`095d099`

4.2 authentication system with email & OAuth

Authored by mfwolffe <wolffemf@dukes.jmu.edu> 8 months ago

SHA: 095d099187a428bd3ccbbea9a51bb1f592353f8d
Parents: cd963ec
Tree: 20d3390

7 changed files

Status	File	+	-
M	`server/package.json`	8	1
A	`server/src/database/connection.ts`	112	0
A	`server/src/database/schema.sql`	131	0
A	`server/src/database/types.ts`	138	0
A	`server/src/routes/auth-v2.ts`	613	0
A	`server/src/routes/oauth.ts`	500	0
A	`server/src/services/email.ts`	371	0

server/package.jsonmodified

      "@fastify/multipart": "^8.0.0",
      "@fastify/static": "^6.12.0",
      "@fastify/websocket": "^8.3.1",
++    "@fastify/oauth2": "^7.8.0",
      "webdav": "^5.3.0",
      "ws": "^8.14.2",
      "zod": "^3.22.4",
--    "archiver": "^6.0.1"
++    "archiver": "^6.0.1",
++    "bcrypt": "^5.1.1",
++    "nodemailer": "^6.9.7",
++    "sqlite3": "^5.1.6",
++    "kysely": "^0.27.2"
    },
    "devDependencies": {
      "@types/node": "^20.8.10",
      "@types/ws": "^8.5.8",
      "@types/archiver": "^6.0.2",
++    "@types/bcrypt": "^5.0.2",
++    "@types/nodemailer": "^6.4.14",
      "@typescript-eslint/eslint-plugin": "^6.9.1",
      "@typescript-eslint/parser": "^6.9.1",
      "eslint": "^8.52.0",

server/src/database/connection.tsadded

++import { Kysely, SqliteDialect } from 'kysely';
++import SQLite from 'sqlite3';
++import { readFileSync } from 'fs';
++import { join } from 'path';
++import type { Database } from './types.js';
++
++let db: Kysely<Database> | null = null;
++
++export function initializeDatabase(dbPath?: string): Kysely<Database> {
++  if (db) {
++    return db;
++  }
++
++  const databasePath = dbPath || process.env.DATABASE_PATH || ':memory:';
++
++  const dialect = new SqliteDialect({
++    database: new SQLite.Database(databasePath),
++  });
++
++  db = new Kysely<Database>({
++    dialect,
++  });
++
++  return db;
++}
++
++export async function setupDatabase(): Promise<void> {
++  const database = getDatabase();
++
++  // Read and execute schema
++  const schemaPath = join(new URL(import.meta.url).pathname, '../schema.sql');
++  const schema = readFileSync(schemaPath, 'utf-8');
++
++  // Split and execute each statement
++  const statements = schema
++    .split(';')
++    .map(stmt => stmt.trim())
++    .filter(stmt => stmt.length > 0);
++
++  for (const statement of statements) {
++    try {
++      await database.executeQuery({
++        sql: statement,
++        parameters: [],
++      });
++    } catch (error) {
++      // Ignore table already exists errors
++      if (!error.message?.includes('already exists')) {
++        console.error('Database setup error:', error);
++        throw error;
++      }
++    }
++  }
++}
++
++export function getDatabase(): Kysely<Database> {
++  if (!db) {
++    throw new Error('Database not initialized. Call initializeDatabase() first.');
++  }
++  return db;
++}
++
++export async function closeDatabase(): Promise<void> {
++  if (db) {
++    await db.destroy();
++    db = null;
++  }
++}
++
++// Helper function to convert snake_case to camelCase for database rows
++export function toCamelCase<T>(obj: any): T {
++  if (obj === null || obj === undefined) {
++    return obj;
++  }
++
++  if (Array.isArray(obj)) {
++    return obj.map(toCamelCase) as T;
++  }
++
++  if (typeof obj === 'object' && obj.constructor === Object) {
++    const result: any = {};
++    for (const [key, value] of Object.entries(obj)) {
++      const camelKey = key.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
++      result[camelKey] = toCamelCase(value);
++    }
++    return result;
++  }
++
++  return obj;
++}
++
++// Helper function to convert camelCase to snake_case for database queries
++export function toSnakeCase<T>(obj: any): T {
++  if (obj === null || obj === undefined) {
++    return obj;
++  }
++
++  if (Array.isArray(obj)) {
++    return obj.map(toSnakeCase) as T;
++  }
++
++  if (typeof obj === 'object' && obj.constructor === Object) {
++    const result: any = {};
++    for (const [key, value] of Object.entries(obj)) {
++      const snakeKey = key.replace(/[A-Z]/g, letter => `_${letter.toLowerCase()}`);
++      result[snakeKey] = toSnakeCase(value);
++    }
++    return result;
++  }
++
++  return obj;
++}

server/src/database/schema.sqladded

++-- ZephyrFS Authentication Database Schema
++
++-- Users table with email registration and OAuth support
++CREATE TABLE users (
++    id TEXT PRIMARY KEY,
++    email TEXT UNIQUE NOT NULL,
++    username TEXT UNIQUE,
++    password_hash TEXT,
++    user_type TEXT CHECK (user_type IN ('backup', 'volunteer', 'admin')) NOT NULL DEFAULT 'backup',
++    email_verified BOOLEAN DEFAULT FALSE,
++    email_verification_token TEXT,
++    email_verification_expires_at DATETIME,
++    password_reset_token TEXT,
++    password_reset_expires_at DATETIME,
++    github_id TEXT UNIQUE,
++    github_username TEXT,
++    github_avatar_url TEXT,
++    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    last_login_at DATETIME,
++    profile_data TEXT -- JSON storage for additional profile info
++);
++
++-- OAuth accounts table for multiple providers
++CREATE TABLE oauth_accounts (
++    id TEXT PRIMARY KEY,
++    user_id TEXT NOT NULL,
++    provider TEXT NOT NULL,
++    provider_account_id TEXT NOT NULL,
++    access_token TEXT,
++    refresh_token TEXT,
++    expires_at DATETIME,
++    token_type TEXT,
++    scope TEXT,
++    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE,
++    UNIQUE(provider, provider_account_id)
++);
++
++-- User sessions table
++CREATE TABLE user_sessions (
++    id TEXT PRIMARY KEY,
++    user_id TEXT NOT NULL,
++    session_token TEXT UNIQUE NOT NULL,
++    expires_at DATETIME NOT NULL,
++    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    last_access_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    ip_address TEXT,
++    user_agent TEXT,
++    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
++);
++
++-- Email verification attempts tracking
++CREATE TABLE email_verifications (
++    id TEXT PRIMARY KEY,
++    user_id TEXT NOT NULL,
++    email TEXT NOT NULL,
++    token TEXT NOT NULL,
++    attempts INTEGER DEFAULT 0,
++    verified_at DATETIME,
++    expires_at DATETIME NOT NULL,
++    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
++);
++
++-- Password reset attempts tracking
++CREATE TABLE password_resets (
++    id TEXT PRIMARY KEY,
++    user_id TEXT NOT NULL,
++    token TEXT NOT NULL,
++    attempts INTEGER DEFAULT 0,
++    used_at DATETIME,
++    expires_at DATETIME NOT NULL,
++    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
++);
++
++-- User onboarding progress tracking
++CREATE TABLE user_onboarding (
++    id TEXT PRIMARY KEY,
++    user_id TEXT NOT NULL,
++    step TEXT NOT NULL,
++    completed BOOLEAN DEFAULT FALSE,
++    data TEXT, -- JSON storage for step-specific data
++    completed_at DATETIME,
++    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
++    FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
++);
++
++-- Indexes for performance
++CREATE INDEX idx_users_email ON users (email);
++CREATE INDEX idx_users_username ON users (username);
++CREATE INDEX idx_users_github_id ON oauth_accounts (provider_account_id);
++CREATE INDEX idx_sessions_token ON user_sessions (session_token);
++CREATE INDEX idx_sessions_user_id ON user_sessions (user_id);
++CREATE INDEX idx_email_verifications_token ON email_verifications (token);
++CREATE INDEX idx_password_resets_token ON password_resets (token);
++
++-- Insert default admin user
++INSERT INTO users (
++    id,
++    email,
++    username,
++    password_hash,
++    user_type,
++    email_verified
++) VALUES (
++    'admin',
++    'admin@zephyrfs.org',
++    'admin',
++    '$2b$10$rKGHZ0aB0qKhP0DqW8qZHu2wF2nF.FqD3tYw1pV6gB2wZ8vY0gG4u', -- 'admin' hashed
++    'admin',
++    TRUE
++);
++
++INSERT INTO users (
++    id,
++    email,
++    username,
++    password_hash,
++    user_type,
++    email_verified
++) VALUES (
++    'demo',
++    'demo@zephyrfs.org',
++    'demo',
++    '$2b$10$rKGHZ0aB0qKhP0DqW8qZHu2wF2nF.FqD3tYw1pV6gB2wZ8vY0gG4u', -- 'demo' hashed
++    'backup',
++    TRUE
++);

