@unchainedshop/core-users 5.0.0-alpha.1 → 5.0.0-alpha.11

package/README.md

@@ -13,143 +13,22 @@ npm install @unchainedshop/core-users
 
 ## Usage
 
-```typescript
-import { configureUsersModule } from '@unchainedshop/core-users';
-
-const usersModule = await configureUsersModule({ db });
-
-// Find users
-const users = await usersModule.findUsers({
-  includeGuests: false,
-  limit: 50,
-});
+The platform initializes this module as `platform.unchainedAPI.modules.users`.
 
-// Create a user
-const userId = await usersModule.createUser({
-  email: 'user@example.com',
-  password: 'securePassword',
-});
+```typescript
+const { users } = platform.unchainedAPI.modules;
+const customers = await users.findUsers({ includeGuests: false, limit: 50 });
 
-// Update profile
-await usersModule.updateProfile(userId, {
-  displayName: 'John Doe',
+await users.updateProfile('user-123', {
+  profile: { displayName: 'Jane Doe' },
 });
 ```
 
-## API Overview
-
-### Module Configuration
-
-| Export | Description |
-|--------|-------------|
-| `configureUsersModule` | Configure and return the users module |
-| `configureUsersWebAuthnModule` | Configure WebAuthn submodule |
-
-### Queries
-
-| Method | Description |
-|--------|-------------|
-| `findUser` | Find user by ID, email, or username |
-| `findUsers` | Find users with filtering, sorting, and pagination |
-| `count` | Count users matching query |
-| `userExists` | Check if a user exists |
-
-### Mutations
-
-| Method | Description |
-|--------|-------------|
-| `createUser` | Create a new user account |
-| `updateUser` | Update user data |
-| `updateProfile` | Update user profile |
-| `updateRoles` | Update user roles |
-| `updateTags` | Update user tags |
-| `updateAvatar` | Set user avatar |
-| `updateBillingAddress` | Update billing address |
-| `updatePassword` | Change user password |
-| `updateUsername` | Change username |
-| `delete` | Soft delete a user |
-| `replaceUserId` | Migrate data between users |
-
-### Authentication
-
-| Method | Description |
-|--------|-------------|
-| `verifyPassword` | Verify password against stored hash |
-| `hashPassword` | Hash a password for storage |
-| `addEmail` | Add email address to user |
-| `removeEmail` | Remove email address |
-| `verifyEmail` | Mark email as verified |
-| `updateHeartbeat` | Update last activity timestamp |
-| `updateLastLogin` | Record login event |
-
-### WebAuthn Submodule
-
-| Method | Description |
-|--------|-------------|
-| `webAuthn.findCredentials` | Find WebAuthn credentials for user |
-| `webAuthn.createCredential` | Register new WebAuthn credential |
-| `webAuthn.removeCredential` | Remove WebAuthn credential |
-
-### Settings
-
-| Export | Description |
-|--------|-------------|
-| `userSettings` | Access user module settings |
-| `UserAccountAction` | Account action types enum |
-
-### Types
-
-| Export | Description |
-|--------|-------------|
-| `User` | User document type |
-| `UserQuery` | Query parameters type |
-| `UserProfile` | User profile type |
-| `Email` | Email address type |
-| `UsersModule` | Module interface type |
-| `UserSettingsOptions` | Configuration options type |
-
-## Events
-
-| Event | Description |
-|-------|-------------|
-| `USER_CREATE` | User created |
-| `USER_UPDATE` | User updated |
-| `USER_REMOVE` | User deleted |
-| `USER_UPDATE_PROFILE` | Profile updated |
-| `USER_UPDATE_PASSWORD` | Password changed |
-| `USER_UPDATE_ROLES` | Roles changed |
-| `USER_ACCOUNT_ACTION` | Account action triggered |
-
-## Security
-
-This module implements security best practices for user authentication and data protection.
