axiodb 9.7.9 → 10.8.11

package/README.md

@@ -63,6 +63,7 @@ SQLite is great, but it requires native bindings that break in Electron and cros
 - **Transaction Support:** ACID-compliant transactions with savepoints, rollback, and Write-Ahead Logging (WAL)
 - **Single Instance Architecture:** Unified management for unlimited databases, collections, and documents
 - **Web-Based GUI Dashboard:** Visual database administration, query execution, and real-time monitoring at `localhost:27018`
+- **Role-Based Access Control:** Built-in login for the Control Server with Super Admin/Admin/View roles and per-permission enforcement
 - **AxioDBCloud Remote Access:** TCP-based client for connecting to AxioDB from anywhere—Docker, Cloud, or local network
 - **Zero-Configuration Setup:** Serverless architecture—install and start building instantly
 - **Custom Database Path:** Flexible storage locations for better project organization
@@ -254,6 +255,27 @@ const db = new AxioDB({ GUI: true, RootName: "MyDB", CustomPath: "./custom/path"
 
 Access the GUI at `http://localhost:27018` when enabled.
 
+### Authentication & Access Control (v9.8+)
+
+The Control Server ships with built-in login and role-based access control (RBAC). On first start with `GUI: true`, AxioDB seeds a reserved `config` database (hidden from the regular database list) containing three collections—`users`, `roles`, `permissions`—and a default account:
+
+```
+Username: admin
+Password: admin
+```
+
+You'll be forced to change this password on first login (this applies to every account, not just the default one). Three predefined roles are seeded automatically:
+
+| Role | Access |
+|------|--------|
+| **Super Admin** | Full access, including creating users/roles |
+| **Admin** | Full database/collection/document access, no user or role management |
+| **View** | Read-only access to databases, collections, and documents |
+
+A Super Admin can create additional roles from the predefined permission catalogue and create new users with any role. Sessions are held only in server memory (never persisted to disk) and are tied to an httpOnly cookie, so restarting the server logs everyone out.
+
+> **Security note:** RBAC protects the Control Server's HTTP API; it is still intended for trusted local/network access, not public internet exposure.
+
 ---
 
 ## ⚙️ Architecture & Internal Mechanisms

package/lib/Services/Auth/AuthSeeder.service.d.ts

@@ -0,0 +1,16 @@
+import { AxioDB } from "../Indexation.operation";
+/**
+ * Idempotently creates the `config` database and its `users`/`roles`/`permissions`
+ * collections on first control-server start, then hydrates PermissionChecker's
+ * in-memory role->permissions cache on every boot (including subsequent restarts,
+ * where seeding itself is a no-op but the cache still needs rebuilding).
+ */
+export default class AuthSeeder {
+    private readonly axioDBInstance;
+    constructor(axioDBInstance: AxioDB);
+    seedIfNeeded(): Promise<void>;
+    private seedPermissions;
+    private seedRoles;
+    private seedDefaultAdmin;
+    private hydratePermissionCache;
+}

