@fonderie/auth 5.0.0 → 5.0.1

package/dist/index.cjs

@@ -76,8 +76,10 @@ __export(index_exports, {
   importUser: () => importUser,
   normalizeEmail: () => normalizeEmail,
   normalizeEmailSafe: () => normalizeEmailSafe,
+  purgeSoftDeletedUsers: () => purgeSoftDeletedUsers,
   requireAuth: () => import_middlewares3.requireAuth,
   schemas: () => schemas_exports,
+  startUserRetention: () => startUserRetention,
   toUserDTO: () => toUserDTO,
   validate: () => import_middlewares.validate,
   validateAuthConfig: () => validateAuthConfig,
@@ -202,10 +204,18 @@ var updateProfileSchema = import_zod.z.object({
 var updatePreferencesSchema = import_zod.z.object({
   locale: import_zod.z.string().max(35).optional(),
   timezone: import_zod.z.string().max(64).optional(),
-  notifications: import_zod.z.unknown().optional(),
-  emailDigest: import_zod.z.unknown().optional(),
-  dateFormat: import_zod.z.unknown().optional(),
-  timeFormat: import_zod.z.unknown().optional()
+  // Typed at last — these four accepted `unknown`, letting null and
+  // arbitrary JSON into stored preferences that the user DTO then served
+  // against string-typed client fields.
+  notifications: import_zod.z.object({
+    email: import_zod.z.boolean().optional(),
+    inApp: import_zod.z.boolean().optional(),
+    sms: import_zod.z.boolean().optional(),
+    push: import_zod.z.boolean().optional()
+  }).optional(),
+  emailDigest: import_zod.z.string().max(20).optional(),
+  dateFormat: import_zod.z.string().max(30).optional(),
+  timeFormat: import_zod.z.string().max(30).optional()
 }).refine(
   (o) => Object.values(o).some((v) => v !== void 0),
   "Provide at least one preference field"
@@ -392,10 +402,16 @@ function generateTotpUri(email2, secret, issuer) {
   });
   return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(email2)}?${params}`;
 }
+function safeCodeEqual(a, b) {
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return (0, import_node_crypto2.timingSafeEqual)(bufA, bufB);
+}
 function verifyTotpToken(token, secret) {
   const t = timeCounter();
   for (let i = -DRIFT; i <= DRIFT; i++) {
-    if (hotp(secret, t + i) === token) {
+    if (safeCodeEqual(hotp(secret, t + i), token)) {
       return true;
     }
   }
@@ -408,6 +424,41 @@ function generateBackupCodes(count = 8) {
 // src/controllers/mfa.controller.ts
 init_password();
 
+// src/services/mfa-crypto.ts
+var import_node_crypto3 = require("crypto");
+var PREFIX = "mfa.v1:";
+function makeMfaCipher(keyHex) {
+  if (!keyHex) {
+    return { encrypt: (plain) => plain, decrypt: (stored) => stored };
+  }
+  const key = Buffer.from(keyHex, "hex");
+  if (key.length !== 32) {
+    throw new Error("[auth] mfaSecretKey must be 32 bytes (64 hex chars, e.g. `openssl rand -hex 32`)");
+  }
+  return {
+    encrypt(plain) {
+      const iv = (0, import_node_crypto3.randomBytes)(12);
+      const cipher = (0, import_node_crypto3.createCipheriv)("aes-256-gcm", key, iv);
+      const enc = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+      const tag = cipher.getAuthTag();
+      return `${PREFIX}${iv.toString("hex")}:${tag.toString("hex")}:${enc.toString("hex")}`;
+    },
+    decrypt(stored) {
+      if (!stored.startsWith(PREFIX)) return stored;
