@nauth-toolkit/core 0.1.0

package/dist/services/auth.service.js

@@ -0,0 +1,2356 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = void 0;
+const auth_audit_event_type_enum_1 = require("../enums/auth-audit-event-type.enum");
+const risk_factor_enum_1 = require("../enums/risk-factor.enum");
+const context_storage_1 = require("../utils/context-storage");
+const user_response_dto_1 = require("../dto/user-response.dto");
+const auth_challenge_dto_1 = require("../dto/auth-challenge.dto");
+const verify_email_dto_1 = require("../dto/verify-email.dto");
+const verify_phone_dto_1 = require("../dto/verify-phone.dto");
+const verify_phone_by_sub_dto_1 = require("../dto/verify-phone-by-sub.dto");
+const nauth_exception_1 = require("../exceptions/nauth.exception");
+const error_codes_enum_1 = require("../enums/error-codes.enum");
+const mfa_method_enum_1 = require("../enums/mfa-method.enum");
+const crypto = __importStar(require("crypto"));
+const DUMMY_ARGON2_HASH = '$argon2id$v=19$m=65536,t=3,p=4$RFVNTVlfU0FMVF9GT1JfVElNSU5H$dummyhashfordummyhashfordummyhash1234567890';
+class AuthService {
+    userRepository;
+    loginAttemptRepository;
+    passwordService;
+    jwtService;
+    sessionService;
+    challengeService;
+    challengeHelper;
+    emailVerificationService;
+    clientInfoService;
+    accountLockoutStorage;
+    config;
+    logger;
+    auditService;
+    phoneVerificationService;
+    mfaService;
+    mfaDeviceRepository;
+    trustedDeviceService;
+    constructor(userRepository, loginAttemptRepository, passwordService, jwtService, sessionService, challengeService, challengeHelper, emailVerificationService, clientInfoService, accountLockoutStorage, config, logger, auditService, phoneVerificationService, mfaService, mfaDeviceRepository, trustedDeviceService) {
+        this.userRepository = userRepository;
+        this.loginAttemptRepository = loginAttemptRepository;
+        this.passwordService = passwordService;
+        this.jwtService = jwtService;
+        this.sessionService = sessionService;
+        this.challengeService = challengeService;
+        this.challengeHelper = challengeHelper;
+        this.emailVerificationService = emailVerificationService;
+        this.clientInfoService = clientInfoService;
+        this.accountLockoutStorage = accountLockoutStorage;
+        this.config = config;
+        this.logger = logger;
+        this.auditService = auditService;
+        this.phoneVerificationService = phoneVerificationService;
+        this.mfaService = mfaService;
+        this.mfaDeviceRepository = mfaDeviceRepository;
+        this.trustedDeviceService = trustedDeviceService;
+        this.logger?.log?.('AuthService initialized');
+    }
+    async signup(dto) {
+        const clientInfo = this.clientInfoService.get();
+        this.logger?.log?.(`Signup attempt for email: ${dto.email}`);
+        this.logger?.debug?.(`Signup details: { email: ${dto.email}, username: ${dto.username || 'none'}, ip: ${clientInfo.ipAddress} }`);
+        if (this.config.signup?.enabled === false) {
+            this.logger?.warn?.(`Signup blocked - signup is disabled`);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SIGNUP_DISABLED, 'Signups are currently disabled');
+        }
+        this.logger?.debug?.(`Checking if user exists: ${dto.email}`);
+        const existingUserByEmail = await this.userRepository.findOne({
+            where: { email: dto.email },
+        });
+        if (existingUserByEmail) {
+            this.logger?.warn?.(`Signup failed - user already exists: ${dto.email}`);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this email already exists');
+        }
+        if (dto.username) {
+            this.logger?.debug?.(`Checking if username exists: ${dto.username}`);
+            const existingUserByUsername = await this.userRepository.findOne({
+                where: { username: dto.username },
+            });
+            if (existingUserByUsername) {
+                this.logger?.warn?.(`Signup failed - username already exists: ${dto.username}`);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USERNAME_EXISTS, 'Username is already taken');
+            }
+        }
+        if (dto.phone && !this.config.signup?.allowDuplicatePhones) {
+            this.logger?.debug?.(`Checking if phone exists: ${dto.phone}`);
+            const existingUserByPhone = await this.userRepository.findOne({
+                where: { phone: dto.phone },
+            });
+            if (existingUserByPhone) {
+                this.logger?.warn?.(`Signup failed - phone already exists: ${dto.phone}`);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_EXISTS, 'Phone number is already registered');
+            }
+        }
+        this.logger?.debug?.('Validating password against policy');
+        const passwordValidation = await this.passwordService.validatePassword(dto.password, {
+            email: dto.email,
+            username: dto.username,
+        });
+        if (!passwordValidation.valid) {
+            this.logger?.warn?.(`Password validation failed for ${dto.email}: ${passwordValidation.errors.join(', ')}`);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.WEAK_PASSWORD, passwordValidation.errors.join(', '), {
+                errors: passwordValidation.errors,
+            });
+        }
+        const passwordHash = await this.passwordService.hashPassword(dto.password);
+        const verificationMethod = this.config.signup?.verificationMethod;
+        if ((verificationMethod === 'phone' || verificationMethod === 'both') && !dto.phone) {
+            this.logger?.warn?.(`Signup failed - phone required for verification method: ${verificationMethod}`);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_REQUIRED, 'Phone number is required for the selected verification method', { verificationMethod });
+        }
+        this.logger?.debug?.(`Creating user record for: ${dto.email} || ${dto.username} || ${dto.phone}`);
+        const user = this.userRepository.create({
+            email: dto.email,
+            username: dto.username,
+            firstName: dto.firstName,
+            lastName: dto.lastName,
+            phone: dto.phone,
+            passwordHash,
+            passwordChangedAt: new Date(),
+            isEmailVerified: false,
+            isPhoneVerified: false,
+            isActive: true,
+            metadata: dto.metadata,
+        });
+        let savedUser;
+        try {
+            savedUser = (await this.userRepository.save(user));
+            this.logger?.log?.(`User created successfully: ${dto.email} (sub: ${savedUser.sub})`);
+            try {
+                await this.auditService?.recordEvent({
+                    userId: savedUser.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.ACCOUNT_CREATED,
+                    eventStatus: 'INFO',
+                    authMethod: 'password',
+                    metadata: {
+                        email: savedUser.email,
+                        username: savedUser.username || null,
+                        verificationMethod,
+                    },
+                });
+            }
+            catch (auditError) {
+                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record ACCOUNT_CREATED audit event: ${errorMessage}`, {
+                    error: auditError,
+                    userId: savedUser.id,
+                });
+            }
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'code' in error && error.code === '23505') {
+                const dbError = error;
+                if (dbError.detail?.includes('email')) {
+                    this.logger?.warn?.(`Signup failed - email constraint violation: ${dto.email}`);
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this email already exists');
+                }
+                else if (dbError.detail?.includes('username')) {
+                    this.logger?.warn?.(`Signup failed - username constraint violation: ${dto.username}`);
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USERNAME_EXISTS, 'Username is already taken');
+                }
+                else if (dbError.detail?.includes('phone')) {
+                    this.logger?.warn?.(`Signup failed - phone constraint violation: ${dto.phone}`);
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_EXISTS, 'Phone number is already registered');
+                }
+                else {
+                    this.logger?.error?.(`Signup failed - database constraint violation: ${dbError.message}`);
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this information already exists', {
+                        conflictType: 'unknown',
+                    });
+                }
+            }
+            const errorMessage = error instanceof Error ? error.message : 'Unknown database error';
+            this.logger?.error?.(`Signup failed - database error: ${errorMessage}`);
+            throw error;
+        }
+        if (this.config.hooks?.afterSignup) {
+            await this.config.hooks.afterSignup(savedUser, { requiresVerification: verificationMethod !== 'none' });
+        }
+        const response = await this.challengeHelper.determineAuthResponse({
+            user: savedUser,
+            config: this.config,
+            deviceToken: clientInfo.deviceToken,
+        });
+        if (response.challengeName) {
+            this.logger?.log?.(`Challenge required for user ${savedUser.sub}: ${response.challengeName}`);
+        }
+        else {
+            this.logger?.log?.(`Signup successful - tokens issued for: ${dto.email}`);
+        }
+        return response;
+    }
+    async login(dto) {
+        const clientInfo = this.clientInfoService.get();
+        const fireAndForget = this.config.auditLogs?.fireAndForget === true;
+        this.logger?.log?.(`Login attempt for: ${dto.identifier}`);
+        this.logger?.debug?.(`Login details: { identifier: ${dto.identifier}, ip: ${clientInfo.ipAddress}, deviceToken: ${clientInfo.deviceToken ? 'present' : 'none'} }`);
+        if (this.config.lockout?.enabled) {
+            const clientInfo = this.clientInfoService.get();
+            const ipAddress = clientInfo.ipAddress;
+            if (ipAddress) {
+                this.logger?.debug?.(`Checking IP lockout status for: ${ipAddress}`);
+                const isLocked = await this.accountLockoutStorage.isAccountLocked(ipAddress);
+                if (isLocked) {
+                    this.logger?.warn?.(`Login blocked - IP locked: ${ipAddress}`);
+                    await this.recordLoginAttempt(dto.identifier, false, 'ip_locked');
+                    if (fireAndForget) {
+                        this.auditService
+                            ?.recordEvent({
+                            userSub: dto.identifier,
+                            eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_BLOCKED,
+                            eventStatus: 'FAILURE',
+                            authMethod: 'password',
+                            reason: 'ip_locked',
+                            description: 'Login blocked - IP address locked due to too many failed attempts',
+                        })
+                            .catch((err) => {
+                            const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                            this.logger?.error?.(`Failed to record LOGIN_BLOCKED audit event (fire-and-forget): ${errorMessage}`, {
+                                error: err,
+                                identifier: dto.identifier,
+                            });
+                        });
+                    }
+                    else {
+                        try {
+                            await this.auditService?.recordEvent({
+                                userSub: dto.identifier,
+                                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_BLOCKED,
+                                eventStatus: 'FAILURE',
+                                authMethod: 'password',
+                                reason: 'ip_locked',
+                                description: 'Login blocked - IP address locked due to too many failed attempts',
+                            });
+                        }
+                        catch (auditError) {
+                            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                            this.logger?.error?.(`Failed to record LOGIN_BLOCKED audit event (IP locked): ${errorMessage}`, {
+                                error: auditError,
+                            });
+                        }
+                    }
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.RATE_LIMIT_LOGIN, 'Too many failed attempts from this IP. Please try again later.');
+                }
+            }
+        }
+        const identifierType = this.config.login?.identifierType;
+        if (identifierType) {
+            this.logger?.debug?.(`Validating identifier type for: ${dto.identifier}, allowed type: ${identifierType}`);
+            const isValidIdentifier = this.validateIdentifierType(dto.identifier, identifierType);
+            if (!isValidIdentifier) {
+                this.logger?.warn?.(`Login rejected - identifier type mismatch. Identifier: ${dto.identifier}, Required: ${identifierType}`);
+                await this.handleFailedLogin(dto.identifier, 'identifier_type_mismatch');
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INVALID_CREDENTIALS, `Login with this identifier type is not allowed. Expected: ${identifierType}`);
+            }
+        }
+        this.logger?.debug?.(`Finding user by identifier: ${dto.identifier}`);
+        const user = await this.findUserByIdentifier(dto.identifier, identifierType);
+        const hashToVerify = user?.passwordHash || DUMMY_ARGON2_HASH;
+        this.logger?.debug?.('Verifying password');
+        const isPasswordValid = await this.passwordService.verifyPassword(dto.password, hashToVerify);
+        if (!user || !user.passwordHash || !isPasswordValid) {
+            this.logger?.warn?.(`Login failed - invalid credentials for: ${dto.identifier}`);
+            await this.handleFailedLogin(dto.identifier, 'invalid_credentials');
+            if (user) {
+                if (fireAndForget) {
+                    this.auditService
+                        ?.recordEvent({
+                        userId: user.id,
+                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_FAILED,
+                        eventStatus: 'FAILURE',
+                        authMethod: 'password',
+                        reason: 'invalid_credentials',
+                        description: 'Invalid password or user not found',
+                    })
+                        .catch((err) => {
+                        const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                        this.logger?.error?.(`Failed to record LOGIN_FAILED audit event (fire-and-forget): ${errorMessage}`, {
