@digitaldefiance/node-express-suite 3.6.21 → 3.6.22

package/src/schemas/user.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserSchema = void 0;
+exports.createUserSchema = createUserSchema;
+const tslib_1 = require("tslib");
+const i18n_lib_1 = require("@digitaldefiance/i18n-lib");
+const mongoose_types_1 = require("@digitaldefiance/mongoose-types");
+const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
+const currency_codes_1 = require("currency-codes");
+const validator_1 = tslib_1.__importDefault(require("validator"));
+const constants_1 = require("../constants");
+const enumerations_1 = require("../enumerations");
+function createUserSchema(usernameValidationMessage, emailValidationMessage, timezoneValidationMessage, currencyValidationMessage, supportedLanguages, idType = mongoose_types_1.Schema.Types.ObjectId, constants = constants_1.LocalhostConstants) {
+    const definition = {
+        /**
+         * The unique identifier for the user
+         */
+        username: {
+            type: String,
+            required: true,
+            unique: true,
+            validate: {
+                validator: (v) => constants.UsernameRegex.test(v),
+                message: usernameValidationMessage ||
+                    (() => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_UsernameRegexErrorTemplate)),
+            },
+        },
+        /**
+         * The email address for the user
+         */
+        email: {
+            type: String,
+            required: true,
+            unique: true,
+            validate: {
+                validator: (v) => validator_1.default.isEmail(v),
+                message: emailValidationMessage ||
+                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Error_InvalidEmailTemplate, { email: props.value })),
+            },
+        },
+        /**
+         * The user's public key, stored in hex format.
+         */
+        publicKey: {
+            type: String,
+            required: true,
+            unique: true,
+        },
+        /**
+         * The timezone for the user
+         */
+        timezone: {
+            type: String,
+            required: true,
+            default: 'UTC',
+            validate: {
+                validator: function (v) {
+                    return (0, i18n_lib_1.isValidTimezone)(v);
+                },
+                message: timezoneValidationMessage ||
+                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_NotValidTimeZoneTemplate, { timezone: props.value })),
+            },
+        },
+        currency: {
+            type: String,
+            required: true,
+            default: 'USD',
+            validate: {
+                validator: function (v) {
+                    return (0, currency_codes_1.codes)().includes(v);
+                },
+                message: currencyValidationMessage ||
+                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_NotValidCurrencyTemplate, { currency: props.value })),
+            },
+        },
+        /**
+         * The language of the site for the user
+         */
+        siteLanguage: {
+            type: String,
+            enum: supportedLanguages || Object.values(i18n_lib_1.LanguageCodes),
+            default: i18n_lib_1.LanguageCodes.EN_US,
+            required: true,
+        },
+        /**
+         * Whether the user prefers dark mode
+         */
+        darkMode: {
+            type: Boolean,
+            default: false,
+            required: true,
+        },
+        /**
+         * Whether to enable direct challenge login for the user
+         */
+        directChallenge: {
+            type: Boolean,
+            default: true,
+            required: true,
+        },
+        /**
+         * The date the user last logged in
+         */
+        lastLogin: { type: Date, required: false },
+        /**
+         * Whether the user has verified their email address
+         */
+        emailVerified: { type: Boolean, default: false },
+        /**
+         * The status of the user's account
+         */
+        accountStatus: {
+            type: String,
+            enum: Object.values(suite_core_lib_1.AccountStatus),
+            default: suite_core_lib_1.AccountStatus.PendingEmailVerification,
+        },
+        /**
+         * The user who created the user.
+         */
+        createdBy: {
+            type: idType,
+            ref: enumerations_1.BaseModelName.User,
+            required: true,
+            immutable: true,
+        },
+        /**
+         * The user who last updated the user.
+         */
+        updatedBy: {
+            type: idType,
+            ref: enumerations_1.BaseModelName.User,
+            optional: true,
+        },
+        /**
+         * The date/time the user was deleted.
+         */
+        deletedAt: { type: Date, optional: true },
+        /**
+         * The user who deleted the user.
+         */
+        deletedBy: {
+            type: idType,
+            ref: enumerations_1.BaseModelName.User,
+            optional: true,
+        },
+        /**
+         * Reference to the mnemonic document
+         */
+        mnemonicId: {
+            type: idType,
+            ref: enumerations_1.BaseModelName.Mnemonic,
+            required: false,
+        },
+        /**
+         * Copy of the mnemonic encrypted with the user's public key
+         */
+        mnemonicRecovery: {
+            type: String,
+            required: false,
+        },
+        /**
+         * Password-wrapped ECIES private key (Option B)
+         */
+        passwordWrappedPrivateKey: {
+            type: {
+                salt: { type: String, required: true },
+                iv: { type: String, required: true },
+                authTag: { type: String, required: true },
+                ciphertext: { type: String, required: true },
+                iterations: { type: Number, required: true },
+            },
+            required: false,
+        },
+        /**
+         * Array of backup codes to recover mnemonic/private key
+         */
+        backupCodes: {
+            type: [
+                {
+                    version: { type: String, required: true },
+                    checksumSalt: { type: String, required: true },
+                    checksum: { type: String, required: true },
+                    encrypted: { type: String, required: true },
+                },
+            ],
+            default: [],
+        },
+    };
+    return new mongoose_types_1.Schema(definition, { timestamps: true });
+}
+/**
+ * Default user schema with base configuration
+ */
+exports.UserSchema = createUserSchema();
+//# sourceMappingURL=user.js.map