+      const [ivHex, tagHex, dataHex] = stored.slice(PREFIX.length).split(":");
+      if (!ivHex || !tagHex || !dataHex) {
+        throw new Error("[auth] malformed mfa secret ciphertext");
+      }
+      const decipher = (0, import_node_crypto3.createDecipheriv)("aes-256-gcm", key, Buffer.from(ivHex, "hex"));
+      decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+      return Buffer.concat([
+        decipher.update(Buffer.from(dataHex, "hex")),
+        decipher.final()
+      ]).toString("utf8");
+    }
+  };
+}
+
 // src/dtos/user.ts
 var import_core2 = require("@fonderie/core");
 var DEFAULT_PREFERENCES = {
@@ -418,8 +469,27 @@ var DEFAULT_PREFERENCES = {
   dateFormat: "MM/DD/YYYY",
   timeFormat: "hh:mm A"
 };
+function cleanPreferences(prefs) {
+  const out = {};
+  if (typeof prefs.locale === "string") out.locale = prefs.locale;
+  if (typeof prefs.timezone === "string") out.timezone = prefs.timezone;
+  if (typeof prefs.emailDigest === "string") out.emailDigest = prefs.emailDigest;
+  if (typeof prefs.dateFormat === "string") out.dateFormat = prefs.dateFormat;
+  if (typeof prefs.timeFormat === "string") out.timeFormat = prefs.timeFormat;
+  return out;
+}
+function cleanNotifications(value) {
+  if (!value || typeof value !== "object") return {};
+  const out = {};
+  for (const key of ["email", "inApp", "sms", "push"]) {
+    const v = value[key];
+    if (typeof v === "boolean") out[key] = v;
+  }
+  return out;
+}
 function toUserDTO(user, phoneVerified = false) {
   const prefs = user.preferences ?? {};
+  const cleaned = cleanPreferences(prefs);
   return {
     id: (0, import_core2.stringOrEmpty)(user.id),
     email: (0, import_core2.stringOrEmpty)(user.email),
@@ -431,9 +501,13 @@ function toUserDTO(user, phoneVerified = false) {
     lastLogin: user.lastLogin instanceof Date ? user.lastLogin.toISOString() : "",
     preferences: {
       ...DEFAULT_PREFERENCES,
-      ...prefs,
-      locale: user.locale || prefs.locale || "en-US",
-      timezone: user.timezone || prefs.timezone || "UTC"
+      ...cleaned,
+      notifications: {
+        ...DEFAULT_PREFERENCES.notifications,
+        ...cleanNotifications(prefs.notifications)
+      },
+      locale: user.locale || cleaned.locale || "en-US",
+      timezone: user.timezone || cleaned.timezone || "UTC"
     },
     isEmailVerified: user.emailVerifiedAt !== null,
     isPhoneVerified: phoneVerified,
@@ -464,7 +538,6 @@ var USER_COLUMNS = `
 	whitelist,
 	ip_whitelist       AS "ipWhitelist",
 	mfa_enabled        AS "mfaEnabled",
-	mfa_secret         AS "mfaSecret",
 	email_verified_at  AS "emailVerifiedAt",
 	deleted_at         AS "deletedAt",
 	created_at         AS "createdAt",
@@ -673,6 +746,25 @@ var SessionModel = class {
   async delete(token) {
     await this.store.query(`DELETE FROM fonderie_sessions WHERE token = $1`, [token]);
   }
+  // Revoke every session for a user (e.g. on password change). Access tokens
+  // bound to these sessions via the sid claim die on their next request.
+  async deleteByUser(userId) {
+    await this.store.query(`DELETE FROM fonderie_sessions WHERE user_id = $1`, [userId]);
+  }
+  // Session metadata for a user (no tokens) — for the data-export / SAR bundle.