+                            error: err,
+                            userId: user.id,
+                            userSub: user.sub,
+                        });
+                    });
+                }
+                else {
+                    try {
+                        await this.auditService?.recordEvent({
+                            userId: user.id,
+                            eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_FAILED,
+                            eventStatus: 'FAILURE',
+                            authMethod: 'password',
+                            reason: 'invalid_credentials',
+                            description: 'Invalid password or user not found',
+                        });
+                    }
+                    catch (auditError) {
+                        const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                        this.logger?.error?.(`Failed to record LOGIN_FAILED audit event: ${errorMessage}`, {
+                            error: auditError,
+                            userId: user?.id,
+                        });
+                    }
+                }
+            }
+            if (user && !user.passwordHash && user.socialProviders && user.socialProviders.length > 0) {
+                const provider = user.socialProviders[0];
+                const providerName = provider.charAt(0).toUpperCase() + provider.slice(1);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INVALID_CREDENTIALS, `Invalid credentials - use your ${providerName} account`, {
+                    suggestedProvider: providerName,
+                });
+            }
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INVALID_CREDENTIALS, 'Invalid credentials');
+        }
+        const expiryDays = this.config.password?.expiryDays;
+        if (expiryDays && expiryDays > 0 && user.passwordChangedAt) {
+            const expiryDate = new Date(user.passwordChangedAt);
+            expiryDate.setDate(expiryDate.getDate() + expiryDays);
+            const now = new Date();
+            if (now > expiryDate) {
+                this.logger?.warn?.(`Password expired for user: ${user.sub}. Changed: ${user.passwordChangedAt}, Expiry: ${expiryDate}`);
+                await this.userRepository.update(user.id, {
+                    mustChangePassword: true,
+                });
+                user.mustChangePassword = true;
+                const response = await this.challengeHelper.determineAuthResponse({
+                    user,
+                    config: this.config,
+                    deviceToken: clientInfo.deviceToken,
+                    isSocialLogin: false,
+                });
+                if (response.challengeName) {
+                    this.logger?.warn?.(`Login blocked - password expired, challenge: ${response.challengeName} for ${dto.identifier}`);
+                    return response;
+                }
+            }
+        }
+        try {
+            await this.auditService?.recordEvent({
+                userId: user.id,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_ATTEMPT,
+                eventStatus: 'INFO',
+                authMethod: 'password',
+                description: 'Password verification successful',
+            });
+        }
+        catch (auditError) {
+            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+            this.logger?.error?.(`Failed to record LOGIN_ATTEMPT audit event: ${errorMessage}`, {
+                error: auditError,
+                userId: user.id,
+            });
+        }
+        const response = await this.challengeHelper.determineAuthResponse({
+            user,
+            config: this.config,
+            deviceToken: clientInfo.deviceToken,
+            isSocialLogin: false,
+        });
+        if (response.challengeName) {
+            const reasonMap = {
+                [auth_challenge_dto_1.AuthChallenge.VERIFY_EMAIL]: 'verification_required',
+                [auth_challenge_dto_1.AuthChallenge.VERIFY_PHONE]: 'verification_required',
+                [auth_challenge_dto_1.AuthChallenge.MFA_SETUP_REQUIRED]: 'mfa_setup_required',
+                [auth_challenge_dto_1.AuthChallenge.FORCE_CHANGE_PASSWORD]: 'password_change_required',
+                [auth_challenge_dto_1.AuthChallenge.MFA_REQUIRED]: 'mfa_required',
+            };
+            this.logger?.warn?.(`Login blocked - pending challenge: ${response.challengeName} for ${dto.identifier} (sub: ${user.sub})`);
+            await this.recordLoginAttempt(dto.identifier, false, reasonMap[response.challengeName] || 'challenge_required', user.id);
+            return response;
+        }
+        if (response.accessToken && response.refreshToken) {
+            this.logger?.debug?.(`Login successful - session already created by challenge helper for ${dto.identifier} (sub: ${user.sub})`);
+            await this.recordLoginAttempt(dto.identifier, true, undefined, user.id);
+            this.logger?.log?.(`Login successful for: ${dto.identifier} (sub: ${user.sub}) from ${clientInfo.ipAddress}`);
+            await this.userRepository.update(user.id, {
+                lastLoginAt: new Date(),
+                lastLoginIp: clientInfo.ipAddress,
+                failedLoginAttempts: 0,
+            });
+            if (this.config.lockout?.enabled && this.config.lockout.resetOnSuccess) {
+                const ipAddress = clientInfo.ipAddress;
+                if (ipAddress) {
+                    this.logger?.debug?.(`Resetting failed login attempts for IP: ${ipAddress}`);
+                    await this.accountLockoutStorage.resetFailedAttempts(ipAddress);
+                }
+            }
+            let sessionId;
+            let deviceId;
+            try {
+                const tokenPayload = this.jwtService.decodeToken(response.accessToken);
+                if (tokenPayload?.sessionId) {
+                    sessionId = parseInt(String(tokenPayload.sessionId), 10);
+                }
+                if (sessionId) {
+                    const session = await this.sessionService.findById(sessionId);
+                    if (session && session.deviceId) {
+                        deviceId = session.deviceId;
+                    }
+                }
+            }
+            catch (error) {
+                this.logger?.debug?.('Failed to extract sessionId/deviceId from token for audit');
+            }
+            const isTrustedDevice = response.trusted || false;
+            const mfaBypassed = false;
+            const mfaBypassReason = null;
+            if (fireAndForget) {
+                this.auditService
+                    ?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                    eventStatus: 'SUCCESS',
+                    sessionId: sessionId || undefined,
+                    deviceId: deviceId || undefined,
+                    authMethod: 'password',
+                    metadata: { trustedDevice: isTrustedDevice, mfaBypassed, mfaBypassReason },
+                })
+                    .catch((err) => {
+                    const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event (fire-and-forget): ${errorMessage}`, {
+                        error: err,
+                        userId: user.id,
+                        userSub: user.sub,
+                    });
+                });
+            }
+            else {
+                try {
+                    await this.auditService?.recordEvent({
+                        userId: user.id,
+                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                        eventStatus: 'SUCCESS',
+                        sessionId: sessionId || undefined,
+                        deviceId: deviceId || undefined,
+                        authMethod: 'password',
+                        metadata: { trustedDevice: isTrustedDevice, mfaBypassed, mfaBypassReason },
+                    });
+                }
+                catch (auditError) {
+                    const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event: ${errorMessage}`, {
+                        error: auditError,
+                        userId: user.id,
+                    });
+                }
+            }
+            return response;
+        }
+        let isTrustedDevice = false;
+        let mfaBypassed = false;
+        let mfaBypassReason = null;
+        if (this.config.mfa?.rememberDevices &&
+            this.config.mfa?.rememberDevices !== 'never' &&
+            this.trustedDeviceService &&
+            clientInfo.deviceToken) {
+            isTrustedDevice = await this.trustedDeviceService.isDeviceTrusted(clientInfo.deviceToken, user.id);
+        }
+        const userEntityDebug = user;
+        const userMfaExempt = userEntityDebug.mfaExempt === true || userEntityDebug.mfaExempt === 'true';
+        if (!response.challengeName && this.config.mfa) {
+            const enforcement = this.config.mfa.enforcement || 'OPTIONAL';
+            const wouldRequireMFA = (enforcement === 'OPTIONAL' && user.mfaEnabled) || enforcement === 'REQUIRED' || enforcement === 'ADAPTIVE';
+            if (wouldRequireMFA) {
+                if (isTrustedDevice &&
+                    this.config.mfa.bypassMFAForTrustedDevices === true &&
+                    enforcement !== 'ADAPTIVE' &&
+                    !userMfaExempt) {
+                    mfaBypassed = true;
+                    mfaBypassReason = 'trusted_device';
+                    this.logger?.debug?.(`MFA bypassed for trusted device - user ${user.sub}`);
+                }
+                else if (userMfaExempt) {
+                    mfaBypassed = true;
+                    mfaBypassReason = 'mfa_exempt';
+                    this.logger?.debug?.(`MFA bypassed due to exemption - user ${user.sub}`);
+                }
+            }
+        }
+        if (!user.isActive) {
+            this.logger?.warn?.(`Login failed - account inactive: ${dto.identifier} (sub: ${user.sub})`);
+            await this.recordLoginAttempt(dto.identifier, false, 'account_inactive', user.id);
+            try {
+                await this.auditService?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_BLOCKED,
+                    eventStatus: 'FAILURE',
+                    authMethod: 'password',
+                    reason: 'account_inactive',
+                    description: 'Login blocked - account is inactive',
+                });
+            }
+            catch (auditError) {
+                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record LOGIN_BLOCKED audit event (account inactive): ${errorMessage}`, {
+                    error: auditError,
+                    userId: user.id,
+                });
+            }
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.ACCOUNT_INACTIVE, 'Account is inactive. Please contact support.');
+        }
+        if (this.config.lockout?.enabled && this.config.lockout.resetOnSuccess) {
+            const ipAddress = clientInfo.ipAddress;
+            if (ipAddress) {
+                this.logger?.debug?.(`Resetting failed login attempts for IP: ${ipAddress}`);
+                await this.accountLockoutStorage.resetFailedAttempts(ipAddress);
+            }
+        }
+        const validatedDeviceId = crypto.randomUUID();
+        this.logger?.debug?.(`Generated server-side deviceId: ${validatedDeviceId}`);
+        const tokenFamily = this.jwtService.generateTokenFamily();
+        if (this.config.session?.disallowMultipleSessions) {
+            this.logger?.debug?.(`Single session mode enabled - revoking other sessions for user: ${user.sub}`);
+            const revokedCount = await this.sessionService.revokeAllUserSessions(user.id, 'Login from new session');
+            if (revokedCount > 0) {
+                this.logger?.log?.(`Revoked ${revokedCount} other active session(s) for user: ${user.sub}`);
+            }
+        }
+        this.logger?.debug?.(`Creating login session for user: ${user.sub}`);
+        const atomic = await this.sessionService.createSessionAtomic({
+            userId: user.id,
+            tokenFamily,
+            deviceId: validatedDeviceId,
+            deviceName: dto.deviceName,
+            deviceType: dto.deviceType,
+            isRemembered: false,
+            expiresAt: this.sessionService.getSessionExpirationDate(),
+            authMethod: 'password',
+        }, async (sessionId) => {
+            const pair = await this.jwtService.generateTokenPair({
+                userId: user.sub,
+                email: user.email,
+                sessionId: sessionId.toString(),
+                tokenFamily,
+            });
+            return {
+                accessTokenHash: this.jwtService.hashToken(pair.accessToken),
+                refreshTokenHash: this.jwtService.hashToken(pair.refreshToken),
+                extra: pair,
+            };
+        });
+        const session = atomic.session;
+        const tokens = atomic.extra;
+        this.logger?.debug?.(`Session created: ${session.id}`);
+        await this.userRepository.update(user.id, {
+            lastLoginAt: new Date(),
+            lastLoginIp: clientInfo.ipAddress,
+            failedLoginAttempts: 0,
+        });
+        await this.recordLoginAttempt(dto.identifier, true, undefined, user.id);
+        this.logger?.log?.(`Login successful for: ${dto.identifier} (sub: ${user.sub}) from ${clientInfo.ipAddress}`);
+        if (fireAndForget) {
+            this.auditService
+                ?.recordEvent({
+                userId: user.id,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                eventStatus: 'SUCCESS',
+                sessionId: session.id,
+                deviceId: validatedDeviceId || undefined,
+                authMethod: 'password',
+                metadata: { trustedDevice: isTrustedDevice, mfaBypassed, mfaBypassReason },
+            })
+                .catch((err) => {
+                const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event (fire-and-forget): ${errorMessage}`, {
+                    error: err,
+                    userId: user.id,
+                    userSub: user.sub,
+                });
+            });
+        }
+        else {
+            try {
+                await this.auditService?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                    eventStatus: 'SUCCESS',
+                    sessionId: session.id,
+                    deviceId: validatedDeviceId || undefined,
+                    authMethod: 'password',
+                    metadata: { trustedDevice: isTrustedDevice, mfaBypassed, mfaBypassReason },
+                });
+            }
+            catch (auditError) {
+                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event: ${errorMessage}`, {
