@solidstarters/solid-core 1.2.0

package/src/services/authentication.service.ts

@@ -0,0 +1,970 @@
+import { HttpService } from '@nestjs/axios';
+import {
+    BadRequestException,
+    ConflictException,
+    Inject,
+    Injectable,
+    Logger,
+    NotFoundException,
+    UnauthorizedException,
+} from '@nestjs/common';
+import { ConfigType } from '@nestjs/config';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { JwtService } from '@nestjs/jwt';
+import { InjectRepository } from '@nestjs/typeorm';
+import { isEmpty, isNotEmpty } from 'class-validator';
+import { randomInt, randomUUID } from 'crypto';
+import { SMTPEMailService } from 'src/services/mail/SMTPEmailService';
+import { Msg91OTPService } from 'src/services/sms/Msg91OTPService';
+import { Repository } from 'typeorm';
+import { iamConfig, jwtConfig } from '../config/iam.config';
+import { ChangePasswordDto } from "../dtos/change-password.dto";
+import { ConfirmForgotPasswordDto } from '../dtos/confirm-forgot-password.dto';
+import { InitiateForgotPasswordDto } from '../dtos/initiate-forgot-password.dto';
+import { OTPConfirmOTPDto } from '../dtos/otp-confirm-otp.dto';
+import { OTPSignInDto } from '../dtos/otp-sign-in.dto';
+import { OTPSignUpDto } from '../dtos/otp-sign-up.dto';
+import { RefreshTokenDto } from '../dtos/refresh-token.dto';
+import { SignInDto } from '../dtos/sign-in.dto';
+import { SignUpDto } from '../dtos/sign-up.dto';
+import { UserPasswordHistory } from '../entities/user-password-history.entity';
+import { User } from '../entities/user.entity';
+import { ActiveUserData } from '../interfaces/active-user-data.interface';
+import { HashingService } from './hashing.service';
+import { InvalidatedRefreshTokenError, RefreshTokenIdsStorageService } from './refresh-token-ids-storage.service';
+import { UserService } from './user.service';
+import { EventDetails, EventType } from "../interfaces";
+import {
+    ForgotPasswordSendVerificationTokenOn,
+    RegistrationValidationSource,
+    TransactionalRegistrationValidationSource
+} from "../constants";
+
+enum LoginProvider {
+    LOCAL = 'local',
+    GOOGLE = 'google',
+    OTP = 'otp',
+}
+
+interface otp {
+    token: string;
+    expiresAt: Date;
+}
+
+@Injectable()
+export class AuthenticationService {
+    private readonly logger = new Logger(AuthenticationService.name);
+
+    constructor(
+        private readonly userService: UserService,
+        @InjectRepository(User) private readonly userRepository: Repository<User>,
+        @InjectRepository(UserPasswordHistory) private readonly userPasswordHistoryRepository: Repository<UserPasswordHistory>,
+        private readonly hashingService: HashingService,
+        private readonly jwtService: JwtService,
+        @Inject(jwtConfig.KEY)
+        private readonly jwtConfiguration: ConfigType<typeof jwtConfig>,
+        @Inject(iamConfig.KEY)
+        private readonly iamConfiguration: ConfigType<typeof iamConfig>,
+        private readonly refreshTokenIdsStorage: RefreshTokenIdsStorageService,
+        private readonly httpService: HttpService,
+        private readonly mailService: SMTPEMailService,
+        private readonly smsService: Msg91OTPService,
+        private readonly eventEmitter: EventEmitter2,
+    ) { }
+
+    async resolveUser(username: string, email: string) {
+        return await this.userRepository.findOne({
+            where: [
+                { username: username },
+                { email: email },
+            ],
+            relations: {
+                roles: true
+            }
+        });
+    }
+
+    async validateUser(signInDto: SignInDto) {
+
+        const user = await this.resolveUser(signInDto.username, signInDto.email);
+
+        if (!user) {
+            throw new UnauthorizedException('User does not exists');
+        }
+        if (!user.active) {
+            throw new UnauthorizedException('User profile not activated');
+        }
+        const isEqual = await this.hashingService.compare(
+            signInDto.password,
+            user.password,
+        );
+        if (!isEqual) {
+            throw new UnauthorizedException('Password does not match');
+        }
+
+        return user;
+    }
+
+    async signUp(signUpDto: SignUpDto, activeUser: ActiveUserData = null): Promise<User> {
+        // If public registrations are disabled and no activeUser is present when invoking signUp then we throw an exception.
+        if (!this.iamConfiguration.allowPublicRegistration && !activeUser) {
+            throw new BadRequestException('Public registrations are disabled.');
+        }
+
+        try {
+            const user = new User();
+            user.username = signUpDto.username;
+            user.email = signUpDto.email;
+            user.fullName = signUpDto.fullName;
+            if (signUpDto.mobile) {
+                user.mobile = signUpDto.mobile;
+            }
+            // If password has been specified by the user, then we simply create & activate the user based on the configuration parameter "activateUserOnRegistration".
