@tomei/sso 0.34.2 → 0.34.6

package/dist/src/components/login-user/user.js

@@ -0,0 +1,1617 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.User = void 0;
+const general_1 = require("@tomei/general");
+const user_repository_1 = require("./user.repository");
+const system_repository_1 = require("../system/system.repository");
+const login_history_repository_1 = require("../login-history/login-history.repository");
+const password_hash_service_1 = require("../password-hash/password-hash.service");
+const user_group_repository_1 = require("../user-group/user-group.repository");
+const staff_entity_1 = require("../../models/staff.entity");
+const system_privilege_entity_1 = require("../../models/system-privilege.entity");
+const yn_enum_1 = require("../../enum/yn.enum");
+const enum_1 = require("../../enum");
+const config_1 = require("@tomei/config");
+const sequelize_1 = require("sequelize");
+const activity_history_1 = require("@tomei/activity-history");
+const user_entity_1 = require("../../models/user.entity");
+const group_entity_1 = require("../../models/group.entity");
+const group_system_access_repository_1 = require("../group-system-access/group-system-access.repository");
+const group_repository_1 = require("../group/group.repository");
+const system_entity_1 = require("../../models/system.entity");
+const user_system_access_repository_1 = require("../user-system-access/user-system-access.repository");
+const group_system_access_entity_1 = require("../../models/group-system-access.entity");
+const user_privilege_repository_1 = require("../user-privilege/user-privilege.repository");
+const user_object_privilege_repository_1 = require("../user-object-privilege/user-object-privilege.repository");
+const group_privilege_entity_1 = require("../../models/group-privilege.entity");
+const group_object_privilege_repository_1 = require("../group-object-privilege/group-object-privilege.repository");
+const speakeasy = require("speakeasy");
+const login_status_enum_1 = require("../../enum/login-status.enum");
+const redis_service_1 = require("../../redis-client/redis.service");
+const login_user_1 = require("./login-user");
+class User extends general_1.UserBase {
+    get SessionService() {
+        return this._SessionService;
+    }
+    get UserId() {
+        return parseInt(this.ObjectId);
+    }
+    set UserId(value) {
+        this.ObjectId = value.toString();
+    }
+    get Password() {
+        return this._Password;
+    }
+    set Password(value) {
+        this._Password = value;
+    }
+    get Status() {
+        return this._Status;
+    }
+    set Status(value) {
+        this._Status = value;
+    }
+    get UserName() {
+        return this._UserName;
+    }
+    set UserName(value) {
+        this._UserName = value;
+    }
+    get DefaultPasswordChangedYN() {
+        return this._DefaultPasswordChangedYN;
+    }
+    set DefaultPasswordChangedYN(value) {
+        this._DefaultPasswordChangedYN = value;
+    }
+    get FirstLoginAt() {
+        return this._FirstLoginAt;
+    }
+    set FirstLoginAt(value) {
+        this._FirstLoginAt = value;
+    }
+    get LastLoginAt() {
+        return this._LastLoginAt;
+    }
+    set LastLoginAt(value) {
+        this._LastLoginAt = value;
+    }
+    get MFAEnabled() {
+        return this._MFAEnabled;
+    }
+    set MFAEnabled(value) {
+        this._MFAEnabled = value;
+    }
+    get MFAConfig() {
+        return this._MFAConfig;
+    }
+    set MFAConfig(value) {
+        this._MFAConfig = value;
+    }
+    get RecoveryEmail() {
+        return this._RecoveryEmail;
+    }
+    set RecoveryEmail(value) {
+        this._RecoveryEmail = value;
+    }
+    get FailedLoginAttemptCount() {
+        return this._FailedLoginAttemptCount;
+    }
+    set FailedLoginAttemptCount(value) {
+        this._FailedLoginAttemptCount = value;
+    }
+    get LastFailedLoginAt() {
+        return this._LastFailedLoginAt;
+    }
+    set LastFailedLoginAt(value) {
+        this._LastFailedLoginAt = value;
+    }
+    get LastPasswordChangedAt() {
+        return this._LastPasswordChangedAt;
+    }
+    set LastPasswordChangedAt(value) {
+        this._LastPasswordChangedAt = value;
+    }
+    get NeedToChangePasswordYN() {
+        return this._NeedToChangePasswordYN;
+    }
+    set NeedToChangePasswordYN(value) {
+        this._NeedToChangePasswordYN = value;
+    }
+    get CreatedById() {
+        return this._CreatedById;
+    }
+    set CreatedById(value) {
+        this._CreatedById = value;
+    }
+    get CreatedAt() {
+        return this._CreatedAt;
+    }
+    set CreatedAt(value) {
+        this._CreatedAt = value;
+    }
+    get UpdatedById() {
+        return this._UpdatedById;
+    }
+    set UpdatedById(value) {
+        this._UpdatedById = value;
+    }
+    get UpdatedAt() {
+        return this._UpdatedAt;
+    }
+    set UpdatedAt(value) {
+        this._UpdatedAt = value;
+    }
+    getDetails() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return {
+                FullName: this.FullName,
+                UserName: this.UserName,
+                IDNo: this.IDNo,
+                IDType: this.IDType,
+                Email: this.Email,
+                ContactNo: this.ContactNo,
+            };
+        });
+    }
+    constructor(sessionService, dbTransaction, userInfo) {
+        super();
+        this.ObjectName = 'User';
+        this.TableName = 'sso_Users';
+        this.ObjectType = 'User';
+        this._SessionService = sessionService;
+        if (dbTransaction) {
+            this._dbTransaction = dbTransaction;
+        }
+        if (userInfo) {
+            this.UserId = userInfo.UserId;
+            this.UserName = userInfo.FullName;
+            this.FullName = userInfo.FullName;
+            this.IDNo = userInfo.IDNo;
+            this.Email = userInfo.Email;
+            this.ContactNo = userInfo.ContactNo;
+            this.Password = userInfo.Password;
+            this.staffs = userInfo.staffs;
+            this.Status = userInfo.Status;
+            this.DefaultPasswordChangedYN = userInfo.DefaultPasswordChangedYN;
+            this.FirstLoginAt = userInfo.FirstLoginAt;
+            this.LastLoginAt = userInfo.LastLoginAt;
+            this.MFAEnabled = userInfo.MFAEnabled;
+            this.MFAConfig = userInfo.MFAConfig;
+            this.RecoveryEmail = userInfo.RecoveryEmail;
+            this.FailedLoginAttemptCount = userInfo.FailedLoginAttemptCount;
+            this.LastFailedLoginAt = userInfo.LastFailedLoginAt;
+            this.LastPasswordChangedAt = userInfo.LastPasswordChangedAt;
+            this.NeedToChangePasswordYN = userInfo.NeedToChangePasswordYN;
+            this.CreatedById = userInfo.CreatedById;
+            this.CreatedAt = userInfo.CreatedAt;
+            this.UpdatedById = userInfo.UpdatedById;
+            this.UpdatedAt = userInfo.UpdatedAt;
+        }
+    }
+    static init(sessionService, userId, dbTransaction = null) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            User._RedisService = yield redis_service_1.RedisService.init();
+            if (userId) {
+                if (dbTransaction) {
+                    User._Repository = new user_repository_1.UserRepository();
+                }
+                const user = yield User._Repository.findOne({
+                    where: {
+                        UserId: userId,
+                    },
+                    include: [
+                        {
+                            model: staff_entity_1.default,
+                        },
+                    ],
+                    transaction: dbTransaction,
+                });
+                if (!user) {
+                    throw new Error('Invalid credentials.');
+                }
+                if (user) {
+                    const userAttr = {
+                        UserId: user.UserId,
+                        UserName: user.UserName,
+                        FullName: (_a = user === null || user === void 0 ? void 0 : user.Staff) === null || _a === void 0 ? void 0 : _a.FullName,
+                        IDNo: (_b = user === null || user === void 0 ? void 0 : user.Staff) === null || _b === void 0 ? void 0 : _b.IdNo,
+                        ContactNo: (_c = user === null || user === void 0 ? void 0 : user.Staff) === null || _c === void 0 ? void 0 : _c.Mobile,
+                        Email: user.Email,
+                        Password: user.Password,
+                        Status: user.Status,
+                        DefaultPasswordChangedYN: user.DefaultPasswordChangedYN,
+                        FirstLoginAt: user.FirstLoginAt,
+                        LastLoginAt: user.LastLoginAt,
+                        MFAEnabled: user.MFAEnabled,
+                        MFAConfig: user.MFAConfig,
+                        RecoveryEmail: user.RecoveryEmail,
+                        FailedLoginAttemptCount: user.FailedLoginAttemptCount,
+                        LastFailedLoginAt: user.LastFailedLoginAt,
