@unchainedshop/core-users 4.8.25 → 4.8.26

package/lib/module/configureUsersModule.js

@@ -27,6 +27,7 @@ const USER_EVENTS = [
     'USER_UPDATE_WEB3_ADDRESS',
     'USER_REMOVE',
 ];
+const ADMIN_ROLE = 'admin';
 export const removeConfidentialServiceHashes = (rawUser) => {
     const user = { ...rawUser };
     delete user?.services;
@@ -88,6 +89,14 @@ export const configureUsersModule = async (moduleInput) => {
     registerEvents(USER_EVENTS);
     const Users = await UsersCollection(db);
     const webAuthn = await configureUsersWebAuthnModule(moduleInput);
+    const assertAnotherActiveAdminExists = async (userId) => {
+        const user = await Users.findOne({ _id: userId, deleted: null });
+        if (!user?.roles?.includes(ADMIN_ROLE))
+            return;
+        const activeAdminCount = await Users.countDocuments({ deleted: null, roles: ADMIN_ROLE }, { limit: 2 });
+        if (activeAdminCount <= 1)
+            throw new Error('At least one active administrator is required. Assign another administrator before removing this account or revoking its admin role.', { cause: 'LAST_ADMIN' });
+    };
     return {
         webAuthn,
         async count(query) {
@@ -606,6 +615,7 @@ export const configureUsersModule = async (moduleInput) => {
             return user;
         },
         markDeleted: async (userId) => {
+            await assertAnotherActiveAdminExists(userId);
             await db.collection('sessions').deleteMany({
                 session: { $regex: `"user(Id)?":"${escapeRegexString(userId)}"` },
             });
@@ -635,6 +645,7 @@ export const configureUsersModule = async (moduleInput) => {
             return user;
         },
         deletePermanently: async ({ userId }) => {
+            await assertAnotherActiveAdminExists(userId);
             return Users.findOneAndDelete({ _id: userId });
         },
         updateProfile: async (userId, updatedData) => {
@@ -751,15 +762,14 @@ export const configureUsersModule = async (moduleInput) => {
             return updatedUser;
         },
         updateRoles: async (_id, roles) => {
-            const modifier = {
+            if (!roles.includes(ADMIN_ROLE))
+                await assertAnotherActiveAdminExists(_id);
+            const user = await Users.findOneAndUpdate(generateDbFilterById(_id), {
                 $set: {
                     updated: new Date(),
                     roles,
                 },
-            };
-            const user = await Users.findOneAndUpdate(generateDbFilterById(_id), modifier, {
-                returnDocument: 'after',
-            });
+            }, { returnDocument: 'after' });
             if (!user)
                 return null;
             await emit('USER_UPDATE_ROLE', {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@unchainedshop/core-users",
   "description": "User management module for the Unchained Engine with authentication support",
-  "version": "4.8.25",
+  "version": "4.8.26",
   "main": "lib/users-index.js",
   "types": "lib/users-index.d.ts",
   "type": "module",

package/lib/domain/model/Email.d.ts

@@ -1,17 +0,0 @@
-export interface Email {
-    readonly address: string;
-    verified: boolean;
-}
-export declare const Email: {
-    create(address: string, verified?: boolean): Email;
-    fromData(data: {
-        address: string;
-        verified: boolean;
-    }): Email;
-    isValid(address: string): boolean;
-    equals(a: Email, b: Email): boolean;
-    toData(email: Email): {
-        address: string;
-        verified: boolean;
-    };
-};

package/lib/domain/model/Email.js

@@ -1,21 +0,0 @@
-export const Email = {
-    create(address, verified = false) {
-        const normalized = address.trim().toLowerCase();
-        if (!Email.isValid(normalized)) {
-            throw new Error(`Invalid email address: ${address}`);
-        }
-        return { address: normalized, verified };
-    },
-    fromData(data) {
-        return { address: data.address, verified: data.verified };
-    },
-    isValid(address) {
-        return typeof address === 'string' && address.includes('@') && address.length >= 3;
-    },
-    equals(a, b) {
-        return a.address.toLowerCase() === b.address.toLowerCase();
-    },
-    toData(email) {
-        return { address: email.address, verified: email.verified };
-    },
-};

package/lib/domain/model/PasswordHash.d.ts

@@ -1,16 +0,0 @@
-export interface PasswordHash {
-    pbkdf2?: string;
-    bcrypt?: string;
-}
-export declare const PasswordHash: {
-    create(pbkdf2Hash: string): PasswordHash;
-    fromLegacyBcrypt(bcryptHash: string): PasswordHash;
-    fromData(data: {
-        pbkdf2?: string;
-        bcrypt?: string;
-    }): PasswordHash;
-    isEmpty(hash: PasswordHash | undefined): boolean;
-    isLegacyBcrypt(hash: PasswordHash): boolean;
-    getSalt(hash: PasswordHash): string | undefined;
-    getHash(hash: PasswordHash): string | undefined;
-};

package/lib/domain/model/PasswordHash.js

@@ -1,31 +0,0 @@
-export const PasswordHash = {
-    create(pbkdf2Hash) {
-        return { pbkdf2: pbkdf2Hash };
-    },
-    fromLegacyBcrypt(bcryptHash) {
-        return { bcrypt: bcryptHash };
-    },
-    fromData(data) {
-        return { ...data };
-    },
-    isEmpty(hash) {
-        if (!hash)
-            return true;
-        return !hash.pbkdf2 && !hash.bcrypt;
-    },
-    isLegacyBcrypt(hash) {
-        return !!hash.bcrypt && !hash.pbkdf2;
-    },
-    getSalt(hash) {
-        if (!hash.pbkdf2)
-            return undefined;
-        const [salt] = hash.pbkdf2.split(':');
-        return salt;
-    },
-    getHash(hash) {
-        if (!hash.pbkdf2)
-            return undefined;
-        const [, hashValue] = hash.pbkdf2.split(':');
-        return hashValue;
-    },
-};