+                    error: auditError,
+                    userId: user.id,
+                });
+            }
+        }
+        let deviceToken;
+        let isTrusted = false;
+        if (this.config.mfa?.rememberDevices && this.config.mfa?.rememberDevices !== 'never' && this.trustedDeviceService) {
+            const rememberDevicesMode = this.config.mfa.rememberDevices;
+            if (clientInfo.deviceToken) {
+                isTrusted = await this.trustedDeviceService.isDeviceTrusted(clientInfo.deviceToken, user.id);
+                if (isTrusted) {
+                    deviceToken = clientInfo.deviceToken;
+                    this.logger?.debug?.(`Device already trusted for user ${user.sub}`);
+                }
+            }
+            if (rememberDevicesMode === 'always' && !isTrusted) {
+                try {
+                    deviceToken = await this.trustedDeviceService.createTrustedDevice(user.id, dto.deviceName || clientInfo.deviceName, dto.deviceType || clientInfo.deviceType, clientInfo.ipAddress, clientInfo.userAgent, clientInfo.platform, clientInfo.browser);
+                    isTrusted = true;
+                    this.logger?.debug?.(`Auto-created trusted device token for user ${user.sub} (always mode)`);
+                }
+                catch (error) {
+                    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                    this.logger?.warn?.(`Failed to create trusted device token: ${errorMessage}`, { error });
+                }
+            }
+        }
+        const accessTokenValidation = await this.jwtService.validateAccessToken(tokens.accessToken);
+        const refreshTokenValidation = await this.jwtService.validateRefreshToken(tokens.refreshToken);
+        const userDto = user_response_dto_1.UserResponseDto.fromEntity(user);
+        const authResponse = {
+            user: {
+                sub: userDto.sub,
+                email: userDto.email,
+                firstName: userDto.firstName,
+                lastName: userDto.lastName,
+                phone: userDto.phone ?? undefined,
+                isEmailVerified: userDto.isEmailVerified,
+                isPhoneVerified: userDto.isPhoneVerified ?? undefined,
+                socialProviders: userDto.socialProviders && userDto.socialProviders.length > 0 ? userDto.socialProviders : undefined,
+            },
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            accessTokenExpiresAt: accessTokenValidation.payload?.exp || 0,
+            refreshTokenExpiresAt: refreshTokenValidation.payload?.exp || 0,
+            trusted: isTrusted,
+            deviceToken,
+        };
+        return authResponse;
+    }
+    async respondToChallenge(dto) {
+        const responseData = dto;
+        const { session, type } = responseData;
+        const requestTrace = `${Date.now()}-${Math.random().toString(36).substring(7)}`;
+        this.logger?.log?.(`[${requestTrace}] Challenge response received: type=${type}, session=${session?.substring(0, 8)}...`);
+        const challengeSession = await this.challengeService.validateSession(session);
+        this.validateChallengeTypeMatch(challengeSession.challengeName, type);
+        this.validateChallengeParams(type, responseData);
+        switch (type) {
+            case 'VERIFY_EMAIL':
+                return await this.handleVerifyEmail(challengeSession, responseData.code);
+            case 'VERIFY_PHONE':
+                return await this.handleVerifyPhone(challengeSession, responseData);
+            case 'MFA_REQUIRED':
+                return await this.handleMFAVerification(challengeSession, responseData);
+            case 'FORCE_CHANGE_PASSWORD':
+                return await this.handleForceChangePassword(challengeSession, responseData.newPassword);
+            case 'MFA_SETUP_REQUIRED':
+                return await this.handleMFASetup(challengeSession, responseData);
+            default:
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, `Unknown challenge type: ${type}`);
+        }
+    }
+    validateChallengeTypeMatch(expected, provided) {
+        if (expected !== provided) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, `Challenge type mismatch: expected ${expected}, got ${provided}`);
+        }
+    }
+    validateChallengeParams(type, data) {
+        switch (type) {
+            case 'VERIFY_EMAIL': {
+                const response = data;
+                if (!response.code || typeof response.code !== 'string') {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'Verification code is required', { field: 'code' });
+                }
+                break;
+            }
+            case 'VERIFY_PHONE': {
+                const response = data;
+                const hasCode = 'code' in response && response.code;
+                const hasPhone = 'phone' in response && response.phone;
+                if (!hasCode && !hasPhone) {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'Either phone number or verification code is required', { fields: ['phone', 'code'] });
+                }
+                break;
+            }
+            case 'MFA_REQUIRED': {
+                const response = data;
+                if (!response.method) {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'MFA method is required', { field: 'method' });
+                }
+                if (response.method === 'passkey') {
+                    const passkeyResponse = response;
+                    if (!passkeyResponse.credential) {
+                        throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'Passkey credential is required', {
+                            field: 'credential',
+                        });
+                    }
+                }
+                else {
+                    const codeResponse = response;
+                    if (!codeResponse.code || typeof codeResponse.code !== 'string') {
+                        throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'MFA code is required', { field: 'code' });
+                    }
+                }
+                break;
+            }
+            case 'FORCE_CHANGE_PASSWORD': {
+                const response = data;
+                if (!response.newPassword || typeof response.newPassword !== 'string') {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'New password is required', {
+                        field: 'newPassword',
+                    });
+                }
+                break;
+            }
+            case 'MFA_SETUP_REQUIRED': {
+                const response = data;
+                if (!response.method) {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'MFA setup method is required', {
+                        field: 'method',
+                    });
+                }
+                if (!response.setupData || typeof response.setupData !== 'object') {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'MFA setup data is required', {
+                        field: 'setupData',
+                    });
+                }
+                break;
+            }
+        }
+    }
+    async handleVerifyEmail(challengeSession, code) {
+        const user = challengeSession.user;
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.CHALLENGE_INVALID, 'User not found in challenge session');
+        }
+        this.logger?.log?.(`Verifying email for user: ${user.sub}`);
+        const verifyDto = Object.assign(new verify_email_dto_1.VerifyEmailWithCodeDTO(), {
+            email: user.email,
+            code,
+            challengeSessionId: challengeSession.id,
+        });
+        const result = await this.emailVerificationService.verifyEmailWithCode(verifyDto);
+        const isVerified = result.message === 'Email verified successfully. Please log in to continue.';
+        if (!isVerified) {
+            await this.challengeService.incrementAttempts(challengeSession);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_INVALID, 'Invalid verification code');
+        }
+        await this.challengeService.validateAndConsumeSession(challengeSession.sessionToken, auth_challenge_dto_1.AuthChallenge.VERIFY_EMAIL);
+        const updatedUser = await this.userRepository.findOne({ where: { sub: user.sub } });
+        if (!updatedUser) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found after email verification');
+        }
+        const clientInfo = this.clientInfoService.get();
+        const authMethod = challengeSession.metadata?.authMethod || 'password';
+        const authProvider = challengeSession.metadata?.authProvider;
+        const isSocialLogin = authMethod === 'social';
+        const response = await this.challengeHelper.determineAuthResponse({
+            user: updatedUser,
+            config: this.config,
+            deviceToken: clientInfo.deviceToken,
+            isSocialLogin,
+            skipMFAVerification: false,
+            authProvider,
+        });
+        if (response.challengeName) {
+            this.logger?.log?.(`Additional challenge required: ${response.challengeName}`);
+        }
+        else {
+            this.logger?.log?.(`Email verified, auth completed for: ${user.email}`);
+        }
+        return response;
+    }
+    async handleVerifyPhone(challengeSession, data) {
+        const user = challengeSession.user;
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.CHALLENGE_INVALID, 'User not found in challenge session');
+        }
+        if ('phone' in data && data.phone) {
+            const phone = data.phone;
+            this.logger?.log?.(`Collecting phone number for user: ${user.sub}`);
+            const phoneRegex = /^\+[1-9]\d{1,14}$/;
+            if (!phoneRegex.test(phone)) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INVALID_PHONE_FORMAT, 'Invalid phone number format. Use E.164 format (e.g., +1234567890)');
+            }
+            await this.userRepository.update({ sub: user.sub }, { phone });
+            this.logger?.log?.(`Phone number added for user ${user.sub}: ${phone}`);
+            let smsError;
+            if (this.phoneVerificationService) {
+                this.logger?.log?.(`Sending verification SMS to newly added phone: ${phone}`);
+                try {
+                    const smsDto = Object.assign(new verify_phone_dto_1.SendVerificationSMSDTO(), {
+                        sub: user.sub,
+                        challengeSessionId: challengeSession.id,
+                    });
+                    await this.phoneVerificationService.sendVerificationSMS(smsDto);
+                    this.logger?.log?.(`Verification SMS sent successfully to: ${phone}`);
+                }
+                catch (error) {
+                    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to send verification SMS to ${phone}: ${errorMessage}`);
+                    smsError = errorMessage;
+                }
+            }
+            else {
+                this.logger?.warn?.(`Phone verification SMS not sent - PhoneVerificationService not available. ` +
+                    'Phone verification requires an SMS provider to be configured.');
+            }
+            const authMethod = challengeSession.metadata?.authMethod || 'password';
+            const authProvider = challengeSession.metadata?.authProvider;
+            const challengeResponse = await this.challengeHelper.createChallengeResponse({ ...user, phone }, auth_challenge_dto_1.AuthChallenge.VERIFY_PHONE, this.config, authMethod, authProvider, true);
+            if (smsError) {
+                challengeResponse.challengeParameters = challengeResponse.challengeParameters || {};
+                challengeResponse.challengeParameters.smsError = smsError;
+            }
+            return challengeResponse;
+        }
+        else {
+            const code = data.code;
+            this.logger?.log?.(`Verifying phone for user: ${user.sub}`);
+            if (!user.phone) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'Phone number not yet provided. Submit phone number first.');
+            }
+            const verifyDto = Object.assign(new verify_phone_by_sub_dto_1.VerifyPhoneWithCodeBySubDTO(), {
+                sub: user.sub,
+                code,
+                challengeSessionId: challengeSession.id,
+            });
+            const result = await this.phoneVerificationService.verifyPhoneWithCodeBySub(verifyDto);
+            const isVerified = result.message === 'Phone verified successfully. Please log in to continue.';
+            if (!isVerified) {
+                await this.challengeService.incrementAttempts(challengeSession);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_INVALID, 'Invalid verification code');
+            }
+            await this.challengeService.validateAndConsumeSession(challengeSession.sessionToken, auth_challenge_dto_1.AuthChallenge.VERIFY_PHONE);
+            const updatedUser = await this.userRepository.findOne({ where: { sub: user.sub } });
+            if (!updatedUser) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found after phone verification');
+            }
+            const clientInfo = this.clientInfoService.get();
+            const authMethod = challengeSession.metadata?.authMethod || 'password';
+            const authProvider = challengeSession.metadata?.authProvider;
+            const isSocialLogin = authMethod === 'social';
+            const response = await this.challengeHelper.determineAuthResponse({
+                user: updatedUser,
+                config: this.config,
+                deviceToken: clientInfo.deviceToken,
+                isSocialLogin,
+                skipMFAVerification: false,
+                authProvider,
+            });
+            if (response.challengeName) {
+                this.logger?.log?.(`Additional challenge required: ${response.challengeName}`);
+            }
+            else {
+                this.logger?.log?.(`Phone verified, auth completed for: ${user.email}`);
+                const fireAndForget = this.config.auditLogs?.fireAndForget !== false;
+                if (fireAndForget) {
+                    this.auditService
+                        ?.recordEvent({
+                        userId: user.id,
+                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                        eventStatus: 'SUCCESS',
+                        authMethod: isSocialLogin ? authProvider || 'social' : 'password',
+                        metadata: {
+                            completedAfterPhoneVerification: true,
+                        },
+                    })
+                        .catch((err) => {
+                        const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                        this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event after phone verification (fire-and-forget): ${errorMessage}`, {
+                            error: err,
