@digitaldefiance/node-express-suite 4.22.2 → 4.23.0

package/src/schemas/user.js

@@ -1,214 +0,0 @@
-"use strict";
-/**
- * @fileoverview User schema factory for MongoDB with comprehensive validation.
- * Creates schema for user management with authentication and preferences.
- * @module schemas/user
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserSchema = void 0;
-exports.createUserSchema = createUserSchema;
-const tslib_1 = require("tslib");
-const i18n_lib_1 = require("@digitaldefiance/i18n-lib");
-const mongoose_types_1 = require("@digitaldefiance/mongoose-types");
-const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
-const currency_codes_1 = require("currency-codes");
-const validator_1 = tslib_1.__importDefault(require("validator"));
-const constants_1 = require("../constants");
-const enumerations_1 = require("../enumerations");
-/**
- * Creates a user schema with custom or default constants.
- * Includes validation for username, email, timezone, currency, and language.
- * @template T - Constants type extending IConstants
- * @param {Function} [usernameValidationMessage] - Custom username validation message
- * @param {Function} [emailValidationMessage] - Custom email validation message
- * @param {Function} [timezoneValidationMessage] - Custom timezone validation message
- * @param {Function} [currencyValidationMessage] - Custom currency validation message
- * @param {readonly string[]} [supportedLanguages] - Supported language codes
- * @param {any} idType - ID type for references (defaults to ObjectId)
- * @param {T} constants - Constants for validation (defaults to AppConstants)
- * @returns {Schema} Configured user schema with timestamps
- */
-function createUserSchema(usernameValidationMessage, emailValidationMessage, timezoneValidationMessage, currencyValidationMessage, supportedLanguages, idType = mongoose_types_1.Schema.Types.ObjectId, constants = constants_1.LocalhostConstants) {
-    const definition = {
-        /**
-         * The unique identifier for the user
-         */
-        username: {
-            type: String,
-            required: true,
-            unique: true,
-            validate: {
-                validator: (v) => constants.UsernameRegex.test(v),
-                message: usernameValidationMessage ||
-                    (() => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Validation_UsernameRegexErrorTemplate)),
-            },
-        },
-        /**
-         * The email address for the user
-         */
-        email: {
-            type: String,
-            required: true,
-            unique: true,
-            validate: {
-                validator: (v) => validator_1.default.isEmail(v),
-                message: emailValidationMessage ||
-                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Error_InvalidEmailTemplate, { email: props.value })),
-            },
-        },
-        /**
-         * The user's public key, stored in hex format.
-         */
-        publicKey: {
-            type: String,
-            required: true,
-            unique: true,
-        },
-        /**
-         * The timezone for the user
-         */
-        timezone: {
-            type: String,
-            required: true,
-            default: 'UTC',
-            validate: {
-                validator: function (v) {
-                    return (0, i18n_lib_1.isValidTimezone)(v);
-                },
-                message: timezoneValidationMessage ||
-                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_NotValidTimeZoneTemplate, { timezone: props.value })),
-            },
-        },
-        currency: {
-            type: String,
-            required: true,
-            default: 'USD',
-            validate: {
-                validator: function (v) {
-                    return (0, currency_codes_1.codes)().includes(v);
-                },
-                message: currencyValidationMessage ||
-                    ((props) => (0, suite_core_lib_1.getSuiteCoreTranslation)(suite_core_lib_1.SuiteCoreStringKey.Common_NotValidCurrencyTemplate, { currency: props.value })),
-            },
-        },
-        /**
-         * The language of the site for the user
-         */
-        siteLanguage: {
-            type: String,
-            enum: supportedLanguages || Object.values(i18n_lib_1.LanguageCodes),
-            default: i18n_lib_1.LanguageCodes.EN_US,
-            required: true,
-        },
-        /**
-         * Whether the user prefers dark mode
-         */
-        darkMode: {
-            type: Boolean,
-            default: false,
-            required: true,
-        },
-        /**
-         * Whether to enable direct challenge login for the user
-         */
-        directChallenge: {
-            type: Boolean,
-            default: true,
-            required: true,
-        },
-        /**
-         * The date the user last logged in
-         */
-        lastLogin: { type: Date, required: false },
-        /**
-         * Whether the user has verified their email address
-         */
-        emailVerified: { type: Boolean, default: false },
-        /**
-         * The status of the user's account
-         */
-        accountStatus: {
-            type: String,
-            enum: Object.values(suite_core_lib_1.AccountStatus),
-            default: suite_core_lib_1.AccountStatus.PendingEmailVerification,
-        },
-        /**
-         * The user who created the user.