package/src/schemas/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/schemas/user.ts"],"names":[],"mappings":";;;AAaA,4CA6MC;;AA1ND,wDAA2E;AAC3E,oEAAyD;AACzD,oEAIyC;AACzC,mDAAuC;AACvC,kEAAkC;AAClC,4CAAkE;AAClE,kDAAgD;AAGhD,SAAgB,gBAAgB,CAC9B,yBAAwC,EACxC,sBAAqC,EACrC,yBAAwC,EACxC,yBAAwC,EACxC,kBAAsC,EACtC,SAAc,uBAAM,CAAC,KAAK,CAAC,QAAQ,EACnC,YAAe,8BAAiB;IAEhC,MAAM,UAAU,GAAG;QACjB;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE;gBACR,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,OAAO,EACL,yBAAyB;oBACzB,CAAC,GAAG,EAAE,CACJ,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,qCAAqC,CACzD,CAAC;aACP;SACF;QACD;;WAEG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE;gBACR,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,mBAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9C,OAAO,EACL,sBAAsB;oBACtB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,0BAA0B,EAC7C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;aACP;SACF;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;SACb;QACD;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE;gBACR,SAAS,EAAE,UAAU,CAAS;oBAC5B,OAAO,IAAA,0BAAe,EAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;gBACD,OAAO,EACL,yBAAyB;oBACzB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,+BAA+B,EAClD,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,CAC1B,CAAC;aACP;SACF;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE;gBACR,SAAS,EAAE,UAAU,CAAS;oBAC5B,OAAO,IAAA,sBAAK,GAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBACD,OAAO,EACL,yBAAyB;oBACzB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,+BAA+B,EAClD,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,CAC1B,CAAC;aACP;SACF;QACD;;WAEG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,kBAAkB,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAa,CAAC;YACxD,OAAO,EAAE,wBAAa,CAAC,KAAK;YAC5B,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1C;;WAEG;QACH,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAChD;;WAEG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,8BAAa,CAAC;YAClC,OAAO,EAAE,8BAAa,CAAC,wBAAwB;SAChD;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;SAChB;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,QAAQ;YAC3B,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE;gBACJ,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACtC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC7C;YACD,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,WAAW,EAAE;YACX,IAAI,EAAE;gBACJ;oBACE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACzC,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC1C,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC5C;aACF;YACD,OAAO,EAAE,EAAE;SACZ;KACF,CAAC;IAEF,OAAO,IAAI,uBAAM,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACU,QAAA,UAAU,GAAG,gBAAgB,EAAE,CAAC"}