server/src/database/types.tsadded

++// Database types for ZephyrFS authentication system
++
++export interface User {
++  id: string;
++  email: string;
++  username?: string;
++  passwordHash?: string;
++  userType: 'backup' | 'volunteer' | 'admin';
++  emailVerified: boolean;
++  emailVerificationToken?: string;
++  emailVerificationExpiresAt?: Date;
++  passwordResetToken?: string;
++  passwordResetExpiresAt?: Date;
++  githubId?: string;
++  githubUsername?: string;
++  githubAvatarUrl?: string;
++  createdAt: Date;
++  updatedAt: Date;
++  lastLoginAt?: Date;
++  profileData?: string; // JSON storage
++}
++
++export interface OAuthAccount {
++  id: string;
++  userId: string;
++  provider: string;
++  providerAccountId: string;
++  accessToken?: string;
++  refreshToken?: string;
++  expiresAt?: Date;
++  tokenType?: string;
++  scope?: string;
++  createdAt: Date;
++  updatedAt: Date;
++}
++
++export interface UserSession {
++  id: string;
++  userId: string;
++  sessionToken: string;
++  expiresAt: Date;
++  createdAt: Date;
++  lastAccessAt: Date;
++  ipAddress?: string;
++  userAgent?: string;
++}
++
++export interface EmailVerification {
++  id: string;
++  userId: string;
++  email: string;
++  token: string;
++  attempts: number;
++  verifiedAt?: Date;
++  expiresAt: Date;
++  createdAt: Date;
++}
++
++export interface PasswordReset {
++  id: string;
++  userId: string;
++  token: string;
++  attempts: number;
++  usedAt?: Date;
++  expiresAt: Date;
++  createdAt: Date;
++}
++
++export interface UserOnboarding {
++  id: string;
++  userId: string;
++  step: string;
++  completed: boolean;
++  data?: string; // JSON storage
++  completedAt?: Date;
++  createdAt: Date;
++}
++
++export interface Database {
++  users: User;
++  oauth_accounts: OAuthAccount;
++  user_sessions: UserSession;
++  email_verifications: EmailVerification;
++  password_resets: PasswordReset;
++  user_onboarding: UserOnboarding;
++}
++
++// API types for requests/responses
++export interface RegisterRequest {
++  email: string;
++  username?: string;
++  password: string;
++  userType: 'backup' | 'volunteer';
++}
++
++export interface LoginRequest {
++  email?: string;
++  username?: string;
++  password?: string;
++  token?: string;
++}
++
++export interface AuthResponse {
++  token: string;
++  refreshToken: string;
++  expiresIn: number;
++  user: PublicUser;
++}
++
++export interface PublicUser {
++  id: string;
++  email: string;
++  username?: string;
++  userType: 'backup' | 'volunteer' | 'admin';
++  emailVerified: boolean;
++  githubUsername?: string;
++  githubAvatarUrl?: string;
++  createdAt: Date;
++}
++
++export interface EmailVerificationRequest {
++  token: string;
++}
++
++export interface PasswordResetRequest {
++  email: string;
++}
++
++export interface PasswordResetConfirmRequest {
++  token: string;
++  newPassword: string;
++}
++
++export interface OnboardingUpdateRequest {
++  step: string;
++  data?: Record<string, any>;
++  completed?: boolean;
++}

