@xeplr/auth 1.0.0 → 1.0.1

package/lib/authMiddleware.js

@@ -1,27 +1,53 @@
-const { verifyToken } = require('./authHelper');
-const { validateAccessToken } = require('./sessionService');
+const { decodeVerified, getToleranceSeconds } = require('./authHelper');
+const { validateAccessToken, slideAccessToken } = require('./sessionService');
+const { decide } = require('./tokenDecision');
 
+// The ONE place token logic lives. Order (from tokenDecision): signature →
+// revocation → expiry. Tolerance (ACCESS_TOKEN_TOLERANCE_SECONDS, default 0)
+// turns on the sliding refresh: an expired-but-recent token is served AND a
+// fresh token is attached to the response (X-New-Token), set BEFORE the handler
+// runs so it rides every response path. With tolerance 0 this is exactly the
+// old behavior (reject on expiry).
 async function authMiddleware(req, res, next) {
   const authHeader = req.headers.authorization;
-
   if (!authHeader || !authHeader.startsWith('Bearer ')) {
     return res.status(401).json({ error: 'No token provided' });
   }
-
   const token = authHeader.split(' ')[1];
 
-  // Step 1: Verify JWT signature + expiry
-  let decoded;
-  try {
-    decoded = verifyToken(token);
-  } catch (err) {
+  // Verify signature, ignore expiry (we decide on expiry ourselves).
+  const { decoded, signatureValid } = decodeVerified(token);
+
+  // Session liveness = the whitelist entry still exists (a logout deletes it).
+  // The entry outlives the token by `tolerance`, so it's present during grace.
+  const session = signatureValid ? await validateAccessToken(token) : null;
+
+  const decision = decide({
+    exp: decoded && decoded.exp,
+    now: Math.floor(Date.now() / 1000),
+    toleranceSeconds: getToleranceSeconds(),
+    sessionLive: !!session,
+    signatureValid: signatureValid
+  });
+
+  if (decision.action === 'reject') {
+    if (req.log) req.log.debug('auth reject: ' + decision.reason);
     return res.status(401).json({ error: 'Invalid or expired token' });
   }
 
-  // Step 2: Check Redis whitelist (token not revoked)
-  const session = await validateAccessToken(token);
-  if (!session) {
-    return res.status(401).json({ error: 'Session expired or revoked' });
+  if (decision.action === 'slide') {
+    // Serve the request but hand back a fresh token. Header set BEFORE next()
+    // → present on every response. A slide failure must not block a live
+    // session — fall through and serve with the (still-tolerated) old token.
+    try {
+      const newToken = await slideAccessToken(token, decoded);
+      if (newToken) {
+        res.setHeader('X-New-Token', newToken);
+        res.setHeader('Access-Control-Expose-Headers', 'X-New-Token');
+      }
+    } catch (err) {
+      if (req.log) req.log.error('slide failed: ' + err.message);
+    }
   }
 
   req.user = decoded;

package/lib/authRouter.js

@@ -1,10 +1,19 @@
 const express = require('express');
-const { register, activate, login, forgotPassword, resetPassword } = require('./authService');
+const FileUploader = require('@xeplr/utils/lib/fileUploader');
+const { register, activate, previewInvite, acceptInvite, login, forgotPassword, resetPassword, requestPhoneOtp, verifyPhoneOtp, getProfile, updateProfile, setProfilePic, changePassword } = require('./authService');
 const { getUserAccess } = require('./accessService');
 const { getSession, rotateSession, destroySession } = require('./sessionService');
+const { issueTicket } = require('./ticketService');
 const authMiddleware = require('./authMiddleware');
 const User = require('../models/User');
 
+// Avatar uploads — local disk by default (FileUploader's own default:
+// process.env.UPLOAD_DIR or ./uploads). Auth only persists the resulting
+// path on the user; serving it back over HTTP is the consuming app's concern
+// (same as any other uploaded asset), so wire a static route to the same
+// directory wherever it makes sense for your deployment.
+const avatarUploader = new FileUploader({ allowedTypes: ['image/*'], maxSize: 2 * 1024 * 1024 });
+
 function logError(req, err) {
   if (req.log) req.log.error(err.message, { stack: err.stack });
 }
@@ -47,6 +56,32 @@ function createAuthRouter(options = {}) {
     }
   });
 
