@trokky/trokky 2.0.3

package/dist/core/core/engine.js

@@ -0,0 +1,1074 @@
+import { detectCryptoAdapter } from '../crypto/adapter.js';
+import { SecurityValidator } from '../security/validation.js';
+import { SchemaRegistry } from '../schema/registry.js';
+import { DocumentValidator } from '../validation/validator.js';
+import { RateLimiter } from '../security/rate-limiter.js';
+import { IdGenerator } from '../utils/id-generator.js';
+import { createLogger } from '../utils/logger.js';
+import { createImageProcessor } from '../media/image-processor.js';
+import { TrokkyEventBus, MemoryEventStorage } from '../events/index.js';
+import { systemStartup } from '../events/index.js';
+import { OAuth2AuthorizationServer } from '../security/oauth2/index.js';
+import { AuthService } from '../services/auth-service.js';
+import { MFAService, generateSecureSecret } from '../services/mfa-service.js';
+import { TrustedDeviceService } from '../services/trusted-device-service.js';
+import { OAuthService } from '../services/oauth-service.js';
+import { PasskeyService } from '../services/passkey-service.js';
+import { UserService } from '../services/user-service.js';
+import { TokenService } from '../services/token-service.js';
+import { DocumentService } from '../services/document-service.js';
+import { MediaService } from '../services/media-service.js';
+import { CaptchaService } from '../services/captcha-service.js';
+import { OAuth2ServerService } from '../services/oauth2-server-service.js';
+export class TrokkyCore {
+    // Split storage adapters (new architecture)
+    dataStorage;
+    mediaStorage;
+    // Legacy unified storage adapter (for backward compatibility)
+    storage;
+    schemas;
+    validator;
+    idGenerator;
+    rateLimiter;
+    securityEnabled;
+    options;
+    jwtSecret;
+    config;
+    auditLogger;
+    cryptoAdapter;
+    imageProcessor; // Initialized in init() method
+    imageProcessorConfig;
+    logger = createLogger('core', 'TrokkyCore');
+    auditLog = createLogger('core', 'Audit');
+    // Event system
+    eventBus;
+    eventsEnabled;
+    // OAuth2 Authorization Server (enables CLI login and external SSO)
+    oauth2Server = null;
+    // Secure callbacks for sensitive operations (not logged in events)
+    userCreatedWithPasswordCallback;
+    // Extracted domain services (authentication, MFA, trusted devices, OAuth, passkeys)
+    authService;
+    mfaService;
+    trustedDeviceService;
+    oauthService;
+    passkeyService;
+    userService;
+    tokenService;
+    documentService;
+    mediaService;
+    captchaService;
+    oauth2ServerService;
+    constructor(config, storageAdapterOrAdapters, options = {}) {
+        // Determine if we're using unified or split adapters
+        if (this.isTrokkyStorageAdapters(storageAdapterOrAdapters)) {
+            // Split adapters (new architecture)
+            this.dataStorage = storageAdapterOrAdapters.data;
+            this.mediaStorage = storageAdapterOrAdapters.media;
+            this.storage = undefined;
+            this.logger.info('TrokkyCore initialized with split storage adapters', {
+                dataAdapter: this.dataStorage.constructor?.name || 'DataStorageAdapter',
+                mediaAdapter: this.mediaStorage.constructor?.name || 'MediaStorageAdapter'
+            });
+            // Validate split adapters have required methods
+            this.validateStorageAdapters();
+        }
+        else {
+            // Unified adapter (legacy support)
+            this.storage = storageAdapterOrAdapters;
+            // Create adapter wrappers for backward compatibility
+            this.dataStorage = this.createDataAdapterWrapper(storageAdapterOrAdapters);
+            this.mediaStorage = this.createMediaAdapterWrapper(storageAdapterOrAdapters);
+            this.logger.warn('TrokkyCore using legacy unified storage adapter - consider migrating to split adapters', {
+                adapter: storageAdapterOrAdapters.constructor?.name || 'StorageAdapter'
+            });
+        }
+        this.options = options;
+        this.config = config;
+        this.schemas = options.schemaRegistry || new SchemaRegistry(config.schemas, config.features);
+        this.validator = options.validator || new DocumentValidator(this.schemas);
+        this.idGenerator = options.idGenerator || new IdGenerator();
+        this.securityEnabled = options.enableSecurity ?? config.security?.validateInput ?? true;
+        // Initialize JWT secret (use provided secret, environment variable if available, or generate one)
+        const envJwt = (typeof process !== 'undefined' && process.env?.TROKKY_JWT_SECRET)
+            ? process.env.TROKKY_JWT_SECRET
+            : undefined;
+        this.jwtSecret = options.jwtSecret || envJwt || this.generateSecureSecret();
+        // Initialize audit logger
+        this.auditLogger = options.auditLogger;
+        // Initialize crypto adapter
+        this.cryptoAdapter = options.cryptoAdapter || detectCryptoAdapter({
+            ...options.cryptoOptions,
+            adapterType: options.cryptoOptions?.adapterType || 'auto'
+        });
+        // Image processor will be initialized in init() method
+        // Store config for async initialization
+        this.imageProcessorConfig = options.imageProcessorConfig || {
+            type: config.media?.imageProcessor || 'none',
+            variants: config.media?.imageVariants || [],
+            options: config.media?.imageProcessorOptions || {}
+        };
+        if (config.security?.rateLimitEnabled || config.api?.rateLimit) {
+            const rateLimitConfig = {
+                windowMs: config.api?.rateLimit?.windowMs || 60 * 1000,
