@digitaldefiance/node-express-suite 1.0.22 → 1.0.24

package/dist/services/user.js

@@ -1,1373 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserService = void 0;
-const ecies_lib_1 = require("@digitaldefiance/ecies-lib");
-const node_ecies_lib_1 = require("@digitaldefiance/node-ecies-lib");
-const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
-const crypto_1 = require("crypto");
-const mongodb_1 = require("mongodb");
-const mongoose_1 = require("mongoose");
-const validator_1 = __importDefault(require("validator"));
-const errors_1 = require("../errors");
-const backup_code_1 = require("../backup-code");
-const base_model_name_1 = require("../enumerations/base-model-name");
-const mongoose_validation_1 = require("../errors/mongoose-validation");
-const model_registry_1 = require("../model-registry");
-const utils_1 = require("../utils");
-const base_1 = require("./base");
-const direct_login_token_1 = require("./direct-login-token");
-const mnemonic_1 = require("./mnemonic");
-const request_user_1 = require("./request-user");
-const system_user_1 = require("./system-user");
-class UserService extends base_1.BaseService {
-    constructor(application, roleService, emailService, keyWrappingService, backupCodeService) {
-        super(application);
-        this.roleService = roleService;
-        this.emailService = emailService;
-        this.keyWrappingService = keyWrappingService;
-        this.backupCodeService = backupCodeService;
-        this.serverUrl = application.environment.serverUrl;
-        this.disableEmailSend = application.environment.disableEmailSend;
-        const config = {
-            curveName: this.application.constants.ECIES.CURVE_NAME,
-            primaryKeyDerivationPath: this.application.constants.ECIES.PRIMARY_KEY_DERIVATION_PATH,
-            mnemonicStrength: this.application.constants.ECIES.MNEMONIC_STRENGTH,
-            symmetricAlgorithm: this.application.constants.ECIES.SYMMETRIC_ALGORITHM_CONFIGURATION,
-            symmetricKeyBits: this.application.constants.ECIES.SYMMETRIC.KEY_BITS,
-            symmetricKeyMode: this.application.constants.ECIES.SYMMETRIC.MODE,
-        };
-        this.eciesService = new node_ecies_lib_1.ECIESService(config);
-        const mnemonicModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.Mnemonic);
-        this.mnemonicService = new mnemonic_1.MnemonicService(mnemonicModel, application.environment.mnemonicHmacSecret, this.keyWrappingService);
-    }
-    /**
-     * Given a User Document, make a User DTO
-     * @param user a User Document
-     * @returns An IUserDTO
-     */
-    static userToUserDTO(user) {
-        return {
-            ...(user instanceof mongoose_1.Document ? user.toObject() : user),
-            _id: (user._id instanceof mongoose_1.Types.ObjectId
-                ? user._id.toString()
-                : user._id),
-            createdBy: (user.createdBy instanceof Date
-                ? user.createdBy.toString()
-                : user.createdBy),
-            updatedBy: (user.updatedBy instanceof Date
-                ? user.updatedBy.toString()
-                : user.updatedBy),
-            ...(user.lastLogin
-                ? {
-                    lastLogin: (user.lastLogin instanceof Date
-                        ? user.lastLogin.toString()
-                        : user.lastLogin),
-                }
-                : {}),
-            ...(user.deletedBy
-                ? {
-                    deletedBy: (user.deletedBy instanceof Date
-                        ? user.deletedBy.toString()
-                        : user.deletedBy),
-                }
-                : {}),
-        };
-    }
-    /**
-     * Given a User DTO, reconstitute ids and dates
-     * @param user a User DTO
-     * @returns An IUserBackendObject
-     */
-    hydrateUserDTOToBackend(user) {
-        return {
-            ...user,
-            _id: new mongodb_1.ObjectId(user._id),
-            ...(user.lastLogin ? { lastLogin: new Date(user.lastLogin) } : {}),
-            createdAt: new Date(user.createdAt),
-            createdBy: new mongodb_1.ObjectId(user.createdBy),
-            updatedAt: new Date(user.updatedAt),
-            updatedBy: new mongodb_1.ObjectId(user.updatedBy),
-            ...(user.deletedAt ? { deletedAt: new Date(user.deletedAt) } : {}),
-            ...(user.deletedBy
-                ? {
-                    deletedBy: new mongodb_1.ObjectId(user.deletedBy),
-                }
-                : {}),
-            ...(user.mnemonicId ? { mnemonicId: new mongodb_1.ObjectId(user.mnemonicId) } : {}),
-        };
-    }
-    /**
-     * Create a new email token to send to the user for email verification
-     * @param userDoc The user to create the email token for
-     * @param type The type of email token to create
-     * @param session The session to use for the query
-     * @returns The email token document
-     */
-    async createEmailToken(userDoc, type, session) {
-        const EmailTokenModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.EmailToken);
-        // If we already have a session, use it directly to avoid nested transactions
-        if (session) {
-            const now = new Date();
-            const tokenData = {
-                userId: userDoc._id,
-                type: type,
-                email: userDoc.email,
-                token: (0, crypto_1.randomBytes)(this.application.constants.EmailTokenLength).toString('hex'),
-                createdAt: now,
-                updatedAt: now,
-                expiresAt: new Date(now.getTime() + this.application.constants.EmailTokenExpiration),
-            };
-            // Use findOneAndUpdate with upsert to avoid duplicate key errors
-            const emailToken = await EmailTokenModel.findOneAndUpdate({
-                userId: userDoc._id,
-                email: userDoc.email,
-                type: type,
-            }, tokenData, {
-                upsert: true,
-                new: true,
-                session,
-            });
-            if (!emailToken) {
-                throw new suite_core_lib_1.TranslatableSuiteError(suite_core_lib_1.SuiteCoreStringKey.Error_FailedToCreateEmailToken);
-            }
-            return emailToken;
-        }
-        // Only create a new transaction if no session is provided
-        return await this.withTransaction(async (sess) => {
-            const now = new Date();
-            const tokenData = {
-                userId: userDoc._id,
-                type: type,
-                email: userDoc.email,
-                token: (0, crypto_1.randomBytes)(this.application.constants.EmailTokenLength).toString('hex'),
-                createdAt: now,
-                updatedAt: now,
-                expiresAt: new Date(now.getTime() + this.application.constants.EmailTokenExpiration),
-            };
-            // Use findOneAndUpdate with upsert to avoid duplicate key errors
-            const emailToken = await EmailTokenModel.findOneAndUpdate({
-                userId: userDoc._id,
-                email: userDoc.email,
-                type: type,
-            }, tokenData, {
-                upsert: true,
-                new: true,
-                session: sess,
-            });
-            if (!emailToken) {
-                throw new suite_core_lib_1.TranslatableSuiteError(suite_core_lib_1.SuiteCoreStringKey.Error_FailedToCreateEmailToken);
-            }
-            return emailToken;
-        }, undefined, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout,
-            retryAttempts: 2,
-        });
-    }
-    /**
-     * Create and send an email token to the user for email verification
-     * @param user The user to send the email token to
-     * @param type The type of email token to send
-     * @param session The session to use for the query
-     * @returns The email token document
-     */
-    async createAndSendEmailToken(user, type = suite_core_lib_1.EmailTokenType.AccountVerification, session, debug = false) {
-        const emailToken = await this.createEmailToken(user, type, session);
-        try {
-            await this.sendEmailToken(emailToken, session, debug);
-        }
-        catch (error) {
-            // keep parity with previous behavior: continue returning token even if email send fails
-        }
-        return emailToken;
-    }
-    /**
-     * Create and send an email token directly within an existing transaction
-     * @param user The user to send the email token to
-     * @param type The type of email token to send
-     * @param session The session to use for the query (required)
-     * @param debug Whether to enable debug logging
-     * @returns The email token document
-     */
-    async createAndSendEmailTokenDirect(user, type = suite_core_lib_1.EmailTokenType.AccountVerification, session, debug = false) {
