@nauth-toolkit/core 0.1.87 → 0.1.88

package/dist/services/auth.service.js

@@ -38,34 +38,31 @@ const auth_audit_event_type_enum_1 = require("../enums/auth-audit-event-type.enu
 const risk_factor_enum_1 = require("../enums/risk-factor.enum");
 const context_storage_1 = require("../utils/context-storage");
 const signup_dto_1 = require("../dto/signup.dto");
-const admin_signup_dto_1 = require("../dto/admin-signup.dto");
-const admin_signup_social_dto_1 = require("../dto/admin-signup-social.dto");
+// Admin DTOs moved to AdminAuthService
 const login_dto_1 = require("../dto/login.dto");
-const change_password_request_dto_1 = require("../dto/change-password-request.dto");
-const user_response_dto_1 = require("../dto/user-response.dto");
+const change_password_dto_1 = require("../dto/change-password.dto");
+const admin_update_user_attributes_dto_1 = require("../dto/admin-update-user-attributes.dto");
 const auth_response_dto_1 = require("../dto/auth-response.dto");
 const auth_challenge_dto_1 = require("../dto/auth-challenge.dto");
 const respond_challenge_dto_1 = require("../dto/respond-challenge.dto");
+// Admin-only lookups are handled by AdminAuthService
 const logout_dto_1 = require("../dto/logout.dto");
 const logout_all_dto_1 = require("../dto/logout-all.dto");
-const get_user_sessions_dto_1 = require("../dto/get-user-sessions.dto");
 const logout_session_dto_1 = require("../dto/logout-session.dto");
 const refresh_token_dto_1 = require("../dto/refresh-token.dto");
 const resend_code_dto_1 = require("../dto/resend-code.dto");
-const admin_set_password_dto_1 = require("../dto/admin-set-password.dto");
-const admin_reset_password_dto_1 = require("../dto/admin-reset-password.dto");
+const validate_access_token_dto_1 = require("../dto/validate-access-token.dto");
+// Admin-only password workflows are handled by AdminAuthService
 const forgot_password_dto_1 = require("../dto/forgot-password.dto");
 const confirm_forgot_password_dto_1 = require("../dto/confirm-forgot-password.dto");
 const verify_email_dto_1 = require("../dto/verify-email.dto");
 const verify_phone_dto_1 = require("../dto/verify-phone.dto");
-const validate_access_token_dto_1 = require("../dto/validate-access-token.dto");
+const admin_get_user_auth_history_dto_1 = require("../dto/admin-get-user-auth-history.dto");
 const auth_service_internal_helpers_1 = require("./auth-service-internal-helpers");
 const user_service_1 = require("./user.service");
 const nauth_exception_1 = require("../exceptions/nauth.exception");
 const error_codes_enum_1 = require("../enums/error-codes.enum");
-const class_validator_1 = require("class-validator");
 const crypto = __importStar(require("crypto"));
-const password_generator_1 = require("../utils/password-generator");
 const dto_validator_1 = require("../utils/dto-validator");
 const cookies_util_1 = require("../utils/cookies.util");
 /**
@@ -77,6 +74,25 @@ const cookies_util_1 = require("../utils/cookies.util");
  * Format: $argon2id$v=19$m=65536,t=3,p=4$salt$hash
  */
 const DUMMY_ARGON2_HASH = '$argon2id$v=19$m=65536,t=3,p=4$RFVNTVlfU0FMVF9GT1JfVElNSU5H$dummyhashfordummyhashfordummyhash1234567890';
+/**
+ * Core user-facing authentication service
+ *
+ * This service implements **self-service** authentication flows for the currently authenticated user:
+ * - Signup, login, challenge completion, refresh token rotation
+ * - Logout / logout-all / logout-session (self-management)
+ * - Profile management and password change (self-management)
+ *
+ * Admin-only operations (explicit targeting via `sub`) are intentionally owned by {@link AdminAuthService}.
+ *
+ * @example
+ * ```typescript
+ * // Login (self-service)
+ * const result = await authService.login({ identifier: 'user@example.com', password: 'Password123!' });
+ *
+ * // Refresh (self-service; cookies or JSON depending on config)
+ * const refreshed = await authService.refreshToken({ refreshToken: '...' });
+ * ```
+ */
 class AuthService {
     userRepository;
     loginAttemptRepository;
@@ -374,590 +390,6 @@ class AuthService {
         return response;
     }
     // ============================================================================
-    // Admin Signup
-    // ============================================================================
-    /**
-     * Administrative user creation with override capabilities
-     *
-     * Allows administrators to create user accounts with:
-     * - Bypass email/phone verification requirements
-     * - Force password change on first login
-     * - Auto-generate secure passwords
-     *
-     * Security:
-     * - No built-in authentication - endpoint must be protected by framework adapter
-     * - All duplicate checks still enforced
-     * - Password policy still enforced (unless auto-generated)
-     * - Audit trail records admin-created accounts
-     *
-     * @param dto - Admin signup DTO with override flags
-     * @returns User object and optionally generated password
-     * @throws {NAuthException} EMAIL_EXISTS | USERNAME_EXISTS | PHONE_EXISTS | WEAK_PASSWORD
-     *
-     * @example
-     * ```typescript
-     * // Create user with pre-verified email
-     * const result = await authService.adminSignup({
-     *   email: 'user@example.com',
-     *   password: 'SecurePass123!',
-     *   isEmailVerified: true,
-     * });
-     *
-     * // Create user with auto-generated password
-     * const result = await authService.adminSignup({
-     *   email: 'user@example.com',
-     *   generatePassword: true,
-     *   isEmailVerified: true,
-     *   mustChangePassword: true,
-     * });
-     * // result.generatedPassword contains the temporary password
-     * ```
-     */
-    async adminSignup(dto) {
-        // Ensure DTO is validated (supports direct usage without framework validation)
-        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_signup_dto_1.AdminSignupDTO, dto);
-        // Get client info from request context (transparent!)
-        const clientInfo = this.clientInfoService.get();
-        this.logger?.log?.(`Admin signup attempt for email: ${dto.email}`);
-        this.logger?.debug?.(`Admin signup details: { email: ${dto.email}, username: ${dto.username || 'none'}, ip: ${clientInfo.ipAddress} }`);
-        // Skip signup.enabled check (admin bypass)
-        // Check if user already exists (email and username)
-        this.logger?.debug?.(`Checking if user exists: ${dto.email}`);
-        const existingUserByEmail = await this.userRepository.findOne({
-            where: { email: dto.email },
-        });
-        if (existingUserByEmail) {
-            this.logger?.warn?.(`Admin signup failed - user already exists: ${dto.email}`);
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this email already exists');
-        }
-        // Check for duplicate username if provided
-        if (dto.username) {
-            this.logger?.debug?.(`Checking if username exists: ${dto.username}`);
-            const existingUserByUsername = await this.userRepository.findOne({
-                where: { username: dto.username },
-            });
-            if (existingUserByUsername) {
-                this.logger?.warn?.(`Admin signup failed - username already exists: ${dto.username}`);
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USERNAME_EXISTS, 'Username is already taken');
-            }
-        }
-        // Check for duplicate phone if provided and duplicates not allowed
-        if (dto.phone && !this.config.signup?.allowDuplicatePhones) {
-            this.logger?.debug?.(`Checking if phone exists: ${dto.phone}`);
-            const existingUserByPhone = await this.userRepository.findOne({
-                where: { phone: dto.phone },
-            });
-            if (existingUserByPhone) {
-                this.logger?.warn?.(`Admin signup failed - phone already exists: ${dto.phone}`);
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_EXISTS, 'Phone number is already registered');
-            }
-        }
-        // Handle password
-        let passwordHash;
-        let generatedPassword;
-        if (dto.generatePassword) {
-            // Generate secure random password
-            generatedPassword = (0, password_generator_1.generateSecurePassword)(16);
-            this.logger?.debug?.(`Generated password for admin-created user: ${dto.email}`);
-            passwordHash = await this.passwordService.hashPassword(generatedPassword);
-        }
-        else {
-            // Validate password policy
-            if (!dto.password) {
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.WEAK_PASSWORD, 'Password is required when generatePassword is false');
-            }
-            this.logger?.debug?.('Validating password against policy');
-            const passwordValidation = await this.passwordService.validatePassword(dto.password, {
-                email: dto.email,
-                username: dto.username,
-            });
-            if (!passwordValidation.valid) {
-                this.logger?.warn?.(`Password validation failed for ${dto.email}: ${passwordValidation.errors.join(', ')}`);
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.WEAK_PASSWORD, passwordValidation.errors.join(', '), {
-                    errors: passwordValidation.errors,
-                });
-            }
-            // Hash password
-            passwordHash = await this.passwordService.hashPassword(dto.password);
-        }
-        // ============================================================================
-        // Lifecycle Hook: preSignup
-        // ============================================================================
-        // Execute preSignup hook before user creation (admin signup)
-        // Hook can throw NAuthException with PRESIGNUP_FAILED to block signup with custom message
-        await this.hookRegistry.executePreSignup(dto, 'password', undefined, true);
-        // Create user with override flags
-        this.logger?.debug?.(`Creating admin user record for: ${dto.email} || ${dto.username} || ${dto.phone} (isEmailVerified: ${dto.isEmailVerified || false}, isPhoneVerified: ${dto.isPhoneVerified || false})`);
-        const user = this.userRepository.create({
-            email: dto.email,
-            username: dto.username,
-            firstName: dto.firstName,
-            lastName: dto.lastName,
-            phone: dto.phone,
-            passwordHash,
-            passwordChangedAt: new Date(),
-            isEmailVerified: dto.isEmailVerified ?? false, // Use DTO value or default to false
-            isPhoneVerified: dto.isPhoneVerified ?? false, // Use DTO value or default to false
-            mustChangePassword: dto.mustChangePassword ?? false, // Use DTO value or default to false
-            isActive: true, // Always active
-            metadata: dto.metadata,
-        });
-        let savedUser;
-        try {
-            savedUser = (await this.userRepository.save(user));
-            this.logger?.log?.(`Admin user created successfully: ${dto.email} (sub: ${savedUser.sub})`);
-            // ============================================================================
-            // Audit: Record account creation by admin
-            // ============================================================================
-            try {
-                await this.auditService?.recordEvent({
-                    userId: savedUser.id,
-                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.ACCOUNT_CREATED,
-                    eventStatus: 'INFO',
-                    authMethod: 'admin',
-                    // Client info automatically included from context
-                    metadata: {
-                        email: savedUser.email,
-                        username: savedUser.username || null,
-                        createdByAdmin: true,
-                        adminIdentifier: clientInfo.ipAddress || 'unknown',
-                        isEmailVerified: savedUser.isEmailVerified,
-                        isPhoneVerified: savedUser.isPhoneVerified,
-                        mustChangePassword: savedUser.mustChangePassword,
-                        passwordGenerated: !!generatedPassword,
-                    },
-                });
-            }
-            catch (auditError) {
-                // Non-blocking: Log but continue
-                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
-                this.logger?.error?.(`Failed to record ACCOUNT_CREATED audit event: ${errorMessage}`, {
-                    error: auditError,
-                    userId: savedUser.id,
-                });
-            }
-        }
-        catch (error) {
-            // Handle database constraint violations gracefully
-            if (error && typeof error === 'object' && 'code' in error && error.code === '23505') {
-                // PostgreSQL unique constraint violation
-                const dbError = error;
-                if (dbError.detail?.includes('email')) {
-                    this.logger?.warn?.(`Admin signup failed - email constraint violation: ${dto.email}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this email already exists');
-                }
-                else if (dbError.detail?.includes('username')) {
-                    this.logger?.warn?.(`Admin signup failed - username constraint violation: ${dto.username}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USERNAME_EXISTS, 'Username is already taken');
-                }
-                else if (dbError.detail?.includes('phone')) {
-                    this.logger?.warn?.(`Admin signup failed - phone constraint violation: ${dto.phone}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_EXISTS, 'Phone number is already registered');
-                }
-                else {
-                    this.logger?.error?.(`Admin signup failed - database constraint violation: ${dbError.message}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this information already exists', {
-                        conflictType: 'unknown',
-                    });
-                }
-            }
-            // Re-throw other database errors
-            const errorMessage = error instanceof Error ? error.message : 'Unknown database error';
-            this.logger?.error?.(`Admin signup failed - database error: ${errorMessage}`);
-            throw error;
-        }
-        // ============================================================================
-        // Lifecycle Hook: afterSignup
-        // ============================================================================
-        // Execute afterSignup hook immediately after account creation (non-blocking)
-        await this.hookRegistry.executePostSignup(savedUser, {
-            signupType: 'password',
-            adminSignup: true,
-        });
-        // No tokens, no challenge system, no verification emails - pure user creation
-        // Return sanitized user object (excludes passwordHash and other sensitive fields)
-        const userDto = user_response_dto_1.UserResponseDto.fromEntity(savedUser);
-        return {
-            user: userDto,
-            generatedPassword,
-        };
-    }
-    // ============================================================================
-    // Admin Social Signup
-    // ============================================================================
-    /**
-     * Administrative social user import with override capabilities
-     *
-     * Allows administrators to import existing social users from external platforms
-     * (e.g., Cognito, Auth0) into nauth with:
-     * - Bypass email/phone verification requirements
-     * - Optional password for hybrid social+password accounts
-     * - Social account linkage (provider + providerId)
-     * - Automatic user flag updates (hasSocialAuth)
-     *
-     * Use case: Migrating users from external authentication platforms while
-     * preserving their social login connections for transparent future logins.