+                maxRequests: config.api?.rateLimit?.maxRequests || 1000
+            };
+            this.rateLimiter = options.rateLimiter || new RateLimiter(rateLimitConfig);
+        }
+        // Initialize event system
+        this.eventsEnabled = options.enableEvents ?? true;
+        if (options.eventBus) {
+            this.eventBus = options.eventBus;
+        }
+        else {
+            // Create default event bus with memory storage
+            const eventStorage = new MemoryEventStorage({
+                maxEvents: 1000,
+                autoCleanup: true
+            });
+            const eventBusConfig = {
+                maxHistorySize: 1000,
+                enablePersistence: true,
+                storage: eventStorage,
+                enableWebhooks: true,
+                maxConcurrentWebhooks: 5,
+                dataStorage: this.dataStorage?.saveWebhook && this.dataStorage?.listWebhooks && this.dataStorage?.deleteWebhook
+                    ? this.dataStorage
+                    : undefined,
+                ...options.eventBusConfig
+            };
+            this.eventBus = new TrokkyEventBus(eventBusConfig);
+        }
+        // Initialize extracted domain services
+        this.authService = new AuthService({
+            cryptoAdapter: this.cryptoAdapter,
+            jwtSecret: this.jwtSecret,
+            config: this.config,
+            logger: this.logger,
+            getUser: (id) => this.getUser(id),
+            getUserByUsername: (username) => this.getUserByUsername(username),
+            updateUser: (id, userData) => this.updateUser(id, userData),
+            // Adapters that support a conditional write set updatedAt themselves
+            updateUserIf: this.dataStorage.saveUserIf
+                ? async (id, userData, condition) => {
+                    // Same guards as updateUser(); only the write itself is conditional.
+                    if (this.rateLimiter) {
+                        await this.rateLimiter.checkRateLimit('updateUser');
+                    }
+                    if (this.securityEnabled) {
+                        SecurityValidator.validateDocumentId(id);
+                    }
+                    return this.dataStorage.saveUserIf(id, userData, condition);
+                }
+                : undefined,
+            validateAppToken: (token) => this.validateAppToken(token),
+            logAuditEvent: (event) => this.logAuditEvent(event),
+            checkMFARequired: (userId) => this.mfaService.checkMFARequired(userId),
+            isDeviceTrusted: (userId, deviceId) => this.trustedDeviceService.isDeviceTrusted(userId, deviceId),
+            trustDevice: (userId, deviceId, deviceName, deviceOptions) => this.trustedDeviceService.trustDevice(userId, deviceId, deviceName, deviceOptions),
+            getTOTPService: (issuer) => this.mfaService.getTOTPService(issuer)
+        });
+        this.mfaService = new MFAService({
+            logger: this.logger,
+            eventBus: this.eventBus,
+            eventsEnabled: this.eventsEnabled,
+            getUser: (id) => this.getUser(id),
+            updateUser: (id, userData) => this.updateUser(id, userData),
+            getSettings: () => this.getSettings(),
+            verifyPassword: (plainPassword, hashedPassword) => this.authService.verifyPassword(plainPassword, hashedPassword),
+            logAuditEvent: (event) => this.logAuditEvent(event)
+        });
+        this.trustedDeviceService = new TrustedDeviceService({
+            logger: this.logger,
+            getUser: (id) => this.getUser(id),
+            updateUser: (id, userData) => this.updateUser(id, userData),
+            getSettings: () => this.getSettings()
+        });
+        this.oauthService = new OAuthService({
+            config: this.config,
+            logger: this.logger,
+            dataStorage: this.dataStorage,
+            getUser: (id) => this.getUser(id),
+            updateUser: (id, userData) => this.updateUser(id, userData),
+            listUsers: (listOptions) => this.listUsers(listOptions),
+            logAuditEvent: (event) => this.logAuditEvent(event),
+            checkMFARequired: (userId) => this.mfaService.checkMFARequired(userId),
+            isDeviceTrusted: (userId, deviceId) => this.trustedDeviceService.isDeviceTrusted(userId, deviceId),
+            issueFullTokens: (user, tokenOptions) => this.authService.issueFullTokens(user, tokenOptions),
+            generateMFAPendingToken: (user, methods) => this.authService.generateMFAPendingToken(user, methods),
+            generateMFASetupToken: (user, allowedMethods) => this.authService.generateMFASetupToken(user, allowedMethods),
+            generateAuthToken: (user, expiresIn, rememberMe) => this.authService.generateAuthToken(user, expiresIn, rememberMe),
+            verifyAuthToken: (token) => this.authService.verifyAuthToken(token)
+        });
+        this.passkeyService = new PasskeyService({
+            config: this.config,
+            logger: this.logger,
+            dataStorage: this.dataStorage,
+            getUser: (id) => this.getUser(id),
+            updateUser: (id, userData) => this.updateUser(id, userData),
+            listUsers: (listOptions) => this.listUsers(listOptions),
+            logAuditEvent: (event) => this.logAuditEvent(event),
+            checkMFARequired: (userId) => this.mfaService.checkMFARequired(userId),
+            isDeviceTrusted: (userId, deviceId) => this.trustedDeviceService.isDeviceTrusted(userId, deviceId),
+            issueFullTokens: (user, tokenOptions) => this.authService.issueFullTokens(user, tokenOptions),
+            generateMFAPendingToken: (user, methods) => this.authService.generateMFAPendingToken(user, methods),