+                            userId: user.id,
+                            userSub: user.sub,
+                        });
+                    });
+                }
+                else {
+                    try {
+                        await this.auditService?.recordEvent({
+                            userId: user.id,
+                            eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                            eventStatus: 'SUCCESS',
+                            authMethod: isSocialLogin ? authProvider || 'social' : 'password',
+                            metadata: {
+                                completedAfterPhoneVerification: true,
+                            },
+                        });
+                    }
+                    catch (auditError) {
+                        const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                        this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event after phone verification: ${errorMessage}`, {
+                            error: auditError,
+                            userId: user.id,
+                        });
+                    }
+                }
+            }
+            return response;
+        }
+    }
+    async handleMFAVerification(challengeSession, data) {
+        const user = challengeSession.user;
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.CHALLENGE_INVALID, 'User not found in challenge session');
+        }
+        const method = data.method;
+        this.logger?.log?.(`MFA verification attempt: method=${method}, user=${user.sub}`);
+        if (!this.mfaService) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, 'MFA service is not available');
+        }
+        const clientInfo = this.clientInfoService.get();
+        let isValid = false;
+        if (method === 'passkey') {
+            const passkeyData = data;
+            const credential = passkeyData.credential;
+            const expectedChallenge = challengeSession.metadata?.passkeyChallenge;
+            if (!expectedChallenge) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.CHALLENGE_INVALID, 'No passkey challenge found in session');
+            }
+            const wrappedCredential = { credential, expectedChallenge };
+            const verifyResult = await this.mfaService.verifyCode({
+                sub: user.sub,
+                methodName: mfa_method_enum_1.MFAMethod.PASSKEY,
+                code: wrappedCredential,
+            });
+            isValid = verifyResult.valid;
+        }
+        else {
+            const codeData = data;
+            const code = codeData.code;
+            const verifyResult = await this.mfaService.verifyCode({
+                sub: user.sub,
+                methodName: method,
+                code,
+            });
+            isValid = verifyResult.valid;
+        }
+        if (!isValid) {
+            this.logger?.warn?.(`MFA verification failed for user: ${user.sub}`);
+            if (this.config.auditLogs?.fireAndForget) {
+                this.auditService
+                    ?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.MFA_VERIFICATION_FAILED,
+                    eventStatus: 'FAILURE',
+                    challengeSessionId: challengeSession.id,
+                    authMethod: method,
+                    metadata: { mfaMethod: method },
+                })
+                    .catch((err) => {
+                    const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record MFA_VERIFICATION_FAILED audit event (fire-and-forget): ${errorMessage}`, {
+                        error: err,
+                        userId: user.id,
+                        userSub: user.sub,
+                    });
+                });
+            }
+            else {
+                try {
+                    await this.auditService?.recordEvent({
+                        userId: user.id,
+                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.MFA_VERIFICATION_FAILED,
+                        eventStatus: 'FAILURE',
+                        challengeSessionId: challengeSession.id,
+                        authMethod: method,
+                        metadata: { mfaMethod: method },
+                    });
+                }
+                catch (auditError) {
+                    const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record MFA_VERIFICATION_FAILED audit event: ${errorMessage}`, {
+                        error: auditError,
+                        userId: user.id,
+                    });
+                }
+            }
+            await this.challengeService.incrementAttempts(challengeSession);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VERIFICATION_CODE_INVALID, 'Invalid MFA code');
+        }
+        this.logger?.log?.(`MFA verified successfully for user: ${user.sub}`);
+        if (this.config.auditLogs?.fireAndForget) {
+            this.auditService
+                ?.recordEvent({
+                userId: user.id,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.MFA_VERIFICATION_SUCCESS,
+                eventStatus: 'SUCCESS',
+                challengeSessionId: challengeSession.id,
+                authMethod: method,
+                metadata: { mfaMethod: method },
+            })
+                .catch((err) => {
+                const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record MFA_VERIFICATION_SUCCESS audit event (fire-and-forget): ${errorMessage}`, {
+                    error: err,
+                    userId: user.id,
+                    userSub: user.sub,
+                });
+            });
+        }
+        else {
+            try {
+                await this.auditService?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.MFA_VERIFICATION_SUCCESS,
+                    eventStatus: 'SUCCESS',
+                    challengeSessionId: challengeSession.id,
+                    authMethod: method,
+                    metadata: { mfaMethod: method },
+                });
+            }
+            catch (auditError) {
+                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record MFA_VERIFICATION_SUCCESS audit event: ${errorMessage}`, {
+                    error: auditError,
+                    userId: user.id,
+                });
+            }
+        }
+        await this.challengeService.updateMetadata(challengeSession.sessionToken, {
+            mfaMethod: method,
+        });
+        await this.challengeService.validateAndConsumeSession(challengeSession.sessionToken, auth_challenge_dto_1.AuthChallenge.MFA_REQUIRED);
+        const authMethod = challengeSession.metadata?.authMethod || 'password';
+        const authProvider = challengeSession.metadata?.authProvider;
+        const isSocialLogin = authMethod === 'social';
+        let deviceToken = clientInfo.deviceToken;
+        let isTrustedDevice = false;
+        if (this.trustedDeviceService && this.config.mfa?.rememberDevices && this.config.mfa.rememberDevices !== 'never') {
+            const rememberMode = this.config.mfa.rememberDevices;
+            if (deviceToken) {
+                try {
+                    isTrustedDevice = await this.trustedDeviceService.isDeviceTrusted(deviceToken, user.id);
+                    if (isTrustedDevice) {
+                        this.logger?.debug?.(`MFA flow: existing trusted device token detected for user ${user.sub} (token reused)`);
+                    }
+                }
+                catch (error) {
+                    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                    this.logger?.warn?.(`MFA flow: failed to validate existing trusted device token for user ${user.sub}: ${errorMessage}`, { error });
+                }
+            }
+            if (rememberMode === 'always' && !isTrustedDevice) {
+                try {
+                    deviceToken = await this.trustedDeviceService.createTrustedDevice(user.id, clientInfo.deviceName, clientInfo.deviceType, clientInfo.ipAddress, clientInfo.userAgent, clientInfo.platform, clientInfo.browser);
+                    isTrustedDevice = true;
+                    this.logger?.debug?.(`MFA flow: auto-created trusted device token for user ${user.sub} (rememberDevices='always')`);
+                }
+                catch (error) {
+                    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                    this.logger?.warn?.(`MFA flow: failed to create trusted device token for user ${user.sub}: ${errorMessage}`, {
+                        error,
+                    });
+                }
+            }
+        }
+        const response = await this.challengeHelper.determineAuthResponse({
+            user,
+            config: this.config,
+            deviceToken,
+            isSocialLogin,
+            skipMFAVerification: true,
+            authProvider,
+        });
+        if (isTrustedDevice) {
+            response.trusted = response.trusted ?? true;
+        }
+        if (deviceToken && !response.deviceToken) {
+            response.deviceToken = deviceToken;
+        }
+        if (response.challengeName) {
+            this.logger?.log?.(`Additional challenge required: ${response.challengeName}`);
+        }
+        else {
+            this.logger?.log?.(`MFA verified, auth completed for: ${user.email}`);
+            const fireAndForget = this.config.auditLogs?.fireAndForget !== false;
+            if (fireAndForget) {
+                this.auditService
+                    ?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                    eventStatus: 'SUCCESS',
+                    authMethod: isSocialLogin ? authProvider || 'social' : 'password',
+                    metadata: {
+                        completedAfterMFA: true,
+                    },
+                })
+                    .catch((err) => {
+                    const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event after MFA (fire-and-forget): ${errorMessage}`, {
+                        error: err,
+                        userId: user.id,
+                        userSub: user.sub,
+                    });
+                });
+            }
+            else {
+                try {
+                    await this.auditService?.recordEvent({
+                        userId: user.id,
+                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                        eventStatus: 'SUCCESS',
+                        authMethod: isSocialLogin ? authProvider || 'social' : 'password',
+                        metadata: {
+                            completedAfterMFA: true,
+                        },
+                    });
+                }
+                catch (auditError) {
+                    const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event after MFA: ${errorMessage}`, {
+                        error: auditError,
+                        userId: user.id,
+                    });
+                }
+            }
+        }
+        return response;
+    }
+    async handleForceChangePassword(challengeSession, newPassword) {
+        const user = challengeSession.user;
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.CHALLENGE_INVALID, 'User not found in challenge session');
+        }
+        this.logger?.log?.(`Changing password for user: ${user.sub}`);
+        const validation = await this.passwordService.validatePassword(newPassword, {
+            email: user.email,
+            username: user.username || undefined,
+        });
+        if (!validation.valid) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.WEAK_PASSWORD, validation.errors.join(', '), {
+                errors: validation.errors,
+            });
+        }
+        if (this.config.password?.historyCount) {
+            const historyToCheck = user.passwordHistory || [];
+            const allPreviousPasswords = user.passwordHash ? [user.passwordHash, ...historyToCheck] : historyToCheck;
+            const isReused = await this.passwordService.isPasswordInHistory(newPassword, allPreviousPasswords);
+            if (isReused) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PASSWORD_REUSED, 'You have used this password recently. Please choose a different password.');
+            }
+        }
+        const newHash = await this.passwordService.hashPassword(newPassword);
+        const newHistory = this.passwordService.addToHistory(user.passwordHistory || [], user.passwordHash);
+        user.passwordHash = newHash;
+        user.passwordChangedAt = new Date();
+        user.passwordHistory = newHistory;
+        user.mustChangePassword = false;
+        await this.userRepository.save(user);
+        this.logger?.log?.(`Password changed successfully for user: ${user.sub}`);
+        await this.challengeService.validateAndConsumeSession(challengeSession.sessionToken, auth_challenge_dto_1.AuthChallenge.FORCE_CHANGE_PASSWORD);
+        const updatedUser = await this.userRepository.findOne({ where: { sub: user.sub } });
+        if (!updatedUser) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found after password update');
+        }
+        const clientInfo = this.clientInfoService.get();
+        const authMethod = challengeSession.metadata?.authMethod || 'password';
+        const authProvider = challengeSession.metadata?.authProvider;
+        const isSocialLogin = authMethod === 'social';
+        const response = await this.challengeHelper.determineAuthResponse({
+            user: updatedUser,
+            config: this.config,
+            deviceToken: clientInfo.deviceToken,
+            isSocialLogin,
+            skipMFAVerification: false,
+            authProvider,
+        });
+        if (response.challengeName) {
+            this.logger?.log?.(`Additional challenge required: ${response.challengeName}`);
+        }
+        else {
+            this.logger?.log?.(`Password changed, auth completed for: ${user.email}`);
+            const fireAndForget = this.config.auditLogs?.fireAndForget !== false;
+            if (fireAndForget) {
+                this.auditService
+                    ?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                    eventStatus: 'SUCCESS',
+                    authMethod: isSocialLogin ? authProvider || 'social' : 'password',
+                    metadata: {
+                        completedAfterPasswordChange: true,
+                    },
+                })
+                    .catch((err) => {
+                    const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event after password change (fire-and-forget): ${errorMessage}`, {
+                        error: err,
+                        userId: user.id,
+                        userSub: user.sub,
+                    });
+                });
+            }
+            else {
+                try {
+                    await this.auditService?.recordEvent({
