@lenne.tech/nest-server 11.43.3 → 12.1.0

package/dist/core/modules/better-auth/core-better-auth-user.mapper.js

@@ -1,4 +1,3 @@
-"use strict";
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -12,18 +11,14 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var CoreBetterAuthUserMapper_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoreBetterAuthUserMapper = void 0;
-const common_1 = require("@nestjs/common");
-const mongoose_1 = require("@nestjs/mongoose");
-const bcrypt = require("bcrypt");
-const crypto_1 = require("crypto");
-const js_sha256_1 = require("js-sha256");
-const mongodb_1 = require("mongodb");
-const mongoose_2 = require("mongoose");
+import { Injectable, Logger, Optional } from '@nestjs/common';
+import { InjectConnection } from '../../common/persistence/mongo/mongoose-compat.js';
+import * as bcrypt from 'bcrypt';
+import { randomBytes, scrypt } from 'crypto';
+import { sha256 } from 'js-sha256';
 const scryptPromise = (password, salt, keylen, options) => {
     return new Promise((resolve, reject) => {
-        (0, crypto_1.scrypt)(password, salt, keylen, options, (err, derivedKey) => {
+        scrypt(password, salt, keylen, options, (err, derivedKey) => {
             if (err)
                 reject(err);
             else
@@ -31,13 +26,19 @@ const scryptPromise = (password, salt, keylen, options) => {
         });
     });
 };
-const role_enum_1 = require("../../common/enums/role.enum");
-const logging_helper_1 = require("../../common/helpers/logging.helper");
-const core_better_auth_account_issuer_helper_1 = require("./core-better-auth-account-issuer.helper");
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { maskEmail } from '../../common/helpers/logging.helper.js';
+import { legacyCredentialAccountIssuer } from './core-better-auth-account-issuer.helper.js';
+import { getBetterAuthSqlStore } from './core-better-auth-sql.registry.js';
+import { isValidObjectId, newObjectId } from '../../common/persistence/mongo/mongoose-compat.js';
+function isClosedConnectionError(error) {
+    const name = error?.name;
+    return name === 'MongoClientClosedError' || name === 'MongoTopologyClosedError';
+}
 let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
     static { CoreBetterAuthUserMapper_1 = this; }
     connection;
-    logger = new common_1.Logger(CoreBetterAuthUserMapper_1.name);
+    logger = new Logger(CoreBetterAuthUserMapper_1.name);
     userCache = new Map();
     static USER_CACHE_MAX = 500;
     static USER_CACHE_TTL_MS = process.env.VITEST === 'true' ||
@@ -54,7 +55,8 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         if (!sessionUser?.id || !sessionUser?.email) {
             return null;
         }
-        if (!this.connection) {
+        const sql = getBetterAuthSqlStore();
+        if (!this.connection && !sql) {
             this.logger.warn('No database connection available - using default role mapping');
             return this.createMappedUser({
                 email: sessionUser.email,
@@ -83,28 +85,29 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
                     verified: cached.verified,
                 });
             }
-            const userCollection = this.connection.collection('users');
-            const dbUser = await userCollection.findOne({
-                $or: [{ email: sessionUser.email }, { iamId: sessionUser.id }],
-            });
+            const dbUser = sql
+                ? await sql.findUser({ email: sessionUser.email, iamId: sessionUser.id, id: sessionUser.id })
+                : await this.connection?.collection('users').findOne({
+                    $or: [{ email: sessionUser.email }, { iamId: sessionUser.id }],
+                });
             if (dbUser) {
                 const roles = Array.isArray(dbUser.roles) ? dbUser.roles : [];
                 const verified = dbUser.verified === true || sessionUser.emailVerified === true;
                 if (CoreBetterAuthUserMapper_1.USER_CACHE_TTL_MS > 0) {
-                    this.cacheUserData(sessionUser.id, { id: dbUser._id.toString(), roles, verified });
+                    this.cacheUserData(sessionUser.id, { id: String(dbUser._id ?? dbUser.id), roles, verified });
                 }
                 return this.createMappedUser({
                     email: sessionUser.email,
                     emailVerified: sessionUser.emailVerified,
                     iamId: sessionUser.id,
-                    id: dbUser._id.toString(),
+                    id: String(dbUser._id ?? dbUser.id),
                     image: sessionUser.image,
                     name: sessionUser.name,
                     roles,
                     verified,
                 });
             }
-            this.logger.debug(`Better-Auth user ${(0, logging_helper_1.maskEmail)(sessionUser.email)} not found in users collection`);
