`095d099`

4.2 authentication system with email & OAuth

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 8 months ago

SHA: 095d099187a428bd3ccbbea9a51bb1f592353f8d
Parents: cd963ec
Tree: 20d3390

7 changed files

Status	File	+	-
M	`server/package.json`	8	1
A	`server/src/database/connection.ts`	112	0
A	`server/src/database/schema.sql`	131	0
A	`server/src/database/types.ts`	138	0
A	`server/src/routes/auth-v2.ts`	613	0
A	`server/src/routes/oauth.ts`	500	0
A	`server/src/services/email.ts`	371	0

server/package.jsonmodified

      "@fastify/multipart": "^8.0.0",
      "@fastify/static": "^6.12.0",
      "@fastify/websocket": "^8.3.1",
 +    "@fastify/oauth2": "^7.8.0",
      "webdav": "^5.3.0",
      "ws": "^8.14.2",
      "zod": "^3.22.4",
 -    "archiver": "^6.0.1"
 +    "archiver": "^6.0.1",
 +    "bcrypt": "^5.1.1",
 +    "nodemailer": "^6.9.7",
 +    "sqlite3": "^5.1.6",
 +    "kysely": "^0.27.2"
    },
    "devDependencies": {
      "@types/node": "^20.8.10",
      "@types/ws": "^8.5.8",
      "@types/archiver": "^6.0.2",
 +    "@types/bcrypt": "^5.0.2",
 +    "@types/nodemailer": "^6.4.14",
      "@typescript-eslint/eslint-plugin": "^6.9.1",
      "@typescript-eslint/parser": "^6.9.1",
      "eslint": "^8.52.0",

server/src/database/connection.tsadded

 +import { Kysely, SqliteDialect } from 'kysely';
 +import SQLite from 'sqlite3';
 +import { readFileSync } from 'fs';
 +import { join } from 'path';
 +import type { Database } from './types.js';
++
 +let db: Kysely<Database> | null = null;
++
 +export function initializeDatabase(dbPath?: string): Kysely<Database> {
 +  if (db) {
 +    return db;
 +  }
++
 +  const databasePath = dbPath || process.env.DATABASE_PATH || ':memory:';
++
 +  const dialect = new SqliteDialect({
 +    database: new SQLite.Database(databasePath),
 +  });
++
 +  db = new Kysely<Database>({
 +    dialect,
 +  });
++
 +  return db;
 +}
++
 +export async function setupDatabase(): Promise<void> {
 +  const database = getDatabase();
++
 +  // Read and execute schema
 +  const schemaPath = join(new URL(import.meta.url).pathname, '../schema.sql');
 +  const schema = readFileSync(schemaPath, 'utf-8');
++
 +  // Split and execute each statement
 +  const statements = schema
 +    .split(';')
 +    .map(stmt => stmt.trim())
 +    .filter(stmt => stmt.length > 0);
++
 +  for (const statement of statements) {
 +    try {
 +      await database.executeQuery({
 +        sql: statement,
 +        parameters: [],
 +      });
 +    } catch (error) {
 +      // Ignore table already exists errors
 +      if (!error.message?.includes('already exists')) {
 +        console.error('Database setup error:', error);
 +        throw error;
 +      }
 +    }
 +  }
 +}
++
 +export function getDatabase(): Kysely<Database> {
 +  if (!db) {
 +    throw new Error('Database not initialized. Call initializeDatabase() first.');
 +  }
 +  return db;
 +}
++
 +export async function closeDatabase(): Promise<void> {
 +  if (db) {
 +    await db.destroy();
 +    db = null;
 +  }
 +}
++
 +// Helper function to convert snake_case to camelCase for database rows
 +export function toCamelCase<T>(obj: any): T {
 +  if (obj === null || obj === undefined) {
 +    return obj;
 +  }
++
 +  if (Array.isArray(obj)) {
 +    return obj.map(toCamelCase) as T;
 +  }
++
 +  if (typeof obj === 'object' && obj.constructor === Object) {
 +    const result: any = {};
 +    for (const [key, value] of Object.entries(obj)) {
 +      const camelKey = key.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
 +      result[camelKey] = toCamelCase(value);
 +    }
 +    return result;
 +  }
++
 +  return obj;
 +}
++
 +// Helper function to convert camelCase to snake_case for database queries
 +export function toSnakeCase<T>(obj: any): T {
 +  if (obj === null || obj === undefined) {
 +    return obj;
 +  }
++
 +  if (Array.isArray(obj)) {
 +    return obj.map(toSnakeCase) as T;
 +  }
++
 +  if (typeof obj === 'object' && obj.constructor === Object) {
 +    const result: any = {};
 +    for (const [key, value] of Object.entries(obj)) {
 +      const snakeKey = key.replace(/[A-Z]/g, letter => `_${letter.toLowerCase()}`);
 +      result[snakeKey] = toSnakeCase(value);
 +    }
 +    return result;
 +  }
++
 +  return obj;
 +}

server/src/database/schema.sqladded

 +-- ZephyrFS Authentication Database Schema
++
 +-- Users table with email registration and OAuth support
 +CREATE TABLE users (
 +    id TEXT PRIMARY KEY,
 +    email TEXT UNIQUE NOT NULL,
 +    username TEXT UNIQUE,
 +    password_hash TEXT,
 +    user_type TEXT CHECK (user_type IN ('backup', 'volunteer', 'admin')) NOT NULL DEFAULT 'backup',
 +    email_verified BOOLEAN DEFAULT FALSE,
 +    email_verification_token TEXT,
 +    email_verification_expires_at DATETIME,
 +    password_reset_token TEXT,
 +    password_reset_expires_at DATETIME,
 +    github_id TEXT UNIQUE,
 +    github_username TEXT,
 +    github_avatar_url TEXT,
 +    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    last_login_at DATETIME,
 +    profile_data TEXT -- JSON storage for additional profile info
 +);
++
 +-- OAuth accounts table for multiple providers
 +CREATE TABLE oauth_accounts (
 +    id TEXT PRIMARY KEY,
 +    user_id TEXT NOT NULL,
 +    provider TEXT NOT NULL,
 +    provider_account_id TEXT NOT NULL,
 +    access_token TEXT,
 +    refresh_token TEXT,
 +    expires_at DATETIME,
 +    token_type TEXT,
 +    scope TEXT,
 +    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
 +    UNIQUE(provider, provider_account_id)
 +);
++
 +-- User sessions table
 +CREATE TABLE user_sessions (
 +    id TEXT PRIMARY KEY,
 +    user_id TEXT NOT NULL,
 +    session_token TEXT UNIQUE NOT NULL,
 +    expires_at DATETIME NOT NULL,
 +    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    last_access_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    ip_address TEXT,
 +    user_agent TEXT,
 +    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
 +);
++
 +-- Email verification attempts tracking
 +CREATE TABLE email_verifications (
 +    id TEXT PRIMARY KEY,
 +    user_id TEXT NOT NULL,
 +    email TEXT NOT NULL,
 +    token TEXT NOT NULL,
 +    attempts INTEGER DEFAULT 0,
 +    verified_at DATETIME,
 +    expires_at DATETIME NOT NULL,
 +    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
 +);
++
 +-- Password reset attempts tracking
 +CREATE TABLE password_resets (
 +    id TEXT PRIMARY KEY,
 +    user_id TEXT NOT NULL,
 +    token TEXT NOT NULL,
 +    attempts INTEGER DEFAULT 0,
 +    used_at DATETIME,
 +    expires_at DATETIME NOT NULL,
 +    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
 +);
++
 +-- User onboarding progress tracking
 +CREATE TABLE user_onboarding (
 +    id TEXT PRIMARY KEY,
 +    user_id TEXT NOT NULL,
 +    step TEXT NOT NULL,
 +    completed BOOLEAN DEFAULT FALSE,
 +    data TEXT, -- JSON storage for step-specific data
 +    completed_at DATETIME,
 +    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 +    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
 +);
++
 +-- Indexes for performance
 +CREATE INDEX idx_users_email ON users (email);
 +CREATE INDEX idx_users_username ON users (username);
 +CREATE INDEX idx_users_github_id ON oauth_accounts (provider_account_id);
 +CREATE INDEX idx_sessions_token ON user_sessions (session_token);
 +CREATE INDEX idx_sessions_user_id ON user_sessions (user_id);
 +CREATE INDEX idx_email_verifications_token ON email_verifications (token);
 +CREATE INDEX idx_password_resets_token ON password_resets (token);
++
 +-- Insert default admin user
 +INSERT INTO users (
 +    id,
 +    email,
 +    username,
 +    password_hash,
 +    user_type,
 +    email_verified
 +) VALUES (
 +    'admin',
 +    'admin@zephyrfs.org',
 +    'admin',
 +    '$2b$10$rKGHZ0aB0qKhP0DqW8qZHu2wF2nF.FqD3tYw1pV6gB2wZ8vY0gG4u', -- 'admin' hashed
 +    'admin',
 +    TRUE
 +);
++
 +INSERT INTO users (
 +    id,
 +    email,
 +    username,
 +    password_hash,
 +    user_type,
 +    email_verified
 +) VALUES (
 +    'demo',
 +    'demo@zephyrfs.org',
 +    'demo',
 +    '$2b$10$rKGHZ0aB0qKhP0DqW8qZHu2wF2nF.FqD3tYw1pV6gB2wZ8vY0gG4u', -- 'demo' hashed
 +    'backup',
 +    TRUE
 +);