+  router.get('/invite-preview', async function(req, res) {
+    try {
+      var token = req.query.token;
+      if (!token) return res.status(400).json({ error: 'Token is required' });
+      var info = await previewInvite(token);
+      res.json(info);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/invite-accept', async function(req, res) {
+    try {
+      const { token, name, password } = req.body;
+      if (!token || !password) {
+        return res.status(400).json({ error: 'Token and password are required' });
+      }
+      const result = await acceptInvite({ token, name, password });
+      res.json({ message: 'Invite accepted', user: result });
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
   router.post('/login', async function(req, res) {
     try {
       const { email, password } = req.body;
@@ -115,12 +150,20 @@ function createAuthRouter(options = {}) {
         return res.status(401).json({ error: 'Invalid or expired refresh token' });
       }
 
-      const user = await User.query().findById(session.userId);
+      const user = await User.query().findById(session.userId).withGraphFetched('roles');
       if (!user || !user.isActive) {
         return res.status(401).json({ error: 'Account not found or deactivated' });
       }
 
-      const result = await rotateSession(refreshToken, user);
+      // Pack role names so refreshed tokens carry the same role claims as login.
+      const tokenUser = {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        roles: (user.roles || []).map(function(r) { return r.name; })
+      };
+
+      const result = await rotateSession(refreshToken, tokenUser);
       if (!result) {
         return res.status(401).json({ error: 'Invalid or expired refresh token' });
       }
@@ -172,17 +215,103 @@ function createAuthRouter(options = {}) {
     }
   });
 
-  // Get tenants for the current logged-in user
-  router.get('/my-tenants', authMiddleware, async function(req, res) {
+  router.get('/profile', authMiddleware, async function(req, res) {
     try {
-      var user = await User.query().findById(req.user.id).withGraphFetched('tenants');
-      var tenants = (user && user.tenants) ? user.tenants : [];
-      res.json(tenants.map(function(t) {
-        return { id: t.id, name: t.name, code: t.code, description: t.description };
-      }));
+      const profile = await getProfile(req.user.id);
+      res.json(profile);
     } catch (err) {
       logError(req, err);
-      res.status(500).json({ error: 'Something went wrong' });
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.put('/profile', authMiddleware, async function(req, res) {
+    try {
+      const profile = await updateProfile(req.user.id, req.body);
+      res.json(profile);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/profile/avatar', authMiddleware, ...avatarUploader.single('avatar'), async function(req, res) {
+    try {
+      if (!req.file) return res.status(400).json({ error: 'avatar file is required' });
+      // Store just the generated filename — never the server's filesystem
+      // path (leaks server layout, and isn't meaningful once you swap disk
+      // storage for S3/etc). The app knows its own UPLOAD_DIR and however
+      // it serves it; it builds the actual URL from this filename.
+      const profile = await setProfilePic(req.user.id, req.file.filename);
+      res.json(profile);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/change-password', authMiddleware, async function(req, res) {
+    try {
+      const { oldPassword, newPassword } = req.body;
+      if (!oldPassword || !newPassword) {
+        return res.status(400).json({ error: 'oldPassword and newPassword are required' });
+      }
+      await changePassword(req.user.id, { oldPassword, newPassword });
+      res.json({ message: 'Password changed. Please log in again.' });
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  // Additive phone verification — like email activation, but for a phone
+  // number attached to an already-authenticated account. Body: { phoneNumber }
+  // optional (omit to re-send to the number already on file).
+  router.post('/request-phone-otp', authMiddleware, async function(req, res) {
+    try {
+      const result = await requestPhoneOtp(req.user.id, req.body.phoneNumber);
+      res.json(result);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  router.post('/verify-phone-otp', authMiddleware, async function(req, res) {
+    try {
+      if (!req.body.code) return res.status(400).json({ error: 'code is required' });
+      const result = await verifyPhoneOtp(req.user.id, req.body.code);
+      res.json(result);
+    } catch (err) {
+      logError(req, err);
+      res.status(400).json({ error: err.message });
+    }
+  });
+
+  // ── SSE ticket ────────────────────────────────────────────────────────
+  //
+  // Mints a short-lived, single-use ticket so a browser can open an
+  // EventSource without leaking the primary session token in the URL.
+  //
+  // Body (optional):
+  //   { scopes: [...] }   — client-requested scopes. If omitted, defaults
+  //                         to the user's own namespace (['user:me:*']).
+  //                         Whatever is minted here is what the SSE server
+  //                         will enforce at subscribe time.
+  //
+  // NOTE the scopes are advisory intent — the SSE handler owns the final
+  // authorization check (see xeplr-base-apis/lib/sse.js#createHandler).
+  router.post('/sse-ticket', authMiddleware, async function(req, res) {
+    try {
+      var requested = (req.body && Array.isArray(req.body.scopes)) ? req.body.scopes : ['user:me:*'];
+      var { ticket, expiresIn } = await issueTicket({
+        userId: req.user.id,
+        scopes: requested
+      });
+      res.json({ ticket: ticket, expiresIn: expiresIn });
+    } catch (err) {
+      logError(req, err);
+      res.status(500).json({ error: 'Failed to mint SSE ticket' });
     }
   });
 

