@solidstarters/solid-core 1.2.0

package/dist/services/authentication.service.js

@@ -0,0 +1,766 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthenticationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticationService = void 0;
+const axios_1 = require("@nestjs/axios");
+const common_1 = require("@nestjs/common");
+const event_emitter_1 = require("@nestjs/event-emitter");
+const jwt_1 = require("@nestjs/jwt");
+const typeorm_1 = require("@nestjs/typeorm");
+const class_validator_1 = require("class-validator");
+const crypto_1 = require("crypto");
+const SMTPEmailService_1 = require("./mail/SMTPEmailService");
+const Msg91OTPService_1 = require("./sms/Msg91OTPService");
+const typeorm_2 = require("typeorm");
+const iam_config_1 = require("../config/iam.config");
+const user_password_history_entity_1 = require("../entities/user-password-history.entity");
+const user_entity_1 = require("../entities/user.entity");
+const hashing_service_1 = require("./hashing.service");
+const refresh_token_ids_storage_service_1 = require("./refresh-token-ids-storage.service");
+const user_service_1 = require("./user.service");
+const interfaces_1 = require("../interfaces");
+const constants_1 = require("../constants");
+var LoginProvider;
+(function (LoginProvider) {
+    LoginProvider["LOCAL"] = "local";
+    LoginProvider["GOOGLE"] = "google";
+    LoginProvider["OTP"] = "otp";
+})(LoginProvider || (LoginProvider = {}));
+let AuthenticationService = AuthenticationService_1 = class AuthenticationService {
+    constructor(userService, userRepository, userPasswordHistoryRepository, hashingService, jwtService, jwtConfiguration, iamConfiguration, refreshTokenIdsStorage, httpService, mailService, smsService, eventEmitter) {
+        this.userService = userService;
+        this.userRepository = userRepository;
+        this.userPasswordHistoryRepository = userPasswordHistoryRepository;
+        this.hashingService = hashingService;
+        this.jwtService = jwtService;
+        this.jwtConfiguration = jwtConfiguration;
+        this.iamConfiguration = iamConfiguration;
+        this.refreshTokenIdsStorage = refreshTokenIdsStorage;
+        this.httpService = httpService;
+        this.mailService = mailService;
+        this.smsService = smsService;
+        this.eventEmitter = eventEmitter;
+        this.logger = new common_1.Logger(AuthenticationService_1.name);
+    }
+    async resolveUser(username, email) {
+        return await this.userRepository.findOne({
+            where: [
+                { username: username },
+                { email: email },
+            ],
+            relations: {
+                roles: true
+            }
+        });
+    }
+    async validateUser(signInDto) {
+        const user = await this.resolveUser(signInDto.username, signInDto.email);
+        if (!user) {
+            throw new common_1.UnauthorizedException('User does not exists');
+        }
+        if (!user.active) {
+            throw new common_1.UnauthorizedException('User profile not activated');
+        }
+        const isEqual = await this.hashingService.compare(signInDto.password, user.password);
+        if (!isEqual) {
+            throw new common_1.UnauthorizedException('Password does not match');
+        }
+        return user;
+    }
+    async signUp(signUpDto, activeUser = null) {
+        if (!this.iamConfiguration.allowPublicRegistration && !activeUser) {
+            throw new common_1.BadRequestException('Public registrations are disabled.');
+        }
+        try {
+            const user = new user_entity_1.User();
+            user.username = signUpDto.username;
+            user.email = signUpDto.email;
+            user.fullName = signUpDto.fullName;
+            if (signUpDto.mobile) {
+                user.mobile = signUpDto.mobile;
+            }
+            let pwd = '';
+            let autoGeneratedPwd = '';
+            if (signUpDto.password) {
+                pwd = await this.hashingService.hash(signUpDto.password);
+            }
+            else {
+                autoGeneratedPwd = this.generatePassword();
+                pwd = await this.hashingService.hash(autoGeneratedPwd);
+                user.forcePasswordChange = true;
+            }
+            user.password = pwd;
+            user.active = this.iamConfiguration.activateUserOnRegistration;
+            const savedUser = await this.userRepository.save(user);
+            let roles = [];
+            if (this.iamConfiguration.defaultRole) {