server/src/database/types.tsadded

 +// Database types for ZephyrFS authentication system
++
 +export interface User {
 +  id: string;
 +  email: string;
 +  username?: string;
 +  passwordHash?: string;
 +  userType: 'backup' | 'volunteer' | 'admin';
 +  emailVerified: boolean;
 +  emailVerificationToken?: string;
 +  emailVerificationExpiresAt?: Date;
 +  passwordResetToken?: string;
 +  passwordResetExpiresAt?: Date;
 +  githubId?: string;
 +  githubUsername?: string;
 +  githubAvatarUrl?: string;
 +  createdAt: Date;
 +  updatedAt: Date;
 +  lastLoginAt?: Date;
 +  profileData?: string; // JSON storage
 +}
++
 +export interface OAuthAccount {
 +  id: string;
 +  userId: string;
 +  provider: string;
 +  providerAccountId: string;
 +  accessToken?: string;
 +  refreshToken?: string;
 +  expiresAt?: Date;
 +  tokenType?: string;
 +  scope?: string;
 +  createdAt: Date;
 +  updatedAt: Date;
 +}
++
 +export interface UserSession {
 +  id: string;
 +  userId: string;
 +  sessionToken: string;
 +  expiresAt: Date;
 +  createdAt: Date;
 +  lastAccessAt: Date;
 +  ipAddress?: string;
 +  userAgent?: string;
 +}
++
 +export interface EmailVerification {
 +  id: string;
 +  userId: string;
 +  email: string;
 +  token: string;
 +  attempts: number;
 +  verifiedAt?: Date;
 +  expiresAt: Date;
 +  createdAt: Date;
 +}
++
 +export interface PasswordReset {
 +  id: string;
 +  userId: string;
 +  token: string;
 +  attempts: number;
 +  usedAt?: Date;
 +  expiresAt: Date;
 +  createdAt: Date;
 +}
++
 +export interface UserOnboarding {
 +  id: string;
 +  userId: string;
 +  step: string;
 +  completed: boolean;
 +  data?: string; // JSON storage
 +  completedAt?: Date;
 +  createdAt: Date;
 +}
++
 +export interface Database {
 +  users: User;
 +  oauth_accounts: OAuthAccount;
 +  user_sessions: UserSession;
 +  email_verifications: EmailVerification;
 +  password_resets: PasswordReset;
 +  user_onboarding: UserOnboarding;
 +}
++
 +// API types for requests/responses
 +export interface RegisterRequest {
 +  email: string;
 +  username?: string;
 +  password: string;
 +  userType: 'backup' | 'volunteer';
 +}
++
 +export interface LoginRequest {
 +  email?: string;
 +  username?: string;
 +  password?: string;
 +  token?: string;
 +}
++
 +export interface AuthResponse {
 +  token: string;
 +  refreshToken: string;
 +  expiresIn: number;
 +  user: PublicUser;
 +}
++
 +export interface PublicUser {
 +  id: string;
 +  email: string;
 +  username?: string;
 +  userType: 'backup' | 'volunteer' | 'admin';
 +  emailVerified: boolean;
 +  githubUsername?: string;
 +  githubAvatarUrl?: string;
 +  createdAt: Date;
 +}
++
 +export interface EmailVerificationRequest {
 +  token: string;
 +}
++
 +export interface PasswordResetRequest {
 +  email: string;
 +}
++
 +export interface PasswordResetConfirmRequest {
 +  token: string;
 +  newPassword: string;
 +}
++
 +export interface OnboardingUpdateRequest {
 +  step: string;
 +  data?: Record<string, any>;
 +  completed?: boolean;
 +}