package/src/services/backup-code.d.ts

@@ -0,0 +1,76 @@
+import { SecureString } from '@digitaldefiance/ecies-lib';
+import { ClientSession, Types } from '@digitaldefiance/mongoose-types';
+import { Member as BackendMember, ECIESService } from '@digitaldefiance/node-ecies-lib';
+import { IBackupCode, ITokenRole } from '@digitaldefiance/suite-core-lib';
+import { IUserDocument } from '../documents';
+import { IApplication } from '../interfaces/application';
+import { BaseService } from './base';
+import { KeyWrappingService } from './index';
+import { RoleService } from './role';
+/**
+ * Service handling generation, storage, validation, consumption, and recovery using backup codes.
+ *
+ * v1 scheme:
+ * - Code: 32 lowercase alphanumerics (a–z0–9), displayed as 8 groups of 4: xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx
+ * - Checksum/tag: HKDF-SHA256(codeUtf8, salt, "backup-checksum") → 32 bytes (stored as hex)
+ * - KDF for encryption key: Argon2id(codeUtf8, salt) → 32 bytes
+ * - Encryption: SymmetricService AEAD (encryptedData must embed IV + authTag + ciphertext)
+ * - Wrapping: AEAD blob wrapped with system user's asymmetric key (ECIES)
+ */
+export declare class BackupCodeService<I extends string | Types.ObjectId = Types.ObjectId, D extends Date = Date, TTokenRole extends ITokenRole<I, D> = ITokenRole<I, D>, TApplication extends IApplication = IApplication> extends BaseService {
+    private readonly eciesService;
+    private systemUser?;
+    private readonly keyWrappingService;
+    private readonly roleService;
+    /**
+     * Construct a BackupCodeService.
+     */
+    constructor(application: TApplication, eciesService: ECIESService, keyWrappingService: KeyWrappingService, roleService: RoleService<I, D, TTokenRole>);
+    /**
+     * Get the lazily-initialized system user for key wrapping/unwrapping.
+     */
+    private getSystemUser;
+    /**
+     * Forcibly set the system user (for database initialization)
+     * @param user
+     */
+    setSystemUser(user: BackendMember<I>): void;
+    /**
+     * v1: Consume (validate and remove) a backup code via constant-time checksum match.
+     */
+    useBackupCodeV1(encryptedBackupCodes: Array<IBackupCode>, backupCode: string): {
+        newCodesArray: Array<IBackupCode>;
+        code: IBackupCode;
+    };
+    /**
+     * Consume a backup code by first detecting the version and then dispatching to the appropriate handler.
+     */
+    useBackupCode(encryptedBackupCodes: Array<IBackupCode>, backupCode: string): {
+        newCodesArray: Array<IBackupCode>;
+        code: IBackupCode;
+    };
+    /**
+     * v1: Recover a user's private key using a backup code.
+     */
+    recoverKeyWithBackupCodeV1(userDoc: IUserDocument<string, I>, backupCode: string, newPassword?: SecureString, session?: ClientSession): Promise<{
+        userDoc: IUserDocument<string, I>;
+        user: BackendMember<I>;
+        codeCount: number;
+    }>;
+    /**
+     * Recover a user's private key using a backup code (version-dispatched).
+     */
+    recoverKeyWithBackupCode(userDoc: IUserDocument<string, I>, backupCode: string, newPassword?: SecureString, session?: ClientSession): Promise<{
+        userDoc: IUserDocument<string, I>;
+        user: BackendMember<I>;
+        codeCount: number;
+    }>;
+    /**
+     * Rewrap system-wrapped AEAD blobs from old system key to new one without touching inner AEAD.
+     */
+    rewrapAllUsersBackupCodes(fetchBatch: (afterId?: string, limit?: number) => Promise<IUserDocument<string, I>[]>, saveUser: (user: IUserDocument<string, I>) => Promise<void>, oldSystem: BackendMember, newSystem: BackendMember, options?: {
+        batchSize?: number;
+        onProgress?: (count: number) => void;
+    }): Promise<number>;
+}
+//# sourceMappingURL=backup-code.d.ts.map

package/src/services/backup-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-code.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/services/backup-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,YAAY,EACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,MAAM,IAAI,aAAa,EACvB,YAAY,EACb,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,WAAW,EAEX,UAAU,EACX,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAIrC;;;;;;;;;GASG;AACH,qBAAa,iBAAiB,CAC5B,CAAC,SAAS,MAAM,GAAG,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAClD,CAAC,SAAS,IAAI,GAAG,IAAI,EACrB,UAAU,SAAS,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,EACtD,YAAY,SAAS,YAAY,GAAG,YAAY,CAChD,SAAQ,WAAW;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,UAAU,CAAC,CAAmB;IACtC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAE5D;;OAEG;gBAED,WAAW,EAAE,YAAY,EACzB,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC;IAQ5C;;OAEG;IACH,OAAO,CAAC,aAAa;IAYrB;;;OAGG;IACI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI;IAIlD;;OAEG;IACI,eAAe,CACpB,oBAAoB,EAAE,KAAK,CAAC,WAAW,CAAC,EACxC,UAAU,EAAE,MAAM,GACjB;QAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE;IAmC3D;;OAEG;IACI,aAAa,CAClB,oBAAoB,EAAE,KAAK,CAAC,WAAW,CAAC,EACxC,UAAU,EAAE,MAAM,GACjB;QAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE;IAkB3D;;OAEG;IACU,0BAA0B,CACrC,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,EACjC,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC;QACT,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IA0EF;;OAEG;IACU,wBAAwB,CACnC,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,EACjC,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC;QACT,OAAO,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAkBF;;OAEG;IACU,yBAAyB,CACpC,UAAU,EAAE,CACV,OAAO,CAAC,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EACxC,QAAQ,EAAE,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,EAC3D,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,aAAa,EACxB,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,GACrE,OAAO,CAAC,MAAM,CAAC;CAwCnB"}