+                roles.push(this.iamConfiguration.defaultRole);
+            }
+            if (signUpDto.roles) {
+                roles = [...roles, ...signUpDto.roles];
+            }
+            roles = Array.from(new Set([...roles]));
+            if (roles.length > 0) {
+                this.userService.addRolesToUser(user.username, roles);
+            }
+            const userPasswordHistory = new user_password_history_entity_1.UserPasswordHistory();
+            userPasswordHistory.passwordHash = pwd;
+            userPasswordHistory.user = savedUser;
+            await this.userPasswordHistoryRepository.save(userPasswordHistory);
+            if (user.forcePasswordChange && autoGeneratedPwd) {
+                this.notifyUserOnForcePasswordChange(user, autoGeneratedPwd);
+            }
+            return savedUser;
+        }
+        catch (err) {
+            const pgUniqueViolationErrorCode = '23505';
+            if (err.code === pgUniqueViolationErrorCode) {
+                throw new common_1.ConflictException();
+            }
+            throw err;
+        }
+    }
+    generatePassword(length = 8) {
+        const upperCase = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+        const lowerCase = "abcdefghijklmnopqrstuvwxyz";
+        const numbers = "0123456789";
+        const specialChars = "@$#";
+        const allChars = upperCase + lowerCase + numbers + specialChars;
+        let password = "";
+        for (let i = 0; i < length; i++) {
+            const randomIndex = Math.floor(Math.random() * allChars.length);
+            password += allChars[randomIndex];
+        }
+        return password;
+    }
+    notifyUserOnForcePasswordChange(user, autoGeneratedPwd) {
+        this.mailService.sendEmailUsingTemplate(user.email, 'on-force-password-change', {
+            solidAppName: process.env.SOLID_APP_NAME,
+            solidAppWebsiteUrl: process.env.SOLID_APP_WEBSITE_URL,
+            frontendLoginPageUrl: process.env.IAM_FRONTEND_APP_LOGIN_PAGE_URL,
+            fullName: user.fullName,
+            userName: user.username,
+            password: autoGeneratedPwd,
+        }, true, 'user', user.id);
+    }
+    async otpInitiateRegistration(signUpDto) {
+        try {
+            if (!this.isPasswordlessRegistrationEnabled()) {
+                throw new common_1.BadRequestException('Passwordless registration is not enabled');
+            }
+            if ((0, class_validator_1.isEmpty)(signUpDto.mobile) && (0, class_validator_1.isEmpty)(signUpDto.email)) {
+                throw new common_1.BadRequestException('Either mobile or email is required for initiating registration');
+            }
+            if (signUpDto.validationSources.includes(constants_1.TransactionalRegistrationValidationSource.EMAIL) && (0, class_validator_1.isEmpty)(signUpDto.email)) {
+                throw new common_1.BadRequestException('Email is required for email validation source');
+            }
+            if (signUpDto.validationSources.includes(constants_1.TransactionalRegistrationValidationSource.MOBILE) && (0, class_validator_1.isEmpty)(signUpDto.mobile)) {
+                throw new common_1.BadRequestException('Mobile is required for mobile validation source');
+            }
+            const existingUser = await this.userRepository.findOne({
+                where: [
+                    { email: signUpDto.email, },
+                    { mobile: signUpDto.mobile, },
+                    { username: signUpDto.username, }
+                ]
+            });
+            if ((0, class_validator_1.isNotEmpty)(existingUser) && existingUser.active) {
+                throw new common_1.ConflictException('User already exists. Please sign in');
+            }
+            const finalRegistrationVerificationSources = this.calculateVerificationSources(this.iamConfiguration.passwordlessRegistrationValidateWhat, signUpDto);
+            let user = existingUser;
+            if ((0, class_validator_1.isEmpty)(user)) {
+                user = this.createUser(signUpDto);
+                this.populateVerificationTokens(finalRegistrationVerificationSources, user);
+                await this.userRepository.save(user);
+                await this.userService.addRoleToUser(user.username, this.iamConfiguration.defaultRole);
+            }
+            else {
+                this.populateVerificationTokens(finalRegistrationVerificationSources, user);
+                await this.userRepository.save(user);
+            }