+                        LastPasswordChangedAt: user.LastPasswordChangedAt,
+                        NeedToChangePasswordYN: user.NeedToChangePasswordYN,
+                        CreatedById: user.CreatedById,
+                        CreatedAt: user.CreatedAt,
+                        UpdatedById: user.UpdatedById,
+                        UpdatedAt: user.UpdatedAt,
+                        staffs: user === null || user === void 0 ? void 0 : user.Staff,
+                    };
+                    return new User(sessionService, dbTransaction, userAttr);
+                }
+                else {
+                    throw new Error('User not found');
+                }
+            }
+            return new User(sessionService, dbTransaction);
+        });
+    }
+    setEmail(email, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                if (this.Email === email) {
+                    return;
+                }
+                const user = yield User._Repository.findOne({
+                    where: {
+                        Email: email,
+                    },
+                    transaction: dbTransaction,
+                });
+                if (user) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Email already exists');
+                }
+                this.Email = email;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    login(systemCode, email, password, ipAddress, dbTransaction) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                if (!this.ObjectId) {
+                    const user = yield User._Repository.findOne({
+                        transaction: dbTransaction,
+                        where: {
+                            Email: email,
+                            Status: {
+                                [sequelize_1.Op.or]: [enum_1.UserStatus.ACTIVE, enum_1.UserStatus.LOCKED],
+                            },
+                        },
+                        include: [
+                            {
+                                model: staff_entity_1.default,
+                            },
+                        ],
+                    });
+                    if (user) {
+                        const userAttr = {
+                            UserId: user.UserId,
+                            UserName: user.UserName,
+                            FullName: ((_a = user === null || user === void 0 ? void 0 : user.Staff) === null || _a === void 0 ? void 0 : _a.FullName) || null,
+                            IDNo: ((_b = user === null || user === void 0 ? void 0 : user.Staff) === null || _b === void 0 ? void 0 : _b.IdNo) || null,
+                            ContactNo: ((_c = user === null || user === void 0 ? void 0 : user.Staff) === null || _c === void 0 ? void 0 : _c.Mobile) || null,
+                            Email: user.Email,
+                            Password: user.Password,
+                            Status: user.Status,
+                            DefaultPasswordChangedYN: user.DefaultPasswordChangedYN,
+                            FirstLoginAt: user.FirstLoginAt,
+                            LastLoginAt: user.LastLoginAt,
+                            MFAEnabled: user.MFAEnabled,
+                            MFAConfig: user.MFAConfig,
+                            RecoveryEmail: user.RecoveryEmail,
+                            FailedLoginAttemptCount: user.FailedLoginAttemptCount,
+                            LastFailedLoginAt: user.LastFailedLoginAt,
+                            LastPasswordChangedAt: user.LastPasswordChangedAt,
+                            NeedToChangePasswordYN: user.NeedToChangePasswordYN,
+                            CreatedById: user.CreatedById,
+                            CreatedAt: user.CreatedAt,
+                            UpdatedById: user.UpdatedById,
+                            UpdatedAt: user.UpdatedAt,
+                            staffs: (user === null || user === void 0 ? void 0 : user.Staff) || null,
+                        };
+                        this.UserId = userAttr.UserId;
+                        this.FullName = userAttr.FullName;
+                        this.IDNo = userAttr.IDNo;
+                        this.Email = userAttr.Email;
+                        this.ContactNo = userAttr.ContactNo;
+                        this.Password = userAttr.Password;
+                        this.Status = userAttr.Status;
+                        this.DefaultPasswordChangedYN = userAttr.DefaultPasswordChangedYN;
+                        this.FirstLoginAt = userAttr.FirstLoginAt;
+                        this.LastLoginAt = userAttr.LastLoginAt;
+                        this.MFAEnabled = userAttr.MFAEnabled;
+                        this.MFAConfig = userAttr.MFAConfig;
+                        this.RecoveryEmail = userAttr.RecoveryEmail;
+                        this.FailedLoginAttemptCount = userAttr.FailedLoginAttemptCount;
+                        this.LastFailedLoginAt = userAttr.LastFailedLoginAt;
+                        this.LastPasswordChangedAt = userAttr.LastPasswordChangedAt;
+                        this.NeedToChangePasswordYN = userAttr.NeedToChangePasswordYN;
+                        this.CreatedById = userAttr.CreatedById;
+                        this.CreatedAt = userAttr.CreatedAt;
+                        this.UpdatedById = userAttr.UpdatedById;
+                        this.UpdatedAt = userAttr.UpdatedAt;
+                        this.staffs = userAttr.staffs;
+                    }
+                    else {
+                        throw new general_1.ClassError('User', 'UserErrMsg0X', 'Invalid Credentials');
+                    }
+                }
+                if (this.ObjectId && this.Email !== email) {
+                    throw new Error('Invalid credentials.');
+                }
+                const check2FA = yield User.check2FA(this, dbTransaction);
+                try {
+                    const system = yield User._SystemRepository.findOne({
+                        where: {
+                            SystemCode: systemCode,
+                            Status: 'Active',
+                        },
+                    });
+                    if (!system) {
+                        throw new Error('Invalid credentials.');
+                    }
+                    const passwordHashService = new password_hash_service_1.PasswordHashService();
+                    const isPasswordValid = yield passwordHashService.verify(password, this.Password);
+                    if (!isPasswordValid) {
+                        throw new Error('Invalid credentials.');
+                    }
+                    yield this.checkSystemAccess(this.UserId, system.SystemCode, dbTransaction);
+                    if (this.Status === enum_1.UserStatus.LOCKED) {
+                        const isReleaseLock = User.shouldReleaseLock(this.LastFailedLoginAt);
+                        if (isReleaseLock) {
+                            yield User.releaseLock(this.UserId, dbTransaction);
+                            this.Status = enum_1.UserStatus.ACTIVE;
+                        }
+                        else {
+                            throw new Error('Invalid credentials.');
+                        }
+                    }
+                }
+                catch (error) {
+                    yield this.incrementFailedLoginAttemptCount(dbTransaction);
+                }
+                const system = yield User._SystemRepository.findOne({
+                    where: {
+                        SystemCode: systemCode,
+                    },
+                });
+                yield this.alertNewLogin(this.ObjectId, system.SystemCode, ipAddress);
+                this.FailedLoginAttemptCount = 0;
+                this.LastLoginAt = new Date();
+                if (!this.FirstLoginAt) {
+                    this.FirstLoginAt = new Date();
+                }
+                yield User._Repository.update({
+                    FullName: this.FullName,
+                    UserName: this.UserName,
+                    IDNo: this.IDNo,
+                    Email: this.Email,
+                    ContactNo: this.ContactNo,
+                    Password: this.Password,
+                    Status: this.Status,
+                    DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                    FirstLoginAt: this.FirstLoginAt,
+                    LastLoginAt: this.LastLoginAt,
+                    MFAEnabled: this.MFAEnabled,
+                    MFAConfig: this.MFAConfig,
+                    RecoveryEmail: this.RecoveryEmail,
+                    FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                    LastFailedLoginAt: this.LastFailedLoginAt,
+                    LastPasswordChangedAt: this.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                }, {
+                    where: {
+                        UserId: this.UserId,
+                    },