+            generateMFASetupToken: (user, allowedMethods) => this.authService.generateMFASetupToken(user, allowedMethods)
+        });
+        this.userService = new UserService({
+            logger: this.logger,
+            dataStorage: this.dataStorage,
+            idGenerator: this.idGenerator,
+            rateLimiter: this.rateLimiter,
+            securityEnabled: this.securityEnabled,
+            eventBus: this.eventBus,
+            hashPassword: (password) => this.hashPassword(password),
+            checkWeakPassword: (password) => this.checkWeakPassword(password),
+            logAuditEvent: (event) => this.logAuditEvent(event),
+            getUserCreatedWithPasswordCallback: () => this.userCreatedWithPasswordCallback
+        });
+        this.tokenService = new TokenService({
+            dataStorage: this.dataStorage,
+            idGenerator: this.idGenerator,
+            cryptoAdapter: this.cryptoAdapter,
+            rateLimiter: this.rateLimiter,
+            securityEnabled: this.securityEnabled,
+            logAuditEvent: (event) => this.logAuditEvent(event)
+        });
+        this.documentService = new DocumentService({
+            logger: this.logger,
+            auditLog: this.auditLog,
+            dataStorage: this.dataStorage,
+            schemas: this.schemas,
+            idGenerator: this.idGenerator,
+            rateLimiter: this.rateLimiter,
+            securityEnabled: this.securityEnabled,
+            eventBus: this.eventBus,
+            eventsEnabled: this.eventsEnabled,
+            validateDocument: (collection, data) => this.validateDocument(collection, data)
+        });
+        this.mediaService = new MediaService({
+            config: this.config,
+            logger: this.logger,
+            mediaStorage: this.mediaStorage,
+            idGenerator: this.idGenerator,
+            rateLimiter: this.rateLimiter,
+            securityEnabled: this.securityEnabled,
+            eventBus: this.eventBus,
+            eventsEnabled: this.eventsEnabled,
+            getImageProcessor: () => this.imageProcessor
+        });
+        this.captchaService = new CaptchaService({
+            config: this.config,
+            logger: this.logger
+        });
+        this.oauth2ServerService = new OAuth2ServerService({
+            logger: this.logger,
+            cryptoAdapter: this.cryptoAdapter,
+            jwtSecret: this.jwtSecret,
+            getOAuth2Server: () => this.oauth2Server,
+            getOAuth2Options: () => this.options.oauth2,
+            getUser: (id) => this.getUser(id),
+            updateUser: (id, userData) => this.updateUser(id, userData)
+        });
+        // Emit system startup event
+        if (this.eventsEnabled) {
+            this.eventBus.emitEvent(systemStartup('TrokkyCore')).catch(error => {
+                this.logger.warn('Failed to emit system startup event', error);
+            });
+        }
+    }
+    // Public getters for external access
+    /**
+     * Get the event bus instance for emitting custom events
+     */
+    get events() {
+        return this.eventBus;
+    }
+    /**
+     * Get the configuration
+     */
+    get configuration() {
+        return this.config;
+    }
+    /**
+     * Register a secure callback for when users are created with temporary passwords
+     * This callback is NOT part of the event system and does not get logged
+     * Used by mail services to send welcome emails with credentials
+     */
+    onUserCreatedWithPassword(callback) {
+        this.userCreatedWithPasswordCallback = callback;
+        this.logger.debug('Registered secure callback for user creation with password');
+    }
+    /**
+     * Check rate limit for a specific operation
+     * Allows routes and external code to use the rate limiter
+     */
+    async checkRateLimit(operation, context) {
+        if (this.rateLimiter) {
+            await this.rateLimiter.checkRateLimit(operation, context);
+        }
+    }
+    // Helper methods for adapter management
+    isTrokkyStorageAdapters(adapter) {
+        return adapter &&
+            typeof adapter === 'object' &&
+            'data' in adapter &&
+            'media' in adapter &&
+            typeof adapter.data === 'object' &&
+            typeof adapter.media === 'object';
+    }
+    createDataAdapterWrapper(storage) {
+        return {
+            // Document operations
+            getDocument: storage.getDocument.bind(storage),
+            saveDocument: storage.saveDocument.bind(storage),
+            listDocuments: storage.listDocuments.bind(storage),
+            deleteDocument: storage.deleteDocument.bind(storage),
+            // User operations (with fallback if not implemented)
+            getUser: storage.getUser?.bind(storage) || (() => { throw new Error('User operations not supported by unified adapter'); }),
+            saveUser: storage.saveUser?.bind(storage) || (() => { throw new Error('User operations not supported by unified adapter'); }),
+            saveUserIf: storage.saveUserIf?.bind(storage),
+            listUsers: storage.listUsers?.bind(storage) || (() => { throw new Error('User operations not supported by unified adapter'); }),
+            deleteUser: storage.deleteUser?.bind(storage) || (() => { throw new Error('User operations not supported by unified adapter'); }),
+            getUserByUsername: storage.getUserByUsername?.bind(storage) || (() => { throw new Error('User operations not supported by unified adapter'); }),
+            getUserByEmail: storage.getUserByEmail?.bind(storage) || (() => { throw new Error('User operations not supported by unified adapter'); }),
+            // App token operations (with fallback if not implemented)