package/lib/Services/Auth/AuthSeeder.service.js

@@ -0,0 +1,99 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const PasswordHasher_helper_1 = __importDefault(require("./PasswordHasher.helper"));
+const ConfigDatabase_service_1 = __importDefault(require("./ConfigDatabase.service"));
+const PermissionChecker_helper_1 = __importDefault(require("./PermissionChecker.helper"));
+const Permissions_1 = require("../../config/Keys/Permissions");
+/**
+ * Idempotently creates the `config` database and its `users`/`roles`/`permissions`
+ * collections on first control-server start, then hydrates PermissionChecker's
+ * in-memory role->permissions cache on every boot (including subsequent restarts,
+ * where seeding itself is a no-op but the cache still needs rebuilding).
+ */
+class AuthSeeder {
+    constructor(axioDBInstance) {
+        this.axioDBInstance = axioDBInstance;
+    }
+    seedIfNeeded() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const configDB = yield this.axioDBInstance.createDB(Permissions_1.RESERVED_DB_NAME);
+            const usersCollection = yield configDB.createCollection(Permissions_1.CONFIG_USERS_COLLECTION);
+            const rolesCollection = yield configDB.createCollection(Permissions_1.CONFIG_ROLES_COLLECTION);
+            const permissionsCollection = yield configDB.createCollection(Permissions_1.CONFIG_PERMISSIONS_COLLECTION);
+            ConfigDatabase_service_1.default.setCollections(usersCollection, rolesCollection, permissionsCollection);
+            // totalDocuments() counts the collection's "indexes" subfolder as an entry, so it
+            // reports a non-zero count even when no real document has been inserted yet - use
+            // an actual document query (filtered to real .axiodb files) to detect prior seeding.
+            const existingUsers = yield usersCollection.query({}).Limit(1).exec();
+            const alreadySeeded = "data" in existingUsers &&
+                Array.isArray((_a = existingUsers.data) === null || _a === void 0 ? void 0 : _a.documents) &&
+                existingUsers.data.documents.length > 0;
+            if (!alreadySeeded) {
+                yield this.seedPermissions(permissionsCollection);
+                yield this.seedRoles(rolesCollection);
+                yield this.seedDefaultAdmin(usersCollection);
+            }
+            yield this.hydratePermissionCache(rolesCollection);
+        });
+    }
+    seedPermissions(permissionsCollection) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const documents = Permissions_1.PERMISSION_CATALOGUE.map((entry) => ({
+                key: entry.key,
+                group: entry.group,
+                description: entry.description,
+            }));
+            yield permissionsCollection.insertMany(documents);
+        });
+    }
+    seedRoles(rolesCollection) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const now = new Date().toISOString();
+            const documents = Permissions_1.PREDEFINED_ROLES.map((role) => ({
+                roleName: role.roleName,
+                permissions: role.permissions,
+                isSystemRole: true,
+                createdAt: now,
+            }));
+            yield rolesCollection.insertMany(documents);
+        });
+    }
+    seedDefaultAdmin(usersCollection) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(Permissions_1.DEFAULT_ADMIN_PASSWORD);
+            const document = {
+                username: Permissions_1.DEFAULT_ADMIN_USERNAME,
+                passwordHash,
+                role: Permissions_1.SUPER_ADMIN_ROLE,
+                mustChangePassword: true,
+                isActive: true,
+                createdAt: new Date().toISOString(),
+            };
+            yield usersCollection.insert(document);
+        });
+    }
+    hydratePermissionCache(rolesCollection) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield rolesCollection.query({}).Limit(1000).exec();
+            if ("data" in result && result.data && Array.isArray(result.data.documents)) {
+                const roles = result.data.documents;
+                PermissionChecker_helper_1.default.hydrate(roles.map((role) => ({ roleName: role.roleName, permissions: role.permissions })));
+            }
+        });
+    }
+}
+exports.default = AuthSeeder;
+//# sourceMappingURL=AuthSeeder.service.js.map

