@hed-hog/core 0.0.4

package/src/auth/auth.service.ts

@@ -0,0 +1,554 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { PrismaService } from '@hed-hog/api-prisma';
+import { User } from '@hed-hog/types';
+import {
+  BadRequestException,
+  forwardRef,
+  Inject,
+  Injectable,
+  OnModuleInit,
+} from '@nestjs/common';
+import { ChallengeService } from '../challenge/challenge.service';
+import { MailService as MailManagerService } from '../mail/mail.service';
+import { SecurityService } from '../security/security.service';
+import { SessionService } from '../session/session.service';
+import { SettingService } from '../setting/setting.service';
+import { TokenService } from '../token/token.service';
+import { UserService } from '../user/user.service';
+import { ForgetDTO } from './dto/forget.dto';
+import { LoginDTO } from './dto/login.dto';
+
+@Injectable()
+export class AuthService implements OnModuleInit {
+  public settings: Record<string, any> = {};
+
+  constructor(
+    @Inject(forwardRef(() => PrismaService))
+    private readonly prisma: PrismaService,
+    @Inject(forwardRef(() => MailManagerService))
+    private readonly mail: MailManagerService,
+    @Inject(forwardRef(() => SettingService))
+    private readonly setting: SettingService,
+    @Inject(forwardRef(() => SecurityService))
+    private readonly security: SecurityService,
+    @Inject(forwardRef(() => TokenService))
+    private readonly token: TokenService,
+    @Inject(forwardRef(() => SessionService))
+    private readonly session: SessionService,
+    @Inject(forwardRef(() => UserService))
+    private readonly user: UserService,
+    @Inject(forwardRef(() => ChallengeService))
+    private readonly challenge: ChallengeService,
+  ) { }
+
+  async onModuleInit() {
+    this.settings = await this.setting.getSettingValues([
+      'mfa-issuer',
+      'mfa-window',
+      'mfa-setp',
+      'system-name',
+      'google_client_id',
+      'google_client_secret',
+      'google_scopes',
+      'url',
+      'mfa-challenge-expiration-minutes',
+      'access-token-expiration-minutes'
+    ]);
+  }
+
+  async getAuthenticationPayload(locale: string, userId: number, ipAddress: string,
+    userAgent: string) {
+    const payload = { sub: userId };
+    const accessToken = await this.token.createAccessToken(payload);
+    const { token: refreshToken, session } = await this.session.create(locale, userId, ipAddress, userAgent);
+
+    return {
+      accessToken,
+      refreshToken,
+      session,
+    }
+
+  }
+
+  async loginWithEmailAndPassword(
+    locale: string,
+    ipAddress: string,
+    userAgent: string,
+    { email, password }: LoginDTO,
+  ) {
+    const user = await this.user.findUserByEmail(locale, email);
+    if (!user) throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    const credentials = (user as unknown as User).user_credential?.filter((c) => c.type === 'password') || [];
+
+    if (!await this.security.validatePassword(locale, credentials, password)) {
+      throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    const mfaMethods = await this.prisma.user_mfa.findMany({
+      where: { 
+        user_id: user.id,
+        verified_at: { not: null }
+      },
+      include: {
+        user_mfa_totp: true,
+        user_mfa_email: true
+      }
+    });
+
+    if (mfaMethods.length > 0) {
+      const mfaToken = await this.token.createMfaChallengeToken({
+        userId: user.id,
+        ipAddress,
+        userAgent,
+        email
+      });
+
+      const emailMfas = mfaMethods.filter(m => m.type === 'email' && m.user_mfa_email && m.user_mfa_email.length > 0);
+
+      if (emailMfas.length > 0) {
+        const emails = emailMfas.map(mfa => mfa.user_mfa_email[0].email);
+        await this.challenge.sendMfaCodeToMultipleEmails(locale, user.id, emails);
+      }
+
+      return { 
+        requiresMfa: true, 
+        mfaToken,
+        mfaMethods: mfaMethods.map(m => ({ type: m.type, id: m.id }))
+      };
+    }
+
+    const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(
+      locale,
+      user.id,
+      ipAddress,
+      userAgent
+    );
+
+    this.mail.sendTemplatedMail(
+      locale,
+      {
+        email,
+        slug: 'auth-login-new-device',
+        variables: {
+          name: user.name,
+          ipAddress,
+          userAgent,
