@flusys/nestjs-auth 1.0.0-beta → 1.0.0

package/cjs/services/auth-config.service.js

@@ -9,8 +9,8 @@ Object.defineProperty(exports, "AuthConfigService", {
     }
 });
 const _common = require("@nestjs/common");
-const _authmoduleoptionsinterface = require("../interfaces/auth-module-options.interface");
 const _authconstants = require("../config/auth.constants");
+const _authmoduleoptionsinterface = require("../interfaces/auth-module-options.interface");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -39,26 +39,39 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthConfigService = class AuthConfigService {
-    // Database Mode
-    /** Get database mode (single or multi-tenant) */ getDatabaseMode() {
+    // Database Mode (required by IModuleConfigService)
+    getDatabaseMode() {
         return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
     }
-    /** Check if running in multi-tenant mode */ isMultiTenant() {
+    isMultiTenant() {
         return this.getDatabaseMode() === 'multi-tenant';
     }
     // Feature Flags
-    /** Check if company feature is enabled */ isCompanyFeatureEnabled() {
+    isCompanyFeatureEnabled() {
         return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
     // JWT Configuration
     /** Get JWT secret key */ getJwtSecret() {
-        return this.config.jwtSecret ?? 'default-secret-change-in-production';
+        if (!this.config.jwtSecret) {
+            throw new _common.InternalServerErrorException('[AuthModule] JWT_SECRET is required - set via environment or module config');
+        }
+        return this.config.jwtSecret;
     }
     /** Get JWT expiration time */ getJwtExpiration() {
         return this.config.jwtExpiration ?? '1h';
     }
     /** Get refresh token secret key */ getRefreshTokenSecret() {
-        return this.config.refreshTokenSecret ?? this.getJwtSecret();
+        if (this.config.refreshTokenSecret) {
+            return this.config.refreshTokenSecret;
+        }
+        if (process.env.NODE_ENV === 'production') {
+            throw new _common.InternalServerErrorException('[AuthModule] REFRESH_TOKEN_SECRET is required in production - ' + 'using the same secret for access and refresh tokens is a security risk');
+        }
+        if (!this.refreshTokenSecretWarned) {
+            this.refreshTokenSecretWarned = true;
+            this.logger.warn('REFRESH_TOKEN_SECRET not configured - using JWT_SECRET as fallback. ' + 'For better security, configure a separate refresh token secret.');
+        }
+        return this.getJwtSecret();
     }
     /** Get refresh token expiration time */ getRefreshTokenExpiration() {
         return this.config.refreshTokenExpiration ?? '7d';
@@ -66,30 +79,15 @@ let AuthConfigService = class AuthConfigService {
     /** Get refresh token cookie name */ getRefreshTokenCookieName() {
         return this.config.refreshTokenCookieName ?? 'fsn_refresh_token';
     }
-    // Database Configuration
-    /** Get default database config */ getDefaultDatabaseConfig() {
-        return this.config.defaultDatabaseConfig ?? this.config.tenantDefaultDatabaseConfig;
-    }
-    /** Get tenant default database config (for multi-tenant) */ getTenantDefaultDatabaseConfig() {
-        return this.config.tenantDefaultDatabaseConfig;
-    }
-    /** Get registered tenants */ getTenants() {
-        return this.config.tenants ?? [];
-    }
-    // Raw Options
-    /** Get full module options */ getOptions() {
-        return {
-            ...this.options
-        };
-    }
-    /** Get runtime config */ getConfig() {
-        return {
-            ...this.config
-        };
+    // Frontend Configuration
+    /** Get frontend URL for email links */ getFrontendUrl() {
+        return this.config.frontendUrl;
     }
     constructor(injectedOptions){
+        _define_property(this, "logger", new _common.Logger(AuthConfigService.name));
         _define_property(this, "options", void 0);
         _define_property(this, "config", void 0);
+        _define_property(this, "refreshTokenSecretWarned", false);
         this.options = injectedOptions ?? {
             global: false,
             includeController: true

package/cjs/services/auth-datasource.provider.js

@@ -92,7 +92,7 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
             const lockPromise = (async ()=>{
                 const config = this.getDefaultDatabaseConfig();
                 if (!config) {
-                    throw new Error('Default database config is not available');
+                    throw new _common.InternalServerErrorException('Default database config is not available');
                 }
                 const ds = await this.createDataSourceFromConfig(config);
                 AuthDataSourceProvider.singleDataSource = ds;
@@ -141,38 +141,28 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
         };
     }
     // Feature Flags
-    /** Get global enable company feature flag */ getEnableCompanyFeature() {