-
-### Password Security
-
-- **Algorithm**: PBKDF2 with SHA-512
-- **Iterations**: 300,000 (exceeds OWASP recommendation)
-- **Salt**: 16 bytes, cryptographically random per password
-- **Key Length**: 256 bytes
-- **FIPS 140-3**: Compatible when running on FIPS-enabled Node.js
-
-### Token Security
-
-- **Generation**: `crypto.randomUUID()` (CSPRNG-based)
-- **Storage**: SHA-256 hashed before database storage
-- **Expiration**: Time-limited (configurable, default 1 hour)
-- **Single-use**: Tokens invalidated after verification
-
-### WebAuthn/FIDO2
-
-Full support for passwordless authentication via hardware security keys and platform authenticators, providing phishing-resistant authentication.
-
-### Data Protection
+`updateProfile` accepts an object containing `profile` and optional `meta`. Account creation uses `createUser`; account deletion uses `markDeleted` or `deletePermanently`. Authentication flows and permissions are coordinated by the API layer.
 
-- Sensitive data (password hashes, tokens) stripped from event emissions via `removeConfidentialServiceHashes()`
-- Soft delete preserves audit trail while removing PII
-- Email addresses and profile data access-controlled via RBAC
+See the [module settings](https://docs.unchained.shop/platform-configuration/modules/users), [authentication guide](https://docs.unchained.shop/concepts/authentication), [public exports](src/users-index.ts), and [module implementation](src/module/configureUsersModule.ts).
 
-See [SECURITY.md](../../SECURITY.md) for complete security documentation.
+For security reporting and the implementation's security properties, see [SECURITY.md](../../SECURITY.md).
 
 ## License
 

package/lib/db/UsersCollection.js

@@ -1,36 +1,34 @@
-import { buildDbIndexes, isDocumentDBCompatModeEnabled, } from '@unchainedshop/mongodb';
+import { buildDbIndexes, } from '@unchainedshop/mongodb';
 export const UsersCollection = async (db) => {
     const Users = db.collection('users');
-    if (!isDocumentDBCompatModeEnabled()) {
-        await buildDbIndexes(Users, [
-            {
-                index: {
-                    _id: 'text',
-                    username: 'text',
-                    'emails.address': 'text',
-                    'profile.displayName': 'text',
-                    'lastBillingAddress.firstName': 'text',
-                    'lastBillingAddress.lastName': 'text',
-                    'lastBillingAddress.company': 'text',
-                    'lastBillingAddress.addressLine': 'text',
-                    'lastBillingAddress.addressLine2': 'text',
-                },
-                options: {
-                    weights: {
-                        _id: 9,
-                        'emails.address': 7,
-                        'profile.displayName': 5,
-                        'lastBillingAddress.firstName': 3,
-                        'lastBillingAddress.lastName': 3,
-                        'lastBillingAddress.company': 1,
-                        'lastBillingAddress.addressLine': 1,
-                        'lastBillingAddress.addressLine2': 1,
-                    },
-                    name: 'user_fulltext_search',
+    await buildDbIndexes(Users, [
+        {
+            index: {
+                _id: 'text',
+                username: 'text',
+                'emails.address': 'text',
+                'profile.displayName': 'text',
+                'lastBillingAddress.firstName': 'text',
+                'lastBillingAddress.lastName': 'text',
+                'lastBillingAddress.company': 'text',
+                'lastBillingAddress.addressLine': 'text',
+                'lastBillingAddress.addressLine2': 'text',
+            },
+            options: {
+                weights: {
+                    _id: 9,
+                    'emails.address': 7,
+                    'profile.displayName': 5,
+                    'lastBillingAddress.firstName': 3,
+                    'lastBillingAddress.lastName': 3,
+                    'lastBillingAddress.company': 1,
+                    'lastBillingAddress.addressLine': 1,