+            let pwd = '';
+            let autoGeneratedPwd = '';
+            if (signUpDto.password) {
+                pwd = await this.hashingService.hash(signUpDto.password);
+            }
+            else {
+                // TODO: If password is not specified then auto-generate a random password, trigger this password over an email to the user.
+                // TODO: Also track if the user has to force reset / change their password, and then activate the user. 
+                autoGeneratedPwd = this.generatePassword();
+                pwd = await this.hashingService.hash(autoGeneratedPwd);
+                user.forcePasswordChange = true;
+            }
+            user.password = pwd;
+            user.active = this.iamConfiguration.activateUserOnRegistration;
+            const savedUser = await this.userRepository.save(user);
+
+            // Also assign a default role to the newly created user. 
+            let roles = [];
+            if (this.iamConfiguration.defaultRole) {
+                roles.push(this.iamConfiguration.defaultRole);
+            }
+            if (signUpDto.roles) {
+                roles = [...roles, ...signUpDto.roles];
+            }
+            roles = Array.from(new Set([...roles]));
+            if (roles.length > 0) {
+                this.userService.addRolesToUser(user.username, roles);
+            }
+            // Tanay: Adding user password to history table
+            const userPasswordHistory = new UserPasswordHistory();
+            userPasswordHistory.passwordHash = pwd;
+            userPasswordHistory.user = savedUser;
+            await this.userPasswordHistoryRepository.save(userPasswordHistory);
+
+            // if forcePasswordChange is true, then we trigger an email to the user to change the password, this needs to be done using a queue. 
+            // Create a new method like notifyUserOnForcePasswordChange, create a new email template we can call it on-force-password-change this template to include the random password
+            if (user.forcePasswordChange && autoGeneratedPwd) {
+                this.notifyUserOnForcePasswordChange(user, autoGeneratedPwd);
+            }
+
+            // TODO: make provision to trigger a welcome email also.
+
+            return savedUser;
+        } catch (err) {
+            const pgUniqueViolationErrorCode = '23505';
+            if (err.code === pgUniqueViolationErrorCode) {
+                throw new ConflictException();
+            }
+            throw err;
+        }
+    }
+
+    generatePassword(length: number = 8): string {
+        const upperCase = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+        const lowerCase = "abcdefghijklmnopqrstuvwxyz";
+        const numbers = "0123456789";
+        const specialChars = "@$#";
+        const allChars = upperCase + lowerCase + numbers + specialChars;
+
+        let password = "";
+
+        for (let i = 0; i < length; i++) {
+            const randomIndex = Math.floor(Math.random() * allChars.length);
+            password += allChars[randomIndex];
+        }
+
+        return password;
+    }
+
+    private notifyUserOnForcePasswordChange(user: User, autoGeneratedPwd: string) {
+
+        this.mailService.sendEmailUsingTemplate(
+            user.email,
+            'on-force-password-change',
+            {
+                solidAppName: process.env.SOLID_APP_NAME,
+                solidAppWebsiteUrl: process.env.SOLID_APP_WEBSITE_URL,
+                frontendLoginPageUrl: process.env.IAM_FRONTEND_APP_LOGIN_PAGE_URL,
+                fullName: user.fullName,
+                userName: user.username,
+                password: autoGeneratedPwd,
+            },
+            true,
+            'user',
+            user.id
+        );
+
+    }
+
+    async otpInitiateRegistration(signUpDto: OTPSignUpDto) {
+        try {
+            if (!this.isPasswordlessRegistrationEnabled()) {
+                throw new BadRequestException('Passwordless registration is not enabled');
+            }
+            // Validate if either mobile or email is present.
+            if (isEmpty(signUpDto.mobile) && isEmpty(signUpDto.email)) {
+                throw new BadRequestException('Either mobile or email is required for initiating registration');
+            }
+            if (signUpDto.validationSources.includes(TransactionalRegistrationValidationSource.EMAIL) && isEmpty(signUpDto.email)) {
+                throw new BadRequestException('Email is required for email validation source');
+            }
+            if (signUpDto.validationSources.includes(TransactionalRegistrationValidationSource.MOBILE) && isEmpty(signUpDto.mobile)) {
+                throw new BadRequestException('Mobile is required for mobile validation source');
+            }
+
+            // Validate if user already exists.
+            const existingUser = await this.userRepository.findOne({ //TODO Perhaps we should use the user service instead of the repository directly.