+          location: 'Unknown',
+        }
+      }
+    );
+
+    await this.user.registerUserActivity(user.id, "login")
+    return { accessToken, refreshToken, session };
+  }
+
+  async verifyUser(locale: string, userId: number) {
+    const user = await this.user.findUserById(locale, userId);
+    delete user.user_credential;
+    return user;
+  }
+
+  async refreshAccessToken(locale: string, refreshToken: string, ipAddress: string, userAgent: string) {
+
+    if (!refreshToken) {
+      throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    const { session, token } = await this.session.refresh(
+      locale,
+      refreshToken,
+      ipAddress,
+      userAgent
+    );
+
+    const user = await this.user.findUserById(locale, session.user_id);
+    const payload = { sub: user.id };
+    const accessToken = await this.token.createAccessToken(payload);
+
+    return { accessToken, refreshToken: token, session };
+
+  }
+
+  async forgotPassword(locale: string, { email }: ForgetDTO) {
+    const user = await this.user.findUserByEmail(locale, email);
+    if (user){
+      await this.user.registerUserActivity(user?.id, "forgotPassword")
+    }
+    await this.challenge.forgotEmail(locale, email);
+    return { success: true };
+  }
+
+  async logout(res, req, refreshToken: string) {
+    await this.session.deleteRefreshTokenCookie(res, refreshToken);
+    await this.user.registerUserActivity(req.auth?.sub, "logout")
+    return { success: true };
+  }
+
+  async forgotResetPassword(locale: string, password: string, code: string, ipAddress: string, userAgent: string) {
+    const challenge = await this.challenge.verifyCodePassword(locale, code);
+    const passwordHash = await this.security.hashArgon2(password);
+
+    await this.prisma.user_credential.updateMany({
+      where: {
+        type: 'password',
+        user: {
+          user_mfa: {
+            some: {
+              user_mfa_challenge: {
+                some: { id: challenge.id }
+              }
+            }
+          }
+        }
+      },
+      data: { hash: passwordHash },
+    });
+
+
+    const userIdentifier = await this.prisma.user_identifier.findFirst({
+      where: {
+        type: 'email',
+        user_id: challenge.user_mfa.user_id
+      },
+      include: {
+        user: {
+          select: { name: true }
+        }
+      }
+    });
+
+    if (!userIdentifier) {
+      throw new BadRequestException(getLocaleText('userIdentifierNotFound', locale, 'User identifier not found.'));
+    }
+
+    this.mail.sendTemplatedMail(
+      locale,
+      {
+        email: userIdentifier.value,
+        slug: 'auth-forget-password-confirmation',
+        variables: {
+          name: userIdentifier.user.name,
+        }
+      }
+    );
+
+    const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(locale, challenge.user_mfa.user_id, ipAddress, userAgent);
+    await this.user.registerUserActivity(userIdentifier.id, "resetPassword")
+    return { accessToken, refreshToken, session }
+  }
+
+  async verifyMfaCode(locale: string, mfaToken: string, code: string, ipAddress: string, userAgent: string, methodType?: 'totp' | 'email' | 'recovery') {
+    const payload = await this.token.verifyMfaChallengeToken(mfaToken);
+    const user = await this.prisma.user.findUnique({
+      where: { id: payload.userId },
+      include: {
+        user_mfa: {
+          where: { verified_at: { not: null } },
+          include: {
+            user_mfa_totp: true,
+            user_mfa_email: true
+          }
+        },
+        user_recovery_code: true
+      }
+    });
+
+    if (!user) {
+      throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    let isValid = false;
+
+    if (methodType === 'totp') {
+      const totpMfa = user.user_mfa.find(m => m.type === 'totp' && m.user_mfa_totp);
+      if (totpMfa && totpMfa.user_mfa_totp[0]) {
+        const secretBuffer = totpMfa.user_mfa_totp[0].secret;
+        const secret = secretBuffer instanceof Uint8Array
+          ? Buffer.from(secretBuffer).toString('utf-8')
+          : String(secretBuffer);
+
+        const window = this.settings['mfa-window'] ?? 0;
+        const step = this.settings['mfa-setp'] ?? 30;
+
+        const speakeasy = require('speakeasy');
+        isValid = speakeasy.totp.verify({
+          secret,
+          encoding: 'base32',