-        const EmailTokenModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.EmailToken);
-        // Create token directly within the existing session using upsert
-        const now = new Date();
-        const tokenData = {
-            userId: user._id,
-            type: type,
-            email: user.email,
-            token: (0, crypto_1.randomBytes)(this.application.constants.EmailTokenLength).toString('hex'),
-            createdAt: now,
-            updatedAt: now,
-            expiresAt: new Date(now.getTime() + this.application.constants.EmailTokenExpiration),
-        };
-        // Use findOneAndUpdate with upsert to avoid duplicate key errors
-        const emailToken = await EmailTokenModel.findOneAndUpdate({
-            userId: user._id,
-            email: user.email,
-            type: type,
-        }, tokenData, {
-            upsert: true,
-            new: true,
-            session,
-        });
-        if (!emailToken) {
-            throw new suite_core_lib_1.TranslatableSuiteError(suite_core_lib_1.SuiteCoreStringKey.Error_FailedToCreateEmailToken);
-        }
-        try {
-            await this.sendEmailToken(emailToken, session, debug);
-        }
-        catch (error) {
-            // Ignore email send errors in direct token creation
-        }
-        return emailToken;
-    }
-    /**
-     * Send an email token to the user for email verification
-     * @param emailToken The email token to send
-     * @param session The session to use for the query
-     * @returns void
-     */
-    async sendEmailToken(emailToken, session, debug = false) {
-        if (this.disableEmailSend) {
-            (0, utils_1.debugLog)(debug, 'log', 'Email sending disabled for testing');
-            // Still update lastSent and expiration to keep token valid during tests
-            emailToken.lastSent = new Date();
-            emailToken.expiresAt = new Date(Date.now() + this.application.constants.EmailTokenExpiration);
-            await emailToken.save({ session });
-            return;
-        }
-        if (emailToken.lastSent &&
-            emailToken.lastSent.getTime() +
-                this.application.constants.EmailTokenResendInterval >
-                Date.now()) {
-            throw new suite_core_lib_1.EmailTokenSentTooRecentlyError(emailToken.lastSent);
-        }
-        let subjectString;
-        let bodyString;
-        let url;
-        switch (emailToken.type) {
-            case suite_core_lib_1.EmailTokenType.AccountVerification:
-                subjectString = suite_core_lib_1.SuiteCoreStringKey.Email_ConfirmationSubjectTemplate;
-                bodyString = suite_core_lib_1.SuiteCoreStringKey.Email_ConfirmationBody;
-                url = `${this.serverUrl}/verify-email?token=${emailToken.token}`;
-                break;
-            case suite_core_lib_1.EmailTokenType.PasswordReset:
-                subjectString = suite_core_lib_1.SuiteCoreStringKey.Email_ResetPasswordSubjectTemplate;
-                bodyString = suite_core_lib_1.SuiteCoreStringKey.Email_ResetPasswordBody;
-                url = `${this.serverUrl}/forgot-password?token=${emailToken.token}`;
-                break;
-            case suite_core_lib_1.EmailTokenType.LoginRequest:
-                subjectString = suite_core_lib_1.SuiteCoreStringKey.Email_LoginRequestSubjectTemplate;
-                bodyString = suite_core_lib_1.SuiteCoreStringKey.Email_LoginRequestBody;
-                url = `${this.serverUrl}/challenge?token=${emailToken.token}`;
-                break;
-            case suite_core_lib_1.EmailTokenType.MnemonicRecoveryRequest:
-            case suite_core_lib_1.EmailTokenType.PrivateKeyRequest:
-            default:
-                throw new Error('Invalid email token type');
-        }
-        const emailSubject = (0, suite_core_lib_1.getSuiteCoreTranslation)(subjectString);
-        const emailText = `${(0, suite_core_lib_1.getSuiteCoreTranslation)(bodyString)}\r\n\r\n${url}`;
-        const emailHtml = `<p>${(0, suite_core_lib_1.getSuiteCoreTranslation)(bodyString)}</p><br/><p><a href="${url}">${url}</a></p><p>${(0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Email_LinkExpiresInTemplate)}</p>`;
-        try {
-            // Use the EmailService to send the email
-            await this.emailService.sendEmail(emailToken.email, emailSubject, emailText, emailHtml);
-            // update last sent/expiration
-            emailToken.lastSent = new Date();
-            emailToken.expiresAt = new Date(Date.now() + this.application.constants.EmailTokenExpiration);
-            await emailToken.save({ session });
-        }
-        catch (error) {
-            throw new suite_core_lib_1.EmailTokenFailedToSendError(emailToken.type);
-        }
-    }
-    /**
-     * Find a user by email or username and enforce account status checks
-     * @param email Optional email
-     * @param username Optional username
-     * @param session Optional mongoose session
-     * @throws UsernameOrEmailRequiredError if neither provided
-     * @throws InvalidCredentialsError if not found or deleted
-     * @throws AccountLockedError | PendingEmailVerificationError | AccountStatusError per status
-     */
-    async findUser(email, username, session) {
-        if (!email && !username) {
-            throw new suite_core_lib_1.UsernameOrEmailRequiredError();
-        }
-        const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-        let userDoc = null;
-        try {
-            if (email) {
-                userDoc = await UserModel.findOne({
-                    email: email.toLowerCase(),
-                })
-                    .session(session ?? null)
-                    .exec();
-            }
-            else if (username) {
-                userDoc = await UserModel.findOne({ username })
-                    .collation({ locale: 'en', strength: 2 })
-                    .session(session ?? null)
-                    .exec();
-            }
-        }
-        catch (error) {
-            // Database error in findUser - convert to InvalidCredentialsError for security
-            throw new suite_core_lib_1.InvalidCredentialsError();
-        }
-        if (!userDoc || userDoc.deletedAt) {
-            if (email) {
-                const engine = (0, ecies_lib_1.getEciesI18nEngine)();
-                throw new ecies_lib_1.InvalidEmailError(ecies_lib_1.InvalidEmailErrorType.Missing, engine);
-            }
-            throw new suite_core_lib_1.InvalidUsernameError();
-        }
-        switch (userDoc.accountStatus) {
-            case suite_core_lib_1.AccountStatus.Active:
-                break;
-            case suite_core_lib_1.AccountStatus.AdminLock:
-                throw new suite_core_lib_1.AccountLockedError();
-            case suite_core_lib_1.AccountStatus.PendingEmailVerification:
-                throw new suite_core_lib_1.PendingEmailVerificationError();
-            default:
-                throw new suite_core_lib_1.AccountStatusError(userDoc.accountStatus);
-        }
-        return userDoc;
-    }
-    /**
-     * Finds a user record by ID
-     * @param userId The user ID
-     * @param throwIfNotActive Whether to throw if the user is inactive
-     * @param session The active session, if present
-     * @returns The user document
-     */
-    async findUserById(userId, throwIfNotActive, session, select) {
-        const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-        const baseQuery = UserModel.findById(userId).session(session ?? null);
-        if (select) {
-            // Always include fields needed for status checks
-            const merged = this.ensureRequiredFieldsInProjection(select, [
-                'deletedAt',
-                'accountStatus',
-            ]);
-            baseQuery.select(merged);
-        }
-        const userDoc = (await baseQuery.exec());
-        if (!userDoc || userDoc.deletedAt) {
-            throw new suite_core_lib_1.UserNotFoundError();
-        }
-        if (throwIfNotActive) {
-            switch (userDoc.accountStatus) {
-                case suite_core_lib_1.AccountStatus.Active:
-                    break;
-                case suite_core_lib_1.AccountStatus.AdminLock:
-                    throw new suite_core_lib_1.AccountLockedError();
-                case suite_core_lib_1.AccountStatus.PendingEmailVerification:
-                    throw new suite_core_lib_1.PendingEmailVerificationError();
-                default:
-                    throw new suite_core_lib_1.AccountStatusError(userDoc.accountStatus);
-            }
-        }
-        return userDoc;
-    }
-    /**
-     * Ensure required fields are present in a projection for queries that rely on them.