+                where: [
+                    { email: signUpDto.email, },
+                    { mobile: signUpDto.mobile, },
+                    { username: signUpDto.username, }
+                ]
+            });
+            if (isNotEmpty(existingUser) && existingUser.active) {
+                throw new ConflictException('User already exists. Please sign in');
+            }
+            const finalRegistrationVerificationSources = this.calculateVerificationSources(this.iamConfiguration.passwordlessRegistrationValidateWhat, signUpDto);
+            let user = existingUser
+            if (isEmpty(user)) {
+                user = this.createUser(signUpDto);
+                this.populateVerificationTokens(finalRegistrationVerificationSources, user);
+                await this.userRepository.save(user);
+                await this.userService.addRoleToUser(user.username, this.iamConfiguration.defaultRole);
+            }
+            else {
+                this.populateVerificationTokens(finalRegistrationVerificationSources, user);
+                await this.userRepository.save(user);
+            }
+
+            // Send OTP to the user through email or SMS, depending on the configuration.
+            this.notifyUserOnOtpInitiateRegistration(user, finalRegistrationVerificationSources);
+            return { message: 'User registration initiated. OTP sent to the user.' }
+        } catch (err) {
+            const pgUniqueViolationErrorCode = '23505';
+            if (err.code === pgUniqueViolationErrorCode) {
+                throw new ConflictException();
+            }
+            throw err;
+        }
+    }
+
+    // Create a new user entity.
+    private createUser(signUpDto: OTPSignUpDto) {
+        const user = new User();
+        user.username = signUpDto.username;
+        user.email = signUpDto.email;
+        user.mobile = signUpDto.mobile;
+        user.customPayload = signUpDto.customPayload;
+        user.lastLoginProvider = LoginProvider.OTP;
+        return user;
+    }
+
+    private calculateVerificationSources(configuredRegistrationValidationSources: string[], signUpDto: OTPSignUpDto): string[] {
+        const finalRegistrationValidationSources = configuredRegistrationValidationSources.filter((source) => source !== RegistrationValidationSource.TRANSACTIONAL);
+        if (configuredRegistrationValidationSources.includes(RegistrationValidationSource.TRANSACTIONAL)) {
+            finalRegistrationValidationSources.push(...signUpDto.validationSources); // Add the validation sources provided by the user.
+        }
+        return finalRegistrationValidationSources;
+    }
+
+    // Generate the validation tokens for the user i.e (system configured + user provided)
+    private populateVerificationTokens(finalRegistrationValidationSources: string[], user: User) {
+        if (finalRegistrationValidationSources.length === 0) {
+            throw new BadRequestException('At least one validation source is required');
+        }
+        if (finalRegistrationValidationSources.includes(TransactionalRegistrationValidationSource.EMAIL)) {
+            const { token, expiresAt } = this.otp();
+            user.emailVerificationTokenOnRegistration = token;
+            user.emailVerificationTokenOnRegistrationExpiresAt = expiresAt;
+            if (this.iamConfiguration.autoLoginUserOnRegistration) {
+                user.emailVerificationTokenOnLogin = token;
+                user.emailVerificationTokenOnLoginExpiresAt = expiresAt;
+            }
+        }
+        if (finalRegistrationValidationSources.includes(TransactionalRegistrationValidationSource.MOBILE)) {
+            const { token, expiresAt } = this.otp();
+            user.mobileVerificationTokenOnRegistration = token;
+            user.mobileVerificationTokenOnRegistrationExpiresAt = expiresAt;
+            if (this.iamConfiguration.autoLoginUserOnRegistration) {
+                user.mobileVerificationTokenOnLogin = token;
+                user.mobileVerificationTokenOnLoginExpiresAt = expiresAt;
+            }
+        }
+    }
+
+    private notifyUserOnOtpInitiateRegistration(user: User, registrationValidationSources: string[]) {
+        if (this.iamConfiguration.dummyOtp)
+            return; // Do nothing if dummy otp is configured.
+        if (registrationValidationSources.includes(RegistrationValidationSource.EMAIL)) {
+            this.mailService.sendEmailUsingTemplate(
+                user.email,
+                'otp-on-register',
+                {
+                    solidAppName: process.env.SOLID_APP_NAME,
+                    solidAppWebsiteUrl: process.env.SOLID_APP_WEBSITE_URL,
+                    firstName: user.username,
+                    emailVerificationTokenOnRegistration: user.emailVerificationTokenOnRegistration,
+                },
+                true,
+                'user',
+                user.id
+            );
+        }
+        if (registrationValidationSources.includes(RegistrationValidationSource.MOBILE)) {
+            this.smsService.sendSMSUsingTemplate(
+                user.mobile,
+                'otp-on-register',
+                {
+                    solidAppName: process.env.SOLID_APP_NAME,
+                    otp: user.mobileVerificationTokenOnRegistration,
+                    mobileVerificationTokenOnRegistration: user.mobileVerificationTokenOnRegistration,
+                    firstName: user.username
+                }
+            );
+        }
+    }
+
+    async otpConfirmRegistration(confirmSignUpDto: OTPConfirmOTPDto) {
+        if (!this.isPasswordlessRegistrationEnabled()) {
+            throw new BadRequestException('Passwordless registration is not enabled');
+        }
+
+        // Based on the identifier, validate by query the user table.