+          token: code,
+          window,
+          step
+        });
+      }
+    } else if (methodType === 'email') {
+      const emailMfa = user.user_mfa.find(m => m.type === 'email');
+      if (emailMfa) {
+        isValid = await this.challenge.verifyMfaEmailCode(locale, user.id, code);
+      }
+    } else if (methodType === 'recovery') {
+      for (const recoveryCode of user.user_recovery_code) {
+        if (await this.security.verifyArgon2(code, recoveryCode.hash)) {
+          isValid = true;
+          await this.prisma.user_recovery_code.delete({
+            where: { id: recoveryCode.id }
+          });
+          break;
+        }
+      }
+    } else {
+      const totpMfa = user.user_mfa.find(m => m.type === 'totp' && m.user_mfa_totp);
+      if (totpMfa && totpMfa.user_mfa_totp[0]) {
+        const secretBuffer = totpMfa.user_mfa_totp[0].secret;
+        const secret = secretBuffer instanceof Uint8Array
+          ? Buffer.from(secretBuffer).toString('utf-8')
+          : String(secretBuffer);
+
+        const window = this.settings['mfa-window'] ?? 0;
+        const step = this.settings['mfa-setp'] ?? 30;
+
+        const speakeasy = require('speakeasy');
+        isValid = speakeasy.totp.verify({
+          secret,
+          encoding: 'base32',
+          token: code,
+          window,
+          step
+        });
+      }
+
+      if (!isValid) {
+        const emailMfa = user.user_mfa.find(m => m.type === 'email');
+        if (emailMfa) {
+          isValid = await this.challenge.verifyMfaEmailCode(locale, user.id, code);
+        }
+      }
+    }
+
+    if (!isValid) {
+      throw new BadRequestException(getLocaleText('invalidMfaCode', locale, 'Invalid MFA code.'));
+    }
+
+    const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(
+      locale,
+      user.id,
+      ipAddress,
+      userAgent
+    );
+
+    this.mail.sendTemplatedMail(
+      locale,
+      {
+        email: payload.email,
+        slug: 'auth-login-new-device',
+        variables: {
+          name: user.name,
+          ipAddress,
+          userAgent,
+          location: 'Unknown',
+        }
+      }
+    );
+
+    await this.user.registerUserActivity(user.id, "login");
+    return { accessToken, refreshToken, session };
+  }
+
+  async verifyMfaRecoveryCode(locale: string, mfaToken: string, recoveryCode: string, ipAddress: string, userAgent: string) {
+    const payload = await this.token.verifyMfaChallengeToken(mfaToken);
+    const user = await this.prisma.user.findUnique({
+      where: { id: payload.userId },
+      include: {
+        user_recovery_code: true
+      }
+    });
+
+    if (!user) {
+      throw new BadRequestException(getLocaleText('accessDenied', locale, 'Access denied.'));
+    }
+
+    let isValid = false;
+    for (const code of user.user_recovery_code) {
+      if (await this.security.verifyArgon2(recoveryCode, code.hash)) {
+        isValid = true;
+        await this.prisma.user_recovery_code.delete({
+          where: { id: code.id }
+        });
+        break;
+      }
+    }
+
+    if (!isValid) {
+      throw new BadRequestException(getLocaleText('invalidRecoveryCode', locale, 'Invalid recovery code.'));
+    }
+
+    const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(
+      locale,
+      user.id,
+      ipAddress,
+      userAgent
+    );
+
+    await this.user.registerUserActivity(user.id, "login");
+    return { accessToken, refreshToken, session };
+  }
+
+  async resendMfaCode(locale: string, mfaToken: string) {
+    const payload = await this.token.verifyMfaChallengeToken(mfaToken);
+    
+    const mfaMethods = await this.prisma.user_mfa.findMany({
+      where: { 
+        user_id: payload.userId,
+        verified_at: { not: null },
+        type: 'email'
+      },
+      include: {
+        user_mfa_email: true
+      }
+    });
+
+    if (mfaMethods.length === 0) {
+      throw new BadRequestException(getLocaleText('noEmailMfaFound', locale, 'No email MFA method found for this user.'));
+    }
+
+    const emailMfa = mfaMethods[0];
+    if (!emailMfa.user_mfa_email || emailMfa.user_mfa_email.length === 0) {
+      throw new BadRequestException(getLocaleText('noEmailMfaFound', locale, 'No email MFA method found for this user.'));
+    }
+
+    await this.challenge.sendMfaCodeByEmail(locale, payload.userId, emailMfa.user_mfa_email[0].email);
