@unchainedshop/core-users 4.6.2 → 4.8.0

package/lib/domain/model/Email.d.ts

@@ -0,0 +1,17 @@
+export interface Email {
+    readonly address: string;
+    verified: boolean;
+}
+export declare const Email: {
+    create(address: string, verified?: boolean): Email;
+    fromData(data: {
+        address: string;
+        verified: boolean;
+    }): Email;
+    isValid(address: string): boolean;
+    equals(a: Email, b: Email): boolean;
+    toData(email: Email): {
+        address: string;
+        verified: boolean;
+    };
+};

package/lib/domain/model/Email.js

@@ -0,0 +1,21 @@
+export const Email = {
+    create(address, verified = false) {
+        const normalized = address.trim().toLowerCase();
+        if (!Email.isValid(normalized)) {
+            throw new Error(`Invalid email address: ${address}`);
+        }
+        return { address: normalized, verified };
+    },
+    fromData(data) {
+        return { address: data.address, verified: data.verified };
+    },
+    isValid(address) {
+        return typeof address === 'string' && address.includes('@') && address.length >= 3;
+    },
+    equals(a, b) {
+        return a.address.toLowerCase() === b.address.toLowerCase();
+    },
+    toData(email) {
+        return { address: email.address, verified: email.verified };
+    },
+};

package/lib/domain/model/PasswordHash.d.ts

@@ -0,0 +1,16 @@
+export interface PasswordHash {
+    pbkdf2?: string;
+    bcrypt?: string;
+}
+export declare const PasswordHash: {
+    create(pbkdf2Hash: string): PasswordHash;
+    fromLegacyBcrypt(bcryptHash: string): PasswordHash;
+    fromData(data: {
+        pbkdf2?: string;
+        bcrypt?: string;
+    }): PasswordHash;
+    isEmpty(hash: PasswordHash | undefined): boolean;
+    isLegacyBcrypt(hash: PasswordHash): boolean;
+    getSalt(hash: PasswordHash): string | undefined;
+    getHash(hash: PasswordHash): string | undefined;
+};

package/lib/domain/model/PasswordHash.js

@@ -0,0 +1,31 @@
+export const PasswordHash = {
+    create(pbkdf2Hash) {
+        return { pbkdf2: pbkdf2Hash };
+    },
+    fromLegacyBcrypt(bcryptHash) {
+        return { bcrypt: bcryptHash };
+    },
+    fromData(data) {
+        return { ...data };
+    },
+    isEmpty(hash) {
+        if (!hash)
+            return true;
+        return !hash.pbkdf2 && !hash.bcrypt;
+    },
+    isLegacyBcrypt(hash) {
+        return !!hash.bcrypt && !hash.pbkdf2;
+    },
+    getSalt(hash) {
+        if (!hash.pbkdf2)
+            return undefined;
+        const [salt] = hash.pbkdf2.split(':');
+        return salt;
+    },
+    getHash(hash) {
+        if (!hash.pbkdf2)
+            return undefined;
+        const [, hashValue] = hash.pbkdf2.split(':');
+        return hashValue;
+    },
+};

package/lib/domain/model/PushSubscription.d.ts

@@ -0,0 +1,23 @@
+export interface PushSubscription {
+    userAgent: string;
+    endpoint: string;
+    expirationTime: number;
+    keys: {
+        auth: string;
+        p256dh: string;
+    };
+}
+export declare const PushSubscription: {
+    create(data: {
+        userAgent: string;
+        endpoint: string;
+        expirationTime?: number;
+        keys: {
+            auth: string;
+            p256dh: string;
+        };
+    }): PushSubscription;
+    fromData(data: PushSubscription): PushSubscription;
+    equals(a: PushSubscription, b: PushSubscription): boolean;
+    matchesKey(subscription: PushSubscription, p256dh: string): boolean;
+};

package/lib/domain/model/PushSubscription.js

@@ -0,0 +1,25 @@
+export const PushSubscription = {
+    create(data) {
+        if (!data.endpoint || !data.keys?.p256dh || !data.keys?.auth) {
+            throw new Error('Push subscription requires endpoint and keys');
+        }
+        return {
+            userAgent: data.userAgent,
+            endpoint: data.endpoint,
+            expirationTime: data.expirationTime ?? 0,
+            keys: {
+                auth: data.keys.auth,
+                p256dh: data.keys.p256dh,
+            },
+        };
+    },
+    fromData(data) {
+        return { ...data };
+    },
+    equals(a, b) {
+        return a.keys.p256dh === b.keys.p256dh;
+    },
+    matchesKey(subscription, p256dh) {
+        return subscription.keys.p256dh === p256dh;
+    },
+};