package/lib/authService.js

@@ -1,10 +1,11 @@
 const crypto = require('crypto');
-const { sendEmail, configureEmail, formatDbDateTime } = require('@xeplr/utils');
+const { sendEmail, configureEmail, formatDbDateTime, otp } = require('@xeplr/utils');
 const { normalizeEmail } = require('@xeplr/utils/isomorphic');
 const { generateId, hashPassword, comparePassword } = require('./authHelper');
 const User = require('../models/User');
 const { getUserAccess, clearUserAccess } = require('./accessService');
 const { createSession, destroyAllUserSessions } = require('./sessionService');
+const hooks = require('./hooks');
 
 let _activationBaseUrl = null;
 
@@ -12,10 +13,11 @@ function configureActivation(baseUrl) {
   _activationBaseUrl = baseUrl;
 }
 
-async function register({ email, phoneNumber, name, password }) {
+async function register({ email, phoneNumber, name, password, knex }) {
+  const UserM = knex ? User.bindKnex(knex) : User;
   const normalized = normalizeEmail(email);
 
-  const existing = await User.query().findOne({ normalizedEmail: normalized });
+  const existing = await UserM.query().findOne({ normalizedEmail: normalized });
   if (existing) {
     throw new Error('Email already registered');
   }
@@ -25,7 +27,7 @@ async function register({ email, phoneNumber, name, password }) {
   const now = formatDbDateTime();
   const activationToken = crypto.randomBytes(32).toString('hex');
 
-  const user = await User.query().insert({
+  const user = await UserM.query().insert({
     id,
     email: email.trim().toLowerCase(),
     normalizedEmail: normalized,
@@ -45,7 +47,7 @@ async function register({ email, phoneNumber, name, password }) {
   });
 
   // Send activation email
-  const baseUrl = _activationBaseUrl || process.env.ACTIVATION_BASE_URL;
+  const baseUrl = _activationBaseUrl || process.env.AUTH_ACTIVATION_BASE_URL;
   if (!baseUrl) {
     throw new Error('ACTIVATION_BASE_URL is required. Cannot register without email activation.');
   }
@@ -58,6 +60,8 @@ async function register({ email, phoneNumber, name, password }) {
 
   await sendEmail(email, 'Activate your account', html);
 
+  await hooks.fire('user', 'create', user.id);
+
   return {
     id: user.id,
     email: user.email,
@@ -86,12 +90,16 @@ async function activate(token) {
     recordModifiedDate: now
   });
 
+  await hooks.fire('user', 'update', user.id);
+
   return { id: user.id, email: user.email, name: user.name };
 }
 
 async function login({ email, password }) {
   const normalized = normalizeEmail(email);
-  const user = await User.query().findOne({ normalizedEmail: normalized });
+  const user = await User.query()
+    .findOne({ normalizedEmail: normalized })
+    .withGraphFetched('roles');
   if (!user) {
     throw new Error('Invalid email or password');
   }
@@ -109,11 +117,22 @@ async function login({ email, password }) {
     throw new Error('NOT_ACTIVATED');
   }
 