+    
+    return { 
+      success: true,
+      hasEmailMfa: true 
+    };
+  }
+
+  async generateWebAuthnAuthenticationOptions(mfaToken: string) {
+    const { generateAuthenticationOptions } = await import('@simplewebauthn/server');
+    const payload = await this.token.verifyMfaChallengeToken(mfaToken);
+
+    const user = await this.prisma.user.findFirst({
+      where: { id: payload.userId },
+      include: {
+        user_mfa: {
+          where: { type: 'webauthn', verified_at: { not: null } },
+          include: { user_mfa_webauthn: true }
+        }
+      }
+    });
+
+    if (!user || user.user_mfa.length === 0) {
+      throw new BadRequestException(getLocaleText('webauthnNotConfigured', 'en', 'WebAuthn not configured.'));
+    }
+
+    const rpID = new URL(process.env.FRONTEND_URL || 'http://localhost:3200').hostname;
+
+    const allowCredentials = user.user_mfa
+      .filter(mfa => mfa.user_mfa_webauthn && mfa.user_mfa_webauthn.length > 0)
+      .map(mfa => ({
+        id: Buffer.from(mfa.user_mfa_webauthn[0].credential_id).toString('base64url'),
+      }));
+
+    const options = await generateAuthenticationOptions({
+      rpID,
+      allowCredentials,
+      userVerification: 'preferred',
+    });
+
+    await this.prisma.user_mfa_challenge.create({
+      data: {
+        user_mfa_id: user.user_mfa[0].id,
+        hash: options.challenge,
+        attempts: 0,
+        expires_at: new Date(Date.now() + 5 * 60 * 1000),
+      }
+    });
+
+    return options;
+  }
+
+  async verifyWebAuthnAuthentication(locale: string, mfaToken: string, assertionResponse: any, ipAddress: string, userAgent: string) {
+    const { verifyAuthenticationResponse } = await import('@simplewebauthn/server');
+    const payload = await this.token.verifyMfaChallengeToken(mfaToken);
+    const userId = payload.userId;
+
+    const challengeRecord = await this.prisma.user_mfa_challenge.findFirst({
+      where: {
+        user_mfa: {
+          user_id: userId,
+          type: 'webauthn',
+          verified_at: { not: null },
+        },
+        verified_at: null,
+        expires_at: { gt: new Date() }
+      },
+      include: {
+        user_mfa: {
+          include: { user_mfa_webauthn: true }
+        }
+      },
+      orderBy: { created_at: 'desc' }
+    });
+
+    if (!challengeRecord || !challengeRecord.user_mfa.user_mfa_webauthn[0]) {
+      throw new BadRequestException(getLocaleText('challengeNotFound', locale, 'Challenge not found or expired.'));
+    }
+
+    const authenticator = challengeRecord.user_mfa.user_mfa_webauthn[0];
+    const rpID = new URL(process.env.FRONTEND_URL || 'http://localhost:3200').hostname;
+    const expectedOrigin = process.env.FRONTEND_URL || 'http://localhost:3200';
+
+    const verification = await verifyAuthenticationResponse({
+      response: assertionResponse,
+      expectedChallenge: challengeRecord.hash,
+      expectedOrigin,
+      expectedRPID: rpID,
+      credential: {
+        id: Buffer.from(authenticator.credential_id).toString('base64url'),
+        publicKey: authenticator.public_key,
+        counter: authenticator.sign_count,
+      },
+    });
+
+    if (!verification.verified) {
+      throw new BadRequestException(getLocaleText('verificationFailed', locale, 'Verification failed.'));
+    }
+
+    await this.prisma.user_mfa_webauthn.update({
+      where: { id: authenticator.id },
+      data: {
+        sign_count: verification.authenticationInfo.newCounter,
+        last_used_at: new Date(),
+      }
+    });
+
+    await this.prisma.user_mfa_challenge.update({
+      where: { id: challengeRecord.id },
+      data: { verified_at: new Date() }
+    });
+
+    const { accessToken, refreshToken, session } = await this.getAuthenticationPayload(
+      locale,
+      userId,
+      ipAddress,
+      userAgent
+    );
+
+    const user = await this.prisma.user.findFirst({ where: { id: userId } });
+    this.mail.sendTemplatedMail(
+      locale,
+      {
+        email: payload.email,
+        slug: 'auth-login-new-device',
+        variables: {
+          name: user.name,
+          ipAddress,
+          userAgent,
+          location: 'Unknown',
+        }
+      }
+    );
+
+    await this.user.registerUserActivity(userId, 'login');
+    return { accessToken, refreshToken, session };
+  }
+}