+                        userId: user.id,
+                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                        eventStatus: 'SUCCESS',
+                        authMethod: isSocialLogin ? authProvider || 'social' : 'password',
+                        metadata: {
+                            completedAfterPasswordChange: true,
+                        },
+                    });
+                }
+                catch (auditError) {
+                    const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event after password change: ${errorMessage}`, {
+                        error: auditError,
+                        userId: user.id,
+                    });
+                }
+            }
+        }
+        return response;
+    }
+    async handleMFASetup(challengeSession, data) {
+        const user = challengeSession.user;
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.CHALLENGE_INVALID, 'User not found in challenge session');
+        }
+        const method = data.method;
+        const setupData = data.setupData;
+        const requestTrace = `${Date.now()}-${Math.random().toString(36).substring(7)}`;
+        this.logger?.log?.(`[${requestTrace}] MFA setup attempt: method=${method}, user=${user.sub}`);
+        if (!this.mfaService) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, 'MFA service is not available');
+        }
+        const provider = this.mfaService.getProvider(method);
+        let deviceId;
+        try {
+            deviceId = await provider.verifySetup(user, setupData);
+            this.logger?.log?.(`MFA device setup completed: method=${method}, deviceId=${deviceId}`);
+        }
+        catch (error) {
+            this.logger?.warn?.(`MFA setup verification failed: method=${method}, user=${user.sub}`);
+            await this.challengeService.incrementAttempts(challengeSession);
+            throw error;
+        }
+        await this.challengeService.updateMetadata(challengeSession.sessionToken, {
+            mfaMethod: method,
+        });
+        await this.challengeService.validateAndConsumeSession(challengeSession.sessionToken, auth_challenge_dto_1.AuthChallenge.MFA_SETUP_REQUIRED);
+        const updatedUser = await this.userRepository.findOne({ where: { sub: user.sub } });
+        if (!updatedUser) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found after MFA setup');
+        }
+        const clientInfo = this.clientInfoService.get();
+        const response = await this.challengeHelper.determineAuthResponse({
+            user: updatedUser,
+            config: this.config,
+            deviceToken: clientInfo.deviceToken,
+            isSocialLogin: false,
+            skipMFAVerification: true,
+        });
+        if (response.challengeName) {
+            this.logger?.log?.(`Additional challenge required: ${response.challengeName}`);
+        }
+        else {
+            this.logger?.log?.(`MFA setup completed, auth completed for: ${user.email}`);
+            const fireAndForget = this.config.auditLogs?.fireAndForget !== false;
+            if (fireAndForget) {
+                this.auditService
+                    ?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                    eventStatus: 'SUCCESS',
+                    authMethod: 'password',
+                    metadata: {
+                        completedAfterMFASetup: true,
+                    },
+                })
+                    .catch((err) => {
+                    const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event after MFA setup (fire-and-forget): ${errorMessage}`, {
+                        error: err,
+                        userId: user.id,
+                        userSub: user.sub,
+                    });
+                });
+            }
+            else {
+                try {
+                    await this.auditService?.recordEvent({
+                        userId: user.id,
+                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.LOGIN_SUCCESS,
+                        eventStatus: 'SUCCESS',
+                        authMethod: 'password',
+                        metadata: {
+                            completedAfterMFASetup: true,
+                        },
+                    });
+                }
+                catch (auditError) {
+                    const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                    this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event after MFA setup: ${errorMessage}`, {
+                        error: auditError,
+                        userId: user.id,
+                    });
+                }
+            }
+        }
+        return response;
+    }
+    async resendCode(dto) {
+        this.logger?.debug?.(`Resending verification code: session=${dto.session}`);
+        const challengeSession = await this.challengeService.validateSession(dto.session);
+        const user = challengeSession.user;
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'Challenge session has no associated user');
+        }
+        switch (challengeSession.challengeName) {
+            case auth_challenge_dto_1.AuthChallenge.VERIFY_EMAIL: {
+                const resendDto = Object.assign(new verify_email_dto_1.ResendVerificationEmailDTO(), { sub: user.sub });
+                await this.emailVerificationService.resendVerificationEmail(resendDto);
+                const maskedEmail = this.maskEmail(user.email);
+                this.logger?.debug?.(`Email verification code resent: user=${user.sub}, email=${maskedEmail}`);
+                return { destination: maskedEmail };
+            }
+            case auth_challenge_dto_1.AuthChallenge.VERIFY_PHONE: {
+                if (!user.phone) {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'Phone number not yet provided. Submit phone number first.');
+                }
+                if (!this.phoneVerificationService) {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, 'Phone verification service is not available');
+                }
+                const resendDto = Object.assign(new verify_phone_dto_1.ResendVerificationSMSDTO(), { sub: user.sub });
+                await this.phoneVerificationService.resendVerificationSMS(resendDto);
+                const maskedPhone = this.maskPhone(user.phone);
+                this.logger?.debug?.(`Phone verification code resent: user=${user.sub}, phone=${maskedPhone}`);
+                return { destination: maskedPhone };
+            }
+            case auth_challenge_dto_1.AuthChallenge.MFA_REQUIRED: {
+                const metadata = challengeSession.metadata;
+                const method = metadata?.method;
+                if (!method) {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, 'Cannot resend MFA code: method not specified in session');
+                }
+                if (method === 'sms' || method === 'email') {
+                    if (method === 'sms' && this.phoneVerificationService) {
+                        const smsDto = Object.assign(new verify_phone_dto_1.SendVerificationSMSDTO(), {
+                            sub: user.sub,
+                            skipAlreadyVerifiedCheck: true,
+                            challengeSessionId: challengeSession.id,
+                        });
+                        await this.phoneVerificationService.sendVerificationSMS(smsDto);
+                        this.logger?.debug?.(`SMS MFA code resent: user=${user.sub}`);
+                        const maskedPhone = user.phone ? this.maskPhone(user.phone) : '***-***-****';
+                        return { destination: maskedPhone };
+                    }
+                    if (method === 'email' && this.emailVerificationService) {
+                        const emailDto = Object.assign(new verify_email_dto_1.ResendVerificationEmailDTO(), {
+                            sub: user.sub,
+                            challengeSessionId: challengeSession.id,
+                        });
+                        await this.emailVerificationService.resendVerificationEmail(emailDto);
+                        this.logger?.debug?.(`Email MFA code resent: user=${user.sub}`);
+                        const maskedEmail = user.email ? this.maskEmail(user.email) : 'u***r@example.com';
+                        return { destination: maskedEmail };
+                    }
+                    if (!this.mfaService) {
+                        throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, 'MFA service is not available');
+                    }
+                    const provider = this.mfaService.getProvider(method);
+                    if (!provider.sendChallenge) {
+                        throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, `${method.toUpperCase()} MFA provider does not support sending challenges`);
+                    }
+                    const result = await provider.sendChallenge(user);
+                    this.logger?.debug?.(`${method.toUpperCase()} MFA code resent: user=${user.sub}`);
+                    return { destination: result };
+                }
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, `Cannot resend code for MFA method '${method}'. Only SMS and Email support code resending.`);
+            }
+            default:
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, `Cannot resend code for challenge type '${challengeSession.challengeName}'`);
+        }
+    }
+    maskEmail(email) {
+        const [localPart, domain] = email.split('@');
+        if (localPart.length <= 2) {
+            return `${localPart[0]}***@${domain}`;
+        }
+        return `${localPart[0]}***${localPart[localPart.length - 1]}@${domain}`;
+    }
+    maskPhone(phone) {
+        const digits = phone.replace(/\D/g, '');
+        const lastFour = digits.slice(-4);
+        return `***-***-${lastFour}`;
+    }
+    async trustDevice() {
+        if (this.config.mfa?.rememberDevices !== 'user_opt_in') {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.FORBIDDEN, 'Trust device feature is only available in user_opt_in mode');
+        }
+        if (!this.trustedDeviceService) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, 'Trusted device service not available');
+        }
+        const clientInfo = this.clientInfoService.get();
+        const sessionId = clientInfo.sessionId;
+        if (!sessionId) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session ID not found in request context. Ensure the request is authenticated.');
+        }
+        const session = await this.sessionService.findById(sessionId);
+        if (!session || session.isRevoked) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
+        }
+        const user = await this.userRepository.findOne({ where: { id: session.userId } });
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        const userId = typeof user.id === 'number' ? user.id : parseInt(String(user.id), 10);
+        if (clientInfo.deviceToken) {
+            const isAlreadyTrusted = await this.trustedDeviceService.isDeviceTrusted(clientInfo.deviceToken, userId);
+            if (isAlreadyTrusted) {
+                this.logger?.debug?.(`Device already trusted for user ${user.sub}`);
+                return { deviceToken: clientInfo.deviceToken };
+            }
+            try {
+                await this.trustedDeviceService.revokeTrustedDevice(clientInfo.deviceToken, userId);
+                this.logger?.debug?.(`Revoked existing untrusted device token for user ${user.sub}`);
+            }
+            catch {
+            }
+        }
+        const deviceToken = await this.trustedDeviceService.createTrustedDevice(userId, session.deviceName || clientInfo.deviceName, session.deviceType || clientInfo.deviceType, session.ipAddress || clientInfo.ipAddress, session.userAgent || clientInfo.userAgent, clientInfo.platform, clientInfo.browser);
+        this.logger?.log?.(`Device trusted for user ${user.sub} (user opt-in)`);
+        try {
+            const userId = typeof user.id === 'number' ? user.id : parseInt(String(user.id), 10);
+            await this.auditService?.recordEvent({
+                userId,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.DEVICE_TRUSTED,
+                eventStatus: 'SUCCESS',
+                deviceId: deviceToken,
+                sessionId: session.id,
+                description: `Device trusted by user (opt-in) - ${session.deviceName || 'Unknown device'}`,
+                metadata: {
+                    rememberDeviceDays: this.config.mfa?.rememberDeviceDays || 30,
+                    trustedUntil: new Date(Date.now() + (this.config.mfa?.rememberDeviceDays || 30) * 24 * 60 * 60 * 1000).toISOString(),
+                },
+            });
+        }
+        catch (auditError) {
+            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+            this.logger?.error?.(`Failed to record DEVICE_TRUSTED audit event: ${errorMessage}`, {
+                error: auditError,
+                userId: user.id,
+            });
+        }
+        return { deviceToken };
+    }
+    async isTrustedDevice() {
+        if (!this.trustedDeviceService) {
+            return { trusted: false };
+        }
+        const clientInfo = this.clientInfoService.get();
+        const sessionId = clientInfo.sessionId;
+        if (!sessionId) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session ID not found in request context. Ensure the request is authenticated.');
+        }
+        const session = await this.sessionService.findById(sessionId);
+        if (!session || session.isRevoked) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
+        }
+        const user = await this.userRepository.findOne({ where: { id: session.userId } });
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        const userId = typeof user.id === 'number' ? user.id : parseInt(String(user.id), 10);
+        const deviceToken = clientInfo.deviceToken;
+        if (!deviceToken) {
+            return { trusted: false };
+        }
+        const isTrusted = await this.trustedDeviceService.isDeviceTrusted(deviceToken, userId);
+        return { trusted: isTrusted };
+    }
+    async refreshToken(dto) {
+        const tokenHash = this.jwtService.hashToken(dto.refreshToken);
+        const session = await this.sessionService.findByRefreshToken(tokenHash);
+        if (!session || session.isRevoked) {
+            const validation = await this.jwtService.validateRefreshToken(dto.refreshToken);
+            const userId = validation.payload?.sub || 'unknown';
+            this.logger?.debug?.(`Session not found or revoked for user ${userId}. Possible issue where token are not cleared on logout`);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
+        }
+        const lockKey = `session-refresh:${session.id}`;