package/src/services/backup-code.js

@@ -0,0 +1,185 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BackupCodeService = void 0;
+const ecies_lib_1 = require("@digitaldefiance/ecies-lib");
+const node_ecies_lib_1 = require("@digitaldefiance/node-ecies-lib");
+const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
+const crypto_1 = require("crypto");
+const backup_code_1 = require("../backup-code");
+const constants_1 = require("../constants");
+const invalid_backup_code_version_1 = require("../errors/invalid-backup-code-version");
+const base_1 = require("./base");
+const symmetric_1 = require("./symmetric");
+const system_user_1 = require("./system-user");
+/**
+ * Service handling generation, storage, validation, consumption, and recovery using backup codes.
+ *
+ * v1 scheme:
+ * - Code: 32 lowercase alphanumerics (a–z0–9), displayed as 8 groups of 4: xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx-xxxx
+ * - Checksum/tag: HKDF-SHA256(codeUtf8, salt, "backup-checksum") → 32 bytes (stored as hex)
+ * - KDF for encryption key: Argon2id(codeUtf8, salt) → 32 bytes
+ * - Encryption: SymmetricService AEAD (encryptedData must embed IV + authTag + ciphertext)
+ * - Wrapping: AEAD blob wrapped with system user's asymmetric key (ECIES)
+ */
+class BackupCodeService extends base_1.BaseService {
+    eciesService;
+    systemUser;
+    keyWrappingService;
+    roleService;
+    /**
+     * Construct a BackupCodeService.
+     */
+    constructor(application, eciesService, keyWrappingService, roleService) {
+        super(application);
+        this.eciesService = eciesService;
+        this.keyWrappingService = keyWrappingService;
+        this.roleService = roleService;
+    }
+    /**
+     * Get the lazily-initialized system user for key wrapping/unwrapping.
+     */
+    getSystemUser() {
+        if (!this.systemUser) {
+            // System user is always created with Buffer IDs, but we need to cast to the generic type I
+            // This is safe because the system user's ID type is compatible with all ID types
+            this.systemUser = system_user_1.SystemUserService.getSystemUser(this.application.environment, this.application.constants);
+        }
+        return this.systemUser;
+    }
+    /**
+     * Forcibly set the system user (for database initialization)
+     * @param user
+     */
+    setSystemUser(user) {
+        this.systemUser = user;
+    }
+    /**
+     * v1: Consume (validate and remove) a backup code via constant-time checksum match.
+     */
+    useBackupCodeV1(encryptedBackupCodes, backupCode) {
+        const normalizedCode = backup_code_1.BackupCode.normalizeCode(backupCode);
+        if (!constants_1.LocalhostConstants.BACKUP_CODES.NormalizedHexRegex.test(normalizedCode)) {
+            throw new suite_core_lib_1.InvalidBackupCodeError();
+        }
+        const codeBytes = Buffer.from(normalizedCode, 'utf8');
+        try {
+            for (const code of encryptedBackupCodes) {
+                if (code.version !== backup_code_1.BackupCode.BackupCodeVersion)
+                    continue;
+                const checksumSalt = Buffer.from(code.checksumSalt, 'hex');
+                const expected = backup_code_1.BackupCode.hkdfSha256(codeBytes, checksumSalt, Buffer.from('backup-checksum'), 32);
+                if (code.checksum.length === expected.length * 2 &&
+                    (0, crypto_1.timingSafeEqual)(Buffer.from(code.checksum, 'hex'), expected)) {
+                    const checksumHex = expected.toString('hex');
+                    return {
+                        newCodesArray: encryptedBackupCodes.filter((c) => c.checksum !== checksumHex),
+                        code,
+                    };
+                }
+            }
+            throw new suite_core_lib_1.InvalidBackupCodeError();
+        }
+        finally {
+            codeBytes.fill(0);
+        }
+    }
+    /**
+     * Consume a backup code by first detecting the version and then dispatching to the appropriate handler.
+     */
+    useBackupCode(encryptedBackupCodes, backupCode) {
+        const version = backup_code_1.BackupCode.detectBackupCodeVersion(encryptedBackupCodes, backupCode);
+        switch (version) {
+            case backup_code_1.BackupCode.BackupCodeVersion:
+                return this.useBackupCodeV1(encryptedBackupCodes.filter((c) => c.version === backup_code_1.BackupCode.BackupCodeVersion), backupCode);
+            default:
+                throw new invalid_backup_code_version_1.InvalidBackupCodeVersionError(version);