+            getAppToken: storage.getAppToken?.bind(storage) || (() => { throw new Error('App token operations not supported by unified adapter'); }),
+            saveAppToken: storage.saveAppToken?.bind(storage) || (() => { throw new Error('App token operations not supported by unified adapter'); }),
+            listAppTokens: storage.listAppTokens?.bind(storage) || (() => { throw new Error('App token operations not supported by unified adapter'); }),
+            deleteAppToken: storage.deleteAppToken?.bind(storage) || (() => { throw new Error('App token operations not supported by unified adapter'); }),
+            getAppTokenByHash: storage.getAppTokenByHash?.bind(storage) || (() => { throw new Error('App token operations not supported by unified adapter'); }),
+            // Utility operations
+            healthCheck: storage.healthCheck.bind(storage),
+            migrate: storage.migrate?.bind(storage)
+        };
+    }
+    createMediaAdapterWrapper(storage) {
+        return {
+            // File operations
+            uploadFile: storage.uploadFile.bind(storage),
+            getFile: storage.getFile.bind(storage),
+            updateFile: storage.updateFile?.bind(storage) || (() => { throw new Error('File update not supported by unified adapter'); }),
+            getFileContent: storage.getFileContent.bind(storage),
+            listMedia: storage.listMedia?.bind(storage) || (() => { throw new Error('Media listing not supported by unified adapter'); }),
+            deleteFile: storage.deleteFile.bind(storage),
+            // Variant operations (with fallback if not implemented)
+            saveVariantFile: storage.saveVariantFile?.bind(storage) || (() => { throw new Error('Variant operations not supported by unified adapter'); }),
+            getVariantContent: storage.getVariantContent?.bind(storage) || (() => { throw new Error('Variant operations not supported by unified adapter'); }),
+            deleteVariantFiles: storage.deleteVariantFiles?.bind(storage) || (() => { throw new Error('Variant operations not supported by unified adapter'); }),
+            // Utility operations
+            healthCheck: storage.healthCheck.bind(storage)
+        };
+    }
+    // Adapter validation
+    validateStorageAdapters() {
+        // Validate DataStorageAdapter has required methods
+        const requiredDataMethods = [
+            'getDocument', 'saveDocument', 'listDocuments', 'deleteDocument',
+            'getUser', 'saveUser', 'listUsers', 'deleteUser', 'getUserByUsername', 'getUserByEmail',
+            'getAppToken', 'saveAppToken', 'listAppTokens', 'deleteAppToken', 'getAppTokenByHash',
+            'healthCheck'
+        ];
+        for (const method of requiredDataMethods) {
+            if (typeof this.dataStorage[method] !== 'function') {
+                throw new Error(`DataStorageAdapter missing required method: ${method}`);
+            }
+        }
+        // Validate MediaStorageAdapter has required methods
+        const requiredMediaMethods = [
+            'uploadFile', 'getFile', 'getFileContent', 'deleteFile', 'healthCheck'
+        ];
+        for (const method of requiredMediaMethods) {
+            if (typeof this.mediaStorage[method] !== 'function') {
+                throw new Error(`MediaStorageAdapter missing required method: ${method}`);
+            }
+        }
+        this.logger.debug('Storage adapters validation passed', {
+            dataMethodCount: requiredDataMethods.length,
+            mediaMethodCount: requiredMediaMethods.length
+        });
+    }
+    // Public getters
+    getEventBus() {
+        return this.eventBus;
+    }
+    // Initialization
+    async init() {
+        // Initialize image processor asynchronously
+        if (!this.options.imageProcessor) {
+            this.imageProcessor = await createImageProcessor(this.imageProcessorConfig);
+        }
+        else {
+            this.imageProcessor = this.options.imageProcessor;
+        }
+        // Initialize OAuth2 Authorization Server if enabled
+        if (this.options.oauth2?.enabled) {
+            const oauth2Config = this.options.oauth2;
+            if (!oauth2Config.issuer) {
+                this.logger.warn('OAuth2 enabled but no issuer configured - using default localhost');
+            }
+            this.oauth2Server = new OAuth2AuthorizationServer({
+                issuer: oauth2Config.issuer || 'http://localhost:3000',
+                jwtSecret: this.jwtSecret,
+                accessTokenTtl: oauth2Config.accessTokenTtl,
+                refreshTokenTtl: oauth2Config.refreshTokenTtl,
+                deviceCodeTtl: oauth2Config.deviceCodeTtl,
+                authCodeTtl: oauth2Config.authCodeTtl,
+                pollingInterval: oauth2Config.pollingInterval,
+                clients: oauth2Config.clients
+            });
+            this.logger.info('OAuth2 Authorization Server initialized', {
+                issuer: oauth2Config.issuer || 'http://localhost:3000',
+                clients: oauth2Config.clients?.length || 0
+            });
+        }
+        // Setup admin user from environment variables if configured
+        if (this.options.setupAdminFromEnv) {
+            await this.setupAdminFromEnv();
+        }
+    }
+    // Document operations
+    async getDocument(collection, id) {
+        return this.documentService.getDocument(collection, id);
+    }
+    async saveDocument(collection, data, auditContext) {
+        return this.documentService.saveDocument(collection, data, auditContext);
+    }
+    async listDocuments(collection, options) {
+        return this.documentService.listDocuments(collection, options);
+    }