+            this.logger.debug(`Better-Auth user ${maskEmail(sessionUser.email)} not found in users collection`);
             return this.createMappedUser({
                 email: sessionUser.email,
                 emailVerified: sessionUser.emailVerified,
@@ -133,13 +136,13 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
     static createHasRole(roles, verified) {
         return (checkRoles) => {
             const rolesToCheck = Array.isArray(checkRoles) ? checkRoles : [checkRoles];
-            if (rolesToCheck.includes(role_enum_1.RoleEnum.S_EVERYONE))
+            if (rolesToCheck.includes(RoleEnum.S_EVERYONE))
                 return true;
-            if (rolesToCheck.includes(role_enum_1.RoleEnum.S_USER))
+            if (rolesToCheck.includes(RoleEnum.S_USER))
                 return true;
-            if (rolesToCheck.includes(role_enum_1.RoleEnum.S_NO_ONE))
+            if (rolesToCheck.includes(RoleEnum.S_NO_ONE))
                 return false;
-            if (rolesToCheck.includes(role_enum_1.RoleEnum.S_VERIFIED))
+            if (rolesToCheck.includes(RoleEnum.S_VERIFIED))
                 return verified;
             return rolesToCheck.some((role) => roles.includes(role));
         };
@@ -159,6 +162,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         this.userCache.delete(iamId);
     }
     async syncPasswordToLegacy(iamUserId, userEmail, plainPassword) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.syncPasswordToLegacyOnSql(sql, iamUserId, userEmail, plainPassword);
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot sync password to legacy');
             return false;
@@ -180,6 +187,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         }
     }
     async syncPasswordChangeToIam(userEmail, plainPassword) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.syncPasswordChangeToIamOnSql(sql, userEmail, plainPassword);
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot sync password to IAM');
             return false;
@@ -216,6 +227,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         }
     }
     async migrateAccountToIam(userEmail, plainPassword) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.migrateAccountToIamOnSql(sql, userEmail, plainPassword);
+        }
         if (!this.connection) {
             return false;
         }
@@ -238,9 +253,9 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
                 return false;
             }
             const directMatch = await bcrypt.compare(plainPassword, legacyUser.password);
-            const sha256Match = !directMatch ? await bcrypt.compare((0, js_sha256_1.sha256)(plainPassword), legacyUser.password) : false;
+            const sha256Match = !directMatch ? await bcrypt.compare(sha256(plainPassword), legacyUser.password) : false;
             if (!directMatch && !sha256Match) {
-                this.logger.warn(`Migration password verification failed for ${(0, logging_helper_1.maskEmail)(userEmail)}`);
+                this.logger.warn(`Migration password verification failed for ${maskEmail(userEmail)}`);
                 return false;
             }
             const userIdHex = userMongoId.toHexString();
@@ -259,7 +274,7 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
             }
             const passwordHash = await this.hashPasswordForBetterAuth(plainPassword);
             const now = new Date();
-            const credentialIssuer = (0, core_better_auth_account_issuer_helper_1.legacyCredentialAccountIssuer)();
+            const credentialIssuer = legacyCredentialAccountIssuer();
             await accountsCollection.insertOne({
                 accountId: userIdHex,
                 createdAt: now,
@@ -279,7 +294,7 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
     }
     generateId() {
         const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
-        const bytes = (0, crypto_1.randomBytes)(21);
+        const bytes = randomBytes(21);
         let result = '';
         for (let i = 0; i < 21; i++) {
             result += chars.charAt(bytes[i] % chars.length);
@@ -290,11 +305,11 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         if (/^[a-f0-9]{64}$/i.test(password)) {
             return password;
         }
-        return (0, js_sha256_1.sha256)(password);
+        return sha256(password);
     }
     async hashPasswordForBetterAuth(password) {
         const normalizedPassword = this.normalizePasswordForIam(password);
-        const saltBytes = (0, crypto_1.randomBytes)(16);
+        const saltBytes = randomBytes(16);
         const salt = saltBytes.toString('hex');
         const keyLength = 64;
         const scryptOptions = {
@@ -310,6 +325,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         if (!sessionUser?.email) {
             return null;
         }
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.linkOrCreateUserOnSql(sql, sessionUser, additionalData);