+            this.notifyUserOnOtpInitiateRegistration(user, finalRegistrationVerificationSources);
+            return { message: 'User registration initiated. OTP sent to the user.' };
+        }
+        catch (err) {
+            const pgUniqueViolationErrorCode = '23505';
+            if (err.code === pgUniqueViolationErrorCode) {
+                throw new common_1.ConflictException();
+            }
+            throw err;
+        }
+    }
+    createUser(signUpDto) {
+        const user = new user_entity_1.User();
+        user.username = signUpDto.username;
+        user.email = signUpDto.email;
+        user.mobile = signUpDto.mobile;
+        user.customPayload = signUpDto.customPayload;
+        user.lastLoginProvider = LoginProvider.OTP;
+        return user;
+    }
+    calculateVerificationSources(configuredRegistrationValidationSources, signUpDto) {
+        const finalRegistrationValidationSources = configuredRegistrationValidationSources.filter((source) => source !== constants_1.RegistrationValidationSource.TRANSACTIONAL);
+        if (configuredRegistrationValidationSources.includes(constants_1.RegistrationValidationSource.TRANSACTIONAL)) {
+            finalRegistrationValidationSources.push(...signUpDto.validationSources);
+        }
+        return finalRegistrationValidationSources;
+    }
+    populateVerificationTokens(finalRegistrationValidationSources, user) {
+        if (finalRegistrationValidationSources.length === 0) {
+            throw new common_1.BadRequestException('At least one validation source is required');
+        }
+        if (finalRegistrationValidationSources.includes(constants_1.TransactionalRegistrationValidationSource.EMAIL)) {
+            const { token, expiresAt } = this.otp();
+            user.emailVerificationTokenOnRegistration = token;
+            user.emailVerificationTokenOnRegistrationExpiresAt = expiresAt;
+            if (this.iamConfiguration.autoLoginUserOnRegistration) {
+                user.emailVerificationTokenOnLogin = token;
+                user.emailVerificationTokenOnLoginExpiresAt = expiresAt;
+            }
+        }
+        if (finalRegistrationValidationSources.includes(constants_1.TransactionalRegistrationValidationSource.MOBILE)) {
+            const { token, expiresAt } = this.otp();
+            user.mobileVerificationTokenOnRegistration = token;
+            user.mobileVerificationTokenOnRegistrationExpiresAt = expiresAt;
+            if (this.iamConfiguration.autoLoginUserOnRegistration) {
+                user.mobileVerificationTokenOnLogin = token;
+                user.mobileVerificationTokenOnLoginExpiresAt = expiresAt;
+            }
+        }
+    }
+    notifyUserOnOtpInitiateRegistration(user, registrationValidationSources) {
+        if (this.iamConfiguration.dummyOtp)
+            return;
+        if (registrationValidationSources.includes(constants_1.RegistrationValidationSource.EMAIL)) {
+            this.mailService.sendEmailUsingTemplate(user.email, 'otp-on-register', {
+                solidAppName: process.env.SOLID_APP_NAME,
+                solidAppWebsiteUrl: process.env.SOLID_APP_WEBSITE_URL,
+                firstName: user.username,
+                emailVerificationTokenOnRegistration: user.emailVerificationTokenOnRegistration,
+            }, true, 'user', user.id);
+        }
+        if (registrationValidationSources.includes(constants_1.RegistrationValidationSource.MOBILE)) {
+            this.smsService.sendSMSUsingTemplate(user.mobile, 'otp-on-register', {
+                solidAppName: process.env.SOLID_APP_NAME,
+                otp: user.mobileVerificationTokenOnRegistration,
+                mobileVerificationTokenOnRegistration: user.mobileVerificationTokenOnRegistration,
+                firstName: user.username
+            });
+        }
+    }
+    async otpConfirmRegistration(confirmSignUpDto) {
+        if (!this.isPasswordlessRegistrationEnabled()) {
+            throw new common_1.BadRequestException('Passwordless registration is not enabled');
+        }
+        if (confirmSignUpDto.type === constants_1.RegistrationValidationSource.EMAIL) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    email: confirmSignUpDto.identifier,
+                }
+            });
+            if (!user) {
+                throw new common_1.UnauthorizedException('User does not exist');
+            }
+            if (user.emailVerificationTokenOnRegistration !== confirmSignUpDto.otp) {
+                throw new common_1.UnauthorizedException('Invalid OTP');
+            }