package/src/auth/consts/body.ts

@@ -0,0 +1,27 @@
+export const getBody = (url: string): string => {
+  return `
+        <body style="font-family: Arial, sans-serif; background-color: #eef2f7; color: #333; margin: 0; padding: 0;">
+                <div style="max-width: 600px; margin: 40px auto; background-color: #ffffff; border: 1px solid #dcdfe6; border-radius: 10px; padding: 40px; box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);">
+                        <div style="text-align: center; margin-bottom: 30px;">
+                                <img style="margin-bottom: 16px" src="https://coinbitclub.vip/_next/image?url=%2F_next%2Fstatic%2Fmedia%2Fcoinbitclub-logo.b29de722.png&w=640&q=75" alt="Coinbitclub Logo" />
+                                <h1 style="color: #2c3e50; font-size: 26px; margin: 0;">Recuperação de Senha - CoinBitClub</h1>
+                        </div>
+                        <div style="line-height: 1.8; font-size: 16px; color: #555; text-align: justify;">
+                                <p>Olá,</p>
+                                <p>Recebemos uma solicitação para redefinir sua senha em nossa plataforma. Para garantir que você é o proprietário desta conta, criamos um link exclusivo para redefinir sua senha.</p>
+                                <p>Se você não fez essa solicitação, entre em contato conosco imediatamente para garantir a segurança de sua conta.</p>
+                                <p>Para redefinir sua senha, clique no botão abaixo:</p>
+                        </div>
+                        <div style="text-align: center; margin: 30px 0;">
+                                <a href="${url}" style="display: inline-block; padding: 15px 30px; background-color: #3498db; color: #ffffff; text-decoration: none; font-size: 16px; font-weight: bold; border-radius: 8px; box-shadow: 0 2px 5px rgba(0, 0, 0, 0.2);">Redefinir Senha</a>
+                        </div>
+                        <div style="font-size: 14px; line-height: 1.7; color: #666;">
+                                <p>Por razões de segurança, evite compartilhar suas informações de login ou clicar em links suspeitos.</p>
+                                <p>Agradecemos por escolher nossa plataforma!</p>
+                        </div>
+                        <div style="text-align: center; font-size: 13px; color: #95a5a6; margin-top: 40px; border-top: 1px solid #ecf0f1; padding-top: 20px;">
+                                <p>Este email foi enviado automaticamente. Por favor, não responda.</p>
+                        </div>
+                </div>
+        </body>`;
+};