server/src/routes/auth-v2.tsadded

 +import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 +import bcrypt from 'bcrypt';
 +import { z } from 'zod';
 +import { randomBytes, randomUUID } from 'crypto';
 +import { getDatabase, toCamelCase } from '../database/connection.js';
 +import { EmailService } from '../services/email.js';
 +import type {
 +  RegisterRequest,
 +  LoginRequest,
 +  AuthResponse,
 +  PublicUser,
 +  EmailVerificationRequest,
 +  PasswordResetRequest,
 +  PasswordResetConfirmRequest,
 +  OnboardingUpdateRequest,
 +} from '../database/types.js';
++
 +// Validation schemas
 +const registerSchema = z.object({
 +  email: z.string().email('Invalid email address'),
 +  username: z.string().min(3).max(30).optional(),
 +  password: z.string().min(8, 'Password must be at least 8 characters'),
 +  userType: z.enum(['backup', 'volunteer'], {
 +    required_error: 'Please select whether you want to backup files or volunteer storage',
 +  }),
 +});
++
 +const loginSchema = z.object({
 +  email: z.string().email().optional(),
 +  username: z.string().optional(),
 +  password: z.string().optional(),
 +  token: z.string().optional(),
 +}).refine(
 +  (data) => (data.email || data.username) && data.password || data.token,
 +  'Email/username and password, or token required'
 +);
++
 +const emailVerificationSchema = z.object({
 +  token: z.string().min(1, 'Verification token required'),
 +});
++
 +const passwordResetSchema = z.object({
 +  email: z.string().email('Invalid email address'),
 +});
++
 +const passwordResetConfirmSchema = z.object({
 +  token: z.string().min(1, 'Reset token required'),
 +  newPassword: z.string().min(8, 'Password must be at least 8 characters'),
 +});
++
 +const onboardingUpdateSchema = z.object({
 +  step: z.string().min(1),
 +  data: z.record(z.any()).optional(),
 +  completed: z.boolean().optional(),
 +});
++
 +let emailService: EmailService;
++
 +export async function authV2Routes(fastify: FastifyInstance) {
 +  const db = getDatabase();
++
 +  // Initialize email service
 +  emailService = new EmailService({
 +    host: process.env.SMTP_HOST || 'smtp.ethereal.email',
 +    port: parseInt(process.env.SMTP_PORT || '587'),
 +    secure: process.env.SMTP_SECURE === 'true',
 +    auth: process.env.SMTP_USER && process.env.SMTP_PASS ? {
 +      user: process.env.SMTP_USER,
 +      pass: process.env.SMTP_PASS,
 +    } : undefined,
 +    from: process.env.SMTP_FROM || 'ZephyrFS <noreply@zephyrfs.org>',
 +  });
++
 +  // Helper function to create public user object
 +  const toPublicUser = (user: any): PublicUser => ({
 +    id: user.id,
 +    email: user.email,
 +    username: user.username,
 +    userType: user.userType || user.user_type,
 +    emailVerified: user.emailVerified || user.email_verified,
 +    githubUsername: user.githubUsername || user.github_username,
 +    githubAvatarUrl: user.githubAvatarUrl || user.github_avatar_url,
 +    createdAt: new Date(user.createdAt || user.created_at),
 +  });
++
 +  // User registration
 +  fastify.post<{
 +    Body: RegisterRequest;
 +  }>('/auth/register', {
 +    schema: { body: registerSchema },
 +  }, async (request: FastifyRequest, reply: FastifyReply) => {
 +    const { email, username, password, userType } = request.body as RegisterRequest;
++
 +    try {
 +      // Check if user already exists
 +      const existingUser = await db
 +        .selectFrom('users')
 +        .selectAll()
 +        .where((eb) => eb.or([
 +          eb('email', '=', email),
 +          ...(username ? [eb('username', '=', username)] : [])
 +        ]))
 +        .executeTakeFirst();
++
 +      if (existingUser) {
 +        if (existingUser.email === email) {
 +          throw fastify.httpErrors.conflict('Email already registered');
 +        }
 +        if (existingUser.username === username) {
 +          throw fastify.httpErrors.conflict('Username already taken');
 +        }
 +      }
++
 +      // Hash password
 +      const passwordHash = await bcrypt.hash(password, 12);
++
 +      // Generate verification token
 +      const verificationToken = randomBytes(32).toString('hex');
 +      const verificationExpiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24 hours
++
 +      // Create user
 +      const userId = randomUUID();
 +      await db
 +        .insertInto('users')
 +        .values({
 +          id: userId,
 +          email,
 +          username,
 +          password_hash: passwordHash,
 +          user_type: userType,
 +          email_verified: false,
 +          email_verification_token: verificationToken,
 +          email_verification_expires_at: verificationExpiresAt.toISOString(),
 +          created_at: new Date().toISOString(),
 +          updated_at: new Date().toISOString(),
 +        })
 +        .execute();
++
 +      // Create email verification record
 +      await db
 +        .insertInto('email_verifications')
 +        .values({
 +          id: randomUUID(),
 +          user_id: userId,
 +          email,
 +          token: verificationToken,
 +          attempts: 0,
 +          expires_at: verificationExpiresAt.toISOString(),
 +          created_at: new Date().toISOString(),
 +        })
 +        .execute();
++
 +      // Send verification email
 +      try {
 +        await emailService.sendEmailVerification(email, verificationToken, username);
 +      } catch (emailError) {
 +        fastify.log.error(emailError, 'Failed to send verification email');
 +        // Don't fail registration if email fails
 +      }
++
 +      // Initialize onboarding steps
 +      const onboardingSteps = userType === 'volunteer'
 +        ? ['user-type-selection', 'storage-setup', 'desktop-app', 'node-configuration']
 +        : ['user-type-selection', 'backup-setup', 'first-upload'];
++
 +      for (const step of onboardingSteps) {
 +        await db
 +          .insertInto('user_onboarding')
 +          .values({
 +            id: randomUUID(),
 +            user_id: userId,
 +            step,
 +            completed: step === 'user-type-selection', // First step completed
 +            data: step === 'user-type-selection' ? JSON.stringify({ userType }) : null,
 +            completed_at: step === 'user-type-selection' ? new Date().toISOString() : null,
 +            created_at: new Date().toISOString(),
 +          })
 +          .execute();
 +      }
++
 +      return {
 +        success: true,
 +        message: 'Registration successful! Please check your email to verify your account.',
 +        userId,
 +      };
 +    } catch (error) {
 +      if (error.statusCode) {
 +        throw error;
 +      }
 +      fastify.log.error(error, 'Registration failed');
 +      throw fastify.httpErrors.internalServerError('Registration failed');
 +    }
 +  });
++
 +  // Email verification
 +  fastify.post<{
 +    Body: EmailVerificationRequest;
 +  }>('/auth/verify-email', {
 +    schema: { body: emailVerificationSchema },
 +  }, async (request: FastifyRequest, reply: FastifyReply) => {
 +    const { token } = request.body as EmailVerificationRequest;
++
 +    try {
 +      // Find verification record
 +      const verification = await db
 +        .selectFrom('email_verifications')
 +        .selectAll()
 +        .where('token', '=', token)
 +        .where('verified_at', 'is', null)
 +        .executeTakeFirst();
++
 +      if (!verification) {
 +        throw fastify.httpErrors.badRequest('Invalid or expired verification token');
 +      }
++
 +      if (new Date() > new Date(verification.expires_at)) {
 +        throw fastify.httpErrors.badRequest('Verification token has expired');
 +      }
++
 +      // Update verification record
 +      await db
 +        .updateTable('email_verifications')
 +        .set({
 +          verified_at: new Date().toISOString(),
 +          attempts: verification.attempts + 1,
 +        })
 +        .where('id', '=', verification.id)
 +        .execute();
++
 +      // Update user
 +      const user = await db
 +        .updateTable('users')
 +        .set({
 +          email_verified: true,
 +          email_verification_token: null,
 +          email_verification_expires_at: null,
 +          updated_at: new Date().toISOString(),
 +        })
 +        .where('id', '=', verification.user_id)
 +        .returningAll()
 +        .executeTakeFirstOrThrow();
++
 +      // Send welcome email
 +      try {
 +        await emailService.sendWelcomeEmail(
 +          user.email,
 +          user.user_type as 'backup' | 'volunteer',
 +          user.username || undefined
 +        );
 +      } catch (emailError) {
 +        fastify.log.error(emailError, 'Failed to send welcome email');
 +      }
++
 +      return {
 +        success: true,
 +        message: 'Email verified successfully! Welcome to ZephyrFS!',
 +        user: toPublicUser(user),
 +      };
 +    } catch (error) {
 +      if (error.statusCode) {
 +        throw error;
 +      }
 +      fastify.log.error(error, 'Email verification failed');
 +      throw fastify.httpErrors.internalServerError('Email verification failed');
 +    }
 +  });
++
 +  // Enhanced login
 +  fastify.post<{
 +    Body: LoginRequest;
 +  }>('/auth/login', {
 +    schema: { body: loginSchema },
 +  }, async (request: FastifyRequest, reply: FastifyReply) => {
 +    const { email, username, password, token } = request.body as LoginRequest;
++
 +    try {
 +      let user: any;
++
 +      if (token) {
 +        // Token-based authentication
 +        try {
 +          const decoded = fastify.jwt.verify(token) as { userId: string; username: string };
 +          user = await db
 +            .selectFrom('users')
 +            .selectAll()
 +            .where('id', '=', decoded.userId)
 +            .executeTakeFirst();
++
 +          if (!user) {
 +            throw new Error('User not found');
 +          }
 +        } catch (error) {
 +          throw fastify.httpErrors.unauthorized('Invalid token');
 +        }
 +      } else if ((email || username) && password) {
 +        // Password-based authentication