-  const { accessToken, refreshToken } = await createSession(user);
+  // Pack role names into the JWT so middleware (e.g. requireSuperAdmin)
+  // can gate without a per-request DB lookup.
+  const tokenUser = {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    roles: (user.roles || []).map(function(r) { return r.name; })
+  };
+
+  const { accessToken, refreshToken } = await createSession(tokenUser);
 
   await clearUserAccess(user.id);
   const access = await getUserAccess(user.id);
 
+  await hooks.fire('user', 'login', user.id);
+
   return {
     accessToken,
     refreshToken,
@@ -127,6 +146,124 @@ async function login({ email, password }) {
   };
 }
 
+/**
+ * Invite a user. Creates a User row with no password, isActivated=false, and an
+ * activation token. Sends an "accept invite" email pointing the user to a page
+ * where they set their own password and activate.
+ *
+ * Idempotent on email: if the user already exists, returns the existing user
+ * (no email sent, no password reset). The caller can then layer additional
+ * roles/mappings on top.
+ */
+async function invite({ email, name, phoneNumber, invitedBy, inviterName, appName, knex }) {
+  const UserM = knex ? User.bindKnex(knex) : User;
+  const normalized = normalizeEmail(email);
+
+  const existing = await UserM.query().findOne({ normalizedEmail: normalized });
+  if (existing) {
+    return {
+      id: existing.id,
+      email: existing.email,
+      name: existing.name,
+      isNew: false,
+      isActivated: existing.isActivated
+    };
+  }
+
+  const id = generateId();
+  const now = formatDbDateTime();
+  const activationToken = crypto.randomBytes(32).toString('hex');
+  const inviter = invitedBy || id;
+
+  const user = await UserM.query().insert({
+    id,
+    email: email.trim().toLowerCase(),
+    normalizedEmail: normalized,
+    phoneNumber: phoneNumber || null,
+    name: name || null,
+    pwd: null,
+    pwdSalt: null,
+    isActive: true,
+    isActivated: false,
+    activationToken,
+    activatedOn: null,
+    activatedBy: null,
+    recordCreatedDate: now,
+    recordModifiedDate: now,
+    recordCreatedBy: inviter,
+    recordModifiedBy: inviter
+  });
+
+  const baseUrl = _activationBaseUrl || process.env.AUTH_ACTIVATION_BASE_URL;
+  if (!baseUrl) {
+    throw new Error('ACTIVATION_BASE_URL is required to send invite emails.');
+  }
+
+  const acceptLink = baseUrl + '/auth/accept-invite?token=' + activationToken;
+  const app = appName || 'the app';
+  const subject = 'You have been invited to ' + app;
+  const html = '<h2>You have been invited</h2>'
+    + '<p>Hi ' + (name || 'there') + ',</p>'
+    + (inviterName ? '<p>' + inviterName + ' has invited you to join ' + app + '.</p>' : '<p>You have been invited to join ' + app + '.</p>')
+    + '<p>Click below to set your password and accept the invite:</p>'
+    + '<p><a href="' + acceptLink + '">' + acceptLink + '</a></p>';
+
+  await sendEmail(email, subject, html);
+
+  await hooks.fire('user', 'create', user.id);
+
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    isNew: true,
+    isActivated: false
+  };
+}
+
+/**
+ * Preview an invite — returns invitee info if the token matches a pending
+ * invite (user exists, is not activated, and has no password set yet).
+ */
+async function previewInvite(token, options = {}) {
+  const UserM = options.knex ? User.bindKnex(options.knex) : User;
+  const user = await UserM.query().findOne({ activationToken: token });
+  if (!user) throw new Error('Invalid or expired invite');
+  if (user.isActivated) throw new Error('Invite already accepted');
+  if (user.pwd) throw new Error('This account already has a password — use the activation link instead');
+
+  return { email: user.email, name: user.name };
+}
+
+/**
+ * Accept an invite — sets the user's password and name, then activates.
+ */
+async function acceptInvite({ token, name, password, knex }) {
+  if (!password) throw new Error('Password is required');
+
+  const UserM = knex ? User.bindKnex(knex) : User;
+  const user = await UserM.query().findOne({ activationToken: token });
+  if (!user) throw new Error('Invalid or expired invite');
+  if (user.isActivated) throw new Error('Invite already accepted');
+
+  const { hash, salt } = await hashPassword(password);
+  const now = formatDbDateTime();
+
+  await UserM.query().findById(user.id).patch({
+    name: name || user.name,
+    pwd: hash,
+    pwdSalt: salt,
+    isActivated: true,
+    activatedOn: now,
+    activationToken: null,
+    recordModifiedDate: now
+  });
+
+  await hooks.fire('user', 'update', user.id);
+
+  return { id: user.id, email: user.email, name: name || user.name };
+}
+
 async function forgotPassword({ email }, resetBaseUrl) {
   const normalized = normalizeEmail(email);
   const user = await User.query().findOne({ normalizedEmail: normalized });
@@ -135,7 +272,7 @@ async function forgotPassword({ email }, resetBaseUrl) {
   }
 