package/src/auth/dto/change.dto.ts

@@ -0,0 +1,36 @@
+import { IsEmail, IsNotEmpty, MinLength } from 'class-validator';
+
+export class ChangeDTO {
+  @IsNotEmpty({
+    message: 'Precisa preencher a nova senha',
+  })
+  @MinLength(8, {
+    message: 'A senha deve ter pelo menos 8 caracteres',
+  })
+  newPassword: string;
+
+  @IsNotEmpty({
+    message: 'Precisa confirmar a nova senha',
+  })
+  @MinLength(8)
+  confirmNewPassword: string;
+
+  @IsNotEmpty({
+    message: 'Precisa preencher a senha atual',
+  })
+  @MinLength(8, {
+    message: 'A senha atual deve ter pelo menos 8 caracteres',
+  })
+  currentPassword: string;
+
+  @IsNotEmpty({
+    message: 'Precisa preencher o email',
+  })
+  @IsEmail(
+    {},
+    {
+      message: 'O email informado não é válido.',
+    },
+  )
+  email: string;
+}

package/src/auth/dto/create-user.dto.ts

@@ -0,0 +1,37 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { IsStrongPasswordWithSettings } from '../../validators/is-strong-password-with-settings.validator';
+
+export class CreateUserDTO {
+  @IsString({ message: (args) => getLocaleText('validation.codeMustBeString', args.value) })
+  @IsNotEmpty({ message: (args) => getLocaleText('validation.codeRequired', args.value) })
+  code: string;
+
+  @IsStrongPasswordWithSettings({
+    message: (args) => getLocaleText('password.weakPassword', args.value)
+  })
+  password: string;
+
+  @IsString({ message: (args) => getLocaleText('validation.streetMustBeString', args.value) })
+  street: string;
+
+  @IsOptional()
+  @IsString({ message: (args) => getLocaleText('validation.numberMustBeString', args.value) })
+  number?: string;
+
+  @IsOptional()
+  @IsString({ message: (args) => getLocaleText('validation.complementMustBeString', args.value) })
+  complement?: string;
+
+  @IsString({ message: (args) => getLocaleText('validation.districtMustBeString', args.value) })
+  district: string;
+
+  @IsString({ message: (args) => getLocaleText('validation.cityMustBeString', args.value) })
+  city: string;
+
+  @IsString({ message: (args) => getLocaleText('validation.stateMustBeString', args.value) })
+  state: string;
+
+  @IsString({ message: (args) => getLocaleText('validation.postalCodeMustBeString', args.value) })
+  postal_code: string;
+}

package/src/auth/dto/email.dto.ts

@@ -0,0 +1,16 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsEmail, IsNotEmpty, MinLength } from 'class-validator';
+
+export class EmailDTO {
+  @IsNotEmpty({ message: (args) => getLocaleText('validation.currentEmailRequired', args.value) })
+  @IsEmail({}, { message: (args) => getLocaleText('validation.currentEmailInvalid', args.value) })
+  currentEmail: string;
+
+  @IsNotEmpty({ message: (args) => getLocaleText('validation.passwordRequired', args.value) })
+  @MinLength(8, { message: (args) => getLocaleText('validation.passwordMinLength', args.value) })
+  password: string;
+
+  @IsNotEmpty({ message: (args) => getLocaleText('validation.newEmailRequired', args.value) })
+  @IsEmail({}, { message: (args) => getLocaleText('validation.newEmailInvalid', args.value) })
+  newEmail: string;
+}

package/src/auth/dto/forget.dto.ts

@@ -0,0 +1,13 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsEmail } from 'class-validator';
+
+export class ForgetDTO {
+  @IsEmail({}, { message: (args) => getLocaleText('validation.emailInvalid', args.value) })
+  set email(value: string) {
+    this._email = value?.trim().toLowerCase();
+  }
+  get email(): string {
+    return this._email;
+  }
+  private _email: string;
+}

package/src/auth/dto/login-with-code.dto.ts

@@ -0,0 +1,14 @@
+import { getLocaleText } from '@hed-hog/api-locale';
+import { IsIn, IsJWT, IsOptional, IsString } from 'class-validator';
+
+export class LoginWithCodeDTO {
+  @IsString({ message: (args) => getLocaleText('validation.codeMustBeString', args.value) })
+  code: string;
+
+  @IsJWT({ message: (args) => getLocaleText('validation.tokenMustBeJWT', args.value) })
+  token: string;
+
+  @IsOptional()
+  @IsIn(['totp', 'email', 'recovery'], { message: (args) => getLocaleText('validation.methodTypeInvalid', args.value) })
+  methodType?: 'totp' | 'email' | 'recovery';
+}