+        }
+    }
+    /**
+     * v1: Recover a user's private key using a backup code.
+     */
+    async recoverKeyWithBackupCodeV1(userDoc, backupCode, newPassword, session) {
+        const normalizedCode = backup_code_1.BackupCode.normalizeCode(backupCode);
+        return await this.withTransaction(async (sess) => {
+            const { code, newCodesArray } = this.useBackupCodeV1(userDoc.backupCodes, normalizedCode);
+            userDoc.backupCodes = newCodesArray;
+            let decryptionKey;
+            try {
+                const adminMember = this.getSystemUser();
+                decryptionKey = await backup_code_1.BackupCode.getBackupKeyV1(code.checksumSalt, normalizedCode, this.application.constants);
+                const privateKeyUnwrapped = adminMember.decryptData(Buffer.from(code.encrypted, 'hex'));
+                const decryptedPrivateKey = new ecies_lib_1.SecureBuffer(symmetric_1.SymmetricService.decryptBuffer(privateKeyUnwrapped, decryptionKey));
+                const memberType = await this.roleService.getMemberType(userDoc, session);
+                const user = new node_ecies_lib_1.Member(this.eciesService, memberType, userDoc.username, new ecies_lib_1.EmailString(userDoc.email), Buffer.from(userDoc.publicKey, 'hex'), decryptedPrivateKey, undefined, userDoc._id, new Date(userDoc.createdAt), new Date(userDoc.updatedAt));
+                if (!newPassword) {
+                    await userDoc.save({ session: sess });
+                    return {
+                        userDoc,
+                        user,
+                        codeCount: newCodesArray.length,
+                    };
+                }
+                const wrapped = this.keyWrappingService.wrapSecret(decryptedPrivateKey, newPassword, this.application.constants);
+                userDoc.passwordWrappedPrivateKey = wrapped;
+                await userDoc.save({ session: sess });
+                return { userDoc, user, codeCount: newCodesArray.length };
+            }
+            finally {
+                if (decryptionKey)
+                    decryptionKey.fill(0);
+            }
+        }, session, {
+            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
+        });
+    }
+    /**
+     * Recover a user's private key using a backup code (version-dispatched).
+     */
+    async recoverKeyWithBackupCode(userDoc, backupCode, newPassword, session) {
+        const version = backup_code_1.BackupCode.detectBackupCodeVersion(userDoc.backupCodes, backupCode);
+        switch (version) {
+            case backup_code_1.BackupCode.BackupCodeVersion:
+                return this.recoverKeyWithBackupCodeV1(userDoc, backupCode, newPassword, session);
+            default:
+                throw new invalid_backup_code_version_1.InvalidBackupCodeVersionError(version);
+        }
+    }
+    /**
+     * Rewrap system-wrapped AEAD blobs from old system key to new one without touching inner AEAD.
+     */
+    async rewrapAllUsersBackupCodes(fetchBatch, saveUser, oldSystem, newSystem, options) {
+        const batchSize = options?.batchSize ?? 500;
+        let processed = 0;
+        let afterId;
+        for (;;) {
+            const users = await fetchBatch(afterId, batchSize);
+            if (!users.length)
+                break;
+            for (const user of users) {
+                let modified = false;
+                for (const bc of user.backupCodes ?? []) {
+                    try {
+                        const sealed = oldSystem.decryptData(Buffer.from(bc.encrypted, 'hex'));
+                        const rewrapped = newSystem.encryptData(sealed).toString('hex');
+                        if (rewrapped !== bc.encrypted) {
+                            bc.encrypted = rewrapped;
+                            modified = true;
+                        }
+                    }
+                    catch (e) {
+                        throw new Error(`Failed to rewrap backup code for user ${user._id}: ${e.message}`);
+                    }
+                }
+                if (modified) {
+                    await saveUser(user);
+                    processed++;
+                    options?.onProgress?.(processed);
+                }
+            }
+            afterId = users[users.length - 1]?._id?.toString() ?? undefined;
+        }
+        return processed;
+    }
+}
+exports.BackupCodeService = BackupCodeService;
+//# sourceMappingURL=backup-code.js.map