server/src/routes/auth-v2.tsadded

++import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
++import bcrypt from 'bcrypt';
++import { z } from 'zod';
++import { randomBytes, randomUUID } from 'crypto';
++import { getDatabase, toCamelCase } from '../database/connection.js';
++import { EmailService } from '../services/email.js';
++import type {
++  RegisterRequest,
++  LoginRequest,
++  AuthResponse,
++  PublicUser,
++  EmailVerificationRequest,
++  PasswordResetRequest,
++  PasswordResetConfirmRequest,
++  OnboardingUpdateRequest,
++} from '../database/types.js';
++
++// Validation schemas
++const registerSchema = z.object({
++  email: z.string().email('Invalid email address'),
++  username: z.string().min(3).max(30).optional(),
++  password: z.string().min(8, 'Password must be at least 8 characters'),
++  userType: z.enum(['backup', 'volunteer'], {
++    required_error: 'Please select whether you want to backup files or volunteer storage',
++  }),
++});
++
++const loginSchema = z.object({
++  email: z.string().email().optional(),
++  username: z.string().optional(),
++  password: z.string().optional(),
++  token: z.string().optional(),
++}).refine(
++  (data) => (data.email || data.username) && data.password || data.token,
++  'Email/username and password, or token required'
++);
++
++const emailVerificationSchema = z.object({
++  token: z.string().min(1, 'Verification token required'),
++});
++
++const passwordResetSchema = z.object({
++  email: z.string().email('Invalid email address'),
++});
++
++const passwordResetConfirmSchema = z.object({
++  token: z.string().min(1, 'Reset token required'),
++  newPassword: z.string().min(8, 'Password must be at least 8 characters'),
++});
++
++const onboardingUpdateSchema = z.object({
++  step: z.string().min(1),
++  data: z.record(z.any()).optional(),
++  completed: z.boolean().optional(),
++});
++
++let emailService: EmailService;
++
++export async function authV2Routes(fastify: FastifyInstance) {
++  const db = getDatabase();
++
++  // Initialize email service
++  emailService = new EmailService({
++    host: process.env.SMTP_HOST || 'smtp.ethereal.email',
++    port: parseInt(process.env.SMTP_PORT || '587'),
++    secure: process.env.SMTP_SECURE === 'true',
++    auth: process.env.SMTP_USER && process.env.SMTP_PASS ? {
++      user: process.env.SMTP_USER,
++      pass: process.env.SMTP_PASS,
++    } : undefined,
++    from: process.env.SMTP_FROM || 'ZephyrFS <noreply@zephyrfs.org>',
++  });
++
++  // Helper function to create public user object
++  const toPublicUser = (user: any): PublicUser => ({
++    id: user.id,
++    email: user.email,
++    username: user.username,
++    userType: user.userType || user.user_type,
++    emailVerified: user.emailVerified || user.email_verified,
++    githubUsername: user.githubUsername || user.github_username,
++    githubAvatarUrl: user.githubAvatarUrl || user.github_avatar_url,
++    createdAt: new Date(user.createdAt || user.created_at),
++  });
++
++  // User registration
++  fastify.post<{
++    Body: RegisterRequest;
++  }>('/auth/register', {
++    schema: { body: registerSchema },
++  }, async (request: FastifyRequest, reply: FastifyReply) => {
++    const { email, username, password, userType } = request.body as RegisterRequest;
++
++    try {
++      // Check if user already exists
++      const existingUser = await db
++        .selectFrom('users')
++        .selectAll()
++        .where((eb) => eb.or([
++          eb('email', '=', email),
++          ...(username ? [eb('username', '=', username)] : [])
++        ]))
++        .executeTakeFirst();
++
++      if (existingUser) {
++        if (existingUser.email === email) {
++          throw fastify.httpErrors.conflict('Email already registered');
++        }
++        if (existingUser.username === username) {
++          throw fastify.httpErrors.conflict('Username already taken');
++        }
++      }
++
++      // Hash password
++      const passwordHash = await bcrypt.hash(password, 12);
++
++      // Generate verification token
++      const verificationToken = randomBytes(32).toString('hex');
++      const verificationExpiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000); // 24 hours
++
++      // Create user
++      const userId = randomUUID();
++      await db
++        .insertInto('users')
++        .values({
++          id: userId,
++          email,
++          username,
++          password_hash: passwordHash,
++          user_type: userType,
++          email_verified: false,
++          email_verification_token: verificationToken,
++          email_verification_expires_at: verificationExpiresAt.toISOString(),
++          created_at: new Date().toISOString(),
++          updated_at: new Date().toISOString(),
++        })
++        .execute();
++
++      // Create email verification record
++      await db
++        .insertInto('email_verifications')
++        .values({
++          id: randomUUID(),
++          user_id: userId,
++          email,
++          token: verificationToken,
++          attempts: 0,
++          expires_at: verificationExpiresAt.toISOString(),
++          created_at: new Date().toISOString(),
++        })
++        .execute();
++
++      // Send verification email
++      try {
++        await emailService.sendEmailVerification(email, verificationToken, username);
++      } catch (emailError) {
++        fastify.log.error(emailError, 'Failed to send verification email');
++        // Don't fail registration if email fails
++      }
++
++      // Initialize onboarding steps
++      const onboardingSteps = userType === 'volunteer'
++        ? ['user-type-selection', 'storage-setup', 'desktop-app', 'node-configuration']
++        : ['user-type-selection', 'backup-setup', 'first-upload'];
++
++      for (const step of onboardingSteps) {
++        await db
++          .insertInto('user_onboarding')
++          .values({
++            id: randomUUID(),
++            user_id: userId,
++            step,
++            completed: step === 'user-type-selection', // First step completed
++            data: step === 'user-type-selection' ? JSON.stringify({ userType }) : null,
++            completed_at: step === 'user-type-selection' ? new Date().toISOString() : null,
++            created_at: new Date().toISOString(),
++          })
++          .execute();
++      }
++
++      return {
++        success: true,
++        message: 'Registration successful! Please check your email to verify your account.',
++        userId,
++      };
++    } catch (error) {
++      if (error.statusCode) {
++        throw error;
++      }
++      fastify.log.error(error, 'Registration failed');