 +        user = await db
 +          .selectFrom('users')
 +          .selectAll()
 +          .where((eb) => eb.or([
 +            ...(email ? [eb('email', '=', email)] : []),
 +            ...(username ? [eb('username', '=', username)] : [])
 +          ]))
 +          .executeTakeFirst();
++
 +        if (!user || !user.password_hash) {
 +          throw fastify.httpErrors.unauthorized('Invalid credentials');
 +        }
++
 +        const validPassword = await bcrypt.compare(password, user.password_hash);
 +        if (!validPassword) {
 +          throw fastify.httpErrors.unauthorized('Invalid credentials');
 +        }
++
 +        // Check if email is verified for new registrations
 +        if (!user.email_verified) {
 +          throw fastify.httpErrors.forbidden('Please verify your email address before logging in');
 +        }
 +      } else {
 +        throw fastify.httpErrors.badRequest('Email/username and password, or token required');
 +      }
++
 +      // Create session
 +      const sessionId = randomUUID();
 +      const sessionToken = randomBytes(32).toString('hex');
 +      const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // 30 days
++
 +      await db
 +        .insertInto('user_sessions')
 +        .values({
 +          id: sessionId,
 +          user_id: user.id,
 +          session_token: sessionToken,
 +          expires_at: expiresAt.toISOString(),
 +          created_at: new Date().toISOString(),
 +          last_access_at: new Date().toISOString(),
 +          ip_address: request.ip,
 +          user_agent: request.headers['user-agent'],
 +        })
 +        .execute();
++
 +      // Update last login
 +      await db
 +        .updateTable('users')
 +        .set({
 +          last_login_at: new Date().toISOString(),
 +          updated_at: new Date().toISOString(),
 +        })
 +        .where('id', '=', user.id)
 +        .execute();
++
 +      // Generate tokens
 +      const accessToken = fastify.jwt.sign(
 +        { userId: user.id, username: user.username, sessionId },
 +        { expiresIn: fastify.config.jwtExpiresIn }
 +      );
++
 +      const refreshToken = fastify.jwt.sign(
 +        { userId: user.id, sessionId, type: 'refresh' },
 +        { expiresIn: fastify.config.jwtRefreshExpiresIn }
 +      );
++
 +      const response: AuthResponse = {
 +        token: accessToken,
 +        refreshToken,
 +        expiresIn: 24 * 60 * 60, // 24 hours in seconds
 +        user: toPublicUser(user),
 +      };
++
 +      return response;
 +    } catch (error) {
 +      if (error.statusCode) {
 +        throw error;
 +      }
 +      fastify.log.error(error, 'Login failed');
 +      throw fastify.httpErrors.internalServerError('Login failed');
 +    }
 +  });
++
 +  // Password reset request
 +  fastify.post<{
 +    Body: PasswordResetRequest;
 +  }>('/auth/password-reset', {
 +    schema: { body: passwordResetSchema },
 +  }, async (request: FastifyRequest, reply: FastifyReply) => {
 +    const { email } = request.body as PasswordResetRequest;
++
 +    try {
 +      const user = await db
 +        .selectFrom('users')
 +        .selectAll()
 +        .where('email', '=', email)
 +        .executeTakeFirst();
++
 +      // Always return success to prevent email enumeration
 +      if (!user) {
 +        return {
 +          success: true,
 +          message: 'If an account with that email exists, we\'ve sent a password reset link.',
 +        };
 +      }
++
 +      // Generate reset token
 +      const resetToken = randomBytes(32).toString('hex');
 +      const resetExpiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
++
 +      // Update user with reset token
 +      await db
 +        .updateTable('users')
 +        .set({
 +          password_reset_token: resetToken,
 +          password_reset_expires_at: resetExpiresAt.toISOString(),
 +          updated_at: new Date().toISOString(),
 +        })
 +        .where('id', '=', user.id)
 +        .execute();
++
 +      // Create password reset record
 +      await db
 +        .insertInto('password_resets')
 +        .values({
 +          id: randomUUID(),
 +          user_id: user.id,
 +          token: resetToken,
 +          attempts: 0,
 +          expires_at: resetExpiresAt.toISOString(),
 +          created_at: new Date().toISOString(),
 +        })
 +        .execute();
++
 +      // Send reset email
 +      try {
 +        await emailService.sendPasswordReset(email, resetToken, user.username || undefined);
 +      } catch (emailError) {
 +        fastify.log.error(emailError, 'Failed to send password reset email');
 +      }
++
 +      return {
 +        success: true,
 +        message: 'If an account with that email exists, we\'ve sent a password reset link.',
 +      };
 +    } catch (error) {
 +      fastify.log.error(error, 'Password reset request failed');
 +      throw fastify.httpErrors.internalServerError('Password reset request failed');
 +    }
 +  });
++
 +  // Password reset confirmation
 +  fastify.post<{
 +    Body: PasswordResetConfirmRequest;
 +  }>('/auth/password-reset/confirm', {
 +    schema: { body: passwordResetConfirmSchema },
 +  }, async (request: FastifyRequest, reply: FastifyReply) => {
 +    const { token, newPassword } = request.body as PasswordResetConfirmRequest;
++
 +    try {
 +      // Find reset record
 +      const reset = await db
 +        .selectFrom('password_resets')
 +        .selectAll()
 +        .where('token', '=', token)
 +        .where('used_at', 'is', null)
 +        .executeTakeFirst();
++
 +      if (!reset) {
 +        throw fastify.httpErrors.badRequest('Invalid or expired reset token');
 +      }
++
 +      if (new Date() > new Date(reset.expires_at)) {
 +        throw fastify.httpErrors.badRequest('Reset token has expired');
 +      }
++
 +      // Hash new password
 +      const passwordHash = await bcrypt.hash(newPassword, 12);
++
 +      // Update user
 +      await db
 +        .updateTable('users')
 +        .set({
 +          password_hash: passwordHash,
 +          password_reset_token: null,
 +          password_reset_expires_at: null,
 +          updated_at: new Date().toISOString(),
 +        })
 +        .where('id', '=', reset.user_id)
 +        .execute();
++
 +      // Mark reset as used
 +      await db
 +        .updateTable('password_resets')
 +        .set({
 +          used_at: new Date().toISOString(),
 +          attempts: reset.attempts + 1,
 +        })
 +        .where('id', '=', reset.id)
 +        .execute();
++
 +      // Invalidate all sessions for this user
 +      await db
 +        .deleteFrom('user_sessions')
 +        .where('user_id', '=', reset.user_id)
 +        .execute();
++
 +      return {
 +        success: true,
 +        message: 'Password updated successfully! Please log in with your new password.',
 +      };
 +    } catch (error) {
 +      if (error.statusCode) {
 +        throw error;
 +      }
 +      fastify.log.error(error, 'Password reset confirmation failed');
 +      throw fastify.httpErrors.internalServerError('Password reset confirmation failed');
 +    }
 +  });
++
 +  // Get user onboarding status
 +  fastify.get('/auth/onboarding', {
 +    preHandler: fastify.authenticate,
 +  }, async (request: FastifyRequest) => {
 +    const user = request.user as { userId: string };
++
 +    const onboardingSteps = await db
 +      .selectFrom('user_onboarding')
 +      .selectAll()
 +      .where('user_id', '=', user.userId)
 +      .orderBy('created_at', 'asc')
 +      .execute();
++
 +    return {
 +      steps: onboardingSteps.map(toCamelCase),
 +      completed: onboardingSteps.filter(step => step.completed).length,
 +      total: onboardingSteps.length,
 +    };
 +  });
++
 +  // Update onboarding progress
 +  fastify.post<{
 +    Body: OnboardingUpdateRequest;
 +  }>('/auth/onboarding/update', {
 +    preHandler: fastify.authenticate,
 +    schema: { body: onboardingUpdateSchema },
 +  }, async (request: FastifyRequest) => {
 +    const user = request.user as { userId: string };
 +    const { step, data, completed } = request.body as OnboardingUpdateRequest;
++
 +    await db
 +      .updateTable('user_onboarding')
 +      .set({
 +        completed: completed || false,
 +        data: data ? JSON.stringify(data) : null,
 +        completed_at: completed ? new Date().toISOString() : null,
 +      })
 +      .where('user_id', '=', user.userId)
 +      .where('step', '=', step)
 +      .execute();
++
 +    return { success: true };
 +  });
++
 +  // Get current user info (enhanced)
 +  fastify.get('/auth/me', {
 +    preHandler: fastify.authenticate,
 +  }, async (request: FastifyRequest) => {
 +    const authUser = request.user as { userId: string; sessionId: string };
++
 +    // Get user details
 +    const user = await db
 +      .selectFrom('users')
 +      .selectAll()
 +      .where('id', '=', authUser.userId)
 +      .executeTakeFirstOrThrow();
++
 +    // Update session last access
 +    await db
 +      .updateTable('user_sessions')
 +      .set({ last_access_at: new Date().toISOString() })
 +      .where('id', '=', authUser.sessionId)
 +      .execute();
++
 +    return toPublicUser(user);
 +  });
++
 +  // Enhanced logout (cleanup sessions)
 +  fastify.post('/auth/logout', {
 +    preHandler: fastify.authenticate,
 +  }, async (request: FastifyRequest) => {
 +    const user = request.user as { sessionId: string };
++
 +    // Remove session
 +    await db
 +      .deleteFrom('user_sessions')
 +      .where('id', '=', user.sessionId)
 +      .execute();
++
 +    return { success: true };
 +  });
++
 +  // Logout from all devices
 +  fastify.post('/auth/logout-all', {
 +    preHandler: fastify.authenticate,
 +  }, async (request: FastifyRequest) => {
 +    const user = request.user as { userId: string };
++
 +    // Remove all sessions for user
 +    await db
 +      .deleteFrom('user_sessions')
 +      .where('user_id', '=', user.userId)
 +      .execute();
++
 +    return { success: true };
 +  });
 +}