+                    transaction: dbTransaction,
+                });
+                const userSession = yield this._SessionService.retrieveUserSession(this.ObjectId);
+                let systemLogin = userSession.systemLogins.find((system) => system.code === systemCode);
+                const { randomUUID } = require('crypto');
+                const sessionId = randomUUID();
+                if (systemLogin) {
+                    systemLogin = systemLogin.sessionId = sessionId;
+                    userSession.systemLogins.map((system) => system.code === systemCode ? systemLogin : system);
+                }
+                else {
+                    const newLogin = {
+                        id: system.SystemCode,
+                        code: system.SystemCode,
+                        sessionId: sessionId,
+                        privileges: yield this.getPrivileges(system.SystemCode, dbTransaction),
+                    };
+                    userSession.systemLogins.push(newLogin);
+                }
+                this._SessionService.setUserSession(this.ObjectId, userSession);
+                yield User._LoginHistoryRepository.create({
+                    UserId: this.UserId,
+                    SystemCode: system.SystemCode,
+                    OriginIp: ipAddress,
+                    CreatedAt: new Date(),
+                    LoginStatus: login_status_enum_1.LoginStatusEnum.SUCCESS,
+                }, {
+                    transaction: dbTransaction,
+                });
+                const is2FAEnabledYN = config_1.ComponentConfig.getComponentConfigValue('@tomei/sso', 'is2FAEnabledYN');
+                const loginUser = yield login_user_1.LoginUser.init(this.SessionService, this.UserId, dbTransaction);
+                if (is2FAEnabledYN === 'Y') {
+                    loginUser.session.Id = `${this.UserId}:`;
+                }
+                else {
+                    loginUser.session.Id = `${this.UserId}:${sessionId}`;
+                }
+                return loginUser;
+            }
+            catch (error) {
+                if (this.ObjectId) {
+                    yield User._LoginHistoryRepository.create({
+                        UserId: this.UserId,
+                        SystemCode: systemCode,
+                        OriginIp: ipAddress,
+                        LoginStatus: login_status_enum_1.LoginStatusEnum.FAILURE,
+                        CreatedAt: new Date(),
+                    }, {
+                        transaction: dbTransaction,
+                    });
+                }
+                throw error;
+            }
+        });
+    }
+    checkSystemAccess(userId, systemCode, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                let isUserHaveAccess = false;
+                const systemAccess = yield User._UserSystemAccessRepo.findOne({
+                    where: {
+                        UserId: userId,
+                        SystemCode: systemCode,
+                        Status: 'Active',
+                    },
+                    dbTransaction,
+                });
+                if (systemAccess) {
+                    isUserHaveAccess = true;
+                }
+                else {
+                    const userGroups = yield User._UserGroupRepo.findAll({
+                        where: {
+                            UserId: userId,
+                            InheritGroupAccessYN: 'Y',
+                            Status: 'Active',
+                        },
+                        include: [
+                            {
+                                model: group_entity_1.default,
+                            },
+                        ],
+                        dbTransaction,
+                    });
+                    for (const usergroup of userGroups) {
+                        const group = usergroup.Group;
+                        const groupSystemAccess = yield User.getInheritedSystemAccess(dbTransaction, group);
+                        for (const system of groupSystemAccess) {
+                            if (system.SystemCode === systemCode) {
+                                isUserHaveAccess = true;
+                                break;
+                            }
+                        }
+                    }
+                }
+                if (!isUserHaveAccess) {
+                    throw new Error("User don't have access to the system.");
+                }
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    checkPrivileges(systemCode, privilegeName) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                if (!this.ObjectId) {
+                    throw new Error('ObjectId(UserId) is not set');
+                }
+                const userSession = yield this._SessionService.retrieveUserSession(this.ObjectId);
+                const systemLogin = userSession.systemLogins.find((system) => system.code === systemCode);
+                if (!systemLogin) {
+                    return false;
+                }
+                const privileges = systemLogin.privileges;
+                const hasPrivilege = privileges.includes(privilegeName);
+                return hasPrivilege;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    alertNewLogin(userId, systemCode, ipAddress) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const userLogins = yield User._LoginHistoryRepository.findAll({
+                    where: {
+                        UserId: userId,
+                        SystemCode: systemCode,
+                    },
+                });
+                const gotPreviousLogins = (userLogins === null || userLogins === void 0 ? void 0 : userLogins.length) !== 0;
+                let ipFound = undefined;
+                if (gotPreviousLogins) {
+                    ipFound = userLogins.find((item) => item.OriginIp === ipAddress);
+                }
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    getPrivileges(systemCode, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const system = yield User._SystemRepository.findOne({
+                    where: {
+                        SystemCode: systemCode,
+                    },
+                    transaction: dbTransaction,
+                });
+                if (!system) {
+                    throw new Error('Invalid system code.');
+                }
+                const userPrivileges = yield this.getUserPersonalPrivileges(systemCode, dbTransaction);
+                const objectPrivileges = yield this.getObjectPrivileges(systemCode, dbTransaction);
+                const userGroupOwnByUser = yield User._UserGroupRepo.findAll({
+                    where: {
+                        UserId: this.UserId,
+                        InheritGroupSystemAccessYN: 'Y',
+                        InheritGroupPrivilegeYN: 'Y',
+                        Status: 'Active',
+                    },
+                    include: [
+                        {
+                            model: group_entity_1.default,
+                            where: {
+                                Status: 'Active',
+                            },
+                            include: [
+                                {
+                                    model: group_system_access_entity_1.default,
+                                    where: {
+                                        SystemCode: systemCode,
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                    transaction: dbTransaction,
+                });
+                let groupsPrivileges = [];
+                for (const userGroup of userGroupOwnByUser) {
+                    const gp = yield this.getInheritedPrivileges(userGroup.GroupCode, systemCode, dbTransaction);
+                    groupsPrivileges = [...groupsPrivileges, ...gp];
+                }
+                const privileges = [
+                    ...userPrivileges,
+                    ...objectPrivileges,
+                    ...groupsPrivileges,
+                ];
+                return privileges;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    getInheritedPrivileges(groupCode, systemCode, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const group = yield User._GroupRepo.findOne({
+                    where: {
+                        GroupCode: groupCode,
+                        Status: 'Active',
+                    },
+                    include: [
+                        {
+                            model: group_privilege_entity_1.default,
+                            where: {
+                                Status: 'Active',
+                            },
+                            include: [
+                                {
+                                    model: system_privilege_entity_1.default,
+                                    where: {
+                                        SystemCode: systemCode,
+                                        Status: 'Active',