-         */
-        createdBy: {
-            type: idType,
-            ref: enumerations_1.BaseModelName.User,
-            required: true,
-            immutable: true,
-        },
-        /**
-         * The user who last updated the user.
-         */
-        updatedBy: {
-            type: idType,
-            ref: enumerations_1.BaseModelName.User,
-            optional: true,
-        },
-        /**
-         * The date/time the user was deleted.
-         */
-        deletedAt: { type: Date, optional: true },
-        /**
-         * The user who deleted the user.
-         */
-        deletedBy: {
-            type: idType,
-            ref: enumerations_1.BaseModelName.User,
-            optional: true,
-        },
-        /**
-         * Reference to the mnemonic document
-         */
-        mnemonicId: {
-            type: idType,
-            ref: enumerations_1.BaseModelName.Mnemonic,
-            required: false,
-        },
-        /**
-         * Copy of the mnemonic encrypted with the user's public key
-         */
-        mnemonicRecovery: {
-            type: String,
-            required: false,
-        },
-        /**
-         * Password-wrapped ECIES private key (Option B)
-         */
-        passwordWrappedPrivateKey: {
-            type: {
-                salt: { type: String, required: true },
-                iv: { type: String, required: true },
-                authTag: { type: String, required: true },
-                ciphertext: { type: String, required: true },
-                iterations: { type: Number, required: true },
-            },
-            required: false,
-        },
-        /**
-         * Array of backup codes to recover mnemonic/private key
-         */
-        backupCodes: {
-            type: [
-                {
-                    version: { type: String, required: true },
-                    checksumSalt: { type: String, required: true },
-                    checksum: { type: String, required: true },
-                    encrypted: { type: String, required: true },
-                },
-            ],
-            default: [],
-        },
-    };
-    return new mongoose_types_1.Schema(definition, { timestamps: true });
-}
-/**
- * Default user schema with base configuration.
- * Pre-configured schema with standard validation and supported languages.
- */
-exports.UserSchema = createUserSchema();
-//# sourceMappingURL=user.js.map

package/src/schemas/user.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/schemas/user.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA4BH,4CA6MC;;AAvOD,wDAA2E;AAC3E,oEAAyD;AACzD,oEAIyC;AACzC,mDAAuC;AACvC,kEAAkC;AAClC,4CAAkE;AAClE,kDAAgD;AAGhD;;;;;;;;;;;;GAYG;AACH,SAAgB,gBAAgB,CAC9B,yBAAwC,EACxC,sBAAqC,EACrC,yBAAwC,EACxC,yBAAwC,EACxC,kBAAsC,EACtC,SAAc,uBAAM,CAAC,KAAK,CAAC,QAAQ,EACnC,YAAe,8BAAiB;IAEhC,MAAM,UAAU,GAAG;QACjB;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE;gBACR,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,OAAO,EACL,yBAAyB;oBACzB,CAAC,GAAG,EAAE,CACJ,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,qCAAqC,CACzD,CAAC;aACP;SACF;QACD;;WAEG;QACH,KAAK,EAAE;YACL,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE;gBACR,SAAS,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,mBAAS,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9C,OAAO,EACL,sBAAsB;oBACtB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,0BAA0B,EAC7C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CACvB,CAAC;aACP;SACF;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI;SACb;QACD;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE;gBACR,SAAS,EAAE,UAAU,CAAS;oBAC5B,OAAO,IAAA,0BAAe,EAAC,CAAC,CAAC,CAAC;gBAC5B,CAAC;gBACD,OAAO,EACL,yBAAyB;oBACzB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,+BAA+B,EAClD,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,CAC1B,CAAC;aACP;SACF;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE;gBACR,SAAS,EAAE,UAAU,CAAS;oBAC5B,OAAO,IAAA,sBAAK,GAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC7B,CAAC;gBACD,OAAO,EACL,yBAAyB;oBACzB,CAAC,CAAC,KAAwB,EAAE,EAAE,CAC5B,IAAA,wCAAuB,EACrB,mCAAkB,CAAC,+BAA+B,EAClD,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,CAC1B,CAAC;aACP;SACF;QACD;;WAEG;QACH,YAAY,EAAE;YACZ,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,kBAAkB,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAa,CAAC;YACxD,OAAO,EAAE,wBAAa,CAAC,KAAK;YAC5B,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,QAAQ,EAAE;YACR,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,eAAe,EAAE;YACf,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1C;;WAEG;QACH,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;QAChD;;WAEG;QACH,aAAa,EAAE;YACb,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,8BAAa,CAAC;YAClC,OAAO,EAAE,8BAAa,CAAC,wBAAwB;SAChD;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;SAChB;QACD;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC;;WAEG;QACH,SAAS,EAAE;YACT,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI;SACf;QACD;;WAEG;QACH,UAAU,EAAE;YACV,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,4BAAa,CAAC,QAAQ;YAC3B,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,gBAAgB,EAAE;YAChB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,yBAAyB,EAAE;YACzB,IAAI,EAAE;gBACJ,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACtC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACpC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACzC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;gBAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC7C;YACD,QAAQ,EAAE,KAAK;SAChB;QACD;;WAEG;QACH,WAAW,EAAE;YACX,IAAI,EAAE;gBACJ;oBACE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBACzC,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC9C,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC1C,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;iBAC5C;aACF;YACD,OAAO,EAAE,EAAE;SACZ;KACF,CAAC;IAEF,OAAO,IAAI,uBAAM,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACU,QAAA,UAAU,GAAG,gBAAgB,EAAE,CAAC"}

package/src/services/backup-code.d.ts

@@ -1,120 +0,0 @@
-/**
- * @fileoverview Backup code service for secure account recovery.
- * Implements v1.0.0 backup code scheme with Argon2id KDF and HKDF-SHA256 checksums.
- *
- * Storage-agnostic: accepts an optional {@link IBackupCodeStore} for persistence.
- * When no store is provided, falls back to direct UserDocument manipulation
- * (backward-compatible Mongoose path).
- *
- * @module services/backup-code
- */
-import { SecureString } from '@digitaldefiance/ecies-lib';
-import { ClientSession } from '@digitaldefiance/mongoose-types';
-import { Member as BackendMember, ECIESService, PlatformID } from '@digitaldefiance/node-ecies-lib';
-import { IBackupCode, ITokenRole } from '@digitaldefiance/suite-core-lib';
-import { UserDocument } from '../documents';
-import { IApplication } from '../interfaces/application';
-import type { IBackupCodeStore, IBackupCodeUserRecord } from '../interfaces/backup-code-store';
-import { BaseService } from './base';
-import { KeyWrappingService } from './index';
-import { RoleService } from './role';
-/**
- * Service for backup code generation, validation, and key recovery.
- * Implements secure backup code scheme with constant-time validation and key wrapping.
- *
- * Storage is abstracted via {@link IBackupCodeStore}. When a store is provided,
- * all persistence goes through the store interface. When omitted, the service
- * falls back to direct UserDocument manipulation for backward compatibility
- * with existing Mongoose-based consumers.
- *
- * @template TID - Platform ID type (defaults to Buffer)
- * @template TDate - Date type (defaults to Date)
- * @template TTokenRole - Token role interface type
- * @template TApplication - Application interface type
- * @extends {BaseService<TID>}
- */
-export declare class BackupCodeService<TID extends PlatformID = Buffer, TDate extends Date = Date, TTokenRole extends ITokenRole<TID, TDate> = ITokenRole<TID, TDate>, TApplication extends IApplication<TID> = IApplication<TID>> extends BaseService<TID> {
-    private readonly eciesService;
-    private systemUser?;
-    private readonly keyWrappingService;
-    private readonly roleService;
-    private readonly store?;
-    /**
-     * Construct a BackupCodeService.
-     * @param application - The application instance
-     * @param eciesService - ECIES cryptographic service
-     * @param keyWrappingService - Key wrapping service for password-based key protection
-     * @param roleService - Role service for member type resolution
-     * @param store - Optional storage adapter. When omitted, falls back to direct
-     *   UserDocument manipulation (Mongoose). Provide an IBackupCodeStore implementation
-     *   for non-Mongoose backends (e.g. BrightDB).