package/lib/domain/model/User.d.ts

@@ -0,0 +1,116 @@
+import { type Email } from './Email.ts';
+import { type UserProfile } from './UserProfile.ts';
+import { type Web3Address } from './Web3Address.ts';
+import { type WebAuthnCredential } from './WebAuthnCredential.ts';
+import { type PasswordHash } from './PasswordHash.ts';
+import { type PushSubscription } from './PushSubscription.ts';
+import type { Address, Contact, UserLastLogin, TokenRecord } from '../types.ts';
+export interface UserData {
+    _id: string;
+    emails: Email[];
+    username?: string;
+    profile?: UserProfile;
+    roles: string[];
+    tags: string[];
+    guest: boolean;
+    initialPassword: boolean;
+    avatarId?: string;
+    lastBillingAddress?: Address;
+    lastContact?: Contact;
+    lastLogin?: UserLastLogin;
+    pushSubscriptions: PushSubscription[];
+    meta?: Record<string, unknown>;
+    created: Date;
+    updated?: Date;
+    deleted?: Date | null;
+    services: {
+        password?: PasswordHash;
+        web3?: Web3Address[];
+        webAuthn?: WebAuthnCredential[];
+        token?: {
+            secret: string;
+        };
+        email?: {
+            verificationTokens: TokenRecord[];
+        };
+    };
+}
+export interface CreateUserParams {
+    _id?: string;
+    email?: string;
+    username?: string;
+    password?: PasswordHash;
+    webAuthnCredential?: WebAuthnCredential;
+    roles?: string[];
+    tags?: string[];
+    guest?: boolean;
+    initialPassword?: boolean;
+    profile?: Partial<UserProfile>;
+    meta?: Record<string, unknown>;
+    pushSubscriptions?: PushSubscription[];
+}
+export interface User {
+    readonly id: string;
+    readonly _id: string;
+    readonly emails: Email[];
+    readonly username: string | undefined;
+    readonly profile: UserProfile | undefined;
+    readonly roles: string[];
+    readonly tags: string[];
+    readonly guest: boolean;
+    readonly initialPassword: boolean;
+    readonly avatarId: string | undefined;
+    readonly lastBillingAddress: Address | undefined;
+    readonly lastContact: Contact | undefined;
+    readonly lastLogin: UserLastLogin | undefined;
+    readonly pushSubscriptions: PushSubscription[];
+    readonly meta: Record<string, unknown> | undefined;
+    readonly created: Date;
+    readonly updated: Date | undefined;
+    readonly deleted: Date | null | undefined;
+    readonly services: UserData['services'];
+    readonly isDeleted: boolean;
+    primaryEmail(): Email | undefined;
+    hasVerifiedEmail(): boolean;
+    hasPassword(): boolean;
+    getPasswordHash(): PasswordHash | undefined;
+    findWeb3Address(address: string): Web3Address | undefined;
+    getWebAuthnCredentials(): WebAuthnCredential[];
+    findEmailByAddress(address: string): Email | undefined;
+    addEmail(email: Email): void;
+    removeEmail(address: string): void;
+    markEmailVerified(address: string): boolean;
+    setUsername(username: string): void;
+    setProfile(profile: Partial<UserProfile>): void;
+    setMeta(meta: Record<string, unknown>): void;
+    setAvatar(fileId: string): void;
+    setPassword(passwordHash: PasswordHash): void;
+    setRoles(roles: string[]): void;
+    addRoles(roles: string[]): void;
+    setTags(tags: string[]): void;
+    setGuest(isGuest: boolean): void;
+    updateLastLogin(loginInfo: Omit<UserLastLogin, 'timestamp'>): void;
+    updateLastBillingAddress(address: Address, updateDisplayName?: boolean): void;
+    updateLastContact(contact: Contact, updatePhoneMobile?: boolean): void;
+    addWeb3Address(address: string): string;
+    removeWeb3Address(address: string): boolean;
+    verifyWeb3Address(address: string): boolean;
+    addWebAuthnCredential(credential: WebAuthnCredential): void;
+    removeWebAuthnCredential(credentialId: string): boolean;
+    updateWebAuthnCounter(credentialId: string, counter: number): boolean;
+    addPushSubscription(subscription: PushSubscription): boolean;
+    removePushSubscription(p256dh: string): boolean;
+    setAccessToken(hashedToken: string): void;
+    addVerificationToken(token: TokenRecord): void;
+    addResetToken(token: TokenRecord): void;
+    removeResetToken(hashedToken: string): void;
+    clearVerificationTokens(address: string): void;
+    markAsDeleted(): void;
+    readonly isDirty: boolean;
+    readonly changes: readonly string[];
+    clearChanges(): void;
+    toData(): UserData;
+    toPublicData(): Omit<UserData, 'services'>;
+}
+export declare const createUser: (params: CreateUserParams) => User;
+export declare const reconstituteUser: (data: UserData) => User;