-     * Supports string and object-style projections. For inclusion projections, adds fields.
-     * For exclusion projections, ensures required fields are not excluded.
-     */
-    ensureRequiredFieldsInProjection(select, required) {
-        if (typeof select === 'string') {
-            const parts = select
-                .split(/\s+/)
-                .map((s) => s.trim())
-                .filter(Boolean);
-            const exclusions = new Set(parts.filter((p) => p.startsWith('-')).map((p) => p.slice(1)));
-            // Remove exclusions on required fields
-            for (const r of required) {
-                exclusions.delete(r);
-            }
-            const cleaned = parts.filter((p) => !p.startsWith('-'));
-            for (const r of required) {
-                if (!cleaned.includes(r))
-                    cleaned.push(r);
-            }
-            const result = [...cleaned, ...[...exclusions].map((r) => `-${r}`)];
-            return result.join(' ');
-        }
-        if (select && typeof select === 'object') {
-            const proj = { ...select };
-            const values = Object.values(proj);
-            const hasInclusions = values.some((v) => v === 1 || v === true);
-            if (hasInclusions) {
-                for (const r of required) {
-                    proj[r] = 1;
-                }
-            }
-            else {
-                const keysToRemove = required.filter((r) => proj[r] === 0 || proj[r] === false || proj[r] === -1);
-                keysToRemove.forEach((key) => delete proj[key]);
-            }
-            return proj;
-        }
-        return select;
-    }
-    /**
-     * Fill in the default values to a user object
-     * @param newUser The user object to fill in
-     * @param createdBy The user ID of the user creating the new user
-     * @returns The filled in user
-     */
-    fillUserDefaults(newUser, createdBy, backupCodes, encryptedMnemonic, userId) {
-        return {
-            ...(userId ? { _id: userId } : {}),
-            timezone: 'UTC',
-            ...newUser,
-            email: newUser.email.toLowerCase(),
-            emailVerified: false,
-            accountStatus: suite_core_lib_1.AccountStatus.PendingEmailVerification,
-            duressPasswords: [],
-            siteLanguage: suite_core_lib_1.DefaultLanguageCode,
-            publicKey: '',
-            backupCodes,
-            mnemonicRecovery: encryptedMnemonic,
-            directChallenge: false,
-            createdAt: new Date(),
-            createdBy: createdBy,
-            updatedAt: new Date(),
-            updatedBy: createdBy,
-        };
-    }
-    /**
-     * Create a new user document from an IUser and unhashed password
-     * @param newUser The user object
-     * @returns The new user document
-     */
-    async makeUserDoc(newUser) {
-        const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-        const newUserDoc = new UserModel(newUser);
-        const validationError = newUserDoc.validateSync();
-        if (validationError) {
-            throw new mongoose_validation_1.MongooseValidationError(validationError.errors);
-        }
-        return newUserDoc;
-    }
-    /**
-     * Create a new user.
-     * Do not set createdBy to a new (non-existing) ObjectId unless you also set newUserId to it.
-     * If newUserId is not set, one will be generated.
-     * @param systemUser The system user performing the operation
-     * @param userData Username, email, password in a ICreateUserBasics object
-     * @param createdBy The user id of the user creating the user
-     * @param newUserId the user id of the new user object- usually the createdBy user id.
-     * @param session The session to use for the query
-     * @param debug Whether to log debug information
-     * @param password The password to use for the new user (optional, if not provided, mnemonic will be used)
-     * @returns The new user document
-     */
-    async newUser(systemUser, userData, createdBy, newUserId, session, debug = false, password) {
-        const _newUserId = newUserId ?? new mongoose_1.Types.ObjectId();
-        if (!this.application.constants.UsernameRegex.test(userData.username)) {
-            throw new suite_core_lib_1.InvalidUsernameError();
-        }
-        if (password && !this.application.constants.PasswordRegex.test(password)) {
-            throw new errors_1.InvalidNewPasswordError();
-        }
-        const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-        return await this.withTransaction(async (sess) => {
-            const existingEmail = await UserModel.findOne({
-                email: userData.email.toLowerCase(),
-            }).session(sess ?? null);
-            if (existingEmail) {
-                throw new suite_core_lib_1.EmailInUseError();
-            }
-            const existingUsername = await UserModel.findOne({
-                username: { $regex: new RegExp(`^${userData.username}$`, 'i') },
-            }).session(sess ?? null);
-            if (existingUsername) {
-                throw new suite_core_lib_1.UsernameInUseError();
-            }
-            let mnemonic;
-            let member;
-            while (!mnemonic || !member) {
-                try {
-                    const { member: newMember, mnemonic: newMnemonic } = node_ecies_lib_1.Member.newMember(this.eciesService, ecies_lib_1.MemberType.User, userData.username, new ecies_lib_1.EmailString(userData.email), undefined, createdBy);
-                    // make sure the new mnemonic is not already in the database
-                    const mnemonicExists = await this.mnemonicService.mnemonicExists(newMnemonic, sess);
-                    if (!mnemonicExists) {
-                        member = newMember;
-                        mnemonic = newMnemonic;
-                    }
-                }
-                catch {
-                    // If we fail to create a new member, we will retry until we succeed.
-                    // This is to ensure that we do not end up with duplicate mnemonics.
