siteLanguage: {
+            type: String,
+            enum: supportedLanguages || Object.values(i18n_lib_1.LanguageCodes),
+            default: i18n_lib_1.LanguageCodes.EN_US,
+            required: true,
+        },
+        /**
+         * Whether the user prefers dark mode
+         */
+        darkMode: {
+            type: Boolean,
+            default: false,
+            required: true,
+        },
+        /**
+         * Whether to enable direct challenge login for the user
+         */
+        directChallenge: {
+            type: Boolean,
+            default: true,
+            required: true,
+        },
+        /**
+         * The date the user last logged in
+         */
+        lastLogin: { type: Date, required: false },
+        /**
+         * Whether the user has verified their email address
+         */
+        emailVerified: { type: Boolean, default: false },
+        /**
+         * The status of the user's account
+         */
+        accountStatus: {
+            type: String,
+            enum: Object.values(suite_core_lib_1.AccountStatus),
+            default: suite_core_lib_1.AccountStatus.PendingEmailVerification,
+        },
+        /**
+         * The user who created the user.
+         */
+        createdBy: {
+            type: idType,
+            ref: enumerations_1.BaseModelName.User,
+            required: true,
+            immutable: true,
+        },
+        /**
+         * The user who last updated the user.
+         */
+        updatedBy: {
+            type: idType,
+            ref: enumerations_1.BaseModelName.User,
+            optional: true,
+        },
+        /**
+         * The date/time the user was deleted.
+         */
+        deletedAt: { type: Date, optional: true },
+        /**
+         * The user who deleted the user.
+         */
+        deletedBy: {
+            type: idType,
+            ref: enumerations_1.BaseModelName.User,
+            optional: true,
+        },
+        /**
+         * Reference to the mnemonic document
+         */
+        mnemonicId: {
+            type: idType,
+            ref: enumerations_1.BaseModelName.Mnemonic,
+            required: false,
+        },
+        /**
+         * Copy of the mnemonic encrypted with the user's public key
+         */
+        mnemonicRecovery: {
+            type: String,
+            required: false,
+        },
+        /**
+         * Password-wrapped ECIES private key (Option B)
+         */
+        passwordWrappedPrivateKey: {
+            type: {
+                salt: { type: String, required: true },
+                iv: { type: String, required: true },
+                authTag: { type: String, required: true },
+                ciphertext: { type: String, required: true },
+                iterations: { type: Number, required: true },
+            },
+            required: false,
+        },
+        /**
+         * Array of backup codes to recover mnemonic/private key
+         */
+        backupCodes: {
+            type: [
+                {
+                    version: { type: String, required: true },
+                    checksumSalt: { type: String, required: true },
+                    checksum: { type: String, required: true },
+                    encrypted: { type: String, required: true },
+                },
+            ],
+            default: [],
+        },
+    };
+    return new mongoose_types_1.Schema(definition, { timestamps: true });
+}
+/**
+ * Default user schema with base configuration.
+ * Pre-configured schema with standard validation and supported languages.
+ */
+exports.UserSchema = createUserSchema();
+//# sourceMappingURL=user.js.map

package/src/schemas/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite-mongo/src/schemas/user.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA8BH,4CA6MC;;AAzOD,wDAA2E;AAC3E,oEAAyD;AACzD,oEAIyC;AACzC,mDAAuC;AACvC,kEAAkC;AAClC,4EAG6C;AAC7C,kDAAgD;AAEhD;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAC9B,yBAAwC,EACxC,sBAAqC,EACrC,yBAAwC,EACxC,yBAAwC,EACxC,kBAAsC,EACtC,SAAc,uBAAM,CAAC,KAAK,CAAC,QAAQ,EACnC,YAAe,uCAAiB;IAEhC,MAAM,UAAU,GAAG;QACjB;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE;gBACR,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,OAAO,EACL,yBAAyB;oBACzB,CAAC,GAAG,EAAE,CACJ,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,qCAAqC,CACzD,CAAC;aACP;SACF;QACD;;WAEG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE;gBACR,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,mBAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9C,OAAO,EACL,sBAAsB;oBACtB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,0BAA0B,EAC7C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;aACP;SACF;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;SACb;QACD;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE;gBACR,SAAS,EAAE,UAAU,CAAS;oBAC5B,OAAO,IAAA,0BAAe,EAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;gBACD,OAAO,EACL,yBAAyB;oBACzB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,+BAA+B,EAClD,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,CAC1B,CAAC;aACP;SACF;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE;gBACR,SAAS,EAAE,UAAU,CAAS;oBAC5B,OAAO,IAAA,sBAAK,GAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBACD,OAAO,EACL,yBAAyB;oBACzB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,+BAA+B,EAClD,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,CAC1B,CAAC;aACP;SACF;QACD;;WAEG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,kBAAkB,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAa,CAAC;YACxD,OAAO,EAAE,wBAAa,CAAC,KAAK;YAC5B,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1C;;WAEG;QACH,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAChD;;WAEG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,8BAAa,CAAC;YAClC,OAAO,EAAE,8BAAa,CAAC,wBAAwB;SAChD;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;SAChB;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,QAAQ;YAC3B,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE;gBACJ,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACtC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC7C;YACD,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,WAAW,EAAE;YACX,IAAI,EAAE;gBACJ;oBACE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACzC,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC1C,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC5C;aACF;YACD,OAAO,EAAE,EAAE;SACZ;KACF,CAAC;IAEF,OAAO,IAAI,uBAAM,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACU,QAAA,UAAU,GAAG,gBAAgB,EAAE,CAAC"}

package/src/services/backup-code.d.ts

@@ -0,0 +1,118 @@
+/**
+ * @fileoverview Backup code service for secure account recovery.