-     *
-     * Security:
-     * - No built-in authentication - endpoint must be protected by framework adapter
-     * - All duplicate checks enforced (email, username, phone, provider+providerId)
-     * - Password policy enforced if password provided
-     * - Audit trail records admin-imported social accounts
-     *
-     * @param dto - Admin social signup DTO with social account details
-     * @returns User object and social account confirmation
-     * @throws {NAuthException} EMAIL_EXISTS | USERNAME_EXISTS | PHONE_EXISTS | SOCIAL_ACCOUNT_EXISTS | WEAK_PASSWORD
-     *
-     * @example
-     * ```typescript
-     * // Import social-only user from Cognito
-     * // Note: Email is automatically verified for social imports (like normal social signup)
-     * const result = await authService.adminSignupSocial({
-     *   email: 'user@example.com',
-     *   provider: 'google',
-     *   providerId: 'google_12345',
-     *   providerEmail: 'user@gmail.com',
-     *   socialMetadata: { sub: 'google_12345', given_name: 'John' },
-     * });
-     *
-     * // Import hybrid user with password + social
-     * const result = await authService.adminSignupSocial({
-     *   email: 'user@example.com',
-     *   password: 'SecurePass123!',
-     *   provider: 'apple',
-     *   providerId: 'apple_67890',
-     * });
-     * ```
-     */
-    async adminSignupSocial(dto) {
-        // Ensure DTO is validated (supports direct usage without framework validation)
-        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_signup_social_dto_1.AdminSignupSocialDTO, dto);
-        // Get client info from request context (transparent!)
-        const clientInfo = this.clientInfoService.get();
-        this.logger?.log?.(`Admin social signup attempt for email: ${dto.email}, provider: ${dto.provider}`);
-        this.logger?.debug?.(`Admin social signup details: { email: ${dto.email}, username: ${dto.username || 'none'}, provider: ${dto.provider}, providerId: ${dto.providerId}, ip: ${clientInfo.ipAddress} }`);
-        // Skip signup.enabled check (admin bypass)
-        // Check if user already exists (email and username)
-        this.logger?.debug?.(`Checking if user exists: ${dto.email}`);
-        const existingUserByEmail = await this.userRepository.findOne({
-            where: { email: dto.email },
-        });
-        if (existingUserByEmail) {
-            this.logger?.warn?.(`Admin social signup failed - user already exists: ${dto.email}`);
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this email already exists');
-        }
-        // Check for duplicate username if provided
-        if (dto.username) {
-            this.logger?.debug?.(`Checking if username exists: ${dto.username}`);
-            const existingUserByUsername = await this.userRepository.findOne({
-                where: { username: dto.username },
-            });
-            if (existingUserByUsername) {
-                this.logger?.warn?.(`Admin social signup failed - username already exists: ${dto.username}`);
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USERNAME_EXISTS, 'Username is already taken');
-            }
-        }
-        // Check for duplicate phone if provided and duplicates not allowed
-        if (dto.phone && !this.config.signup?.allowDuplicatePhones) {
-            this.logger?.debug?.(`Checking if phone exists: ${dto.phone}`);
-            const existingUserByPhone = await this.userRepository.findOne({
-                where: { phone: dto.phone },
-            });
-            if (existingUserByPhone) {
-                this.logger?.warn?.(`Admin social signup failed - phone already exists: ${dto.phone}`);
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_EXISTS, 'Phone number is already registered');
-            }
-        }
-        // Check for duplicate provider+providerId
-        if (!this.socialAuthService) {
-            this.logger?.error?.('SocialAuthService not available - cannot import social user');
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SOCIAL_CONFIG_MISSING, 'Social authentication is not configured');
-        }
-        this.logger?.debug?.(`Checking if social account exists: ${dto.provider}:${dto.providerId}`);
-        const existingSocialAccount = await this.socialAuthService.findSocialAccountByProvider(dto.provider, dto.providerId);
-        if (existingSocialAccount) {
-            this.logger?.warn?.(`Admin social signup failed - social account already exists: ${dto.provider}:${dto.providerId}`);
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SOCIAL_ACCOUNT_EXISTS, 'This social account is already registered');
-        }
-        // Handle password (optional for hybrid accounts)
-        let passwordHash;
-        if (dto.password) {
-            // Validate password policy
-            this.logger?.debug?.('Validating password against policy');
-            const passwordValidation = await this.passwordService.validatePassword(dto.password, {
-                email: dto.email,
-                username: dto.username,
-            });
-            if (!passwordValidation.valid) {
-                this.logger?.warn?.(`Password validation failed for ${dto.email}: ${passwordValidation.errors.join(', ')}`);
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.WEAK_PASSWORD, passwordValidation.errors.join(', '), {
-                    errors: passwordValidation.errors,
-                });
-            }
-            // Hash password
-            passwordHash = await this.passwordService.hashPassword(dto.password);
-        }
-        else {
-            // Social-only user: no password (NULL in database)
-            passwordHash = null;
-        }
-        // ============================================================================
-        // Lifecycle Hook: preSignup
-        // ============================================================================
-        // Execute preSignup hook before user creation (admin social signup)
-        // Hook can throw NAuthException with PRESIGNUP_FAILED to block signup with custom message
-        // Convert AdminSignupSocialDTO to profile-like structure for hook
-        const profileData = {
-            email: dto.email,
-            id: dto.providerId,
-            firstName: dto.firstName,
-            lastName: dto.lastName,
-            verified: true, // Admin signup always has verified email
-            raw: dto.socialMetadata,
-        };
-        await this.hookRegistry.executePreSignup(profileData, 'social', dto.provider, true);
-        // Create user with override flags
-        // Note: Email is always verified for social imports (like normal social signup)
-        this.logger?.debug?.(`Creating admin social user record for: ${dto.email} || ${dto.username} || ${dto.phone} (isEmailVerified: true [auto-verified for social], isPhoneVerified: ${dto.isPhoneVerified || false})`);
-        const user = this.userRepository.create({
-            email: dto.email,
-            username: dto.username,
-            firstName: dto.firstName,
-            lastName: dto.lastName,
-            phone: dto.phone,
-            passwordHash, // null for social-only, hashed string for hybrid accounts
-            passwordChangedAt: dto.password ? new Date() : null, // Only set if password provided
-            isEmailVerified: true, // Always verified for social imports (like normal social signup)
-            isPhoneVerified: dto.isPhoneVerified ?? false, // Use DTO value or default to false
-            mustChangePassword: dto.mustChangePassword ?? false, // Use DTO value or default to false
-            isActive: true, // Always active
-            metadata: dto.metadata,
-            hasSocialAuth: true, // Set immediately since we know this is a social user
-            socialProviders: [dto.provider], // Set immediately with the provider from DTO
-        });
-        let savedUser;
-        try {
-            savedUser = (await this.userRepository.save(user));
-            this.logger?.log?.(`Admin social user created successfully: ${dto.email} (sub: ${savedUser.sub}, provider: ${dto.provider})`);
-            // Create social account linkage
-            this.logger?.debug?.(`Creating social account linkage: ${dto.provider}:${dto.providerId}`);
-            await this.socialAuthService.createOrUpdateSocialAccount(savedUser.id, dto.provider, dto.providerId, dto.providerEmail || null, dto.socialMetadata);
-            this.logger?.log?.(`Social account linked successfully: ${dto.provider}:${dto.providerId}`);
-            // Update savedUser in memory to reflect the updated social flags (no additional query needed)
-            // updateUserSocialFlags() has already updated the DB, we just sync the in-memory object
-            savedUser.hasSocialAuth = true;
-            savedUser.socialProviders = [dto.provider];
-            // ============================================================================
-            // Lifecycle Hook: afterSignup
-            // ============================================================================
-            // Execute afterSignup hook immediately after account creation (non-blocking)
-            // Extract profile picture from social metadata if available
-            const profilePicture = dto.socialMetadata && typeof dto.socialMetadata === 'object' && 'picture' in dto.socialMetadata
-                ? dto.socialMetadata.picture
-                : null;
-            await this.hookRegistry.executePostSignup(savedUser, {
-                signupType: 'social',
-                provider: dto.provider,
-                adminSignup: true,
-                socialMetadata: dto.socialMetadata || null,
-                profilePicture,
-            });
-            // ============================================================================
-            // Audit: Record account creation by admin (social import)
-            // ============================================================================
-            try {
-                await this.auditService?.recordEvent({
-                    userId: savedUser.id,
-                    eventType: auth_audit_event_type_enum_1.AuthAuditEventType.ACCOUNT_CREATED,
-                    eventStatus: 'INFO',
-                    authMethod: 'admin-social',
-                    // Client info automatically included from context
-                    metadata: {
-                        email: savedUser.email,
-                        username: savedUser.username || null,
-                        createdByAdmin: true,
-                        adminIdentifier: clientInfo.ipAddress || 'unknown',
-                        isEmailVerified: savedUser.isEmailVerified,
-                        isPhoneVerified: savedUser.isPhoneVerified,
-                        mustChangePassword: savedUser.mustChangePassword,
-                        provider: dto.provider,
-                        providerId: dto.providerId,
-                        hasPassword: !!dto.password,
-                        socialImport: true,
-                    },
-                });
-            }
-            catch (auditError) {
-                // Non-blocking: Log but continue
-                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
-                this.logger?.error?.(`Failed to record ACCOUNT_CREATED audit event: ${errorMessage}`, {
-                    error: auditError,
-                    userId: savedUser.id,
-                });
-            }
-        }
-        catch (error) {
-            // Handle database constraint violations gracefully
-            if (error && typeof error === 'object' && 'code' in error && error.code === '23505') {
-                // PostgreSQL unique constraint violation
-                const dbError = error;
-                if (dbError.detail?.includes('email')) {
-                    this.logger?.warn?.(`Admin social signup failed - email constraint violation: ${dto.email}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this email already exists');
-                }
-                else if (dbError.detail?.includes('username')) {
-                    this.logger?.warn?.(`Admin social signup failed - username constraint violation: ${dto.username}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.USERNAME_EXISTS, 'Username is already taken');
-                }
-                else if (dbError.detail?.includes('phone')) {
-                    this.logger?.warn?.(`Admin social signup failed - phone constraint violation: ${dto.phone}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PHONE_EXISTS, 'Phone number is already registered');
-                }
-                else if (dbError.detail?.includes('provider') && dbError.detail?.includes('providerId')) {
-                    this.logger?.warn?.(`Admin social signup failed - social account constraint violation: ${dto.provider}:${dto.providerId}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SOCIAL_ACCOUNT_EXISTS, 'This social account is already registered');
-                }
-                else {
-                    this.logger?.error?.(`Admin social signup failed - database constraint violation: ${dbError.message}`);
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.EMAIL_EXISTS, 'User with this information already exists', {
-                        conflictType: 'unknown',
-                    });
-                }
-            }
-            // Re-throw other database errors
-            const errorMessage = error instanceof Error ? error.message : 'Unknown database error';
-            this.logger?.error?.(`Admin social signup failed - database error: ${errorMessage}`);
-            throw error;
-        }
-        // No tokens, no challenge system, no verification emails - pure user creation with social linkage
-        // Return sanitized user object and social account confirmation
-        const userDto = user_response_dto_1.UserResponseDto.fromEntity(savedUser);
-        return {
-            user: userDto,
-            socialAccount: {
-                provider: dto.provider,
-                providerId: dto.providerId,
-                providerEmail: dto.providerEmail || null,
-            },
-        };
-    }
-    // ============================================================================
-    // Admin User Management
-    // ============================================================================
-    /**
-     * Administrative user deletion with complete cascade cleanup
-     *
-     * HARD DELETE - Permanently removes user and ALL associated data including:
-     * - Sessions, verification tokens, MFA devices, trusted devices
-     * - Social accounts, login attempts, challenge sessions, audit logs
-     *
-     * Security:
-     * - NO built-in authentication - endpoint MUST be protected by admin guards
-     * - Records admin action in separate audit log (not deleted with user)
-     * - Irreversible operation - all data permanently removed
-     *
-     * @param dto - User sub to delete
-     * @returns Deletion confirmation with cascade counts
-     * @throws {NAuthException} USER_NOT_FOUND
-     *
-     * @example
-     * ```typescript
-     * const result = await authService.deleteUser({ sub: 'user-uuid-123' });
-     * console.log(`Deleted user: ${result.deletedUserId}`);
-     * console.log(`Deleted ${result.deletedRecords.sessions} sessions`);
-     * ```
-     */
-    async deleteUser(dto) {
-        return await this.userService.deleteUser(dto);
-    }
-    /**
-     * Get paginated list of users with advanced filtering
-     *
-     * Supports pagination, boolean filters, exact match filters,
-     * date filters with operators (gt, gte, lt, lte, eq), and flexible sorting.