-                    (0, utils_1.debugLog)(debug, 'warn', 'Failed to create a new member, retrying...');
-                }
-            }
-            const backupCodes = backup_code_1.BackupCode.generateBackupCodes();
-            const encryptedBackupCodes = await backup_code_1.BackupCode.encryptBackupCodes(member, systemUser, backupCodes);
-            const encryptedMnemonic = member
-                .encryptData(Buffer.from(mnemonic.value ?? '', 'utf-8'))
-                .toString('hex');
-            const newUserDoc = new UserModel({
-                ...this.fillUserDefaults(userData, createdBy ?? _newUserId, encryptedBackupCodes, encryptedMnemonic, _newUserId),
-                publicKey: member.publicKey.toString('hex'),
-            });
-            const validationError = newUserDoc.validateSync();
-            if (validationError) {
-                throw new mongoose_validation_1.MongooseValidationError(validationError.errors);
-            }
-            // Always add HMAC-only mnemonic doc
-            const newMnemonicDoc = await this.mnemonicService.addMnemonic(mnemonic, sess);
-            if (newMnemonicDoc) {
-                newUserDoc.mnemonicId = newMnemonicDoc._id;
-            }
-            // If password provided, wrap the ECIES private key with the password (Option B)
-            if (password) {
-                const passwordSecure = new ecies_lib_1.SecureString(password);
-                try {
-                    const priv = new ecies_lib_1.SecureBuffer(member.privateKey.value);
-                    try {
-                        const wrapped = this.keyWrappingService.wrapSecret(priv, passwordSecure);
-                        newUserDoc.passwordWrappedPrivateKey = wrapped;
-                    }
-                    finally {
-                        priv.dispose();
-                    }
-                }
-                finally {
-                    passwordSecure.dispose();
-                }
-            }
-            const savedUserDoc = await newUserDoc.save({ session: sess });
-            const memberRoleId = await this.roleService.getRoleIdByName(this.application.constants.MemberRole, sess);
-            if (!memberRoleId) {
-                throw new suite_core_lib_1.TranslatableSuiteError(suite_core_lib_1.SuiteCoreStringKey.Error_FailedToLookupRoleTemplate, {
-                    ROLE: (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_Member),
-                });
-            }
-            await this.roleService.addUserToRole(memberRoleId, savedUserDoc._id, _newUserId, sess);
-            return {
-                user: savedUserDoc,
-                mnemonic: mnemonic.value ?? '',
-                backupCodes: backupCodes.map((code) => code.value ?? ''),
-                ...(password ? { password } : {}),
-            };
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 10,
-        });
-    }
-    /**
-     * Get the backup codes for a user.
-     * Requires the user not be deleted or inactive
-     */
-    async getEncryptedUserBackupCodes(userId, session) {
-        const userWithCodes = await this.findUserById(userId, true, session, {
-            backupCodes: 1,
-        });
-        return userWithCodes.backupCodes;
-    }
-    /**
-     * Resets the given user's backup codes
-     * @param backupUser The user to generate codes for
-     * @param session The current session, if any
-     * @returns A promise of an array of backup codes
-     */
-    async resetUserBackupCodes(backupUser, systemUser, session) {
-        if (!backupUser.hasPrivateKey) {
-            throw new suite_core_lib_1.PrivateKeyRequiredError();
-        }
-        const backupCodes = backup_code_1.BackupCode.generateBackupCodes();
-        const encryptedBackupCodes = await backup_code_1.BackupCode.encryptBackupCodes(backupUser, systemUser, backupCodes);
-        const UserModel = model_registry_1.ModelRegistry.instance.get('User')?.model;
-        return await this.withTransaction(async (sess) => {
-            await UserModel.updateOne({ _id: backupUser.id }, { $set: { backupCodes: encryptedBackupCodes } }, { session: sess });
-            return backupCodes;
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout,
-        });
-    }
-    /**
-     * Recover a user's mnemonic from an encrypted mnemonic
-     * @param user The user whose mnemonic to recover
-     * @param encryptedMnemonic The encrypted mnemonic
-     * @returns The recovered mnemonic
-     */
-    recoverMnemonic(user, encryptedMnemonic) {
-        if (!encryptedMnemonic) {
-            throw new suite_core_lib_1.TranslatableSuiteHandleableError(suite_core_lib_1.SuiteCoreStringKey.MnemonicRecovery_Missing, undefined, undefined, {
-                statusCode: 400,
-            });
-        }
-        return new ecies_lib_1.SecureString(user.decryptData(Buffer.from(encryptedMnemonic, 'hex')).toString('utf-8'));
-    }
-    /**
-     * Make a Member from a user document and optional private key
-     * @param userDoc The user document
-     * @param privateKey Optional private key to load the wallet
-     * @param publicKey Optional public key to override the userDoc public key
-     * @param session The current session, if any
-     * @returns A promise containing the created Member
-     */
-    async makeUserFromUserDoc(userDoc, privateKey, publicKey, mnemonic, wallet, session) {
-        const memberType = await this.roleService.getMemberType(userDoc, session);
-        const user = new node_ecies_lib_1.Member(this.eciesService, memberType, userDoc.username, new ecies_lib_1.EmailString(userDoc.email), publicKey ?? Buffer.from(userDoc.publicKey, 'hex'), privateKey, wallet, userDoc._id, new Date(userDoc.createdAt), new Date(userDoc.updatedAt), userDoc.createdBy);
-        if ((privateKey?.originalLength ?? -1) > 0 && user.hasPrivateKey) {
-            user.loadWallet(mnemonic ?? this.recoverMnemonic(user, userDoc.mnemonicRecovery));
-        }
-        return user;
-    }
-    /**
-     * Challenges a given userDoc with a given mnemonic, returns a system and user Member
-     * @param userDoc The userDoc in question
-     * @param mnemonic The mnemonic to challenge against
-     * @returns A promise containing the user and system Members
-     * @throws InvalidCredentialsError if the challenge fails
-     * @throws AccountLockedError if the account is locked
-     * @throws PendingEmailVerificationError if the email is not verified
-     * @throws AccountStatusError if the account status is invalid
-     */
-    async challengeUserWithMnemonic(userDoc, mnemonic, session) {
-        try {
-            // Verify provided mnemonic corresponds to the stored mnemonic HMAC (no password required)
-            // This prevents any valid mnemonic from authenticating as another user.