package/lib/domain/model/PushSubscription.d.ts

@@ -1,23 +0,0 @@
-export interface PushSubscription {
-    userAgent: string;
-    endpoint: string;
-    expirationTime: number;
-    keys: {
-        auth: string;
-        p256dh: string;
-    };
-}
-export declare const PushSubscription: {
-    create(data: {
-        userAgent: string;
-        endpoint: string;
-        expirationTime?: number;
-        keys: {
-            auth: string;
-            p256dh: string;
-        };
-    }): PushSubscription;
-    fromData(data: PushSubscription): PushSubscription;
-    equals(a: PushSubscription, b: PushSubscription): boolean;
-    matchesKey(subscription: PushSubscription, p256dh: string): boolean;
-};

package/lib/domain/model/PushSubscription.js

@@ -1,25 +0,0 @@
-export const PushSubscription = {
-    create(data) {
-        if (!data.endpoint || !data.keys?.p256dh || !data.keys?.auth) {
-            throw new Error('Push subscription requires endpoint and keys');
-        }
-        return {
-            userAgent: data.userAgent,
-            endpoint: data.endpoint,
-            expirationTime: data.expirationTime ?? 0,
-            keys: {
-                auth: data.keys.auth,
-                p256dh: data.keys.p256dh,
-            },
-        };
-    },
-    fromData(data) {
-        return { ...data };
-    },
-    equals(a, b) {
-        return a.keys.p256dh === b.keys.p256dh;
-    },
-    matchesKey(subscription, p256dh) {
-        return subscription.keys.p256dh === p256dh;
-    },
-};

package/lib/domain/model/User.d.ts

@@ -1,116 +0,0 @@
-import { type Email } from './Email.ts';
-import { type UserProfile } from './UserProfile.ts';
-import { type Web3Address } from './Web3Address.ts';
-import { type WebAuthnCredential } from './WebAuthnCredential.ts';
-import { type PasswordHash } from './PasswordHash.ts';
-import { type PushSubscription } from './PushSubscription.ts';
-import type { Address, Contact, UserLastLogin, TokenRecord } from '../types.ts';
-export interface UserData {
-    _id: string;
-    emails: Email[];
-    username?: string;
-    profile?: UserProfile;
-    roles: string[];
-    tags: string[];
-    guest: boolean;
-    initialPassword: boolean;
-    avatarId?: string;
-    lastBillingAddress?: Address;
-    lastContact?: Contact;
-    lastLogin?: UserLastLogin;
-    pushSubscriptions: PushSubscription[];
-    meta?: Record<string, unknown>;
-    created: Date;
-    updated?: Date;
-    deleted?: Date | null;
-    services: {
-        password?: PasswordHash;
-        web3?: Web3Address[];
-        webAuthn?: WebAuthnCredential[];
-        token?: {
-            secret: string;
-        };
-        email?: {
-            verificationTokens: TokenRecord[];
-        };
-    };
-}
-export interface CreateUserParams {
-    _id?: string;
-    email?: string;
-    username?: string;
-    password?: PasswordHash;
-    webAuthnCredential?: WebAuthnCredential;
-    roles?: string[];
-    tags?: string[];
-    guest?: boolean;
-    initialPassword?: boolean;
-    profile?: Partial<UserProfile>;
-    meta?: Record<string, unknown>;
-    pushSubscriptions?: PushSubscription[];
-}
-export interface User {
-    readonly id: string;
-    readonly _id: string;
-    readonly emails: Email[];
-    readonly username: string | undefined;
-    readonly profile: UserProfile | undefined;
-    readonly roles: string[];
-    readonly tags: string[];
-    readonly guest: boolean;
-    readonly initialPassword: boolean;
-    readonly avatarId: string | undefined;
-    readonly lastBillingAddress: Address | undefined;
-    readonly lastContact: Contact | undefined;
-    readonly lastLogin: UserLastLogin | undefined;
-    readonly pushSubscriptions: PushSubscription[];
-    readonly meta: Record<string, unknown> | undefined;
-    readonly created: Date;
-    readonly updated: Date | undefined;
-    readonly deleted: Date | null | undefined;
-    readonly services: UserData['services'];
-    readonly isDeleted: boolean;
-    primaryEmail(): Email | undefined;
-    hasVerifiedEmail(): boolean;
-    hasPassword(): boolean;
-    getPasswordHash(): PasswordHash | undefined;
-    findWeb3Address(address: string): Web3Address | undefined;
-    getWebAuthnCredentials(): WebAuthnCredential[];
-    findEmailByAddress(address: string): Email | undefined;
-    addEmail(email: Email): void;
-    removeEmail(address: string): void;
-    markEmailVerified(address: string): boolean;
-    setUsername(username: string): void;
-    setProfile(profile: Partial<UserProfile>): void;
-    setMeta(meta: Record<string, unknown>): void;
-    setAvatar(fileId: string): void;
-    setPassword(passwordHash: PasswordHash): void;
-    setRoles(roles: string[]): void;
-    addRoles(roles: string[]): void;
-    setTags(tags: string[]): void;
-    setGuest(isGuest: boolean): void;
-    updateLastLogin(loginInfo: Omit<UserLastLogin, 'timestamp'>): void;
-    updateLastBillingAddress(address: Address, updateDisplayName?: boolean): void;
-    updateLastContact(contact: Contact, updatePhoneMobile?: boolean): void;
-    addWeb3Address(address: string): string;
-    removeWeb3Address(address: string): boolean;
-    verifyWeb3Address(address: string): boolean;
-    addWebAuthnCredential(credential: WebAuthnCredential): void;
-    removeWebAuthnCredential(credentialId: string): boolean;
-    updateWebAuthnCounter(credentialId: string, counter: number): boolean;
-    addPushSubscription(subscription: PushSubscription): boolean;
-    removePushSubscription(p256dh: string): boolean;
-    setAccessToken(hashedToken: string): void;
-    addVerificationToken(token: TokenRecord): void;
-    addResetToken(token: TokenRecord): void;
-    removeResetToken(hashedToken: string): void;
-    clearVerificationTokens(address: string): void;
-    markAsDeleted(): void;
-    readonly isDirty: boolean;
-    readonly changes: readonly string[];
-    clearChanges(): void;
-    toData(): UserData;
-    toPublicData(): Omit<UserData, 'services'>;
-}
-export declare const createUser: (params: CreateUserParams) => User;
-export declare const reconstituteUser: (data: UserData) => User;