+                                    },
+                                },
+                            ],
+                        },
+                    ],
+                    transaction: dbTransaction,
+                });
+                const objectPrivileges = yield User._GroupObjectPrivilegeRepo.findAll({
+                    where: {
+                        GroupCode: groupCode,
+                    },
+                    include: {
+                        model: system_privilege_entity_1.default,
+                        where: {
+                            SystemCode: systemCode,
+                            Status: 'Active',
+                        },
+                    },
+                    transaction: dbTransaction,
+                });
+                let privileges = [];
+                const groupPrivileges = [];
+                for (const groupPrivilege of group.GroupPrivileges) {
+                    groupPrivileges.push(groupPrivilege.Privilege.PrivilegeCode);
+                }
+                const ops = [];
+                for (const objectPrivilege of objectPrivileges) {
+                    ops.push(objectPrivilege.Privilege.PrivilegeCode);
+                }
+                privileges = [...privileges, ...groupPrivileges, ...ops];
+                if (group.ParentGroupCode && group.InheritParentPrivilegeYN === 'Y') {
+                    const parentGroupPrivileges = yield this.getInheritedPrivileges(group.ParentGroupCode, systemCode, dbTransaction);
+                    privileges = [...privileges, ...parentGroupPrivileges];
+                }
+                return privileges;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    getUserPersonalPrivileges(systemCode, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const userPrivileges = yield User._UserPrivilegeRepo.findAll({
+                    where: {
+                        UserId: this.UserId,
+                        Status: 'Active',
+                    },
+                    include: {
+                        model: system_privilege_entity_1.default,
+                        where: {
+                            SystemCode: systemCode,
+                            Status: 'Active',
+                        },
+                    },
+                    transaction: dbTransaction,
+                });
+                const privileges = userPrivileges.map((u) => u.Privilege.PrivilegeCode);
+                return privileges;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    getObjectPrivileges(systemCode, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const userObjectPrivileges = yield User._UserObjectPrivilegeRepo.findAll({
+                    where: {
+                        UserId: this.UserId,
+                    },
+                    include: {
+                        model: system_privilege_entity_1.default,
+                        where: {
+                            SystemCode: systemCode,
+                            Status: 'Active',
+                        },
+                    },
+                    transaction: dbTransaction,
+                });
+                const privilegesCodes = userObjectPrivileges.map((u) => u.Privilege.PrivilegeCode);
+                return privilegesCodes;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    static checkUserInfoDuplicated(dbTransaction, query) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const { Email, UserName, IdType, IdNo, ContactNo } = query;
+                const where = {
+                    [sequelize_1.Op.or]: {},
+                };
+                if (Email) {
+                    where[sequelize_1.Op.or]['Email'] = Email;
+                }
+                if (UserName) {
+                    where[sequelize_1.Op.or]['UserName'] = UserName;
+                }
+                if (IdType && IdNo) {
+                    where[sequelize_1.Op.or]['IdType'] = IdType;
+                    where[sequelize_1.Op.or]['IdNo'] = IdNo;
+                }
+                if (ContactNo) {
+                    where[sequelize_1.Op.or]['ContactNo'] = ContactNo;
+                }
+                const user = yield User._Repository.findAll({
+                    where,
+                    transaction: dbTransaction,
+                });
+                if (user && user.length > 0) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'User info already exists');
+                }
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    static generateDefaultPassword() {
+        try {
+            const passwordPolicy = config_1.ComponentConfig.getComponentConfigValue('@tomei/sso', 'passwordPolicy');
+            if (!passwordPolicy ||
+                !passwordPolicy.maxLen ||
+                !passwordPolicy.minLen ||
+                !passwordPolicy.nonAcceptableChar ||
+                !passwordPolicy.numOfCapitalLetters ||
+                !passwordPolicy.numOfNumbers ||
+                !passwordPolicy.numOfSpecialChars) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Missing password policy. Please set in config file.');
+            }
+            if (passwordPolicy.numOfCapitalLetters +
+                passwordPolicy.numOfNumbers +
+                passwordPolicy.numOfSpecialChars >
+                passwordPolicy.maxLen) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Password policy is invalid. Please set in config file.');
+            }
+            const { maxLen, minLen, nonAcceptableChar, numOfCapitalLetters, numOfNumbers, numOfSpecialChars, } = passwordPolicy;
+            const passwordLength = Math.floor(Math.random() * (maxLen - minLen + 1)) + minLen;
+            const words = 'abcdefghijklmnopqrstuvwxyz';
+            const capitalLetters = words.toUpperCase();
+            const numbers = '0123456789';
+            const specialChars = '!@#$%^&*()_+-={}[]|:;"<>,.?/~`';
+            const nonAcceptableChars = nonAcceptableChar.split(',');
+            const filteredWords = words
+                .split('')
+                .filter((word) => !nonAcceptableChars.includes(word));
+            const filteredCapitalLetters = capitalLetters
+                .split('')
+                .filter((word) => !nonAcceptableChars.includes(word));
+            const filteredNumbers = numbers
+                .split('')
+                .filter((word) => !nonAcceptableChars.includes(word));
+            const filteredSpecialChars = specialChars
+                .split('')
+                .filter((word) => !nonAcceptableChars.includes(word));
+            const generatedCapitalLetters = [];
+            const generatedNumbers = [];
+            const generatedSpecialChars = [];
+            const generatedWords = [];
+            for (let i = 0; i < numOfCapitalLetters; i++) {
+                const randomIndex = Math.floor(Math.random() * filteredCapitalLetters.length);
+                generatedCapitalLetters.push(filteredCapitalLetters[randomIndex]);
+            }
+            for (let i = 0; i < numOfNumbers; i++) {
+                const randomIndex = Math.floor(Math.random() * filteredNumbers.length);
+                generatedNumbers.push(filteredNumbers[randomIndex]);
+            }
+            for (let i = 0; i < numOfSpecialChars; i++) {
+                const randomIndex = Math.floor(Math.random() * filteredSpecialChars.length);
+                generatedSpecialChars.push(filteredSpecialChars[randomIndex]);
+            }
+            for (let i = 0; i <
+                passwordLength -
+                    (numOfCapitalLetters + numOfNumbers + numOfSpecialChars); i++) {
+                const randomIndex = Math.floor(Math.random() * filteredWords.length);
+                generatedWords.push(filteredWords[randomIndex]);
+            }
+            let generatedPassword = '';
+            const allGeneratedChars = generatedCapitalLetters.concat(generatedNumbers, generatedSpecialChars, generatedWords);
+            allGeneratedChars.sort(() => Math.random() - 0.5);
+            generatedPassword = allGeneratedChars.join('');
+            return generatedPassword;
+        }
+        catch (error) {
+            throw error;
+        }
+    }
+    static setPassword(dbTransaction, user, password) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const passwordPolicy = config_1.ComponentConfig.getComponentConfigValue('@tomei/sso', 'passwordPolicy');
+                if (!passwordPolicy ||
+                    !passwordPolicy.maxLen ||
+                    !passwordPolicy.minLen ||
+                    !passwordPolicy.nonAcceptableChar ||
+                    !passwordPolicy.numOfCapitalLetters ||
+                    !passwordPolicy.numOfNumbers ||
+                    !passwordPolicy.numOfSpecialChars) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Missing password policy. Please set in config file.');
+                }
+                try {
+                    if (password.length < passwordPolicy.minLen) {