package/lib/domain/model/User.js

@@ -0,0 +1,386 @@
+import { Email as EmailVO } from "./Email.js";
+import { UserProfile as UserProfileVO } from "./UserProfile.js";
+import { Web3Address as Web3AddressVO } from "./Web3Address.js";
+import { WebAuthnCredential as WebAuthnCredentialVO, } from "./WebAuthnCredential.js";
+import { PasswordHash as PasswordHashVO } from "./PasswordHash.js";
+import { PushSubscription as PushSubscriptionVO } from "./PushSubscription.js";
+export const createUser = (params) => {
+    const now = new Date();
+    const data = {
+        _id: params._id || crypto.randomUUID(),
+        emails: params.email ? [EmailVO.create(params.email)] : [],
+        username: params.username?.trim().toLowerCase(),
+        profile: params.profile ? UserProfileVO.create(params.profile) : undefined,
+        roles: params.roles || [],
+        tags: params.tags || [],
+        guest: params.guest ?? false,
+        initialPassword: params.initialPassword ?? false,
+        pushSubscriptions: params.pushSubscriptions || [],
+        meta: params.meta,
+        created: now,
+        updated: undefined,
+        deleted: null,
+        services: {},
+    };
+    if (params.password) {
+        data.services.password = params.password;
+    }
+    if (params.webAuthnCredential) {
+        data.services.webAuthn = [params.webAuthnCredential];
+    }
+    const isDirty = true;
+    const changes = ['created'];
+    return createUserFromData(data, isDirty, changes);
+};
+export const reconstituteUser = (data) => {
+    const reconstituted = {
+        ...data,
+        emails: (data.emails || []).map((e) => EmailVO.fromData(e)),
+        profile: data.profile ? UserProfileVO.fromData(data.profile) : undefined,
+        roles: [...(data.roles || [])],
+        tags: [...(data.tags || [])],
+        pushSubscriptions: (data.pushSubscriptions || []).map((p) => PushSubscriptionVO.fromData(p)),
+        services: {
+            ...data.services,
+            password: data.services?.password ? PasswordHashVO.fromData(data.services.password) : undefined,
+            web3: data.services?.web3?.map((w) => Web3AddressVO.fromData(w)),
+            webAuthn: data.services?.webAuthn?.map((w) => WebAuthnCredentialVO.fromData(w)),
+        },
+    };
+    return createUserFromData(reconstituted, false, []);
+};
+const createUserFromData = (data, initialDirty, initialChanges) => {
+    let isDirty = initialDirty;
+    const changes = [...initialChanges];
+    const markDirty = (field) => {
+        isDirty = true;
+        data.updated = new Date();
+        if (!changes.includes(field)) {
+            changes.push(field);
+        }
+    };
+    const user = {
+        get id() {
+            return data._id;
+        },
+        get _id() {
+            return data._id;
+        },
+        get emails() {
+            return [...data.emails];
+        },
+        get username() {
+            return data.username;
+        },
+        get profile() {
+            return data.profile ? { ...data.profile } : undefined;
+        },
+        get roles() {
+            return [...data.roles];
+        },
+        get tags() {
+            return [...data.tags];
+        },
+        get guest() {
+            return data.guest;
+        },
+        get initialPassword() {
+            return data.initialPassword;
+        },
+        get avatarId() {
+            return data.avatarId;
+        },
+        get lastBillingAddress() {
+            return data.lastBillingAddress ? { ...data.lastBillingAddress } : undefined;
+        },
+        get lastContact() {
+            return data.lastContact ? { ...data.lastContact } : undefined;
+        },
+        get lastLogin() {
+            return data.lastLogin ? { ...data.lastLogin } : undefined;
+        },
+        get pushSubscriptions() {
+            return [...data.pushSubscriptions];
+        },
+        get meta() {
+            return data.meta ? { ...data.meta } : undefined;
+        },
+        get created() {
+            return data.created;
+        },
+        get updated() {
+            return data.updated;
+        },
+        get deleted() {
+            return data.deleted;
+        },
+        get services() {
+            return data.services;
+        },
+        get isDeleted() {
+            return data.deleted != null;
+        },
+        primaryEmail() {
+            return [...data.emails].sort((a, b) => Number(b.verified) - Number(a.verified))[0];
+        },
+        hasVerifiedEmail() {
+            return data.emails.some((e) => e.verified);
+        },
+        hasPassword() {
+            return !PasswordHashVO.isEmpty(data.services.password);
+        },
+        getPasswordHash() {
+            return data.services.password;
+        },
+        findWeb3Address(address) {
+            return data.services.web3?.find((w) => w.address.toLowerCase() === address.toLowerCase());
+        },
+        getWebAuthnCredentials() {
+            return data.services.webAuthn || [];
+        },
+        findEmailByAddress(address) {
+            return data.emails.find((e) => e.address.toLowerCase() === address.toLowerCase());
+        },
+        addEmail(email) {
+            const exists = data.emails.some((e) => EmailVO.equals(e, email));
+            if (!exists) {
+                data.emails.push(email);
+                markDirty('emails');
+            }
+        },
+        removeEmail(address) {
+            const index = data.emails.findIndex((e) => e.address.toLowerCase() === address.toLowerCase());
+            if (index !== -1) {
+                data.emails.splice(index, 1);
+                markDirty('emails');
+            }
+        },
+        markEmailVerified(address) {
+            const email = data.emails.find((e) => e.address.toLowerCase() === address.toLowerCase());
+            if (email && !email.verified) {
+                email.verified = true;
+                if (data.services.email?.verificationTokens) {
+                    data.services.email.verificationTokens = data.services.email.verificationTokens.filter((t) => t.address.toLowerCase() !== address.toLowerCase());
+                }
+                markDirty('emails');
+                return true;
+            }
+            return false;
+        },
+        setUsername(username) {
+            data.username = username.trim().toLowerCase();
+            markDirty('username');
+        },
+        setProfile(profile) {
+            data.profile = UserProfileVO.merge(data.profile, profile);
+            markDirty('profile');
+        },
+        setMeta(meta) {
+            data.meta = meta;
+            markDirty('meta');
+        },
+        setAvatar(fileId) {
+            data.avatarId = fileId;
+            markDirty('avatar');
+        },
+        setPassword(passwordHash) {
+            data.services.password = passwordHash;
+            data.initialPassword = false;
+            markDirty('password');
+        },
+        setRoles(roles) {
+            data.roles = [...roles];
+            markDirty('roles');
+        },
+        addRoles(roles) {
+            const newRoles = roles.filter((r) => !data.roles.includes(r));
+            if (newRoles.length > 0) {
+                data.roles.push(...newRoles);