package/lib/domain/model/User.js

@@ -1,386 +0,0 @@
-import { Email as EmailVO } from "./Email.js";
-import { UserProfile as UserProfileVO } from "./UserProfile.js";
-import { Web3Address as Web3AddressVO } from "./Web3Address.js";
-import { WebAuthnCredential as WebAuthnCredentialVO, } from "./WebAuthnCredential.js";
-import { PasswordHash as PasswordHashVO } from "./PasswordHash.js";
-import { PushSubscription as PushSubscriptionVO } from "./PushSubscription.js";
-export const createUser = (params) => {
-    const now = new Date();
-    const data = {
-        _id: params._id || crypto.randomUUID(),
-        emails: params.email ? [EmailVO.create(params.email)] : [],
-        username: params.username?.trim().toLowerCase(),
-        profile: params.profile ? UserProfileVO.create(params.profile) : undefined,
-        roles: params.roles || [],
-        tags: params.tags || [],
-        guest: params.guest ?? false,
-        initialPassword: params.initialPassword ?? false,
-        pushSubscriptions: params.pushSubscriptions || [],
-        meta: params.meta,
-        created: now,
-        updated: undefined,
-        deleted: null,
-        services: {},
-    };
-    if (params.password) {
-        data.services.password = params.password;
-    }
-    if (params.webAuthnCredential) {
-        data.services.webAuthn = [params.webAuthnCredential];
-    }
-    const isDirty = true;
-    const changes = ['created'];
-    return createUserFromData(data, isDirty, changes);
-};
-export const reconstituteUser = (data) => {
-    const reconstituted = {
-        ...data,
-        emails: (data.emails || []).map((e) => EmailVO.fromData(e)),
-        profile: data.profile ? UserProfileVO.fromData(data.profile) : undefined,
-        roles: [...(data.roles || [])],
-        tags: [...(data.tags || [])],
-        pushSubscriptions: (data.pushSubscriptions || []).map((p) => PushSubscriptionVO.fromData(p)),
-        services: {
-            ...data.services,
-            password: data.services?.password ? PasswordHashVO.fromData(data.services.password) : undefined,
-            web3: data.services?.web3?.map((w) => Web3AddressVO.fromData(w)),
-            webAuthn: data.services?.webAuthn?.map((w) => WebAuthnCredentialVO.fromData(w)),
-        },
-    };
-    return createUserFromData(reconstituted, false, []);
-};
-const createUserFromData = (data, initialDirty, initialChanges) => {
-    let isDirty = initialDirty;
-    const changes = [...initialChanges];
-    const markDirty = (field) => {
-        isDirty = true;
-        data.updated = new Date();
-        if (!changes.includes(field)) {
-            changes.push(field);
-        }
-    };
-    const user = {
-        get id() {
-            return data._id;
-        },
-        get _id() {
-            return data._id;
-        },
-        get emails() {
-            return [...data.emails];
-        },
-        get username() {
-            return data.username;
-        },
-        get profile() {
-            return data.profile ? { ...data.profile } : undefined;
-        },
-        get roles() {
-            return [...data.roles];
-        },
-        get tags() {
-            return [...data.tags];
-        },
-        get guest() {
-            return data.guest;
-        },
-        get initialPassword() {
-            return data.initialPassword;
-        },
-        get avatarId() {
-            return data.avatarId;
-        },
-        get lastBillingAddress() {
-            return data.lastBillingAddress ? { ...data.lastBillingAddress } : undefined;
-        },
-        get lastContact() {
-            return data.lastContact ? { ...data.lastContact } : undefined;
-        },
-        get lastLogin() {
-            return data.lastLogin ? { ...data.lastLogin } : undefined;
-        },
-        get pushSubscriptions() {
-            return [...data.pushSubscriptions];
-        },
-        get meta() {
-            return data.meta ? { ...data.meta } : undefined;
-        },
-        get created() {
-            return data.created;
-        },
-        get updated() {
-            return data.updated;
-        },
-        get deleted() {
-            return data.deleted;
-        },
-        get services() {
-            return data.services;
-        },
-        get isDeleted() {
-            return data.deleted != null;
-        },
-        primaryEmail() {
-            return [...data.emails].sort((a, b) => Number(b.verified) - Number(a.verified))[0];
-        },
-        hasVerifiedEmail() {
-            return data.emails.some((e) => e.verified);
-        },
-        hasPassword() {
-            return !PasswordHashVO.isEmpty(data.services.password);
-        },
-        getPasswordHash() {
-            return data.services.password;
-        },
-        findWeb3Address(address) {
-            return data.services.web3?.find((w) => w.address.toLowerCase() === address.toLowerCase());
-        },
-        getWebAuthnCredentials() {
-            return data.services.webAuthn || [];
-        },
-        findEmailByAddress(address) {
-            return data.emails.find((e) => e.address.toLowerCase() === address.toLowerCase());
-        },
-        addEmail(email) {
-            const exists = data.emails.some((e) => EmailVO.equals(e, email));
-            if (!exists) {
-                data.emails.push(email);
-                markDirty('emails');
-            }
-        },
-        removeEmail(address) {
-            const index = data.emails.findIndex((e) => e.address.toLowerCase() === address.toLowerCase());
-            if (index !== -1) {
-                data.emails.splice(index, 1);
-                markDirty('emails');
-            }
-        },
-        markEmailVerified(address) {
-            const email = data.emails.find((e) => e.address.toLowerCase() === address.toLowerCase());
-            if (email && !email.verified) {
-                email.verified = true;
-                if (data.services.email?.verificationTokens) {
-                    data.services.email.verificationTokens = data.services.email.verificationTokens.filter((t) => t.address.toLowerCase() !== address.toLowerCase());
-                }
-                markDirty('emails');
-                return true;
-            }
-            return false;
-        },
-        setUsername(username) {
-            data.username = username.trim().toLowerCase();
-            markDirty('username');
-        },
-        setProfile(profile) {
-            data.profile = UserProfileVO.merge(data.profile, profile);
-            markDirty('profile');
-        },
-        setMeta(meta) {
-            data.meta = meta;
-            markDirty('meta');
-        },
-        setAvatar(fileId) {
-            data.avatarId = fileId;
-            markDirty('avatar');
-        },
-        setPassword(passwordHash) {
-            data.services.password = passwordHash;
-            data.initialPassword = false;
-            markDirty('password');
-        },
-        setRoles(roles) {
-            data.roles = [...roles];
-            markDirty('roles');
-        },
-        addRoles(roles) {
-            const newRoles = roles.filter((r) => !data.roles.includes(r));
-            if (newRoles.length > 0) {
-                data.roles.push(...newRoles);