server/src/routes/oauth.tsadded

 +import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 +import { randomUUID } from 'crypto';
 +import { z } from 'zod';
 +import { getDatabase } from '../database/connection.js';
 +import { EmailService } from '../services/email.js';
 +import type { AuthResponse, PublicUser } from '../database/types.js';
++
 +// OAuth callback schemas
 +const githubCallbackSchema = z.object({
 +  code: z.string().min(1, 'Authorization code required'),
 +  state: z.string().optional(),
 +});
++
 +const userTypeSelectionSchema = z.object({
 +  userType: z.enum(['backup', 'volunteer']),
 +  tempUserId: z.string().uuid(),
 +});
++
 +interface GitHubUser {
 +  id: number;
 +  login: string;
 +  name?: string;
 +  email?: string;
 +  avatar_url?: string;
 +}
++
 +interface GitHubEmail {
 +  email: string;
 +  primary: boolean;
 +  verified: boolean;
 +}
++
 +let emailService: EmailService;
++
 +export async function oauthRoutes(fastify: FastifyInstance) {
 +  const db = getDatabase();
++
 +  // Initialize email service
 +  emailService = new EmailService({
 +    host: process.env.SMTP_HOST || 'smtp.ethereal.email',
 +    port: parseInt(process.env.SMTP_PORT || '587'),
 +    secure: process.env.SMTP_SECURE === 'true',
 +    auth: process.env.SMTP_USER && process.env.SMTP_PASS ? {
 +      user: process.env.SMTP_USER,
 +      pass: process.env.SMTP_PASS,
 +    } : undefined,
 +    from: process.env.SMTP_FROM || 'ZephyrFS <noreply@zephyrfs.org>',
 +  });
++
 +  // Register GitHub OAuth plugin
 +  await fastify.register(import('@fastify/oauth2'), {
 +    name: 'githubOAuth2',
 +    credentials: {
 +      client: {
 +        id: process.env.GITHUB_CLIENT_ID!,
 +        secret: process.env.GITHUB_CLIENT_SECRET!,
 +      },
 +      auth: fastify.oauth2.GITHUB_CONFIGURATION,
 +    },
 +    scope: ['user:email', 'read:user'],
 +    startRedirectPath: '/oauth/github/login',
 +    callbackUri: `${process.env.BACKEND_URL || 'http://localhost:8080'}/oauth/github/callback`,
 +  });
++
 +  // Helper function to create public user object
 +  const toPublicUser = (user: any): PublicUser => ({
 +    id: user.id,
 +    email: user.email,
 +    username: user.username,
 +    userType: user.userType || user.user_type,
 +    emailVerified: user.emailVerified || user.email_verified,
 +    githubUsername: user.githubUsername || user.github_username,
 +    githubAvatarUrl: user.githubAvatarUrl || user.github_avatar_url,
 +    createdAt: new Date(user.createdAt || user.created_at),
 +  });
++
 +  // GitHub OAuth login initiation
 +  fastify.get('/oauth/github/login', async (request: FastifyRequest, reply: FastifyReply) => {
 +    const state = randomUUID();
++
 +    // Store state for verification (in production, use Redis or database)
 +    // For now, we'll include it in the OAuth flow and verify in callback
++
 +    return fastify.githubOAuth2.generateAuthorizationUri(request, reply, {
 +      state,
 +    });
 +  });
++
 +  // GitHub OAuth callback
 +  fastify.get<{
 +    Querystring: z.infer<typeof githubCallbackSchema>;
 +  }>('/oauth/github/callback', async (request: FastifyRequest, reply: FastifyReply) => {
 +    const { code, state } = request.query as z.infer<typeof githubCallbackSchema>;
++
 +    try {
 +      // Exchange code for token
 +      const tokenResponse = await fastify.githubOAuth2.getAccessTokenFromAuthorizationCodeFlow(request);
++
 +      if (!tokenResponse.access_token) {
 +        throw new Error('No access token received');
 +      }
++
 +      // Fetch GitHub user data
 +      const userResponse = await fetch('https://api.github.com/user', {
 +        headers: {
 +          'Authorization': `Bearer ${tokenResponse.access_token}`,
 +          'User-Agent': 'ZephyrFS/1.0',
 +          'Accept': 'application/vnd.github.v3+json',
 +        },
 +      });
++
 +      if (!userResponse.ok) {
 +        throw new Error('Failed to fetch GitHub user data');
 +      }
++
 +      const githubUser: GitHubUser = await userResponse.json();
++
 +      // Fetch GitHub user emails
 +      const emailsResponse = await fetch('https://api.github.com/user/emails', {
 +        headers: {
 +          'Authorization': `Bearer ${tokenResponse.access_token}`,
 +          'User-Agent': 'ZephyrFS/1.0',
 +          'Accept': 'application/vnd.github.v3+json',
 +        },
 +      });
++
 +      let primaryEmail = githubUser.email;
 +      if (emailsResponse.ok) {
 +        const emails: GitHubEmail[] = await emailsResponse.json();
 +        const primary = emails.find(email => email.primary && email.verified);
 +        if (primary) {
 +          primaryEmail = primary.email;
 +        }
 +      }
++
 +      if (!primaryEmail) {
 +        // Redirect to frontend with error
 +        const errorUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/auth/error?error=no_email`;
 +        return reply.redirect(errorUrl);
 +      }
++
 +      // Check if user already exists with this GitHub ID
 +      let existingOAuthAccount = await db
 +        .selectFrom('oauth_accounts')
 +        .selectAll()
 +        .where('provider', '=', 'github')
 +        .where('provider_account_id', '=', githubUser.id.toString())
 +        .executeTakeFirst();
++
 +      let user: any;
 +      let isNewUser = false;
++
 +      if (existingOAuthAccount) {
 +        // User exists, get their account
 +        user = await db
 +          .selectFrom('users')
 +          .selectAll()
 +          .where('id', '=', existingOAuthAccount.user_id)
 +          .executeTakeFirst();
++
 +        if (!user) {
 +          throw new Error('OAuth account exists but user not found');
 +        }
++
 +        // Update OAuth account tokens
 +        await db
 +          .updateTable('oauth_accounts')
 +          .set({
 +            access_token: tokenResponse.access_token,
 +            refresh_token: tokenResponse.refresh_token || null,
 +            expires_at: tokenResponse.expires_in
 +              ? new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
 +              : null,
 +            updated_at: new Date().toISOString(),
 +          })
 +          .where('id', '=', existingOAuthAccount.id)
 +          .execute();
++
 +        // Update user's GitHub info
 +        await db
 +          .updateTable('users')
 +          .set({
 +            github_username: githubUser.login,
 +            github_avatar_url: githubUser.avatar_url,
 +            last_login_at: new Date().toISOString(),
 +            updated_at: new Date().toISOString(),
 +          })
 +          .where('id', '=', user.id)
 +          .execute();
++
 +      } else {
 +        // Check if user exists with the email
 +        user = await db
 +          .selectFrom('users')
 +          .selectAll()
 +          .where('email', '=', primaryEmail)
 +          .executeTakeFirst();
++
 +        if (user) {
 +          // Link GitHub to existing account
 +          await db
 +            .insertInto('oauth_accounts')
 +            .values({
 +              id: randomUUID(),
 +              user_id: user.id,
 +              provider: 'github',
 +              provider_account_id: githubUser.id.toString(),
 +              access_token: tokenResponse.access_token,
 +              refresh_token: tokenResponse.refresh_token || null,
 +              expires_at: tokenResponse.expires_in
 +                ? new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
 +                : null,
 +              token_type: tokenResponse.token_type || 'bearer',
 +              scope: Array.isArray(tokenResponse.scope)
 +                ? tokenResponse.scope.join(' ')
 +                : tokenResponse.scope || 'user:email read:user',
 +              created_at: new Date().toISOString(),
 +              updated_at: new Date().toISOString(),
 +            })
 +            .execute();
++
 +          // Update user's GitHub info
 +          await db
 +            .updateTable('users')
 +            .set({
 +              github_id: githubUser.id.toString(),
 +              github_username: githubUser.login,
 +              github_avatar_url: githubUser.avatar_url,
 +              last_login_at: new Date().toISOString(),
 +              updated_at: new Date().toISOString(),
 +            })
 +            .where('id', '=', user.id)
 +            .execute();
++
 +        } else {
 +          // New user - create temporary user and redirect to user type selection
 +          isNewUser = true;
 +          const tempUserId = randomUUID();
++
 +          // Store temporary user data in database for user type selection
 +          user = await db
 +            .insertInto('users')
 +            .values({
 +              id: tempUserId,
 +              email: primaryEmail,
 +              username: githubUser.login,
 +              user_type: 'backup', // Temporary, will be updated after type selection
 +              email_verified: true, // GitHub email is considered verified