+    async countDocuments(collection, filter) {
+        return this.documentService.countDocuments(collection, filter);
+    }
+    async deleteDocument(collection, id, auditContext) {
+        return this.documentService.deleteDocument(collection, id, auditContext);
+    }
+    // ==========================================================================
+    // AUDIT LOG OPERATIONS
+    // ==========================================================================
+    /**
+     * Get audit logs for a specific document
+     */
+    async getDocumentAuditLogs(documentId, options) {
+        return this.documentService.getDocumentAuditLogs(documentId, options);
+    }
+    /**
+     * Get audit logs for a collection
+     */
+    async getCollectionAuditLogs(collection, options) {
+        return this.documentService.getCollectionAuditLogs(collection, options);
+    }
+    /**
+     * Get audit logs for a specific actor
+     */
+    async getActorAuditLogs(actorId, options) {
+        return this.documentService.getActorAuditLogs(actorId, options);
+    }
+    // Media operations
+    async uploadMedia(file) {
+        return this.mediaService.uploadMedia(file);
+    }
+    async getMedia(id) {
+        return this.mediaService.getMedia(id);
+    }
+    async updateMedia(id, metadata) {
+        return this.mediaService.updateMedia(id, metadata);
+    }
+    async getMediaContent(id) {
+        return this.mediaService.getMediaContent(id);
+    }
+    async listMedia(options) {
+        return this.mediaService.listMedia(options);
+    }
+    async deleteMedia(id) {
+        return this.mediaService.deleteMedia(id);
+    }
+    async regenerateMediaVariants(id) {
+        return this.mediaService.regenerateMediaVariants(id);
+    }
+    // Schema operations
+    getSchema(name) {
+        return this.schemas.getSchema(name);
+    }
+    getAllSchemas() {
+        return this.schemas.getAllSchemas();
+    }
+    validateDocument(collection, data) {
+        return this.validator.validateDocument(collection, data);
+    }
+    // Image processing operations
+    getImageUrl(imageId, variantName) {
+        return this.mediaService.getImageUrl(imageId, variantName);
+    }
+    async getImageProcessor() {
+        return this.mediaService.getImageProcessor();
+    }
+    /**
+     * Get storage adapter (legacy unified adapter)
+     * @deprecated Use getDataStorageAdapter() and getMediaStorageAdapter() instead
+     */
+    getStorageAdapter() {
+        return this.storage || null;
+    }
+    /**
+     * Get data storage adapter
+     */
+    getDataStorageAdapter() {
+        return this.dataStorage;
+    }
+    /**
+     * Get media storage adapter
+     */
+    getMediaStorageAdapter() {
+        return this.mediaStorage;
+    }
+    /**
+     * Get both storage adapters
+     */
+    getStorageAdapters() {
+        return {
+            data: this.dataStorage,
+            media: this.mediaStorage
+        };
+    }
+    // Health check
+    async healthCheck() {
+        try {
+            // Check health of both storage adapters
+            const dataStorageHealthy = await this.dataStorage.healthCheck();
+            const mediaStorageHealthy = await this.mediaStorage.healthCheck();
+            const storageHealthy = dataStorageHealthy && mediaStorageHealthy;
+            const schemasLoaded = this.schemas.getAllSchemas().length > 0;
+            const imageProcessorHealthy = await this.imageProcessor.healthCheck();
+            return storageHealthy && schemasLoaded && imageProcessorHealthy;
+        }
+        catch {
+            return false;
+        }
+    }
+    // Utility methods
+    validateAndSanitizeMediaFile(file) {
+        return this.mediaService.validateAndSanitizeMediaFile(file);
+    }
+    sanitizeFilename(filename) {
+        return this.mediaService.sanitizeFilename(filename);
+    }
+    getFileExtension(filename) {
+        return this.mediaService.getFileExtension(filename);
+    }
+    // User management operations (system entities)
+    async createUser(userData) {
+        return this.userService.createUser(userData);
+    }
+    async getUser(id) {
+        return this.userService.getUser(id);
+    }
+    async getUserByUsername(username) {
+        return this.userService.getUserByUsername(username);
+    }
+    async getUserByEmail(email) {
+        return this.userService.getUserByEmail(email);
+    }
+    async updateUser(id, userData) {
+        return this.userService.updateUser(id, userData);
+    }
+    async listUsers(options) {
+        return this.userService.listUsers(options);
+    }
+    async deleteUser(id) {
+        return this.userService.deleteUser(id);
+    }
+    // App Token management operations
+    async listAppTokens(options) {
+        return this.tokenService.listAppTokens(options);
+    }
+    async createAppToken(tokenData, createdBy) {
+        return this.tokenService.createAppToken(tokenData, createdBy);
+    }
+    async getAppToken(id) {
+        return this.tokenService.getAppToken(id);
+    }
+    async validateAppToken(token) {
+        return this.tokenService.validateAppToken(token);
+    }
+    async deleteAppToken(id) {
+        return this.tokenService.deleteAppToken(id);
+    }
+    // Authentication utilities
+    async verifyPassword(plainPassword, hashedPassword) {
+        return this.authService.verifyPassword(plainPassword, hashedPassword);
+    }
+    /**
+     * Hash a password using the configured crypto adapter
+     * Exposed publicly to ensure consistent hashing across all password operations
+     */
+    async hashPassword(password) {
+        return this.authService.hashPassword(password);
+    }
+    getDefaultPermissions(role) {