+                        throw Error('Password is too short');
+                    }
+                    if (password.length > passwordPolicy.maxLen) {
+                        throw Error('Password is too long');
+                    }
+                    const nonAcceptableChars = passwordPolicy.nonAcceptableChar.split(',');
+                    const nonAcceptableCharsFound = nonAcceptableChars.some((char) => password.includes(char));
+                    if (nonAcceptableCharsFound) {
+                        throw Error('Password contains unacceptable characters');
+                    }
+                    const capitalLetters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+                    const numOfCapitalLetters = passwordPolicy.numOfCapitalLetters;
+                    const capitalLettersFound = capitalLetters
+                        .split('')
+                        .filter((char) => password.includes(char)).length;
+                    if (capitalLettersFound < numOfCapitalLetters) {
+                        throw Error('Password does not contain enough capital letters');
+                    }
+                    const numbers = '0123456789';
+                    const numOfNumbers = passwordPolicy.numOfNumbers;
+                    const numbersFound = numbers
+                        .split('')
+                        .filter((char) => password.includes(char)).length;
+                    if (numbersFound < numOfNumbers) {
+                        throw Error('Password does not contain enough numbers');
+                    }
+                    const specialChars = '!@#$%^&*()_+-={}[]|:;"<>,.?/~`';
+                    const numOfSpecialChars = passwordPolicy.numOfSpecialChars;
+                    const specialCharsFound = specialChars
+                        .split('')
+                        .filter((char) => password.includes(char)).length;
+                    if (specialCharsFound < numOfSpecialChars) {
+                        throw Error('Password does not contain enough special characters');
+                    }
+                }
+                catch (error) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', "Your password doesn't meet security requirements. Try using a mix of uppercase and lowercase letters, numbers, and symbols.");
+                }
+                const passwordHashService = new password_hash_service_1.PasswordHashService();
+                const hashedPassword = yield passwordHashService.hashPassword(password);
+                user._Password = hashedPassword;
+                return user;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    static create(loginUser, dbTransaction, user) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+                const isPrivileged = yield loginUser.checkPrivileges(systemCode, 'User - Create');
+                if (!isPrivileged) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'You do not have the privilege to create user');
+                }
+                if (!user.Email && !user.UserName) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Email and Username is required');
+                }
+                yield User.checkUserInfoDuplicated(dbTransaction, {
+                    Email: user.Email,
+                    UserName: user.UserName,
+                    IdType: user.IDType,
+                    IdNo: user.IDNo,
+                    ContactNo: user.ContactNo,
+                });
+                const defaultPassword = User.generateDefaultPassword();
+                user = yield User.setPassword(dbTransaction, user, defaultPassword);
+                const userInfo = {
+                    UserName: user.UserName,
+                    FullName: user.FullName,
+                    IDNo: user.IDNo,
+                    Email: user.Email,
+                    ContactNo: user.ContactNo,
+                    Password: user.Password,
+                    Status: enum_1.UserStatus.ACTIVE,
+                    FirstLoginAt: null,
+                    LastLoginAt: null,
+                    MFAEnabled: null,
+                    MFAConfig: null,
+                    RecoveryEmail: null,
+                    FailedLoginAttemptCount: 0,
+                    LastFailedLoginAt: null,
+                    LastPasswordChangedAt: null,
+                    DefaultPasswordChangedYN: yn_enum_1.YN.No,
+                    NeedToChangePasswordYN: yn_enum_1.YN.Yes,
+                    CreatedById: loginUser.UserId,
+                    CreatedAt: new Date(),
+                    UpdatedById: loginUser.UserId,
+                    UpdatedAt: new Date(),
+                    UserId: null,
+                };
+                const newUser = yield User._Repository.create({
+                    Email: userInfo.Email,
+                    UserName: userInfo.UserName,
+                    Password: userInfo.Password,
+                    Status: userInfo.Status,
+                    DefaultPasswordChangedYN: userInfo.DefaultPasswordChangedYN,
+                    FirstLoginAt: userInfo.FirstLoginAt,
+                    LastLoginAt: userInfo.LastLoginAt,
+                    MFAEnabled: userInfo.MFAEnabled,
+                    MFAConfig: userInfo.MFAConfig,
+                    RecoveryEmail: userInfo.RecoveryEmail,
+                    FailedLoginAttemptCount: userInfo.FailedLoginAttemptCount,
+                    LastFailedLoginAt: userInfo.LastFailedLoginAt,
+                    LastPasswordChangedAt: userInfo.LastPasswordChangedAt,
+                    NeedToChangePasswordYN: userInfo.NeedToChangePasswordYN,
+                    CreatedById: userInfo.CreatedById,
+                    CreatedAt: userInfo.CreatedAt,
+                    UpdatedById: userInfo.UpdatedById,
+                    UpdatedAt: userInfo.UpdatedAt,
+                }, {
+                    transaction: dbTransaction,
+                });
+                userInfo.UserId = newUser.UserId;
+                const userToBeCreated = new User(loginUser.SessionService, dbTransaction, userInfo);
+                const activity = new activity_history_1.Activity();
+                activity.ActivityId = activity.createId();
+                activity.Action = activity_history_1.ActionEnum.ADD;
+                activity.Description = 'Create User';
+                activity.EntityType = 'LoginUser';
+                activity.EntityId = newUser.UserId.toString();
+                activity.EntityValueBefore = JSON.stringify({});
+                activity.EntityValueAfter = JSON.stringify(newUser.get({ plain: true }));
+                yield activity.create(loginUser.ObjectId, dbTransaction);
+                return userToBeCreated;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    incrementFailedLoginAttemptCount(dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const maxFailedLoginAttempts = config_1.ComponentConfig.getComponentConfigValue('@tomei/sso', 'maxFailedLoginAttempts');
+            const autoReleaseYN = config_1.ComponentConfig.getComponentConfigValue('@tomei/sso', 'autoReleaseYN');
+            if (!maxFailedLoginAttempts || !autoReleaseYN) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Missing maxFailedLoginAttempts and or autoReleaseYN. Please set in config file.');
+            }
+            const FailedLoginAttemptCount = this.FailedLoginAttemptCount + 1;
+            const LastFailedLoginAt = new Date();
+            if (FailedLoginAttemptCount > maxFailedLoginAttempts) {
+                this.Status = enum_1.UserStatus.LOCKED;
+            }
+            yield User._Repository.update({
+                FailedLoginAttemptCount: FailedLoginAttemptCount,
+                LastFailedLoginAt: LastFailedLoginAt,
+                Status: this.Status,
+            }, {
+                where: {
+                    UserId: this.UserId,
+                },
+                transaction: dbTransaction,
+            });
+            if (this.Status === enum_1.UserStatus.LOCKED && autoReleaseYN === 'Y') {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Your account has been temporarily locked due to too many failed login attempts, please try again later.');
+            }
+            if (this.Status === enum_1.UserStatus.LOCKED && autoReleaseYN === 'N') {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Your account has been locked due to too many failed login attempts, please contact IT Support for instructions on how to unlock your account');
+            }
+            if (this.Status == enum_1.UserStatus.LOCKED) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid credentials.');
+            }
+        });
+    }
+    static shouldReleaseLock(LastFailedLoginAt) {
+        const minuteToAutoRelease = config_1.ComponentConfig.getComponentConfigValue('@tomei/sso', 'minuteToAutoRelease');
+        const autoReleaseYN = config_1.ComponentConfig.getComponentConfigValue('@tomei/sso', 'autoReleaseYN');