-                markDirty('roles');
-            }
-        },
-        setTags(tags) {
-            data.tags = [...tags];
-            markDirty('tags');
-        },
-        setGuest(isGuest) {
-            data.guest = isGuest;
-            markDirty('guest');
-        },
-        updateLastLogin(loginInfo) {
-            data.lastLogin = {
-                timestamp: new Date(),
-                ...loginInfo,
-            };
-            markDirty('lastLogin');
-        },
-        updateLastBillingAddress(address, updateDisplayName = false) {
-            data.lastBillingAddress = address;
-            if (updateDisplayName || !data.profile?.displayName || data.guest) {
-                const displayName = [address.firstName, address.lastName].filter(Boolean).join(' ');
-                if (displayName) {
-                    data.profile = UserProfileVO.merge(data.profile, { displayName });
-                }
-            }
-            markDirty('lastBillingAddress');
-        },
-        updateLastContact(contact, updatePhoneMobile = false) {
-            data.lastContact = contact;
-            if ((updatePhoneMobile || !data.profile?.phoneMobile || data.guest) && contact.telNumber) {
-                data.profile = UserProfileVO.merge(data.profile, { phoneMobile: contact.telNumber });
-            }
-            markDirty('lastContact');
-        },
-        addWeb3Address(address) {
-            if (!data.services.web3) {
-                data.services.web3 = [];
-            }
-            const existing = data.services.web3.find((w) => w.address.toLowerCase() === address.toLowerCase());
-            if (existing) {
-                return existing.nonce || '';
-            }
-            const nonce = crypto.randomUUID();
-            data.services.web3.push(Web3AddressVO.create(address, nonce));
-            markDirty('web3');
-            return nonce;
-        },
-        removeWeb3Address(address) {
-            if (!data.services.web3)
-                return false;
-            const index = data.services.web3.findIndex((w) => w.address.toLowerCase() === address.toLowerCase());
-            if (index !== -1) {
-                data.services.web3.splice(index, 1);
-                markDirty('web3');
-                return true;
-            }
-            return false;
-        },
-        verifyWeb3Address(address) {
-            if (!data.services.web3)
-                return false;
-            const web3Address = data.services.web3.find((w) => w.address.toLowerCase() === address.toLowerCase());
-            if (web3Address && !web3Address.verified) {
-                web3Address.verified = true;
-                web3Address.nonce = undefined;
-                markDirty('web3');
-                return true;
-            }
-            return false;
-        },
-        addWebAuthnCredential(credential) {
-            if (!data.services.webAuthn) {
-                data.services.webAuthn = [];
-            }
-            data.services.webAuthn.push(credential);
-            markDirty('webAuthn');
-        },
-        removeWebAuthnCredential(credentialId) {
-            if (!data.services.webAuthn)
-                return false;
-            const index = data.services.webAuthn.findIndex((c) => c.id === credentialId);
-            if (index !== -1) {
-                data.services.webAuthn.splice(index, 1);
-                markDirty('webAuthn');
-                return true;
-            }
-            return false;
-        },
-        updateWebAuthnCounter(credentialId, counter) {
-            if (!data.services.webAuthn)
-                return false;
-            const credential = data.services.webAuthn.find((c) => c.id === credentialId);
-            if (credential) {
-                credential.counter = counter;
-                markDirty('webAuthn');
-                return true;
-            }
-            return false;
-        },
-        addPushSubscription(subscription) {
-            const exists = data.pushSubscriptions.some((p) => PushSubscriptionVO.equals(p, subscription));
-            if (!exists) {
-                data.pushSubscriptions.push(subscription);
-                markDirty('pushSubscriptions');
-                return true;
-            }
-            return false;
-        },
-        removePushSubscription(p256dh) {
-            const index = data.pushSubscriptions.findIndex((p) => PushSubscriptionVO.matchesKey(p, p256dh));
-            if (index !== -1) {
-                data.pushSubscriptions.splice(index, 1);
-                markDirty('pushSubscriptions');
-                return true;
-            }
-            return false;
-        },
-        setAccessToken(hashedToken) {
-            data.services.token = { secret: hashedToken };
-            markDirty('token');
-        },
-        addVerificationToken(token) {
-            if (!data.services.email) {
-                data.services.email = { verificationTokens: [] };
-            }
-            data.services.email.verificationTokens.push(token);
-            markDirty('verificationTokens');
-        },
-        addResetToken(token) {
-            if (!data.services.password) {
-                data.services.password = {};
-            }
-            const passwordWithReset = data.services.password;
-            if (!passwordWithReset.reset) {
-                passwordWithReset.reset = [];
-            }
-            passwordWithReset.reset.push(token);
-            markDirty('resetTokens');
-        },
-        removeResetToken(hashedToken) {
-            const passwordWithReset = data.services.password;
-            if (passwordWithReset?.reset) {
-                passwordWithReset.reset = passwordWithReset.reset.filter((t) => t.token !== hashedToken);
-                markDirty('resetTokens');
-            }
-        },
-        clearVerificationTokens(address) {
-            if (data.services.email?.verificationTokens) {
-                data.services.email.verificationTokens = data.services.email.verificationTokens.filter((t) => t.address.toLowerCase() !== address.toLowerCase());
-                markDirty('verificationTokens');
-            }
-        },
-        markAsDeleted() {
-            data.deleted = new Date();
-            data.username = `deleted-${Date.now()}`;
-            data.emails = [];
-            data.roles = [];
-            data.services = {};
-            data.pushSubscriptions = [];
-            data.initialPassword = false;
-            data.profile = undefined;
-            data.lastBillingAddress = undefined;
-            data.lastContact = undefined;
-            data.lastLogin = undefined;
-            data.avatarId = undefined;
-            markDirty('deleted');
-        },
-        get isDirty() {
-            return isDirty;
-        },
-        get changes() {
-            return [...changes];
-        },
-        clearChanges() {
-            isDirty = false;
-            changes.length = 0;
-        },
-        toData() {
-            return JSON.parse(JSON.stringify(data));
-        },
-        toPublicData() {
-            const { services, ...publicData } = data;
-            return JSON.parse(JSON.stringify(publicData));
-        },
-    };
-    return user;
-};