+        if (confirmSignUpDto.type === RegistrationValidationSource.EMAIL) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    email: confirmSignUpDto.identifier,
+                }
+            });
+            if (!user) {
+                throw new UnauthorizedException('User does not exist');
+            }
+            if (user.emailVerificationTokenOnRegistration !== confirmSignUpDto.otp) {
+                throw new UnauthorizedException('Invalid OTP');
+            }
+            if (user.emailVerificationTokenOnRegistrationExpiresAt < new Date()) {
+                throw new UnauthorizedException('OTP expired');
+            }
+            user.emailVerifiedOnRegistrationAt = new Date();
+            user.emailVerificationTokenOnRegistration = null;
+            user.emailVerificationTokenOnRegistrationExpiresAt = null;
+            user.active = this.iamConfiguration.activateUserOnRegistration && this.areRegistrationValidationSourcesVerified(user);
+            const savedUser: User = await this.userRepository.save(user);
+            this.triggerRegistrationEvent(savedUser);
+            return { active: savedUser.active, message: `User registration verified for ${confirmSignUpDto.type}` }
+        } else if (confirmSignUpDto.type === RegistrationValidationSource.MOBILE) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    mobile: confirmSignUpDto.identifier,
+                }
+            });
+            if (!user) {
+                throw new UnauthorizedException('User does not exist');
+            }
+            if (user.mobileVerificationTokenOnRegistration !== confirmSignUpDto.otp) {
+                throw new UnauthorizedException('Invalid OTP');
+            }
+            if (user.mobileVerificationTokenOnRegistrationExpiresAt < new Date()) {
+                throw new UnauthorizedException('Invalid OTP');
+            }
+            user.mobileVerifiedOnRegistrationAt = new Date();
+            user.mobileVerificationTokenOnRegistration = null;
+            user.mobileVerificationTokenOnRegistrationExpiresAt = null;
+            user.active = this.iamConfiguration.activateUserOnRegistration && this.areRegistrationValidationSourcesVerified(user);
+            const savedUser: User = await this.userRepository.save(user);
+            this.triggerRegistrationEvent(savedUser);
+            return { active: savedUser.active, message: `User registration verified for ${confirmSignUpDto.type}` }
+        }
+        throw new BadRequestException('Invalid type. Must be either email or mobile');
+    }
+
+    private triggerRegistrationEvent(savedUser: User) {
+        // Trigger events for user registration.
+        const event = new EventDetails<User>(EventType.USER_REGISTERED, savedUser);
+        this.eventEmitter.emit(EventType.USER_REGISTERED, event);
+    }
+
+    areRegistrationValidationSourcesVerified(user: User): boolean {
+        const registrationValidationSources = this.iamConfiguration.passwordlessRegistrationValidateWhat;
+        if (registrationValidationSources.includes(RegistrationValidationSource.EMAIL)) {
+            if (!user.emailVerifiedOnRegistrationAt) {
+                return false;
+            }
+        }
+        if (registrationValidationSources.includes(RegistrationValidationSource.MOBILE)) {
+            if (!user.mobileVerifiedOnRegistrationAt) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    private otp(): otp {
+        const now = new Date();
+        now.setMinutes(now.getMinutes() + this.iamConfiguration.otpExpiry);
+        return {
+            token: this.iamConfiguration.dummyOtp ? this.iamConfiguration.dummyOtp : randomInt(100000, 999999).toString(),
+            expiresAt: now,
+        };
+    }
+
+    async signIn(signInDto: SignInDto) {
+        const user = await this.validateUser(signInDto);
+
+        // TODO: Unset the password etc...
+        const tokens = await this.generateTokens(user);
+        return {
+            user: {
+                email: user.email,
+                mobile: user.mobile,
+                username: user.username,
+                forcePasswordChange: user.forcePasswordChange,
+                id: user.id,
+                roles: user.roles.map((role, idx, roles) => role.name)
+            },
+            ...tokens
+        }
+    }
+
+    async otpInitiateLogin(signInDto: OTPSignInDto) {
+        if (!this.isPasswordlessRegistrationEnabled()) {
+            throw new BadRequestException('Passwordless registration is not enabled');
+        }
+
+        // Validate & generate otp token for the user based on the identifier type.