package/lib/Services/Auth/AuthSeeder.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthSeeder.service.js","sourceRoot":"","sources":["../../../source/Services/Auth/AuthSeeder.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAEA,oFAAqD;AACrD,sFAAsD;AACtD,0FAA2D;AAM3D,+DAUuC;AAEvC;;;;;GAKG;AACH;IAGE,YAAY,cAAsB;QAChC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACvC,CAAC;IAEY,YAAY;;;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,8BAAgB,CAAC,CAAC;YAEtE,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,qCAAuB,CAAC,CAAC;YACjF,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,qCAAuB,CAAC,CAAC;YACjF,MAAM,qBAAqB,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAC3D,2CAA6B,CAC9B,CAAC;YAEF,gCAAc,CAAC,cAAc,CAAC,eAAe,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC;YAEvF,kFAAkF;YAClF,kFAAkF;YAClF,qFAAqF;YACrF,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,aAAa,GACjB,MAAM,IAAI,aAAa;gBACvB,KAAK,CAAC,OAAO,CAAC,MAAA,aAAa,CAAC,IAAI,0CAAE,SAAS,CAAC;gBAC5C,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;YAE1C,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,eAAe,CAAC,qBAAqB,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;gBACtC,MAAM,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;YAC/C,CAAC;YAED,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACrD,CAAC;KAAA;IAEa,eAAe,CAAC,qBAAiC;;YAC7D,MAAM,SAAS,GAAyB,kCAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC3E,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;aAC/B,CAAC,CAAC,CAAC;YACJ,MAAM,qBAAqB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;KAAA;IAEa,SAAS,CAAC,eAA2B;;YACjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,SAAS,GAAmB,8BAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChE,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,GAAG;aACf,CAAC,CAAC,CAAC;YACJ,MAAM,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;KAAA;IAEa,gBAAgB,CAAC,eAA2B;;YACxD,MAAM,YAAY,GAAG,MAAM,+BAAc,CAAC,YAAY,CAAC,oCAAsB,CAAC,CAAC;YAC/E,MAAM,QAAQ,GAAiB;gBAC7B,QAAQ,EAAE,oCAAsB;gBAChC,YAAY;gBACZ,IAAI,EAAE,8BAAgB;gBACtB,kBAAkB,EAAE,IAAI;gBACxB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;KAAA;IAEa,sBAAsB,CAAC,eAA2B;;YAC9D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAA2B,CAAC;gBACtD,kCAAiB,CAAC,OAAO,CACvB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAClF,CAAC;YACJ,CAAC;QACH,CAAC;KAAA;CACF"}

package/lib/Services/Auth/AuthService.service.d.ts

@@ -0,0 +1,53 @@
+import { UserDocument, RoleDocument } from "../../config/Interfaces/Auth/auth.interface";
+export interface AuthResult {
+    success: boolean;
+    message: string;
+    user?: UserDocument;
+}
+export interface MutationResult {
+    success: boolean;
+    message: string;
+    /** True when the failure means "this already exists" (HTTP 409) rather than a validation failure (HTTP 400). */
+    conflict?: boolean;
+}
+export interface SafeUser {
+    username: string;
+    role: string;
+    mustChangePassword: boolean;
+    isActive: boolean;
+    createdAt: string;
+}
+/**
+ * Business logic for login, password management, and user/role administration.
+ * Backed entirely by AxioDB's own Collection API against the `config` database
+ * (see ConfigDatabase.service.ts) - no separate storage mechanism.
+ */
+export default class AuthService {
+    login(username: string, password: string): Promise<AuthResult>;
+    findUserByUsername(username: string): Promise<UserDocument | null>;
+    listUsers(): Promise<SafeUser[]>;
+    createUser(username: string, password: string, role: string): Promise<MutationResult>;
+    changeOwnPassword(username: string, currentPassword: string, newPassword: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    resetUserPassword(username: string, newPassword: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    updateUserRole(username: string, newRole: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    deleteUser(username: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    createRole(roleName: string, permissions: string[]): Promise<MutationResult>;
+    listRoles(): Promise<RoleDocument[]>;
+    /**
+     * Rejects an operation that would leave zero active Super Admin users behind,
+     * preventing a permanent RBAC lockout.
+     */
+    private assertNotLastSuperAdmin;
+}