package/lib/domain/model/UserProfile.d.ts

@@ -1,14 +0,0 @@
-import type { Address } from '../types.ts';
-export interface UserProfile {
-    displayName?: string;
-    birthday?: Date;
-    phoneMobile?: string;
-    gender?: string;
-    address?: Address;
-}
-export declare const UserProfile: {
-    create(data?: Partial<UserProfile>): UserProfile;
-    fromData(data: UserProfile): UserProfile;
-    merge(existing: UserProfile | undefined, updates: Partial<UserProfile>): UserProfile;
-    isEmpty(profile: UserProfile | undefined): boolean;
-};

package/lib/domain/model/UserProfile.js

@@ -1,29 +0,0 @@
-export const UserProfile = {
-    create(data = {}) {
-        return {
-            displayName: data.displayName?.trim(),
-            birthday: data.birthday,
-            phoneMobile: data.phoneMobile?.trim(),
-            gender: data.gender?.trim(),
-            address: data.address,
-        };
-    },
-    fromData(data) {
-        return { ...data };
-    },
-    merge(existing, updates) {
-        return {
-            ...existing,
-            ...updates,
-        };
-    },
-    isEmpty(profile) {
-        if (!profile)
-            return true;
-        return (!profile.displayName &&
-            !profile.birthday &&
-            !profile.phoneMobile &&
-            !profile.gender &&
-            !profile.address);
-    },
-};

package/lib/domain/model/Web3Address.d.ts

@@ -1,16 +0,0 @@
-export interface Web3Address {
-    readonly address: string;
-    nonce?: string;
-    verified: boolean;
-}
-export declare const Web3Address: {
-    create(address: string, nonce?: string): Web3Address;
-    fromData(data: {
-        address: string;
-        nonce?: string;
-        verified?: boolean;
-    }): Web3Address;
-    isValidAddress(address: string): boolean;
-    equals(a: Web3Address, b: Web3Address): boolean;
-    markVerified(web3Address: Web3Address): Web3Address;
-};

package/lib/domain/model/Web3Address.js

@@ -1,32 +0,0 @@
-export const Web3Address = {
-    create(address, nonce) {
-        if (!Web3Address.isValidAddress(address)) {
-            throw new Error(`Invalid Web3 address: ${address}`);
-        }
-        return {
-            address,
-            nonce,
-            verified: false,
-        };
-    },
-    fromData(data) {
-        return {
-            address: data.address,
-            nonce: data.nonce,
-            verified: data.verified ?? false,
-        };
-    },
-    isValidAddress(address) {
-        return /^0x[a-fA-F0-9]{40}$/.test(address);
-    },
-    equals(a, b) {
-        return a.address.toLowerCase() === b.address.toLowerCase();
-    },
-    markVerified(web3Address) {
-        return {
-            ...web3Address,
-            nonce: undefined,
-            verified: true,
-        };
-    },
-};