-        return this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
-    }
-    /** Get enable company feature for specific tenant. Falls back to global setting. */ getEnableCompanyFeatureForTenant(tenant) {
-        return tenant?.enableCompanyFeature ?? this.getEnableCompanyFeature();
-    }
-    /** Get enable company feature for current request context */ getEnableCompanyFeatureForCurrentTenant() {
-        return this.getEnableCompanyFeatureForTenant(this.getCurrentTenant() ?? undefined);
+    /** Check if company feature is enabled (tenant-specific or global fallback) */ isCompanyFeatureEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableCompanyFeature ?? this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
     // Entity Management
-    /** Get auth entities based on company feature flag */ async getAuthEntities(enableCompanyFeature) {
-        const enable = enableCompanyFeature ?? this.getEnableCompanyFeature();
-        const { Company, CompanyBranch, User, UserCompanyPermission } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("../entities")));
+    /** Get auth entities based on company feature flag */ async getAuthEntities() {
+        const { Company, CompanyBranch, User, UserCompanyPermission, UserToken, PendingRegistration } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("../entities")));
         const coreEntities = [
-            User
+            User,
+            UserToken,
+            PendingRegistration
         ];
-        const companyEntities = enable ? [
+        return this.isCompanyFeatureEnabled() ? [
+            ...coreEntities,
             Company,
             CompanyBranch,
             UserCompanyPermission
-        ] : [];
-        return [
-            ...coreEntities,
-            ...companyEntities
-        ];
+        ] : coreEntities;
     }
     // Overrides
     /** Override to dynamically set entities based on tenant config */ async createDataSourceFromConfig(config) {
-        const currentTenant = this.getCurrentTenant();
-        const enableCompanyFeature = this.getEnableCompanyFeatureForTenant(currentTenant ?? undefined);
-        const entities = await this.getAuthEntities(enableCompanyFeature);
-        return super.createDataSourceFromConfig(config, entities);
+        return super.createDataSourceFromConfig(config, await this.getAuthEntities());
     }
     constructor(authOptions, request){
         super(AuthDataSourceProvider.buildParentOptions(authOptions), request), _define_property(this, "authOptions", void 0), _define_property(this, "logger", void 0), this.authOptions = authOptions, this.logger = new _common.Logger(AuthDataSourceProvider.name);

package/cjs/services/auth-email.service.js

@@ -0,0 +1,456 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "AuthEmailService", {
+    enumerable: true,
+    get: function() {
+        return AuthEmailService;
+    }
+});
+const _common = require("@nestjs/common");
+const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
+const _crypto = /*#__PURE__*/ _interop_require_wildcard(require("crypto"));
+const _typeorm = require("typeorm");
+const _config = require("../config");
+const _pendingregistrationentity = require("../entities/pending-registration.entity");
+const _usertokenentity = require("../entities/user-token.entity");
+const _userentity = require("../entities/user.entity");
+const _interfaces = require("../interfaces");
+const _authdatasourceprovider = require("./auth-datasource.provider");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _getRequireWildcardCache(nodeInterop) {
+    if (typeof WeakMap !== "function") return null;
+    var cacheBabelInterop = new WeakMap();
+    var cacheNodeInterop = new WeakMap();
+    return (_getRequireWildcardCache = function(nodeInterop) {
+        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
+    })(nodeInterop);
+}
+function _interop_require_wildcard(obj, nodeInterop) {
+    if (!nodeInterop && obj && obj.__esModule) {
+        return obj;
+    }
+    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
+        return {
+            default: obj
+        };
+    }
+    var cache = _getRequireWildcardCache(nodeInterop);
+    if (cache && cache.has(obj)) {
+        return cache.get(obj);
+    }
+    var newObj = {
+        __proto__: null
+    };
+    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
+    for(var key in obj){
+        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
+            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
+            if (desc && (desc.get || desc.set)) {
+                Object.defineProperty(newObj, key, desc);
+            } else {
+                newObj[key] = obj[key];
+            }
+        }
+    }
+    newObj.default = obj;
+    if (cache) {
+        cache.set(obj, newObj);
+    }
+    return newObj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+let AuthEmailService = class AuthEmailService {