   const resetToken = crypto.randomBytes(32).toString('hex');
-  const expiryMinutes = parseInt(process.env.RESET_TOKEN_EXPIRY_MINUTES) || 30;
+  const expiryMinutes = parseInt(process.env.AUTH_RESET_TOKEN_EXPIRY_MINUTES) || 30;
   const resetTokenExpiry = formatDbDateTime(new Date(Date.now() + expiryMinutes * 60 * 1000));
 
   await User.query().findById(user.id).patch({
@@ -156,6 +293,8 @@ async function forgotPassword({ email }, resetBaseUrl) {
   `;
 
   await sendEmail(user.email, 'Password Reset', html);
+
+  await hooks.fire('user', 'update', user.id);
 }
 
 async function resetPassword({ token, newPassword }) {
@@ -181,6 +320,176 @@ async function resetPassword({ token, newPassword }) {
 
   await destroyAllUserSessions(user.id);
   await clearUserAccess(user.id);
+
+  await hooks.fire('user', 'update', user.id);
+}
+
+/**
+ * Send an OTP to verify a phone number on an already-authenticated user's
+ * account (additive — like email activation, not a replacement for password
+ * login). Delivery + code storage are @xeplr/utils's otp module — register an
+ * sms provider (see @xeplr/utils sms.register()) from your own boot script
+ * before calling boot(), otherwise this throws "provider not registered".
+ *
+ * @param {string} userId
+ * @param {string} [phoneNumber] - set/replace the number on file; omit to
+ *   re-send a code to the number already on the account.
+ */
+async function requestPhoneOtp(userId, phoneNumber) {
+  const user = await User.query().findById(userId);
+  if (!user) throw new Error('User not found');
+
+  const targetPhone = phoneNumber || user.phoneNumber;
+  if (!targetPhone) throw new Error('phoneNumber is required');
+
+  if (phoneNumber && phoneNumber !== user.phoneNumber) {
+    // Changing the number on file invalidates any prior verification.
+    await User.query().findById(userId).patch({
+      phoneNumber: targetPhone,
+      phoneVerified: false,
+      recordModifiedDate: formatDbDateTime()
+    });
+    await hooks.fire('user', 'update', userId);
+  }
+
+  await otp.requestOtp(targetPhone);
+  return { sent: true };
+}
+
+/**
+ * Verify a code against the phone number currently on file for this user.
+ */
+async function verifyPhoneOtp(userId, code) {
+  const user = await User.query().findById(userId);
+  if (!user) throw new Error('User not found');
+  if (!user.phoneNumber) throw new Error('No phone number on file — request a code first');
+
+  const result = await otp.verifyOtp(user.phoneNumber, code);
+  if (!result.success) {
+    const messages = {
+      expired: 'Code expired — request a new one',
+      too_many_attempts: 'Too many attempts — request a new code',
+      invalid: 'Invalid code'
+    };
+    throw new Error(messages[result.reason] || 'Invalid code');
+  }
+
+  const now = formatDbDateTime();
+  await User.query().findById(userId).patch({
+    phoneVerified: true,
+    phoneVerifiedOn: now,
+    recordModifiedDate: now
+  });
+
+  await hooks.fire('user', 'update', userId);
+
+  return { phoneVerified: true };
+}
+
+function shapeProfile(user) {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    phoneNumber: user.phoneNumber,
+    phoneVerified: user.phoneVerified,
+    profilePicUrl: user.profilePicUrl,
+    isActivated: user.isActivated
+  };
+}
+
+async function getProfile(userId) {
+  const user = await User.query().findById(userId);
+  if (!user) throw new Error('User not found');
+  return shapeProfile(user);