 +              github_id: githubUser.id.toString(),
 +              github_username: githubUser.login,
 +              github_avatar_url: githubUser.avatar_url,
 +              created_at: new Date().toISOString(),
 +              updated_at: new Date().toISOString(),
 +              profile_data: JSON.stringify({
 +                temp: true,
 +                githubName: githubUser.name,
 +                needsUserTypeSelection: true,
 +              }),
 +            })
 +            .returningAll()
 +            .executeTakeFirstOrThrow();
++
 +          // Create OAuth account
 +          await db
 +            .insertInto('oauth_accounts')
 +            .values({
 +              id: randomUUID(),
 +              user_id: tempUserId,
 +              provider: 'github',
 +              provider_account_id: githubUser.id.toString(),
 +              access_token: tokenResponse.access_token,
 +              refresh_token: tokenResponse.refresh_token || null,
 +              expires_at: tokenResponse.expires_in
 +                ? new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
 +                : null,
 +              token_type: tokenResponse.token_type || 'bearer',
 +              scope: Array.isArray(tokenResponse.scope)
 +                ? tokenResponse.scope.join(' ')
 +                : tokenResponse.scope || 'user:email read:user',
 +              created_at: new Date().toISOString(),
 +              updated_at: new Date().toISOString(),
 +            })
 +            .execute();
++
 +          // Redirect to user type selection
 +          const userTypeUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/auth/select-type?temp_user=${tempUserId}&github=true`;
 +          return reply.redirect(userTypeUrl);
 +        }
 +      }
++
 +      // Create session for existing user
 +      const sessionId = randomUUID();
 +      const sessionToken = randomUUID();
 +      const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // 30 days
++
 +      await db
 +        .insertInto('user_sessions')
 +        .values({
 +          id: sessionId,
 +          user_id: user.id,
 +          session_token: sessionToken,
 +          expires_at: expiresAt.toISOString(),
 +          created_at: new Date().toISOString(),
 +          last_access_at: new Date().toISOString(),
 +          ip_address: request.ip,
 +          user_agent: request.headers['user-agent'],
 +        })
 +        .execute();
++
 +      // Generate tokens
 +      const accessToken = fastify.jwt.sign(
 +        { userId: user.id, username: user.username, sessionId },
 +        { expiresIn: fastify.config.jwtExpiresIn }
 +      );
++
 +      // Redirect to frontend with token
 +      const successUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/auth/success?token=${accessToken}&new_user=${isNewUser}`;
 +      return reply.redirect(successUrl);
++
 +    } catch (error) {
 +      fastify.log.error(error, 'GitHub OAuth callback failed');
 +      const errorUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/auth/error?error=oauth_failed`;
 +      return reply.redirect(errorUrl);
 +    }
 +  });
++
 +  // Complete user type selection for GitHub OAuth users
 +  fastify.post<{
 +    Body: z.infer<typeof userTypeSelectionSchema>;
 +  }>('/oauth/github/complete-registration', {
 +    schema: { body: userTypeSelectionSchema },
 +  }, async (request: FastifyRequest, reply: FastifyReply) => {
 +    const { userType, tempUserId } = request.body as z.infer<typeof userTypeSelectionSchema>;
++
 +    try {
 +      // Get temporary user
 +      const tempUser = await db
 +        .selectFrom('users')
 +        .selectAll()
 +        .where('id', '=', tempUserId)
 +        .executeTakeFirst();
++
 +      if (!tempUser) {
 +        throw fastify.httpErrors.notFound('Temporary user not found');
 +      }
++
 +      const profileData = tempUser.profile_data ? JSON.parse(tempUser.profile_data) : {};
 +      if (!profileData.temp || !profileData.needsUserTypeSelection) {
 +        throw fastify.httpErrors.badRequest('User registration already completed');
 +      }
++
 +      // Update user with selected type
 +      const user = await db
 +        .updateTable('users')
 +        .set({
 +          user_type: userType,
 +          profile_data: JSON.stringify({
 +            ...profileData,
 +            temp: false,
 +            needsUserTypeSelection: false,
 +          }),
 +          updated_at: new Date().toISOString(),
 +        })
 +        .where('id', '=', tempUserId)
 +        .returningAll()
 +        .executeTakeFirstOrThrow();
++
 +      // Initialize onboarding steps
 +      const onboardingSteps = userType === 'volunteer'
 +        ? ['user-type-selection', 'storage-setup', 'desktop-app', 'node-configuration']
 +        : ['user-type-selection', 'backup-setup', 'first-upload'];
++
 +      for (const step of onboardingSteps) {
 +        await db
 +          .insertInto('user_onboarding')
 +          .values({
 +            id: randomUUID(),
 +            user_id: user.id,
 +            step,
 +            completed: step === 'user-type-selection',
 +            data: step === 'user-type-selection' ? JSON.stringify({ userType }) : null,
 +            completed_at: step === 'user-type-selection' ? new Date().toISOString() : null,
 +            created_at: new Date().toISOString(),
 +          })
 +          .execute();
 +      }
++
 +      // Send welcome email
 +      try {
 +        await emailService.sendWelcomeEmail(user.email, userType, user.username || undefined);
 +      } catch (emailError) {
 +        fastify.log.error(emailError, 'Failed to send welcome email');
 +      }
++
 +      // Create session
 +      const sessionId = randomUUID();
 +      const sessionToken = randomUUID();
 +      const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
++
 +      await db
 +        .insertInto('user_sessions')
 +        .values({
 +          id: sessionId,
 +          user_id: user.id,
 +          session_token: sessionToken,
 +          expires_at: expiresAt.toISOString(),
 +          created_at: new Date().toISOString(),
 +          last_access_at: new Date().toISOString(),
 +          ip_address: request.ip,
 +          user_agent: request.headers['user-agent'],
 +        })
 +        .execute();
++
 +      // Generate tokens
 +      const accessToken = fastify.jwt.sign(
 +        { userId: user.id, username: user.username, sessionId },
 +        { expiresIn: fastify.config.jwtExpiresIn }
 +      );
++
 +      const refreshToken = fastify.jwt.sign(
 +        { userId: user.id, sessionId, type: 'refresh' },
 +        { expiresIn: fastify.config.jwtRefreshExpiresIn }
 +      );
++
 +      const response: AuthResponse = {
 +        token: accessToken,
 +        refreshToken,
 +        expiresIn: 24 * 60 * 60,
 +        user: toPublicUser(user),
 +      };
++
 +      return {
 +        success: true,
 +        message: 'Registration completed successfully! Welcome to ZephyrFS!',
 +        auth: response,
 +      };
++
 +    } catch (error) {
 +      if (error.statusCode) {
 +        throw error;
 +      }
 +      fastify.log.error(error, 'GitHub OAuth registration completion failed');
 +      throw fastify.httpErrors.internalServerError('Registration completion failed');
 +    }
 +  });
++
 +  // Link GitHub account to existing user
 +  fastify.post('/oauth/github/link', {
 +    preHandler: fastify.authenticate,
 +  }, async (request: FastifyRequest, reply: FastifyReply) => {
 +    const user = request.user as { userId: string };
++
 +    // Check if GitHub account already linked
 +    const existingLink = await db
 +      .selectFrom('oauth_accounts')
 +      .selectAll()
 +      .where('user_id', '=', user.userId)
 +      .where('provider', '=', 'github')
 +      .executeTakeFirst();
++
 +    if (existingLink) {
 +      throw fastify.httpErrors.conflict('GitHub account already linked to this user');
 +    }
++
 +    // Generate state for OAuth flow
 +    const state = `link_${user.userId}_${randomUUID()}`;
++
 +    return fastify.githubOAuth2.generateAuthorizationUri(request, reply, {
 +      state,
 +    });
 +  });
++
 +  // Unlink GitHub account
 +  fastify.delete('/oauth/github/unlink', {
 +    preHandler: fastify.authenticate,
 +  }, async (request: FastifyRequest) => {
 +    const user = request.user as { userId: string };
++
 +    // Remove OAuth account
 +    await db
 +      .deleteFrom('oauth_accounts')
 +      .where('user_id', '=', user.userId)
 +      .where('provider', '=', 'github')
 +      .execute();
++
 +    // Clear GitHub info from user
 +    await db
 +      .updateTable('users')
 +      .set({
 +        github_id: null,
 +        github_username: null,
 +        github_avatar_url: null,
 +        updated_at: new Date().toISOString(),
 +      })
 +      .where('id', '=', user.userId)
 +      .execute();
++
 +    return { success: true, message: 'GitHub account unlinked successfully' };
 +  });
 +}