+        if (!minuteToAutoRelease || !autoReleaseYN) {
+            throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Missing minuteToAutoRelease and or autoReleaseYN. Please set in config file.');
+        }
+        if (autoReleaseYN === 'Y') {
+            const lastFailedDate = new Date(LastFailedLoginAt);
+            const currentDate = new Date();
+            const timeDifferenceInMillis = currentDate.getTime() - lastFailedDate.getTime();
+            const timeDifferenceInMinutes = timeDifferenceInMillis / (1000 * 60);
+            if (timeDifferenceInMinutes > +minuteToAutoRelease) {
+                return true;
+            }
+            else {
+                return false;
+            }
+        }
+        else if (autoReleaseYN === 'N') {
+            return false;
+        }
+    }
+    static releaseLock(UserId, dbTransaction) {
+        this._Repository.update({
+            FailedLoginAttemptCount: 0,
+            Status: enum_1.UserStatus.ACTIVE,
+        }, {
+            where: {
+                UserId: UserId,
+            },
+            transaction: dbTransaction,
+        });
+    }
+    static getGroups(loginUser, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+            const isPrivileged = yield loginUser.checkPrivileges(systemCode, 'UserGroup - List Own');
+            if (!isPrivileged) {
+                throw new Error('You do not have permission to list UserGroup.');
+            }
+            const userGroups = yield User._UserGroupRepo.findAll({
+                where: {
+                    UserId: loginUser.ObjectId,
+                    Status: 'Active',
+                },
+                include: [{ model: user_entity_1.default, as: 'User' }, { model: group_entity_1.default }],
+                transaction: dbTransaction,
+            });
+            return userGroups;
+        });
+    }
+    static getInheritedSystemAccess(dbTransaction, group) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataSystemAccesses = yield User._GroupSystemAccessRepo.findAll({
+                where: {
+                    GroupCode: group.GroupCode,
+                    Status: 'Active',
+                },
+                include: [{ model: system_entity_1.default }],
+                transaction: dbTransaction,
+            });
+            let systemAccesses = dataSystemAccesses;
+            if (group.InheritParentPrivilegeYN === 'Y' && group.ParentGroupCode) {
+                const GroupCode = group.ParentGroupCode;
+                const parentGroup = yield User._GroupRepo.findByPk(GroupCode, dbTransaction);
+                const dataParentSystemAccesses = yield User.getInheritedSystemAccess(dbTransaction, parentGroup);
+                const parentSystemAccesses = dataParentSystemAccesses;
+                systemAccesses = systemAccesses.concat(parentSystemAccesses);
+            }
+            return systemAccesses;
+        });
+    }
+    static combineSystemAccess(loginUser, dbTransaction, groups) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const userAccess = yield User._UserSystemAccessRepo.findAll({
+                where: {
+                    UserId: loginUser.ObjectId,
+                    Status: 'Active',
+                },
+                include: [{ model: system_entity_1.default }],
+                transaction: dbTransaction,
+            });
+            const groupAccessPromises = groups.map((e) => __awaiter(this, void 0, void 0, function* () {
+                if (e.InheritParentSystemAccessYN) {
+                    return yield this.getInheritedSystemAccess(dbTransaction, e);
+                }
+                else {
+                    return [];
+                }
+            }));
+            const groupAccess = (yield Promise.all(groupAccessPromises)).flat();
+            const allAccess = userAccess.concat(groupAccess);
+            const uniqueAccess = new Set(allAccess.filter((value, index, self) => {
+                return self.some((prev) => prev.SystemCode === value.SystemCode);
+            }));
+            return Array.from(uniqueAccess);
+        });
+    }
+    static getSystems(loginUser, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+            const isPrivileged = yield loginUser.checkPrivileges(systemCode, 'System – List Own');
+            if (!isPrivileged) {
+                throw new Error('You do not have permission to list UserGroup.');
+            }
+            const groups = yield User.getGroups(loginUser, dbTransaction);
+            const systemAccess = yield User.combineSystemAccess(loginUser, dbTransaction, groups);
+            const output = [];
+            if (systemAccess) {
+                for (let i = 0; i < systemAccess.length; i++) {
+                    const system = yield User._SystemRepository.findOne({
+                        where: {
+                            SystemCode: systemAccess[i].SystemCode,
+                            Status: 'Active',
+                        },
+                    });
+                    output.push({
+                        UserSystemAccessId: systemAccess[i].UserSystemAccessId,
+                        UserId: systemAccess[i].UserId,
+                        SystemCode: systemAccess[i].SystemCode,
+                        Status: systemAccess[i].Status,
+                        CreatedById: systemAccess[i].CreatedById,
+                        UpdatedById: systemAccess[i].UpdatedById,
+                        CreatedAt: systemAccess[i].CreatedAt,
+                        UpdatedAt: systemAccess[i].UpdatedAt,
+                        System: system,
+                    });
+                }
+            }
+            return output;
+        });
+    }
+    static check2FA(loginUser, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const user = yield User._Repository.findOne({
+                    where: {
+                        UserId: loginUser.UserId,
+                    },
+                    transaction: dbTransaction,
+                });
+                if (user.MFAEnabled === 1) {
+                    return true;
+                }
+                return false;
+            }
+            catch (error) {
+                throw error;
+            }
+        });
+    }
+    static setup2FA(userId, dbTransaction) {
+        var _a, _b, _c, _d;
+        return __awaiter(this, void 0, void 0, function* () {
+            const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+            const user = yield User._Repository.findOne({
+                where: {
+                    UserId: userId,
+                },
+            });
+            if (!user) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid Credentials');
+            }
+            const secretCode = speakeasy.generateSecret({ name: systemCode });
+            let userMFAConfig = null;
+            if ((user === null || user === void 0 ? void 0 : user.MFAConfig) !== null && typeof (user === null || user === void 0 ? void 0 : user.MFAConfig) === 'string') {
+                try {
+                    userMFAConfig = JSON.parse(user === null || user === void 0 ? void 0 : user.MFAConfig);
+                }
+                catch (error) {
+                    console.error('Invalid JSON string on MFAConfig:', error);
+                }
+            }
+            const MFAConfig = {
+                totp: {
+                    enabled: true,
+                    secret: secretCode.base32,
+                    issuer: systemCode,
+                },
+                sms: {
+                    enabled: ((_a = userMFAConfig === null || userMFAConfig === void 0 ? void 0 : userMFAConfig.sms) === null || _a === void 0 ? void 0 : _a.enable) || false,
+                    phoneNumber: ((_b = userMFAConfig === null || userMFAConfig === void 0 ? void 0 : userMFAConfig.sms) === null || _b === void 0 ? void 0 : _b.phoneNumber) || '',
+                },
+                email: {
+                    enabled: ((_c = userMFAConfig === null || userMFAConfig === void 0 ? void 0 : userMFAConfig.email) === null || _c === void 0 ? void 0 : _c.enable) || false,
+                    emailAddress: ((_d = userMFAConfig === null || userMFAConfig === void 0 ? void 0 : userMFAConfig.email) === null || _d === void 0 ? void 0 : _d.emailAddress) || '',
+                },
+            };
+            user.MFAEnabled = 0;
+            user.MFAConfig = JSON.stringify(MFAConfig);
+            yield User._Repository.update({
+                MFAEnabled: user.MFAEnabled,
+                MFAConfig: user.MFAConfig,
+            }, {
+                where: {
+                    UserId: userId,
+                },
+                transaction: dbTransaction,
+            });
+            return secretCode.otpauth_url;
+        });
+    }
+    verify2FASetup(userId, mfaToken, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield User._Repository.findOne({
+                where: {
+                    UserId: userId,