-     *
-     * Security:
-     * - NO built-in authentication - endpoint MUST be protected by admin guards
-     * - Returns sanitized user data (no passwordHash, secrets)
-     *
-     * @param dto - Filters, pagination, sorting
-     * @returns Paginated user list with metadata
-     *
-     * @example
-     * ```typescript
-     * const result = await authService.getUsers({
-     *   page: 1,
-     *   limit: 20,
-     *   isEmailVerified: true,
-     *   hasSocialAuth: true,
-     *   createdAt: { operator: 'gte', value: new Date('2024-01-01') },
-     *   sortBy: 'createdAt',
-     *   sortOrder: 'DESC'
-     * });
-     * ```
-     */
-    async getUsers(dto) {
-        return await this.userService.getUsers(dto);
-    }
-    /**
-     * Administrative permanent account locking
-     *
-     * Sets permanent lock (lockedUntil=NULL) and immediately revokes all active sessions.
-     * Reuses existing rate-limit lock fields (isLocked, lockReason, lockedAt, lockedUntil).
-     *
-     * Permanent vs Temporary locks:
-     * - Rate limiting: lockedUntil = future date (temporary auto-unlock)
-     * - Admin disableUser: lockedUntil = NULL (permanent manual lock)
-     *
-     * Security:
-     * - NO built-in authentication - endpoint MUST be protected by admin guards
-     * - Revokes all sessions immediately (forced logout)
-     * - Records ACCOUNT_DISABLED audit event with admin identifier
-     *
-     * @param dto - User sub and optional reason
-     * @returns User object with updated lock status and revoked session count
-     * @throws {NAuthException} USER_NOT_FOUND
-     *
-     * @example
-     * ```typescript
-     * const result = await authService.disableUser({
-     *   sub: 'user-uuid-123',
-     *   reason: 'Suspicious activity detected'
-     * });
-     * console.log(`Revoked ${result.revokedSessions} sessions`);
-     * ```
-     */
-    async disableUser(dto) {
-        return await this.userService.disableUser(dto);
-    }
-    /**
-     * Enable (unlock) user account
-     *
-     * Unlocks a previously locked user account by clearing all lock fields.
-     * This reverses the effect of disableUser() or rate-limit lockouts.
-     *
-     * Security:
-     * - NO built-in authentication - endpoint MUST be protected by admin guards
-     * - Clears lock fields (isLocked, lockReason, lockedAt, lockedUntil)
-     * - Resets failed login attempts counter
-     * - Records ACCOUNT_ENABLED audit event with admin identifier
-     *
-     * @param dto - User sub to enable
-     * @returns User object with updated lock status
-     * @throws {NAuthException} USER_NOT_FOUND
-     *
-     * @example
-     * ```typescript
-     * const result = await authService.enableUser({
-     *   sub: 'user-uuid-123'
-     * });
-     * console.log(`User unlocked: ${result.user.email}`);
-     * ```
-     */
-    async enableUser(dto) {
-        return await this.userService.enableUser(dto);
-    }
-    // ============================================================================
     // User Login
     // ============================================================================
     /**
@@ -1002,7 +434,7 @@ class AuthService {
                     // ============================================================================
                     // We do not have a resolved user yet because IP lockout happens before the normal
                     // identifier validation + user lookup. Resolve it here to avoid passing a non-UUID
-                    // (email/username/phone) into `userSub`.
+                    // (email/username/phone) into a `sub` field.
                     const userForAudit = await this.helpers.findUserByIdentifier(dto.identifier, identifierType);
                     if (fireAndForget) {
                         if (userForAudit?.id) {
@@ -1100,7 +532,7 @@ class AuthService {
                         this.logger?.error?.(`Failed to record LOGIN_FAILED audit event (fire-and-forget): ${errorMessage}`, {
                             error: err,
                             userId: user.id,
-                            userSub: user.sub,
+                            sub: user.sub,
                         });
                     });
                 }
@@ -1171,7 +603,7 @@ class AuthService {
                         this.logger?.error?.(`Failed to record LOGIN_BLOCKED audit event (fire-and-forget): ${errorMessage}`, {
                             error: err,
                             userId: user.id,
-                            userSub: user.sub,
+                            sub: user.sub,
                         });
                     });
                 }
@@ -1354,7 +786,7 @@ class AuthService {
                     this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event (fire-and-forget): ${errorMessage}`, {
                         error: err,
                         userId: user.id,
-                        userSub: user.sub,
+                        sub: user.sub,
                     });
                 });
             }
@@ -1540,7 +972,7 @@ class AuthService {
                 this.logger?.error?.(`Failed to record LOGIN_SUCCESS audit event (fire-and-forget): ${errorMessage}`, {
                     error: err,
                     userId: user.id,
-                    userSub: user.sub,
+                    sub: user.sub,
                 });
             });
         }
@@ -1942,238 +1374,255 @@ class AuthService {
      * ```
      */
     async refreshToken(dto) {
-        // Ensure DTO is validated (supports direct usage without framework validation)
-        dto = await (0, dto_validator_1.ensureValidatedDto)(refresh_token_dto_1.RefreshTokenDTO, dto);
-        // After validation, refreshToken must be present (validation ensures it's a valid string)
-        // Controller should have filled it from cookies if it was missing in cookies mode
-        if (!dto.refreshToken) {
-            // Best-effort: clear cookies in cookie/hybrid delivery so clients don't keep sending stale cookies.
-            this.clearAuthCookiesOnRefreshFailure(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID);
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Refresh token is required');
-        }
-        // Extract to const for type narrowing (TypeScript doesn't narrow optional properties)
-        const refreshToken = dto.refreshToken;
-        const tokenHash = this.jwtService.hashToken(refreshToken);
-        // ============================================================================
-        // CRITICAL SECURITY FIX #1 & #2: Distributed Lock + Reuse Detection
-        // ============================================================================
-        // CRITICAL: We need to get session ID for locking, but we must lock BEFORE validation
-        // to prevent race conditions. So we do a quick, lightweight lookup first.
-        // Find session by refresh token hash - this is fast and allows us to get session ID
-        const session = await this.sessionService.findByRefreshToken(tokenHash);
-        if (!session || session.isRevoked) {
-            // Validate token to get user info for error message
-            const validation = await this.jwtService.validateRefreshToken(refreshToken);
-            const userId = validation.payload?.sub || 'unknown';
-            this.logger?.debug?.(`Session not found or revoked for user ${userId}. Possible issue where token are not cleared on logout`);
-            // Best-effort: clear cookies in cookie/hybrid delivery so clients don't keep sending stale cookies.
-            this.clearAuthCookiesOnRefreshFailure(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND);
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
-        }
-        // Acquire distributed lock using SESSION ID (not token hash)
-        // THIS MUST HAPPEN BEFORE VALIDATION to prevent race conditions
-        // where multiple requests validate the same token before any lock is acquired
-        const lockKey = `session-refresh:${session.id}`;
-        this.logger?.debug?.(`[REFRESH DEBUG] Attempting to acquire lock ${lockKey} for token hash ${tokenHash.substring(0, 16)}...`);
-        let lockAcquired = false;
         try {
-            const lockStartTime = Date.now();
-            lockAcquired = await this.sessionService.acquireRefreshLock(lockKey, 10000);
-            const lockDuration = Date.now() - lockStartTime;
-            if (!lockAcquired) {
-                this.logger?.warn?.(`[REFRESH DEBUG] Lock ${lockKey} NOT acquired - refresh already in progress for session ${session.id}`);
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.RATE_LIMIT_LOGIN, 'Token refresh already in progress', {
-                    retryAfter: 5,
-                });
+            // Ensure DTO is validated (supports direct usage without framework validation)
+            dto = await (0, dto_validator_1.ensureValidatedDto)(refresh_token_dto_1.RefreshTokenDTO, dto);
+            // After validation, refreshToken must be present (validation ensures it's a valid string)
+            // Controller should have filled it from cookies if it was missing in cookies mode
+            if (!dto.refreshToken) {
+                // Best-effort: clear cookies in cookie/hybrid delivery so clients don't keep sending stale cookies.
+                this.clearAuthCookiesOnRefreshFailure(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Refresh token is required');
+            }
+            // Extract to const for type narrowing (TypeScript doesn't narrow optional properties)
+            const refreshToken = dto.refreshToken;
+            const tokenHash = this.jwtService.hashToken(refreshToken);
+            // ============================================================================
+            // CRITICAL SECURITY FIX #1 & #2: Distributed Lock + Reuse Detection
+            // ============================================================================
+            // CRITICAL: We need to get session ID for locking, but we must lock BEFORE validation
+            // to prevent race conditions. So we do a quick, lightweight lookup first.