+                    'lastBillingAddress.addressLine2': 1,
                 },
+                name: 'user_fulltext_search',
             },
-        ]);
-    }
+        },
+    ]);
     await buildDbIndexes(Users, [
         {
             index: {
@@ -96,6 +94,30 @@ export const UsersCollection = async (db) => {
                 sparse: true,
             },
         },
+        {
+            index: {
+                'services.web3.verified': 1,
+            },
+            options: {
+                sparse: true,
+            },
+        },
+        {
+            index: {
+                tags: 1,
+            },
+            options: {
+                sparse: true,
+            },
+        },
+        {
+            index: {
+                'lastLogin.timestamp': 1,
+            },
+            options: {
+                sparse: true,
+            },
+        },
     ]);
     return Users;
 };

package/lib/db/WebAuthnCredentialsCreationRequestsCollection.d.ts

@@ -4,6 +4,7 @@ export interface WebAuthnCredentialsCreationRequest {
     username: string;
     origin: string;
     factor: 'first' | 'second' | 'either';
+    created?: Date;
 }
 type Collection = WebAuthnCredentialsCreationRequest & {
     _id: string;

package/lib/db/WebAuthnCredentialsCreationRequestsCollection.js

@@ -2,11 +2,8 @@ import { buildDbIndexes } from '@unchainedshop/mongodb';
 export const WebAuthnCredentialsCreationRequestsCollection = async (db) => {
     const WebAuthnCredentialsCreationRequests = db.collection('accounts_webauthn_credentials_creation_requests');
     await buildDbIndexes(WebAuthnCredentialsCreationRequests, [
-        {
-            index: {
-                username: 1,
-            },
-        },
+        { index: { username: 1 } },
+        { index: { created: 1 }, options: { expireAfterSeconds: 15 * 60 } },
     ]);
     return WebAuthnCredentialsCreationRequests;
 };

package/lib/migrations/20260625120200-normalize-profile-phone.d.ts

@@ -0,0 +1,2 @@
+import type { MigrationRepository } from '@unchainedshop/mongodb';
+export default function normalizeProfilePhone(repository: MigrationRepository): void;

package/lib/migrations/20260625120200-normalize-profile-phone.js

@@ -0,0 +1,52 @@
+import { normalizePhoneNumber } from '@unchainedshop/utils';
+import { UsersCollection } from "../db/UsersCollection.js";
+export default function normalizeProfilePhone(repository) {
+    repository?.register({
+        id: 20260625120200,
+        name: 'Normalize user.profile.phoneMobile and user.lastContact.telNumber to E.164 format',
+        up: async ({ logger }) => {
+            const Users = await UsersCollection(repository.db);
+            const users = await Users.find({
+                $or: [
+                    { 'profile.phoneMobile': { $exists: true, $nin: [null, ''] } },
+                    { 'lastContact.telNumber': { $exists: true, $nin: [null, ''] } },
+                ],
+            }, {
+                projection: {
+                    _id: true,
+                    profile: true,
+                    lastContact: true,
+                    lastBillingAddress: true,
+                    lastLogin: true,
+                },
+            }).toArray();
+            let changed = 0;
+            let skipped = 0;
+            for (const user of users) {
+                const defaultCountry = user.lastBillingAddress?.countryCode ||
+                    user.profile?.address?.countryCode ||
+                    user.lastLogin?.countryCode;
+                const $set = {};
+                const phoneMobile = user.profile?.phoneMobile;
+                const normalizedPhoneMobile = normalizePhoneNumber(phoneMobile, defaultCountry);
+                if (normalizedPhoneMobile && normalizedPhoneMobile !== phoneMobile) {
+                    $set['profile.phoneMobile'] = normalizedPhoneMobile;
+                }
+                const telNumber = user.lastContact?.telNumber;
+                const normalizedTelNumber = normalizePhoneNumber(telNumber, defaultCountry);