+            if (user.emailVerificationTokenOnRegistrationExpiresAt < new Date()) {
+                throw new common_1.UnauthorizedException('OTP expired');
+            }
+            user.emailVerifiedOnRegistrationAt = new Date();
+            user.emailVerificationTokenOnRegistration = null;
+            user.emailVerificationTokenOnRegistrationExpiresAt = null;
+            user.active = this.iamConfiguration.activateUserOnRegistration && this.areRegistrationValidationSourcesVerified(user);
+            const savedUser = await this.userRepository.save(user);
+            this.triggerRegistrationEvent(savedUser);
+            return { active: savedUser.active, message: `User registration verified for ${confirmSignUpDto.type}` };
+        }
+        else if (confirmSignUpDto.type === constants_1.RegistrationValidationSource.MOBILE) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    mobile: confirmSignUpDto.identifier,
+                }
+            });
+            if (!user) {
+                throw new common_1.UnauthorizedException('User does not exist');
+            }
+            if (user.mobileVerificationTokenOnRegistration !== confirmSignUpDto.otp) {
+                throw new common_1.UnauthorizedException('Invalid OTP');
+            }
+            if (user.mobileVerificationTokenOnRegistrationExpiresAt < new Date()) {
+                throw new common_1.UnauthorizedException('Invalid OTP');
+            }
+            user.mobileVerifiedOnRegistrationAt = new Date();
+            user.mobileVerificationTokenOnRegistration = null;
+            user.mobileVerificationTokenOnRegistrationExpiresAt = null;
+            user.active = this.iamConfiguration.activateUserOnRegistration && this.areRegistrationValidationSourcesVerified(user);
+            const savedUser = await this.userRepository.save(user);
+            this.triggerRegistrationEvent(savedUser);
+            return { active: savedUser.active, message: `User registration verified for ${confirmSignUpDto.type}` };
+        }
+        throw new common_1.BadRequestException('Invalid type. Must be either email or mobile');
+    }
+    triggerRegistrationEvent(savedUser) {
+        const event = new interfaces_1.EventDetails(interfaces_1.EventType.USER_REGISTERED, savedUser);
+        this.eventEmitter.emit(interfaces_1.EventType.USER_REGISTERED, event);
+    }
+    areRegistrationValidationSourcesVerified(user) {
+        const registrationValidationSources = this.iamConfiguration.passwordlessRegistrationValidateWhat;
+        if (registrationValidationSources.includes(constants_1.RegistrationValidationSource.EMAIL)) {
+            if (!user.emailVerifiedOnRegistrationAt) {
+                return false;
+            }
+        }
+        if (registrationValidationSources.includes(constants_1.RegistrationValidationSource.MOBILE)) {
+            if (!user.mobileVerifiedOnRegistrationAt) {
+                return false;
+            }
+        }
+        return true;
+    }
+    otp() {
+        const now = new Date();
+        now.setMinutes(now.getMinutes() + this.iamConfiguration.otpExpiry);
+        return {
+            token: this.iamConfiguration.dummyOtp ? this.iamConfiguration.dummyOtp : (0, crypto_1.randomInt)(100000, 999999).toString(),
+            expiresAt: now,
+        };
+    }
+    async signIn(signInDto) {
+        const user = await this.validateUser(signInDto);
+        const tokens = await this.generateTokens(user);
+        return {
+            user: {
+                email: user.email,
+                mobile: user.mobile,
+                username: user.username,
+                forcePasswordChange: user.forcePasswordChange,
+                id: user.id,
+                roles: user.roles.map((role, idx, roles) => role.name)
+            },
+            ...tokens
+        };
+    }
+    async otpInitiateLogin(signInDto) {
+        if (!this.isPasswordlessRegistrationEnabled()) {
+            throw new common_1.BadRequestException('Passwordless registration is not enabled');
+        }
+        if (signInDto.type === constants_1.RegistrationValidationSource.EMAIL) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    email: signInDto.identifier,
+                }
+            });
+            if (!user) {
+                throw new common_1.UnauthorizedException('User does not exist');
+            }
+            if (!user.active) {
+                throw new common_1.UnauthorizedException('User is inactive');
+            }
+            const { token, expiresAt } = this.otp();