-            const MnemonicModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.Mnemonic);
-            if (!userDoc.mnemonicId) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            const mnemonicDoc = await MnemonicModel.findById(userDoc.mnemonicId)
-                .select('hmac')
-                .session(session ?? null)
-                .lean()
-                .exec();
-            if (!mnemonicDoc) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            const computedHmac = this.mnemonicService.getMnemonicHmac(mnemonic);
-            console.log('Debug mnemonic auth:', {
-                userDocId: userDoc._id.toString(),
-                userDocEmail: userDoc.email,
-                userDocUsername: userDoc.username,
-                mnemonicDocId: mnemonicDoc._id?.toString(),
-                storedHmac: mnemonicDoc.hmac,
-                computedHmac,
-                mnemonicsMatch: computedHmac === mnemonicDoc.hmac,
-            });
-            if (computedHmac !== mnemonicDoc.hmac) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            // Create a Member from the provided mnemonic to get the keys
-            const { wallet } = this.eciesService.walletAndSeedFromMnemonic(mnemonic);
-            const privateKey = wallet.getPrivateKey();
-            const publicKey = wallet.getPublicKey();
-            const publicKeyWithPrefix = Buffer.concat([
-                Buffer.from([this.application.constants.ECIES.PUBLIC_KEY_MAGIC]),
-                publicKey,
-            ]);
-            const userMember = await this.makeUserFromUserDoc(userDoc, new ecies_lib_1.SecureBuffer(privateKey), publicKeyWithPrefix, mnemonic, wallet, session);
-            // Verify the public key matches the stored userDoc public key
-            if (userMember.publicKey.toString('hex') !== userDoc.publicKey) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            // Generate a nonce challenge to verify they can decrypt with their key
-            const adminMember = system_user_1.SystemUserService.getSystemUser(this.application.environment);
-            const nonce = (0, crypto_1.randomBytes)(32);
-            const signature = adminMember.sign(nonce);
-            const payload = Buffer.concat([nonce, signature]);
-            const encryptedPayload = userMember.encryptData(payload);
-            const decryptedPayload = userMember.decryptData(encryptedPayload);
-            // Verify the server's signature on the nonce
-            const decryptedNonce = decryptedPayload.subarray(0, 32);
-            const decryptedSignature = decryptedPayload.subarray(32);
-            const isSignatureValid = adminMember.verify(decryptedSignature, decryptedNonce);
-            if (!isSignatureValid || !nonce.equals(decryptedNonce)) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            return {
-                userMember,
-                adminMember: adminMember,
-            };
-        }
-        catch (error) {
-            if (error instanceof suite_core_lib_1.InvalidCredentialsError ||
-                error instanceof suite_core_lib_1.AccountLockedError ||
-                error instanceof suite_core_lib_1.PendingEmailVerificationError ||
-                error instanceof suite_core_lib_1.AccountStatusError) {
-                throw error;
-            }
-            throw new suite_core_lib_1.InvalidCredentialsError();
-        }
-    }
-    /**
-     * Validates a login challenge response
-     * @param challengeResponse The challenge response bytes in hex
-     * @param email The email address of the user
-     * @param username The username of the user
-     * @param session The mongo session for the query
-     * @returns A promise that resolves to the user document, user member, and system member
-     */
-    async loginWithChallengeResponse(challengeResponse, email, username, session) {
-        const challengeBuffer = Buffer.from(challengeResponse, 'hex');
-        // validate the expected challenge response length (8 + 32 + 64 = 104 bytes)
-        if (challengeBuffer.length !=
-            this.application.constants.DirectLoginChallengeLength) {
-            throw new suite_core_lib_1.InvalidChallengeResponseError();
-        }
-        // disassemble the challengeResponse into time, nonce, signature
-        //
-        const time = challengeBuffer.subarray(0, 8); // 16 hex characters
-        const nonce = challengeBuffer.subarray(8, 40); // 64 hex characters
-        const signature = challengeBuffer.subarray(40); // 65 * 2 hex characters
-        const timeMs = parseInt(time.toString('hex'), 16);
-        if (new Date().getTime() - timeMs >
-            this.application.constants.LoginChallengeExpiration) {
-            throw new suite_core_lib_1.LoginChallengeExpiredError();
-        }
-        const userDoc = await this.findUser(email, username, session);
-        if (!userDoc && email) {
-            const engine = (0, ecies_lib_1.getEciesI18nEngine)();
-            throw new ecies_lib_1.InvalidEmailError(ecies_lib_1.InvalidEmailErrorType.Missing, engine);
-        }
-        else if (!userDoc) {
-            throw new suite_core_lib_1.InvalidUsernameError();
-        }
-        // re-sign the time + nonce and check if the signature matches
-        const adminMember = system_user_1.SystemUserService.getSystemUser(this.application.environment);
-        const timeAndNonce = Buffer.concat([time, nonce]);
-        const expectedSignature = adminMember.sign(timeAndNonce);
-        if (expectedSignature.toString('hex') !== signature.toString('hex')) {
-            throw new suite_core_lib_1.InvalidChallengeResponseError();
-        }
-        const userMember = await this.makeUserFromUserDoc(userDoc, undefined, undefined, undefined, undefined, session);
-        return {
-            userDoc,
-            userMember,
-            adminMember: adminMember,
-        };
-    }
-    /**
-     * Authenticate a user with client-verified challenge (skips server-side challenge)
-     * @returns The authenticated user document.
-     */
-    async loginWithClientVerifiedChallenge(usernameOrEmail, mnemonic, session) {
-        const UserModel = this.application.getModel(base_model_name_1.BaseModelName.User);
-        const userQuery = validator_1.default.isEmail(usernameOrEmail)
-            ? UserModel.findOne({ email: usernameOrEmail.toLowerCase() }).select('_id username email accountStatus deletedAt mnemonicId publicKey passwordWrappedPrivateKey')
-            : UserModel.findOne({ username: usernameOrEmail })
-                .collation({ locale: 'en', strength: 2 })
-                .select('_id username email accountStatus deletedAt mnemonicId publicKey passwordWrappedPrivateKey');
-        const userDoc = await userQuery.lean().session(session ?? null);
-        if (!userDoc || userDoc.deletedAt) {
-            throw new suite_core_lib_1.InvalidCredentialsError();
-        }
-        // Check account status
-        switch (userDoc.accountStatus) {
-            case suite_core_lib_1.AccountStatus.Active:
-                break;
-            case suite_core_lib_1.AccountStatus.AdminLock:
-                throw new suite_core_lib_1.AccountLockedError();
-            case suite_core_lib_1.AccountStatus.PendingEmailVerification:
-                throw new suite_core_lib_1.PendingEmailVerificationError();
-            default:
-                throw new suite_core_lib_1.AccountStatusError(userDoc.accountStatus);
-        }
-        // Verify mnemonic matches user (simplified verification)
-        try {
-            const MnemonicModel = this.application.getModel(base_model_name_1.BaseModelName.Mnemonic);
-            if (!userDoc.mnemonicId) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            const mnemonicDoc = await MnemonicModel.findById(userDoc.mnemonicId)
-                .select('hmac')
-                .session(session ?? null)
-                .lean()
-                .exec();
-            if (!mnemonicDoc) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            const computedHmac = this.mnemonicService.getMnemonicHmac(mnemonic);
-            if (computedHmac !== mnemonicDoc.hmac) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            // Create Member from mnemonic
-            const { wallet } = this.eciesService.walletAndSeedFromMnemonic(mnemonic);
-            const privateKey = wallet.getPrivateKey();
-            const publicKey = wallet.getPublicKey();
-            const publicKeyWithPrefix = Buffer.concat([
-                Buffer.from([this.application.constants.ECIES.PUBLIC_KEY_MAGIC]),
-                publicKey,
-            ]);
-            const userMember = await this.makeUserFromUserDoc(userDoc, new ecies_lib_1.SecureBuffer(privateKey), publicKeyWithPrefix, mnemonic, wallet, session);
-            // Verify public key matches
-            if (userMember.publicKey.toString('hex') !== userDoc.publicKey) {
-                throw new suite_core_lib_1.InvalidCredentialsError();
-            }
-            const adminMember = system_user_1.SystemUserService.getSystemUser(this.application.environment);
-            return {
-                userMember,
-                adminMember,
-                userDoc,
-            };
-        }
-        catch (error) {
-            if (error instanceof suite_core_lib_1.InvalidCredentialsError ||
-                error instanceof suite_core_lib_1.AccountLockedError ||
-                error instanceof suite_core_lib_1.PendingEmailVerificationError ||
-                error instanceof suite_core_lib_1.AccountStatusError) {
-                throw error;
-            }
-            throw new suite_core_lib_1.InvalidCredentialsError();
-        }
-    }
-    /**
-     * Authenticate a user with their mnemonic.
-     * @returns The authenticated user document.
-     */
-    async loginWithMnemonic(usernameOrEmail, mnemonic, session) {
-        const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-        const userQuery = validator_1.default.isEmail(usernameOrEmail)
-            ? UserModel.findOne({ email: usernameOrEmail.toLowerCase() }).select('_id username email accountStatus deletedAt mnemonicId publicKey passwordWrappedPrivateKey')
-            : UserModel.findOne({ username: usernameOrEmail })
-                .collation({ locale: 'en', strength: 2 })
-                .select('_id username email accountStatus deletedAt mnemonicId publicKey passwordWrappedPrivateKey');
-        const userDoc = await userQuery.lean().session(session ?? null);
-        if (!userDoc || userDoc.deletedAt) {
-            throw new suite_core_lib_1.InvalidCredentialsError();
-        }
-        // Check account status
-        switch (userDoc.accountStatus) {
-            case suite_core_lib_1.AccountStatus.Active:
-                break;
-            case suite_core_lib_1.AccountStatus.AdminLock:
-                throw new suite_core_lib_1.AccountLockedError();
-            case suite_core_lib_1.AccountStatus.PendingEmailVerification:
-                throw new suite_core_lib_1.PendingEmailVerificationError();
-            default:
-                throw new suite_core_lib_1.AccountStatusError(userDoc.accountStatus);
-        }
-        const challengeResponse = await this.challengeUserWithMnemonic(userDoc, mnemonic, session);
-        return { ...challengeResponse, userDoc };
-    }
-    /**
-     * Authenticate a user with their password (for key-wrapped accounts).