package/lib/Services/Auth/AuthService.service.js

@@ -0,0 +1,217 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const PasswordHasher_helper_1 = __importDefault(require("./PasswordHasher.helper"));
+const ConfigDatabase_service_1 = __importDefault(require("./ConfigDatabase.service"));
+const PermissionChecker_helper_1 = __importDefault(require("./PermissionChecker.helper"));
+const SessionStore_service_1 = __importDefault(require("./SessionStore.service"));
+const Permissions_1 = require("../../config/Keys/Permissions");
+/**
+ * Business logic for login, password management, and user/role administration.
+ * Backed entirely by AxioDB's own Collection API against the `config` database
+ * (see ConfigDatabase.service.ts) - no separate storage mechanism.
+ */
+class AuthService {
+    login(username, password) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.findUserByUsername(username);
+            if (!user || user.isActive === false) {
+                return { success: false, message: "Invalid username or password" };
+            }
+            const passwordMatches = yield PasswordHasher_helper_1.default.verifyPassword(password, user.passwordHash);
+            if (!passwordMatches) {
+                return { success: false, message: "Invalid username or password" };
+            }
+            return { success: true, message: "Login successful", user };
+        });
+    }
+    findUserByUsername(username) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const result = yield ConfigDatabase_service_1.default.getUsersCollection()
+                .query({ username })
+                .findOne(true)
+                .exec();
+            if ("data" in result && result.data && result.data.documents) {
+                return result.data.documents;
+            }
+            return null;
+        });
+    }
+    listUsers() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield ConfigDatabase_service_1.default.getUsersCollection().query({}).Limit(1000).exec();
+            if (!("data" in result) || !((_a = result.data) === null || _a === void 0 ? void 0 : _a.documents)) {
+                return [];
+            }
+            const users = result.data.documents;
+            return users.map((user) => ({
+                username: user.username,
+                role: user.role,
+                mustChangePassword: user.mustChangePassword,
+                isActive: user.isActive,
+                createdAt: user.createdAt,
+            }));
+        });
+    }
+    createUser(username, password, role) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!PermissionChecker_helper_1.default.roleExists(role)) {
+                return { success: false, message: `Role "${role}" does not exist` };
+            }
+            const existingUser = yield this.findUserByUsername(username);
+            if (existingUser) {
+                return { success: false, message: "Username already exists", conflict: true };
+            }
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(password);
+            const document = {
+                username,
+                passwordHash,
+                role,
+                mustChangePassword: true,
+                isActive: true,
+                createdAt: new Date().toISOString(),
+            };
+            yield ConfigDatabase_service_1.default.getUsersCollection().insert(document);
+            return { success: true, message: "User created successfully" };
+        });
+    }
+    changeOwnPassword(username, currentPassword, newPassword) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.findUserByUsername(username);
+            if (!user) {
+                return { success: false, message: "User not found" };
+            }
+            const currentPasswordMatches = yield PasswordHasher_helper_1.default.verifyPassword(currentPassword, user.passwordHash);
+            if (!currentPasswordMatches) {
+                return { success: false, message: "Current password is incorrect" };
+            }
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(newPassword);
+            yield ConfigDatabase_service_1.default.getUsersCollection()
+                .update({ username })
+                .UpdateOne({ passwordHash, mustChangePassword: false });
+            return { success: true, message: "Password changed successfully" };
+        });
+    }
+    resetUserPassword(username, newPassword) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.findUserByUsername(username);
+            if (!user) {
+                return { success: false, message: "User not found" };
+            }
+            const passwordHash = yield PasswordHasher_helper_1.default.hashPassword(newPassword);