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot sync user');
             return null;
@@ -319,26 +338,7 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
             const existingUser = await userCollection.findOne({
                 $or: [{ email: sessionUser.email }, { iamId: sessionUser.id }],
             });
-            const processedAdditionalData = { ...additionalData };
-            if (processedAdditionalData?.termsAndPrivacyAccepted === true) {
-                processedAdditionalData.termsAndPrivacyAcceptedAt = new Date();
-                delete processedAdditionalData.termsAndPrivacyAccepted;
-            }
-            else {
-                delete processedAdditionalData?.termsAndPrivacyAccepted;
-            }
-            const updateData = {
-                email: sessionUser.email,
-                ...(sessionUser.name && { firstName: sessionUser.name.split(' ')[0] }),
-                ...(sessionUser.name &&
-                    sessionUser.name.includes(' ') && {
-                    lastName: sessionUser.name.split(' ').slice(1).join(' '),
-                }),
-                ...(sessionUser.emailVerified !== undefined && { verified: sessionUser.emailVerified }),
-                iamId: sessionUser.id,
-                updatedAt: new Date(),
-                ...processedAdditionalData,
-            };
+            const updateData = this.linkedUserFields(sessionUser, existingUser, additionalData);
             const updateQuery = {
                 $set: updateData,
             };
@@ -361,7 +361,59 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
             return null;
         }
     }
+    linkedUserFields(sessionUser, existingUser, additionalData) {
+        const processedAdditionalData = { ...additionalData };
+        if (processedAdditionalData?.termsAndPrivacyAccepted === true) {
+            processedAdditionalData.termsAndPrivacyAcceptedAt = new Date();
+            delete processedAdditionalData.termsAndPrivacyAccepted;
+        }
+        else {
+            delete processedAdditionalData?.termsAndPrivacyAccepted;
+        }
+        const existingFullName = [existingUser?.firstName, existingUser?.lastName].filter(Boolean).join(' ');
+        const nameChangedInIam = !!sessionUser.name && sessionUser.name !== existingFullName;
+        return {
+            email: sessionUser.email,
+            ...(sessionUser.name && nameChangedInIam && { firstName: sessionUser.name.split(' ')[0] }),
+            ...(sessionUser.name &&
+                nameChangedInIam &&
+                sessionUser.name.includes(' ') && {
+                lastName: sessionUser.name.split(' ').slice(1).join(' '),
+            }),
+            ...(sessionUser.emailVerified !== undefined && { verified: sessionUser.emailVerified }),
+            iamId: sessionUser.id,
+            updatedAt: new Date(),
+            ...processedAdditionalData,
+        };
+    }
+    async syncNameChangeFromLegacy(userEmail, name) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.syncNameChangeFromLegacyOnSql(sql, userEmail, name);
+        }
+        if (!this.connection) {
+            this.logger.warn('No database connection available - cannot sync name change');
+            return false;
+        }
+        try {
+            const usersCollection = this.connection.collection('users');
+            const result = await usersCollection.updateOne({ email: userEmail }, { $set: { name, updatedAt: new Date() } });
+            if (result.matchedCount === 0) {
+                return false;
+            }
+            this.logger.debug(`Synced name change from Legacy to IAM for ${maskEmail(userEmail)}`);
+            return true;
+        }
+        catch (error) {
+            this.logger.error(`Error syncing name change from Legacy: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return false;
+        }
+    }
     async syncEmailChangeFromLegacy(oldEmail, newEmail) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.syncEmailChangeFromLegacyOnSql(sql, oldEmail, newEmail);
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot sync email change');
             return false;
@@ -377,7 +429,7 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
             }
             if (user._id) {
                 await sessionCollection.deleteMany({ userId: user._id });
-                this.logger.debug(`Invalidated sessions for email change: ${(0, logging_helper_1.maskEmail)(oldEmail)} → ${(0, logging_helper_1.maskEmail)(newEmail)}`);
+                this.logger.debug(`Invalidated sessions for email change: ${maskEmail(oldEmail)} → ${maskEmail(newEmail)}`);
             }
             return true;
         }
@@ -387,6 +439,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         }
     }
     async syncEmailChangeFromIam(userId, newEmail) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.syncEmailChangeFromIamOnSql(sql, userId, newEmail);