-     * @returns The authenticated user document.
-     */
-    async loginWithPassword(usernameOrEmail, password, session) {
-        const UserModel = this.application.getModel(base_model_name_1.BaseModelName.User);
-        const query = validator_1.default.isEmail(usernameOrEmail)
-            ? UserModel.findOne({ email: usernameOrEmail.toLowerCase() })
-            : UserModel.findOne({ username: usernameOrEmail }).collation({
-                locale: 'en',
-                strength: 2,
-            });
-        const userDoc = await query
-            .session(session ?? null)
-            .exec();
-        if (!userDoc || userDoc.deletedAt) {
-            throw new suite_core_lib_1.InvalidCredentialsError();
-        }
-        // Check account status
-        switch (userDoc.accountStatus) {
-            case suite_core_lib_1.AccountStatus.Active:
-                break;
-            case suite_core_lib_1.AccountStatus.AdminLock:
-                throw new suite_core_lib_1.AccountLockedError();
-            case suite_core_lib_1.AccountStatus.PendingEmailVerification:
-                throw new suite_core_lib_1.PendingEmailVerificationError();
-            default:
-                throw new suite_core_lib_1.AccountStatusError(userDoc.accountStatus);
-        }
-        // Check if user has password-based authentication set up (Option B requires passwordWrappedPrivateKey)
-        if (!userDoc.passwordWrappedPrivateKey || !userDoc.mnemonicId) {
-            throw new suite_core_lib_1.InvalidCredentialsError();
-        }
-        // Unwrap password-wrapped private key and complete challenge with possession of private key
-        const unwrapped = await this.keyWrappingService.unwrapSecretAsync(userDoc.passwordWrappedPrivateKey, password);
-        // Build user member with unwrapped private key to decrypt challenge
-        // Note: userMember now owns the unwrapped SecureBuffer, so we don't dispose it here
-        const userMember = await this.makeUserFromUserDoc(userDoc, unwrapped, undefined, undefined, undefined, session);
-        // Generate a nonce challenge signed by system
-        const adminMember = system_user_1.SystemUserService.getSystemUser(this.application.environment);
-        const nonce = (0, crypto_1.randomBytes)(32);
-        const signature = adminMember.sign(nonce);
-        const payload = Buffer.concat([nonce, signature]);
-        const encryptedPayload = userMember.encryptData(payload);
-        const decryptedPayload = userMember.decryptData(encryptedPayload);
-        const decryptedNonce = decryptedPayload.subarray(0, 32);
-        const decryptedSignature = decryptedPayload.subarray(32);
-        const isSignatureValid = adminMember.verify(decryptedSignature, decryptedNonce);
-        if (!isSignatureValid || !nonce.equals(decryptedNonce)) {
-            throw new suite_core_lib_1.InvalidCredentialsError();
-        }
-        return { userDoc, userMember, adminMember: adminMember };
-    }
-    /**
-     * Re-send a previously sent email token
-     * @param userId The user id
-     * @param session The session to use for the query
-     * @returns void
-     * @throws EmailTokenUsedOrInvalidError
-     */
-    async resendEmailToken(userId, type, session, debug = false) {
-        const EmailTokenModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.EmailToken);
-        return await this.withTransaction(async (sess) => {
-            // look up the most recent email token for a given user, then send it
-            const emailToken = await EmailTokenModel.findOne({
-                userId,
-                type,
-                expiresAt: { $gt: new Date() },
-            })
-                .session(sess ?? null)
-                .sort({ createdAt: -1 })
-                .limit(1);
-            if (!emailToken) {
-                throw new suite_core_lib_1.EmailTokenUsedOrInvalidError();
-            }
-            await this.sendEmailToken(emailToken, sess, debug);
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
-        });
-    }
-    /**
-     * Verify the email token and update the user's account status
-     * @param emailToken The email token to verify
-     * @param session The session to use for the query
-     * @returns void
-     * @throws EmailTokenUsedOrInvalidError
-     * @throws EmailTokenExpiredError
-     * @throws EmailVerifiedError
-     * @throws UserNotFoundError
-     */
-    async verifyAccountTokenAndComplete(emailToken, session) {
-        let alreadyVerified = false;
-        await this.withTransaction(async (sess) => {
-            const EmailTokenModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.EmailToken);
-            const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-            const token = await this.findEmailToken(emailToken, suite_core_lib_1.EmailTokenType.AccountVerification, sess);
-            if (!token) {
-                throw new suite_core_lib_1.EmailTokenUsedOrInvalidError();
-            }
-            if (token.expiresAt < new Date()) {
-                await EmailTokenModel.deleteOne({ _id: token._id }).session(sess ?? null);
-                throw new suite_core_lib_1.EmailTokenExpiredError();
-            }
-            const user = await UserModel.findById(token.userId).session(sess ?? null);
-            if (!user || user.deletedAt) {
-                throw new suite_core_lib_1.UserNotFoundError();
-            }
-            if (user.emailVerified) {
-                // Delete the token and mark to throw error after transaction commits
-                await EmailTokenModel.deleteOne({ _id: token._id }).session(sess ?? null);
-                alreadyVerified = true;
-                return;
-            }
-            // set user email to token email and mark as verified
-            user.email = token.email;
-            user.emailVerified = true;
-            user.accountStatus = suite_core_lib_1.AccountStatus.Active;
-            user.updatedBy = user._id;
-            await user.save({ session: sess });
-            // Delete the token after successful verification
-            await EmailTokenModel.deleteOne({ _id: token._id }).session(sess ?? null);
-            // add the user to the member role
-            const memberRoleId = await this.roleService.getRoleIdByName(this.application.constants.MemberRole, sess);
-            if (memberRoleId) {
-                await this.roleService.addUserToRole(memberRoleId, user._id, user._id, sess);
-            }
-            else {
-                throw new Error('Member role not found');
-            }
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
-        });
-        if (alreadyVerified) {
-            throw new suite_core_lib_1.EmailVerifiedError(409);
-        }
-    }
-    /**
-     * Validate the email token
-     * @param token The token to validate
-     * @param restrictType The type of email token to validate (or throw)
-     * @param session The session to use for the query
-     * @returns void
-     * @throws EmailTokenUsedOrInvalidError
-     */
-    async validateEmailToken(token, restrictType, session) {
-        return await this.withTransaction(async (ses) => {
-            const EmailTokenModel = this.application.getModel(base_model_name_1.BaseModelName.EmailToken);
-            const emailToken = await EmailTokenModel.findOne({
-                token,
-                ...(restrictType ? { type: suite_core_lib_1.EmailTokenType.PasswordReset } : {}),
-            }).session(ses ?? null);
-            if (!emailToken) {
-                throw new suite_core_lib_1.EmailTokenUsedOrInvalidError();
-            }
-            else if (emailToken.expiresAt < new Date()) {
-                await EmailTokenModel.deleteOne({ _id: emailToken._id }).session(ses ?? null);
-                throw new suite_core_lib_1.EmailTokenExpiredError();
-            }
-            // nothing else to do here, token is valid
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
-        });
-    }
-    /**
-     * Updates the user's language
-     * @param userId - The ID of the user
-     * @param newLanguage - The new language
-     * @param session - The session to use for the query
-     * @returns The updated user
-     */
-    async updateSiteLanguage(userId, newLanguage, session) {
-        return await this.withTransaction(async (sess) => {
-            const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-            const userDoc = await UserModel.findByIdAndUpdate(new mongoose_1.Types.ObjectId(userId), {