+            yield ConfigDatabase_service_1.default.getUsersCollection()
+                .update({ username })
+                .UpdateOne({ passwordHash, mustChangePassword: true });
+            SessionStore_service_1.default.revokeSessionsForUser(username);
+            return { success: true, message: "Password reset successfully" };
+        });
+    }
+    updateUserRole(username, newRole) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!PermissionChecker_helper_1.default.roleExists(newRole)) {
+                return { success: false, message: `Role "${newRole}" does not exist` };
+            }
+            const user = yield this.findUserByUsername(username);
+            if (!user) {
+                return { success: false, message: "User not found" };
+            }
+            if (user.role === Permissions_1.SUPER_ADMIN_ROLE && newRole !== Permissions_1.SUPER_ADMIN_ROLE) {
+                const lastAdminGuard = yield this.assertNotLastSuperAdmin(username);
+                if (!lastAdminGuard.success) {
+                    return lastAdminGuard;
+                }
+            }
+            yield ConfigDatabase_service_1.default.getUsersCollection()
+                .update({ username })
+                .UpdateOne({ role: newRole });
+            SessionStore_service_1.default.revokeSessionsForUser(username);
+            return { success: true, message: "Role updated successfully" };
+        });
+    }
+    deleteUser(username) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.findUserByUsername(username);
+            if (!user) {
+                return { success: false, message: "User not found" };
+            }
+            if (user.role === Permissions_1.SUPER_ADMIN_ROLE) {
+                const lastAdminGuard = yield this.assertNotLastSuperAdmin(username);
+                if (!lastAdminGuard.success) {
+                    return lastAdminGuard;
+                }
+            }
+            yield ConfigDatabase_service_1.default.getUsersCollection().delete({ username }).deleteOne();
+            SessionStore_service_1.default.revokeSessionsForUser(username);
+            return { success: true, message: "User deleted successfully" };
+        });
+    }
+    createRole(roleName, permissions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (PermissionChecker_helper_1.default.roleExists(roleName)) {
+                return { success: false, message: "Role already exists", conflict: true };
+            }
+            const invalidPermissions = permissions.filter((key) => !Permissions_1.ALL_PERMISSION_KEYS.includes(key));
+            if (invalidPermissions.length > 0) {
+                return {
+                    success: false,
+                    message: `Unknown permission key(s): ${invalidPermissions.join(", ")}`,
+                };
+            }
+            const document = {
+                roleName,
+                permissions,
+                isSystemRole: false,
+                createdAt: new Date().toISOString(),
+            };
+            yield ConfigDatabase_service_1.default.getRolesCollection().insert(document);
+            PermissionChecker_helper_1.default.setRolePermissions(roleName, permissions);
+            return { success: true, message: "Role created successfully" };
+        });
+    }
+    listRoles() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield ConfigDatabase_service_1.default.getRolesCollection().query({}).Limit(1000).exec();
+            if (!("data" in result) || !((_a = result.data) === null || _a === void 0 ? void 0 : _a.documents)) {
+                return [];
+            }
+            return result.data.documents;
+        });
+    }
+    /**
+     * Rejects an operation that would leave zero active Super Admin users behind,
+     * preventing a permanent RBAC lockout.
+     */
+    assertNotLastSuperAdmin(excludingUsername) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const result = yield ConfigDatabase_service_1.default.getUsersCollection()
+                .query({ role: Permissions_1.SUPER_ADMIN_ROLE })
+                .Limit(1000)
+                .exec();
+            const superAdmins = "data" in result && ((_a = result.data) === null || _a === void 0 ? void 0 : _a.documents) ? result.data.documents : [];
+            const remaining = superAdmins.filter((user) => user.username !== excludingUsername && user.isActive !== false);
+            if (remaining.length === 0) {
+                return {
+                    success: false,
+                    message: "Cannot remove the last remaining Super Admin",
+                };
+            }
+            return { success: true, message: "OK" };
+        });
+    }
+}
+exports.default = AuthService;
+//# sourceMappingURL=AuthService.service.js.map