+        if (signInDto.type === RegistrationValidationSource.EMAIL) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    email: signInDto.identifier,
+                }
+            });
+            if (!user) {
+                throw new UnauthorizedException('User does not exist');
+            }
+            if (!user.active) {
+                throw new UnauthorizedException('User is inactive');
+            }
+            const { token, expiresAt } = this.otp();
+            user.emailVerificationTokenOnLogin = token;
+            user.emailVerificationTokenOnLoginExpiresAt = expiresAt;
+            await this.userRepository.save(user);
+            this.notifyUserOnOtpInititateLogin(user, RegistrationValidationSource.EMAIL);
+        } else if (signInDto.type === RegistrationValidationSource.MOBILE) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    mobile: signInDto.identifier,
+                }
+            });
+            if (!user) {
+                throw new UnauthorizedException('User does not exist');
+            }
+
+            const { token, expiresAt } = this.otp();
+            user.mobileVerificationTokenOnLogin = token;
+            user.mobileVerificationTokenOnLoginExpiresAt = expiresAt;
+            await this.userRepository.save(user);
+            this.notifyUserOnOtpInititateLogin(user, RegistrationValidationSource.MOBILE);
+        }
+        else {
+            throw new BadRequestException('Invalid type. Must be either email or mobile');
+        }
+        return { message: 'User login initiated. OTP sent to the user.' };
+    }
+
+    private notifyUserOnOtpInititateLogin(user: User, loginType: RegistrationValidationSource) {
+        if (this.iamConfiguration.dummyOtp)
+            return; // Do nothing if dummy otp is configured.
+        if (loginType === RegistrationValidationSource.EMAIL) {
+            this.mailService.sendEmailUsingTemplate(
+                user.email,
+                'otp-on-login',
+                {
+                    solidAppName: process.env.SOLID_APP_NAME,
+                    solidAppWebsiteUrl: process.env.SOLID_APP_WEBSITE_URL,
+                    firstName: user.username,
+                    emailVerificationTokenOnLogin: user.emailVerificationTokenOnLogin
+                },
+                true,
+                'user',
+                user.id
+            );
+        }
+        if (loginType === RegistrationValidationSource.MOBILE) {
+            this.smsService.sendSMSUsingTemplate(
+                user.mobile,
+                'otp-on-login',
+                {
+                    solidAppName: process.env.SOLID_APP_NAME,
+                    otp: user.mobileVerificationTokenOnLogin,
+                    mobileVerificationTokenOnLogin: user.mobileVerificationTokenOnLogin,
+                    firstName: user.username
+                }
+            );
+        }
+    }
+
+    async otpConfirmLogin(confirmSignInDto: OTPConfirmOTPDto) {
+        if (!this.isPasswordlessRegistrationEnabled()) {
+            throw new BadRequestException('Passwordless registration is not enabled');
+        }
+        if (confirmSignInDto.type === RegistrationValidationSource.EMAIL) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    email: confirmSignInDto.identifier,
+                },
+                relations: ['roles']
+            });
+            if (!user) {
+                throw new UnauthorizedException('User does not exist');
+            }
+            if (!user.active) {
+                throw new UnauthorizedException('User is inactive');
+            }
+            if (user.emailVerificationTokenOnLogin !== confirmSignInDto.otp) {
+                throw new UnauthorizedException('Invalid OTP');
+            }
+            if (user.emailVerificationTokenOnLoginExpiresAt < new Date()) {
+                throw new UnauthorizedException('Invalid OTP');
+            }
+            user.emailVerifiedOnLoginAt = new Date();
+            user.emailVerificationTokenOnLogin = null;
+            user.emailVerificationTokenOnLoginExpiresAt = null;
+            await this.userRepository.save(user);
+            const { accessToken, refreshToken } = await this.generateTokens(user);
+            const { id, username, email, mobile, lastLoginProvider } = user;
+            const roles = user.roles.map((role) => role.name);
+            return { accessToken, refreshToken, user: { id, username, email, mobile, lastLoginProvider, roles } };
+        } else if (confirmSignInDto.type === RegistrationValidationSource.MOBILE) {
+            const user = await this.userRepository.findOne({
+                where: {
+                    mobile: confirmSignInDto.identifier,
+                },
+                relations: ['roles']
+            });
+            if (!user) {
+                throw new UnauthorizedException('User does not exist');
+            }
+            if (!user.active) {
+                throw new UnauthorizedException('User is inactive');
+            }
+            if (user.mobileVerificationTokenOnLogin !== confirmSignInDto.otp) {
+                throw new UnauthorizedException('Invalid OTP');
+            }
+            if (user.mobileVerificationTokenOnLoginExpiresAt < new Date()) {
+                throw new UnauthorizedException('Invalid OTP');
+            }
+            user.mobileVerifiedOnLoginAt = new Date();
+            user.mobileVerificationTokenOnLogin = null;
+            user.mobileVerificationTokenOnLoginExpiresAt = null;
+            await this.userRepository.save(user);
+            const { accessToken, refreshToken } = await this.generateTokens(user);
+            const { id, username, email, mobile, lastLoginProvider } = user;
+            const roles = user.roles.map((role) => role.name);
+            return { accessToken, refreshToken, user: { id, username, email, mobile, lastLoginProvider, roles } };
+
+        }
+        throw new BadRequestException('Invalid type. Must be either email or mobile');
+    }
+
+    async changePassword(changePasswordDto: ChangePasswordDto, activeUser: ActiveUserData) {
+        const user = await this.userRepository.findOne({
+            where: { id: changePasswordDto.id }
+        });
+        if (!user) {
+            throw new NotFoundException('User does not exists');
+        }
+
+        if (!user.active) {
+            throw new UnauthorizedException('User is inactive');
+        }
+
+        // 2. Validate if user has used a provider which is "local", only then it makes sense for us to initiate the forgot password routine.