+                markDirty('roles');
+            }
+        },
+        setTags(tags) {
+            data.tags = [...tags];
+            markDirty('tags');
+        },
+        setGuest(isGuest) {
+            data.guest = isGuest;
+            markDirty('guest');
+        },
+        updateLastLogin(loginInfo) {
+            data.lastLogin = {
+                timestamp: new Date(),
+                ...loginInfo,
+            };
+            markDirty('lastLogin');
+        },
+        updateLastBillingAddress(address, updateDisplayName = false) {
+            data.lastBillingAddress = address;
+            if (updateDisplayName || !data.profile?.displayName || data.guest) {
+                const displayName = [address.firstName, address.lastName].filter(Boolean).join(' ');
+                if (displayName) {
+                    data.profile = UserProfileVO.merge(data.profile, { displayName });
+                }
+            }
+            markDirty('lastBillingAddress');
+        },
+        updateLastContact(contact, updatePhoneMobile = false) {
+            data.lastContact = contact;
+            if ((updatePhoneMobile || !data.profile?.phoneMobile || data.guest) && contact.telNumber) {
+                data.profile = UserProfileVO.merge(data.profile, { phoneMobile: contact.telNumber });
+            }
+            markDirty('lastContact');
+        },
+        addWeb3Address(address) {
+            if (!data.services.web3) {
+                data.services.web3 = [];
+            }
+            const existing = data.services.web3.find((w) => w.address.toLowerCase() === address.toLowerCase());
+            if (existing) {
+                return existing.nonce || '';
+            }
+            const nonce = crypto.randomUUID();
+            data.services.web3.push(Web3AddressVO.create(address, nonce));
+            markDirty('web3');
+            return nonce;
+        },
+        removeWeb3Address(address) {
+            if (!data.services.web3)
+                return false;
+            const index = data.services.web3.findIndex((w) => w.address.toLowerCase() === address.toLowerCase());
+            if (index !== -1) {
+                data.services.web3.splice(index, 1);
+                markDirty('web3');
+                return true;
+            }
+            return false;
+        },
+        verifyWeb3Address(address) {
+            if (!data.services.web3)
+                return false;
+            const web3Address = data.services.web3.find((w) => w.address.toLowerCase() === address.toLowerCase());
+            if (web3Address && !web3Address.verified) {
+                web3Address.verified = true;
+                web3Address.nonce = undefined;
+                markDirty('web3');
+                return true;
+            }
+            return false;
+        },
+        addWebAuthnCredential(credential) {
+            if (!data.services.webAuthn) {
+                data.services.webAuthn = [];
+            }
+            data.services.webAuthn.push(credential);
+            markDirty('webAuthn');
+        },
+        removeWebAuthnCredential(credentialId) {
+            if (!data.services.webAuthn)
+                return false;
+            const index = data.services.webAuthn.findIndex((c) => c.id === credentialId);
+            if (index !== -1) {
+                data.services.webAuthn.splice(index, 1);
+                markDirty('webAuthn');
+                return true;
+            }
+            return false;
+        },
+        updateWebAuthnCounter(credentialId, counter) {
+            if (!data.services.webAuthn)
+                return false;
+            const credential = data.services.webAuthn.find((c) => c.id === credentialId);
+            if (credential) {
+                credential.counter = counter;
+                markDirty('webAuthn');
+                return true;
+            }
+            return false;
+        },
+        addPushSubscription(subscription) {
+            const exists = data.pushSubscriptions.some((p) => PushSubscriptionVO.equals(p, subscription));
+            if (!exists) {
+                data.pushSubscriptions.push(subscription);
+                markDirty('pushSubscriptions');
+                return true;
+            }
+            return false;
+        },
+        removePushSubscription(p256dh) {
+            const index = data.pushSubscriptions.findIndex((p) => PushSubscriptionVO.matchesKey(p, p256dh));
+            if (index !== -1) {
+                data.pushSubscriptions.splice(index, 1);
+                markDirty('pushSubscriptions');
+                return true;
+            }
+            return false;
+        },
+        setAccessToken(hashedToken) {
+            data.services.token = { secret: hashedToken };
+            markDirty('token');
+        },
+        addVerificationToken(token) {
+            if (!data.services.email) {
+                data.services.email = { verificationTokens: [] };
+            }
+            data.services.email.verificationTokens.push(token);
+            markDirty('verificationTokens');
+        },
+        addResetToken(token) {
+            if (!data.services.password) {
+                data.services.password = {};
+            }
+            const passwordWithReset = data.services.password;
+            if (!passwordWithReset.reset) {
+                passwordWithReset.reset = [];
+            }
+            passwordWithReset.reset.push(token);
+            markDirty('resetTokens');
+        },
+        removeResetToken(hashedToken) {
+            const passwordWithReset = data.services.password;
+            if (passwordWithReset?.reset) {
+                passwordWithReset.reset = passwordWithReset.reset.filter((t) => t.token !== hashedToken);
+                markDirty('resetTokens');
+            }
+        },
+        clearVerificationTokens(address) {
+            if (data.services.email?.verificationTokens) {
+                data.services.email.verificationTokens = data.services.email.verificationTokens.filter((t) => t.address.toLowerCase() !== address.toLowerCase());
+                markDirty('verificationTokens');
+            }
+        },
+        markAsDeleted() {
+            data.deleted = new Date();
+            data.username = `deleted-${Date.now()}`;
+            data.emails = [];
+            data.roles = [];
+            data.services = {};
+            data.pushSubscriptions = [];
+            data.initialPassword = false;
+            data.profile = undefined;
+            data.lastBillingAddress = undefined;
+            data.lastContact = undefined;
+            data.lastLogin = undefined;
+            data.avatarId = undefined;
+            markDirty('deleted');
+        },
+        get isDirty() {
+            return isDirty;
+        },
+        get changes() {
+            return [...changes];
+        },
+        clearChanges() {
+            isDirty = false;
+            changes.length = 0;
+        },
+        toData() {
+            return JSON.parse(JSON.stringify(data));
+        },
+        toPublicData() {
+            const { services, ...publicData } = data;
+            return JSON.parse(JSON.stringify(publicData));
+        },
+    };
+    return user;
+};