package/lib/Services/Auth/AuthService.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.service.js","sourceRoot":"","sources":["../../../source/Services/Auth/AuthService.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;AAAA,oFAAqD;AACrD,sFAAsD;AACtD,0FAA2D;AAC3D,kFAAkD;AAKlD,+DAAsF;AAuBtF;;;;GAIG;AACH;IACe,KAAK,CAAC,QAAgB,EAAE,QAAgB;;YACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACrC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACrE,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,+BAAc,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACzF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACrE,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QAC9D,CAAC;KAAA;IAEY,kBAAkB,CAAC,QAAgB;;YAC9C,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACrD,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;iBACnB,OAAO,CAAC,IAAI,CAAC;iBACb,IAAI,EAAE,CAAC;YACV,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,SAAyB,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;IAEY,SAAS;;;YACpB,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACtF,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAC,MAAA,MAAM,CAAC,IAAI,0CAAE,SAAS,CAAA,EAAE,CAAC;gBACnD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAA2B,CAAC;YACtD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;gBAC3C,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC,CAAC;QACN,CAAC;KAAA;IAEY,UAAU,CACrB,QAAgB,EAChB,QAAgB,EAChB,IAAY;;YAEZ,IAAI,CAAC,kCAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,IAAI,kBAAkB,EAAE,CAAC;YACtE,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAChF,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,+BAAc,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAiB;gBAC7B,QAAQ;gBACR,YAAY;gBACZ,IAAI;gBACJ,kBAAkB,EAAE,IAAI;gBACxB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;KAAA;IAEY,iBAAiB,CAC5B,QAAgB,EAChB,eAAuB,EACvB,WAAmB;;YAEnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YACvD,CAAC;YAED,MAAM,sBAAsB,GAAG,MAAM,+BAAc,CAAC,cAAc,CAChE,eAAe,EACf,IAAI,CAAC,YAAY,CAClB,CAAC;YACF,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC5B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;YACtE,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,+BAAc,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACpE,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACtC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;iBACpB,SAAS,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;YAE1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;QACrE,CAAC;KAAA;IAEY,iBAAiB,CAC5B,QAAgB,EAChB,WAAmB;;YAEnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YACvD,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,+BAAc,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACpE,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACtC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;iBACpB,SAAS,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YAEzD,8BAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;QACnE,CAAC;KAAA;IAEY,cAAc,CACzB,QAAgB,EAChB,OAAe;;YAEf,IAAI,CAAC,kCAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,OAAO,kBAAkB,EAAE,CAAC;YACzE,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAgB,IAAI,OAAO,KAAK,8BAAgB,EAAE,CAAC;gBACnE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;gBACpE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC5B,OAAO,cAAc,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACtC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;iBACpB,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAEhC,8BAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;KAAA;IAEY,UAAU,CAAC,QAAgB;;YACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,KAAK,8BAAgB,EAAE,CAAC;gBACnC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;gBACpE,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;oBAC5B,OAAO,cAAc,CAAC;gBACxB,CAAC;YACH,CAAC;YAED,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAC3E,8BAAY,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;KAAA;IAEY,UAAU,CACrB,QAAgB,EAChB,WAAqB;;YAErB,IAAI,kCAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAC5E,CAAC;YAED,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iCAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3F,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,8BAA8B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACvE,CAAC;YACJ,CAAC;YAED,MAAM,QAAQ,GAAiB;gBAC7B,QAAQ;gBACR,WAAW;gBACX,YAAY,EAAE,KAAK;gBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3D,kCAAiB,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YAE5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;QACjE,CAAC;KAAA;IAEY,SAAS;;;YACpB,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YACtF,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAC,MAAA,MAAM,CAAC,IAAI,0CAAE,SAAS,CAAA,EAAE,CAAC;gBACnD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,SAA2B,CAAC;QACjD,CAAC;KAAA;IAED;;;OAGG;IACW,uBAAuB,CACnC,iBAAyB;;;YAEzB,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,kBAAkB,EAAE;iBACrD,KAAK,CAAC,EAAE,IAAI,EAAE,8BAAgB,EAAE,CAAC;iBACjC,KAAK,CAAC,IAAI,CAAC;iBACX,IAAI,EAAE,CAAC;YAEV,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,KAAI,MAAA,MAAM,CAAC,IAAI,0CAAE,SAAS,CAAA,CAAC,CAAC,CAAE,MAAM,CAAC,IAAI,CAAC,SAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CACzE,CAAC;YAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,8CAA8C;iBACxD,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;KAAA;CACF"}