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot sync email change');
             return false;
@@ -408,6 +464,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         }
     }
     async deleteUserFromBothSystems(userIdentifier) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.deleteUserFromBothSystemsOnSql(sql, userIdentifier);
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot delete user');
             return { accountsDeleted: 0, sessionsDeleted: 0, success: false, userDeleted: false };
@@ -421,8 +481,8 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
             if (!user) {
                 user = await usersCollection.findOne({ iamId: userIdentifier });
             }
-            if (!user && mongodb_1.ObjectId.isValid(userIdentifier)) {
-                user = await usersCollection.findOne({ _id: new mongodb_1.ObjectId(userIdentifier) });
+            if (!user && isValidObjectId(userIdentifier)) {
+                user = await usersCollection.findOne({ _id: newObjectId(userIdentifier) });
             }
             if (!user) {
                 return { accountsDeleted: 0, sessionsDeleted: 0, success: false, userDeleted: false };
@@ -448,6 +508,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         }
     }
     async cleanupIamDataForDeletedUser(userId) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.cleanupIamDataForDeletedUserOnSql(sql, String(userId));
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot cleanup IAM data');
             return { accountsDeleted: 0, sessionsDeleted: 0, success: false };
@@ -455,7 +519,7 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         try {
             const accountCollection = this.connection.collection('account');
             const sessionCollection = this.connection.collection('session');
-            const userObjectId = typeof userId === 'string' ? new mongodb_1.ObjectId(userId) : userId;
+            const userObjectId = typeof userId === 'string' ? newObjectId(userId) : userId;
             const sessionsResult = await sessionCollection.deleteMany({ userId: userObjectId });
             const sessionsDeleted = sessionsResult.deletedCount;
             const accountsResult = await accountCollection.deleteMany({ userId: userObjectId });
@@ -472,6 +536,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         }
     }
     async cleanupLegacyDataForDeletedIamUser(iamUserId) {
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.cleanupLegacyDataForDeletedIamUserOnSql(sql, iamUserId);
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot cleanup Legacy data');
             return false;
@@ -490,6 +558,10 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
     }
     async getMigrationStatus(options) {
         const includePendingEmails = options?.includePendingEmails !== false;
+        const sql = getBetterAuthSqlStore();
+        if (sql) {
+            return this.getMigrationStatusOnSql(sql, includePendingEmails);
+        }
         if (!this.connection) {
             this.logger.warn('No database connection available - cannot get migration status');
             return {
@@ -582,6 +654,215 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
                 usersWithIamId,
             };
         }
+        catch (error) {
+            if (isClosedConnectionError(error)) {
+                this.logger.debug('Migration status not read: the database connection was closed (application shutting down)');
+            }
+            else {
+                this.logger.error(`Error getting migration status: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            }
+            return {
+                canDisableLegacyAuth: false,
+                fullyMigratedUsers: 0,
+                migrationPercentage: 0,
+                pendingMigrationUsers: 0,
+                pendingUserEmails: [],
+                totalUsers: 0,
+                usersWithIamAccount: 0,
+                usersWithIamId: 0,
+            };
+        }
+    }
+    async syncPasswordToLegacyOnSql(sql, iamUserId, userEmail, plainPassword) {
+        if (!plainPassword) {
+            return false;
+        }
+        try {
+            const bcryptHash = await bcrypt.hash(this.normalizePasswordForIam(plainPassword), 10);
+            return !!(await sql.updateUser({ email: userEmail, iamId: iamUserId }, { password: bcryptHash }));
+        }
+        catch (error) {
+            this.logger.error(`Error syncing password to legacy: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return false;
+        }
+    }
+    async syncPasswordChangeToIamOnSql(sql, userEmail, plainPassword) {
+        if (!plainPassword) {
+            return false;
+        }
+        try {
+            const user = await sql.findUser({ email: userEmail });