+        this.logger?.debug?.(`[REFRESH DEBUG] Attempting to acquire lock ${lockKey} for token hash ${tokenHash.substring(0, 16)}...`);
+        let lockAcquired = false;
+        try {
+            const lockStartTime = Date.now();
+            lockAcquired = await this.sessionService.acquireRefreshLock(lockKey, 10000);
+            const lockDuration = Date.now() - lockStartTime;
+            if (!lockAcquired) {
+                this.logger?.warn?.(`[REFRESH DEBUG] Lock ${lockKey} NOT acquired - refresh already in progress for session ${session.id}`);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.RATE_LIMIT_LOGIN, 'Token refresh already in progress', {
+                    retryAfter: 5,
+                });
+            }
+            this.logger?.debug?.(`[REFRESH DEBUG] Lock ${lockKey} acquired successfully in ${lockDuration}ms for token hash ${tokenHash.substring(0, 16)}...`);
+            if (this.config.jwt.refreshToken.reuseDetection) {
+                const isAlreadyUsed = await this.sessionService.isRefreshTokenUsed(tokenHash);
+                if (isAlreadyUsed) {
+                    const tokenPayload = this.jwtService.decodeToken(dto.refreshToken);
+                    const tokenSessionId = tokenPayload?.sessionId;
+                    const currentSession = (await this.sessionService.findByIdLight(session.id));
+                    if (!currentSession || currentSession.isRevoked) {
+                        throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
+                    }
+                    if (tokenSessionId && tokenSessionId === session.id.toString()) {
+                        this.logger?.debug?.(`[REFRESH DEBUG] Token hash ${tokenHash.substring(0, 16)}... already used for same session ${session.id} - cookie race detected, returning current tokens`);
+                        const user = (await this.userRepository.findOne({
+                            where: { id: currentSession.userId },
+                        }));
+                        if (!user) {
+                            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+                        }
+                        const newTokens = await this.jwtService.generateTokenPair({
+                            userId: user.sub,
+                            email: user.email,
+                            sessionId: currentSession.id.toString(),
+                            tokenFamily: currentSession.tokenFamily,
+                        });
+                        await this.sessionService.updateTokens(currentSession.id, this.jwtService.hashToken(newTokens.accessToken), this.jwtService.hashToken(newTokens.refreshToken));
+                        const accessTokenValidation = await this.jwtService.validateAccessToken(newTokens.accessToken);
+                        const refreshTokenValidation = await this.jwtService.validateRefreshToken(newTokens.refreshToken);
+                        return {
+                            accessToken: newTokens.accessToken,
+                            refreshToken: newTokens.refreshToken,
+                            accessTokenExpiresAt: accessTokenValidation.payload?.exp || 0,
+                            refreshTokenExpiresAt: refreshTokenValidation.payload?.exp || 0,
+                        };
+                    }
+                    else {
+                        this.logger?.error?.(`[REFRESH DEBUG] Token hash ${tokenHash.substring(0, 16)}... already used for different session - ATTACK DETECTED! Token sessionId: ${tokenSessionId}, Found session: ${session.id}. Revoking session ${session.id}`);
+                        await this.sessionService.revokeSession(session.id, 'Token reuse detected - possible token theft');
+                        let userForAudit = null;
+                        try {
+                            userForAudit = (await this.userRepository.findOne({
+                                where: { id: session.userId },
+                            }));
+                            if (userForAudit) {
+                                await this.auditService?.recordEvent({
+                                    userId: userForAudit.id,
+                                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.SUSPICIOUS_ACTIVITY,
+                                    eventStatus: 'SUSPICIOUS',
+                                    riskFactor: 90,
+                                    riskFactors: [risk_factor_enum_1.RiskFactor.TOKEN_THEFT_ATTEMPT, risk_factor_enum_1.RiskFactor.REFRESH_TOKEN_REUSE_DIFFERENT_SESSION],
+                                    reason: 'Refresh token reuse from different session',
+                                    description: 'Refresh token from another session attempted to be used. Session revoked as security measure.',
+                                    metadata: {
+                                        sessionId: session.id,
+                                        tokenSessionId,
+                                        tokenHash: `${tokenHash.substring(0, 16)}...`,
+                                        detectedAt: new Date().toISOString(),
+                                        action: 'session_revoked',
+                                    },
+                                });
+                            }
+                        }
+                        catch (auditError) {
+                            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                            this.logger?.error?.(`Failed to record SUSPICIOUS_ACTIVITY audit event (token reuse): ${errorMessage}`, {
+                                error: auditError,
+                                userId: userForAudit?.id || session.userId,
+                            });
+                        }
+                        throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Refresh token has already been used');
+                    }
+                }
+            }
+            const validation = await this.jwtService.validateRefreshToken(dto.refreshToken);
+            if (!validation.valid || !validation.payload) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Invalid refresh token');
+            }
+            const payload = validation.payload;
+            const lockedSession = (await this.sessionService.findByIdLight(session.id));
+            if (!lockedSession || lockedSession.isRevoked || lockedSession.id !== session.id) {
+                this.logger?.debug?.(`Session changed after lock acquisition for user ${payload.sub}. Session may have been revoked.`);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
+            }
+            if (this.config.jwt.refreshToken.reuseDetection) {
+                const refreshTokenTTL = this.jwtService.getRefreshTokenTTL();
+                const marked = await this.sessionService.markRefreshTokenAsUsed(tokenHash, refreshTokenTTL);
+                if (!marked) {
+                    this.logger?.error?.(`Token reuse detected for user ${payload.sub} - atomic mark failed, revoking entire token family ${payload.tokenFamily}`);
+                    try {
+                        const userForAudit = (await this.userRepository.findOne({
+                            where: { sub: payload.sub },
+                        }));
+                        if (userForAudit) {
+                            await this.auditService?.recordEvent({
+                                userId: userForAudit.id,
+                                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.SUSPICIOUS_ACTIVITY,
+                                eventStatus: 'SUSPICIOUS',
+                                riskFactor: 75,
+                                riskFactors: [risk_factor_enum_1.RiskFactor.TOKEN_REUSE_ATTEMPT],
+                                reason: 'Token reuse attempt blocked',
+                                description: 'Refresh token reuse attempt detected via atomic operation. Legitimate user session preserved.',
+                                metadata: {
+                                    tokenFamily: payload.tokenFamily,
+                                    detectedAt: new Date().toISOString(),
+                                    action: 'reuse_blocked_atomic',
+                                },
+                            });
+                        }
+                    }
+                    catch (auditError) {
+                        this.logger?.warn?.('Failed to record SUSPICIOUS_ACTIVITY audit event', { error: auditError });
+                    }
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Refresh token has already been used');
+                }
+                this.logger?.debug?.(`Marked refresh token as used for session ${lockedSession.id}`);
+            }
+            const newTokens = await this.jwtService.generateTokenPair({
+                userId: payload.sub,
+                email: payload.email,
+                sessionId: lockedSession.id.toString(),
+                tokenFamily: payload.tokenFamily,
+            });
+            await this.sessionService.updateTokens(lockedSession.id, this.jwtService.hashToken(newTokens.accessToken), this.jwtService.hashToken(newTokens.refreshToken));
+            this.logger?.log?.(`Token refreshed successfully for user ${payload.sub}`);
+            const accessTokenValidation = await this.jwtService.validateAccessToken(newTokens.accessToken);
+            const refreshTokenValidation = await this.jwtService.validateRefreshToken(newTokens.refreshToken);
+            return {
+                accessToken: newTokens.accessToken,
+                refreshToken: newTokens.refreshToken,
+                accessTokenExpiresAt: accessTokenValidation.payload?.exp || 0,
+                refreshTokenExpiresAt: refreshTokenValidation.payload?.exp || 0,
+            };
+        }
+        finally {
+            if (lockAcquired) {
+                await this.sessionService.releaseRefreshLock(lockKey);
+                this.logger?.debug?.(`[REFRESH DEBUG] Released lock ${lockKey}`);
+            }
+        }
+    }
+    async logout(dto) {
+        const clientInfo = this.clientInfoService.get();
+        let sessionId = clientInfo.sessionId;
+        if (!sessionId) {
+            const jwtPayload = context_storage_1.ContextStorage.get('JWT_PAYLOAD');
+            if (jwtPayload?.sessionId) {
+                const sessionIdStr = String(jwtPayload.sessionId);
+                const sessionIdNumber = parseInt(sessionIdStr, 10);
+                if (!isNaN(sessionIdNumber) && sessionIdNumber > 0) {
+                    sessionId = sessionIdNumber;
+                    const clientInfoInContext = context_storage_1.ContextStorage.get('CLIENT_INFO');
+                    if (clientInfoInContext) {
+                        clientInfoInContext.sessionId = sessionIdNumber;
+                        context_storage_1.ContextStorage.set('CLIENT_INFO', clientInfoInContext);
+                    }
+                }
+            }
+        }
+        if (!sessionId) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session ID not found in request context. Ensure the request is authenticated.');
+        }
+        const auditMetadata = dto.forgetMe
+            ? {
+                deviceForgotten: true,
+                reason: 'User requested device to be forgotten on logout',
+            }
+            : undefined;
+        await this.sessionService.revokeSession(sessionId, 'User logout', auditMetadata);
+        if (dto.forgetMe &&
+            this.config.mfa?.rememberDevices &&
+            this.config.mfa?.rememberDevices !== 'never' &&
+            this.trustedDeviceService) {
+            if (clientInfo.deviceToken) {
+                try {
+                    const session = await this.sessionService.findById(sessionId);
+                    if (session) {
+                        await this.trustedDeviceService.revokeTrustedDevice(clientInfo.deviceToken, session.userId);
+                        this.logger?.log?.(`Revoked trusted device token for user (forgetMe=true)`);
+                        const user = await this.userRepository.findOne({ where: { id: session.userId } });
+                        if (user) {
+                            try {
+                                const userId = typeof user.id === 'number' ? user.id : parseInt(String(user.id), 10);
+                                await this.auditService?.recordEvent({
+                                    userId,
+                                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.DEVICE_UNTRUSTED,
+                                    eventStatus: 'SUCCESS',
+                                    sessionId: session.id,
+                                    description: `Device untrusted by user (forgetMe=true) - ${session.deviceName || 'Unknown device'}`,
+                                    metadata: {
+                                        reason: 'user_logout_forget_me',
+                                    },
+                                });
+                            }
+                            catch (auditError) {
+                                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                                this.logger?.error?.(`Failed to record DEVICE_UNTRUSTED audit event: ${errorMessage}`, {
+                                    error: auditError,
+                                    userId: session.userId,
+                                });
+                            }
+                        }
+                    }
+                }
+                catch (error) {
+                    const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                    this.logger?.debug?.(`Failed to revoke trusted device token on logout: ${errorMessage}`, { error });
+                }
+            }
+        }
+        const response = this.clientInfoService.getResponse();
+        if (response && this.config.tokenDelivery?.method !== 'json') {
+            this.clearAuthCookies(response, dto.forgetMe ?? false);
+            this.logger?.debug?.('Auth cookies cleared automatically on logout');
+        }
+        return { success: true };
+    }
+    clearAuthCookies(response, forgetDevice) {
+        if (!response.clearCookie) {
+            return;
+        }
+        const cookieOptions = this.config.tokenDelivery?.cookieOptions || {};
+        const prefix = this.config.tokenDelivery?.cookieNamePrefix || 'nauth';
+        response.clearCookie(`${prefix}_access_token`, cookieOptions);
+        response.clearCookie(`${prefix}_refresh_token`, cookieOptions);
+        const csrfCookieOptions = {
+            ...cookieOptions,
+            httpOnly: false,
+        };
+        const csrfCookieName = this.config.security?.csrf?.cookieName || `${prefix}_csrf_token`;
+        response.clearCookie(csrfCookieName, csrfCookieOptions);