+            user.emailVerificationTokenOnLogin = token;
+            user.emailVerificationTokenOnLoginExpiresAt = expiresAt;
+            await this.userRepository.save(user);
+            this.notifyUserOnOtpInititateLogin(user, constants_1.RegistrationValidationSource.EMAIL);
+        }
+        else if (signInDto.type === constants_1.RegistrationValidationSource.MOBILE) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    mobile: signInDto.identifier,
+                }
+            });
+            if (!user) {
+                throw new common_1.UnauthorizedException('User does not exist');
+            }
+            const { token, expiresAt } = this.otp();
+            user.mobileVerificationTokenOnLogin = token;
+            user.mobileVerificationTokenOnLoginExpiresAt = expiresAt;
+            await this.userRepository.save(user);
+            this.notifyUserOnOtpInititateLogin(user, constants_1.RegistrationValidationSource.MOBILE);
+        }
+        else {
+            throw new common_1.BadRequestException('Invalid type. Must be either email or mobile');
+        }
+        return { message: 'User login initiated. OTP sent to the user.' };
+    }
+    notifyUserOnOtpInititateLogin(user, loginType) {
+        if (this.iamConfiguration.dummyOtp)
+            return;
+        if (loginType === constants_1.RegistrationValidationSource.EMAIL) {
+            this.mailService.sendEmailUsingTemplate(user.email, 'otp-on-login', {
+                solidAppName: process.env.SOLID_APP_NAME,
+                solidAppWebsiteUrl: process.env.SOLID_APP_WEBSITE_URL,
+                firstName: user.username,
+                emailVerificationTokenOnLogin: user.emailVerificationTokenOnLogin
+            }, true, 'user', user.id);
+        }
+        if (loginType === constants_1.RegistrationValidationSource.MOBILE) {
+            this.smsService.sendSMSUsingTemplate(user.mobile, 'otp-on-login', {
+                solidAppName: process.env.SOLID_APP_NAME,
+                otp: user.mobileVerificationTokenOnLogin,
+                mobileVerificationTokenOnLogin: user.mobileVerificationTokenOnLogin,
+                firstName: user.username
+            });
+        }
+    }
+    async otpConfirmLogin(confirmSignInDto) {
+        if (!this.isPasswordlessRegistrationEnabled()) {
+            throw new common_1.BadRequestException('Passwordless registration is not enabled');
+        }
+        if (confirmSignInDto.type === constants_1.RegistrationValidationSource.EMAIL) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    email: confirmSignInDto.identifier,
+                },
+                relations: ['roles']
+            });
+            if (!user) {
+                throw new common_1.UnauthorizedException('User does not exist');
+            }
+            if (!user.active) {
+                throw new common_1.UnauthorizedException('User is inactive');
+            }
+            if (user.emailVerificationTokenOnLogin !== confirmSignInDto.otp) {
+                throw new common_1.UnauthorizedException('Invalid OTP');
+            }
+            if (user.emailVerificationTokenOnLoginExpiresAt < new Date()) {
+                throw new common_1.UnauthorizedException('Invalid OTP');
+            }
+            user.emailVerifiedOnLoginAt = new Date();
+            user.emailVerificationTokenOnLogin = null;
+            user.emailVerificationTokenOnLoginExpiresAt = null;
+            await this.userRepository.save(user);
+            const { accessToken, refreshToken } = await this.generateTokens(user);
+            const { id, username, email, mobile, lastLoginProvider } = user;
+            const roles = user.roles.map((role) => role.name);
+            return { accessToken, refreshToken, user: { id, username, email, mobile, lastLoginProvider, roles } };
+        }
+        else if (confirmSignInDto.type === constants_1.RegistrationValidationSource.MOBILE) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    mobile: confirmSignInDto.identifier,
+                },
+                relations: ['roles']
+            });
+            if (!user) {
+                throw new common_1.UnauthorizedException('User does not exist');
+            }
+            if (!user.active) {
+                throw new common_1.UnauthorizedException('User is inactive');
+            }
+            if (user.mobileVerificationTokenOnLogin !== confirmSignInDto.otp) {
+                throw new common_1.UnauthorizedException('Invalid OTP');
+            }