+  async listByUser(userId) {
+    return this.store.query(
+      `SELECT id,
+			        user_agent AS "userAgent",
+			        ip_address AS "ipAddress",
+			        created_at AS "createdAt",
+			        expires_at AS "expiresAt"
+			 FROM fonderie_sessions
+			 WHERE user_id = $1
+			 ORDER BY created_at DESC`,
+      [userId]
+    );
+  }
   async exists(token) {
     const rows = await this.store.query(
       `SELECT id FROM fonderie_sessions WHERE token = $1 AND expires_at > now()`,
@@ -730,6 +822,7 @@ function mfaController(store, config, issuer, bus) {
   const users = new UserModel(store);
   const sessions = new SessionModel(store);
   const backupCodes = new BackupCodeModel(store);
+  const mfaCipher = makeMfaCipher(config.mfaSecretKey);
   return {
     // ── 1. Setup ───────────────────────────────────────────────
     setup: async (ctx) => {
@@ -739,7 +832,7 @@ function mfaController(store, config, issuer, bus) {
       const codeHashes = await Promise.all(plainCodes.map((c) => hashPassword(c)));
       const qr = await import_qrcode.default.toDataURL(uri);
       await Promise.all([
-        users.saveMfaPendingSecret(ctx.user.id, secret),
+        users.saveMfaPendingSecret(ctx.user.id, mfaCipher.encrypt(secret)),
         backupCodes.replace(ctx.user.id, codeHashes)
       ]);
       return (0, import_core3.setApiResponse)(
@@ -761,7 +854,8 @@ function mfaController(store, config, issuer, bus) {
       if (typeof token !== "string") {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.UNPROCESSABLE, "INVALID_PARAMETER", "token is required");
       }
-      const pendingSecret = await users.getMfaPendingSecret(ctx.user.id);
+      const pendingCipher = await users.getMfaPendingSecret(ctx.user.id);
+      const pendingSecret = pendingCipher ? mfaCipher.decrypt(pendingCipher) : null;
       if (pendingSecret) {
         if (!verifyTotpToken(token, pendingSecret)) {
           return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
@@ -808,10 +902,11 @@ function mfaController(store, config, issuer, bus) {
             "Use the mfaToken from the login response"
           );
         }
-        const secret = await users.getMfaSecret(ctx.user.id);
-        if (!secret) {
+        const storedSecret = await users.getMfaSecret(ctx.user.id);
+        if (!storedSecret) {
           return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_CONFIGURED", "MFA not configured");
         }
+        const secret = mfaCipher.decrypt(storedSecret);
         if (!verifyTotpToken(token, secret)) {
           return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid MFA token");
         }
@@ -820,7 +915,8 @@ function mfaController(store, config, issuer, bus) {
         }
       }
       const { accessToken, refreshToken, sid } = issueTokenPair(ctx.user.id, config, {
-        loginMethod: ctx.user.loginMethod
+        loginMethod: ctx.user.loginMethod,
+        phoneVerified: ctx.user.phoneVerified
       });
       await sessions.create(ctx.user.id, refreshToken, refreshTokenExpiry(refreshToken), sid);
       const fullUser = await users.findById(ctx.user.id);
@@ -833,7 +929,7 @@ function mfaController(store, config, issuer, bus) {
           explanation: "MFA verified successfully.",
           result: {
             tokens: { access: accessToken, refresh: refreshToken },
-            user: toUserDTO(fullUser)
+            user: toUserDTO(fullUser, ctx.user.phoneVerified)
           }
         },
         {
@@ -852,7 +948,8 @@ function mfaController(store, config, issuer, bus) {
       if (!ctx.user.mfaEnabled) {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_ENABLED", "MFA is not enabled");
       }
-      const secret = await users.getMfaSecret(ctx.user.id);
+      const storedSecret = await users.getMfaSecret(ctx.user.id);
+      const secret = storedSecret ? mfaCipher.decrypt(storedSecret) : null;
       if (!secret || !verifyTotpToken(token, secret)) {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
       }
@@ -881,7 +978,8 @@ function mfaController(store, config, issuer, bus) {
       if (!user || !user.mfaEnabled) {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.BAD_REQUEST, "MFA_NOT_ENABLED", "MFA is not enabled");
       }
-      const secret = user.mfaSecret;
+      const storedSecret = await users.getMfaSecret(ctx.user.id);
+      const secret = storedSecret ? mfaCipher.decrypt(storedSecret) : null;
       if (!secret || !verifyTotpToken(token, secret)) {
         return (0, import_core3.setApiResponse)(import_core3.HTTP.UNAUTHORIZED, "INVALID_CODE", "Invalid TOTP code");
       }
@@ -899,7 +997,7 @@ function mfaController(store, config, issuer, bus) {
 }
 
 // src/controllers/auth.controller.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_events2 = require("@fonderie/events");
 var import_core4 = require("@fonderie/core");
 
@@ -1123,7 +1221,7 @@ function authController(store, config, bus) {
         if (!row) {
           return (0, import_core4.setApiResponse)(import_core4.HTTP.SERVER_ERROR, "SERVER_ERROR", "Registration failed");
         }
-        const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+        const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
         await emailVerif.create(row.id, pin, expiresAt);
         const user = await users.findById(row.id);
@@ -1187,7 +1285,7 @@ function authController(store, config, bus) {
           firstName ?? null,
           lastName ?? null
         );
-        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(id, normalizePhone(phone2), otp, expiresAt);
         const user = await users.findById(id);
@@ -1315,7 +1413,7 @@ function authController(store, config, bus) {
             "Account suspended. Please contact support."