-     */
-    constructor(application: TApplication, eciesService: ECIESService<TID>, keyWrappingService: KeyWrappingService, roleService: RoleService<TID, TDate, TTokenRole>, store?: IBackupCodeStore<TID>);
-    /**
-     * Get the lazily-initialized system user for key wrapping/unwrapping.
-     */
-    private getSystemUser;
-    /**
-     * Forcibly set the system user (for database initialization)
-     * @param user
-     */
-    setSystemUser(user: BackendMember<TID>): void;
-    /**
-     * v1: Consume (validate and remove) a backup code via constant-time checksum match.
-     */
-    useBackupCodeV1(encryptedBackupCodes: Array<IBackupCode>, backupCode: string): {
-        newCodesArray: Array<IBackupCode>;
-        code: IBackupCode;
-    };
-    /**
-     * Consume a backup code by first detecting the version and then dispatching to the appropriate handler.
-     */
-    useBackupCode(encryptedBackupCodes: Array<IBackupCode>, backupCode: string): {
-        newCodesArray: Array<IBackupCode>;
-        code: IBackupCode;
-    };
-    /**
-     * Recover a user's private key using a backup code.
-     * Storage-agnostic: uses IBackupCodeStore when available, otherwise
-     * falls back to the legacy UserDocument path.
-     *
-     * @param userOrId - Either a UserDocument (legacy) or a user ID (store-based)
-     * @param backupCode - The plaintext backup code
-     * @param newPassword - Optional new password to re-wrap the private key
-     * @param session - Optional database session for transactional consistency
-     */
-    recoverKeyWithBackupCodeV1(userOrId: UserDocument<string, TID> | TID, backupCode: string, newPassword?: SecureString, session?: ClientSession): Promise<{
-        userDoc?: UserDocument<string, TID>;
-        userRecord?: IBackupCodeUserRecord<TID>;
-        user: BackendMember<TID>;
-        codeCount: number;
-    }>;
-    /**
-     * Recover a user's private key using a backup code (version-dispatched).
-     * Accepts either a UserDocument (legacy) or a user ID (store-based).
-     */
-    recoverKeyWithBackupCode(userOrId: UserDocument<string, TID> | TID, backupCode: string, newPassword?: SecureString, session?: ClientSession): Promise<{
-        userDoc?: UserDocument<string, TID>;
-        userRecord?: IBackupCodeUserRecord<TID>;
-        user: BackendMember<TID>;
-        codeCount: number;
-    }>;
-    /**
-     * Rewrap system-wrapped AEAD blobs from old system key to new one.
-     *
-     * When a store is provided, uses the store's fetchBatch/updateUserRecord.
-     * Otherwise falls back to the legacy callback-based approach.
-     */
-    rewrapAllUsersBackupCodes(fetchBatchOrOldSystem: ((afterId?: string, limit?: number) => Promise<UserDocument<string, TID>[]>) | BackendMember, saveUserOrNewSystem: ((user: UserDocument<string, TID>) => Promise<void>) | BackendMember, oldSystemOrOptions?: BackendMember | {
-        batchSize?: number;
-        onProgress?: (count: number) => void;
-    }, newSystemOrUndefined?: BackendMember, options?: {
-        batchSize?: number;
-        onProgress?: (count: number) => void;
-    }): Promise<number>;
-    private _recoverViaStore;
-    private _recoverViaUserDoc;
-    private _rewrapViaStore;
-    private _rewrapViaCallbacks;
-}
-//# sourceMappingURL=backup-code.d.ts.map

package/src/services/backup-code.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"backup-code.d.ts","sourceRoot":"","sources":["../../../../../packages/digitaldefiance-node-express-suite/src/services/backup-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAIL,YAAY,EACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACL,MAAM,IAAI,aAAa,EACvB,YAAY,EACZ,UAAU,EACX,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,WAAW,EAEX,UAAU,EACX,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAIrC;;;;;;;;;;;;;;GAcG;AACH,qBAAa,iBAAiB,CAC5B,GAAG,SAAS,UAAU,GAAG,MAAM,EAC/B,KAAK,SAAS,IAAI,GAAG,IAAI,EACzB,UAAU,SAAS,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,EAClE,YAAY,SAAS,YAAY,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAC1D,SAAQ,WAAW,CAAC,GAAG,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