+            if (user.mobileVerificationTokenOnLoginExpiresAt < new Date()) {
+                throw new common_1.UnauthorizedException('Invalid OTP');
+            }
+            user.mobileVerifiedOnLoginAt = new Date();
+            user.mobileVerificationTokenOnLogin = null;
+            user.mobileVerificationTokenOnLoginExpiresAt = null;
+            await this.userRepository.save(user);
+            const { accessToken, refreshToken } = await this.generateTokens(user);
+            const { id, username, email, mobile, lastLoginProvider } = user;
+            const roles = user.roles.map((role) => role.name);
+            return { accessToken, refreshToken, user: { id, username, email, mobile, lastLoginProvider, roles } };
+        }
+        throw new common_1.BadRequestException('Invalid type. Must be either email or mobile');
+    }
+    async changePassword(changePasswordDto, activeUser) {
+        const user = await this.userRepository.findOne({
+            where: { id: changePasswordDto.id }
+        });
+        if (!user) {
+            throw new common_1.NotFoundException('User does not exists');
+        }
+        if (!user.active) {
+            throw new common_1.UnauthorizedException('User is inactive');
+        }
+        if (user.lastLoginProvider !== 'local') {
+            throw new common_1.BadRequestException('User seems to have used a passwordless mode to authenticate.');
+        }
+        if (!(user.id === activeUser.sub)) {
+            throw new common_1.BadRequestException("User ID's do not match ");
+        }
+        if (!(user.username === activeUser.username)) {
+            throw new common_1.BadRequestException("User username's do not match");
+        }
+        const isEqual = await this.hashingService.compare(changePasswordDto.currentPassword, user.password);
+        if (!isEqual) {
+            throw new common_1.UnauthorizedException('Incorrect current password specified...');
+        }
+        const newPwd = await this.hashingService.hash(changePasswordDto.newPassword);
+        user.password = changePasswordDto.newPassword;
+        user.forcePasswordChange = false;
+        if (await this.isPasswordDuplicate(user)) {
+            throw new common_1.BadRequestException('Previously used passwords cannot be used again.');
+        }
+        await this.deleteOldPasswords(user);
+        user.password = newPwd;
+        const userPasswordHistory = new user_password_history_entity_1.UserPasswordHistory();
+        userPasswordHistory.passwordHash = newPwd;
+        userPasswordHistory.user = user;
+        await this.userRepository.save(user);
+        await this.userPasswordHistoryRepository.save(userPasswordHistory);
+        return true;
+    }
+    async initiateForgotPassword(initiateForgotPasswordDto) {
+        const user = await this.resolveUser(initiateForgotPasswordDto.username, initiateForgotPasswordDto.email);
+        if (!user) {
+            throw new common_1.NotFoundException('User does not exists');
+        }
+        if (!user.active) {
+            throw new common_1.UnauthorizedException('User is inactive');
+        }
+        if (user.lastLoginProvider !== 'local') {
+            throw new common_1.BadRequestException('User seems to have used a passwordless mode to authenticate.');
+        }
+        const { token, expiresAt } = this.otp();
+        user.verificationTokenOnForgotPassword = token;
+        user.verificationTokenOnForgotPasswordExpiresAt = expiresAt;
+        await this.userRepository.save(user);
+        this.notifyUserOnForgotPassword(user);
+        return {
+            status: 'success',
+            message: 'Forgot password - token generated and sent',
+            error: '',
+            errorCode: '',
+            data: {
+                user: {
+                    email: user.email,
+                    mobile: user.mobile,
+                    username: user.username,
+                },
+            }
+        };
+    }
+    notifyUserOnForgotPassword(user) {
+        const forgotPasswordSendVerificationTokenOn = this.iamConfiguration.forgotPasswordSendVerificationTokenOn;
+        if (forgotPasswordSendVerificationTokenOn == constants_1.ForgotPasswordSendVerificationTokenOn.EMAIL) {
+            this.mailService.sendEmailUsingTemplate(user.email, 'forgot-password', {
+                solidAppName: process.env.SOLID_APP_NAME,
+                solidAppWebsiteUrl: process.env.SOLID_APP_WEBSITE_URL,
+                firstName: user.username,