+ * Implements v1.0.0 backup code scheme with Argon2id KDF and HKDF-SHA256 checksums.
+ *
+ * Storage-agnostic: accepts an optional {@link IBackupCodeStore} for persistence.
+ * When no store is provided, falls back to direct UserDocument manipulation
+ * (backward-compatible Mongoose path).
+ *
+ * @module services/backup-code
+ */
+import { SecureString } from '@digitaldefiance/ecies-lib';
+import { ClientSession } from '@digitaldefiance/mongoose-types';
+import { Member as BackendMember, ECIESService, PlatformID } from '@digitaldefiance/node-ecies-lib';
+import { IBackupCode, ITokenRole } from '@digitaldefiance/suite-core-lib';
+import { BaseService, KeyWrappingService } from '@digitaldefiance/node-express-suite';
+import type { IApplication, IBackupCodeStore, IBackupCodeUserRecord } from '@digitaldefiance/node-express-suite';
+import { UserDocument } from '../documents';
+import { RoleService } from './role';
+/**
+ * Service for backup code generation, validation, and key recovery.
+ * Implements secure backup code scheme with constant-time validation and key wrapping.
+ *
+ * Storage is abstracted via {@link IBackupCodeStore}. When a store is provided,
+ * all persistence goes through the store interface. When omitted, the service
+ * falls back to direct UserDocument manipulation for backward compatibility
+ * with existing Mongoose-based consumers.
+ *
+ * @template TID - Platform ID type (defaults to Buffer)
+ * @template TDate - Date type (defaults to Date)
+ * @template TTokenRole - Token role interface type
+ * @template TApplication - Application interface type
+ * @extends {BaseService<TID>}
+ */
+export declare class BackupCodeService<TID extends PlatformID = Buffer, TDate extends Date = Date, TTokenRole extends ITokenRole<TID, TDate> = ITokenRole<TID, TDate>, TApplication extends IApplication<TID> = IApplication<TID>> extends BaseService<TID> {
+    private readonly eciesService;
+    private systemUser?;
+    private readonly keyWrappingService;
+    private readonly roleService;
+    private readonly store?;
+    /**
+     * Construct a BackupCodeService.
+     * @param application - The application instance
+     * @param eciesService - ECIES cryptographic service
+     * @param keyWrappingService - Key wrapping service for password-based key protection
+     * @param roleService - Role service for member type resolution
+     * @param store - Optional storage adapter. When omitted, falls back to direct
+     *   UserDocument manipulation (Mongoose). Provide an IBackupCodeStore implementation
+     *   for non-Mongoose backends (e.g. BrightDB).
+     */
+    constructor(application: TApplication, eciesService: ECIESService<TID>, keyWrappingService: KeyWrappingService, roleService: RoleService<TID, TDate, TTokenRole>, store?: IBackupCodeStore<TID>);
+    /**
+     * Get the lazily-initialized system user for key wrapping/unwrapping.
+     */
+    private getSystemUser;
+    /**
+     * Forcibly set the system user (for database initialization)
+     * @param user
+     */
+    setSystemUser(user: BackendMember<TID>): void;
+    /**
+     * v1: Consume (validate and remove) a backup code via constant-time checksum match.
+     */
+    useBackupCodeV1(encryptedBackupCodes: Array<IBackupCode>, backupCode: string): {
+        newCodesArray: Array<IBackupCode>;
+        code: IBackupCode;
+    };
+    /**
+     * Consume a backup code by first detecting the version and then dispatching to the appropriate handler.
+     */
+    useBackupCode(encryptedBackupCodes: Array<IBackupCode>, backupCode: string): {
+        newCodesArray: Array<IBackupCode>;
+        code: IBackupCode;
+    };
+    /**
+     * Recover a user's private key using a backup code.