package/src/services/backup-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-code.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/services/backup-code.ts"],"names":[],"mappings":";;;AAAA,0DAKoC;AAEpC,oEAGyC;AACzC,oEAIyC;AACzC,mCAAyC;AACzC,gDAA4C;AAC5C,4CAAkE;AAElE,uFAAsF;AAEtF,iCAAqC;AAGrC,2CAA+C;AAC/C,+CAAkD;AAElD;;;;;;;;;GASG;AACH,MAAa,iBAKX,SAAQ,kBAAW;IACF,YAAY,CAAe;IACpC,UAAU,CAAoB;IACrB,kBAAkB,CAAqB;IACvC,WAAW,CAAgC;IAE5D;;OAEG;IACH,YACE,WAAyB,EACzB,YAA0B,EAC1B,kBAAsC,EACtC,WAA0C;QAE1C,KAAK,CAAC,WAAW,CAAC,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,2FAA2F;YAC3F,iFAAiF;YACjF,IAAI,CAAC,UAAU,GAAG,+BAAiB,CAAC,aAAa,CAC/C,IAAI,CAAC,WAAW,CAAC,WAAW,EAC5B,IAAI,CAAC,WAAW,CAAC,SAAS,CACI,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;OAGG;IACI,aAAa,CAAC,IAAsB;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IACzB,CAAC;IAED;;OAEG;IACI,eAAe,CACpB,oBAAwC,EACxC,UAAkB;QAElB,MAAM,cAAc,GAAG,wBAAU,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,8BAAY,CAAC,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,uCAAsB,EAAE,CAAC;QACrC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;gBACxC,IAAI,IAAI,CAAC,OAAO,KAAK,wBAAU,CAAC,iBAAiB;oBAAE,SAAS;gBAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;gBAC3D,MAAM,QAAQ,GAAG,wBAAU,CAAC,UAAU,CACpC,SAAS,EACT,YAAY,EACZ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAC9B,EAAE,CACH,CAAC;gBACF,IACE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAC5C,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,EAC5D,CAAC;oBACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;oBAC7C,OAAO;wBACL,aAAa,EAAE,oBAAoB,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAClC;wBACD,IAAI;qBACL,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,IAAI,uCAAsB,EAAE,CAAC;QACrC,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED;;OAEG;IACI,aAAa,CAClB,oBAAwC,EACxC,UAAkB;QAElB,MAAM,OAAO,GAAG,wBAAU,CAAC,uBAAuB,CAChD,oBAAoB,EACpB,UAAU,CACX,CAAC;QACF,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,wBAAU,CAAC,iBAAiB;gBAC/B,OAAO,IAAI,CAAC,eAAe,CACzB,oBAAoB,CAAC,MAAM,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,wBAAU,CAAC,iBAAiB,CAClD,EACD,UAAU,CACX,CAAC;YACJ;gBACE,MAAM,IAAI,2DAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,0BAA0B,CACrC,OAAiC,EACjC,UAAkB,EAClB,WAA0B,EAC1B,OAAuB;QAMvB,MAAM,cAAc,GAAG,wBAAU,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC5D,OAAO,MAAM,IAAI,CAAC,eAAe,CAK/B,KAAK,EAAE,IAA+B,EAAE,EAAE;YACxC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,eAAe,CAClD,OAAO,CAAC,WAAW,EACnB,cAAc,CACf,CAAC;YACF,OAAO,CAAC,WAAW,GAAG,aAAa,CAAC;YAEpC,IAAI,aAAiC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBACzC,aAAa,GAAG,MAAM,wBAAU,CAAC,cAAc,CAC7C,IAAI,CAAC,YAAY,EACjB,cAAc,EACd,IAAI,CAAC,WAAW,CAAC,SAAS,CAC3B,CAAC;gBACF,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CACjD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CACnC,CAAC;gBACF,MAAM,mBAAmB,GAAG,IAAI,wBAAY,CAC1C,4BAAgB,CAAC,aAAa,CAAC,mBAAmB,EAAE,aAAa,CAAC,CACnE,CAAC;gBAEF,MAAM,UAAU,GAAe,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CACjE,OAAO,EACP,OAAO,CACR,CAAC;gBACF,MAAM,IAAI,GAAG,IAAI,uBAAa,CAC5B,IAAI,CAAC,YAAY,EACjB,UAAU,EACV,OAAO,CAAC,QAAQ,EAChB,IAAI,uBAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,EACrC,mBAAmB,EACnB,SAAS,EACT,OAAO,CAAC,GAAG,EACX,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAC3B,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAC5B,CAAC;gBAEF,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtC,OAAO;wBACL,OAAO;wBACP,IAAI;wBACJ,SAAS,EAAE,aAAa,CAAC,MAAM;qBAChC,CAAC;gBACJ,CAAC;gBAED,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAChD,mBAAmB,EACnB,WAAW,EACX,IAAI,CAAC,WAAW,CAAC,SAAS,CAC3B,CAAC;gBACF,OAAO,CAAC,yBAAyB,GAAG,OAAO,CAAC;gBAC5C,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,EAAE,CAAC;YAC5D,CAAC;oBAAS,CAAC;gBACT,IAAI,aAAa;oBAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,EACD,OAAO,EACP;YACE,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,kBAAkB,GAAG,CAAC;SACrE,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,wBAAwB,CACnC,OAAiC,EACjC,UAAkB,EAClB,WAA0B,EAC1B,OAAuB;QAMvB,MAAM,OAAO,GAAG,wBAAU,CAAC,uBAAuB,CAChD,OAAO,CAAC,WAAW,EACnB,UAAU,CACX,CAAC;QACF,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,wBAAU,CAAC,iBAAiB;gBAC/B,OAAO,IAAI,CAAC,0BAA0B,CACpC,OAAO,EACP,UAAU,EACV,WAAW,EACX,OAAO,CACR,CAAC;YACJ;gBACE,MAAM,IAAI,2DAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,yBAAyB,CACpC,UAGwC,EACxC,QAA2D,EAC3D,SAAwB,EACxB,SAAwB,EACxB,OAAsE;QAEtE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC;QAC5C,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,OAA2B,CAAC;QAEhC,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM;YAEzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAClC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CACjC,CAAC;wBACF,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;wBAChE,IAAI,SAAS,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC;4BAC/B,EAAE,CAAC,SAAS,GAAG,SAAS,CAAC;4BACzB,QAAQ,GAAG,IAAI,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,GAAG,KAC9C,CAAW,CAAC,OACf,EAAE,CACH,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACrB,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAED,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,SAAS,CAAC;QAClE,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA1RD,8CA0RC"}