+                },
+            });
+            if (!user) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid Credentials');
+            }
+            let userMFAConfig = null;
+            if ((user === null || user === void 0 ? void 0 : user.MFAConfig) !== null && typeof (user === null || user === void 0 ? void 0 : user.MFAConfig) === 'string') {
+                try {
+                    userMFAConfig = JSON.parse(user === null || user === void 0 ? void 0 : user.MFAConfig);
+                }
+                catch (error) {
+                    console.error('Invalid JSON string on MFAConfig:', error);
+                }
+            }
+            const isVerified = yield speakeasy.totp.verify({
+                secret: userMFAConfig.totp.secret,
+                encoding: 'base32',
+                token: mfaToken,
+            });
+            if (!isVerified) {
+                return false;
+            }
+            yield User._Repository.update({
+                MFAEnabled: 1,
+            }, {
+                where: {
+                    UserId: userId,
+                },
+                transaction: dbTransaction,
+            });
+            const userSession = yield this._SessionService.retrieveUserSession(`${userId}`);
+            const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+            const systemLogin = userSession.systemLogins.find((e) => e.code === systemCode);
+            return `${userId}:${systemLogin.sessionId}`;
+        });
+    }
+    verify2FACode(userId, mfaToken, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield User._Repository.findOne({
+                where: {
+                    UserId: userId,
+                },
+                transaction: dbTransaction,
+            });
+            if (!user) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid Credentials');
+            }
+            let userMFAConfig = null;
+            if ((user === null || user === void 0 ? void 0 : user.MFAConfig) !== null && typeof (user === null || user === void 0 ? void 0 : user.MFAConfig) === 'string') {
+                try {
+                    userMFAConfig = JSON.parse(user === null || user === void 0 ? void 0 : user.MFAConfig);
+                }
+                catch (error) {
+                    console.error('Invalid JSON string on MFAConfig:', error);
+                }
+            }
+            const isVerified = yield speakeasy.totp.verify({
+                secret: userMFAConfig.totp.secret,
+                encoding: 'base32',
+                token: mfaToken,
+            });
+            if (!isVerified) {
+                return false;
+            }
+            const userSession = yield this._SessionService.retrieveUserSession(`${userId}`);
+            const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+            const systemLogin = userSession.systemLogins.find((e) => e.code === systemCode);
+            return `${userId}:${systemLogin.sessionId}`;
+        });
+    }
+    addUserGroup(GroupCode, loginUser, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const group = yield User._GroupRepo.findOne({
+                where: {
+                    GroupCode,
+                },
+                transaction: dbTransaction,
+            });
+            if (!group) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid Group Code');
+            }
+            const entityValueAfter = {
+                UserId: this.UserId,
+                GroupCode: group.GroupCode,
+                CreatedAt: new Date(),
+                CreatedById: loginUser.UserId,
+                UpdatedAt: new Date(),
+                UpdatedById: loginUser.UserId,
+            };
+            yield User._UserGroupRepo.create(entityValueAfter, {
+                transaction: dbTransaction,
+            });
+            const activity = new activity_history_1.Activity();
+            activity.ActivityId = activity.createId();
+            activity.Action = activity_history_1.ActionEnum.ADD;
+            activity.Description = 'Add User Group';
+            activity.EntityType = 'UserGroup';
+            activity.EntityId = group.GroupCode;
+            activity.EntityValueBefore = JSON.stringify({});
+            activity.EntityValueAfter = JSON.stringify(entityValueAfter);
+            yield activity.create(loginUser.ObjectId, dbTransaction);
+        });
+    }
+    update(data, loginUser, dbTransaction) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+            const isPrivileged = yield loginUser.checkPrivileges(systemCode, 'User - Update');
+            if (!isPrivileged) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'You do not have the privilege to update user');
+            }
+            if (!this.UserId) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'UserId is required');
+            }
+            if (data.Email !== this.Email || data.UserName !== this.UserName) {
+                yield User.checkUserInfoDuplicated(dbTransaction, {
+                    Email: data.Email,
+                    UserName: data.UserName,
+                });
+            }
+            if (data.BuildingCode) {
+                const building = yield group_entity_1.default.findOne({
+                    where: {
+                        Type: 'Building',
+                        GroupCode: data.BuildingCode,
+                    },
+                    transaction: dbTransaction,
+                });
+                if (!building) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid Building Code');
+                }
+                const userBuilding = yield User._UserGroupRepo.findOne({
+                    where: {
+                        UserId: this.UserId,
+                    },
+                    include: [
+                        {
+                            model: group_entity_1.default,
+                            where: {
+                                Type: 'Building',
+                            },
+                        },
+                    ],
+                    transaction: dbTransaction,
+                });
+                if (userBuilding) {
+                    yield User._UserGroupRepo.update({
+                        GroupCode: data.BuildingCode,
+                        UpdatedAt: new Date(),
+                        UpdatedById: loginUser.UserId,
+                    }, {
+                        where: {
+                            UserId: this.UserId,
+                            GroupCode: userBuilding.GroupCode,
+                        },
+                        transaction: dbTransaction,
+                    });
+                }
+                else {
+                    yield User._UserGroupRepo.create({
+                        UserId: this.UserId,
+                        GroupCode: data.BuildingCode,
+                        CreatedAt: new Date(),
+                        CreatedById: loginUser.UserId,
+                        UpdatedAt: new Date(),
+                        UpdatedById: loginUser.UserId,
+                    }, {
+                        transaction: dbTransaction,
+                    });
+                }
+            }
+            if (data.CompanyCode) {
+                const company = yield group_entity_1.default.findOne({
+                    where: {
+                        Type: 'Company',
+                        GroupCode: data.CompanyCode,
+                    },
+                    transaction: dbTransaction,
+                });
+                if (!company) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid Company Code');
+                }
+                const userCompany = yield User._UserGroupRepo.findOne({
+                    where: {
+                        UserId: this.UserId,
+                    },
+                    include: [
+                        {
+                            model: group_entity_1.default,
+                            where: {
+                                Type: 'Company',
+                            },
+                        },
+                    ],
+                    transaction: dbTransaction,
+                });
+                if (userCompany) {
+                    yield User._UserGroupRepo.update({
+                        GroupCode: data.CompanyCode,
+                        UpdatedAt: new Date(),
+                        UpdatedById: loginUser.UserId,
+                    }, {
+                        where: {
+                            UserId: this.UserId,
+                            GroupCode: userCompany.GroupCode,
+                        },
+                        transaction: dbTransaction,
+                    });
+                }
+                else {
+                    yield User._UserGroupRepo.create({
+                        UserId: this.UserId,
+                        GroupCode: data.CompanyCode,
+                        CreatedAt: new Date(),
+                        CreatedById: loginUser.UserId,