+        if (forgetDevice) {
+            response.clearCookie(`${prefix}_device_token`, cookieOptions);
+        }
+    }
+    async logoutAll(dto) {
+        const user = (await this.userRepository.findOne({ where: { sub: dto.sub } }));
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        const revokedCount = await this.sessionService.revokeAllUserSessions(user.id, 'Global signout');
+        let revokedDevicesCount = 0;
+        let revokedDevices = [];
+        if (dto.forgetDevices &&
+            this.config.mfa?.rememberDevices &&
+            this.config.mfa?.rememberDevices !== 'never' &&
+            this.trustedDeviceService) {
+            try {
+                const deviceRevocationResult = await this.trustedDeviceService.revokeAllTrustedDevices(user.id);
+                revokedDevicesCount = deviceRevocationResult.revokedCount;
+                revokedDevices = deviceRevocationResult.devices;
+                this.logger?.log?.(`Revoked ${revokedDevicesCount} trusted device(s) for user ${user.sub} (forgetDevices=true)`);
+                if (revokedDevicesCount > 0 && this.auditService) {
+                    try {
+                        const userId = typeof user.id === 'number' ? user.id : parseInt(String(user.id), 10);
+                        await this.auditService.recordEvent({
+                            userId,
+                            eventType: auth_audit_event_type_enum_1.AuthAuditEventType.DEVICE_UNTRUSTED,
+                            eventStatus: 'SUCCESS',
+                            description: `Global signout: All trusted devices revoked (${revokedDevicesCount} device(s))`,
+                            metadata: {
+                                reason: 'global_logout_forget_devices',
+                                revokedDevicesCount,
+                                devices: revokedDevices.map((d) => ({
+                                    id: d.id,
+                                    deviceName: d.deviceName,
+                                    lastUsedAt: d.lastUsedAt?.toISOString() || null,
+                                    trustedUntil: d.trustedUntil?.toISOString() || null,
+                                })),
+                            },
+                        });
+                    }
+                    catch (auditError) {
+                        const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                        this.logger?.error?.(`Failed to record DEVICE_UNTRUSTED audit event: ${errorMessage}`, {
+                            error: auditError,
+                            userId: user.id,
+                        });
+                    }
+                }
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                this.logger?.debug?.(`Failed to revoke trusted devices on global logout: ${errorMessage}`, { error });
+            }
+        }
+        if (this.auditService && revokedCount > 0) {
+            try {
+                const userId = typeof user.id === 'number' ? user.id : parseInt(String(user.id), 10);
+                const description = dto.forgetDevices && revokedDevicesCount > 0
+                    ? `Global signout: ${revokedCount} session(s) revoked, ${revokedDevicesCount} trusted device(s) forgotten`
+                    : `Global signout: ${revokedCount} session(s) revoked`;
+                await this.auditService.recordEvent({
+                    userId,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.GLOBAL_SIGNOUT,
+                    eventStatus: 'INFO',
+                    reason: 'Global signout',
+                    description,
+                    metadata: {
+                        revokedCount,
+                        forgetDevices: dto.forgetDevices ?? false,
+                        ...(dto.forgetDevices && revokedDevicesCount > 0
+                            ? {
+                                revokedDevicesCount,
+                                devices: revokedDevices.map((d) => ({
+                                    id: d.id,
+                                    deviceName: d.deviceName,
+                                    lastUsedAt: d.lastUsedAt?.toISOString() || null,
+                                    trustedUntil: d.trustedUntil?.toISOString() || null,
+                                })),
+                            }
+                            : {}),
+                    },
+                });
+            }
+            catch (auditError) {
+                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                this.logger?.error?.(`Failed to record GLOBAL_SIGNOUT audit event: ${errorMessage}`, {
+                    error: auditError,
+                    userId: user.id,
+                });
+            }
+        }
+        const response = this.clientInfoService.getResponse();
+        if (response && this.config.tokenDelivery?.method !== 'json') {
+            this.clearAuthCookies(response, dto.forgetDevices ?? false);
+            this.logger?.debug?.('Auth cookies cleared automatically on global logout');
+        }
+        return { revokedCount };
+    }
+    async changePassword(dto) {
+        const user = (await this.userRepository.findOne({ where: { sub: dto.sub } }));
+        if (!user || !user.passwordHash) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        if (this.config.hooks?.beforePasswordChange) {
+            const result = await this.config.hooks.beforePasswordChange(dto.sub, dto.oldPassword);
+            if (result === false) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PASSWORD_CHANGE_NOT_ALLOWED, 'Password change not allowed');
+            }
+        }
+        const isValid = await this.passwordService.verifyPassword(dto.oldPassword, user.passwordHash);
+        if (!isValid) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PASSWORD_INCORRECT, 'Current password is incorrect');
+        }
+        const validation = await this.passwordService.validatePassword(dto.newPassword, {
+            email: user.email,
+            username: user.username || undefined,
+        });
+        if (!validation.valid) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.WEAK_PASSWORD, validation.errors.join(', '), {
+                errors: validation.errors,
+            });
+        }
+        if (this.config.password?.historyCount) {
+            const historyToCheck = user.passwordHistory || [];
+            const allPreviousPasswords = user.passwordHash ? [user.passwordHash, ...historyToCheck] : historyToCheck;
+            const isReused = await this.passwordService.isPasswordInHistory(dto.newPassword, allPreviousPasswords);
+            if (isReused) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PASSWORD_REUSED, 'You have used this password recently. Please choose a different password.');
+            }
+        }
+        const newHash = await this.passwordService.hashPassword(dto.newPassword);
+        const newHistory = this.passwordService.addToHistory(user.passwordHistory || [], user.passwordHash);
+        user.passwordHash = newHash;
+        user.passwordChangedAt = new Date();
+        user.passwordHistory = newHistory;
+        await this.userRepository.save(user);
+        if (this.config.hooks?.afterPasswordChange) {
+            await this.config.hooks.afterPasswordChange(dto.sub);
+        }
+        await this.sessionService.revokeAllUserSessions(user.id, 'Password changed');
+        try {
+            await this.auditService?.recordEvent({
+                userId: user.id,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PASSWORD_CHANGED,
+                eventStatus: 'SUCCESS',
+            });
+        }
+        catch (auditError) {
+            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+            this.logger?.error?.(`Failed to record PASSWORD_CHANGED audit event: ${errorMessage}`, {
+                error: auditError,
+                userId: user.id,
+            });
+        }
+        return { success: true };
+    }
+    async updateUserAttributes(dto) {
+        const user = (await this.userRepository.findOne({ where: { sub: dto.sub } }));
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        await this.validateUniquenessConstraints(user.id, dto);
+        const updateFields = {};
+        if (dto.firstName !== undefined) {
+            updateFields.firstName = dto.firstName;
+        }
+        if (dto.lastName !== undefined) {
+            updateFields.lastName = dto.lastName;
+        }
+        if (dto.username !== undefined) {
+            updateFields.username = dto.username;
+        }
+        if (dto.email !== undefined) {
+            const oldEmail = user.email;
+            updateFields.email = dto.email;
+            if (dto.email !== user.email) {
+                if (!dto.retainVerification) {
+                    updateFields.isEmailVerified = false;
+                }
+                else {
+                    updateFields.isEmailVerified = user.isEmailVerified;
+                }
+                if (oldEmail && this.mfaDeviceRepository) {
+                    try {
+                        const emailDevices = (await this.mfaDeviceRepository.find({
+                            where: {
+                                userId: user.id,
+                                type: mfa_method_enum_1.MFAMethod.EMAIL,
+                                isActive: true,
+                            },
+                        }));
+                        if (emailDevices.length > 0) {
+                            this.logger?.log?.(`Deleting ${emailDevices.length} Email MFA device(s) for user ${user.sub} due to email address change (old: ${oldEmail}, new: ${dto.email})`);
+                            for (const device of emailDevices) {
+                                const deviceId = device.id;
+                                await this.mfaDeviceRepository.delete(deviceId);
+                            }
+                            if (this.auditService) {
+                                try {
+                                    await this.auditService.recordEvent({
+                                        userId: user.id,
+                                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.MFA_DEVICE_REMOVED,
+                                        eventStatus: 'INFO',
+                                        reason: 'email_changed',
+                                        description: `Email MFA device(s) removed due to email address change (${oldEmail} → ${dto.email})`,
+                                        metadata: {
+                                            method: mfa_method_enum_1.MFAMethod.EMAIL,
+                                            deletedCount: emailDevices.length,
+                                            oldEmail,
+                                            newEmail: dto.email,
+                                            reason: 'email_address_changed_requires_reverification',
+                                        },
+                                    });
+                                }
+                                catch (auditError) {
+                                    const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                                    this.logger?.error?.(`Failed to record MFA_DEVICE_REMOVED audit event for email change: ${errorMessage}`, { error: auditError, userId: user.id });
+                                }
+                            }
+                            const allActiveDevices = (await this.mfaDeviceRepository.find({
+                                where: {
+                                    userId: user.id,
+                                    isActive: true,
+                                },
+                            }));
+                            if (allActiveDevices.length === 0 && user.mfaEnabled) {
+                                updateFields.mfaEnabled = false;
+                                updateFields.mfaMethods = [];
+                                updateFields.preferredMfaMethod = null;
+                                this.logger?.log?.(`MFA disabled for user ${user.sub} - no active MFA devices remaining after email change`);
+                            }
+                            else {
+                                this.logger?.log?.(`User ${user.sub} still has ${allActiveDevices.length} active MFA device(s) - MFA remains enabled`);
+                            }
+                        }
+                    }
+                    catch (error) {
+                        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                        this.logger?.warn?.(`Failed to handle MFA device deactivation during email change for user ${user.sub}: ${errorMessage}`);
+                    }
+                }
+            }
+        }
+        if (dto.phone !== undefined) {
+            const oldPhone = user.phone;
+            updateFields.phone = dto.phone;
+            if (dto.phone !== user.phone) {
+                if (!dto.retainVerification) {
+                    updateFields.isPhoneVerified = false;
+                }
+                else {
+                    updateFields.isPhoneVerified = user.isPhoneVerified;
+                }
+                if (oldPhone && this.mfaDeviceRepository) {
+                    try {
+                        const smsDevices = (await this.mfaDeviceRepository.find({
+                            where: {
+                                userId: user.id,
+                                type: mfa_method_enum_1.MFAMethod.SMS,
+                                isActive: true,
+                            },
+                        }));
+                        if (smsDevices.length > 0) {
+                            this.logger?.log?.(`Deleting ${smsDevices.length} SMS MFA device(s) for user ${user.sub} due to phone number change (old: ${oldPhone}, new: ${dto.phone})`);
+                            for (const device of smsDevices) {
+                                const deviceId = device.id;
+                                await this.mfaDeviceRepository.delete(deviceId);
+                            }
+                            if (this.auditService) {
+                                try {
+                                    await this.auditService.recordEvent({
+                                        userId: user.id,
+                                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.MFA_DEVICE_REMOVED,
+                                        eventStatus: 'INFO',
+                                        reason: 'phone_changed',
+                                        description: `SMS MFA device(s) removed due to phone number change (${oldPhone} → ${dto.phone})`,
+                                        metadata: {
+                                            method: mfa_method_enum_1.MFAMethod.SMS,