+        return this.userService.getDefaultPermissions(role);
+    }
+    checkWeakPassword(password) {
+        return this.authService.checkWeakPassword(password);
+    }
+    // JWT Token Management
+    async generateAuthToken(user, expiresIn = '24h', rememberMe) {
+        return this.authService.generateAuthToken(user, expiresIn, rememberMe);
+    }
+    async verifyAuthToken(token) {
+        return this.authService.verifyAuthToken(token);
+    }
+    /**
+     * Unified token validation that handles both JWT and API tokens
+     * Returns a consistent UserSession interface for both token types
+     */
+    async verifyAnyToken(token) {
+        return this.authService.verifyAnyToken(token);
+    }
+    /**
+     * Authentication result types for MFA support
+     */
+    async authenticateUser(username, password, options = {}) {
+        return this.authService.authenticateUser(username, password, options);
+    }
+    /**
+     * Issue full authentication tokens after successful login (including MFA if required)
+     */
+    async issueFullTokens(user, options = {}) {
+        return this.authService.issueFullTokens(user, options);
+    }
+    /**
+     * Generate MFA pending token (used when MFA verification is needed)
+     */
+    async generateMFAPendingToken(user, methods) {
+        return this.authService.generateMFAPendingToken(user, methods);
+    }
+    /**
+     * Generate MFA setup token (used when org requires MFA but user hasn't set it up)
+     */
+    async generateMFASetupToken(user, allowedMethods) {
+        return this.authService.generateMFASetupToken(user, allowedMethods);
+    }
+    /**
+     * Complete MFA verification and issue full tokens
+     * Call this after verifyMFACode returns true
+     */
+    async completeMFAAuthentication(mfaToken, options = {}) {
+        return this.authService.completeMFAAuthentication(mfaToken, options);
+    }
+    /**
+     * Verify MFA setup token and return user info
+     */
+    async verifyMFASetupToken(setupToken) {
+        return this.authService.verifyMFASetupToken(setupToken);
+    }
+    /**
+     * Verify any MFA token (pending or setup) and return payload
+     */
+    async verifyMFAToken(token) {
+        return this.authService.verifyMFAToken(token);
+    }
+    /**
+     * Complete MFA setup and issue full authentication tokens
+     * Used when a user sets up MFA during the login flow (when org requires MFA)
+     */
+    async completeMFASetupAndLogin(setupToken, options = {}) {
+        return this.authService.completeMFASetupAndLogin(setupToken, options);
+    }
+    /**
+     * Verify a backup code for a user
+     * Returns result with remaining codes if valid
+     */
+    async verifyBackupCode(userId, code) {
+        return this.authService.verifyBackupCode(userId, code);
+    }
+    async refreshAuthToken(refreshToken) {
+        return this.authService.refreshAuthToken(refreshToken);
+    }
+    // ==========================================================================
+    // OAuth Methods
+    // ==========================================================================
+    /**
+     * Link an OAuth provider to an existing user
+     */
+    async linkOAuthProvider(userId, provider) {
+        return this.oauthService.linkOAuthProvider(userId, provider);
+    }
+    /**
+     * Unlink an OAuth provider from a user
+     */
+    async unlinkOAuthProvider(userId, providerName) {
+        return this.oauthService.unlinkOAuthProvider(userId, providerName);
+    }
+    /**
+     * Authenticate a user via OAuth provider
+     * Returns null if no user is linked to this provider
+     * Returns AuthenticationResult which may require MFA verification or setup
+     */
+    async authenticateWithOAuth(providerName, providerId, options) {
+        return this.oauthService.authenticateWithOAuth(providerName, providerId, options);
+    }
+    /**
+     * Find a user by OAuth provider
+     */
+    async getUserByOAuthProvider(providerName, providerId) {
+        return this.oauthService.getUserByOAuthProvider(providerName, providerId);
+    }
+    /**
+     * Check if OAuth is configured for a provider
+     */
+    isOAuthConfigured(providerName) {
+        return this.oauthService.isOAuthConfigured(providerName);
+    }
+    /**
+     * Get OAuth configuration for a provider
+     */
+    getOAuthConfig(providerName) {
+        return this.oauthService.getOAuthConfig(providerName);
+    }
+    // ==========================================================================
+    // Passkey/WebAuthn Methods
+    // ==========================================================================
+    /**
+     * Check if passkey authentication is configured
+     */
+    isPasskeyConfigured() {
+        return this.passkeyService.isPasskeyConfigured();
+    }
+    /**
+     * Get passkey configuration
+     */
+    getPasskeyConfig() {
+        return this.passkeyService.getPasskeyConfig();
+    }
+    /**
+     * Find a user by passkey credential ID
+     */
+    async getUserByPasskeyCredentialId(credentialId) {
+        return this.passkeyService.getUserByPasskeyCredentialId(credentialId);
+    }
+    /**
+     * Add a passkey credential to a user
+     */
+    async addPasskeyToUser(userId, credential) {
+        return this.passkeyService.addPasskeyToUser(userId, credential);
+    }
+    /**
+     * Remove a passkey credential from a user
+     */
+    async removePasskeyFromUser(userId, credentialId) {
+        return this.passkeyService.removePasskeyFromUser(userId, credentialId);
+    }
+    /**
+     * Update a passkey credential (counter, lastUsedAt, friendlyName)
+     */
+    async updateUserPasskey(userId, credentialId, updates) {