+                        UpdatedAt: new Date(),
+                        UpdatedById: loginUser.UserId,
+                    }, {
+                        transaction: dbTransaction,
+                    });
+                }
+            }
+            if (data.DepartmentCode) {
+                const department = yield group_entity_1.default.findOne({
+                    where: {
+                        Type: 'Department',
+                        GroupCode: data.DepartmentCode,
+                    },
+                    transaction: dbTransaction,
+                });
+                if (!department) {
+                    throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'Invalid Department Code');
+                }
+                const userDepartment = yield User._UserGroupRepo.findOne({
+                    where: {
+                        UserId: this.UserId,
+                    },
+                    include: [
+                        {
+                            model: group_entity_1.default,
+                            where: {
+                                Type: 'Department',
+                            },
+                        },
+                    ],
+                    transaction: dbTransaction,
+                });
+                if (userDepartment) {
+                    yield User._UserGroupRepo.update({
+                        GroupCode: data.DepartmentCode,
+                        UpdatedAt: new Date(),
+                        UpdatedById: loginUser.UserId,
+                    }, {
+                        where: {
+                            UserId: this.UserId,
+                            GroupCode: userDepartment.GroupCode,
+                        },
+                        transaction: dbTransaction,
+                    });
+                }
+                else {
+                    yield User._UserGroupRepo.create({
+                        UserId: this.UserId,
+                        GroupCode: data.DepartmentCode,
+                        CreatedAt: new Date(),
+                        CreatedById: loginUser.UserId,
+                        UpdatedAt: new Date(),
+                        UpdatedById: loginUser.UserId,
+                    }, {
+                        transaction: dbTransaction,
+                    });
+                }
+            }
+            const entityValueBefore = {
+                UserId: this.UserId,
+                UserName: this.UserName,
+                Email: this.Email,
+                Password: this.Password,
+                Status: this.Status,
+                DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                FirstLoginAt: this.FirstLoginAt,
+                LastLoginAt: this.LastLoginAt,
+                MFAEnabled: this.MFAEnabled,
+                MFAConfig: this.MFAConfig,
+                RecoveryEmail: this.RecoveryEmail,
+                FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                LastFailedLoginAt: this.LastFailedLoginAt,
+                LastPasswordChangedAt: this.LastPasswordChangedAt,
+                NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                CreatedById: this.CreatedById,
+                CreatedAt: this.CreatedAt,
+                UpdatedById: this.UpdatedById,
+                UpdatedAt: this.UpdatedAt,
+            };
+            this.UserName = data.UserName;
+            this.Email = data.Email;
+            this.Status = data.Status;
+            this.RecoveryEmail = data.RecoveryEmail;
+            this.UpdatedAt = new Date();
+            this.UpdatedById = loginUser.UserId;
+            yield User._Repository.update({
+                UserName: this.UserName,
+                Email: this.Email,
+                Status: this.Status,
+                RecoveryEmail: this.RecoveryEmail,
+                UpdatedById: this.UpdatedById,
+                UpdatedAt: this.UpdatedAt,
+            }, {
+                where: {
+                    UserId: this.UserId,
+                },
+                transaction: dbTransaction,
+            });
+            const entityValueAfter = {
+                UserId: this.UserId,
+                UserName: this.UserName,
+                Email: this.Email,
+                Password: this.Password,
+                Status: this.Status,
+                DefaultPasswordChangedYN: this.DefaultPasswordChangedYN,
+                FirstLoginAt: this.FirstLoginAt,
+                LastLoginAt: this.LastLoginAt,
+                MFAEnabled: this.MFAEnabled,
+                MFAConfig: this.MFAConfig,
+                RecoveryEmail: this.RecoveryEmail,
+                FailedLoginAttemptCount: this.FailedLoginAttemptCount,
+                LastFailedLoginAt: this.LastFailedLoginAt,
+                LastPasswordChangedAt: this.LastPasswordChangedAt,
+                NeedToChangePasswordYN: this.NeedToChangePasswordYN,
+                CreatedById: this.CreatedById,
+                CreatedAt: this.CreatedAt,
+                UpdatedById: this.UpdatedById,
+                UpdatedAt: this.UpdatedAt,
+            };
+            const activity = new activity_history_1.Activity();
+            activity.ActivityId = activity.createId();
+            activity.Action = activity_history_1.ActionEnum.UPDATE;
+            activity.Description = 'Update User';
+            activity.EntityType = 'LoginUser';
+            activity.EntityId = this.UserId.toString();
+            activity.EntityValueBefore = JSON.stringify(entityValueBefore);
+            activity.EntityValueAfter = JSON.stringify(entityValueAfter);
+            yield activity.create(loginUser.ObjectId, dbTransaction);
+            return this;
+        });
+    }
+    static findById(loginUser, dbTransaction, UserId) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            const systemCode = config_1.ApplicationConfig.getComponentConfigValue('system-code');
+            const isPrivileged = yield loginUser.checkPrivileges(systemCode, 'USER_VIEW');
+            if (!isPrivileged) {
+                throw new general_1.ClassError('LoginUser', 'LoginUserErrMsg0X', 'You do not have the privilege to find user');
+            }
+            const user = yield User._Repository.findOne({
+                where: {
+                    UserId: UserId,
+                    Status: 'Active',
+                },
+                transaction: dbTransaction,
+            });
+            const userAttr = {
+                UserId: user.UserId,
+                UserName: user.UserName,
+                FullName: ((_a = user === null || user === void 0 ? void 0 : user.Staff) === null || _a === void 0 ? void 0 : _a.FullName) || null,
+                IDNo: ((_b = user === null || user === void 0 ? void 0 : user.Staff) === null || _b === void 0 ? void 0 : _b.IdNo) || null,
+                ContactNo: ((_c = user === null || user === void 0 ? void 0 : user.Staff) === null || _c === void 0 ? void 0 : _c.Mobile) || null,
+                Email: user.Email,
+                Password: user.Password,
+                Status: user.Status,
+                DefaultPasswordChangedYN: user.DefaultPasswordChangedYN,
+                FirstLoginAt: user.FirstLoginAt,
+                LastLoginAt: user.LastLoginAt,
+                MFAEnabled: user.MFAEnabled,
+                MFAConfig: user.MFAConfig,
+                RecoveryEmail: user.RecoveryEmail,
+                FailedLoginAttemptCount: user.FailedLoginAttemptCount,
+                LastFailedLoginAt: user.LastFailedLoginAt,
+                LastPasswordChangedAt: user.LastPasswordChangedAt,
+                NeedToChangePasswordYN: user.NeedToChangePasswordYN,
+                CreatedById: user.CreatedById,
+                CreatedAt: user.CreatedAt,
+                UpdatedById: user.UpdatedById,
+                UpdatedAt: user.UpdatedAt,
+                staffs: (user === null || user === void 0 ? void 0 : user.Staff) || null,
+            };
+            return new User(null, dbTransaction, userAttr);
+        });
+    }
+}
+exports.User = User;
+User._Repository = new user_repository_1.UserRepository();
+User._LoginHistoryRepository = new login_history_repository_1.LoginHistoryRepository();
+User._UserGroupRepo = new user_group_repository_1.UserGroupRepository();
+User._UserPrivilegeRepo = new user_privilege_repository_1.UserPrivilegeRepository();
+User._UserObjectPrivilegeRepo = new user_object_privilege_repository_1.UserObjectPrivilegeRepository();
+User._GroupObjectPrivilegeRepo = new group_object_privilege_repository_1.GroupObjectPrivilegeRepository();
+User._SystemRepository = new system_repository_1.SystemRepository();
+User._UserSystemAccessRepo = new user_system_access_repository_1.UserSystemAccessRepository();
+User._GroupSystemAccessRepo = new group_system_access_repository_1.GroupSystemAccessRepository();
+User._GroupRepo = new group_repository_1.GroupRepository();
+//# sourceMappingURL=user.js.map