+            if (!user || !(await sql.findCredentialAccount(user.id))) {
+                return false;
+            }
+            await sql.updateCredentialPassword(user.id, await this.hashPasswordForBetterAuth(plainPassword));
+            return true;
+        }
+        catch (error) {
+            this.logger.error(`Error syncing password to IAM: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return false;
+        }
+    }
+    async migrateAccountToIamOnSql(sql, userEmail, plainPassword) {
+        try {
+            const legacyUser = await sql.findUser({ email: userEmail });
+            if (!legacyUser?.password) {
+                return false;
+            }
+            if (await sql.findCredentialAccount(legacyUser.id)) {
+                return true;
+            }
+            if (!plainPassword) {
+                return false;
+            }
+            const directMatch = await bcrypt.compare(plainPassword, legacyUser.password);
+            const sha256Match = !directMatch ? await bcrypt.compare(sha256(plainPassword), legacyUser.password) : false;
+            if (!directMatch && !sha256Match) {
+                this.logger.warn(`Migration password verification failed for ${maskEmail(userEmail)}`);
+                return false;
+            }
+            if (!legacyUser.iamId) {
+                await sql.updateUser({ id: legacyUser.id }, { iamId: legacyUser.id });
+                await sql.updateIamUser(legacyUser.id, {
+                    emailVerified: legacyUser.verified === true,
+                    name: [legacyUser.firstName, legacyUser.lastName].filter(Boolean).join(' ') || undefined,
+                });
+            }
+            const credentialIssuer = legacyCredentialAccountIssuer();
+            await sql.createAccount({
+                accountId: legacyUser.id,
+                ...(credentialIssuer ? { issuer: credentialIssuer } : {}),
+                password: await this.hashPasswordForBetterAuth(plainPassword),
+                providerId: 'credential',
+                userId: legacyUser.id,
+            });
+            return true;
+        }
+        catch (error) {
+            this.logger.error(`Error migrating account to IAM: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return false;
+        }
+    }
+    async linkOrCreateUserOnSql(sql, sessionUser, additionalData) {
+        try {
+            const match = { email: sessionUser.email, iamId: sessionUser.id, id: sessionUser.id };
+            const existingUser = await sql.findUser(match);
+            if (!existingUser) {
+                this.logger.warn(`Better-Auth user ${maskEmail(sessionUser.email)} has no row in the users table`);
+                return null;
+            }
+            const synced = await sql.updateUser({ id: existingUser.id }, this.linkedUserFields(sessionUser, existingUser, additionalData));
+            return synced ? { ...synced, _id: synced.id } : null;
+        }
+        catch (error) {
+            this.logger.error(`Error syncing Better-Auth user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return null;
+        }
+    }
+    async syncNameChangeFromLegacyOnSql(sql, userEmail, name) {
+        try {
+            const user = await sql.findUser({ email: userEmail });
+            if (!user) {
+                return false;
+            }
+            await sql.updateIamUser(user.id, { name });
+            this.logger.debug(`Synced name change from Legacy to IAM for ${maskEmail(userEmail)}`);
+            return true;
+        }
+        catch (error) {
+            this.logger.error(`Error syncing name change from Legacy: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return false;
+        }
+    }
+    async syncEmailChangeFromLegacyOnSql(sql, oldEmail, newEmail) {
+        try {
+            const user = (await sql.findUser({ email: newEmail })) ?? (await sql.findUser({ email: oldEmail }));
+            if (!user) {
+                return false;
+            }
+            await sql.deleteSessions(user.id);
+            this.logger.debug(`Invalidated sessions for email change: ${maskEmail(oldEmail)} → ${maskEmail(newEmail)}`);
+            return true;
+        }
+        catch (error) {
+            this.logger.error(`Error syncing email change from Legacy: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return false;
+        }
+    }
+    async syncEmailChangeFromIamOnSql(sql, userId, newEmail) {
+        try {
+            return !!(await sql.updateUser({ iamId: userId, id: userId }, { email: newEmail, refreshTokens: {} }));
+        }
+        catch (error) {
+            this.logger.error(`Error syncing email change from IAM: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return false;
+        }
+    }
+    async deleteUserFromBothSystemsOnSql(sql, userIdentifier) {
+        try {
+            const user = (await sql.findUser({ email: userIdentifier })) ??