package/lib/Services/Auth/ConfigDatabase.service.d.ts

@@ -0,0 +1,22 @@
+import Collection from "../Collection/collection.operation";
+/**
+ * Holds long-lived references to the `config` database's `users`/`roles`/`permissions`
+ * collections. Collection instances are reused across requests instead of being
+ * recreated per call, since each `Collection` eagerly loads its index cache on
+ * construction - recreating it per request would repeatedly reload indexes for
+ * no benefit.
+ */
+declare class ConfigDatabase {
+    private static instance;
+    private usersCollection;
+    private rolesCollection;
+    private permissionsCollection;
+    static getInstance(): ConfigDatabase;
+    setCollections(usersCollection: Collection, rolesCollection: Collection, permissionsCollection: Collection): void;
+    isInitialized(): boolean;
+    getUsersCollection(): Collection;
+    getRolesCollection(): Collection;
+    getPermissionsCollection(): Collection;
+}
+declare const _default: ConfigDatabase;
+export default _default;

package/lib/Services/Auth/ConfigDatabase.service.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Holds long-lived references to the `config` database's `users`/`roles`/`permissions`
+ * collections. Collection instances are reused across requests instead of being
+ * recreated per call, since each `Collection` eagerly loads its index cache on
+ * construction - recreating it per request would repeatedly reload indexes for
+ * no benefit.
+ */
+class ConfigDatabase {
+    static getInstance() {
+        if (!ConfigDatabase.instance) {
+            ConfigDatabase.instance = new ConfigDatabase();
+        }
+        return ConfigDatabase.instance;
+    }
+    setCollections(usersCollection, rolesCollection, permissionsCollection) {
+        this.usersCollection = usersCollection;
+        this.rolesCollection = rolesCollection;
+        this.permissionsCollection = permissionsCollection;
+    }
+    isInitialized() {
+        return (this.usersCollection !== undefined &&
+            this.rolesCollection !== undefined &&
+            this.permissionsCollection !== undefined);
+    }
+    getUsersCollection() {
+        if (!this.usersCollection) {
+            throw new Error("Config database is not initialized yet");
+        }
+        return this.usersCollection;
+    }
+    getRolesCollection() {
+        if (!this.rolesCollection) {
+            throw new Error("Config database is not initialized yet");
+        }
+        return this.rolesCollection;
+    }
+    getPermissionsCollection() {
+        if (!this.permissionsCollection) {
+            throw new Error("Config database is not initialized yet");
+        }
+        return this.permissionsCollection;
+    }
+}
+exports.default = ConfigDatabase.getInstance();
+//# sourceMappingURL=ConfigDatabase.service.js.map

package/lib/Services/Auth/ConfigDatabase.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigDatabase.service.js","sourceRoot":"","sources":["../../../source/Services/Auth/ConfigDatabase.service.ts"],"names":[],"mappings":";;AAEA;;;;;;GAMG;AACH,MAAM,cAAc;IAMX,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC7B,cAAc,CAAC,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,cAAc,CAAC,QAAQ,CAAC;IACjC,CAAC;IAEM,cAAc,CACnB,eAA2B,EAC3B,eAA2B,EAC3B,qBAAiC;QAEjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC;IACrD,CAAC;IAEM,aAAa;QAClB,OAAO,CACL,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,IAAI,CAAC,eAAe,KAAK,SAAS;YAClC,IAAI,CAAC,qBAAqB,KAAK,SAAS,CACzC,CAAC;IACJ,CAAC;IAEM,kBAAkB;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEM,kBAAkB;QACvB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAEM,wBAAwB;QAC7B,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;CACF;kBAEc,cAAc,CAAC,WAAW,EAAE"}

package/lib/Services/Auth/CookieCodec.helper.d.ts

@@ -0,0 +1,10 @@
+import { CookiePayload } from "../../config/Interfaces/Auth/auth.interface";
+/**
+ * Encodes/decodes the session cookie value. The cookie is intentionally not the
+ * security boundary by itself - it only carries a random `sid` used to look up the
+ * real session record in SessionStore's in-memory map. See SessionStore.service.ts.
+ */
+export default class CookieCodec {
+    static encode(payload: CookiePayload): string;
+    static decode(rawCookieValue: string): CookiePayload | null;
+}