+        if (user.lastLoginProvider !== 'local') {
+            throw new BadRequestException('User seems to have used a passwordless mode to authenticate.');
+        }
+
+        // Check if ID's match
+        if (!(user.id === activeUser.sub)) {
+            throw new BadRequestException("User ID's do not match ");
+        }
+
+        // Check if username's match
+        if (!(user.username === activeUser.username)) {
+            throw new BadRequestException("User username's do not match");
+        }
+
+        // Check if old password is matching.
+        const isEqual = await this.hashingService.compare(
+            changePasswordDto.currentPassword,
+            user.password,
+        );
+        if (!isEqual) {
+            throw new UnauthorizedException('Incorrect current password specified...');
+        }
+
+        // Update Password
+        const newPwd = await this.hashingService.hash(changePasswordDto.newPassword);
+        user.password = changePasswordDto.newPassword;
+
+        // Everytime the user changes the password we reset the forcePasswordChange flag back to false. 
+        user.forcePasswordChange = false;
+
+        if (await this.isPasswordDuplicate(user)) {
+            throw new BadRequestException('Previously used passwords cannot be used again.');
+        }
+        await this.deleteOldPasswords(user);
+
+        user.password = newPwd;
+        const userPasswordHistory = new UserPasswordHistory();
+        userPasswordHistory.passwordHash = newPwd;
+        userPasswordHistory.user = user;
+
+        await this.userRepository.save(user);
+        await this.userPasswordHistoryRepository.save(userPasswordHistory);
+
+        return true;
+    }
+
+    async initiateForgotPassword(initiateForgotPasswordDto: InitiateForgotPasswordDto) {
+        // Steps / Algorithm: 
+        // 1. Identify the user using the specified "username", if not found exit.
+        // const user = await this.userRepository.findOne({
+        //     where: { username: initiateForgotPasswordDto.username, }
+        // });
+        const user = await this.resolveUser(initiateForgotPasswordDto.username, initiateForgotPasswordDto.email);
+
+        if (!user) {
+            throw new NotFoundException('User does not exists');
+        }
+        if (!user.active) {
+            throw new UnauthorizedException('User is inactive');
+        }
+
+        // 2. Validate if user has used a provider which is "local", only then it makes sense for us to initiate the forgot password routine. 
+        if (user.lastLoginProvider !== 'local') {
+            throw new BadRequestException('User seems to have used a passwordless mode to authenticate.');
+        }
+
+        // 3. Generate a 6 digit validation token, we send this token to the user over their email & mobile number (controlled using configuration).
+        // 4. Save this validation token in new fields on the user record. 
+        const { token, expiresAt } = this.otp();
+        user.verificationTokenOnForgotPassword = token;
+        user.verificationTokenOnForgotPasswordExpiresAt = expiresAt;
+        await this.userRepository.save(user);
+        this.notifyUserOnForgotPassword(user);
+
+        // 5. Return. 
+        return {
+            status: 'success',
+            message: 'Forgot password - token generated and sent',
+            error: '',
+            errorCode: '',
+            data: {
+                user: {
+                    email: user.email,
+                    mobile: user.mobile,
+                    username: user.username,
+                },
+            }
+        }
+    }
+
+    private notifyUserOnForgotPassword(user: User) {
+        const forgotPasswordSendVerificationTokenOn = this.iamConfiguration.forgotPasswordSendVerificationTokenOn;
+
+        if (forgotPasswordSendVerificationTokenOn == ForgotPasswordSendVerificationTokenOn.EMAIL) {
+            this.mailService.sendEmailUsingTemplate(
+                user.email,
+                'forgot-password',
+                {
+                    solidAppName: process.env.SOLID_APP_NAME,
+                    solidAppWebsiteUrl: process.env.SOLID_APP_WEBSITE_URL,
+                    firstName: user.username,
+                    // TODO: Need to prefix this with the page url where the forgot password page will open up.
+                    passwordResetLink: `${process.env.IAM_FRONTEND_APP_FORGOT_PASSWORD_PAGE_URL}?token=${user.verificationTokenOnForgotPassword}&username=${user.username}`
+                },
+                true,
+                'user',
+                user.id
+            );
+        }
+        // Assuming all users do not have mobile as mandatory.