+     * Storage-agnostic: uses IBackupCodeStore when available, otherwise
+     * falls back to the legacy UserDocument path.
+     *
+     * @param userOrId - Either a UserDocument (legacy) or a user ID (store-based)
+     * @param backupCode - The plaintext backup code
+     * @param newPassword - Optional new password to re-wrap the private key
+     * @param session - Optional database session for transactional consistency
+     */
+    recoverKeyWithBackupCodeV1(userOrId: UserDocument<string, TID> | TID, backupCode: string, newPassword?: SecureString, session?: ClientSession): Promise<{
+        userDoc?: UserDocument<string, TID>;
+        userRecord?: IBackupCodeUserRecord<TID>;
+        user: BackendMember<TID>;
+        codeCount: number;
+    }>;
+    /**
+     * Recover a user's private key using a backup code (version-dispatched).
+     * Accepts either a UserDocument (legacy) or a user ID (store-based).
+     */
+    recoverKeyWithBackupCode(userOrId: UserDocument<string, TID> | TID, backupCode: string, newPassword?: SecureString, session?: ClientSession): Promise<{
+        userDoc?: UserDocument<string, TID>;
+        userRecord?: IBackupCodeUserRecord<TID>;
+        user: BackendMember<TID>;
+        codeCount: number;
+    }>;
+    /**
+     * Rewrap system-wrapped AEAD blobs from old system key to new one.
+     *
+     * When a store is provided, uses the store's fetchBatch/updateUserRecord.
+     * Otherwise falls back to the legacy callback-based approach.
+     */
+    rewrapAllUsersBackupCodes(fetchBatchOrOldSystem: ((afterId?: string, limit?: number) => Promise<UserDocument<string, TID>[]>) | BackendMember, saveUserOrNewSystem: ((user: UserDocument<string, TID>) => Promise<void>) | BackendMember, oldSystemOrOptions?: BackendMember | {
+        batchSize?: number;
+        onProgress?: (count: number) => void;
+    }, newSystemOrUndefined?: BackendMember, options?: {
+        batchSize?: number;
+        onProgress?: (count: number) => void;
+    }): Promise<number>;
+    private _recoverViaStore;
+    private _recoverViaUserDoc;
+    private _rewrapViaStore;
+    private _rewrapViaCallbacks;
+}
+//# sourceMappingURL=backup-code.d.ts.map

package/src/services/backup-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-code.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite-mongo/src/services/backup-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAIL,YAAY,EACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACL,MAAM,IAAI,aAAa,EACvB,YAAY,EACZ,UAAU,EACX,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,WAAW,EAEX,UAAU,EACX,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAGL,WAAW,EACX,kBAAkB,EAGnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAiB,CAC5B,GAAG,SAAS,UAAU,GAAG,MAAM,EAC/B,KAAK,SAAS,IAAI,GAAG,IAAI,EACzB,UAAU,SAAS,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,EAClE,YAAY,SAAS,YAAY,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAC1D,SAAQ,WAAW,CAAC,GAAG,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,UAAU,CAAC,CAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAwB;IAE/C;;;;;;;;;OASG;gBAED,WAAW,EAAE,YAAY,EACzB,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,EAC/B,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,EAChD,KAAK,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC;IAS/B;;OAEG;IACH,OAAO,CAAC,aAAa;IAUrB;;;OAGG;IACI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI;IAMpD;;OAEG;IACI,eAAe,CACpB,oBAAoB,EAAE,KAAK,CAAC,WAAW,CAAC,EACxC,UAAU,EAAE,MAAM,GACjB;QAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE;IAmC3D;;OAEG;IACI,aAAa,CAClB,oBAAoB,EAAE,KAAK,CAAC,WAAW,CAAC,EACxC,UAAU,EAAE,MAAM,GACjB;QAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE;IAoB3D;;;;;;;;;OASG;IACU,0BAA0B,CACrC,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EACzC,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC;QACT,OAAO,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAeF;;;OAGG;IACU,wBAAwB,CACnC,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EACzC,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC;QACT,OAAO,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IA2BF;;;;;OAKG;IACU,yBAAyB,CACpC,qBAAqB,EACjB,CAAC,CACC,OAAO,CAAC,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,GAC1C,aAAa,EACjB,mBAAmB,EACf,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GACpD,aAAa,EACjB,kBAAkB,CAAC,EACf,aAAa,GACb;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,EAChE,oBAAoB,CAAC,EAAE,aAAa,EACpC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,GACrE,OAAO,CAAC,MAAM,CAAC;YA4BJ,gBAAgB;YA+EhB,kBAAkB;YAuFlB,eAAe;YAoDf,mBAAmB;CAmDlC"}