++      throw fastify.httpErrors.internalServerError('Registration failed');
++    }
++  });
++
++  // Email verification
++  fastify.post<{
++    Body: EmailVerificationRequest;
++  }>('/auth/verify-email', {
++    schema: { body: emailVerificationSchema },
++  }, async (request: FastifyRequest, reply: FastifyReply) => {
++    const { token } = request.body as EmailVerificationRequest;
++
++    try {
++      // Find verification record
++      const verification = await db
++        .selectFrom('email_verifications')
++        .selectAll()
++        .where('token', '=', token)
++        .where('verified_at', 'is', null)
++        .executeTakeFirst();
++
++      if (!verification) {
++        throw fastify.httpErrors.badRequest('Invalid or expired verification token');
++      }
++
++      if (new Date() > new Date(verification.expires_at)) {
++        throw fastify.httpErrors.badRequest('Verification token has expired');
++      }
++
++      // Update verification record
++      await db
++        .updateTable('email_verifications')
++        .set({
++          verified_at: new Date().toISOString(),
++          attempts: verification.attempts + 1,
++        })
++        .where('id', '=', verification.id)
++        .execute();
++
++      // Update user
++      const user = await db
++        .updateTable('users')
++        .set({
++          email_verified: true,
++          email_verification_token: null,
++          email_verification_expires_at: null,
++          updated_at: new Date().toISOString(),
++        })
++        .where('id', '=', verification.user_id)
++        .returningAll()
++        .executeTakeFirstOrThrow();
++
++      // Send welcome email
++      try {
++        await emailService.sendWelcomeEmail(
++          user.email,
++          user.user_type as 'backup' | 'volunteer',
++          user.username || undefined
++        );
++      } catch (emailError) {
++        fastify.log.error(emailError, 'Failed to send welcome email');
++      }
++
++      return {
++        success: true,
++        message: 'Email verified successfully! Welcome to ZephyrFS!',
++        user: toPublicUser(user),
++      };
++    } catch (error) {
++      if (error.statusCode) {
++        throw error;
++      }
++      fastify.log.error(error, 'Email verification failed');
++      throw fastify.httpErrors.internalServerError('Email verification failed');
++    }
++  });
++
++  // Enhanced login
++  fastify.post<{
++    Body: LoginRequest;
++  }>('/auth/login', {
++    schema: { body: loginSchema },
++  }, async (request: FastifyRequest, reply: FastifyReply) => {
++    const { email, username, password, token } = request.body as LoginRequest;
++
++    try {
++      let user: any;
++
++      if (token) {
++        // Token-based authentication
++        try {
++          const decoded = fastify.jwt.verify(token) as { userId: string; username: string };
++          user = await db
++            .selectFrom('users')
++            .selectAll()
++            .where('id', '=', decoded.userId)
++            .executeTakeFirst();
++
++          if (!user) {
++            throw new Error('User not found');
++          }
++        } catch (error) {
++          throw fastify.httpErrors.unauthorized('Invalid token');
++        }
++      } else if ((email || username) && password) {
++        // Password-based authentication
++        user = await db
++          .selectFrom('users')
++          .selectAll()
++          .where((eb) => eb.or([
++            ...(email ? [eb('email', '=', email)] : []),
++            ...(username ? [eb('username', '=', username)] : [])
++          ]))
++          .executeTakeFirst();
++
++        if (!user || !user.password_hash) {
++          throw fastify.httpErrors.unauthorized('Invalid credentials');
++        }
++
++        const validPassword = await bcrypt.compare(password, user.password_hash);
++        if (!validPassword) {
++          throw fastify.httpErrors.unauthorized('Invalid credentials');
++        }
++
++        // Check if email is verified for new registrations
++        if (!user.email_verified) {
++          throw fastify.httpErrors.forbidden('Please verify your email address before logging in');
++        }
++      } else {
++        throw fastify.httpErrors.badRequest('Email/username and password, or token required');
++      }
++
++      // Create session
++      const sessionId = randomUUID();
++      const sessionToken = randomBytes(32).toString('hex');
++      const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // 30 days
++
++      await db
++        .insertInto('user_sessions')
++        .values({
++          id: sessionId,
++          user_id: user.id,
++          session_token: sessionToken,
++          expires_at: expiresAt.toISOString(),
++          created_at: new Date().toISOString(),
++          last_access_at: new Date().toISOString(),
++          ip_address: request.ip,
++          user_agent: request.headers['user-agent'],
++        })
++        .execute();
++
++      // Update last login
++      await db
++        .updateTable('users')
++        .set({
++          last_login_at: new Date().toISOString(),
++          updated_at: new Date().toISOString(),
++        })
++        .where('id', '=', user.id)
++        .execute();
++
++      // Generate tokens
++      const accessToken = fastify.jwt.sign(
++        { userId: user.id, username: user.username, sessionId },
++        { expiresIn: fastify.config.jwtExpiresIn }
++      );
++
++      const refreshToken = fastify.jwt.sign(
++        { userId: user.id, sessionId, type: 'refresh' },
++        { expiresIn: fastify.config.jwtRefreshExpiresIn }
++      );
++
++      const response: AuthResponse = {
++        token: accessToken,
++        refreshToken,
++        expiresIn: 24 * 60 * 60, // 24 hours in seconds
++        user: toPublicUser(user),
++      };
++
++      return response;
++    } catch (error) {
++      if (error.statusCode) {
++        throw error;
++      }
++      fastify.log.error(error, 'Login failed');
++      throw fastify.httpErrors.internalServerError('Login failed');
++    }
++  });
++
++  // Password reset request
++  fastify.post<{
++    Body: PasswordResetRequest;
++  }>('/auth/password-reset', {
++    schema: { body: passwordResetSchema },
++  }, async (request: FastifyRequest, reply: FastifyReply) => {
++    const { email } = request.body as PasswordResetRequest;
++
++    try {
++      const user = await db
++        .selectFrom('users')
++        .selectAll()
++        .where('email', '=', email)
++        .executeTakeFirst();
++
++      // Always return success to prevent email enumeration
++      if (!user) {
++        return {
++          success: true,