+                if (normalizedTelNumber && normalizedTelNumber !== telNumber) {
+                    $set['lastContact.telNumber'] = normalizedTelNumber;
+                }
+                if (Object.keys($set).length === 0) {
+                    if ((phoneMobile && !normalizedPhoneMobile) || (telNumber && !normalizedTelNumber)) {
+                        skipped += 1;
+                    }
+                    continue;
+                }
+                await Users.updateOne({ _id: user._id }, { $set });
+                changed += 1;
+            }
+            logger?.info(`Normalize user phone numbers: ${changed} updated, ${skipped} left unchanged (unparseable)`);
+        },
+    });
+}

package/lib/module/configureUsersModule.d.ts

@@ -64,6 +64,12 @@ export declare const configureUsersModule: (moduleInput: ModuleInput<UserSetting
         limit?: number;
         offset?: number;
     }): Promise<User[]>;
+    findGuestUserIds({ before }: {
+        before: Date;
+    }): Promise<string[]>;
+    findExistingUserIds({ userIds }: {
+        userIds: string[];
+    }): Promise<string[]>;
     userExists({ userId }: {
         userId: string;
     }): Promise<boolean>;
@@ -136,5 +142,16 @@ export declare const configureUsersModule: (moduleInput: ModuleInput<UserSetting
     }) => Promise<void>;
     removePushSubscription: (userId: string, p256dh: string) => Promise<void>;
     existingTags: () => Promise<string[]>;
+    bulkUpdateTags: (userIds: string[], { add, remove }: {
+        add?: string[];
+        remove?: string[];
+    }) => Promise<{
+        successIds: string[];
+        failedIds: string[];
+    }>;
+    bulkUpdateRoles: (userIds: string[], roles: string[]) => Promise<{
+        successIds: string[];
+        failedIds: string[];
+    }>;
 }>;
 export type UsersModule = Awaited<ReturnType<typeof configureUsersModule>>;

package/lib/module/configureUsersModule.js

@@ -1,13 +1,14 @@
 import * as bcrypt from 'bcryptjs';
-import { generateDbFilterById, buildSortOptions, generateDbObjectId, insensitiveTrimmedRegexOperator, assertDocumentDBCompatMode, } from '@unchainedshop/mongodb';
+import { generateDbFilterById, buildSortOptions, generateDbObjectId, insensitiveTrimmedRegexOperator, } from '@unchainedshop/mongodb';
 import { UsersCollection, } from "../db/UsersCollection.js";
 import { emit, registerEvents } from '@unchainedshop/events';
-import { systemLocale, SortDirection, sha256 } from '@unchainedshop/utils';
+import { executeBulkOperation, systemLocale, SortDirection, sha256, normalizePhoneNumber, } from '@unchainedshop/utils';
 import { UserAccountAction, userSettings, } from "../users-settings.js";
 import { configureUsersWebAuthnModule } from "./configureUsersWebAuthnModule.js";
 import * as pbkdf2 from "./pbkdf2.js";
 import { verifyWeb3Signature } from "../utils/web3-verification.js";
 import convertUserLocale from "../migrations/20241218092300-convert-locale.js";
+import normalizeProfilePhone from "../migrations/20260625120200-normalize-profile-phone.js";
 const USER_EVENTS = [
     'USER_ACCOUNT_ACTION',
     'USER_CREATE',
@@ -26,6 +27,7 @@ const USER_EVENTS = [
     'USER_UPDATE_WEB3_ADDRESS',
     'USER_REMOVE',
 ];
+const ADMIN_ROLE = 'admin';
 export const removeConfidentialServiceHashes = (rawUser) => {
     const user = { ...rawUser };
     delete user?.services;
@@ -45,12 +47,12 @@ export const buildFindSelector = ({ includeGuests, includeDeleted, queryString,
     }
     if (usernames?.length) {
         selector.username = {
-            $in: usernames.map((u) => insensitiveTrimmedRegexOperator(u)),
+            $in: usernames.map((u) => insensitiveTrimmedRegexOperator(u).$regex),
         };
     }
     if (emails?.length) {
         selector['emails.address'] = {
-            $in: emails.map((e) => insensitiveTrimmedRegexOperator(e)),
+            $in: emails.map((e) => insensitiveTrimmedRegexOperator(e).$regex),
         };
     }
     if (emailVerified === true) {
@@ -75,7 +77,6 @@ export const buildFindSelector = ({ includeGuests, includeDeleted, queryString,