package/lib/domain/model/UserProfile.d.ts

@@ -0,0 +1,14 @@
+import type { Address } from '../types.ts';
+export interface UserProfile {
+    displayName?: string;
+    birthday?: Date;
+    phoneMobile?: string;
+    gender?: string;
+    address?: Address;
+}
+export declare const UserProfile: {
+    create(data?: Partial<UserProfile>): UserProfile;
+    fromData(data: UserProfile): UserProfile;
+    merge(existing: UserProfile | undefined, updates: Partial<UserProfile>): UserProfile;
+    isEmpty(profile: UserProfile | undefined): boolean;
+};

package/lib/domain/model/UserProfile.js

@@ -0,0 +1,29 @@
+export const UserProfile = {
+    create(data = {}) {
+        return {
+            displayName: data.displayName?.trim(),
+            birthday: data.birthday,
+            phoneMobile: data.phoneMobile?.trim(),
+            gender: data.gender?.trim(),
+            address: data.address,
+        };
+    },
+    fromData(data) {
+        return { ...data };
+    },
+    merge(existing, updates) {
+        return {
+            ...existing,
+            ...updates,
+        };
+    },
+    isEmpty(profile) {
+        if (!profile)
+            return true;
+        return (!profile.displayName &&
+            !profile.birthday &&
+            !profile.phoneMobile &&
+            !profile.gender &&
+            !profile.address);
+    },
+};

package/lib/domain/model/Web3Address.d.ts

@@ -0,0 +1,16 @@
+export interface Web3Address {
+    readonly address: string;
+    nonce?: string;
+    verified: boolean;
+}
+export declare const Web3Address: {
+    create(address: string, nonce?: string): Web3Address;
+    fromData(data: {
+        address: string;
+        nonce?: string;
+        verified?: boolean;
+    }): Web3Address;
+    isValidAddress(address: string): boolean;
+    equals(a: Web3Address, b: Web3Address): boolean;
+    markVerified(web3Address: Web3Address): Web3Address;
+};

package/lib/domain/model/Web3Address.js

@@ -0,0 +1,32 @@
+export const Web3Address = {
+    create(address, nonce) {
+        if (!Web3Address.isValidAddress(address)) {
+            throw new Error(`Invalid Web3 address: ${address}`);
+        }
+        return {
+            address,
+            nonce,
+            verified: false,
+        };
+    },
+    fromData(data) {
+        return {
+            address: data.address,
+            nonce: data.nonce,
+            verified: data.verified ?? false,
+        };
+    },
+    isValidAddress(address) {
+        return /^0x[a-fA-F0-9]{40}$/.test(address);
+    },
+    equals(a, b) {
+        return a.address.toLowerCase() === b.address.toLowerCase();
+    },
+    markVerified(web3Address) {
+        return {
+            ...web3Address,
+            nonce: undefined,
+            verified: true,
+        };
+    },
+};

package/lib/domain/model/WebAuthnCredential.d.ts

@@ -0,0 +1,22 @@
+export type NamedAlgo = 'RS256' | 'ES256';
+export interface WebAuthnCredential {
+    readonly id: string;
+    readonly publicKey: string;
+    readonly algorithm: NamedAlgo;
+    readonly aaguid: string;
+    readonly type: 'public-key';
+    counter: number;
+    readonly created: Date;
+}
+export declare const WebAuthnCredential: {
+    create(data: {
+        id: string;
+        publicKey: string;
+        algorithm?: NamedAlgo;
+        aaguid?: string;
+        counter?: number;
+    }): WebAuthnCredential;
+    fromData(data: WebAuthnCredential): WebAuthnCredential;
+    equals(a: WebAuthnCredential, b: WebAuthnCredential): boolean;
+    updateCounter(credential: WebAuthnCredential, newCounter: number): WebAuthnCredential;
+};

package/lib/domain/model/WebAuthnCredential.js

@@ -0,0 +1,28 @@
+export const WebAuthnCredential = {
+    create(data) {
+        if (!data.id || !data.publicKey) {
+            throw new Error('WebAuthn credential requires id and publicKey');
+        }
+        return {
+            id: data.id,
+            publicKey: data.publicKey,
+            algorithm: data.algorithm ?? 'ES256',
+            aaguid: data.aaguid ?? '',
+            type: 'public-key',
+            counter: data.counter ?? 0,
+            created: new Date(),
+        };
+    },
+    fromData(data) {
+        return { ...data, type: 'public-key' };
+    },
+    equals(a, b) {
+        return a.id === b.id;
+    },
+    updateCounter(credential, newCounter) {
+        return {
+            ...credential,
+            counter: newCounter,
+        };
+    },
+};