+                (await sql.findUser({ iamId: userIdentifier })) ??
+                (await sql.findUser({ id: userIdentifier }));
+            if (!user) {
+                return { accountsDeleted: 0, sessionsDeleted: 0, success: false, userDeleted: false };
+            }
+            const sessionsDeleted = await sql.deleteSessions(user.id);
+            const accountsDeleted = await sql.deleteAccounts(user.id);
+            await sql.deleteUser(user.id);
+            this.logger.log(`Deleted user ${maskEmail(user.email)}: user=true, accounts=${accountsDeleted}, sessions=${sessionsDeleted}`);
+            return { accountsDeleted, sessionsDeleted, success: true, userDeleted: true };
+        }
+        catch (error) {
+            this.logger.error(`Error deleting user: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return { accountsDeleted: 0, sessionsDeleted: 0, success: false, userDeleted: false };
+        }
+    }
+    async cleanupIamDataForDeletedUserOnSql(sql, userId) {
+        try {
+            const sessionsDeleted = await sql.deleteSessions(userId);
+            const accountsDeleted = await sql.deleteAccounts(userId);
+            return { accountsDeleted, sessionsDeleted, success: true };
+        }
+        catch (error) {
+            this.logger.error(`Error cleaning up IAM data: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return { accountsDeleted: 0, sessionsDeleted: 0, success: false };
+        }
+    }
+    async cleanupLegacyDataForDeletedIamUserOnSql(sql, iamUserId) {
+        try {
+            const user = await sql.findUser({ iamId: iamUserId, id: iamUserId });
+            if (!user) {
+                return false;
+            }
+            await sql.deleteUser(user.id);
+            return true;
+        }
+        catch (error) {
+            this.logger.error(`Error cleaning up Legacy data: ${error instanceof Error ? error.message : 'Unknown error'}`);
+            return false;
+        }
+    }
+    async getMigrationStatusOnSql(sql, includePendingEmails) {
+        try {
+            const counts = await sql.migrationCounts(includePendingEmails ? 100 : 0);
+            const totalUsers = counts.total;
+            const usersWithIamId = counts.withIamId;
+            const usersWithIamAccount = counts.withIamAccount;
+            const fullyMigratedUsers = counts.fullyMigrated;
+            const pendingMigrationUsers = totalUsers - fullyMigratedUsers;
+            const migrationPercentage = totalUsers > 0 ? Math.round((fullyMigratedUsers / totalUsers) * 100 * 100) / 100 : 0;
+            const pendingUserEmails = counts.pendingEmails;
+            return {
+                canDisableLegacyAuth: totalUsers > 0 && fullyMigratedUsers === totalUsers,
+                fullyMigratedUsers,
+                migrationPercentage,
+                pendingMigrationUsers,
+                pendingUserEmails,
+                totalUsers,
+                usersWithIamAccount,
+                usersWithIamId,
+            };
+        }
         catch (error) {
             this.logger.error(`Error getting migration status: ${error instanceof Error ? error.message : 'Unknown error'}`);
             return {
@@ -597,11 +878,11 @@ let CoreBetterAuthUserMapper = class CoreBetterAuthUserMapper {
         }
     }
 };
-exports.CoreBetterAuthUserMapper = CoreBetterAuthUserMapper;
-exports.CoreBetterAuthUserMapper = CoreBetterAuthUserMapper = CoreBetterAuthUserMapper_1 = __decorate([
-    (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Optional)()),
-    __param(0, (0, mongoose_1.InjectConnection)()),
-    __metadata("design:paramtypes", [mongoose_2.Connection])
+CoreBetterAuthUserMapper = CoreBetterAuthUserMapper_1 = __decorate([
+    Injectable(),
+    __param(0, Optional()),
+    __param(0, InjectConnection()),
+    __metadata("design:paramtypes", [Function])
 ], CoreBetterAuthUserMapper);
+export { CoreBetterAuthUserMapper };
 //# sourceMappingURL=core-better-auth-user.mapper.js.map