,UAAU,CAAC,CAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAwB;IAE/C;;;;;;;;;OASG;gBAED,WAAW,EAAE,YAAY,EACzB,YAAY,EAAE,YAAY,CAAC,GAAG,CAAC,EAC/B,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,EAChD,KAAK,CAAC,EAAE,gBAAgB,CAAC,GAAG,CAAC;IAS/B;;OAEG;IACH,OAAO,CAAC,aAAa;IAUrB;;;OAGG;IACI,aAAa,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI;IAMpD;;OAEG;IACI,eAAe,CACpB,oBAAoB,EAAE,KAAK,CAAC,WAAW,CAAC,EACxC,UAAU,EAAE,MAAM,GACjB;QAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE;IAmC3D;;OAEG;IACI,aAAa,CAClB,oBAAoB,EAAE,KAAK,CAAC,WAAW,CAAC,EACxC,UAAU,EAAE,MAAM,GACjB;QAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE;IAoB3D;;;;;;;;;OASG;IACU,0BAA0B,CACrC,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EACzC,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC;QACT,OAAO,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAeF;;;OAGG;IACU,wBAAwB,CACnC,QAAQ,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,GAAG,EACzC,UAAU,EAAE,MAAM,EAClB,WAAW,CAAC,EAAE,YAAY,EAC1B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC;QACT,OAAO,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IA2BF;;;;;OAKG;IACU,yBAAyB,CACpC,qBAAqB,EACjB,CAAC,CACC,OAAO,CAAC,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,GAC1C,aAAa,EACjB,mBAAmB,EACf,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,GACpD,aAAa,EACjB,kBAAkB,CAAC,EACf,aAAa,GACb;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,EAChE,oBAAoB,CAAC,EAAE,aAAa,EACpC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,GACrE,OAAO,CAAC,MAAM,CAAC;YA4BJ,gBAAgB;YA+EhB,kBAAkB;YAqFlB,eAAe;YAoDf,mBAAmB;CAmDlC"}

package/src/services/backup-code.js

@@ -1,323 +0,0 @@
-"use strict";
-/**
- * @fileoverview Backup code service for secure account recovery.
- * Implements v1.0.0 backup code scheme with Argon2id KDF and HKDF-SHA256 checksums.
- *
- * Storage-agnostic: accepts an optional {@link IBackupCodeStore} for persistence.
- * When no store is provided, falls back to direct UserDocument manipulation
- * (backward-compatible Mongoose path).
- *
- * @module services/backup-code
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BackupCodeService = void 0;
-const ecies_lib_1 = require("@digitaldefiance/ecies-lib");
-const node_ecies_lib_1 = require("@digitaldefiance/node-ecies-lib");
-const suite_core_lib_1 = require("@digitaldefiance/suite-core-lib");
-const crypto_1 = require("crypto");
-const backup_code_1 = require("../backup-code");
-const constants_1 = require("../constants");
-const invalid_backup_code_version_1 = require("../errors/invalid-backup-code-version");
-const base_1 = require("./base");
-const symmetric_1 = require("./symmetric");
-const system_user_1 = require("./system-user");
-/**
- * Service for backup code generation, validation, and key recovery.
- * Implements secure backup code scheme with constant-time validation and key wrapping.
- *
- * Storage is abstracted via {@link IBackupCodeStore}. When a store is provided,
- * all persistence goes through the store interface. When omitted, the service
- * falls back to direct UserDocument manipulation for backward compatibility
- * with existing Mongoose-based consumers.
- *
- * @template TID - Platform ID type (defaults to Buffer)
- * @template TDate - Date type (defaults to Date)
- * @template TTokenRole - Token role interface type
- * @template TApplication - Application interface type
- * @extends {BaseService<TID>}
- */
-class BackupCodeService extends base_1.BaseService {
-    eciesService;
-    systemUser;
-    keyWrappingService;
-    roleService;
-    store;
-    /**
-     * Construct a BackupCodeService.
-     * @param application - The application instance
-     * @param eciesService - ECIES cryptographic service
-     * @param keyWrappingService - Key wrapping service for password-based key protection
-     * @param roleService - Role service for member type resolution
-     * @param store - Optional storage adapter. When omitted, falls back to direct
-     *   UserDocument manipulation (Mongoose). Provide an IBackupCodeStore implementation
-     *   for non-Mongoose backends (e.g. BrightDB).