++          message: 'If an account with that email exists, we\'ve sent a password reset link.',
++        };
++      }
++
++      // Generate reset token
++      const resetToken = randomBytes(32).toString('hex');
++      const resetExpiresAt = new Date(Date.now() + 60 * 60 * 1000); // 1 hour
++
++      // Update user with reset token
++      await db
++        .updateTable('users')
++        .set({
++          password_reset_token: resetToken,
++          password_reset_expires_at: resetExpiresAt.toISOString(),
++          updated_at: new Date().toISOString(),
++        })
++        .where('id', '=', user.id)
++        .execute();
++
++      // Create password reset record
++      await db
++        .insertInto('password_resets')
++        .values({
++          id: randomUUID(),
++          user_id: user.id,
++          token: resetToken,
++          attempts: 0,
++          expires_at: resetExpiresAt.toISOString(),
++          created_at: new Date().toISOString(),
++        })
++        .execute();
++
++      // Send reset email
++      try {
++        await emailService.sendPasswordReset(email, resetToken, user.username || undefined);
++      } catch (emailError) {
++        fastify.log.error(emailError, 'Failed to send password reset email');
++      }
++
++      return {
++        success: true,
++        message: 'If an account with that email exists, we\'ve sent a password reset link.',
++      };
++    } catch (error) {
++      fastify.log.error(error, 'Password reset request failed');
++      throw fastify.httpErrors.internalServerError('Password reset request failed');
++    }
++  });
++
++  // Password reset confirmation
++  fastify.post<{
++    Body: PasswordResetConfirmRequest;
++  }>('/auth/password-reset/confirm', {
++    schema: { body: passwordResetConfirmSchema },
++  }, async (request: FastifyRequest, reply: FastifyReply) => {
++    const { token, newPassword } = request.body as PasswordResetConfirmRequest;
++
++    try {
++      // Find reset record
++      const reset = await db
++        .selectFrom('password_resets')
++        .selectAll()
++        .where('token', '=', token)
++        .where('used_at', 'is', null)
++        .executeTakeFirst();
++
++      if (!reset) {
++        throw fastify.httpErrors.badRequest('Invalid or expired reset token');
++      }
++
++      if (new Date() > new Date(reset.expires_at)) {
++        throw fastify.httpErrors.badRequest('Reset token has expired');
++      }
++
++      // Hash new password
++      const passwordHash = await bcrypt.hash(newPassword, 12);
++
++      // Update user
++      await db
++        .updateTable('users')
++        .set({
++          password_hash: passwordHash,
++          password_reset_token: null,
++          password_reset_expires_at: null,
++          updated_at: new Date().toISOString(),
++        })
++        .where('id', '=', reset.user_id)
++        .execute();
++
++      // Mark reset as used
++      await db
++        .updateTable('password_resets')
++        .set({
++          used_at: new Date().toISOString(),
++          attempts: reset.attempts + 1,
++        })
++        .where('id', '=', reset.id)
++        .execute();
++
++      // Invalidate all sessions for this user
++      await db
++        .deleteFrom('user_sessions')
++        .where('user_id', '=', reset.user_id)
++        .execute();
++
++      return {
++        success: true,
++        message: 'Password updated successfully! Please log in with your new password.',
++      };
++    } catch (error) {
++      if (error.statusCode) {
++        throw error;
++      }
++      fastify.log.error(error, 'Password reset confirmation failed');
++      throw fastify.httpErrors.internalServerError('Password reset confirmation failed');
++    }
++  });
++
++  // Get user onboarding status
++  fastify.get('/auth/onboarding', {
++    preHandler: fastify.authenticate,
++  }, async (request: FastifyRequest) => {
++    const user = request.user as { userId: string };
++
++    const onboardingSteps = await db
++      .selectFrom('user_onboarding')
++      .selectAll()
++      .where('user_id', '=', user.userId)
++      .orderBy('created_at', 'asc')
++      .execute();
++
++    return {
++      steps: onboardingSteps.map(toCamelCase),
++      completed: onboardingSteps.filter(step => step.completed).length,
++      total: onboardingSteps.length,
++    };
++  });
++
++  // Update onboarding progress
++  fastify.post<{
++    Body: OnboardingUpdateRequest;
++  }>('/auth/onboarding/update', {
++    preHandler: fastify.authenticate,
++    schema: { body: onboardingUpdateSchema },
++  }, async (request: FastifyRequest) => {
++    const user = request.user as { userId: string };
++    const { step, data, completed } = request.body as OnboardingUpdateRequest;
++
++    await db
++      .updateTable('user_onboarding')
++      .set({
++        completed: completed || false,
++        data: data ? JSON.stringify(data) : null,
++        completed_at: completed ? new Date().toISOString() : null,
++      })
++      .where('user_id', '=', user.userId)
++      .where('step', '=', step)
++      .execute();
++
++    return { success: true };
++  });
++
++  // Get current user info (enhanced)
++  fastify.get('/auth/me', {
++    preHandler: fastify.authenticate,
++  }, async (request: FastifyRequest) => {
++    const authUser = request.user as { userId: string; sessionId: string };
++
++    // Get user details
++    const user = await db
++      .selectFrom('users')
++      .selectAll()
++      .where('id', '=', authUser.userId)
++      .executeTakeFirstOrThrow();
++
++    // Update session last access
++    await db
++      .updateTable('user_sessions')
++      .set({ last_access_at: new Date().toISOString() })
++      .where('id', '=', authUser.sessionId)
++      .execute();
++
++    return toPublicUser(user);
++  });
++
++  // Enhanced logout (cleanup sessions)
++  fastify.post('/auth/logout', {
++    preHandler: fastify.authenticate,
++  }, async (request: FastifyRequest) => {
++    const user = request.user as { sessionId: string };
++
++    // Remove session
++    await db
++      .deleteFrom('user_sessions')
++      .where('id', '=', user.sessionId)
++      .execute();
++
++    return { success: true };
++  });
++
++  // Logout from all devices
++  fastify.post('/auth/logout-all', {
++    preHandler: fastify.authenticate,
++  }, async (request: FastifyRequest) => {
++    const user = request.user as { userId: string };
++
++    // Remove all sessions for user
++    await db
++      .deleteFrom('user_sessions')
++      .where('user_id', '=', user.userId)
++      .execute();
++
++    return { success: true };
++  });
++}