         selector['lastLogin.timestamp'].$gte = new Date(lastLogin.start);
     }
     if (queryString) {
-        assertDocumentDBCompatMode();
         selector.$text = { $search: queryString };
     }
     return selector;
@@ -83,10 +84,49 @@ export const buildFindSelector = ({ includeGuests, includeDeleted, queryString,
 export const configureUsersModule = async (moduleInput) => {
     const { db, options, migrationRepository } = moduleInput;
     convertUserLocale(migrationRepository);
+    normalizeProfilePhone(migrationRepository);
     userSettings.configureSettings(options || {}, db);
     registerEvents(USER_EVENTS);
     const Users = await UsersCollection(db);
     const webAuthn = await configureUsersWebAuthnModule(moduleInput);
+    const assertAnotherActiveAdminExists = async (userId) => {
+        const user = await Users.findOne({ _id: userId, deleted: null });
+        if (!user?.roles?.includes(ADMIN_ROLE))
+            return;
+        const activeAdminCount = await Users.countDocuments({ deleted: null, roles: ADMIN_ROLE }, { limit: 2 });
+        if (activeAdminCount <= 1)
+            throw new Error('At least one active administrator is required. Assign another administrator before removing this account or revoking its admin role.', { cause: 'LAST_ADMIN' });
+    };
+    const updateUserRoles = async (_id, roles) => {
+        if (!roles.includes(ADMIN_ROLE))
+            await assertAnotherActiveAdminExists(_id);
+        const user = await Users.findOneAndUpdate(generateDbFilterById(_id), {
+            $set: {
+                updated: new Date(),
+                roles,
+            },
+        }, { returnDocument: 'after' });
+        if (!user)
+            return null;
+        await emit('USER_UPDATE_ROLE', {
+            user: removeConfidentialServiceHashes(user),
+        });
+        return user;
+    };
+    const updateUserTags = async (_id, tags) => {
+        const user = await Users.findOneAndUpdate(generateDbFilterById(_id), {
+            $set: {
+                updated: new Date(),
+                tags,
+            },
+        }, { returnDocument: 'after' });
+        if (!user)
+            return null;
+        await emit('USER_UPDATE_TAGS', {
+            user: removeConfidentialServiceHashes(user),
+        });
+        return user;
+    };
     return {
         webAuthn,
         async count(query) {
@@ -198,6 +238,23 @@ export const configureUsersModule = async (moduleInput) => {
                 sort: buildSortOptions(query.sort || defaultSort),
             }).toArray();
         },
+        async findGuestUserIds({ before }) {
+            const users = await Users.find({
+                guest: true,
+                deleted: null,
+                created: { $lte: before },
+                $or: [
+                    { 'lastLogin.timestamp': { $exists: false } },
+                    { 'lastLogin.timestamp': { $lte: before } },
+                ],
+            }, { projection: { _id: 1 } }).toArray();
+            return users.map((u) => u._id);
+        },
+        async findExistingUserIds({ userIds }) {
+            if (!userIds.length)
+                return [];
+            return Users.distinct('_id', { _id: { $in: userIds } });
+        },
         async userExists({ userId }) {
             const userCount = await Users.countDocuments({ _id: userId, deleted: null }, { limit: 1 });
             return userCount === 1;
@@ -588,6 +645,7 @@ export const configureUsersModule = async (moduleInput) => {
             return user;
         },
         markDeleted: async (userId) => {
+            await assertAnotherActiveAdminExists(userId);
             await Users.updateOne({ _id: userId }, { $inc: { tokenVersion: 1 } });
             const user = await Users.findOneAndUpdate({ _id: userId }, {
                 $set: {
@@ -615,6 +673,7 @@ export const configureUsersModule = async (moduleInput) => {
             return user;
         },
         deletePermanently: async ({ userId }) => {