-     */
-    constructor(application, eciesService, keyWrappingService, roleService, store) {
-        super(application);
-        this.eciesService = eciesService;
-        this.keyWrappingService = keyWrappingService;
-        this.roleService = roleService;
-        this.store = store;
-    }
-    /**
-     * Get the lazily-initialized system user for key wrapping/unwrapping.
-     */
-    getSystemUser() {
-        if (!this.systemUser) {
-            this.systemUser = system_user_1.SystemUserService.getSystemUser(this.application.environment, this.application.constants);
-        }
-        return this.systemUser;
-    }
-    /**
-     * Forcibly set the system user (for database initialization)
-     * @param user
-     */
-    setSystemUser(user) {
-        this.systemUser = user;
-    }
-    // ── Pure crypto operations (no storage dependency) ─────────────────────
-    /**
-     * v1: Consume (validate and remove) a backup code via constant-time checksum match.
-     */
-    useBackupCodeV1(encryptedBackupCodes, backupCode) {
-        const normalizedCode = backup_code_1.BackupCode.normalizeCode(backupCode);
-        if (!constants_1.LocalhostConstants.BACKUP_CODES.NormalizedHexRegex.test(normalizedCode)) {
-            throw new suite_core_lib_1.InvalidBackupCodeError();
-        }
-        const codeBytes = Buffer.from(normalizedCode, 'utf8');
-        try {
-            for (const code of encryptedBackupCodes) {
-                if (code.version !== backup_code_1.BackupCode.BackupCodeVersion)
-                    continue;
-                const checksumSalt = Buffer.from(code.checksumSalt, 'hex');
-                const expected = backup_code_1.BackupCode.hkdfSha256(codeBytes, checksumSalt, Buffer.from('backup-checksum'), 32);
-                if (code.checksum.length === expected.length * 2 &&
-                    (0, crypto_1.timingSafeEqual)(Buffer.from(code.checksum, 'hex'), expected)) {
-                    const checksumHex = expected.toString('hex');
-                    return {
-                        newCodesArray: encryptedBackupCodes.filter((c) => c.checksum !== checksumHex),
-                        code,
-                    };
-                }
-            }
-            throw new suite_core_lib_1.InvalidBackupCodeError();
-        }
-        finally {
-            codeBytes.fill(0);
-        }
-    }
-    /**
-     * Consume a backup code by first detecting the version and then dispatching to the appropriate handler.
-     */
-    useBackupCode(encryptedBackupCodes, backupCode) {
-        const version = backup_code_1.BackupCode.detectBackupCodeVersion(encryptedBackupCodes, backupCode);
-        switch (version) {
-            case backup_code_1.BackupCode.BackupCodeVersion:
-                return this.useBackupCodeV1(encryptedBackupCodes.filter((c) => c.version === backup_code_1.BackupCode.BackupCodeVersion), backupCode);
-            default:
-                throw new invalid_backup_code_version_1.InvalidBackupCodeVersionError(version);
-        }
-    }
-    // ── Storage-agnostic recovery ──────────────────────────────────────────
-    /**
-     * Recover a user's private key using a backup code.
-     * Storage-agnostic: uses IBackupCodeStore when available, otherwise
-     * falls back to the legacy UserDocument path.
-     *
-     * @param userOrId - Either a UserDocument (legacy) or a user ID (store-based)
-     * @param backupCode - The plaintext backup code
-     * @param newPassword - Optional new password to re-wrap the private key
-     * @param session - Optional database session for transactional consistency
-     */
-    async recoverKeyWithBackupCodeV1(userOrId, backupCode, newPassword, session) {
-        // Store-based path
-        if (this.store && !userOrId.save) {
-            return this._recoverViaStore(userOrId, backupCode, newPassword);
-        }
-        // Legacy Mongoose path
-        return this._recoverViaUserDoc(userOrId, backupCode, newPassword, session);
-    }
-    /**
-     * Recover a user's private key using a backup code (version-dispatched).
-     * Accepts either a UserDocument (legacy) or a user ID (store-based).