+                passwordResetLink: `${process.env.IAM_FRONTEND_APP_FORGOT_PASSWORD_PAGE_URL}?token=${user.verificationTokenOnForgotPassword}&username=${user.username}`
+            }, true, 'user', user.id);
+        }
+        if (forgotPasswordSendVerificationTokenOn == constants_1.ForgotPasswordSendVerificationTokenOn.MOBILE && user.mobile) {
+            this.smsService.sendSMSUsingTemplate(user.mobile, 'forgot-password', {
+                solidAppName: process.env.SOLID_APP_NAME,
+                otp: user.verificationTokenOnForgotPassword,
+                verificationTokenOnForgotPassword: user.verificationTokenOnForgotPassword,
+                firstName: user.username
+            });
+        }
+    }
+    async confirmForgotPassword(confirmForgotPasswordDto) {
+        const user = await this.resolveUser(confirmForgotPasswordDto.username, confirmForgotPasswordDto.email);
+        if (!user) {
+            throw new common_1.NotFoundException('User does not exists');
+        }
+        if (user.lastLoginProvider !== 'local') {
+            throw new common_1.BadRequestException('User seems to have used a passwordless mode to authenticate.');
+        }
+        if (!user.active) {
+            throw new common_1.UnauthorizedException('User is inactive');
+        }
+        if (user.verificationTokenOnForgotPassword !== confirmForgotPasswordDto.verificationToken) {
+            throw new common_1.UnauthorizedException('Invalid verification token');
+        }
+        if (user.verificationTokenOnForgotPasswordExpiresAt < new Date()) {
+            throw new common_1.UnauthorizedException('Invalid verification token');
+        }
+        user.forgotPasswordConfirmedAt = new Date();
+        user.verificationTokenOnForgotPassword = null;
+        user.verificationTokenOnForgotPasswordExpiresAt = null;
+        const pwd = await this.hashingService.hash(confirmForgotPasswordDto.password);
+        user.password = confirmForgotPasswordDto.password;
+        if (await this.isPasswordDuplicate(user)) {
+            throw new common_1.BadRequestException('Previously used passwords cannot be used again.');
+        }
+        await this.deleteOldPasswords(user);
+        user.password = pwd;
+        const userPasswordHistory = new user_password_history_entity_1.UserPasswordHistory();
+        userPasswordHistory.passwordHash = pwd;
+        userPasswordHistory.user = user;
+        await this.userRepository.save(user);
+        await this.userPasswordHistoryRepository.save(userPasswordHistory);
+        return {
+            status: 'success',
+            message: 'Forgot password confirmed',
+            error: '',
+            errorCode: '',
+            data: {}
+        };
+    }
+    async isPasswordDuplicate(user) {
+        const userPwdHistoryEntityArray = await this.userPasswordHistoryRepository.findBy({ user: { id: user.id } });
+        let userPwdHistoryArray = [];
+        for (const entity of userPwdHistoryEntityArray) {
+            userPwdHistoryArray.push(entity.passwordHash);
+        }
+        for (const pwdHash of userPwdHistoryArray) {
+            const isEqual = await this.hashingService.compare(user.password, pwdHash);
+            if (isEqual) {
+                return true;
+            }
+        }
+        return false;
+    }
+    async deleteOldPasswords(user) {
+        const userPwdHistoryArray = await this.userPasswordHistoryRepository.findBy({ user: { id: user.id } });
+        const pwdLimit = 2;
+        if (userPwdHistoryArray.length >= pwdLimit) {
+            const numToDelete = pwdLimit + 1 - userPwdHistoryArray.length;
+            for (let i = 0; i < numToDelete; i++) {
+                await this.userPasswordHistoryRepository.remove(userPwdHistoryArray[i]);
+            }
+        }
+    }
+    async generateTokens(user) {
+        const refreshTokenId = (0, crypto_1.randomUUID)();
+        const userRoleNames = user.roles.map((role) => role.name);
+        const [accessToken, refreshToken] = await Promise.all([
+            this.signToken(user.id, this.jwtConfiguration.accessTokenTtl, { username: user.username, email: user.email, roles: userRoleNames }),
+            this.signToken(user.id, this.jwtConfiguration.refreshTokenTtl, {
+                refreshTokenId,
+            }),
+        ]);
+        await this.refreshTokenIdsStorage.insert(user.id, refreshTokenId);
+        return {
+            accessToken,
+            refreshToken,
+        };
+    }
+    async refreshTokens(refreshTokenDto) {
+        try {