-                siteLanguage: newLanguage,
-            }, { new: true }).session(sess ?? null);
-            if (!userDoc) {
-                throw new suite_core_lib_1.UserNotFoundError();
-            }
-            const roles = await this.roleService.getUserRoles(userDoc._id);
-            const tokenRoles = this.roleService.rolesToTokenRoles(roles);
-            return request_user_1.RequestUserService.makeRequestUserDTO(userDoc, tokenRoles);
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
-        });
-    }
-    /**
-     * Changes the user's password by re-wrapping their master key
-     * @param userId - The ID of the user
-     * @param currentPassword - The current password
-     * @param newPassword - The new password
-     * @param session - The session to use for the query
-     * @returns void
-     */
-    async changePassword(userId, currentPassword, newPassword, session) {
-        return await this.withTransaction(async (sess) => {
-            const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-            const userDoc = await UserModel.findById(userId).session(sess ?? null);
-            if (!userDoc || !userDoc.passwordWrappedPrivateKey) {
-                throw new suite_core_lib_1.UserNotFoundError();
-            }
-            if (!ecies_lib_1.Constants.PasswordRegex.test(newPassword)) {
-                throw new errors_1.InvalidNewPasswordError();
-            }
-            const currentPasswordSecure = new ecies_lib_1.SecureString(currentPassword);
-            const newPasswordSecure = new ecies_lib_1.SecureString(newPassword);
-            try {
-                // Unwrap existing private key and rewrap under new password
-                const priv = this.keyWrappingService.unwrapSecret(userDoc.passwordWrappedPrivateKey, currentPasswordSecure);
-                try {
-                    const wrapped = this.keyWrappingService.wrapSecret(priv, newPasswordSecure);
-                    userDoc.passwordWrappedPrivateKey = wrapped;
-                    await userDoc.save({ session: sess });
-                }
-                finally {
-                    priv.dispose();
-                }
-            }
-            catch (error) {
-                // Re-throw original error so controller can map it properly
-                // Re-throw original error so controller can map it properly
-                throw error;
-            }
-            finally {
-                currentPasswordSecure.dispose();
-                newPasswordSecure.dispose();
-            }
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
-        });
-    }
-    /**
-     * Retrieve an email token by its token string and type
-     * @param token - The token string
-     * @param type - The type of the email token
-     * @param session - The session to use for the query
-     * @returns The email token document or null if not found
-     */
-    async findEmailToken(token, type, session) {
-        const EmailTokenModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.EmailToken);
-        return await EmailTokenModel.findOne({
-            token: token.toLowerCase().trim(),
-            ...(type ? { type } : {}),
-            expiresAt: { $gt: new Date() },
-        }).session(session ?? null);
-    }
-    /**
-     * Verify email token is valid
-     * @param token - The email token
-     * @param session - The session to use for the query
-     * @returns void
-     */
-    async verifyEmailToken(token, type, session) {
-        return await this.withTransaction(async (sess) => {
-            // Find and validate the token
-            const emailToken = await this.findEmailToken(token, type, sess);
-            if (!emailToken) {
-                throw new suite_core_lib_1.EmailTokenUsedOrInvalidError();
-            }
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
-        });
-    }
-    /**
-     * Reset password using email token
-     * @param token - The email token
-     * @param newPassword - The new password
-     * @param session - The session to use for the query
-     * @returns void
-     */
-    async resetPasswordWithToken(token, newPassword, credential, // either mnemonic or current password; required
-    session) {
-        if (!ecies_lib_1.Constants.PasswordRegex.test(newPassword)) {
-            throw new errors_1.InvalidNewPasswordError();
-        }
-        if (!credential) {
-            throw new suite_core_lib_1.EmailTokenUsedOrInvalidError();
-        }
-        return await this.withTransaction(async (sess) => {
-            const EmailTokenModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.EmailToken);
-            const UserModel = model_registry_1.ModelRegistry.instance.getTypedModel(base_model_name_1.BaseModelName.User);
-            // Find and validate the token
-            const emailToken = await this.findEmailToken(token, suite_core_lib_1.EmailTokenType.PasswordReset, sess);
-            if (!emailToken) {
-                throw new suite_core_lib_1.EmailTokenUsedOrInvalidError();
-            }
-            // Find the user
-            const userDoc = await UserModel.findById(emailToken.userId).session(sess ?? null);
-            if (!userDoc) {
-                throw new suite_core_lib_1.UserNotFoundError();
-            }
-            // Update password-wrapped secrets based on credential type (Option B)
-            const newPasswordSecure = new ecies_lib_1.SecureString(newPassword);
-            try {
-                if (ecies_lib_1.Constants.MnemonicRegex.test(credential)) {
-                    // Credential is mnemonic: verify it belongs to this user via public key
-                    const providedMnemonic = new ecies_lib_1.SecureString(credential);
-                    try {
-                        const { wallet } = this.eciesService.walletAndSeedFromMnemonic(providedMnemonic);
-                        const pub = Buffer.concat([
-                            Buffer.from([
-                                this.application.constants.ECIES.PUBLIC_KEY_MAGIC,
-                            ]),
-                            wallet.getPublicKey(),
-                        ]);
-                        if (pub.toString('hex') !== userDoc.publicKey) {
-                            throw new suite_core_lib_1.InvalidCredentialsError();
-                        }
-                        // Derive private key from mnemonic and wrap it with new password
-                        const privateKey = wallet.getPrivateKey();
-                        const priv = new ecies_lib_1.SecureBuffer(privateKey);
-                        try {
-                            const wrappedPriv = this.keyWrappingService.wrapSecret(priv, newPasswordSecure);
-                            userDoc.passwordWrappedPrivateKey = wrappedPriv;
-                            await userDoc.save({ session: sess });
-                        }
-                        finally {
-                            priv.dispose();
-                        }
-                    }
-                    finally {
-                        providedMnemonic.dispose();
-                    }
-                }
-                else {
-                    // Credential is current password: unwrap existing master key
-                    if (!userDoc.passwordWrappedPrivateKey) {
-                        throw new suite_core_lib_1.InvalidCredentialsError();
-                    }
-                    const privateKeyBuf = await this.keyWrappingService.unwrapSecretAsync(userDoc.passwordWrappedPrivateKey, credential);
-                    try {
-                        // Re-wrap the existing private key under the new password
-                        const wrappedPriv = this.keyWrappingService.wrapSecret(privateKeyBuf, newPasswordSecure);
-                        userDoc.passwordWrappedPrivateKey = wrappedPriv;
-                        await userDoc.save({ session: sess });
-                    }
-                    finally {
-                        privateKeyBuf.dispose();
-                    }
-                }
-                // Delete the used token
-                await EmailTokenModel.deleteOne({ _id: emailToken._id }).session(sess ?? null);
-                // Dispose temporary master key
-            }
-            finally {
-                newPasswordSecure.dispose();
-            }
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