-     */
-    async recoverKeyWithBackupCode(userOrId, backupCode, newPassword, session) {
-        // Determine backup codes source
-        let backupCodes;
-        if (this.store && !userOrId.save) {
-            const record = await this.store.getUserRecord(userOrId);
-            if (!record)
-                throw new suite_core_lib_1.InvalidBackupCodeError();
-            backupCodes = record.backupCodes;
-        }
-        else {
-            backupCodes = userOrId.backupCodes;
-        }
-        const version = backup_code_1.BackupCode.detectBackupCodeVersion(backupCodes, backupCode);
-        switch (version) {
-            case backup_code_1.BackupCode.BackupCodeVersion:
-                return this.recoverKeyWithBackupCodeV1(userOrId, backupCode, newPassword, session);
-            default:
-                throw new invalid_backup_code_version_1.InvalidBackupCodeVersionError(version);
-        }
-    }
-    // ── Rewrap (key rotation) ─────────────────────────────────────────────
-    /**
-     * Rewrap system-wrapped AEAD blobs from old system key to new one.
-     *
-     * When a store is provided, uses the store's fetchBatch/updateUserRecord.
-     * Otherwise falls back to the legacy callback-based approach.
-     */
-    async rewrapAllUsersBackupCodes(fetchBatchOrOldSystem, saveUserOrNewSystem, oldSystemOrOptions, newSystemOrUndefined, options) {
-        // Detect which overload is being used
-        if (this.store && typeof fetchBatchOrOldSystem !== 'function') {
-            // Store-based: rewrapAllUsersBackupCodes(oldSystem, newSystem, options?)
-            return this._rewrapViaStore(fetchBatchOrOldSystem, saveUserOrNewSystem, oldSystemOrOptions);
-        }
-        // Legacy callback-based: rewrapAllUsersBackupCodes(fetchBatch, saveUser, oldSystem, newSystem, options?)
-        return this._rewrapViaCallbacks(fetchBatchOrOldSystem, saveUserOrNewSystem, oldSystemOrOptions, newSystemOrUndefined, options);
-    }
-    // ── Private: store-based recovery ─────────────────────────────────────
-    async _recoverViaStore(userId, backupCode, newPassword) {
-        const store = this.store;
-        const record = await store.getUserRecord(userId);
-        if (!record)
-            throw new suite_core_lib_1.InvalidBackupCodeError();
-        const normalizedCode = backup_code_1.BackupCode.normalizeCode(backupCode);
-        const { code, newCodesArray } = this.useBackupCodeV1(record.backupCodes, normalizedCode);
-        let decryptionKey;
-        try {
-            const adminMember = this.getSystemUser();
-            decryptionKey = await backup_code_1.BackupCode.getBackupKeyV1(code.checksumSalt, normalizedCode, this.application.constants);
-            const privateKeyUnwrapped = await adminMember.decryptData(Buffer.from(code.encrypted, 'hex'));
-            const decryptedPrivateKey = new ecies_lib_1.SecureBuffer(symmetric_1.SymmetricService.decryptBuffer(privateKeyUnwrapped, decryptionKey));
-            const memberType = await store.getMemberType(userId);
-            const user = new node_ecies_lib_1.Member(this.eciesService, memberType, record.username, new ecies_lib_1.EmailString(record.email), Buffer.from(record.publicKey, 'hex'), decryptedPrivateKey, undefined, record._id, new Date(record.createdAt), new Date(record.updatedAt));
-            const updates = {
-                backupCodes: newCodesArray,
-            };
-            if (newPassword) {
-                updates.passwordWrappedPrivateKey = this.keyWrappingService.wrapSecret(decryptedPrivateKey, newPassword, this.application.constants);
-            }
-            await store.updateUserRecord(userId, updates);
-            // Update the record in-place for the caller
-            record.backupCodes = newCodesArray;
-            if (updates.passwordWrappedPrivateKey) {
-                record.passwordWrappedPrivateKey = updates.passwordWrappedPrivateKey;
-            }
-            return { userRecord: record, user, codeCount: newCodesArray.length };
-        }
-        finally {
-            if (decryptionKey)
-                decryptionKey.fill(0);
-        }
-    }
-    // ── Private: legacy Mongoose recovery ─────────────────────────────────
-    async _recoverViaUserDoc(userDoc, backupCode, newPassword, session) {
-        const normalizedCode = backup_code_1.BackupCode.normalizeCode(backupCode);
-        return await this.withTransaction(async (sess) => {
-            const { code, newCodesArray } = this.useBackupCodeV1(userDoc.backupCodes, normalizedCode);
-            userDoc.backupCodes = newCodesArray;
-            let decryptionKey;
-            try {
-                const adminMember = this.getSystemUser();
-                decryptionKey = await backup_code_1.BackupCode.getBackupKeyV1(code.checksumSalt, normalizedCode, this.application.constants);