+    isEmailEnabled() {
+        return !!this.emailProvider;
+    }
+    // ============================================
+    // Private Helpers
+    // ============================================
+    async getRepository(entity) {
+        if (!this.dataSourceProvider) {
+            throw new _common.InternalServerErrorException(`${String(entity)} repository not available`);
+        }
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    generateToken() {
+        return _crypto.randomBytes(32).toString('hex');
+    }
+    /** Hash token for secure storage - prevents token theft if database is compromised */ hashToken(token) {
+        return _crypto.createHash('sha256').update(token).digest('hex');
+    }
+    getErrorMessage(error) {
+        return error instanceof Error ? error.message : 'Unknown error';
+    }
+    assertEmailEnabled() {
+        if (!this.emailProvider) {
+            throw new _common.BadRequestException('Email service is not configured');
+        }
+    }
+    async sendVerificationEmailSafe(email, token, verifyUrl, logContext) {
+        try {
+            await this.emailProvider.sendVerificationEmail(email, token, verifyUrl);
+            this.logger.log(`${logContext} verification email sent to: ${email}`);
+        } catch (error) {
+            this.logger.error(`Failed to send verification email: ${this.getErrorMessage(error)}`);
+            throw new _common.BadRequestException('Failed to send verification email. Please try again.');
+        }
+    }
+    validateTokenNotExpiredOrUsed(token, expiredMessage, usedMessage) {
+        if (token.expiresAt < new Date()) {
+            throw new _common.BadRequestException(expiredMessage);
+        }
+        if (usedMessage && token.usedAt) {
+            throw new _common.BadRequestException(usedMessage);
+        }
+    }
+    // ============================================
+    // Pending Registration (New Users)
+    // ============================================
+    async hasPendingRegistration(email) {
+        if (!this.isEmailEnabled()) return false;
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
+        const pending = await pendingRepository.findOne({
+            where: {
+                email
+            }
+        });
+        return !!pending && pending.expiresAt > new Date();
+    }
+    async createPendingRegistration(data) {
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(_userentity.User);
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
+        // Check if user already exists
+        const existingUser = await userRepository.findOne({
+            where: {
+                email: data.email
+            }
+        });
+        if (existingUser) {
+            throw new _common.BadRequestException('Registration failed. Please try again or contact support.');
+        }
+        // Delete any existing pending registration for this email
+        await pendingRepository.delete({
+            email: data.email
+        });
+        // Create pending registration with hashed token for secure storage
+        const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
+        const passwordHash = await _bcrypt.hash(data.password, _config.BCRYPT_SALT_ROUNDS);
+        const expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
+        const pending = pendingRepository.create({
+            email: data.email,
+            name: data.name ?? null,
+            phone: data.phone ?? null,
+            passwordHash,
+            token: tokenHash,
+            expiresAt,
+            companyData: data.companyData ?? null
+        });
+        await pendingRepository.save(pending);
+        // Send verification email with raw token (user receives this)
+        const verifyUrl = `${data.verifyUrlBase}?token=${token}`;
+        await this.sendVerificationEmailSafe(data.email, token, verifyUrl, 'Registration');
+        return {
+            success: true,
+            message: 'Please check your email to verify your registration.'
+        };
+    }
+    // ============================================
+    // Password Reset (Existing Users)
+    // ============================================
+    /**
+   * Request password reset - sends reset email
+   */ async forgotPassword(email, resetUrlBase) {
+        this.assertEmailEnabled();
+        const userRepository = await this.getRepository(_userentity.User);
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
+        const user = await userRepository.findOne({
+            where: {
+                email
+            }
+        });
+        // Always return success to prevent email enumeration
+        if (!user || !user.isActive) {
+            this.logger.warn(`Password reset requested for non-existent/inactive email: ${email}`);
+            return {
+                success: true,
+                message: 'If the email exists, a password reset link has been sent.'