+            const { sub, refreshTokenId } = await this.jwtService.verifyAsync(refreshTokenDto.refreshToken, {
+                secret: this.jwtConfiguration.secret,
+                audience: this.jwtConfiguration.audience,
+                issuer: this.jwtConfiguration.issuer,
+            });
+            const user = await this.userRepository.findOne({
+                where: {
+                    id: sub,
+                },
+                relations: {
+                    roles: true
+                }
+            });
+            if (!user) {
+                throw new common_1.UnauthorizedException();
+            }
+            const isValid = await this.refreshTokenIdsStorage.validate(user.id, refreshTokenId);
+            if (isValid) {
+                await this.refreshTokenIdsStorage.invalidate(user.id);
+            }
+            else {
+                throw new Error('Refresh token is invalid');
+            }
+            return this.generateTokens(user);
+        }
+        catch (err) {
+            if (err instanceof refresh_token_ids_storage_service_1.InvalidatedRefreshTokenError) {
+                throw new common_1.UnauthorizedException('Access denied');
+            }
+            throw new common_1.UnauthorizedException();
+        }
+    }
+    async signToken(userId, expiresIn, payload) {
+        return await this.jwtService.signAsync({
+            sub: userId,
+            ...payload,
+        }, {
+            audience: this.jwtConfiguration.audience,
+            issuer: this.jwtConfiguration.issuer,
+            secret: this.jwtConfiguration.secret,
+            expiresIn,
+        });
+    }
+    async validateUserUsingGoogle(user) {
+        try {
+            const response = await this.httpService.axiosRef.get(`https://www.googleapis.com/oauth2/v1/userinfo?alt=json&access_token=${user.googleAccessToken}`);
+            const userProfile = response.data;
+            if (userProfile.email === user.email && userProfile.id === user.googleId) {
+                return userProfile;
+            }
+            else {
+                throw new common_1.UnauthorizedException('Invalid user profile');
+            }
+        }
+        catch (error) {
+            throw new common_1.UnauthorizedException('Failed to fetch user profile from Google OAuth service');
+        }
+    }
+    async signInUsingGoogle(accessCode) {
+        const user = await this.userRepository.findOne({
+            where: {
+                accessCode: accessCode
+            },
+            relations: {
+                roles: true
+            }
+        });
+        await this.validateUserUsingGoogle(user);
+        return await this.generateTokens(user);
+    }
+    isPasswordlessRegistrationEnabled() {
+        return this.iamConfiguration.passwordlessRegistration;
+    }
+    async logout() {
+    }
+    async activateUser(userId) {
+        const user = await this.userService.findOne(userId, {});
+        if (!user) {
+            throw new common_1.NotFoundException('User not found');
+        }
+        user.active = true;
+        await this.userRepository.save(user);
+    }
+    async me(activeUser) {
+        const user = await this.userRepository.findOne({
+            where: {
+                id: activeUser.sub,
+            },
+            relations: {
+                roles: true
+            }
+        });
+        const tokens = await this.generateTokens(user);
+        const response = {
+            ...user,
+            ...tokens
+        };
+        return response;
+    }
+};
+exports.AuthenticationService = AuthenticationService;
+exports.AuthenticationService = AuthenticationService = AuthenticationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, typeorm_1.InjectRepository)(user_entity_1.User)),
+    __param(2, (0, typeorm_1.InjectRepository)(user_password_history_entity_1.UserPasswordHistory)),
+    __param(5, (0, common_1.Inject)(iam_config_1.jwtConfig.KEY)),
+    __param(6, (0, common_1.Inject)(iam_config_1.iamConfig.KEY)),
+    __metadata("design:paramtypes", [user_service_1.UserService,
+        typeorm_2.Repository,
+        typeorm_2.Repository,
+        hashing_service_1.HashingService,
+        jwt_1.JwtService, void 0, void 0, refresh_token_ids_storage_service_1.RefreshTokenIdsStorageService,
+        axios_1.HttpService,
+        SMTPEmailService_1.SMTPEMailService,
+        Msg91OTPService_1.Msg91OTPService,
+        event_emitter_1.EventEmitter2])
+], AuthenticationService);
+//# sourceMappingURL=authentication.service.js.map