server/src/routes/oauth.tsadded

++import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
++import { randomUUID } from 'crypto';
++import { z } from 'zod';
++import { getDatabase } from '../database/connection.js';
++import { EmailService } from '../services/email.js';
++import type { AuthResponse, PublicUser } from '../database/types.js';
++
++// OAuth callback schemas
++const githubCallbackSchema = z.object({
++  code: z.string().min(1, 'Authorization code required'),
++  state: z.string().optional(),
++});
++
++const userTypeSelectionSchema = z.object({
++  userType: z.enum(['backup', 'volunteer']),
++  tempUserId: z.string().uuid(),
++});
++
++interface GitHubUser {
++  id: number;
++  login: string;
++  name?: string;
++  email?: string;
++  avatar_url?: string;
++}
++
++interface GitHubEmail {
++  email: string;
++  primary: boolean;
++  verified: boolean;
++}
++
++let emailService: EmailService;
++
++export async function oauthRoutes(fastify: FastifyInstance) {
++  const db = getDatabase();
++
++  // Initialize email service
++  emailService = new EmailService({
++    host: process.env.SMTP_HOST || 'smtp.ethereal.email',
++    port: parseInt(process.env.SMTP_PORT || '587'),
++    secure: process.env.SMTP_SECURE === 'true',
++    auth: process.env.SMTP_USER && process.env.SMTP_PASS ? {
++      user: process.env.SMTP_USER,
++      pass: process.env.SMTP_PASS,
++    } : undefined,
++    from: process.env.SMTP_FROM || 'ZephyrFS <noreply@zephyrfs.org>',
++  });
++
++  // Register GitHub OAuth plugin
++  await fastify.register(import('@fastify/oauth2'), {
++    name: 'githubOAuth2',
++    credentials: {
++      client: {
++        id: process.env.GITHUB_CLIENT_ID!,
++        secret: process.env.GITHUB_CLIENT_SECRET!,
++      },
++      auth: fastify.oauth2.GITHUB_CONFIGURATION,
++    },
++    scope: ['user:email', 'read:user'],
++    startRedirectPath: '/oauth/github/login',
++    callbackUri: `${process.env.BACKEND_URL || 'http://localhost:8080'}/oauth/github/callback`,
++  });
++
++  // Helper function to create public user object
++  const toPublicUser = (user: any): PublicUser => ({
++    id: user.id,
++    email: user.email,
++    username: user.username,
++    userType: user.userType || user.user_type,
++    emailVerified: user.emailVerified || user.email_verified,
++    githubUsername: user.githubUsername || user.github_username,
++    githubAvatarUrl: user.githubAvatarUrl || user.github_avatar_url,
++    createdAt: new Date(user.createdAt || user.created_at),
++  });
++
++  // GitHub OAuth login initiation
++  fastify.get('/oauth/github/login', async (request: FastifyRequest, reply: FastifyReply) => {
++    const state = randomUUID();
++
++    // Store state for verification (in production, use Redis or database)
++    // For now, we'll include it in the OAuth flow and verify in callback
++
++    return fastify.githubOAuth2.generateAuthorizationUri(request, reply, {
++      state,
++    });
++  });
++
++  // GitHub OAuth callback
++  fastify.get<{
++    Querystring: z.infer<typeof githubCallbackSchema>;
++  }>('/oauth/github/callback', async (request: FastifyRequest, reply: FastifyReply) => {
++    const { code, state } = request.query as z.infer<typeof githubCallbackSchema>;
++
++    try {
++      // Exchange code for token
++      const tokenResponse = await fastify.githubOAuth2.getAccessTokenFromAuthorizationCodeFlow(request);
++
++      if (!tokenResponse.access_token) {
++        throw new Error('No access token received');
++      }
++
++      // Fetch GitHub user data
++      const userResponse = await fetch('https://api.github.com/user', {
++        headers: {
++          'Authorization': `Bearer ${tokenResponse.access_token}`,
++          'User-Agent': 'ZephyrFS/1.0',
++          'Accept': 'application/vnd.github.v3+json',
++        },
++      });
++
++      if (!userResponse.ok) {
++        throw new Error('Failed to fetch GitHub user data');
++      }
++
++      const githubUser: GitHubUser = await userResponse.json();
++
++      // Fetch GitHub user emails
++      const emailsResponse = await fetch('https://api.github.com/user/emails', {
++        headers: {
++          'Authorization': `Bearer ${tokenResponse.access_token}`,
++          'User-Agent': 'ZephyrFS/1.0',
++          'Accept': 'application/vnd.github.v3+json',
++        },
++      });
++
++      let primaryEmail = githubUser.email;
++      if (emailsResponse.ok) {
++        const emails: GitHubEmail[] = await emailsResponse.json();
++        const primary = emails.find(email => email.primary && email.verified);
++        if (primary) {
++          primaryEmail = primary.email;
++        }
++      }
++
++      if (!primaryEmail) {
++        // Redirect to frontend with error
++        const errorUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/auth/error?error=no_email`;
++        return reply.redirect(errorUrl);
++      }
++
++      // Check if user already exists with this GitHub ID
++      let existingOAuthAccount = await db
++        .selectFrom('oauth_accounts')
++        .selectAll()
++        .where('provider', '=', 'github')
++        .where('provider_account_id', '=', githubUser.id.toString())
++        .executeTakeFirst();
++
++      let user: any;
++      let isNewUser = false;
++
++      if (existingOAuthAccount) {
++        // User exists, get their account
++        user = await db
++          .selectFrom('users')
++          .selectAll()
++          .where('id', '=', existingOAuthAccount.user_id)
++          .executeTakeFirst();
++
++        if (!user) {
++          throw new Error('OAuth account exists but user not found');
++        }
++
++        // Update OAuth account tokens
++        await db
++          .updateTable('oauth_accounts')
++          .set({
++            access_token: tokenResponse.access_token,
++            refresh_token: tokenResponse.refresh_token || null,
++            expires_at: tokenResponse.expires_in
++              ? new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
++              : null,
++            updated_at: new Date().toISOString(),
++          })
++          .where('id', '=', existingOAuthAccount.id)
++          .execute();
++
++        // Update user's GitHub info
++        await db
++          .updateTable('users')
++          .set({
++            github_username: githubUser.login,
++            github_avatar_url: githubUser.avatar_url,
++            last_login_at: new Date().toISOString(),
++            updated_at: new Date().toISOString(),
++          })
++          .where('id', '=', user.id)
++          .execute();
++
++      } else {
++        // Check if user exists with the email
++        user = await db
++          .selectFrom('users')
++          .selectAll()
++          .where('email', '=', primaryEmail)
++          .executeTakeFirst();
++
++        if (user) {
++          // Link GitHub to existing account
++          await db
++            .insertInto('oauth_accounts')
++            .values({
++              id: randomUUID(),
++              user_id: user.id,
++              provider: 'github',
++              provider_account_id: githubUser.id.toString(),
++              access_token: tokenResponse.access_token,
++              refresh_token: tokenResponse.refresh_token || null,
++              expires_at: tokenResponse.expires_in
++                ? new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
++                : null,
++              token_type: tokenResponse.token_type || 'bearer',
++              scope: Array.isArray(tokenResponse.scope)
++                ? tokenResponse.scope.join(' ')
++                : tokenResponse.scope || 'user:email read:user',
++              created_at: new Date().toISOString(),
++              updated_at: new Date().toISOString(),
++            })
++            .execute();
++
++          // Update user's GitHub info
++          await db
++            .updateTable('users')
++            .set({
++              github_id: githubUser.id.toString(),
++              github_username: githubUser.login,
++              github_avatar_url: githubUser.avatar_url,
++              last_login_at: new Date().toISOString(),
++              updated_at: new Date().toISOString(),
++            })
++            .where('id', '=', user.id)
++            .execute();
++
++        } else {
++          // New user - create temporary user and redirect to user type selection
++          isNewUser = true;
++          const tempUserId = randomUUID();
++
++          // Store temporary user data in database for user type selection
++          user = await db
++            .insertInto('users')
++            .values({
++              id: tempUserId,
++              email: primaryEmail,
++              username: githubUser.login,
++              user_type: 'backup', // Temporary, will be updated after type selection
++              email_verified: true, // GitHub email is considered verified