package/lib/domain/model/index.d.ts

@@ -0,0 +1,14 @@
+export type { Email } from './Email.ts';
+export { Email as EmailFactory } from './Email.ts';
+export type { UserProfile } from './UserProfile.ts';
+export { UserProfile as UserProfileFactory } from './UserProfile.ts';
+export type { Web3Address } from './Web3Address.ts';
+export { Web3Address as Web3AddressFactory } from './Web3Address.ts';
+export type { WebAuthnCredential, NamedAlgo } from './WebAuthnCredential.ts';
+export { WebAuthnCredential as WebAuthnCredentialFactory } from './WebAuthnCredential.ts';
+export type { PasswordHash } from './PasswordHash.ts';
+export { PasswordHash as PasswordHashFactory } from './PasswordHash.ts';
+export type { PushSubscription } from './PushSubscription.ts';
+export { PushSubscription as PushSubscriptionFactory } from './PushSubscription.ts';
+export type { User, UserData, CreateUserParams } from './User.ts';
+export { createUser, reconstituteUser } from './User.ts';

package/lib/domain/model/index.js

@@ -0,0 +1,7 @@
+export { Email as EmailFactory } from "./Email.js";
+export { UserProfile as UserProfileFactory } from "./UserProfile.js";
+export { Web3Address as Web3AddressFactory } from "./Web3Address.js";
+export { WebAuthnCredential as WebAuthnCredentialFactory } from "./WebAuthnCredential.js";
+export { PasswordHash as PasswordHashFactory } from "./PasswordHash.js";
+export { PushSubscription as PushSubscriptionFactory } from "./PushSubscription.js";
+export { createUser, reconstituteUser } from "./User.js";

package/lib/domain/repository/UserRepository.d.ts

@@ -0,0 +1,48 @@
+import type { User } from '../model/User.ts';
+export interface UserQuery {
+    includeGuests?: boolean;
+    includeDeleted?: boolean;
+    queryString?: string;
+    emailVerified?: boolean;
+    lastLogin?: {
+        start?: string;
+        end?: string;
+    };
+    tags?: string[];
+    userIds?: string[];
+    username?: string;
+    usernames?: string[];
+    emails?: string[];
+    web3Verified?: boolean;
+}
+export interface FindOptions {
+    sort?: {
+        key: string;
+        value: 'ASC' | 'DESC';
+    }[];
+    limit?: number;
+    offset?: number;
+}
+export interface TokenResult {
+    userId: string;
+    address: string;
+    when: Date;
+    token: string;
+}
+export interface UserRepository {
+    findById(id: string): Promise<User | null>;
+    findByUsername(username: string): Promise<User | null>;
+    findByEmail(email: string): Promise<User | null>;
+    findByToken(hashedToken: string): Promise<User | null>;
+    findOne(query: UserQuery, options?: FindOptions): Promise<User | null>;
+    findMany(query: UserQuery, options?: FindOptions): Promise<User[]>;
+    count(query: UserQuery): Promise<number>;
+    exists(userId: string): Promise<boolean>;
+    findByVerificationToken(hashedToken: string, validAfter: Date): Promise<TokenResult | null>;
+    findByResetToken(hashedToken: string, validAfter: Date): Promise<TokenResult | null>;
+    save(user: User): Promise<void>;
+    insert(user: User): Promise<string>;
+    delete(userId: string): Promise<boolean>;
+    deleteUserSessions(userId: string): Promise<void>;
+    distinctTags(): Promise<string[]>;
+}

package/lib/domain/repository/UserRepository.js

@@ -0,0 +1 @@
+export {};

package/lib/domain/services/PasswordService.d.ts

@@ -0,0 +1,5 @@
+import type { PasswordHash } from '../model/PasswordHash.ts';
+export interface PasswordService {
+    hash(plainPassword: string): Promise<PasswordHash>;
+    verify(hash: PasswordHash, plainPassword: string): Promise<boolean>;
+}

package/lib/domain/services/PasswordService.js

@@ -0,0 +1 @@
+export {};

package/lib/domain/services/TokenService.d.ts

@@ -0,0 +1,8 @@
+export interface TokenService {
+    generateToken(): string;
+    hashToken(plainToken: string): Promise<string>;
+    generateHashedToken(): Promise<{
+        plain: string;
+        hashed: string;
+    }>;
+}

package/lib/domain/services/TokenService.js

@@ -0,0 +1 @@
+export {};

package/lib/domain/types.d.ts

@@ -0,0 +1,28 @@
+export interface Address {
+    firstName?: string;
+    lastName?: string;
+    company?: string;
+    addressLine?: string;
+    addressLine2?: string;
+    postalCode?: string;
+    regionCode?: string;
+    city?: string;
+    countryCode?: string;
+}
+export interface Contact {
+    telNumber?: string;
+    emailAddress?: string;
+}
+export interface UserLastLogin {
+    timestamp?: Date;
+    locale?: string;
+    countryCode?: string;
+    remoteAddress?: string;
+    remotePort?: number;
+    userAgent?: string;
+}
+export interface TokenRecord {
+    token: string;
+    address: string;
+    when: Date;
+}