+            await assertAnotherActiveAdminExists(userId);
             return Users.findOneAndDelete({ _id: userId });
         },
         updateProfile: async (userId, updatedData) => {
@@ -624,11 +683,28 @@ export const configureUsersModule = async (moduleInput) => {
                 return Users.findOne(userFilter, {});
             }
             const modifier = { $set: {} };
-            if (profile) {
-                modifier.$set = Object.keys(profile).reduce((acc, profileKey) => {
+            let normalizedProfile = profile;
+            if (profile?.phoneMobile) {
+                let defaultCountry = profile.address?.countryCode;
+                if (!defaultCountry) {
+                    const existing = await Users.findOne(userFilter, {
+                        projection: { lastBillingAddress: true, profile: true, lastLogin: true },
+                    });
+                    defaultCountry =
+                        existing?.lastBillingAddress?.countryCode ||
+                            existing?.profile?.address?.countryCode ||
+                            existing?.lastLogin?.countryCode;
+                }
+                normalizedProfile = {
+                    ...profile,
+                    phoneMobile: normalizePhoneNumber(profile.phoneMobile, defaultCountry) || profile.phoneMobile,
+                };
+            }
+            if (normalizedProfile) {
+                modifier.$set = Object.keys(normalizedProfile).reduce((acc, profileKey) => {
                     return {
                         ...acc,
-                        [`profile.${profileKey}`]: profile[profileKey],
+                        [`profile.${profileKey}`]: normalizedProfile[profileKey],
                     };
                 }, {});
             }
@@ -685,14 +761,23 @@ export const configureUsersModule = async (moduleInput) => {
                 return null;
             const profile = user.profile || {};
             const isGuest = !!user.guest;
+            const defaultCountry = user.lastBillingAddress?.countryCode ||
+                profile.address?.countryCode ||
+                user.lastLogin?.countryCode;
+            const normalizedContact = lastContact?.telNumber
+                ? {
+                    ...lastContact,
+                    telNumber: normalizePhoneNumber(lastContact.telNumber, defaultCountry) || lastContact.telNumber,
+                }
+                : lastContact;
             const modifier = {
                 $set: {
                     updated: new Date(),
-                    lastContact,
+                    lastContact: normalizedContact,
                 },
             };
-            if ((!profile.phoneMobile || isGuest) && lastContact.telNumber) {
-                modifier.$set['profile.phoneMobile'] = lastContact.telNumber;
+            if ((!profile.phoneMobile || isGuest) && normalizedContact.telNumber) {
+                modifier.$set['profile.phoneMobile'] = normalizedContact.telNumber;
             }
             const updatedUser = await Users.findOneAndUpdate(userFilter, modifier, {
                 returnDocument: 'after',
@@ -704,23 +789,7 @@ export const configureUsersModule = async (moduleInput) => {
             });
             return updatedUser;
         },
-        updateRoles: async (_id, roles) => {
-            const modifier = {
-                $set: {
-                    updated: new Date(),
-                    roles,
-                },
-            };
-            const user = await Users.findOneAndUpdate(generateDbFilterById(_id), modifier, {
-                returnDocument: 'after',
-            });
-            if (!user)
-                return null;
-            await emit('USER_UPDATE_ROLE', {
-                user: removeConfidentialServiceHashes(user),
-            });
-            return user;
-        },
+        updateRoles: updateUserRoles,
         incrementTokenVersion: async (userId) => {
             const user = await Users.findOneAndUpdate(generateDbFilterById(userId), {
                 $inc: { tokenVersion: 1 },