++              github_id: githubUser.id.toString(),
++              github_username: githubUser.login,
++              github_avatar_url: githubUser.avatar_url,
++              created_at: new Date().toISOString(),
++              updated_at: new Date().toISOString(),
++              profile_data: JSON.stringify({
++                temp: true,
++                githubName: githubUser.name,
++                needsUserTypeSelection: true,
++              }),
++            })
++            .returningAll()
++            .executeTakeFirstOrThrow();
++
++          // Create OAuth account
++          await db
++            .insertInto('oauth_accounts')
++            .values({
++              id: randomUUID(),
++              user_id: tempUserId,
++              provider: 'github',
++              provider_account_id: githubUser.id.toString(),
++              access_token: tokenResponse.access_token,
++              refresh_token: tokenResponse.refresh_token || null,
++              expires_at: tokenResponse.expires_in
++                ? new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
++                : null,
++              token_type: tokenResponse.token_type || 'bearer',
++              scope: Array.isArray(tokenResponse.scope)
++                ? tokenResponse.scope.join(' ')
++                : tokenResponse.scope || 'user:email read:user',
++              created_at: new Date().toISOString(),
++              updated_at: new Date().toISOString(),
++            })
++            .execute();
++
++          // Redirect to user type selection
++          const userTypeUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/auth/select-type?temp_user=${tempUserId}&github=true`;
++          return reply.redirect(userTypeUrl);
++        }
++      }
++
++      // Create session for existing user
++      const sessionId = randomUUID();
++      const sessionToken = randomUUID();
++      const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000); // 30 days
++
++      await db
++        .insertInto('user_sessions')
++        .values({
++          id: sessionId,
++          user_id: user.id,
++          session_token: sessionToken,
++          expires_at: expiresAt.toISOString(),
++          created_at: new Date().toISOString(),
++          last_access_at: new Date().toISOString(),
++          ip_address: request.ip,
++          user_agent: request.headers['user-agent'],
++        })
++        .execute();
++
++      // Generate tokens
++      const accessToken = fastify.jwt.sign(
++        { userId: user.id, username: user.username, sessionId },
++        { expiresIn: fastify.config.jwtExpiresIn }
++      );
++
++      // Redirect to frontend with token
++      const successUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/auth/success?token=${accessToken}&new_user=${isNewUser}`;
++      return reply.redirect(successUrl);
++
++    } catch (error) {
++      fastify.log.error(error, 'GitHub OAuth callback failed');
++      const errorUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/auth/error?error=oauth_failed`;
++      return reply.redirect(errorUrl);
++    }
++  });
++
++  // Complete user type selection for GitHub OAuth users
++  fastify.post<{
++    Body: z.infer<typeof userTypeSelectionSchema>;
++  }>('/oauth/github/complete-registration', {
++    schema: { body: userTypeSelectionSchema },
++  }, async (request: FastifyRequest, reply: FastifyReply) => {
++    const { userType, tempUserId } = request.body as z.infer<typeof userTypeSelectionSchema>;
++
++    try {
++      // Get temporary user
++      const tempUser = await db
++        .selectFrom('users')
++        .selectAll()
++        .where('id', '=', tempUserId)
++        .executeTakeFirst();
++
++      if (!tempUser) {
++        throw fastify.httpErrors.notFound('Temporary user not found');
++      }
++
++      const profileData = tempUser.profile_data ? JSON.parse(tempUser.profile_data) : {};
++      if (!profileData.temp || !profileData.needsUserTypeSelection) {
++        throw fastify.httpErrors.badRequest('User registration already completed');
++      }
++
++      // Update user with selected type
++      const user = await db
++        .updateTable('users')
++        .set({
++          user_type: userType,
++          profile_data: JSON.stringify({
++            ...profileData,
++            temp: false,
++            needsUserTypeSelection: false,
++          }),
++          updated_at: new Date().toISOString(),
++        })
++        .where('id', '=', tempUserId)
++        .returningAll()
++        .executeTakeFirstOrThrow();
++
++      // Initialize onboarding steps
++      const onboardingSteps = userType === 'volunteer'
++        ? ['user-type-selection', 'storage-setup', 'desktop-app', 'node-configuration']
++        : ['user-type-selection', 'backup-setup', 'first-upload'];
++
++      for (const step of onboardingSteps) {
++        await db
++          .insertInto('user_onboarding')
++          .values({
++            id: randomUUID(),
++            user_id: user.id,
++            step,
++            completed: step === 'user-type-selection',
++            data: step === 'user-type-selection' ? JSON.stringify({ userType }) : null,
++            completed_at: step === 'user-type-selection' ? new Date().toISOString() : null,
++            created_at: new Date().toISOString(),
++          })
++          .execute();
++      }
++
++      // Send welcome email
++      try {
++        await emailService.sendWelcomeEmail(user.email, userType, user.username || undefined);
++      } catch (emailError) {
++        fastify.log.error(emailError, 'Failed to send welcome email');
++      }
++
++      // Create session
++      const sessionId = randomUUID();
++      const sessionToken = randomUUID();
++      const expiresAt = new Date(Date.now() + 30 * 24 * 60 * 60 * 1000);
++
++      await db
++        .insertInto('user_sessions')
++        .values({
++          id: sessionId,
++          user_id: user.id,
++          session_token: sessionToken,
++          expires_at: expiresAt.toISOString(),
++          created_at: new Date().toISOString(),
++          last_access_at: new Date().toISOString(),
++          ip_address: request.ip,
++          user_agent: request.headers['user-agent'],
++        })
++        .execute();
++
++      // Generate tokens
++      const accessToken = fastify.jwt.sign(
++        { userId: user.id, username: user.username, sessionId },
++        { expiresIn: fastify.config.jwtExpiresIn }
++      );
++
++      const refreshToken = fastify.jwt.sign(
++        { userId: user.id, sessionId, type: 'refresh' },
++        { expiresIn: fastify.config.jwtRefreshExpiresIn }
++      );
++
++      const response: AuthResponse = {
++        token: accessToken,
++        refreshToken,
++        expiresIn: 24 * 60 * 60,
++        user: toPublicUser(user),
++      };
++
++      return {
++        success: true,
++        message: 'Registration completed successfully! Welcome to ZephyrFS!',
++        auth: response,
++      };
++
++    } catch (error) {
++      if (error.statusCode) {
++        throw error;
++      }
++      fastify.log.error(error, 'GitHub OAuth registration completion failed');
++      throw fastify.httpErrors.internalServerError('Registration completion failed');
++    }
++  });
++
++  // Link GitHub account to existing user
++  fastify.post('/oauth/github/link', {
++    preHandler: fastify.authenticate,
++  }, async (request: FastifyRequest, reply: FastifyReply) => {
++    const user = request.user as { userId: string };
++
++    // Check if GitHub account already linked
++    const existingLink = await db
++      .selectFrom('oauth_accounts')
++      .selectAll()
++      .where('user_id', '=', user.userId)
++      .where('provider', '=', 'github')
++      .executeTakeFirst();
++
++    if (existingLink) {
++      throw fastify.httpErrors.conflict('GitHub account already linked to this user');
++    }
++
++    // Generate state for OAuth flow
++    const state = `link_${user.userId}_${randomUUID()}`;
++
++    return fastify.githubOAuth2.generateAuthorizationUri(request, reply, {
++      state,
++    });
++  });
++
++  // Unlink GitHub account
++  fastify.delete('/oauth/github/unlink', {
++    preHandler: fastify.authenticate,
++  }, async (request: FastifyRequest) => {
++    const user = request.user as { userId: string };
++
++    // Remove OAuth account
++    await db
++      .deleteFrom('oauth_accounts')
++      .where('user_id', '=', user.userId)
++      .where('provider', '=', 'github')
++      .execute();
++
++    // Clear GitHub info from user
++    await db
++      .updateTable('users')
++      .set({
++        github_id: null,
++        github_username: null,
++        github_avatar_url: null,
++        updated_at: new Date().toISOString(),
++      })
++      .where('id', '=', user.userId)
++      .execute();
++
++    return { success: true, message: 'GitHub account unlinked successfully' };
++  });
++}