+        return this.passkeyService.updateUserPasskey(userId, credentialId, updates);
+    }
+    /**
+     * Authenticate with passkey (after WebAuthn verification)
+     * Similar to authenticateWithOAuth but for passkeys
+     */
+    async authenticateWithPasskey(userId, credentialId, options) {
+        return this.passkeyService.authenticateWithPasskey(userId, credentialId, options);
+    }
+    // ==========================================================================
+    // CAPTCHA Methods
+    // ==========================================================================
+    /**
+     * Get or create the CAPTCHA provider instance
+     * @private
+     */
+    getCaptchaProvider() {
+        return this.captchaService.getCaptchaProvider();
+    }
+    /**
+     * Check if CAPTCHA is configured
+     */
+    isCaptchaConfigured() {
+        return this.captchaService.isCaptchaConfigured();
+    }
+    /**
+     * Check if CAPTCHA is required for a specific endpoint
+     * @param endpoint - The endpoint to check ('login', 'passwordResetRequest', 'passwordResetVerify')
+     */
+    isCaptchaRequiredFor(endpoint) {
+        return this.captchaService.isCaptchaRequiredFor(endpoint);
+    }
+    /**
+     * Get CAPTCHA configuration for frontend use
+     * Returns public config (site key, provider, options) - never the secret key
+     */
+    getCaptchaConfig() {
+        return this.captchaService.getCaptchaConfig();
+    }
+    /**
+     * Verify a CAPTCHA token
+     * @param token - The CAPTCHA token from the frontend widget
+     * @param remoteIp - Optional client IP address for verification
+     */
+    async verifyCaptcha(token, remoteIp) {
+        return this.captchaService.verifyCaptcha(token, remoteIp);
+    }
+    // ==========================================================================
+    // MFA (Multi-Factor Authentication) Methods
+    // ==========================================================================
+    /**
+     * Get the TOTP service instance
+     * Creates one with a default issuer (can be overridden via settings)
+     */
+    getTOTPService(issuer) {
+        return this.mfaService.getTOTPService(issuer);
+    }
+    /**
+     * Get the Email OTP service instance
+     */
+    getEmailOTPService() {
+        return this.mfaService.getEmailOTPService();
+    }
+    /**
+     * Check if MFA is required for a user
+     * Returns whether MFA is required and available methods
+     */
+    async checkMFARequired(userId) {
+        return this.mfaService.checkMFARequired(userId);
+    }
+    /**
+     * Get project settings
+     */
+    async getSettings() {
+        if (!this.dataStorage.getSettings) {
+            return null;
+        }
+        return this.dataStorage.getSettings();
+    }
+    /**
+     * Initialize TOTP setup for a user
+     * Returns QR code and secret for authenticator app
+     */
+    async initializeTOTPSetup(userId) {
+        return this.mfaService.initializeTOTPSetup(userId);
+    }
+    /**
+     * Verify and enable TOTP for a user
+     * Must be called after initializeTOTPSetup with a valid code from authenticator
+     */
+    async verifyAndEnableTOTP(userId, code) {
+        return this.mfaService.verifyAndEnableTOTP(userId, code);
+    }
+    /**
+     * Initialize Email OTP setup for a user
+     * Sends verification code to user's email
+     */
+    async initializeEmailOTPSetup(userId) {
+        return this.mfaService.initializeEmailOTPSetup(userId);
+    }
+    /**
+     * Verify and enable Email OTP for a user
+     */
+    async verifyAndEnableEmailOTP(userId, code) {
+        return this.mfaService.verifyAndEnableEmailOTP(userId, code);
+    }
+    /**
+     * Verify MFA code during login
+     * Supports TOTP, email, and backup codes
+     */
+    async verifyMFACode(userId, code, method) {
+        return this.mfaService.verifyMFACode(userId, code, method);
+    }
+    /**
+     * Send Email OTP for MFA verification during login
+     */
+    async sendMFAEmailOTP(userId) {
+        return this.mfaService.sendMFAEmailOTP(userId);
+    }
+    /**
+     * Disable MFA method for a user
+     * Requires password verification
+     */
+    async disableMFAMethod(userId, method, password) {
+        return this.mfaService.disableMFAMethod(userId, method, password);
+    }
+    /**
+     * Disable all MFA for a user (removes all methods and backup codes)
+     * Requires password verification
+     */
+    async disableAllMFA(userId, password) {
+        return this.mfaService.disableAllMFA(userId, password);
+    }
+    /**
+     * Regenerate backup codes for a user
+     * Requires password verification
+     */
+    async regenerateBackupCodes(userId, password) {
+        return this.mfaService.regenerateBackupCodes(userId, password);
+    }
+    /**
+     * Trust a device to skip MFA
+     */
+    async trustDevice(userId, deviceId, deviceName, options) {
+        return this.trustedDeviceService.trustDevice(userId, deviceId, deviceName, options);
+    }
+    /**
+     * Check if a device is trusted for MFA bypass
+     */
+    async isDeviceTrusted(userId, deviceId) {
+        return this.trustedDeviceService.isDeviceTrusted(userId, deviceId);
+    }
+    /**
+     * Revoke trust for a specific device
+     */
+    async revokeTrustedDevice(userId, deviceId) {
+        return this.trustedDeviceService.revokeTrustedDevice(userId, deviceId);
+    }
+    /**
+     * Revoke trust for all devices
+     */
+    async revokeAllTrustedDevices(userId) {
+        return this.trustedDeviceService.revokeAllTrustedDevices(userId);
+    }
+    /**
+     * Get list of trusted devices for a user
+     */
+    async getTrustedDevices(userId) {
+        return this.trustedDeviceService.getTrustedDevices(userId);