+            // Find session by refresh token hash - this is fast and allows us to get session ID
+            const session = await this.sessionService.findByRefreshToken(tokenHash);
+            if (!session || session.isRevoked) {
+                // Validate token to get user info for error message
+                const validation = await this.jwtService.validateRefreshToken(refreshToken);
+                const userId = validation.payload?.sub || 'unknown';
+                this.logger?.debug?.(`Session not found or revoked for user ${userId}. Possible issue where token are not cleared on logout`);
+                // Best-effort: clear cookies in cookie/hybrid delivery so clients don't keep sending stale cookies.
+                this.clearAuthCookiesOnRefreshFailure(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND);
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
             }
-            this.logger?.debug?.(`[REFRESH DEBUG] Lock ${lockKey} acquired successfully in ${lockDuration}ms for token hash ${tokenHash.substring(0, 16)}...`);
-            // CRITICAL: Check for token reuse IMMEDIATELY after acquiring lock
-            // If same session + cookie race → return current tokens (don't reissue)
-            // If different session → invalidate that session and reject (attack)
-            if (this.config.jwt.refreshToken.reuseDetection) {
-                const isAlreadyUsed = await this.sessionService.isRefreshTokenUsed(tokenHash);
-                if (isAlreadyUsed) {
-                    // Decode token to get sessionId from JWT payload (without full validation)
-                    // This allows us to check if the token belongs to the session we found
-                    const tokenPayload = this.jwtService.decodeToken(refreshToken);
-                    const tokenSessionId = tokenPayload?.sessionId;
-                    // Get current session state to ensure it's still valid
-                    const currentSession = (await this.sessionService.findByIdLight(session.id));
-                    if (!currentSession || currentSession.isRevoked) {
-                        throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
-                    }
-                    // Check if token's sessionId matches the session we found
-                    // If they match → cookie race (same session)
-                    // If they don't match → attack (token stolen from different session)
-                    if (tokenSessionId && tokenSessionId === session.id.toString()) {
-                        // Same session - this is a cookie race condition
-                        // Return the current valid tokens (user already has them from first request)
-                        this.logger?.debug?.(`[REFRESH DEBUG] Token hash ${tokenHash.substring(0, 16)}... already used for same session ${session.id} - cookie race detected, returning current tokens`);
-                        // Get user info
-                        const user = (await this.userRepository.findOne({
-                            where: { id: currentSession.userId },
-                        }));
-                        if (!user) {
-                            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+            // Acquire distributed lock using SESSION ID (not token hash)
+            // THIS MUST HAPPEN BEFORE VALIDATION to prevent race conditions
+            // where multiple requests validate the same token before any lock is acquired
+            const lockKey = `session-refresh:${session.id}`;
+            this.logger?.debug?.(`[REFRESH DEBUG] Attempting to acquire lock ${lockKey} for token hash ${tokenHash.substring(0, 16)}...`);
+            let lockAcquired = false;
+            try {
+                const lockStartTime = Date.now();
+                lockAcquired = await this.sessionService.acquireRefreshLock(lockKey, 10000);
+                const lockDuration = Date.now() - lockStartTime;
+                if (!lockAcquired) {
+                    this.logger?.warn?.(`[REFRESH DEBUG] Lock ${lockKey} NOT acquired - refresh already in progress for session ${session.id}`);
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.RATE_LIMIT_LOGIN, 'Token refresh already in progress', {
+                        retryAfter: 5,
+                    });
+                }
+                this.logger?.debug?.(`[REFRESH DEBUG] Lock ${lockKey} acquired successfully in ${lockDuration}ms for token hash ${tokenHash.substring(0, 16)}...`);
+                // CRITICAL: Check for token reuse IMMEDIATELY after acquiring lock
+                // If same session + cookie race → return current tokens (don't reissue)
+                // If different session → invalidate that session and reject (attack)
+                if (this.config.jwt.refreshToken.reuseDetection) {
+                    const isAlreadyUsed = await this.sessionService.isRefreshTokenUsed(tokenHash);
+                    if (isAlreadyUsed) {
+                        // Decode token to get sessionId from JWT payload (without full validation)
+                        // This allows us to check if the token belongs to the session we found
+                        const tokenPayload = this.jwtService.decodeToken(refreshToken);
+                        const tokenSessionId = tokenPayload?.sessionId;
+                        // Get current session state to ensure it's still valid
+                        const currentSession = (await this.sessionService.findByIdLight(session.id));
+                        if (!currentSession || currentSession.isRevoked) {
+                            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
+                        }
+                        // Check if token's sessionId matches the session we found
+                        // If they match → cookie race (same session)
+                        // If they don't match → attack (token stolen from different session)
+                        if (tokenSessionId && tokenSessionId === session.id.toString()) {
+                            // Same session - this is a cookie race condition
+                            // Return the current valid tokens (user already has them from first request)
+                            this.logger?.debug?.(`[REFRESH DEBUG] Token hash ${tokenHash.substring(0, 16)}... already used for same session ${session.id} - cookie race detected, returning current tokens`);
+                            // Get user info
+                            const user = (await this.userRepository.findOne({
+                                where: { id: currentSession.userId },
+                            }));
+                            if (!user) {
+                                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
+                            }
+                            // Generate tokens from current session state (same as what the first request returned)
+                            // These will match what the user already has, so no change needed
+                            // Note: deviceId not included in token - session.deviceId is source of truth
+                            const newTokens = await this.jwtService.generateTokenPair({
+                                userId: user.sub,
+                                email: user.email,
+                                sessionId: currentSession.id.toString(),
+                                tokenFamily: currentSession.tokenFamily,
+                            });
+                            // Update session with these tokens (they're already there, but ensures consistency)
+                            await this.sessionService.updateTokens(currentSession.id, this.jwtService.hashToken(newTokens.accessToken), this.jwtService.hashToken(newTokens.refreshToken));
+                            // Decode tokens to get expiry times
+                            const accessTokenValidation = await this.jwtService.validateAccessToken(newTokens.accessToken);
+                            const refreshTokenValidation = await this.jwtService.validateRefreshToken(newTokens.refreshToken);
+                            // Return success with current tokens
+                            return {
+                                accessToken: newTokens.accessToken,
+                                refreshToken: newTokens.refreshToken,
+                                accessTokenExpiresAt: accessTokenValidation.payload?.exp || 0,
+                                refreshTokenExpiresAt: refreshTokenValidation.payload?.exp || 0,
+                            };
+                        }
+                        else {
+                            // Different session - this is an attack!
+                            // A refresh token from one session cannot be used by another session
+                            this.logger?.error?.(`[REFRESH DEBUG] Token hash ${tokenHash.substring(0, 16)}... already used for different session - ATTACK DETECTED! Token sessionId: ${tokenSessionId}, Found session: ${session.id}. Revoking session ${session.id}`);
+                            // Revoke the session that's trying to use a stolen token
+                            await this.sessionService.revokeSession(session.id, 'Token reuse detected - possible token theft');
+                            // Audit the attack
+                            let userForAudit = null;
+                            try {
+                                userForAudit = (await this.userRepository.findOne({
+                                    where: { id: session.userId },
+                                }));
+                                if (userForAudit) {
+                                    await this.auditService?.recordEvent({
+                                        userId: userForAudit.id,
+                                        eventType: auth_audit_event_type_enum_1.AuthAuditEventType.SUSPICIOUS_ACTIVITY,
+                                        eventStatus: 'SUSPICIOUS',
+                                        riskFactor: 90,
+                                        riskFactors: [risk_factor_enum_1.RiskFactor.TOKEN_THEFT_ATTEMPT, risk_factor_enum_1.RiskFactor.REFRESH_TOKEN_REUSE_DIFFERENT_SESSION],
+                                        reason: 'Refresh token reuse from different session',
+                                        // Client info automatically included from context
+                                        description: 'Refresh token from another session attempted to be used. Session revoked as security measure.',
+                                        metadata: {
+                                            sessionId: session.id,
+                                            tokenSessionId,
+                                            tokenHash: `${tokenHash.substring(0, 16)}...`,
+                                            detectedAt: new Date().toISOString(),
+                                            action: 'session_revoked',
+                                        },
+                                    });
+                                }
+                            }
+                            catch (auditError) {
+                                const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
+                                this.logger?.error?.(`Failed to record SUSPICIOUS_ACTIVITY audit event (token reuse): ${errorMessage}`, {
+                                    error: auditError,
+                                    userId: userForAudit?.id || session.userId,
+                                });
+                            }
+                            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Refresh token has already been used');
                         }
-                        // Generate tokens from current session state (same as what the first request returned)
-                        // These will match what the user already has, so no change needed
-                        // Note: deviceId not included in token - session.deviceId is source of truth
-                        const newTokens = await this.jwtService.generateTokenPair({
-                            userId: user.sub,
-                            email: user.email,
-                            sessionId: currentSession.id.toString(),
-                            tokenFamily: currentSession.tokenFamily,
-                        });
-                        // Update session with these tokens (they're already there, but ensures consistency)
-                        await this.sessionService.updateTokens(currentSession.id, this.jwtService.hashToken(newTokens.accessToken), this.jwtService.hashToken(newTokens.refreshToken));
-                        // Decode tokens to get expiry times
-                        const accessTokenValidation = await this.jwtService.validateAccessToken(newTokens.accessToken);
-                        const refreshTokenValidation = await this.jwtService.validateRefreshToken(newTokens.refreshToken);
-                        // Return success with current tokens
-                        return {
-                            accessToken: newTokens.accessToken,
-                            refreshToken: newTokens.refreshToken,
-                            accessTokenExpiresAt: accessTokenValidation.payload?.exp || 0,
-                            refreshTokenExpiresAt: refreshTokenValidation.payload?.exp || 0,
-                        };
                     }
-                    else {
-                        // Different session - this is an attack!
-                        // A refresh token from one session cannot be used by another session
-                        this.logger?.error?.(`[REFRESH DEBUG] Token hash ${tokenHash.substring(0, 16)}... already used for different session - ATTACK DETECTED! Token sessionId: ${tokenSessionId}, Found session: ${session.id}. Revoking session ${session.id}`);
-                        // Revoke the session that's trying to use a stolen token
-                        await this.sessionService.revokeSession(session.id, 'Token reuse detected - possible token theft');
-                        // Audit the attack
-                        let userForAudit = null;
+                }
+                // NOW validate the refresh token (after lock is acquired and reuse check)
+                // This ensures only one request can validate at a time per session
+                const validation = await this.jwtService.validateRefreshToken(refreshToken);
+                if (!validation.valid || !validation.payload) {
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Invalid refresh token');
+                }
+                const payload = validation.payload;
+                // Re-check session after acquiring lock (it might have been revoked/updated)
+                // Since we have the lock, no other request can modify this session, but it might have been revoked
+                // We already have currentSession from the early reuse check, but re-fetch to ensure it's still valid
+                const lockedSession = (await this.sessionService.findByIdLight(session.id));
+                if (!lockedSession || lockedSession.isRevoked || lockedSession.id !== session.id) {
+                    this.logger?.debug?.(`Session changed after lock acquisition for user ${payload.sub}. Session may have been revoked.`);
+                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
+                }
+                // ============================================================================
+                // NOTE: We still do the atomic mark operation below as a double-check
+                // The early check above handles cookie race conditions where old tokens
+                // are sent before new cookies are received
+                // ============================================================================
+                // Mark token as used BEFORE generating new tokens (prevents reuse)
+                if (this.config.jwt.refreshToken.reuseDetection) {
+                    const refreshTokenTTL = this.jwtService.getRefreshTokenTTL();
+                    const marked = await this.sessionService.markRefreshTokenAsUsed(tokenHash, refreshTokenTTL);
+                    if (!marked) {
+                        // Token was already marked as used - reuse detected!