package/lib/domain/model/WebAuthnCredential.d.ts

@@ -1,22 +0,0 @@
-export type NamedAlgo = 'RS256' | 'ES256';
-export interface WebAuthnCredential {
-    readonly id: string;
-    readonly publicKey: string;
-    readonly algorithm: NamedAlgo;
-    readonly aaguid: string;
-    readonly type: 'public-key';
-    counter: number;
-    readonly created: Date;
-}
-export declare const WebAuthnCredential: {
-    create(data: {
-        id: string;
-        publicKey: string;
-        algorithm?: NamedAlgo;
-        aaguid?: string;
-        counter?: number;
-    }): WebAuthnCredential;
-    fromData(data: WebAuthnCredential): WebAuthnCredential;
-    equals(a: WebAuthnCredential, b: WebAuthnCredential): boolean;
-    updateCounter(credential: WebAuthnCredential, newCounter: number): WebAuthnCredential;
-};

package/lib/domain/model/WebAuthnCredential.js

@@ -1,28 +0,0 @@
-export const WebAuthnCredential = {
-    create(data) {
-        if (!data.id || !data.publicKey) {
-            throw new Error('WebAuthn credential requires id and publicKey');
-        }
-        return {
-            id: data.id,
-            publicKey: data.publicKey,
-            algorithm: data.algorithm ?? 'ES256',
-            aaguid: data.aaguid ?? '',
-            type: 'public-key',
-            counter: data.counter ?? 0,
-            created: new Date(),
-        };
-    },
-    fromData(data) {
-        return { ...data, type: 'public-key' };
-    },
-    equals(a, b) {
-        return a.id === b.id;
-    },
-    updateCounter(credential, newCounter) {
-        return {
-            ...credential,
-            counter: newCounter,
-        };
-    },
-};

package/lib/domain/model/index.d.ts

@@ -1,14 +0,0 @@
-export type { Email } from './Email.ts';
-export { Email as EmailFactory } from './Email.ts';
-export type { UserProfile } from './UserProfile.ts';
-export { UserProfile as UserProfileFactory } from './UserProfile.ts';
-export type { Web3Address } from './Web3Address.ts';
-export { Web3Address as Web3AddressFactory } from './Web3Address.ts';
-export type { WebAuthnCredential, NamedAlgo } from './WebAuthnCredential.ts';
-export { WebAuthnCredential as WebAuthnCredentialFactory } from './WebAuthnCredential.ts';
-export type { PasswordHash } from './PasswordHash.ts';
-export { PasswordHash as PasswordHashFactory } from './PasswordHash.ts';
-export type { PushSubscription } from './PushSubscription.ts';
-export { PushSubscription as PushSubscriptionFactory } from './PushSubscription.ts';
-export type { User, UserData, CreateUserParams } from './User.ts';
-export { createUser, reconstituteUser } from './User.ts';

package/lib/domain/model/index.js

@@ -1,7 +0,0 @@
-export { Email as EmailFactory } from "./Email.js";
-export { UserProfile as UserProfileFactory } from "./UserProfile.js";
-export { Web3Address as Web3AddressFactory } from "./Web3Address.js";
-export { WebAuthnCredential as WebAuthnCredentialFactory } from "./WebAuthnCredential.js";
-export { PasswordHash as PasswordHashFactory } from "./PasswordHash.js";
-export { PushSubscription as PushSubscriptionFactory } from "./PushSubscription.js";
-export { createUser, reconstituteUser } from "./User.js";

package/lib/domain/repository/UserRepository.d.ts

@@ -1,48 +0,0 @@
-import type { User } from '../model/User.ts';
-export interface UserQuery {
-    includeGuests?: boolean;
-    includeDeleted?: boolean;
-    queryString?: string;
-    emailVerified?: boolean;
-    lastLogin?: {
-        start?: string;
-        end?: string;
-    };
-    tags?: string[];
-    userIds?: string[];
-    username?: string;
-    usernames?: string[];
-    emails?: string[];
-    web3Verified?: boolean;
-}
-export interface FindOptions {
-    sort?: {
-        key: string;
-        value: 'ASC' | 'DESC';
-    }[];
-    limit?: number;
-    offset?: number;
-}
-export interface TokenResult {
-    userId: string;
-    address: string;
-    when: Date;
-    token: string;
-}
-export interface UserRepository {
-    findById(id: string): Promise<User | null>;
-    findByUsername(username: string): Promise<User | null>;
-    findByEmail(email: string): Promise<User | null>;
-    findByToken(hashedToken: string): Promise<User | null>;
-    findOne(query: UserQuery, options?: FindOptions): Promise<User | null>;
-    findMany(query: UserQuery, options?: FindOptions): Promise<User[]>;
-    count(query: UserQuery): Promise<number>;
-    exists(userId: string): Promise<boolean>;
-    findByVerificationToken(hashedToken: string, validAfter: Date): Promise<TokenResult | null>;
-    findByResetToken(hashedToken: string, validAfter: Date): Promise<TokenResult | null>;
-    save(user: User): Promise<void>;
-    insert(user: User): Promise<string>;
-    delete(userId: string): Promise<boolean>;
-    deleteUserSessions(userId: string): Promise<void>;
-    distinctTags(): Promise<string[]>;
-}

package/lib/domain/repository/UserRepository.js

@@ -1 +0,0 @@
-export {};

package/lib/domain/services/PasswordService.d.ts

@@ -1,5 +0,0 @@
-import type { PasswordHash } from '../model/PasswordHash.ts';
-export interface PasswordService {
-    hash(plainPassword: string): Promise<PasswordHash>;
-    verify(hash: PasswordHash, plainPassword: string): Promise<boolean>;
-}

package/lib/domain/services/PasswordService.js

@@ -1 +0,0 @@
-export {};

package/lib/domain/services/TokenService.d.ts

@@ -1,8 +0,0 @@
-export interface TokenService {
-    generateToken(): string;
-    hashToken(plainToken: string): Promise<string>;
-    generateHashedToken(): Promise<{
-        plain: string;
-        hashed: string;
-    }>;
-}