+}
+
+/**
+ * Update the current user's own name/phoneNumber/email. Changing phoneNumber
+ * clears phoneVerified (same rule as requestPhoneOtp — a new number needs its
+ * own verification). Changing email re-checks uniqueness (same as register())
+ * but does NOT require re-activation — that's a bigger flow this doesn't touch.
+ */
+async function updateProfile(userId, fields) {
+  const user = await User.query().findById(userId);
+  if (!user) throw new Error('User not found');
+
+  const data = {};
+
+  if (fields.name !== undefined) {
+    data.name = fields.name;
+  }
+
+  if (fields.phoneNumber !== undefined && fields.phoneNumber !== user.phoneNumber) {
+    data.phoneNumber = fields.phoneNumber;
+    data.phoneVerified = false;
+  }
+
+  if (fields.email !== undefined) {
+    const email = fields.email.trim().toLowerCase();
+    if (email !== user.email) {
+      const normalized = normalizeEmail(email);
+      const existing = await User.query().findOne({ normalizedEmail: normalized });
+      if (existing && existing.id !== userId) {
+        throw new Error('Email already in use');
+      }
+      data.email = email;
+      data.normalizedEmail = normalized;
+    }
+  }
+
+  data.recordModifiedDate = formatDbDateTime();
+
+  await User.query().findById(userId).patch(data);
+  await hooks.fire('user', 'update', userId);
+
+  const updated = await User.query().findById(userId);
+  return shapeProfile(updated);
+}
+
+/**
+ * Store an already-uploaded avatar's path/URL on the user's profile. The
+ * upload itself happens in the router via @xeplr/utils's FileUploader — this
+ * just persists the result, same as any other profile field.
+ */
+async function setProfilePic(userId, profilePicUrl) {
+  await User.query().findById(userId).patch({
+    profilePicUrl: profilePicUrl,
+    recordModifiedDate: formatDbDateTime()
+  });
+  await hooks.fire('user', 'update', userId);
+  const updated = await User.query().findById(userId);
+  return shapeProfile(updated);
+}
+
+/**
+ * Self-service password change for an already-authenticated user (distinct
+ * from resetPassword, which is for a user who's locked out and uses an
+ * emailed token instead of their current session). Requires the current
+ * password. Destroys all other sessions afterward — same as resetPassword —
+ * so the caller should expect to need to log back in.
+ */
+async function changePassword(userId, { oldPassword, newPassword }) {
+  if (!oldPassword || !newPassword) throw new Error('oldPassword and newPassword are required');
+
+  const user = await User.query().findById(userId);
+  if (!user) throw new Error('User not found');
+
+  const isMatch = await comparePassword(oldPassword, user.pwd);
+  if (!isMatch) throw new Error('Current password is incorrect');
+
+  const { hash, salt } = await hashPassword(newPassword);
+
+  await User.query().findById(userId).patch({
+    pwd: hash,
+    pwdSalt: salt,
+    recordModifiedDate: formatDbDateTime()
+  });
+
+  await destroyAllUserSessions(userId);
+  await clearUserAccess(userId);
+
+  await hooks.fire('user', 'update', userId);
 }
 
 module.exports = {
@@ -188,7 +497,16 @@ module.exports = {
   configureEmail,
   register,
   activate,
+  invite,
+  previewInvite,
+  acceptInvite,
   login,
   forgotPassword,
-  resetPassword
+  resetPassword,
+  requestPhoneOtp,
+  verifyPhoneOtp,
+  getProfile,
+  updateProfile,
+  setProfilePic,
+  changePassword
 };