package/lib/Services/Auth/CookieCodec.helper.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Encodes/decodes the session cookie value. The cookie is intentionally not the
+ * security boundary by itself - it only carries a random `sid` used to look up the
+ * real session record in SessionStore's in-memory map. See SessionStore.service.ts.
+ */
+class CookieCodec {
+    static encode(payload) {
+        return Buffer.from(JSON.stringify(payload), "utf-8").toString("base64url");
+    }
+    static decode(rawCookieValue) {
+        try {
+            const json = Buffer.from(rawCookieValue, "base64url").toString("utf-8");
+            const parsed = JSON.parse(json);
+            if (typeof parsed === "object" &&
+                parsed !== null &&
+                typeof parsed.sid === "string" &&
+                typeof parsed.iat === "number") {
+                return parsed;
+            }
+            return null;
+        }
+        catch (_a) {
+            return null;
+        }
+    }
+}
+exports.default = CookieCodec;
+//# sourceMappingURL=CookieCodec.helper.js.map

package/lib/Services/Auth/CookieCodec.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CookieCodec.helper.js","sourceRoot":"","sources":["../../../source/Services/Auth/CookieCodec.helper.ts"],"names":[],"mappings":";;AAEA;;;;GAIG;AACH;IACS,MAAM,CAAC,MAAM,CAAC,OAAsB;QACzC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7E,CAAC;IAEM,MAAM,CAAC,MAAM,CAAC,cAAsB;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IACE,OAAO,MAAM,KAAK,QAAQ;gBAC1B,MAAM,KAAK,IAAI;gBACf,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;gBAC9B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAC9B,CAAC;gBACD,OAAO,MAAuB,CAAC;YACjC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;mBAAO,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/lib/Services/Auth/PasswordHasher.helper.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Hashes and verifies passwords using Node's built-in scrypt KDF.
+ * Stored format is `${saltHex}:${hashHex}` - no external dependency required.
+ */
+export default class PasswordHasher {
+    static hashPassword(plainPassword: string): Promise<string>;
+    static verifyPassword(plainPassword: string, storedHash: string): Promise<boolean>;
+    private static deriveKey;
+}

package/lib/Services/Auth/PasswordHasher.helper.js

@@ -0,0 +1,54 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("crypto");
+const KEY_LENGTH = 64;
+const SALT_LENGTH = 16;
+/**
+ * Hashes and verifies passwords using Node's built-in scrypt KDF.
+ * Stored format is `${saltHex}:${hashHex}` - no external dependency required.
+ */
+class PasswordHasher {
+    static hashPassword(plainPassword) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const salt = (0, crypto_1.randomBytes)(SALT_LENGTH).toString("hex");
+            const derivedKey = yield PasswordHasher.deriveKey(plainPassword, salt);
+            return `${salt}:${derivedKey.toString("hex")}`;
+        });
+    }
+    static verifyPassword(plainPassword, storedHash) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const [salt, hashHex] = storedHash.split(":");
+            if (!salt || !hashHex) {
+                return false;
+            }
+            const derivedKey = yield PasswordHasher.deriveKey(plainPassword, salt);
+            const storedKey = Buffer.from(hashHex, "hex");
+            if (derivedKey.length !== storedKey.length) {
+                return false;
+            }
+            return (0, crypto_1.timingSafeEqual)(derivedKey, storedKey);
+        });
+    }
+    static deriveKey(plainPassword, salt) {
+        return new Promise((resolve, reject) => {
+            (0, crypto_1.scrypt)(plainPassword, salt, KEY_LENGTH, (error, derivedKey) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve(derivedKey);
+            });
+        });
+    }
+}
+exports.default = PasswordHasher;
+//# sourceMappingURL=PasswordHasher.helper.js.map

package/lib/Services/Auth/PasswordHasher.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordHasher.helper.js","sourceRoot":"","sources":["../../../source/Services/Auth/PasswordHasher.helper.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,mCAA8D;AAE9D,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;;;GAGG;AACH;IACS,MAAM,CAAO,YAAY,CAAC,aAAqB;;YACpD,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YACvE,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,CAAC;KAAA;IAEM,MAAM,CAAO,cAAc,CAChC,aAAqB,EACrB,UAAkB;;YAElB,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE9C,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;gBAC3C,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAA,wBAAe,EAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC;KAAA;IAEO,MAAM,CAAC,SAAS,CAAC,aAAqB,EAAE,IAAY;QAC1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAA,eAAM,EAAC,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC5D,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}