+                        this.logger?.error?.(`Token reuse detected for user ${payload.sub} - atomic mark failed, revoking entire token family ${payload.tokenFamily}`);
+                        // Audit the reuse attempt
                         try {
-                            userForAudit = (await this.userRepository.findOne({
-                                where: { id: session.userId },
+                            const userForAudit = (await this.userRepository.findOne({
+                                where: { sub: payload.sub },
                             }));
                             if (userForAudit) {
                                 await this.auditService?.recordEvent({
                                     userId: userForAudit.id,
                                     eventType: auth_audit_event_type_enum_1.AuthAuditEventType.SUSPICIOUS_ACTIVITY,
                                     eventStatus: 'SUSPICIOUS',
-                                    riskFactor: 90,
-                                    riskFactors: [risk_factor_enum_1.RiskFactor.TOKEN_THEFT_ATTEMPT, risk_factor_enum_1.RiskFactor.REFRESH_TOKEN_REUSE_DIFFERENT_SESSION],
-                                    reason: 'Refresh token reuse from different session',
+                                    riskFactor: 75,
+                                    riskFactors: [risk_factor_enum_1.RiskFactor.TOKEN_REUSE_ATTEMPT],
+                                    reason: 'Token reuse attempt blocked',
                                     // Client info automatically included from context
-                                    description: 'Refresh token from another session attempted to be used. Session revoked as security measure.',
+                                    description: 'Refresh token reuse attempt detected via atomic operation. Legitimate user session preserved.',
                                     metadata: {
-                                        sessionId: session.id,
-                                        tokenSessionId,
-                                        tokenHash: `${tokenHash.substring(0, 16)}...`,
+                                        tokenFamily: payload.tokenFamily,
                                         detectedAt: new Date().toISOString(),
-                                        action: 'session_revoked',
+                                        action: 'reuse_blocked_atomic',
                                     },
                                 });
                             }
                         }
                         catch (auditError) {
-                            const errorMessage = auditError instanceof Error ? auditError.message : 'Unknown error';
-                            this.logger?.error?.(`Failed to record SUSPICIOUS_ACTIVITY audit event (token reuse): ${errorMessage}`, {
-                                error: auditError,
-                                userId: userForAudit?.id || session.userId,
-                            });
+                            this.logger?.warn?.('Failed to record SUSPICIOUS_ACTIVITY audit event', { error: auditError });
                         }
                         throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Refresh token has already been used');
                     }
+                    this.logger?.debug?.(`Marked refresh token as used for session ${lockedSession.id}`);
                 }
+                // Generate new token pair with same family
+                // Note: deviceId not included in token - session.deviceId is source of truth
+                const newTokens = await this.jwtService.generateTokenPair({
+                    userId: payload.sub,
+                    email: payload.email,
+                    sessionId: lockedSession.id.toString(), // Convert integer to string for JWT
+                    tokenFamily: payload.tokenFamily,
+                });
+                // Update session with new token hashes (token rotation)
+                // This automatically invalidates the old tokens as they won't match the session
+                await this.sessionService.updateTokens(lockedSession.id, this.jwtService.hashToken(newTokens.accessToken), this.jwtService.hashToken(newTokens.refreshToken));
+                this.logger?.log?.(`Token refreshed successfully for user ${payload.sub}`);
+                // Decode new tokens to get expiry times
+                const accessTokenValidation = await this.jwtService.validateAccessToken(newTokens.accessToken);
+                const refreshTokenValidation = await this.jwtService.validateRefreshToken(newTokens.refreshToken);
+                return {
+                    accessToken: newTokens.accessToken,
+                    refreshToken: newTokens.refreshToken,
+                    accessTokenExpiresAt: accessTokenValidation.payload?.exp || 0,
+                    refreshTokenExpiresAt: refreshTokenValidation.payload?.exp || 0,
+                };
             }
-            // NOW validate the refresh token (after lock is acquired and reuse check)
-            // This ensures only one request can validate at a time per session
-            const validation = await this.jwtService.validateRefreshToken(refreshToken);
-            if (!validation.valid || !validation.payload) {
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Invalid refresh token');
-            }
-            const payload = validation.payload;
-            // Re-check session after acquiring lock (it might have been revoked/updated)
-            // Since we have the lock, no other request can modify this session, but it might have been revoked
-            // We already have currentSession from the early reuse check, but re-fetch to ensure it's still valid
-            const lockedSession = (await this.sessionService.findByIdLight(session.id));
-            if (!lockedSession || lockedSession.isRevoked || lockedSession.id !== session.id) {
-                this.logger?.debug?.(`Session changed after lock acquisition for user ${payload.sub}. Session may have been revoked.`);
-                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SESSION_NOT_FOUND, 'Session not found or revoked');
-            }
-            // ============================================================================
-            // NOTE: We still do the atomic mark operation below as a double-check
-            // The early check above handles cookie race conditions where old tokens
-            // are sent before new cookies are received
-            // ============================================================================
-            // Mark token as used BEFORE generating new tokens (prevents reuse)
-            if (this.config.jwt.refreshToken.reuseDetection) {
-                const refreshTokenTTL = this.jwtService.getRefreshTokenTTL();
-                const marked = await this.sessionService.markRefreshTokenAsUsed(tokenHash, refreshTokenTTL);
-                if (!marked) {
-                    // Token was already marked as used - reuse detected!
-                    this.logger?.error?.(`Token reuse detected for user ${payload.sub} - atomic mark failed, revoking entire token family ${payload.tokenFamily}`);
-                    // Audit the reuse attempt
-                    try {
-                        const userForAudit = (await this.userRepository.findOne({
-                            where: { sub: payload.sub },
-                        }));
-                        if (userForAudit) {
-                            await this.auditService?.recordEvent({
-                                userId: userForAudit.id,
-                                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.SUSPICIOUS_ACTIVITY,
-                                eventStatus: 'SUSPICIOUS',
-                                riskFactor: 75,
-                                riskFactors: [risk_factor_enum_1.RiskFactor.TOKEN_REUSE_ATTEMPT],
-                                reason: 'Token reuse attempt blocked',
-                                // Client info automatically included from context
-                                description: 'Refresh token reuse attempt detected via atomic operation. Legitimate user session preserved.',
-                                metadata: {
-                                    tokenFamily: payload.tokenFamily,
-                                    detectedAt: new Date().toISOString(),
-                                    action: 'reuse_blocked_atomic',
-                                },
-                            });
-                        }
-                    }
-                    catch (auditError) {
-                        this.logger?.warn?.('Failed to record SUSPICIOUS_ACTIVITY audit event', { error: auditError });
-                    }
-                    throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID, 'Refresh token has already been used');
+            catch (error) {
+                // Best-effort cookie cleanup for session-invalid refresh errors.
+                if (error instanceof nauth_exception_1.NAuthException) {
+                    this.clearAuthCookiesOnRefreshFailure(error.code);
+                }
+                throw error;
+            }
+            finally {
+                // Always release lock, even if error occurs
+                // Only release if we successfully acquired it
+                if (lockAcquired) {
+                    await this.sessionService.releaseRefreshLock(lockKey);
+                    this.logger?.debug?.(`[REFRESH DEBUG] Released lock ${lockKey}`);
                 }
-                this.logger?.debug?.(`Marked refresh token as used for session ${lockedSession.id}`);
             }
-            // Generate new token pair with same family
-            // Note: deviceId not included in token - session.deviceId is source of truth
-            const newTokens = await this.jwtService.generateTokenPair({
-                userId: payload.sub,
-                email: payload.email,
-                sessionId: lockedSession.id.toString(), // Convert integer to string for JWT
-                tokenFamily: payload.tokenFamily,
-            });
-            // Update session with new token hashes (token rotation)
-            // This automatically invalidates the old tokens as they won't match the session
-            await this.sessionService.updateTokens(lockedSession.id, this.jwtService.hashToken(newTokens.accessToken), this.jwtService.hashToken(newTokens.refreshToken));
-            this.logger?.log?.(`Token refreshed successfully for user ${payload.sub}`);
-            // Decode new tokens to get expiry times
-            const accessTokenValidation = await this.jwtService.validateAccessToken(newTokens.accessToken);
-            const refreshTokenValidation = await this.jwtService.validateRefreshToken(newTokens.refreshToken);
-            return {
-                accessToken: newTokens.accessToken,
-                refreshToken: newTokens.refreshToken,
-                accessTokenExpiresAt: accessTokenValidation.payload?.exp || 0,
-                refreshTokenExpiresAt: refreshTokenValidation.payload?.exp || 0,
-            };
         }
         catch (error) {
-            // Best-effort cookie cleanup for session-invalid refresh errors.
+            // Catch any errors that occur before the lock acquisition try block
+            // Convert non-NAuthException errors to proper NAuthException to prevent 500 errors
             if (error instanceof nauth_exception_1.NAuthException) {
                 this.clearAuthCookiesOnRefreshFailure(error.code);
+                throw error;
             }
-            throw error;
-        }
-        finally {
-            // Always release lock, even if error occurs
-            // Only release if we successfully acquired it
-            if (lockAcquired) {
-                await this.sessionService.releaseRefreshLock(lockKey);
-                this.logger?.debug?.(`[REFRESH DEBUG] Released lock ${lockKey}`);
-            }
+            // Log unexpected errors and convert to NAuthException
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            this.logger?.error?.(`Unexpected error in refreshToken: ${errorMessage}`, {
+                error,
+            });
+            this.clearAuthCookiesOnRefreshFailure(error_codes_enum_1.AuthErrorCode.TOKEN_INVALID);
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, 'An error occurred while refreshing the token');
         }
     }
     // ============================================================================
@@ -2199,16 +1648,25 @@ class AuthService {
             code !== error_codes_enum_1.AuthErrorCode.SESSION_EXPIRED) {
             return;
         }
-        const responseFromContext = this.clientInfoService.getResponse();
-        if (!responseFromContext)
-            return;
-        const response = responseFromContext;
-        if (typeof response.clearCookie === 'function') {
-            this.helpers.clearAuthCookies(response, false);
-            return;
+        try {
+            const responseFromContext = this.clientInfoService.getResponse();
+            if (!responseFromContext)
+                return;
+            const response = responseFromContext;
+            if (typeof response.clearCookie === 'function') {
+                this.helpers.clearAuthCookies(response, false);
+                return;
+            }
+            if (typeof response.cookie === 'function' || typeof response.setCookie === 'function') {
+                (0, cookies_util_1.clearAuthCookies)(response, this.config, this.config.tokenDelivery?.cookieOptions, false);
+            }
         }
-        if (typeof response.cookie === 'function' || typeof response.setCookie === 'function') {
-            (0, cookies_util_1.clearAuthCookies)(response, this.config, this.config.tokenDelivery?.cookieOptions, false);
+        catch (error) {
+            // Best-effort cookie clearing - don't let failures prevent proper error handling
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            this.logger?.warn?.(`Failed to clear auth cookies on refresh failure: ${errorMessage}`, {
+                error,
+            });
         }
     }
     // ============================================================================
@@ -2231,9 +1689,8 @@ class AuthService {
      * - Requires authentication - session ID must be present in request context
      * - Endpoint MUST be protected by authentication guards
      * - User cannot specify which session to logout (always current session)
-     * - Optional sub validation for additional security
      *
-     * @param dto - Logout options (optional sub for validation, optional forgetMe flag)
+     * @param dto - Logout options (optional forgetMe flag)
      * @returns Success status
      * @throws {NAuthException} SESSION_NOT_FOUND if session ID not found in request context
      *
@@ -2242,10 +1699,7 @@ class AuthService {
      * @UseGuards(AuthGuard)
      * @Get('logout')
      * async logout(@CurrentUser() user: IUser, @Query('forgetMe') forgetMe?: string) {
-     *   const dto = new LogoutDTO();
-     *   dto.sub = user.sub; // Optional validation
-     *   dto.forgetMe = forgetMe === 'true';
-     *   return this.authService.logout(dto);
+     *   return this.authService.logout({ forgetMe: forgetMe === 'true' });
      * }
      * ```
      */
@@ -2368,16 +1822,13 @@ class AuthService {
      * Optionally revokes all trusted devices if forgetDevices flag is set.