+            };
+        }
+        // Invalidate existing password reset tokens for this user
+        await tokenRepository.delete({
+            userId: user.id,
+            type: _usertokenentity.TokenType.PASSWORD_RESET
+        });
+        // Create new token with hashed storage
+        const token = this.generateToken();
+        const tokenHash = this.hashToken(token);
+        const userToken = tokenRepository.create({
+            userId: user.id,
+            type: _usertokenentity.TokenType.PASSWORD_RESET,
+            token: tokenHash,
+            expiresAt: new Date(Date.now() + this.PASSWORD_RESET_EXPIRY)
+        });
+        await tokenRepository.save(userToken);
+        // Send email with raw token
+        const resetUrl = `${resetUrlBase}?token=${token}`;
+        try {
+            await this.emailProvider.sendPasswordResetEmail(email, token, resetUrl);
+            this.logger.log(`Password reset email sent to: ${email}`);
+        } catch (error) {
+            this.logger.error(`Failed to send password reset email: ${this.getErrorMessage(error)}`);
+            throw new _common.BadRequestException('Failed to process request. Please try again later.');
+        }
+        return {
+            success: true,
+            message: 'If the email exists, a password reset link has been sent.'
+        };
+    }
+    /**
+   * Reset password using token
+   */ async resetPassword(token, newPassword) {
+        const userRepository = await this.getRepository(_userentity.User);
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
+        // Hash the incoming token to compare with stored hash
+        const tokenHash = this.hashToken(token);
+        const userToken = await tokenRepository.findOne({
+            where: {
+                token: tokenHash,
+                type: _usertokenentity.TokenType.PASSWORD_RESET
+            }
+        });
+        if (!userToken) {
+            throw new _common.BadRequestException('Invalid or expired reset token');
+        }
+        this.validateTokenNotExpiredOrUsed(userToken, 'Reset token has expired. Please request a new one.', 'This reset token has already been used.');
+        const user = await userRepository.findOne({
+            where: {
+                id: userToken.userId
+            }
+        });
+        if (!user) {
+            throw new _common.BadRequestException('User not found');
+        }
+        // Update password
+        user.password = await _bcrypt.hash(newPassword, _config.BCRYPT_SALT_ROUNDS);
+        await userRepository.save(user);
+        // Mark token as used
+        userToken.usedAt = new Date();
+        await tokenRepository.save(userToken);
+        this.logger.log(`Password reset successful for user: ${user.email}`);
+        return {
+            success: true,
+            message: 'Password has been reset successfully.'
+        };
+    }
+    // ============================================
+    // Email Verification
+    // ============================================
+    /**
+   * Verify email using token
+   * Handles both pending registration and existing user verification
+   */ async verifyEmail(token) {
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
+        const userRepository = await this.getRepository(_userentity.User);
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
+        // Hash the incoming token to compare with stored hash
+        const tokenHash = this.hashToken(token);
+        // Check for pending registration first
+        const pending = await pendingRepository.findOne({
+            where: {
+                token: tokenHash
+            }
+        });
+        if (pending) {
+            if (pending.expiresAt < new Date()) {
+                await pendingRepository.delete({
+                    id: pending.id
+                });
+                throw new _common.BadRequestException('Verification token has expired. Please register again.');
+            }
+            // Delete pending registration (will be consumed by caller to create user)
+            await pendingRepository.delete({
+                id: pending.id
+            });
+            return {
+                type: 'pending',
+                pending
+            };
+        }
+        // Check for existing user email verification token
+        const userToken = await tokenRepository.findOne({
+            where: {
+                token: tokenHash,
+                type: _usertokenentity.TokenType.EMAIL_VERIFICATION
+            }
+        });
+        if (!userToken) {
+            throw new _common.BadRequestException('Invalid or expired verification token');
+        }
+        if (userToken.expiresAt < new Date()) {
+            await tokenRepository.delete({
+                id: userToken.id
+            });
+            throw new _common.BadRequestException('Verification token has expired. Please request a new one.');
+        }
+        if (userToken.usedAt) {
+            return {
+                type: 'verified',
+                message: 'Email has already been verified.'
+            };
+        }
+        const user = await userRepository.findOne({
+            where: {
+                id: userToken.userId
+            }
+        });
+        if (!user) {
+            throw new _common.BadRequestException('User not found');
+        }
+        // Mark email as verified
+        user.emailVerified = true;
+        await userRepository.save(user);
+        // Mark token as used
+        userToken.usedAt = new Date();
+        await tokenRepository.save(userToken);
+        this.logger.log(`Email verified for user: ${user.email}`);
+        return {
+            type: 'verified',
+            message: 'Email has been verified successfully.'