server/src/services/email.tsadded

 +import nodemailer from 'nodemailer';
 +import type { Transporter } from 'nodemailer';
++
 +export interface EmailConfig {
 +  host: string;
 +  port: number;
 +  secure: boolean;
 +  auth?: {
 +    user: string;
 +    pass: string;
 +  };
 +  from: string;
 +}
++
 +export class EmailService {
 +  private transporter: Transporter;
 +  private config: EmailConfig;
++
 +  constructor(config: EmailConfig) {
 +    this.config = config;
++
 +    // For development, use Ethereal Email (fake SMTP service)
 +    if (process.env.NODE_ENV === 'development' && !config.auth) {
 +      // This will be setup asynchronously
 +      this.setupDevelopmentTransporter();
 +    } else {
 +      this.transporter = nodemailer.createTransporter({
 +        host: config.host,
 +        port: config.port,
 +        secure: config.secure,
 +        auth: config.auth,
 +      });
 +    }
 +  }
++
 +  private async setupDevelopmentTransporter() {
 +    try {
 +      // Create Ethereal Email account for development
 +      const testAccount = await nodemailer.createTestAccount();
++
 +      this.transporter = nodemailer.createTransporter({
 +        host: 'smtp.ethereal.email',
 +        port: 587,
 +        secure: false,
 +        auth: {
 +          user: testAccount.user,
 +          pass: testAccount.pass,
 +        },
 +      });
++
 +      console.log('Development email transporter created with Ethereal Email');
 +      console.log('Preview URLs will be logged when emails are sent');
 +    } catch (error) {
 +      console.error('Failed to create development email transporter:', error);
 +      // Fallback to console logging
 +      this.transporter = {
 +        sendMail: async (options: any) => {
 +          console.log('Email would be sent:', options);
 +          return { messageId: 'dev-' + Date.now() };
 +        },
 +      } as any;
 +    }
 +  }
++
 +  async sendEmailVerification(to: string, token: string, username?: string): Promise<void> {
 +    const verificationUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/verify-email?token=${token}`;
++
 +    const html = `
 +      <!DOCTYPE html>
 +      <html>
 +        <head>
 +          <meta charset="utf-8">
 +          <title>Verify your ZephyrFS account</title>
 +          <style>
 +            body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
 +            .container { max-width: 600px; margin: 0 auto; padding: 20px; }
 +            .header { background: #007bff; color: white; padding: 20px; text-align: center; }
 +            .content { padding: 30px; background: #f9f9f9; }
 +            .button {
 +              display: inline-block;
 +              background: #007bff;
 +              color: white;
 +              padding: 12px 30px;
 +              text-decoration: none;
 +              border-radius: 5px;
 +              margin: 20px 0;
 +            }
 +            .footer { padding: 20px; text-align: center; color: #666; font-size: 14px; }
 +          </style>
 +        </head>
 +        <body>
 +          <div class="container">
 +            <div class="header">
 +              <h1>Welcome to ZephyrFS!</h1>
 +            </div>
 +            <div class="content">
 +              <h2>Verify Your Email Address</h2>
 +              <p>Hello${username ? ` ${username}` : ''}!</p>
 +              <p>Thank you for signing up for ZephyrFS, the secure and decentralized file backup system.</p>
 +              <p>To complete your registration and start using ZephyrFS, please verify your email address by clicking the button below:</p>
++
 +              <div style="text-align: center;">
 +                <a href="${verificationUrl}" class="button">Verify Email Address</a>
 +              </div>
++
 +              <p>Or copy and paste this link into your browser:</p>
 +              <p style="word-break: break-all; background: #eee; padding: 10px; border-radius: 3px;">
 +                ${verificationUrl}
 +              </p>
++
 +              <p><strong>This verification link will expire in 24 hours.</strong></p>
++
 +              <p>If you didn't create an account with ZephyrFS, you can safely ignore this email.</p>
 +            </div>
 +            <div class="footer">
 +              <p>© 2024 ZephyrFS. All rights reserved.</p>
 +              <p>Secure, decentralized file backup for everyone.</p>
 +            </div>
 +          </div>
 +        </body>
 +      </html>
 +    `;
++
 +    const text = `
 +      Welcome to ZephyrFS!
++
 +      Hello${username ? ` ${username}` : ''}!
++
 +      Thank you for signing up for ZephyrFS, the secure and decentralized file backup system.
++
 +      To complete your registration and start using ZephyrFS, please verify your email address by visiting this link:
++
 +      ${verificationUrl}
++
 +      This verification link will expire in 24 hours.
++
 +      If you didn't create an account with ZephyrFS, you can safely ignore this email.
++
 +      © 2024 ZephyrFS. All rights reserved.
 +    `;
++
 +    const result = await this.transporter.sendMail({
 +      from: this.config.from || 'ZephyrFS <noreply@zephyrfs.org>',
 +      to,
 +      subject: 'Verify your ZephyrFS account',
 +      text,
 +      html,
 +    });
++
 +    // In development, log preview URL
 +    if (process.env.NODE_ENV === 'development') {
 +      const previewUrl = nodemailer.getTestMessageUrl(result);
 +      if (previewUrl) {
 +        console.log('Email verification preview:', previewUrl);
 +      }
 +    }
 +  }
++
 +  async sendPasswordReset(to: string, token: string, username?: string): Promise<void> {
 +    const resetUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/reset-password?token=${token}`;
++
 +    const html = `
 +      <!DOCTYPE html>
 +      <html>
 +        <head>
 +          <meta charset="utf-8">
 +          <title>Reset your ZephyrFS password</title>
 +          <style>
 +            body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
 +            .container { max-width: 600px; margin: 0 auto; padding: 20px; }
 +            .header { background: #dc3545; color: white; padding: 20px; text-align: center; }
 +            .content { padding: 30px; background: #f9f9f9; }
 +            .button {
 +              display: inline-block;
 +              background: #dc3545;
 +              color: white;
 +              padding: 12px 30px;
 +              text-decoration: none;
 +              border-radius: 5px;
 +              margin: 20px 0;
 +            }
 +            .footer { padding: 20px; text-align: center; color: #666; font-size: 14px; }
 +            .warning { background: #fff3cd; border: 1px solid #ffeaa7; padding: 15px; border-radius: 5px; margin: 20px 0; }
 +          </style>
 +        </head>
 +        <body>
 +          <div class="container">
 +            <div class="header">
 +              <h1>Password Reset Request</h1>
 +            </div>
 +            <div class="content">
 +              <h2>Reset Your Password</h2>