package/lib/domain/types.js

@@ -0,0 +1 @@
+export {};

package/lib/infrastructure/persistence/MongoUserRepository.d.ts

@@ -0,0 +1,4 @@
+import { type mongodb } from '@unchainedshop/mongodb';
+import type { UserRepository } from '../../domain/repository/UserRepository.ts';
+import { type UserData } from '../../domain/model/User.ts';
+export declare const createMongoUserRepository: (collection: mongodb.Collection<UserData>, db: mongodb.Db) => UserRepository;

package/lib/infrastructure/persistence/MongoUserRepository.js

@@ -0,0 +1,159 @@
+import { generateDbFilterById, buildSortOptions, insensitiveTrimmedRegexOperator, } from '@unchainedshop/mongodb';
+import { SortDirection } from '@unchainedshop/utils';
+import { reconstituteUser } from "../../domain/model/User.js";
+import { buildUserSelector } from "./buildUserSelector.js";
+export const createMongoUserRepository = (collection, db) => {
+    const buildFindOptions = (options) => {
+        const findOptions = {};
+        if (options?.offset) {
+            findOptions.skip = options.offset;
+        }
+        if (options?.limit) {
+            findOptions.limit = options.limit;
+        }
+        if (options?.sort) {
+            findOptions.sort = buildSortOptions(options.sort);
+        }
+        return findOptions;
+    };
+    return {
+        async findById(id) {
+            if (!id)
+                return null;
+            const data = await collection.findOne(generateDbFilterById(id));
+            return data ? reconstituteUser(data) : null;
+        },
+        async findByUsername(username) {
+            if (!username)
+                return null;
+            const data = await collection.findOne({
+                username: insensitiveTrimmedRegexOperator(username),
+            });
+            return data ? reconstituteUser(data) : null;
+        },
+        async findByEmail(email) {
+            if (!email)
+                return null;
+            const data = await collection.findOne({
+                'emails.address': insensitiveTrimmedRegexOperator(email),
+            });
+            return data ? reconstituteUser(data) : null;
+        },
+        async findByToken(hashedToken) {
+            if (!hashedToken)
+                return null;
+            const data = await collection.findOne({
+                'services.token.secret': hashedToken,
+            });
+            return data ? reconstituteUser(data) : null;
+        },
+        async findOne(query, options) {
+            const selector = buildUserSelector(query);
+            const findOptions = buildFindOptions(options);
+            const data = await collection.findOne(selector, findOptions);
+            return data ? reconstituteUser(data) : null;
+        },
+        async findMany(query, options) {
+            const selector = buildUserSelector(query);
+            const defaultSort = [{ key: 'created', value: SortDirection.ASC }];
+            const findOptions = buildFindOptions(options);
+            if (query.queryString) {
+                const docs = await collection
+                    .find(selector, {
+                    ...findOptions,
+                    projection: { score: { $meta: 'textScore' } },
+                    sort: { score: { $meta: 'textScore' } },
+                })
+                    .toArray();
+                return docs.map(reconstituteUser);
+            }
+            if (!findOptions.sort) {
+                findOptions.sort = buildSortOptions(defaultSort);
+            }
+            const docs = await collection.find(selector, findOptions).toArray();
+            return docs.map(reconstituteUser);
+        },
+        async count(query) {
+            const selector = buildUserSelector(query);
+            return collection.countDocuments(selector);
+        },
+        async exists(userId) {
+            const count = await collection.countDocuments({ _id: userId, deleted: null }, { limit: 1 });
+            return count === 1;
+        },
+        async findByVerificationToken(hashedToken, validAfter) {
+            if (!hashedToken)
+                return null;
+            const data = await collection.findOne({
+                'services.email.verificationTokens': {
+                    $elemMatch: {
+                        token: hashedToken,
+                        when: { $gt: validAfter },
+                    },
+                },
+            });
+            if (!data)
+                return null;
+            const verificationToken = data.services?.email?.verificationTokens?.find((v) => v.token === hashedToken);
+            if (!verificationToken)
+                return null;
+            return {
+                userId: data._id,
+                address: verificationToken.address,
+                when: verificationToken.when,
+                token: verificationToken.token,
+            };
+        },
+        async findByResetToken(hashedToken, validAfter) {
+            if (!hashedToken)
+                return null;
+            const data = await collection.findOne({
+                'services.password.reset': {
+                    $elemMatch: {
+                        token: hashedToken,
+                        when: { $gt: validAfter },
+                    },
+                },
+            });
+            if (!data)
+                return null;
+            const passwordService = data.services?.password;
+            const resetToken = passwordService?.reset?.find((v) => v.token === hashedToken);
+            if (!resetToken)
+                return null;
+            return {
+                userId: data._id,
+                address: resetToken.address,
+                when: resetToken.when,
+                token: resetToken.token,
+            };
+        },
+        async save(user) {
+            const data = user.toData();
+            await collection.replaceOne({ _id: data._id }, data, { upsert: true });
+            user.clearChanges();
+        },
+        async insert(user) {
+            const data = user.toData();
+            await collection.insertOne(data);
+            user.clearChanges();
+            return data._id;
+        },
+        async delete(userId) {
+            const result = await collection.deleteOne({ _id: userId });
+            return result.deletedCount > 0;
+        },
+        async deleteUserSessions(userId) {
+            await db.collection('sessions').deleteMany({
+                session: insensitiveTrimmedRegexOperator(`"user":"${userId}"`),
+            });
+        },
+        async distinctTags() {
+            const tags = (await collection.distinct('tags', {
+                tags: { $exists: true },
+                deleted: null,
+            }));
+            return tags.filter(Boolean).sort();
+        },
+    };
+};