-                const privateKeyUnwrapped = await adminMember.decryptData(Buffer.from(code.encrypted, 'hex'));
-                const decryptedPrivateKey = new ecies_lib_1.SecureBuffer(symmetric_1.SymmetricService.decryptBuffer(privateKeyUnwrapped, decryptionKey));
-                const memberType = await this.roleService.getMemberType(userDoc, session);
-                const user = new node_ecies_lib_1.Member(this.eciesService, memberType, userDoc.username, new ecies_lib_1.EmailString(userDoc.email), Buffer.from(userDoc.publicKey, 'hex'), decryptedPrivateKey, undefined, userDoc._id, new Date(userDoc.createdAt), new Date(userDoc.updatedAt));
-                if (!newPassword) {
-                    await userDoc.save({ session: sess });
-                    return {
-                        userDoc,
-                        user,
-                        codeCount: newCodesArray.length,
-                    };
-                }
-                const wrapped = this.keyWrappingService.wrapSecret(decryptedPrivateKey, newPassword, this.application.constants);
-                userDoc.passwordWrappedPrivateKey = wrapped;
-                await userDoc.save({ session: sess });
-                return { userDoc, user, codeCount: newCodesArray.length };
-            }
-            finally {
-                if (decryptionKey)
-                    decryptionKey.fill(0);
-            }
-        }, session, {
-            timeoutMs: this.application.environment.mongo.transactionTimeout * 5,
-        });
-    }
-    // ── Private: store-based rewrap ───────────────────────────────────────
-    async _rewrapViaStore(oldSystem, newSystem, options) {
-        const store = this.store;
-        const batchSize = options?.batchSize ?? 500;
-        let processed = 0;
-        let afterId;
-        for (;;) {
-            const records = await store.fetchBatch(afterId, batchSize);
-            if (!records.length)
-                break;
-            for (const record of records) {
-                let modified = false;
-                for (const bc of record.backupCodes ?? []) {
-                    try {
-                        const sealed = await oldSystem.decryptData(Buffer.from(bc.encrypted, 'hex'));
-                        const rewrapped = (await newSystem.encryptData(sealed)).toString('hex');
-                        if (rewrapped !== bc.encrypted) {
-                            bc.encrypted = rewrapped;
-                            modified = true;
-                        }
-                    }
-                    catch (e) {
-                        throw new Error(`Failed to rewrap backup code for user ${record._id}: ${e.message}`);
-                    }
-                }
-                if (modified) {
-                    await store.updateUserRecord(record._id, {
-                        backupCodes: record.backupCodes,
-                    });
-                    processed++;
-                    options?.onProgress?.(processed);
-                }
-            }
-            afterId = records[records.length - 1]?._id?.toString() ?? undefined;
-        }
-        return processed;
-    }
-    // ── Private: legacy callback-based rewrap ─────────────────────────────
-    async _rewrapViaCallbacks(fetchBatch, saveUser, oldSystem, newSystem, options) {
-        const batchSize = options?.batchSize ?? 500;
-        let processed = 0;
-        let afterId;
-        for (;;) {
-            const users = await fetchBatch(afterId, batchSize);
-            if (!users.length)
-                break;
-            for (const user of users) {
-                let modified = false;
-                for (const bc of user.backupCodes ?? []) {
-                    try {
-                        const sealed = await oldSystem.decryptData(Buffer.from(bc.encrypted, 'hex'));
-                        const rewrapped = (await newSystem.encryptData(sealed)).toString('hex');
-                        if (rewrapped !== bc.encrypted) {
-                            bc.encrypted = rewrapped;
-                            modified = true;
-                        }
-                    }
-                    catch (e) {
-                        throw new Error(`Failed to rewrap backup code for user ${user._id}: ${e.message}`);
-                    }
-                }
-                if (modified) {
-                    await saveUser(user);
-                    processed++;
-                    options?.onProgress?.(processed);
-                }
-            }
-            afterId = users[users.length - 1]?._id?.toString() ?? undefined;
-        }
-        return processed;
-    }
-}
-exports.BackupCodeService = BackupCodeService;
-//# sourceMappingURL=backup-code.js.map