      *
      * Usage Patterns:
-     * - **User-initiated**: User logs out from all their own sessions (protected endpoint, user provides their own sub)
-     * - **Admin-initiated**: Admin force-logs out any user (admin-protected endpoint, admin provides target user's sub)
+     * - **User-initiated**: User logs out from all their own sessions (protected endpoint)
      *
      * Security:
-     * - Requires explicit sub parameter
-     * - NO built-in authentication - endpoint MUST be protected by guards
-     * - For user endpoints: Extract sub from authenticated user context (@CurrentUser)
-     * - For admin endpoints: Accept sub from route parameter and protect with admin guards
+     * - Uses authenticated user context for sub
+     * - Endpoint MUST be protected by authentication guards
      *
-     * @param dto - User sub and optional forgetDevices flag
+     * @param dto - Logout options (forgetDevices flag)
      * @returns Number of sessions revoked
      * @throws {NAuthException} NOT_FOUND if user not found
      *
@@ -2387,25 +1838,27 @@ class AuthService {
      * @UseGuards(AuthGuard)
      * @Post('logout/all')
      * async logoutAll(@CurrentUser() user: IUser, @Body() body: { forgetDevices?: boolean }) {
-     *   return this.authService.logoutAll({ sub: user.sub, forgetDevices: body.forgetDevices });
+     *   return this.authService.logoutAll({ forgetDevices: body.forgetDevices });
      * }
      * ```
      *
      * @example Admin-initiated (admin manages any user)
      * ```typescript
-     * // Admin provides target user's sub
+     * // Use AdminAuthService.logoutAll with target sub
      * @UseGuards(AuthGuard, AdminGuard)
      * @Post('admin/users/:sub/logout-all')
      * async adminLogoutAll(@Param('sub') sub: string, @Body() body: { forgetDevices?: boolean }) {
-     *   return this.authService.logoutAll({ sub, forgetDevices: body.forgetDevices });
+     *   return this.adminAuthService.logoutAll({ sub, forgetDevices: body.forgetDevices });
      * }
      * ```
      */
     async logoutAll(dto) {
         // Ensure DTO is validated (supports direct usage without framework validation)
         dto = await (0, dto_validator_1.ensureValidatedDto)(logout_all_dto_1.LogoutAllDTO, dto);
+        // Get current authenticated user from context
+        const currentUser = this.getCurrentUserOrThrow();
         // Get user by sub to get internal id
-        const user = (await this.userRepository.findOne({ where: { sub: dto.sub } }));
+        const user = (await this.userRepository.findOne({ where: { sub: currentUser.sub } }));
         if (!user) {
             throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
         }
@@ -2434,6 +1887,7 @@ class AuthService {
                             description: `Global signout: All trusted devices revoked (${revokedDevicesCount} device(s))`,
                             metadata: {
                                 reason: 'global_logout_forget_devices',
+                                initiatedBy: 'user',
                                 revokedDevicesCount,
                                 devices: revokedDevices.map((d) => ({
                                     id: d.id,
@@ -2542,16 +1996,12 @@ class AuthService {
      * Current session (if called from authenticated context) is marked with isCurrent=true.
      *
      * Usage Patterns:
-     * - **User viewing own sessions**: User views their active sessions (protected endpoint, user provides their own sub)
-     * - **Admin viewing any user's sessions**: Admin views any user's sessions (admin-protected endpoint, admin provides target user's sub)
+     * - **User viewing own sessions**: User views their active sessions (protected endpoint)
      *
      * Security:
-     * - Requires explicit sub parameter
-     * - NO built-in authentication - endpoint MUST be protected by guards
-     * - For user endpoints: Extract sub from authenticated user context (@CurrentUser)
-     * - For admin endpoints: Accept sub from route parameter and protect with admin guards
+     * - Uses authenticated user context for sub
+     * - Endpoint MUST be protected by authentication guards
      *
-     * @param dto - Contains user sub
      * @returns Array of sessions with device info, auth method, and isCurrent flag
      * @throws {NAuthException} NOT_FOUND if user not found
      *
@@ -2560,7 +2010,7 @@ class AuthService {
      * @UseGuards(AuthGuard)
      * @Get('sessions')
      * async getSessions(@CurrentUser() user: IUser) {
-     *   return this.authService.getUserSessions({ sub: user.sub });
+     *   return this.authService.getUserSessions();
      * }
      * ```
      *
@@ -2569,15 +2019,15 @@ class AuthService {
      * @UseGuards(AuthGuard, AdminGuard)
      * @Get('admin/users/:sub/sessions')
      * async adminGetSessions(@Param('sub') sub: string) {
-     *   return this.authService.getUserSessions({ sub });
+     *   return this.adminAuthService.getUserSessions({ sub });
      * }
      * ```
      */
-    async getUserSessions(dto) {
-        // Ensure DTO is validated (supports direct usage without framework validation)
-        dto = await (0, dto_validator_1.ensureValidatedDto)(get_user_sessions_dto_1.GetUserSessionsDTO, dto);
+    async getUserSessions() {
+        // Get current authenticated user from context
+        const currentUser = this.getCurrentUserOrThrow();
         // Get user by sub to get internal id
-        const user = (await this.userRepository.findOne({ where: { sub: dto.sub } }));
+        const user = (await this.userRepository.findOne({ where: { sub: currentUser.sub } }));
         if (!user) {
             throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
         }
@@ -2625,6 +2075,83 @@ class AuthService {
         });
         return { sessions: sessionInfos };
     }
+    /**
+     * Get MFA status for current authenticated user
+     *
+     * Returns comprehensive MFA status including enabled status, configured methods,
+     * available methods, backup codes, and exemption information.
+     *
+     * Usage Patterns:
+     * - **User viewing own MFA status**: User views their MFA configuration (protected endpoint)
+     *
+     * Security:
+     * - Uses authenticated user context for sub
+     * - Endpoint MUST be protected by authentication guards
+     *
+     * @returns MFA status response
+     * @throws {NAuthException} FORBIDDEN if user not authenticated
+     * @throws {NAuthException} NOT_FOUND if user not found
+     *
+     * @example User viewing own MFA status
+     * ```typescript
+     * @UseGuards(AuthGuard)
+     * @Get('mfa/status')
+     * async getMFAStatus() {
+     *   return this.authService.getMFAStatus();
+     * }
+     * ```
+     */
+    async getMFAStatus() {
+        if (!this.mfaService) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, 'MFA service is not available');
+        }
+        // Get current authenticated user from context
+        const currentUser = this.getCurrentUserOrThrow();
+        // Call MFA service with user's sub
+        // Pass as plain object to ensure proper transformation by ensureValidatedDto
+        return await this.mfaService.getMFAStatus({ sub: currentUser.sub });
+    }
+    /**
+     * Get authentication audit history for current authenticated user
+     *
+     * Returns paginated audit trail of authentication events for the user:
+     * - Login attempts (success/failure)
+     * - Password changes
+     * - MFA setup/verification
+     * - Device trust events
+     * - Device information, location, risk factors
+     *
+     * Usage Patterns:
+     * - **User viewing own audit history**: User views their authentication history (protected endpoint)
+     *
+     * Security:
+     * - Uses authenticated user context for sub
+     * - Endpoint MUST be protected by authentication guards
+     *
+     * @param dto - Optional query parameters for filtering and pagination
+     * @returns Paginated audit history response
+     * @throws {NAuthException} FORBIDDEN if user not authenticated
+     * @throws {NAuthException} NOT_FOUND if user not found
+     *
+     * @example User viewing own audit history
+     * ```typescript
+     * @UseGuards(AuthGuard)
+     * @Get('audit/history')
+     * async getAuditHistory(@Query() query: GetUserAuthHistoryDTO) {
+     *   return this.authService.getUserAuthHistory(query);
+     * }
+     * ```
+     */
+    async getUserAuthHistory(dto = {}) {
+        if (!this.auditService) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.INTERNAL_ERROR, 'Audit service is not available');
+        }
+        // Get current authenticated user from context
+        const currentUser = this.getCurrentUserOrThrow();
+        // Convert to admin DTO with sub from context
+        const adminDto = Object.assign(new admin_get_user_auth_history_dto_1.AdminGetUserAuthHistoryDTO(), { ...dto, sub: currentUser.sub });
+        return await this.auditService.getUserAuthHistory(adminDto);
+    }
     /**
      * Logout a specific session by ID
      *
@@ -2633,17 +2160,14 @@ class AuthService {
      * Useful for "sign out from device" functionality in user dashboards.
      *
      * Usage Patterns:
-     * - **User logging out own session**: User revokes specific session (protected endpoint, user provides their own sub)
-     * - **Admin revoking any user's session**: Admin revokes specific session for any user (admin-protected endpoint, admin provides target user's sub)
+     * - **User logging out own session**: User revokes specific session (protected endpoint)
      *
      * Security:
-     * - Requires explicit sub parameter
+     * - Uses authenticated user context for sub
      * - Validates session belongs to user (prevents unauthorized session revocation)
-     * - NO built-in authentication - endpoint MUST be protected by guards
-     * - For user endpoints: Extract sub from authenticated user context (@CurrentUser)
-     * - For admin endpoints: Accept sub from route parameter and protect with admin guards
+     * - Endpoint MUST be protected by authentication guards
      *
-     * @param dto - Contains sessionId and user sub
+     * @param dto - Contains sessionId
      * @returns Success status and whether it was the current session
      * @throws {NAuthException} NOT_FOUND if user not found
      * @throws {NAuthException} SESSION_NOT_FOUND if session not found
@@ -2654,7 +2178,7 @@ class AuthService {
      * @UseGuards(AuthGuard)
      * @Delete('sessions/:sessionId')
      * async logoutSession(@CurrentUser() user: IUser, @Param('sessionId') sessionId: string) {
-     *   return this.authService.logoutSession({ sub: user.sub, sessionId });
+     *   return this.authService.logoutSession({ sessionId });
      * }
      * ```
      *
@@ -2663,15 +2187,17 @@ class AuthService {
      * @UseGuards(AuthGuard, AdminGuard)
      * @Delete('admin/users/:sub/sessions/:sessionId')
      * async adminRevokeSession(@Param('sub') sub: string, @Param('sessionId') sessionId: string) {
-     *   return this.authService.logoutSession({ sub, sessionId });
+     *   return this.adminAuthService.revokeUserSession({ sub, sessionId });
      * }
      * ```
      */
     async logoutSession(dto) {
         // Ensure DTO is validated (supports direct usage without framework validation)
         dto = await (0, dto_validator_1.ensureValidatedDto)(logout_session_dto_1.LogoutSessionDTO, dto);
+        // Get current authenticated user from context
+        const currentUser = this.getCurrentUserOrThrow();
         // Get user by sub to get internal id
-        const user = (await this.userRepository.findOne({ where: { sub: dto.sub } }));
+        const user = (await this.userRepository.findOne({ where: { sub: currentUser.sub } }));
         if (!user) {
             throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
         }
@@ -2695,7 +2221,7 @@ class AuthService {
         const wasCurrentSession = currentSessionId !== null && sessionId === currentSessionId;
         // Revoke the session
         await this.sessionService.revokeSession(sessionId, 'User requested logout', {
-            requestedBy: dto.sub,
+            requestedBy: currentUser.sub,
             wasCurrentSession,
         });
         // Clear cookies if this was the current session
@@ -2745,14 +2271,13 @@ class AuthService {
      * checks password reuse policy, and updates the user's password hash and history.