+                                            deletedCount: smsDevices.length,
+                                            oldPhone,
+                                            newPhone: dto.phone,
+                                            reason: 'phone_number_changed_requires_reverification',
+                                        },
+                                    });
+                                }
+                                catch (auditError) {
+                                    const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                                    this.logger?.error?.(`Failed to record MFA_DEVICE_REMOVED audit event for phone change: ${errorMessage}`, { error: auditError, userId: user.id });
+                                }
+                            }
+                            const allActiveDevices = (await this.mfaDeviceRepository.find({
+                                where: {
+                                    userId: user.id,
+                                    isActive: true,
+                                },
+                            }));
+                            if (allActiveDevices.length === 0 && user.mfaEnabled) {
+                                updateFields.mfaEnabled = false;
+                                updateFields.mfaMethods = [];
+                                updateFields.preferredMfaMethod = null;
+                                this.logger?.log?.(`MFA disabled for user ${user.sub} - no active MFA devices remaining after phone change`);
+                            }
+                            else {
+                                this.logger?.log?.(`User ${user.sub} still has ${allActiveDevices.length} active MFA device(s) - MFA remains enabled`);
+                            }
+                        }
+                    }
+                    catch (error) {
+                        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                        this.logger?.warn?.(`Failed to handle MFA device deactivation during phone change for user ${user.sub}: ${errorMessage}`);
+                    }
+                }
+            }
+        }
+        if (dto.preferredMfaMethod !== undefined) {
+            updateFields.preferredMfaMethod = dto.preferredMfaMethod;
+        }
+        if (dto.metadata !== undefined) {
+            const existingMetadata = user.metadata || {};
+            updateFields.metadata = { ...existingMetadata, ...dto.metadata };
+        }
+        await this.userRepository.update(user.id, updateFields);
+        const updatedUser = (await this.userRepository.findOne({ where: { id: user.id } }));
+        if (!updatedUser) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found after update');
+        }
+        try {
+            const updatedFieldNames = Object.keys(updateFields);
+            const fieldChanges = {};
+            if (dto.firstName !== undefined && dto.firstName !== user.firstName) {
+                fieldChanges.firstName = {
+                    before: user.firstName ?? null,
+                    after: dto.firstName ?? null,
+                };
+            }
+            if (dto.lastName !== undefined && dto.lastName !== user.lastName) {
+                fieldChanges.lastName = {
+                    before: user.lastName ?? null,
+                    after: dto.lastName ?? null,
+                };
+            }
+            if (dto.username !== undefined && dto.username !== user.username) {
+                fieldChanges.username = {
+                    before: user.username ?? null,
+                    after: dto.username ?? null,
+                };
+            }
+            if (dto.email !== undefined && dto.email !== user.email) {
+                fieldChanges.email = {
+                    before: user.email ?? null,
+                    after: dto.email ?? null,
+                };
+            }
+            if (dto.phone !== undefined && dto.phone !== user.phone) {
+                fieldChanges.phone = {
+                    before: user.phone ?? null,
+                    after: dto.phone ?? null,
+                };
+            }
+            if (dto.preferredMfaMethod !== undefined && dto.preferredMfaMethod !== user.preferredMfaMethod) {
+                fieldChanges.preferredMfaMethod = {
+                    before: user.preferredMfaMethod ?? null,
+                    after: dto.preferredMfaMethod ?? null,
+                };
+            }
+            if (dto.metadata !== undefined) {
+                const oldMetadata = user.metadata || {};
+                const newMetadata = { ...oldMetadata, ...dto.metadata };
+                const metadataChanges = {};
+                const allKeys = new Set([...Object.keys(oldMetadata), ...Object.keys(dto.metadata)]);
+                for (const key of allKeys) {
+                    const oldValue = oldMetadata[key];
+                    const newValue = newMetadata[key];
+                    if (JSON.stringify(oldValue) !== JSON.stringify(newValue)) {
+                        metadataChanges[key] = {
+                            before: oldValue ?? null,
+                            after: newValue ?? null,
+                        };
+                    }
+                }
+                if (Object.keys(metadataChanges).length > 0) {
+                    fieldChanges.metadata = metadataChanges;
+                }
+            }
+            if (dto.email !== undefined && dto.email !== user.email) {
+                const emailVerificationChanged = !dto.retainVerification && updateFields.isEmailVerified === false;
+                if (emailVerificationChanged) {
+                    fieldChanges.isEmailVerified = {
+                        before: user.isEmailVerified,
+                        after: false,
+                    };
+                }
+            }
+            if (dto.phone !== undefined && dto.phone !== user.phone) {
+                const phoneVerificationChanged = !dto.retainVerification && updateFields.isPhoneVerified === false;
+                if (phoneVerificationChanged) {
+                    fieldChanges.isPhoneVerified = {
+                        before: user.isPhoneVerified,
+                        after: false,
+                    };
+                }
+            }
+            await this.auditService?.recordEvent({
+                userId: user.id,
+                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PROFILE_UPDATED,
+                eventStatus: 'INFO',
+                metadata: {
+                    updatedFields: updatedFieldNames,
+                    fieldChanges: Object.keys(fieldChanges).length > 0 ? fieldChanges : undefined,
+                },
+            });
+            if (dto.email !== undefined && dto.email !== user.email) {
+                await this.auditService?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.EMAIL_CHANGED,
+                    eventStatus: 'INFO',
+                    metadata: {
+                        oldEmail: user.email,
+                        newEmail: dto.email,
+                        retainVerification: dto.retainVerification || false,
+                    },
+                });
+            }
+            if (dto.phone !== undefined && dto.phone !== user.phone) {
+                await this.auditService?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PHONE_CHANGED,
+                    eventStatus: 'INFO',
+                    metadata: {
+                        oldPhone: user.phone,
+                        newPhone: dto.phone,
+                        retainVerification: dto.retainVerification || false,
+                    },
+                });
+            }
+            if (dto.username !== undefined && dto.username !== user.username) {
+                await this.auditService?.recordEvent({
+                    userId: user.id,
+                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.USERNAME_CHANGED,
+                    eventStatus: 'INFO',
+                    metadata: {
+                        oldUsername: user.username,
+                        newUsername: dto.username,
+                    },
+                });
+            }
+        }
+        catch (auditError) {
+            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+            this.logger?.error?.(`Failed to record profile update audit events: ${errorMessage}`, {
+                error: auditError,
+                userId: user.id,
+            });
+        }
+        return user_response_dto_1.UserResponseDto.fromEntity(updatedUser);
+    }
+    async validateUniquenessConstraints(userId, updateData) {
+        const conflicts = [];
+        if (updateData.email) {
+            const existingUser = await this.userRepository.findOne({
+                where: { email: updateData.email },
+            });
+            if (existingUser && existingUser.id !== userId) {
+                conflicts.push('Email already exists');
+            }
+        }
+        if (updateData.phone) {
+            const existingUser = await this.userRepository.findOne({
+                where: { phone: updateData.phone },
+            });
+            if (existingUser && existingUser.id !== userId) {
+                conflicts.push('Phone number already exists');
+            }
+        }
+        if (updateData.username) {
+            const existingUser = await this.userRepository.findOne({
+                where: { username: updateData.username },
+            });
+            if (existingUser && existingUser.id !== userId) {
+                conflicts.push('Username already exists');
+            }
+        }
+        if (conflicts.length > 0) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.VALIDATION_FAILED, conflicts.join(', '), {
+                conflicts,
+            });
+        }
+    }
+    validateIdentifierType(identifier, allowedType) {
+        const isEmail = identifier.includes('@');
+        const isPhone = /^\+[1-9]\d{1,14}$/.test(identifier.trim());
+        const isUsername = !isEmail && !isPhone;
+        switch (allowedType) {
+            case 'email':
+                return isEmail;
+            case 'username':
+                return isUsername;
+            case 'phone':
+                return isPhone;
+            case 'email_or_username':
+                return isEmail || isUsername;
+            default:
+                return true;
+        }
+    }
+    async findUserByIdentifier(identifier, identifierType) {
+        const queryBuilder = this.userRepository.createQueryBuilder('user');
+        if (!identifierType) {
+            queryBuilder
+                .where('user.email = :identifier', { identifier })
+                .orWhere('user.username = :identifier', { identifier })
+                .orWhere('user.phone = :identifier', { identifier });
+        }
+        else {
+            switch (identifierType) {
+                case 'email':
+                    queryBuilder.where('user.email = :identifier', { identifier });
+                    break;
+                case 'username':
+                    queryBuilder.where('user.username = :identifier', { identifier });
+                    break;
+                case 'phone':
+                    queryBuilder.where('user.phone = :identifier', { identifier });
+                    break;
+                case 'email_or_username':
+                    queryBuilder
+                        .where('user.email = :identifier', { identifier })
+                        .orWhere('user.username = :identifier', { identifier });
+                    break;
+            }
+        }
+        queryBuilder.select([
+            'user.id',
+            'user.sub',
+            'user.email',
+            'user.firstName',
+            'user.lastName',
+            'user.username',
+            'user.phone',
+            'user.passwordHash',
+            'user.passwordChangedAt',
+            'user.mustChangePassword',
+            'user.isActive',
+            'user.mfaEnabled',
+            'user.preferredMfaMethod',
+            'user.isEmailVerified',
+            'user.isPhoneVerified',
+            'user.mfaExempt',
+            'user.socialProviders',
+            'user.backupCodes',
+        ]);
+        return (await queryBuilder.getOne());
+    }
+    async handleFailedLogin(identifier, reason) {
+        const clientInfo = this.clientInfoService.get();
+        const ipAddress = clientInfo.ipAddress;
+        await this.recordLoginAttempt(identifier, false, reason);
+        if (this.config.lockout?.enabled && ipAddress) {
+            const attempts = await this.accountLockoutStorage.recordFailedAttempt(ipAddress);
+            if (attempts >= (this.config.lockout.maxAttempts || 5)) {
+                await this.accountLockoutStorage.blockIpAdresss(ipAddress, this.config.lockout.duration || 900, 'Too many failed login attempts from this IP');
+            }
+        }
+    }
+    async recordLoginAttempt(email, success, failureReason, userId) {
+        const clientInfo = this.clientInfoService.get();
+        const attempt = this.loginAttemptRepository.create({
+            email,
+            userId,
+            ipAddress: clientInfo.ipAddress,
+            userAgent: clientInfo.userAgent,
+            success,
+            failureReason,
+        });
+        await this.loginAttemptRepository.save(attempt);
+    }
+    async getUserById(dto) {
+        const user = (await this.userRepository.findOne({ where: { sub: dto.sub } }));
+        return user ? user_response_dto_1.UserResponseDto.fromEntity(user) : null;
+    }
+    async getUserByEmail(dto) {
+        const where = dto.requireEmailVerified
+            ? { email: dto.email, isEmailVerified: true }
+            : { email: dto.email };
+        const user = (await this.userRepository.findOne({ where }));
+        return user ? user_response_dto_1.UserResponseDto.fromEntity(user) : null;
+    }
+    async setMustChangePassword(dto) {
+        const user = await this.userRepository.findOne({ where: { sub: dto.userId } });
+        if (!user) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+        }
+        if (!user.passwordHash) {
+            this.logger?.warn?.(`Cannot force password change for user ${dto.userId} - user doesn't have a password (pure social signup)`);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PASSWORD_CHANGE_NOT_ALLOWED, 'Password change not available. This account uses social authentication only and has no password.');
+        }
+        await this.userRepository.update({ sub: dto.userId }, { mustChangePassword: true });
+        this.logger?.log?.(`Must-change-password flag set for user: ${dto.userId}`);
+        return { success: true };
+    }
+}
+exports.AuthService = AuthService;
+//# sourceMappingURL=auth.service.js.map