           );
         }
-        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
         const expiresAt = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(user.id, normalizePhone(phone2), otp, expiresAt);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1430,7 +1528,7 @@ function authController(store, config, bus) {
           "Password reset email sent (if account exists)."
         );
       }
-      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60);
       await passwordReset.create(user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1597,7 +1695,7 @@ function authController(store, config, bus) {
             }
           );
         }
-        const otp = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+        const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
         const expiresAt2 = new Date(Date.now() + OTP_TTL_MS);
         await phoneVerif.upsert(ctx.user.id, phone2, otp, expiresAt2);
         bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1637,7 +1735,7 @@ function authController(store, config, bus) {
           }
         );
       }
-      const pin = (0, import_node_crypto3.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       bus?.emit(import_events2.NOTIFICATION_EVENT, {
@@ -1655,7 +1753,7 @@ function authController(store, config, bus) {
 }
 
 // src/controllers/user.controller.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var import_core5 = require("@fonderie/core");
 var import_events3 = require("@fonderie/events");
 function normalizePhone2(phone2) {
@@ -1666,6 +1764,7 @@ function isValidPhone2(phone2) {
 }
 function userController(store, config, bus) {
   const users = new UserModel(store);
+  const sessions = new SessionModel(store);
   const emailVerif = new EmailVerificationModel(store);
   const phoneVerif = new PhoneVerificationModel(store);
   return {
@@ -1748,7 +1847,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "EMAIL_IN_USE", "Email already in use");
       }
-      const pin = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+      const pin = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 1e3 * 60 * 60 * 24);
       await emailVerif.replace(ctx.user.id, pin, expiresAt);
       await users.updateEmail(ctx.user.id, normalised);
@@ -1792,7 +1891,7 @@ function userController(store, config, bus) {
       if (existing) {
         return (0, import_core5.setApiResponse)(import_core5.HTTP.CONFLICT, "PHONE_IN_USE", "Phone number already in use");
       }
-      const otp = (0, import_node_crypto4.randomInt)(1e5, 1e6).toString();
+      const otp = (0, import_node_crypto5.randomInt)(1e5, 1e6).toString();
       const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
       await phoneVerif.upsert(ctx.user.id, normalised, otp, expiresAt);
       await users.updatePhone(ctx.user.id, normalised);
@@ -1840,6 +1939,7 @@ function userController(store, config, bus) {
       }
       const hash = await hashPassword2(newPassword);
       await users.updatePassword(ctx.user.id, hash);
+      await sessions.deleteByUser(ctx.user.id);
       return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "PASSWORD_CHANGED", "Password updated successfully.");
     },
     deleteMe: async (ctx) => {
@@ -1859,6 +1959,42 @@ function userController(store, config, bus) {
           headers: cookieHeaders(clearedTokenCookies(config))
         }
       );
+    },
+    // Subject Access Request — the authenticated user's own data as a portable
+    // JSON bundle. Only auth-owned data, and only safe fields: no password hash,
+    // no MFA secret, no session tokens (session metadata only).
+    exportMe: async (ctx) => {
+      const user = await users.findById(ctx.user.id);
+      if (!user) return (0, import_core5.setApiResponse)(import_core5.HTTP.NOT_FOUND, "NOT_FOUND", "User not found");
+      const sessionRows = await sessions.listByUser(ctx.user.id);
+      const bundle = {
+        exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        profile: toUserDTO(user, ctx.user.phoneVerified),
+        sessions: sessionRows.map((s) => ({
+          id: s.id,
+          userAgent: s.userAgent,
+          ipAddress: s.ipAddress,
+          createdAt: s.createdAt instanceof Date ? s.createdAt.toISOString() : s.createdAt,
+          expiresAt: s.expiresAt instanceof Date ? s.expiresAt.toISOString() : s.expiresAt
+        })),
+        security: {
+          mfaEnabled: user.mfaEnabled === true,
+          emailVerified: user.emailVerifiedAt !== null
+        }
+      };