      * Executes configured pre-change hooks if provided.
      *
-     * @param sub - External user identifier (sub/UUID)
      * @param dto - ChangePasswordDTO containing old and new password
      * @returns void
      * @throws {NAuthException} If the user is not found, current password is incorrect, the new password is weak, password reuse is detected, or password change is disallowed by hooks.
      *
      * @example
      * ```typescript
-     * await authService.changePassword('user-uuid', {
+     * await authService.changePassword({
      *   oldPassword: 'currentPass123!',
      *   newPassword: 'newStr0ngPass!@#',
      * });
@@ -2760,30 +2285,42 @@ class AuthService {
      */
     async changePassword(dto) {
         // Ensure DTO is validated (supports direct usage without framework validation)
-        dto = await (0, dto_validator_1.ensureValidatedDto)(change_password_request_dto_1.ChangePasswordRequestDTO, dto);
+        dto = await (0, dto_validator_1.ensureValidatedDto)(change_password_dto_1.ChangePasswordDTO, dto);
+        // Get current authenticated user from context
+        const currentUser = this.getCurrentUserOrThrow();
         // Get user by sub
-        const user = (await this.userRepository.findOne({ where: { sub: dto.sub } }));
-        if (!user || !user.passwordHash) {
+        const user = (await this.userRepository.findOne({ where: { sub: currentUser.sub } }));
+        if (!user) {
             throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
         }
         // ============================================================================
+        // Social-only accounts: allow setting first password without old password
+        // ============================================================================
+        if (!user.passwordHash) {
+            if (dto.oldPassword !== '') {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PASSWORD_CHANGE_NOT_ALLOWED, 'Password change not allowed');
+            }
+        }
+        // ============================================================================
         // Lifecycle Hook: beforePasswordChange (TODO: Implement provider-based hook)
         // ============================================================================
         // TODO: Implement provider-based hook for beforePasswordChange
-        // const allowed = await this.hookRegistry.executeBeforePasswordChange(dto.sub, dto.oldPassword);
+        // const allowed = await this.hookRegistry.executeBeforePasswordChange(currentUser.sub, dto.oldPassword);
         // if (!allowed) {
         //   throw new NAuthException(AuthErrorCode.PASSWORD_CHANGE_NOT_ALLOWED, 'Password change not allowed');
         // }
-        // Verify old password
-        const isValid = await this.passwordService.verifyPassword(dto.oldPassword, user.passwordHash);
-        if (!isValid) {
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PASSWORD_INCORRECT, 'Current password is incorrect');
+        if (user.passwordHash) {
+            // Verify old password
+            const isValid = await this.passwordService.verifyPassword(dto.oldPassword, user.passwordHash);
+            if (!isValid) {
+                throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.PASSWORD_INCORRECT, 'Current password is incorrect');
+            }
         }
         // ============================================================================
         // Lifecycle Hook: afterPasswordChange (TODO: Implement provider-based hook)
         // ============================================================================
         // TODO: Implement provider-based hook for afterPasswordChange
-        // await this.hookRegistry.executeAfterPasswordChange(dto.sub);
+        // await this.hookRegistry.executeAfterPasswordChange(currentUser.sub);
         await this.helpers.updateUserPassword({
             user,
             newPassword: dto.newPassword,
@@ -2802,53 +2339,38 @@ class AuthService {
      *
      * Updates user fields (name, email, phone, username, metadata) and enforces unique constraints and verification rules.
      *
-     * @param dto - UpdateUserAttributesRequestDTO containing sub and fields to update
+     * @param dto - UpdateUserAttributesDTO containing fields to update
      * @returns Updated user object
      * @throws {NAuthException} If user not found or unique constraint violated
      *
      * @example
-     * await authService.updateUserAttributes({ sub: 'user-uuid', email: 'test@example.com' });
+     * await authService.updateUserAttributes({ email: 'test@example.com' });
      */
     async updateUserAttributes(dto) {
-        return await this.userService.updateUserAttributes(dto);
+        const currentUser = this.getCurrentUserOrThrow();
+        const adminDto = Object.assign(new admin_update_user_attributes_dto_1.AdminUpdateUserAttributesDTO(), { sub: currentUser.sub, ...dto });
+        return await this.userService.updateUserAttributes(adminDto);
     }
     /**
-     * Update email and/or phone verification status.
-     *
-     * Intended for admin use cases such as migration or offline validation.
-     * Updates verification status without requiring actual verification codes.
+     * Get user for authentication context
      *
-     * Validation:
-     * - Cannot set verified=true if email/phone doesn't exist
-     * - Can set verified=false even if email/phone doesn't exist (default state)
-     * - Only updates provided fields (partial update)
+     * Loads user by sub (external identifier) with all fields needed for auth context.
+     * Computes hasPasswordHash from passwordHash, then removes passwordHash and other sensitive fields.
      *
-     * Audit:
-     * - Records EMAIL_VERIFIED or PHONE_VERIFIED audit events
-     * - Includes performedBy from authenticated admin context
+     * This method is used by AuthHandler and AuthGuard to load authenticated users.
+     * It ensures consistent user object shape across platforms (core + NestJS).
      *
-     * @param dto - Request DTO containing sub and verification status flags
-     * @returns Updated user object
-     * @throws {NAuthException} If user not found or trying to verify non-existent email/phone
+     * @param sub - External user identifier (UUID)
+     * @returns User object with hasPasswordHash flag, without sensitive fields
+     * @throws {NAuthException} If user not found or account is inactive
      *
      * @example
      * ```typescript
-     * // Update email verification only
-     * await authService.updateVerifiedStatus({
-     *   sub: 'user-uuid',
-     *   isEmailVerified: true
-     * });
-     *
-     * // Update both email and phone verification
-     * await authService.updateVerifiedStatus({
-     *   sub: 'user-uuid',
-     *   isEmailVerified: true,
-     *   isPhoneVerified: false
-     * });
+     * const user = await authService.getUserForAuthContext('user-uuid');
      * ```
      */
-    async updateVerifiedStatus(dto) {
-        return await this.userService.updateVerifiedStatus(dto);
+    async getUserForAuthContext(sub) {
+        return await this.userService.getUserForAuthContext(sub);
     }
     /**
      * Validate JWT access token
@@ -2886,7 +2408,6 @@ class AuthService {
      * ```
      */
     async validateAccessToken(dto) {
-        // Ensure DTO is validated (supports direct usage without framework validation)
         dto = await (0, dto_validator_1.ensureValidatedDto)(validate_access_token_dto_1.ValidateAccessTokenDTO, dto);
         const result = await this.jwtService.validateAccessToken(dto.accessToken);
         return {
@@ -2897,368 +2418,6 @@ class AuthService {
         };
     }
     // ============================================================================
-    // Helper Methods
-    // ============================================================================
-    // NOTE: Private helper methods have been moved to AuthServiceInternalHelpers
-    // Use this.helpers.methodName() to access them
-    /**
-     * Get user for authentication context
-     *
-     * Loads user by sub (external identifier) with all fields needed for auth context.
-     * Computes hasPasswordHash from passwordHash, then removes passwordHash and other sensitive fields.
-     *
-     * This method is used by AuthHandler and AuthGuard to load authenticated users.
-     * It ensures consistent user object shape across platforms (core + NestJS).
-     *
-     * @param sub - External user identifier (UUID)
-     * @returns User object with hasPasswordHash flag, without sensitive fields
-     * @throws {NAuthException} If user not found or account is inactive
-     *
-     * @example
-     * ```typescript
-     * const user = await authService.getUserForAuthContext('user-uuid-123');
-     * // user.hasPasswordHash === true/false
-     * // user.passwordHash === undefined (removed)
-     * ```
-     */
-    async getUserForAuthContext(sub) {
-        return await this.userService.getUserForAuthContext(sub);
-    }
-    /**
-     * Get user by external identifier (sub/UUID).
-     *
-     * @param dto - GetUserByIdDTO containing sub
-     * @returns User response DTO or null if not found
-     *
-     * @example
-     * ```typescript
-     * const user = await authService.getUserById({ sub: 'user-uuid' });
-     * ```
-     */
-    async getUserById(dto) {
-        return await this.userService.getUserById(dto);
-    }
-    /**
-     * Get user by email address.
-     *
-     * @param dto - GetUserByEmailDTO containing email and optional requireEmailVerified
-     * @returns User response DTO or null if not found
-     * @internal - For use by social auth providers
-     *
-     * @example
-     * ```typescript
-     * const user = await authService.getUserByEmail({ email: 'user@example.com', requireEmailVerified: true });
-     * ```
-     */
-    async getUserByEmail(dto) {
-        return await this.userService.getUserByEmail(dto);
-    }
-    /**
-     * Require user to change password at next login.
-     *
-     * Throws if user not found or has no password set (e.g. social login only).
-     *
-     * @param dto - SetMustChangePasswordDTO containing userId (sub)
-     * @returns Success response
-     * @throws {NAuthException} If user is not found or cannot change password
-     *
-     * @example
-     * ```typescript
-     * await authService.setMustChangePassword({ userId: 'user-uuid-123' });
-     * ```
-     */
-    async setMustChangePassword(dto) {
-        return await this.userService.setMustChangePassword(dto);
-    }
-    /**
-     * Admin-only: Initiate a code-based password reset workflow.
-     *
-     * Unlike adminSetPassword(), this sends a verification code (and optional link)
-     * to the user via email/SMS and allows them to set their own password.
-     *
-     * Features:
-     * - Code + optional link delivery (like email verification)
-     * - Optional immediate session revocation
-     * - Configurable expiry (default 1 hour)
-     * - Admin-specific email template
-     * - No rate limiting (admin bypass)
-     * - Separate audit trail with reason
-     *
-     * Security:
-     * - Admin-only operation (protect route with admin guard)
-     * - Non-enumerating (throws NOT_FOUND if user doesn't exist)
-     * - Separate token type ('admin_password_reset')
-     * - Audit logging with reason
-     *
-     * @param dto - Admin reset password request
-     * @returns Response with masked destination, expiry, and sessions revoked count
-     * @throws {NAuthException} NOT_FOUND when user not found
-     *
-     * @example
-     * ```typescript
-     * // With link for custom UI
-     * const result = await authService.adminResetPassword({
-     *   identifier: 'user@example.com',
-     *   baseUrl: 'https://myapp.com/reset-password',
-     *   revokeSessions: true,
-     *   reason: 'User reported compromise'
-     * });
-     * // result: { success: true, destination: 'u***r@example.com', expiresIn: 3600, sessionsRevoked: 3 }
-     *
-     * // Code only (no link)
-     * const result = await authService.adminResetPassword({
-     *   identifier: 'user@example.com'
-     * });
-     * ```
-     */
-    async adminResetPassword(dto) {
-        // Ensure DTO is validated (supports direct usage without framework validation)
-        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_reset_password_dto_1.AdminResetPasswordDTO, dto);
-        this.logger?.log?.(`Admin password reset requested for identifier: ${dto.identifier}`);
-        this.logger?.debug?.(`Reset details: { identifier: ${dto.identifier}, deliveryMethod: ${dto.deliveryMethod ?? 'email'}, revokeSessions: ${dto.revokeSessions ?? false}, baseUrl: ${dto.baseUrl ?? 'none'}, reason: ${dto.reason ?? 'none'} }`);
-        // ============================================================================
-        // Find User by Identifier
-        // ============================================================================
-        // Support multiple identifier types: email, username, phone, or sub (UUID)
-        let user = null;
-        // Try to find by sub (UUID) first if it looks like a UUID.