@@ -728,7 +797,7 @@ export const configureUsersModule = async (moduleInput) => {
             }, { returnDocument: 'after' });
             if (!user)
                 return null;
-            return { tokenVersion: user.tokenVersion ?? 1 };
+            return { tokenVersion: user.tokenVersion ?? 0 };
         },
         updateOidcLogoutAt: async (userId, date) => {
             const user = await Users.findOneAndUpdate(generateDbFilterById(userId), {
@@ -740,22 +809,7 @@ export const configureUsersModule = async (moduleInput) => {
             }, { returnDocument: 'after' });
             return user;
         },
-        updateTags: async (_id, tags) => {
-            const user = await Users.findOneAndUpdate(generateDbFilterById(_id), {
-                $set: {
-                    updated: new Date(),
-                    tags,
-                },
-            }, {
-                returnDocument: 'after',
-            });
-            if (!user)
-                return null;
-            await emit('USER_UPDATE_TAGS', {
-                user: removeConfidentialServiceHashes(user),
-            });
-            return user;
-        },
+        updateTags: updateUserTags,
         updateUser: async (selector, modifier, updateOptions) => {
             const user = await Users.findOneAndUpdate(selector, modifier, {
                 ...updateOptions,
@@ -799,5 +853,25 @@ export const configureUsersModule = async (moduleInput) => {
             }));
             return tags.filter(Boolean).toSorted();
         },
+        bulkUpdateTags: async (userIds, { add = [], remove = [] }) => {
+            const tagsToRemove = new Set(remove);
+            return executeBulkOperation(userIds, async (userId) => {
+                const user = await Users.findOne({ _id: userId, deleted: null }, {});
+                if (!user)
+                    throw new Error('not-found');
+                const tags = (user.tags || []).filter((tag) => !tagsToRemove.has(tag));
+                for (const tag of add) {
+                    if (!tags.includes(tag))
+                        tags.push(tag);
+                }
+                await updateUserTags(userId, tags);
+            });
+        },
+        bulkUpdateRoles: async (userIds, roles) => executeBulkOperation(userIds, async (userId) => {
+            const user = await Users.findOne({ _id: userId, deleted: null }, { projection: { _id: 1 } });
+            if (!user)
+                throw new Error('not-found');
+            await updateUserRoles(userId, roles);
+        }),
     };
 };

package/lib/module/configureUsersWebAuthnModule.js

@@ -36,7 +36,7 @@ async function fetchMDSEntriesImpl() {
     }
     return cache;
 }
-const fetchMDSEntries = memoizeWithTTL(fetchMDSEntriesImpl, ONE_DAY_MS);
+const fetchMDSEntries = memoizeWithTTL(fetchMDSEntriesImpl, { ttl: ONE_DAY_MS });
 export function toArrayBuffer(buffer) {
     return buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength);
 }
@@ -64,6 +64,7 @@ export const configureUsersWebAuthnModule = async ({ db }) => {
                 origin,
                 factor: 'either',
                 username,
+                created: new Date(),
             });
             return {
                 challenge,
@@ -96,6 +97,7 @@ export const configureUsersWebAuthnModule = async ({ db }) => {
                 origin,
                 factor: 'either',
                 username,
+                created: new Date(),
             });
             return {
                 challenge,

package/lib/users-settings.d.ts

@@ -16,6 +16,7 @@ export type UserAccountAction = (typeof UserAccountAction)[keyof typeof UserAcco
 export interface UserSettings {
     mergeUserCartsOnLogin: boolean;
     autoMessagingAfterUserCreation: boolean;
+    guestUserMaxAgeInDays: number;
     earliestValidTokenDate: (type: typeof UserAccountAction.VERIFY_EMAIL | typeof UserAccountAction.RESET_PASSWORD) => Date;
     validateEmail: (email: string) => Promise<boolean>;
     validateUsername: (username: string) => Promise<boolean>;