-        });
-    }
-    /**
-     * Generate a login challenge for the client to sign
-     * @returns The login challenge in hex
-     */
-    generateDirectLoginChallenge() {
-        const adminMember = system_user_1.SystemUserService.getSystemUser(this.application.environment);
-        const time = Buffer.alloc(8);
-        time.writeBigUInt64BE(BigInt(new Date().getTime()));
-        const nonce = (0, crypto_1.randomBytes)(32);
-        const signature = adminMember.sign(Buffer.concat([time, nonce]));
-        return Buffer.concat([time, nonce, signature]).toString('hex');
-    }
-    /**
-     * Verifies a direct login challenge response
-     * @param serverSignedRequest The login challenge response in hex
-     * @param session The mongoose session, if provided
-     * @returns A promise with the user document and user member object
-     */
-    async verifyDirectLoginChallenge(serverSignedRequest, signature, username, email, session) {
-        return await this.withTransaction(async (sess) => {
-            // serverSignedRequest is:
-            // time (8) +
-            // nonce (32) +
-            // server signature (64) +
-            // signature (64)
-            if (serverSignedRequest.length <
-                (8 + 32 + this.application.constants.ECIES.SIGNATURE_SIZE) * 2) {
-                throw new suite_core_lib_1.InvalidChallengeResponseError();
-            }
-            // get signed request into a buffer
-            const requestBuffer = Buffer.from(serverSignedRequest, 'hex');
-            // start tracking offset
-            let offset = 0;
-            // get the time
-            const time = requestBuffer.subarray(offset, 8);
-            offset += 8;
-            // get the nonce
-            const nonce = requestBuffer.subarray(offset, 40);
-            offset += 32;
-            // get the server signature
-            const serverSignature = requestBuffer.subarray(offset, this.application.constants.ECIES.SIGNATURE_SIZE + 40);
-            offset += this.application.constants.ECIES.SIGNATURE_SIZE;
-            const signedDataLength = offset;
-            if (offset !== requestBuffer.length) {
-                throw new suite_core_lib_1.InvalidChallengeResponseError();
-            }
-            // validate time is within acceptable range
-            const timeMs = time.readBigUInt64BE();
-            if (new Date().getTime() - Number(timeMs) >
-                this.application.constants.LoginChallengeExpiration) {
-                throw new suite_core_lib_1.LoginChallengeExpiredError();
-            }
-            // validate the server's signature on the time + nonce portion
-            const adminMember = system_user_1.SystemUserService.getSystemUser(this.application.environment);
-            if (!adminMember.verify(serverSignature, Buffer.concat([time, nonce]))) {
-                throw new suite_core_lib_1.InvalidChallengeResponseError();
-            }
-            // locate the user by email or username
-            const userDoc = await this.findUser(email, username, sess);
-            if (!userDoc) {
-                throw new suite_core_lib_1.InvalidChallengeResponseError();
-            }
-            // get the user's member object
-            const user = await this.makeUserFromUserDoc(userDoc, undefined, undefined, undefined, undefined, sess);
-            // get the signed portion of the response
-            const signedData = requestBuffer.subarray(0, signedDataLength);
-            // verify the user's signature on the signed portion
-            if (!user.verify(Buffer.from(signature, 'hex'), signedData)) {
-                throw new suite_core_lib_1.InvalidChallengeResponseError();
-            }
-            if (userDoc.directChallenge !== true) {
-                throw new suite_core_lib_1.InvalidChallengeResponseError();
-            }
-            // if the user is valid, try to use the token (prevents replay attacks)
-            await direct_login_token_1.DirectLoginTokenService.useToken(this.application, userDoc._id, nonce.toString('hex'));
-            // if successful, update lastLogin
-            await this.updateLastLogin(userDoc._id);
-            // return the user document and member object
-            return { userDoc, userMember: user };
-        }, session, { timeoutMs: this.application.environment.mongo.transactionTimeout });
-    }
-    /**
-     * Request a login link via email
-     * @param email Email address
-     * @param username Username
-     * @param session Existing session, if any
-     * @returns void
-     */
-    async requestEmailLogin(email, username, session) {
-        return this.withTransaction(async (sess) => {
-            const userDoc = await this.findUser(email, username, sess);
-            if (!userDoc) {
-                return;
-            }
-            await this.createAndSendEmailToken(userDoc, suite_core_lib_1.EmailTokenType.LoginRequest, sess, this.application.environment.debug);
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout,
-        });
-    }
-    /**
-     * Validate an email login token challenge
-     * @param token The token to challenge
-     * @param signature The signature of the token by the user's private key
-     * @param session The session to use for the query
-     * @returns The user document if the challenge is valid
-     */
-    async validateEmailLoginTokenChallenge(token, signature, session) {
-        return this.withTransaction(async (sess) => {
-            const emailToken = await this.findEmailToken(token, suite_core_lib_1.EmailTokenType.LoginRequest, sess);
-            if (!emailToken) {
-                throw new suite_core_lib_1.EmailTokenUsedOrInvalidError();
-            }
-            const userDoc = await this.findUser(emailToken.email, undefined, sess);
-            if (!userDoc) {
-                throw new suite_core_lib_1.UserNotFoundError();
-            }
-            const user = await this.makeUserFromUserDoc(userDoc, undefined, undefined, undefined, undefined, sess);
-            const result = user.verify(Buffer.from(signature, 'hex'), Buffer.from(token, 'hex'));
-            if (!result) {
-                throw new suite_core_lib_1.InvalidChallengeResponseError();
-            }
-            await emailToken.deleteOne({ session: sess ?? null });
-            await this.updateLastLogin(userDoc._id);
-            return userDoc;
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout,
-        });
-    }
-    /**
-     * Updates the user's last login time atomically
-     * @param userId - The ID of the user
-     * @returns void
-     */
-    async updateLastLogin(userId) {
-        const UserModel = model_registry_1.ModelRegistry.instance.get('User')?.model;
-        try {
-            // Check if the database connection is still open
-            const connection = this.application.db.connection;
-            if (connection.readyState !== 1) {
-                // Connection is not open (0 = disconnected, 1 = connected, 2 = connecting, 3 = disconnecting)
-                return; // Silently return if connection is not available
-            }
-            // Use atomic update to avoid conflicts and ensure we only update lastLogin
-            // Use a separate session to avoid interfering with any ongoing transactions
-            await UserModel.updateOne({ _id: userId }, {
-                $set: { lastLogin: new Date() },
-                $setOnInsert: {}, // Prevent any unintended document creation
-            }, {
-                upsert: false, // Never create a new document
-                runValidators: false, // Skip validation for performance since we're only updating lastLogin
-                // Don't use any session to avoid transaction conflicts
-            });
-        }
-        catch (error) {
-            // Check if the error is due to client being closed
-            if (error instanceof Error &&
-                (error.message.includes('client was closed') ||
-                    error.message.includes('MongoClientClosedError') ||
-                    error.name === 'MongoClientClosedError')) {
-                // This is expected during shutdown, don't log it as an error
-                return;
-            }
-            // If this fails, it's not critical for login functionality. Ignore and move on.
-        }
-    }
-}
-exports.UserService = UserService;
-//# sourceMappingURL=user.js.map