+        if (forgotPasswordSendVerificationTokenOn == ForgotPasswordSendVerificationTokenOn.MOBILE && user.mobile) {
+            this.smsService.sendSMSUsingTemplate(
+                user.mobile,
+                'forgot-password',
+                {
+                    solidAppName: process.env.SOLID_APP_NAME,
+                    otp: user.verificationTokenOnForgotPassword,
+                    verificationTokenOnForgotPassword: user.verificationTokenOnForgotPassword,
+                    firstName: user.username
+
+                }
+            );
+        }
+    }
+
+    async confirmForgotPassword(confirmForgotPasswordDto: ConfirmForgotPasswordDto) {
+        // Steps / Algorithm: 
+        // 1. Identify the user using the specified "username", if not found exit.
+        // const user = await this.userRepository.findOne({
+        //     where: { username: confirmForgotPasswordDto.username, }
+        // });
+        const user = await this.resolveUser(confirmForgotPasswordDto.username, confirmForgotPasswordDto.email);
+
+        if (!user) {
+            throw new NotFoundException('User does not exists');
+        }
+
+        // 2. Validate if user has used a provider which is "local", only then it makes sense for us to initiate the forgot password routine. 
+        if (user.lastLoginProvider !== 'local') {
+            throw new BadRequestException('User seems to have used a passwordless mode to authenticate.');
+        }
+        if (!user.active) {
+            throw new UnauthorizedException('User is inactive');
+        }
+
+        // 3. Validate the verification token is proper & update the user record. 
+        if (user.verificationTokenOnForgotPassword !== confirmForgotPasswordDto.verificationToken) {
+            throw new UnauthorizedException('Invalid verification token');
+        }
+        if (user.verificationTokenOnForgotPasswordExpiresAt < new Date()) {
+            throw new UnauthorizedException('Invalid verification token');
+        }
+        user.forgotPasswordConfirmedAt = new Date();
+        user.verificationTokenOnForgotPassword = null;
+        user.verificationTokenOnForgotPasswordExpiresAt = null;
+
+        // 4. Update the users password while encrypting it.
+        const pwd = await this.hashingService.hash(confirmForgotPasswordDto.password);
+        user.password = confirmForgotPasswordDto.password
+
+        if (await this.isPasswordDuplicate(user)) {
+            throw new BadRequestException('Previously used passwords cannot be used again.');
+        }
+        await this.deleteOldPasswords(user);
+
+        user.password = pwd;
+        const userPasswordHistory = new UserPasswordHistory();
+        userPasswordHistory.passwordHash = pwd;
+        userPasswordHistory.user = user;
+
+        await this.userRepository.save(user);
+        //FIXME: Do this check conditionally, basis a configuration parameter i.e if IAM_ALLOW_PREVIOUS_PASSWORDS=false, default true
+        await this.userPasswordHistoryRepository.save(userPasswordHistory);
+
+        return {
+            status: 'success',
+            message: 'Forgot password confirmed',
+            error: '',
+            errorCode: '',
+            data: {}
+        }
+    }
+
+    //FIXME: Do this check conditionally, basis a configuration parameter i.e if IAM_ALLOW_PREVIOUS_PASSWORDS=true, return immediately without processing, i.e false.
+    private async isPasswordDuplicate(user: User) {
+        const userPwdHistoryEntityArray = await this.userPasswordHistoryRepository.findBy(
+            { user: { id: user.id } }
+        )
+        let userPwdHistoryArray = [];
+        // O(n)
+        for (const entity of userPwdHistoryEntityArray) {
+            userPwdHistoryArray.push(entity.passwordHash);
+        }
+        // O(n)
+        for (const pwdHash of userPwdHistoryArray) {
+            const isEqual = await this.hashingService.compare(user.password, pwdHash);
+            if (isEqual) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    //FIXME: Do this check conditionally, basis a configuration parameter i.e if IAM_ALLOW_PREVIOUS_PASSWORDS=true, return immediately without processing
+    private async deleteOldPasswords(user: User) {
+        const userPwdHistoryArray = await this.userPasswordHistoryRepository.findBy(
+            { user: { id: user.id } }
+        )
+        const pwdLimit = 2; //FIXME: Should this be moved into the env? IAM_PREVIOUS_PASSWORDS_LIMIT
+
+        // TODO: Check what slice() or splice() does.