-        // WHY: Many deployments treat `sub` as the primary immutable identifier.
-        if ((0, class_validator_1.isUUID)(dto.identifier)) {
-            this.logger?.debug?.(`Identifier appears to be UUID, searching by sub: ${dto.identifier}`);
-            user = (await this.userRepository.findOne({ where: { sub: dto.identifier } }));
-        }
-        // If not found by sub, try by identifier (email, username, phone)
-        if (!user) {
-            this.logger?.debug?.(`Searching by identifier (email/username/phone): ${dto.identifier}`);
-            user = await this.helpers.findUserByIdentifier(dto.identifier);
-        }
-        if (!user) {
-            this.logger?.warn?.(`Admin password reset failed - user not found: ${dto.identifier}`);
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
-        }
-        if (!this.passwordResetService) {
-            this.logger?.error?.('Password reset service not available');
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SERVICE_UNAVAILABLE, 'Password reset service is not configured. Please configure an email provider.');
-        }
-        // ============================================================================
-        // Optionally revoke sessions immediately (before sending reset email)
-        // ============================================================================
-        const revokeSessions = dto.revokeSessions ?? false;
-        let sessionsRevoked = 0;
-        if (revokeSessions) {
-            sessionsRevoked = await this.sessionService.revokeAllUserSessions(user.id, 'Admin initiated password reset');
-            this.logger?.log?.(`Revoked ${sessionsRevoked} sessions for user ${user.sub}`);
-        }
-        // ============================================================================
-        // Request admin reset with code + link
-        // ============================================================================
-        const delivery = dto.deliveryMethod || 'email';
-        const expiresIn = dto.codeExpiresIn || 3600; // Default 1 hour
-        const result = await this.passwordResetService.requestAdminReset(user, delivery, {
-            expiresIn,
-            baseUrl: dto.baseUrl, // Consumer app can build custom UI
-        });
-        // ============================================================================
-        // Audit Logging
-        // ============================================================================
-        await this.auditService?.recordEvent({
-            userId: user.id,
-            eventType: auth_audit_event_type_enum_1.AuthAuditEventType.ADMIN_PASSWORD_RESET_INITIATED,
-            eventStatus: 'INFO',
-            authMethod: 'password',
-            description: dto.reason || 'Admin initiated password reset',
-            reason: dto.reason, // Store reason in audit event
-            metadata: {
-                medium: delivery,
-                expiresIn,
-                sessionsRevoked,
-                hasBaseUrl: !!dto.baseUrl,
-            },
-        });
-        // ============================================================================
-        // Return Response
-        // ============================================================================
-        return {
-            success: true,
-            destination: result.destination,
-            deliveryMedium: result.deliveryMedium,
-            expiresIn: result.expiresIn,
-            sessionsRevoked: revokeSessions ? sessionsRevoked : undefined,
-        };
-    }
-    /**
-     * Complete admin-initiated password reset with a verification code.
-     *
-     * NOTE:
-     * - Links (when provided) should include the same verification code as a query parameter
-     *   (e.g., `...?code=123456`) to keep consumer apps code-only and consistent.
-     *
-     * Security:
-     * - Verifies code via PasswordResetService
-     * - Enforces password policy and history
-     * - Always revokes all sessions on completion
-     * - Does not force password change (user already set new password)
-     * - Records audit event
-     *
-     * @param dto - Confirm admin reset password request
-     * @returns Success response
-     * @throws {NAuthException} NOT_FOUND | PASSWORD_RESET_CODE_INVALID | PASSWORD_RESET_CODE_EXPIRED | PASSWORD_RESET_MAX_ATTEMPTS | WEAK_PASSWORD | PASSWORD_REUSED | INVALID_CREDENTIALS
-     *
-     * @example
-     * ```typescript
-     * await authService.confirmAdminResetPassword({
-     *   identifier: 'user@example.com',
-     *   code: '123456',
-     *   newPassword: 'NewSecurePass123!'
-     * });
-     * ```
-     */
-    async confirmAdminResetPassword(dto) {
-        // Ensure DTO is validated (supports direct usage without framework validation)
-        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_reset_password_dto_1.ConfirmAdminResetPasswordDTO, dto);
-        this.logger?.log?.(`Confirm admin password reset for identifier: ${dto.identifier}`);
-        // ============================================================================
-        // Find User by Identifier
-        // ============================================================================
-        let user = null;
-        if ((0, class_validator_1.isUUID)(dto.identifier)) {
-            this.logger?.debug?.(`Identifier appears to be UUID, searching by sub: ${dto.identifier}`);
-            user = (await this.userRepository.findOne({ where: { sub: dto.identifier } }));
-        }
-        if (!user) {
-            this.logger?.debug?.(`Searching by identifier (email/username/phone): ${dto.identifier}`);
-            user = await this.helpers.findUserByIdentifier(dto.identifier);
-        }
-        if (!user) {
-            this.logger?.warn?.(`Confirm admin reset failed - user not found: ${dto.identifier}`);
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
-        }
-        if (!this.passwordResetService) {
-            this.logger?.error?.('Password reset service not available');
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.SERVICE_UNAVAILABLE, 'Password reset service is not configured. Please configure an email provider.');
-        }
-        // ============================================================================
-        // Verify code
-        // ============================================================================
-        await this.passwordResetService.consumeValidCode(user, dto.code, 'admin_password_reset');
-        // ============================================================================
-        // Update password
-        // ============================================================================
-        // WHY: User already set a new password via this reset flow, so no need to force
-        // another password change on next login (unlike adminSetPassword where admin sets
-        // a password the user doesn't know)
-        await this.helpers.updateUserPassword({
-            user,
-            newPassword: dto.newPassword,
-            mustChangePassword: false, // User already set new password, no need to force change again
-            revokeSessions: true, // Always revoke on completion
-            revokeReason: 'Admin-initiated password reset completed',
-            audit: {
-                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.ADMIN_PASSWORD_RESET_COMPLETED,
-                eventStatus: 'SUCCESS',
-                description: 'User completed admin-initiated password reset',
-                metadata: {
-                    usedCode: true,
-                },
-            },
-        }, this.passwordService, this.auditService);
-        // ============================================================================
-        // Return Response
-        // ============================================================================
-        return {
-            success: true,
-        };
-    }
-    /**
-     * Admin-only: Reset a user's password by identifier.
-     *
-     * Allows administrators to reset a user's password using any identifier
-     * (email, username, phone, or sub). Automatically revokes sessions and optionally
-     * requires password change on next login using the existing challenge system.
-     *
-     * SECURITY: This is an admin-only operation. Ensure proper authorization
-     * checks are in place before calling this method.
-     *
-     * @param dto - Admin reset password request
-     * @returns Response with success status and session revocation count
-     * @throws {NAuthException} If user not found, user has no password (social-only), or password validation fails
-     *
-     * @example
-     * ```typescript
-     * // Reset with force password change
-     * const result = await authService.adminSetPassword({
-     *   identifier: 'user@example.com',
-     *   newPassword: 'NewSecurePassword123!',
-     *   mustChangePassword: true,
-     *   revokeSessions: true
-     * });
-     *
-     * // Reset without forcing password change
-     * const result = await authService.adminSetPassword({
-     *   identifier: 'a21b654c-2746-4168-acee-c175083a65cd',
-     *   newPassword: 'NewSecurePassword123!',
-     *   mustChangePassword: false
-     * });
-     * ```
-     */
-    async adminSetPassword(dto) {
-        // Ensure DTO is validated (supports direct usage without framework validation)
-        dto = await (0, dto_validator_1.ensureValidatedDto)(admin_set_password_dto_1.AdminSetPasswordDTO, dto);
-        this.logger?.log?.(`Admin password reset requested for identifier: ${dto.identifier}`);
-        this.logger?.debug?.(`Reset details: { identifier: ${dto.identifier}, mustChangePassword: ${dto.mustChangePassword ?? true}, revokeSessions: ${dto.revokeSessions ?? true} }`);
-        // ============================================================================
-        // Find User by Identifier
-        // ============================================================================
-        // Support multiple identifier types: email, username, phone, or sub (UUID)
-        let user = null;
-        // Try to find by sub (UUID) first if it looks like a UUID.
-        // WHY: Many deployments treat `sub` as the primary immutable identifier.
-        if ((0, class_validator_1.isUUID)(dto.identifier)) {
-            this.logger?.debug?.(`Identifier appears to be UUID, searching by sub: ${dto.identifier}`);
-            user = (await this.userRepository.findOne({ where: { sub: dto.identifier } }));
-        }
-        // If not found by sub, try by identifier (email, username, phone)
-        if (!user) {
-            this.logger?.debug?.(`Searching by identifier (email/username/phone): ${dto.identifier}`);
-            user = await this.helpers.findUserByIdentifier(dto.identifier);
-        }
-        if (!user) {
-            this.logger?.warn?.(`Password reset failed - user not found: ${dto.identifier}`);
-            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.NOT_FOUND, 'User not found');
-        }
-        const mustChangePassword = dto.mustChangePassword ?? true; // Default to true for security
-        const revokeSessions = dto.revokeSessions !== false;
-        const wasSocialOnly = !user.passwordHash;
-        const { sessionsRevoked } = await this.helpers.updateUserPassword({
-            user,
-            newPassword: dto.newPassword,
-            mustChangePassword,
-            revokeSessions,
-            revokeReason: 'Password reset by administrator',
-            audit: {
-                eventType: auth_audit_event_type_enum_1.AuthAuditEventType.PASSWORD_RESET_COMPLETED,
-                eventStatus: 'SUCCESS',
-                reason: 'admin_reset',
-                description: 'Password reset by administrator',
-                metadata: {
-                    identifier: dto.identifier,
-                    mustChangePassword,
-                    // WHY: Admins can set the first password for social-only accounts so users can login via either route later.
-                    // This flag helps downstream observability without exposing anything to clients.
-                    wasSocialOnly,
-                },
-            },
-        }, this.passwordService, this.auditService);
-        // ============================================================================
-        // Return Response
-        // ============================================================================
-        return {
-            success: true,
-            mustChangePassword,
-            sessionsRevoked,
-        };
-    }
-    // ============================================================================
     // Forgot Password (Account Recovery)
     // ============================================================================
     /**
@@ -3394,6 +2553,16 @@ class AuthService {
         }, this.passwordService, this.auditService);
         return { success: true, mustChangePassword: false };
     }
+    // ============================================================================
+    // Helper Methods
+    // ============================================================================
+    getCurrentUserOrThrow() {
+        const currentUser = context_storage_1.ContextStorage.get('CURRENT_USER');
+        if (!currentUser) {
+            throw new nauth_exception_1.NAuthException(error_codes_enum_1.AuthErrorCode.FORBIDDEN, 'Authentication required');
+        }
+        return currentUser;
+    }
 }
 exports.AuthService = AuthService;
 //# sourceMappingURL=auth.service.js.map