+        };
+    }
+    /**
+   * Resend verification email - handles both pending registrations and existing users
+   */ async resendVerificationEmail(email, verifyUrlBase) {
+        this.assertEmailEnabled();
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
+        const userRepository = await this.getRepository(_userentity.User);
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
+        // Check pending registration first
+        const pending = await pendingRepository.findOne({
+            where: {
+                email
+            }
+        });
+        if (pending) {
+            const token = this.generateToken();
+            pending.token = this.hashToken(token);
+            pending.expiresAt = new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY);
+            await pendingRepository.save(pending);
+            const verifyUrl = `${verifyUrlBase}?token=${token}`;
+            await this.sendVerificationEmailSafe(email, token, verifyUrl, 'Re-sent registration');
+            return {
+                success: true,
+                message: 'If the email requires verification, a link has been sent.'
+            };
+        }
+        // Check existing user
+        const user = await userRepository.findOne({
+            where: {
+                email
+            }
+        });
+        if (!user || user.emailVerified) {
+            return {
+                success: true,
+                message: 'If the email requires verification, a link has been sent.'
+            };
+        }
+        // Invalidate existing tokens and create new one
+        await tokenRepository.delete({
+            userId: user.id,
+            type: _usertokenentity.TokenType.EMAIL_VERIFICATION
+        });
+        const token = this.generateToken();
+        const userToken = tokenRepository.create({
+            userId: user.id,
+            type: _usertokenentity.TokenType.EMAIL_VERIFICATION,
+            token: this.hashToken(token),
+            expiresAt: new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY)
+        });
+        await tokenRepository.save(userToken);
+        const verifyUrl = `${verifyUrlBase}?token=${token}`;
+        await this.sendVerificationEmailSafe(user.email, token, verifyUrl, 'Verification');
+        return {
+            success: true,
+            message: 'If the email requires verification, a link has been sent.'
+        };
+    }
+    // ============================================
+    // Cleanup
+    // ============================================
+    /**
+   * Clean up expired tokens and pending registrations
+   */ async cleanupExpired() {
+        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
+        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
+        const now = new Date();
+        const tokenResult = await tokenRepository.delete({
+            expiresAt: (0, _typeorm.LessThan)(now)
+        });
+        const pendingResult = await pendingRepository.delete({
+            expiresAt: (0, _typeorm.LessThan)(now)
+        });
+        const deletedTokens = tokenResult.affected ?? 0;
+        const deletedPending = pendingResult.affected ?? 0;
+        this.logger.log(`Cleaned up ${deletedTokens} expired tokens and ${deletedPending} expired pending registrations`);
+        return {
+            deletedTokens,
+            deletedPending
+        };
+    }
+    constructor(dataSourceProvider, emailProvider){
+        _define_property(this, "dataSourceProvider", void 0);
+        _define_property(this, "emailProvider", void 0);
+        _define_property(this, "logger", void 0);
+        _define_property(this, "PASSWORD_RESET_EXPIRY", void 0); // 1 hour
+        _define_property(this, "EMAIL_VERIFICATION_EXPIRY", void 0); // 24 hours
+        this.dataSourceProvider = dataSourceProvider;
+        this.emailProvider = emailProvider;
+        this.logger = new _common.Logger(AuthEmailService.name);
+        this.PASSWORD_RESET_EXPIRY = 60 * 60 * 1000;
+        this.EMAIL_VERIFICATION_EXPIRY = 24 * 60 * 60 * 1000;
+    }
+};
+AuthEmailService = _ts_decorate([
+    (0, _common.Injectable)({
+        scope: _common.Scope.REQUEST
+    }),
+    _ts_param(0, (0, _common.Optional)()),
+    _ts_param(0, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
+    _ts_param(1, (0, _common.Optional)()),
+    _ts_param(1, (0, _common.Inject)(_interfaces.AUTH_EMAIL_PROVIDER)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
+        typeof _interfaces.IAuthEmailProvider === "undefined" ? Object : _interfaces.IAuthEmailProvider
+    ])
+], AuthEmailService);