package/src/services/base.d.ts

@@ -0,0 +1,10 @@
+import { ClientSession } from '@digitaldefiance/mongoose-types';
+import { IApplication } from '../interfaces/application';
+import { TransactionCallback } from '../types';
+import { TransactionOptions } from '../utils';
+export declare class BaseService<TApplication extends IApplication = IApplication> {
+    protected readonly application: TApplication;
+    constructor(application: TApplication);
+    withTransaction<T>(callback: TransactionCallback<T>, session?: ClientSession, options?: TransactionOptions, ...args: unknown[]): Promise<T>;
+}
+//# sourceMappingURL=base.d.ts.map

package/src/services/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/services/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAEnB,MAAM,UAAU,CAAC;AAElB,qBAAa,WAAW,CAAC,YAAY,SAAS,YAAY,GAAG,YAAY;IACvE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC;gBAEjC,WAAW,EAAE,YAAY;IAGxB,eAAe,CAAC,CAAC,EAC5B,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAChC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,kBAAkB,EAC5B,GAAG,IAAI,EAAE,OAAO,EAAE;CAWrB"}

package/src/services/base.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseService = void 0;
+const utils_1 = require("../utils");
+class BaseService {
+    application;
+    constructor(application) {
+        this.application = application;
+    }
+    async withTransaction(callback, session, options, ...args) {
+        return await (0, utils_1.withTransaction)(this.application.db.connection, this.application.environment.mongo.useTransactions, session, callback, options ?? {}, ...args);
+    }
+}
+exports.BaseService = BaseService;
+//# sourceMappingURL=base.js.map