package/lib/domain/services/TokenService.js

@@ -1 +0,0 @@
-export {};

package/lib/domain/types.d.ts

@@ -1,28 +0,0 @@
-export interface Address {
-    firstName?: string;
-    lastName?: string;
-    company?: string;
-    addressLine?: string;
-    addressLine2?: string;
-    postalCode?: string;
-    regionCode?: string;
-    city?: string;
-    countryCode?: string;
-}
-export interface Contact {
-    telNumber?: string;
-    emailAddress?: string;
-}
-export interface UserLastLogin {
-    timestamp?: Date;
-    locale?: string;
-    countryCode?: string;
-    remoteAddress?: string;
-    remotePort?: number;
-    userAgent?: string;
-}
-export interface TokenRecord {
-    token: string;
-    address: string;
-    when: Date;
-}

package/lib/domain/types.js

@@ -1 +0,0 @@
-export {};

package/lib/infrastructure/persistence/MongoUserRepository.d.ts

@@ -1,4 +0,0 @@
-import { type mongodb } from '@unchainedshop/mongodb';
-import type { UserRepository } from '../../domain/repository/UserRepository.ts';
-import { type UserData } from '../../domain/model/User.ts';
-export declare const createMongoUserRepository: (collection: mongodb.Collection<UserData>, db: mongodb.Db) => UserRepository;

package/lib/infrastructure/persistence/MongoUserRepository.js

@@ -1,159 +0,0 @@
-import { generateDbFilterById, buildSortOptions, insensitiveTrimmedRegexOperator, } from '@unchainedshop/mongodb';
-import { SortDirection } from '@unchainedshop/utils';
-import { reconstituteUser } from "../../domain/model/User.js";
-import { buildUserSelector } from "./buildUserSelector.js";
-export const createMongoUserRepository = (collection, db) => {
-    const buildFindOptions = (options) => {
-        const findOptions = {};
-        if (options?.offset) {
-            findOptions.skip = options.offset;
-        }
-        if (options?.limit) {
-            findOptions.limit = options.limit;
-        }
-        if (options?.sort) {
-            findOptions.sort = buildSortOptions(options.sort);
-        }
-        return findOptions;
-    };
-    return {
-        async findById(id) {
-            if (!id)
-                return null;
-            const data = await collection.findOne(generateDbFilterById(id));
-            return data ? reconstituteUser(data) : null;
-        },
-        async findByUsername(username) {
-            if (!username)
-                return null;
-            const data = await collection.findOne({
-                username: insensitiveTrimmedRegexOperator(username),
-            });
-            return data ? reconstituteUser(data) : null;
-        },
-        async findByEmail(email) {
-            if (!email)
-                return null;
-            const data = await collection.findOne({
-                'emails.address': insensitiveTrimmedRegexOperator(email),
-            });
-            return data ? reconstituteUser(data) : null;
-        },
-        async findByToken(hashedToken) {
-            if (!hashedToken)
-                return null;
-            const data = await collection.findOne({
-                'services.token.secret': hashedToken,
-            });
-            return data ? reconstituteUser(data) : null;
-        },
-        async findOne(query, options) {
-            const selector = buildUserSelector(query);
-            const findOptions = buildFindOptions(options);
-            const data = await collection.findOne(selector, findOptions);
-            return data ? reconstituteUser(data) : null;
-        },
-        async findMany(query, options) {
-            const selector = buildUserSelector(query);
-            const defaultSort = [{ key: 'created', value: SortDirection.ASC }];
-            const findOptions = buildFindOptions(options);
-            if (query.queryString) {
-                const docs = await collection
-                    .find(selector, {
-                    ...findOptions,
-                    projection: { score: { $meta: 'textScore' } },
-                    sort: { score: { $meta: 'textScore' } },
-                })
-                    .toArray();
-                return docs.map(reconstituteUser);
-            }
-            if (!findOptions.sort) {
-                findOptions.sort = buildSortOptions(defaultSort);
-            }
-            const docs = await collection.find(selector, findOptions).toArray();
-            return docs.map(reconstituteUser);
-        },
-        async count(query) {
-            const selector = buildUserSelector(query);
-            return collection.countDocuments(selector);
-        },
-        async exists(userId) {
-            const count = await collection.countDocuments({ _id: userId, deleted: null }, { limit: 1 });
-            return count === 1;
-        },
-        async findByVerificationToken(hashedToken, validAfter) {
-            if (!hashedToken)
-                return null;
-            const data = await collection.findOne({
-                'services.email.verificationTokens': {
-                    $elemMatch: {
-                        token: hashedToken,
-                        when: { $gt: validAfter },
-                    },
-                },
-            });
-            if (!data)
-                return null;
-            const verificationToken = data.services?.email?.verificationTokens?.find((v) => v.token === hashedToken);
-            if (!verificationToken)
-                return null;
-            return {
-                userId: data._id,
-                address: verificationToken.address,
-                when: verificationToken.when,
-                token: verificationToken.token,
-            };
-        },
-        async findByResetToken(hashedToken, validAfter) {
-            if (!hashedToken)
-                return null;
-            const data = await collection.findOne({
-                'services.password.reset': {
-                    $elemMatch: {
-                        token: hashedToken,
-                        when: { $gt: validAfter },
-                    },
-                },
-            });
-            if (!data)
-                return null;
-            const passwordService = data.services?.password;
-            const resetToken = passwordService?.reset?.find((v) => v.token === hashedToken);
-            if (!resetToken)
-                return null;
-            return {
-                userId: data._id,
-                address: resetToken.address,
-                when: resetToken.when,
-                token: resetToken.token,
-            };
-        },
-        async save(user) {
-            const data = user.toData();
-            await collection.replaceOne({ _id: data._id }, data, { upsert: true });
-            user.clearChanges();
-        },
-        async insert(user) {
-            const data = user.toData();
-            await collection.insertOne(data);
-            user.clearChanges();
-            return data._id;
-        },
-        async delete(userId) {
-            const result = await collection.deleteOne({ _id: userId });
-            return result.deletedCount > 0;
-        },
-        async deleteUserSessions(userId) {
-            await db.collection('sessions').deleteMany({
-                session: insensitiveTrimmedRegexOperator(`"user":"${userId}"`),
-            });
-        },
-        async distinctTags() {
-            const tags = (await collection.distinct('tags', {
-                tags: { $exists: true },
-                deleted: null,
-            }));
-            return tags.filter(Boolean).sort();
-        },
-    };
-};