+    }
+    /**
+     * Admin: Reset MFA for a user (emergency recovery)
+     * Removes all MFA configuration
+     */
+    async adminResetUserMFA(adminUserId, targetUserId) {
+        return this.mfaService.adminResetUserMFA(adminUserId, targetUserId);
+    }
+    /**
+     * Get MFA status for a user
+     */
+    async getMFAStatus(userId) {
+        return this.mfaService.getMFAStatus(userId);
+    }
+    generateSecureSecret() {
+        return generateSecureSecret();
+    }
+    logAuditEvent(event) {
+        // Always call custom audit logger if provided
+        if (this.auditLogger) {
+            this.auditLogger(event);
+        }
+        // Log through our structured logger system
+        const logData = {
+            type: event.type,
+            action: event.action,
+            user: event.username,
+            target: event.targetUserId,
+            timestamp: event.timestamp,
+            ...event.details
+        };
+        if (event.success) {
+            this.auditLog.info(`${event.type}: ${event.action}`, logData);
+        }
+        else {
+            this.auditLog.warn(`${event.type}: ${event.action} - FAILED`, logData);
+        }
+    }
+    // Development utility: Setup admin user from environment variables
+    async setupAdminFromEnv() {
+        return this.userService.setupAdminFromEnv();
+    }
+    // ============================================
+    // OAuth2 Authorization Server Methods
+    // ============================================
+    /**
+     * Get the OAuth2 Authorization Server instance
+     * Returns null if OAuth2 is not enabled
+     */
+    getOAuth2Server() {
+        return this.oauth2ServerService.getOAuth2Server();
+    }
+    /**
+     * Generate OAuth2 tokens for a user
+     * Used by the OAuth2 routes to create access and refresh tokens
+     */
+    async generateOAuth2Tokens(user, scopes, clientId) {
+        return this.oauth2ServerService.generateOAuth2Tokens(user, scopes, clientId);
+    }
+    /**
+     * Refresh an OAuth2 access token using a refresh token
+     * Returns new tokens if the refresh token is valid
+     */
+    async refreshOAuth2Token(refreshToken, clientId, requestedScope) {
+        return this.oauth2ServerService.refreshOAuth2Token(refreshToken, clientId, requestedScope);
+    }
+    // ============================================
+    // OAuth2 Consent Management
+    // ============================================
+    /**
+     * Check if a user has an existing consent for a client with the given scopes
+     * Returns the consent if all requested scopes are already consented, null otherwise
+     */
+    async getUserConsent(userId, clientId, requestedScopes) {
+        return this.oauth2ServerService.getUserConsent(userId, clientId, requestedScopes);
+    }
+    /**
+     * Save user consent for a client
+     * Stores in user preferences for persistence
+     */
+    async saveUserConsent(userId, clientId, scopes, expiresInDays) {
+        return this.oauth2ServerService.saveUserConsent(userId, clientId, scopes, expiresInDays);
+    }
+    /**
+     * Revoke user consent for a client
+     */
+    async revokeUserConsent(userId, clientId) {
+        return this.oauth2ServerService.revokeUserConsent(userId, clientId);
+    }
+    // Rate limiter cleanup (call periodically)
+    cleanup() {
+        if (this.rateLimiter) {
+            this.rateLimiter.cleanup();
+        }
+        // Stop OAuth2 server cleanup interval
+        if (this.oauth2Server) {
+            this.oauth2Server.stopCleanup();
+        }
+    }
+    /**
+     * Full teardown: everything `cleanup()` does, plus releasing whatever the storage adapters
+     * and the event storage are holding open.
+     *
+     * This is a separate method rather than an async `cleanup()` because `cleanup()` is called
+     * synchronously and unawaited by existing hosts (see the express integration's boot-time
+     * consistency check); turning it async would silently give those callers a floating promise
+     * and change nothing for them. So `cleanup()` keeps its exact current behaviour and this
+     * builds on top.
+     *
+     * Every close is awaited independently: an adapter that fails to close must not strand the
+     * handles held by the others, which is the whole reason the process could not exit.
+     */
+    async shutdown() {
+        this.cleanup();
+        const closers = [];
+        const seen = new Set();
+        // The legacy unified adapter is wrapped into both `dataStorage` and `mediaStorage`, and a
+        // split deployment may still point both at one instance, so dedupe by identity: closing
+        // the same pool twice is at best noise and at worst an error.
+        const addCloser = (name, target) => {
+            if (!target || seen.has(target) || typeof target.close !== 'function')
+                return;
+            seen.add(target);
+            closers.push({ name, close: () => target.close() });
+        };
+        // With a legacy unified adapter the two wrappers delegate to it, so close the real one.
+        addCloser('storage', this.storage);
+        addCloser('dataStorage', this.dataStorage);
+        addCloser('mediaStorage', this.mediaStorage);
+        addCloser('eventBus', this.eventBus);
+        const results = await Promise.allSettled(closers.map(c => c.close()));
+        results.forEach((result, index) => {
+            if (result.status === 'rejected') {
+                this.logger.error(`Failed to close ${closers[index].name} during shutdown`, result.reason);
+            }
+        });
+        this.logger.info('TrokkyCore shutdown complete');
+    }
+}
+//# sourceMappingURL=engine.js.map