+      const contributors = config.dataExportContributors ?? [];
+      if (contributors.length > 0) {
+        const modules = {};
+        for (const c of contributors) {
+          try {
+            modules[c.name] = await c.collect(ctx.user.id);
+          } catch {
+            modules[c.name] = null;
+          }
+        }
+        bundle["modules"] = modules;
+      }
+      return (0, import_core5.setApiResponse)(import_core5.HTTP.OK, "DATA_EXPORT", "Your account data.", bundle);
     }
   };
 }
@@ -2003,6 +2139,7 @@ function buildAuthRoutes(store, config, bus) {
     R("updatePhone", "PUT", "/users/phone", import_middlewares2.requireAuth, verifyGate, (0, import_middlewares.validate)(updatePhoneSchema), user.updatePhone),
     R("changePassword", "PUT", "/users/password", import_middlewares2.requireAuth, (0, import_middlewares.validate)(changePasswordSchema), user.changePassword),
     R("deleteMe", "DELETE", "/users", import_middlewares2.requireAuth, verifyGate, user.deleteMe),
+    R("exportMe", "GET", "/users/export", import_middlewares2.requireAuth, user.exportMe),
     // MFA (email sessions only — requireVerified is always enforced here
     // because MFA is a security feature and email verification is meaningful)
     R("mfaSetup", "POST", "/auth/mfa/setup", import_middlewares2.requireAuth, requireEmailLogin, import_middlewares2.requireVerified, mfa.setup),
@@ -2044,10 +2181,40 @@ function collectAuthConfigProblems(config) {
   if (config.secureCookies === false) {
     problems.push({
       module: MODULE,
-      severity: "warning",
+      severity: process.env["NODE_ENV"] === "production" ? "error" : "warning",
       message: "secureCookies is false \u2014 auth cookies may be sent over non-HTTPS connections in production"
     });
   }
+  if (config.google) {
+    const clientSecret = config.google.clientSecret ?? "";
+    if (!clientSecret || !config.google.clientId || !config.google.redirectUri) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "google OAuth is configured but clientId, clientSecret, or redirectUri is missing"
+      });
+    } else if (PLACEHOLDER_SECRET.test(clientSecret)) {
+      problems.push({
+        module: MODULE,
+        severity: "error",
+        message: "google.clientSecret looks like a placeholder or dev-default value"
+      });
+    }
+  }
+  if (config.mfa && !config.mfaSecretKey) {
+    problems.push({
+      module: MODULE,
+      severity: process.env["NODE_ENV"] === "production" ? "error" : "warning",
+      message: "mfa is enabled without mfaSecretKey \u2014 TOTP secrets are stored plaintext at rest; set a 32-byte key (openssl rand -hex 32)"
+    });
+  }
+  if (config.mfaSecretKey && !/^[0-9a-fA-F]{64}$/.test(config.mfaSecretKey)) {
+    problems.push({
+      module: MODULE,
+      severity: "error",
+      message: "mfaSecretKey must be 64 hex characters (32 bytes, e.g. `openssl rand -hex 32`)"
+    });
+  }
   return problems;
 }
 function validateAuthConfig(config) {
@@ -2168,6 +2335,41 @@ async function importUser(store, user) {
   if (!row) throw new Error("[auth] importUser: insert returned no row");
   return row;
 }
+
+// src/services/retention.ts
+async function purgeSoftDeletedUsers(store, { olderThanDays }) {
+  if (!Number.isFinite(olderThanDays) || olderThanDays < 0) {
+    throw new Error("[auth] purgeSoftDeletedUsers: olderThanDays must be a non-negative number");
+  }
+  const rows = await store.query(
+    `DELETE FROM fonderie_users
+		 WHERE deleted_at IS NOT NULL
+		   AND deleted_at < now() - make_interval(days => $1)
+		 RETURNING id`,
+    [olderThanDays]
+  );
+  return rows.length;
+}
+function startUserRetention(store, options) {
+  const intervalMs = options.intervalMs ?? 24 * 60 * 60 * 1e3;
+  let stopped = false;
+  const run = async () => {
+    if (stopped) return;
+    try {
+      const deleted = await purgeSoftDeletedUsers(store, { olderThanDays: options.olderThanDays });
+      options.onPurge?.(deleted);
+    } catch (err) {
+      console.error("[auth] scheduled user retention purge failed:", err);
+    }
+  };
+  const timer = setInterval(run, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
+  void run();
+  return { stop: () => {
+    stopped = true;
+    clearInterval(timer);
+  } };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AUTH_CONFIG_KEYS,
@@ -2178,8 +2380,10 @@ async function importUser(store, user) {
   importUser,
   normalizeEmail,
   normalizeEmailSafe,
+  purgeSoftDeletedUsers,
   requireAuth,
   schemas,
+  startUserRetention,
   toUserDTO,
   validate,
   validateAuthConfig,