 +              <p>Hello${username ? ` ${username}` : ''}!</p>
 +              <p>We received a request to reset the password for your ZephyrFS account.</p>
++
 +              <div class="warning">
 +                <strong>⚠️ Security Notice:</strong> If you didn't request this password reset, please ignore this email. Your account is safe.
 +              </div>
++
 +              <p>To reset your password, click the button below:</p>
++
 +              <div style="text-align: center;">
 +                <a href="${resetUrl}" class="button">Reset Password</a>
 +              </div>
++
 +              <p>Or copy and paste this link into your browser:</p>
 +              <p style="word-break: break-all; background: #eee; padding: 10px; border-radius: 3px;">
 +                ${resetUrl}
 +              </p>
++
 +              <p><strong>This reset link will expire in 1 hour.</strong></p>
++
 +              <p>After clicking the link, you'll be able to create a new password for your account.</p>
 +            </div>
 +            <div class="footer">
 +              <p>© 2024 ZephyrFS. All rights reserved.</p>
 +              <p>If you have security concerns, contact us immediately.</p>
 +            </div>
 +          </div>
 +        </body>
 +      </html>
 +    `;
++
 +    const text = `
 +      Password Reset Request
++
 +      Hello${username ? ` ${username}` : ''}!
++
 +      We received a request to reset the password for your ZephyrFS account.
++
 +      If you didn't request this password reset, please ignore this email. Your account is safe.
++
 +      To reset your password, visit this link:
++
 +      ${resetUrl}
++
 +      This reset link will expire in 1 hour.
++
 +      After clicking the link, you'll be able to create a new password for your account.
++
 +      © 2024 ZephyrFS. All rights reserved.
 +    `;
++
 +    const result = await this.transporter.sendMail({
 +      from: this.config.from || 'ZephyrFS Security <security@zephyrfs.org>',
 +      to,
 +      subject: 'Reset your ZephyrFS password',
 +      text,
 +      html,
 +    });
++
 +    // In development, log preview URL
 +    if (process.env.NODE_ENV === 'development') {
 +      const previewUrl = nodemailer.getTestMessageUrl(result);
 +      if (previewUrl) {
 +        console.log('Password reset preview:', previewUrl);
 +      }
 +    }
 +  }
++
 +  async sendWelcomeEmail(to: string, userType: 'backup' | 'volunteer', username?: string): Promise<void> {
 +    const isVolunteer = userType === 'volunteer';
 +    const dashboardUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/dashboard`;
++
 +    const html = `
 +      <!DOCTYPE html>
 +      <html>
 +        <head>
 +          <meta charset="utf-8">
 +          <title>Welcome to ZephyrFS!</title>
 +          <style>
 +            body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
 +            .container { max-width: 600px; margin: 0 auto; padding: 20px; }
 +            .header { background: #28a745; color: white; padding: 20px; text-align: center; }
 +            .content { padding: 30px; background: #f9f9f9; }
 +            .button {
 +              display: inline-block;
 +              background: #28a745;
 +              color: white;
 +              padding: 12px 30px;
 +              text-decoration: none;
 +              border-radius: 5px;
 +              margin: 20px 0;
 +            }
 +            .footer { padding: 20px; text-align: center; color: #666; font-size: 14px; }
 +            .feature { background: white; padding: 15px; margin: 10px 0; border-left: 4px solid #28a745; }
 +          </style>
 +        </head>
 +        <body>
 +          <div class="container">
 +            <div class="header">
 +              <h1>🎉 Welcome to ZephyrFS!</h1>
 +            </div>
 +            <div class="content">
 +              <h2>Your account is ready!</h2>
 +              <p>Hello${username ? ` ${username}` : ''}!</p>
 +              <p>Welcome to ZephyrFS! Your email has been verified and your account is now active.</p>
++
 +              ${isVolunteer ? `
 +                <h3>🤝 Thank you for volunteering!</h3>
 +                <p>As a storage volunteer, you're helping build a decentralized, secure backup network that benefits everyone.</p>
++
 +                <div class="feature">
 +                  <strong>📁 Safe Storage Allocation</strong><br>
 +                  Choose how much disk space to contribute safely without risking your system.
 +                </div>
++
 +                <div class="feature">
 +                  <strong>🔒 Zero-Knowledge Security</strong><br>
 +                  All stored data is encrypted - you can't see what's stored on your system.
 +                </div>
++
 +                <div class="feature">
 +                  <strong>💰 Earn Rewards</strong><br>
 +                  Get compensated for providing reliable storage to the network.
 +                </div>
++
 +                <p>Ready to get started? Use our desktop app to set up your storage node:</p>
 +              ` : `
 +                <h3>☁️ Secure Backup Made Simple</h3>
 +                <p>Your files will be encrypted, distributed, and safely backed up across our decentralized network.</p>
++
 +                <div class="feature">
 +                  <strong>🔐 Military-Grade Encryption</strong><br>
 +                  Your files are encrypted before leaving your device.
 +                </div>
++
 +                <div class="feature">
 +                  <strong>🌐 Distributed Storage</strong><br>
 +                  Files are split and stored across multiple secure nodes.
 +                </div>
++
 +                <div class="feature">
 +                  <strong>⚡ Simple as Google Drive</strong><br>
 +                  Drag and drop to backup. That's it!
 +                </div>
++
 +                <p>Ready to start backing up your files?</p>
 +              `}
++
 +              <div style="text-align: center;">
 +                <a href="${dashboardUrl}" class="button">Get Started</a>
 +              </div>
++
 +              <p>If you have any questions or need help getting started, our community is here to support you!</p>
 +            </div>
 +            <div class="footer">
 +              <p>© 2024 ZephyrFS. All rights reserved.</p>
 +              <p>Building the future of secure, decentralized storage.</p>
 +            </div>
 +          </div>
 +        </body>
 +      </html>
 +    `;
++
 +    const result = await this.transporter.sendMail({
 +      from: this.config.from || 'ZephyrFS <welcome@zephyrfs.org>',
 +      to,
 +      subject: '🎉 Welcome to ZephyrFS - Your account is ready!',
 +      html,
 +    });
++
 +    // In development, log preview URL
 +    if (process.env.NODE_ENV === 'development') {
 +      const previewUrl = nodemailer.getTestMessageUrl(result);
 +      if (previewUrl) {
 +        console.log('Welcome email preview:', previewUrl);
 +      }
 +    }
 +  }
 +}