+        //FIXME - Delete passwords which are older than the latest n passwords. n is configurable
+        if (userPwdHistoryArray.length >= pwdLimit) {
+            const numToDelete = pwdLimit + 1 - userPwdHistoryArray.length;
+            for (let i = 0; i < numToDelete; i++) {
+                await this.userPasswordHistoryRepository.remove(userPwdHistoryArray[i]);
+            }
+        }
+    }
+
+    async generateTokens(user: User) {
+        const refreshTokenId = randomUUID();
+
+        // const userRoleNames = user.roles.map((role) => role.name).join(';')
+        const userRoleNames = user.roles.map((role) => role.name);
+
+        const [accessToken, refreshToken] = await Promise.all([
+            this.signToken<Partial<ActiveUserData>>(
+                user.id,
+                this.jwtConfiguration.accessTokenTtl,
+                { username: user.username, email: user.email, roles: userRoleNames },
+            ),
+            this.signToken(user.id, this.jwtConfiguration.refreshTokenTtl, {
+                refreshTokenId,
+            }),
+        ]);
+
+        // store the refresh token id in the redis storage.
+        await this.refreshTokenIdsStorage.insert(user.id, refreshTokenId);
+
+        return {
+            accessToken,
+            refreshToken,
+        };
+    }
+
+    async refreshTokens(refreshTokenDto: RefreshTokenDto) {
+        try {
+            const { sub, refreshTokenId } = await this.jwtService.verifyAsync<Pick<ActiveUserData, 'sub'> & { refreshTokenId: string }>(refreshTokenDto.refreshToken, {
+                secret: this.jwtConfiguration.secret,
+                audience: this.jwtConfiguration.audience,
+                issuer: this.jwtConfiguration.issuer,
+            });
+            // const user = await this.userRepository.findOneByOrFail({ id: sub });
+            const user = await this.userRepository.findOne({
+                where: {
+                    id: sub,
+                },
+                relations: {
+                    roles: true
+                }
+            });
+            if (!user) {
+                throw new UnauthorizedException();
+            }
+
+            const isValid = await this.refreshTokenIdsStorage.validate(user.id, refreshTokenId);
+            if (isValid) {
+                // Refresh token rotation.
+                await this.refreshTokenIdsStorage.invalidate(user.id);
+            } else {
+                throw new Error('Refresh token is invalid');
+            }
+            return this.generateTokens(user);
+        } catch (err) {
+            if (err instanceof InvalidatedRefreshTokenError) {
+                // Take action: notify user that his refresh token might have been stolen?
+                throw new UnauthorizedException('Access denied');
+            }
+
+            throw new UnauthorizedException();
+        }
+    }
+
+    private async signToken<T>(userId: number, expiresIn: number, payload?: T) {
+        return await this.jwtService.signAsync(
+            {
+                sub: userId,
+                ...payload,
+            },
+            {
+                audience: this.jwtConfiguration.audience,
+                issuer: this.jwtConfiguration.issuer,
+                secret: this.jwtConfiguration.secret,
+                expiresIn,
+            },
+        );
+    }
+
+    // PROVIDER SPECIFIC CODE
+    async validateUserUsingGoogle(user: User) {
+        try {
+            // Make API call to Google OAuth service to fetch user profile
+            const response = await this.httpService.axiosRef.get(`https://www.googleapis.com/oauth2/v1/userinfo?alt=json&access_token=${user.googleAccessToken}`);
+            const userProfile = response.data;
+
+            // Ensure the fetched profile email & provider Id match the ones we have stored in the database earlier. 
+            if (userProfile.email === user.email && userProfile.id === user.googleId) {
+                // TODO: remove the access code both from the database.
+                return userProfile;
+            } else {
+                throw new UnauthorizedException('Invalid user profile');
+            }
+        } catch (error) {
+            throw new UnauthorizedException('Failed to fetch user profile from Google OAuth service');
+        }
+    }
+
+    async signInUsingGoogle(accessCode: string) {
+        const user = await this.userRepository.findOne({
+            where: {
+                accessCode: accessCode
+            },
+            relations: {
+                roles: true
+            }
+        });
+
+        // Validate the user against the Google oauth provider. 
+        // If the below call finishes without raising an exception then we have validated the user properly.
+        await this.validateUserUsingGoogle(user);
+
+        // finally we simply generate the tokens. 
+        return await this.generateTokens(user);
+    }
+
+    private isPasswordlessRegistrationEnabled() {
+        return this.iamConfiguration.passwordlessRegistration;
+    }
+
+    //FIXME - Pending implementation
+    async logout() {
+        // const user = this.request.user; //TODO: // Access the user from the execution context
+
+        // Invalidate the refresh token
+        // await this.refreshTokenIdsStorage.invalidate(user.id);
+    }
+
+    async activateUser(userId: number) {
+        const user = await this.userService.findOne(userId, {});
+        if (!user) {
+            throw new NotFoundException('User not found');
+        }
+        user.active = true;
+        await this.userRepository.save(user);
+    }
+
+    async me(activeUser: ActiveUserData) {
+        const user = await this.userRepository.findOne({
+            where: {
+                id: activeUser.sub,
+            },
+            relations: {
+                roles: true
+            }
+        });
+        const tokens = await this.generateTokens(user);
+
+        const response = {
+            ...user,
+            ...tokens
+        }
+        return response;
+    }
+
+}