package/src/services/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/services/base.ts"],"names":[],"mappings":";;;AAGA,oCAGkB;AAElB,MAAa,WAAW;IACH,WAAW,CAAe;IAE7C,YAAY,WAAyB;QACnC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IACM,KAAK,CAAC,eAAe,CAC1B,QAAgC,EAChC,OAAuB,EACvB,OAA4B,EAC5B,GAAG,IAAe;QAElB,OAAO,MAAM,IAAA,uBAAoB,EAC/B,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,EAC9B,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,eAAe,EAClD,OAAO,EACP,QAAQ,EACR,OAAO,IAAI,EAAE,EACb,GAAG,IAAI,CACR,CAAC;IACJ,CAAC;CACF;AArBD,kCAqBC"}

package/src/services/checksum.d.ts

@@ -0,0 +1,69 @@
+import { ChecksumBuffer, ChecksumString } from '@digitaldefiance/node-ecies-lib';
+import { IChecksumConfig } from '../interfaces/checksum-config';
+import { IChecksumConsts } from '../interfaces/checksum-consts';
+export declare class ChecksumService {
+    private readonly config;
+    protected readonly constants: IChecksumConsts;
+    constructor(config?: Partial<IChecksumConfig>, constants?: IChecksumConsts);
+    /**
+     * Calculate a checksum for a buffer
+     * @param data - The data to calculate the checksum for
+     * @returns The checksum as a Buffer
+     */
+    calculateChecksum(data: Buffer): ChecksumBuffer;
+    /**
+     * Calculate a checksum for multiple buffers
+     * @param buffers - The buffers to calculate the checksum for
+     * @returns The checksum as a Buffer
+     */
+    calculateChecksumForBuffers(buffers: Buffer[]): ChecksumBuffer;
+    /**
+     * Calculate a checksum for a string
+     * @param str - The string to calculate the checksum for
+     * @returns The checksum as a Buffer
+     */
+    calculateChecksumForString(str: string): ChecksumBuffer;
+    /**
+     * Compare two checksums for equality
+     * @param checksum1 - The first checksum
+     * @param checksum2 - The second checksum
+     * @returns True if the checksums are equal, false otherwise
+     */
+    compareChecksums(checksum1: ChecksumBuffer, checksum2: ChecksumBuffer): boolean;
+    /**
+     * Convert a checksum to a hex string
+     * @param checksum - The checksum to convert
+     * @returns The checksum as a hex string
+     */
+    checksumToHexString(checksum: ChecksumBuffer): ChecksumString;
+    /**
+     * Convert a hex string to a checksum
+     * @param hexString - The hex string to convert
+     * @returns The checksum as a Buffer
+     */
+    hexStringToChecksum(hexString: string): ChecksumBuffer;
+    /**
+     * Validate a checksum buffer
+     * @param checksum - The checksum to validate
+     * @returns True if the checksum is valid, false otherwise
+     */
+    validateChecksum(checksum: ChecksumBuffer): boolean;
+    /**
+     * Calculate a checksum for a file
+     * @param filePath - The path to the file
+     * @returns The checksum as a Buffer
+     */
+    calculateChecksumForFile(filePath: string): Promise<ChecksumBuffer>;
+    /**
+     * Internal file reading method
+     * @private
+     */
+    private readFile;
+    /**
+     * Calculate a checksum for a stream
+     * @param stream - The readable stream
+     * @returns The checksum as a Buffer
+     */
+    calculateChecksumForStream(stream: NodeJS.ReadableStream): Promise<ChecksumBuffer>;
+}
+//# sourceMappingURL=checksum.d.ts.map

package/src/services/checksum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checksum.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/services/checksum.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,cAAc,EACf,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;IACzC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;gBAG5C,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,EACjC,SAAS,GAAE,eAA0B;IAUvC;;;;OAIG;IACI,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc;IAOtD;;;;OAIG;IACI,2BAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,cAAc;IASrE;;;;OAIG;IACI,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc;IAI9D;;;;;OAKG;IACI,gBAAgB,CACrB,SAAS,EAAE,cAAc,EACzB,SAAS,EAAE,cAAc,GACxB,OAAO;IAUV;;;;OAIG;IACI,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,cAAc;IAIpE;;;;OAIG;IACI,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc;IAO7D;;;;OAIG;IACI,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO;IAI1D;;;;OAIG;IACU,wBAAwB,CACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,CAAC;IAQ1B;;;OAGG;YACW,QAAQ;IAUtB;;;;OAIG;IACI,0BAA0B,CAC/B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,OAAO,CAAC,cAAc,CAAC;CAoB3B"}