package/lib/infrastructure/persistence/buildUserSelector.d.ts

@@ -1,4 +0,0 @@
-import { type mongodb } from '@unchainedshop/mongodb';
-import type { UserQuery } from '../../domain/repository/UserRepository.ts';
-import type { UserData } from '../../domain/model/User.ts';
-export declare const buildUserSelector: ({ includeGuests, includeDeleted, queryString, emailVerified, lastLogin, tags, userIds, username, usernames, emails, web3Verified, }: UserQuery) => mongodb.Filter<UserData>;

package/lib/infrastructure/persistence/buildUserSelector.js

@@ -1,54 +0,0 @@
-import { insensitiveTrimmedRegexOperator, assertDocumentDBCompatMode, } from '@unchainedshop/mongodb';
-export const buildUserSelector = ({ includeGuests, includeDeleted, queryString, emailVerified, lastLogin, tags, userIds, username, usernames, emails, web3Verified, }) => {
-    const selector = {};
-    if (!includeDeleted) {
-        selector.deleted = null;
-    }
-    if (!includeGuests) {
-        selector.guest = { $ne: true };
-    }
-    if (userIds) {
-        selector._id = { $in: userIds };
-    }
-    if (username) {
-        selector.username = insensitiveTrimmedRegexOperator(username);
-    }
-    if (usernames?.length) {
-        selector.username = {
-            $in: usernames.map((u) => insensitiveTrimmedRegexOperator(u)),
-        };
-    }
-    if (emails?.length) {
-        selector['emails.address'] = {
-            $in: emails.map((e) => insensitiveTrimmedRegexOperator(e)),
-        };
-    }
-    if (emailVerified === true) {
-        selector['emails.verified'] = true;
-    }
-    if (emailVerified === false) {
-        selector['emails.verified'] = { $ne: true };
-    }
-    if (Array.isArray(tags) && tags.length) {
-        selector.tags = { $in: tags };
-    }
-    if (web3Verified === true) {
-        selector['services.web3.verified'] = true;
-    }
-    if (lastLogin?.start || lastLogin?.end) {
-        const timestampFilter = { $exists: true };
-        if (lastLogin.end) {
-            timestampFilter.$lte = typeof lastLogin.end === 'string' ? new Date(lastLogin.end) : lastLogin.end;
-        }
-        if (lastLogin.start) {
-            timestampFilter.$gte =
-                typeof lastLogin.start === 'string' ? new Date(lastLogin.start) : lastLogin.start;
-        }
-        selector['lastLogin.timestamp'] = timestampFilter;
-    }
-    if (queryString) {
-        assertDocumentDBCompatMode();
-        selector.$text = { $search: queryString };
-    }
-    return selector;
-};

package/lib/infrastructure/services/CryptoTokenService.d.ts

@@ -1,2 +0,0 @@
-import type { TokenService } from '../../domain/services/TokenService.ts';
-export declare const createCryptoTokenService: () => TokenService;

package/lib/infrastructure/services/CryptoTokenService.js

@@ -1,16 +0,0 @@
-import { sha256 } from '@unchainedshop/utils';
-export const createCryptoTokenService = () => {
-    return {
-        generateToken() {
-            return crypto.randomUUID();
-        },
-        async hashToken(plainToken) {
-            return sha256(plainToken);
-        },
-        async generateHashedToken() {
-            const plain = crypto.randomUUID();
-            const hashed = await sha256(plain);
-            return { plain, hashed };
-        },
-    };
-};

package/lib/infrastructure/services/Pbkdf2PasswordService.d.ts

@@ -1,2 +0,0 @@
-import type { PasswordService } from '../../domain/services/PasswordService.ts';
-export declare const createPbkdf2PasswordService: () => PasswordService;

package/lib/infrastructure/services/Pbkdf2PasswordService.js

@@ -1,23 +0,0 @@
-import * as bcrypt from 'bcryptjs';
-import { sha256 } from '@unchainedshop/utils';
-import * as pbkdf2 from "../../module/pbkdf2.js";
-export const createPbkdf2PasswordService = () => {
-    return {
-        async hash(plainPassword) {
-            const salt = pbkdf2.generateSalt();
-            const hashedPassword = await pbkdf2.getDerivedKey(salt, plainPassword);
-            return { pbkdf2: `${salt}:${hashedPassword}` };
-        },
-        async verify(hash, plainPassword) {
-            if (hash.pbkdf2) {
-                const [pbkdf2Salt, pbkdf2Hash] = hash.pbkdf2.split(':');
-                return pbkdf2.compare(plainPassword, pbkdf2Hash, pbkdf2Salt);
-            }
-            if (hash.bcrypt) {
-                const password = await sha256(plainPassword);
-                return bcrypt.compare(password, hash.bcrypt);
-            }
-            return false;
-        },
-    };
-};