package/lib/infrastructure/persistence/buildUserSelector.d.ts

@@ -0,0 +1,4 @@
+import { type mongodb } from '@unchainedshop/mongodb';
+import type { UserQuery } from '../../domain/repository/UserRepository.ts';
+import type { UserData } from '../../domain/model/User.ts';
+export declare const buildUserSelector: ({ includeGuests, includeDeleted, queryString, emailVerified, lastLogin, tags, userIds, username, usernames, emails, web3Verified, }: UserQuery) => mongodb.Filter<UserData>;

package/lib/infrastructure/persistence/buildUserSelector.js

@@ -0,0 +1,54 @@
+import { insensitiveTrimmedRegexOperator, assertDocumentDBCompatMode, } from '@unchainedshop/mongodb';
+export const buildUserSelector = ({ includeGuests, includeDeleted, queryString, emailVerified, lastLogin, tags, userIds, username, usernames, emails, web3Verified, }) => {
+    const selector = {};
+    if (!includeDeleted) {
+        selector.deleted = null;
+    }
+    if (!includeGuests) {
+        selector.guest = { $ne: true };
+    }
+    if (userIds) {
+        selector._id = { $in: userIds };
+    }
+    if (username) {
+        selector.username = insensitiveTrimmedRegexOperator(username);
+    }
+    if (usernames?.length) {
+        selector.username = {
+            $in: usernames.map((u) => insensitiveTrimmedRegexOperator(u)),
+        };
+    }
+    if (emails?.length) {
+        selector['emails.address'] = {
+            $in: emails.map((e) => insensitiveTrimmedRegexOperator(e)),
+        };
+    }
+    if (emailVerified === true) {
+        selector['emails.verified'] = true;
+    }
+    if (emailVerified === false) {
+        selector['emails.verified'] = { $ne: true };
+    }
+    if (Array.isArray(tags) && tags.length) {
+        selector.tags = { $in: tags };
+    }
+    if (web3Verified === true) {
+        selector['services.web3.verified'] = true;
+    }
+    if (lastLogin?.start || lastLogin?.end) {
+        const timestampFilter = { $exists: true };
+        if (lastLogin.end) {
+            timestampFilter.$lte = typeof lastLogin.end === 'string' ? new Date(lastLogin.end) : lastLogin.end;
+        }
+        if (lastLogin.start) {
+            timestampFilter.$gte =
+                typeof lastLogin.start === 'string' ? new Date(lastLogin.start) : lastLogin.start;
+        }
+        selector['lastLogin.timestamp'] = timestampFilter;
+    }
+    if (queryString) {
+        assertDocumentDBCompatMode();
+        selector.$text = { $search: queryString };
+    }
+    return selector;
+};

package/lib/infrastructure/services/CryptoTokenService.d.ts

@@ -0,0 +1,2 @@
+import type { TokenService } from '../../domain/services/TokenService.ts';
+export declare const createCryptoTokenService: () => TokenService;

package/lib/infrastructure/services/CryptoTokenService.js

@@ -0,0 +1,16 @@
+import { sha256 } from '@unchainedshop/utils';
+export const createCryptoTokenService = () => {
+    return {
+        generateToken() {
+            return crypto.randomUUID();
+        },
+        async hashToken(plainToken) {
+            return sha256(plainToken);
+        },
+        async generateHashedToken() {
+            const plain = crypto.randomUUID();
+            const hashed = await sha256(plain);
+            return { plain, hashed };
+        },
+    };
+};

package/lib/infrastructure/services/Pbkdf2PasswordService.d.ts

@@ -0,0 +1,2 @@
+import type { PasswordService } from '../../domain/services/PasswordService.ts';
+export declare const createPbkdf2PasswordService: () => PasswordService;

package/lib/infrastructure/services/Pbkdf2PasswordService.js

@@ -0,0 +1,23 @@
+import * as bcrypt from 'bcryptjs';
+import { sha256 } from '@unchainedshop/utils';
+import * as pbkdf2 from "../../module/pbkdf2.js";
+export const createPbkdf2PasswordService = () => {
+    return {
+        async hash(plainPassword) {
+            const salt = pbkdf2.generateSalt();
+            const hashedPassword = await pbkdf2.getDerivedKey(salt, plainPassword);
+            return { pbkdf2: `${salt}:${hashedPassword}` };
+        },
+        async verify(hash, plainPassword) {
+            if (hash.pbkdf2) {
+                const [pbkdf2Salt, pbkdf2Hash] = hash.pbkdf2.split(':');
+                return pbkdf2.compare(plainPassword, pbkdf2Hash, pbkdf2Salt);
+            }
+            if (hash.bcrypt) {
+                const password = await sha256(plainPassword);
+                return bcrypt.compare(password, hash.bcrypt);
+            }
+            return false;
+        },
+    };
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/core-users",
   "description": "User management module for the Unchained Engine with authentication support",
-  "version": "4.6.2",
+  "version": "4.8.0",
   "main": "lib/users-index.js",
   "types": "lib/users-index.d.ts",
   "type": "module",