server/src/services/email.tsadded

++import nodemailer from 'nodemailer';
++import type { Transporter } from 'nodemailer';
++
++export interface EmailConfig {
++  host: string;
++  port: number;
++  secure: boolean;
++  auth?: {
++    user: string;
++    pass: string;
++  };
++  from: string;
++}
++
++export class EmailService {
++  private transporter: Transporter;
++  private config: EmailConfig;
++
++  constructor(config: EmailConfig) {
++    this.config = config;
++
++    // For development, use Ethereal Email (fake SMTP service)
++    if (process.env.NODE_ENV === 'development' && !config.auth) {
++      // This will be setup asynchronously
++      this.setupDevelopmentTransporter();
++    } else {
++      this.transporter = nodemailer.createTransporter({
++        host: config.host,
++        port: config.port,
++        secure: config.secure,
++        auth: config.auth,
++      });
++    }
++  }
++
++  private async setupDevelopmentTransporter() {
++    try {
++      // Create Ethereal Email account for development
++      const testAccount = await nodemailer.createTestAccount();
++
++      this.transporter = nodemailer.createTransporter({
++        host: 'smtp.ethereal.email',
++        port: 587,
++        secure: false,
++        auth: {
++          user: testAccount.user,
++          pass: testAccount.pass,
++        },
++      });
++
++      console.log('Development email transporter created with Ethereal Email');
++      console.log('Preview URLs will be logged when emails are sent');
++    } catch (error) {
++      console.error('Failed to create development email transporter:', error);
++      // Fallback to console logging
++      this.transporter = {
++        sendMail: async (options: any) => {
++          console.log('Email would be sent:', options);
++          return { messageId: 'dev-' + Date.now() };
++        },
++      } as any;
++    }
++  }
++
++  async sendEmailVerification(to: string, token: string, username?: string): Promise<void> {
++    const verificationUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/verify-email?token=${token}`;
++
++    const html = `
++      <!DOCTYPE html>
++      <html>
++        <head>
++          <meta charset="utf-8">
++          <title>Verify your ZephyrFS account</title>
++          <style>
++            body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
++            .container { max-width: 600px; margin: 0 auto; padding: 20px; }
++            .header { background: #007bff; color: white; padding: 20px; text-align: center; }
++            .content { padding: 30px; background: #f9f9f9; }
++            .button {
++              display: inline-block;
++              background: #007bff;
++              color: white;
++              padding: 12px 30px;
++              text-decoration: none;
++              border-radius: 5px;
++              margin: 20px 0;
++            }
++            .footer { padding: 20px; text-align: center; color: #666; font-size: 14px; }
++          </style>
++        </head>
++        <body>
++          <div class="container">
++            <div class="header">
++              <h1>Welcome to ZephyrFS!</h1>
++            </div>
++            <div class="content">
++              <h2>Verify Your Email Address</h2>
++              <p>Hello${username ? ` ${username}` : ''}!</p>
++              <p>Thank you for signing up for ZephyrFS, the secure and decentralized file backup system.</p>
++              <p>To complete your registration and start using ZephyrFS, please verify your email address by clicking the button below:</p>
++
++              <div style="text-align: center;">
++                <a href="${verificationUrl}" class="button">Verify Email Address</a>
++              </div>
++
++              <p>Or copy and paste this link into your browser:</p>
++              <p style="word-break: break-all; background: #eee; padding: 10px; border-radius: 3px;">
++                ${verificationUrl}
++              </p>
++
++              <p><strong>This verification link will expire in 24 hours.</strong></p>
++
++              <p>If you didn't create an account with ZephyrFS, you can safely ignore this email.</p>
++            </div>
++            <div class="footer">
++              <p>© 2024 ZephyrFS. All rights reserved.</p>
++              <p>Secure, decentralized file backup for everyone.</p>
++            </div>
++          </div>
++        </body>
++      </html>
++    `;
++
++    const text = `
++      Welcome to ZephyrFS!
++
++      Hello${username ? ` ${username}` : ''}!
++
++      Thank you for signing up for ZephyrFS, the secure and decentralized file backup system.
++
++      To complete your registration and start using ZephyrFS, please verify your email address by visiting this link:
++
++      ${verificationUrl}
++
++      This verification link will expire in 24 hours.
++
++      If you didn't create an account with ZephyrFS, you can safely ignore this email.
++
++      © 2024 ZephyrFS. All rights reserved.
++    `;
++
++    const result = await this.transporter.sendMail({
++      from: this.config.from || 'ZephyrFS <noreply@zephyrfs.org>',
++      to,
++      subject: 'Verify your ZephyrFS account',
++      text,
++      html,
++    });
++
++    // In development, log preview URL
++    if (process.env.NODE_ENV === 'development') {
++      const previewUrl = nodemailer.getTestMessageUrl(result);
++      if (previewUrl) {
++        console.log('Email verification preview:', previewUrl);
++      }
++    }
++  }
++
++  async sendPasswordReset(to: string, token: string, username?: string): Promise<void> {
++    const resetUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/reset-password?token=${token}`;
++
++    const html = `
++      <!DOCTYPE html>
++      <html>
++        <head>
++          <meta charset="utf-8">
++          <title>Reset your ZephyrFS password</title>
++          <style>
++            body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
++            .container { max-width: 600px; margin: 0 auto; padding: 20px; }
++            .header { background: #dc3545; color: white; padding: 20px; text-align: center; }
++            .content { padding: 30px; background: #f9f9f9; }
++            .button {
++              display: inline-block;
++              background: #dc3545;
++              color: white;
++              padding: 12px 30px;
++              text-decoration: none;
++              border-radius: 5px;
++              margin: 20px 0;
++            }
++            .footer { padding: 20px; text-align: center; color: #666; font-size: 14px; }
++            .warning { background: #fff3cd; border: 1px solid #ffeaa7; padding: 15px; border-radius: 5px; margin: 20px 0; }
++          </style>
++        </head>
++        <body>
++          <div class="container">
++            <div class="header">
++              <h1>Password Reset Request</h1>
++            </div>
++            <div class="content">
++              <h2>Reset Your Password</h2>
++              <p>Hello${username ? ` ${username}` : ''}!</p>
++              <p>We received a request to reset the password for your ZephyrFS account.</p>
++
++              <div class="warning">
++                <strong>⚠️ Security Notice:</strong> If you didn't request this password reset, please ignore this email. Your account is safe.
++              </div>
++
++              <p>To reset your password, click the button below:</p>
++
++              <div style="text-align: center;">
++                <a href="${resetUrl}" class="button">Reset Password</a>
++              </div>
++
++              <p>Or copy and paste this link into your browser:</p>
++              <p style="word-break: break-all; background: #eee; padding: 10px; border-radius: 3px;">
++                ${resetUrl}
++              </p>
++
++              <p><strong>This reset link will expire in 1 hour.</strong></p>
++
++              <p>After clicking the link, you'll be able to create a new password for your account.</p>
++            </div>
++            <div class="footer">
++              <p>© 2024 ZephyrFS. All rights reserved.</p>
++              <p>If you have security concerns, contact us immediately.</p>
++            </div>
++          </div>
++        </body>
++      </html>
++    `;
++
++    const text = `
++      Password Reset Request
++
++      Hello${username ? ` ${username}` : ''}!
++
++      We received a request to reset the password for your ZephyrFS account.
++
++      If you didn't request this password reset, please ignore this email. Your account is safe.
++
++      To reset your password, visit this link:
++
++      ${resetUrl}
++
++      This reset link will expire in 1 hour.
++
++      After clicking the link, you'll be able to create a new password for your account.
++
++      © 2024 ZephyrFS. All rights reserved.
++    `;
++
++    const result = await this.transporter.sendMail({
++      from: this.config.from || 'ZephyrFS Security <security@zephyrfs.org>',
++      to,
++      subject: 'Reset your ZephyrFS password',
++      text,
++      html,
++    });
++
++    // In development, log preview URL
++    if (process.env.NODE_ENV === 'development') {
++      const previewUrl = nodemailer.getTestMessageUrl(result);
++      if (previewUrl) {
++        console.log('Password reset preview:', previewUrl);
++      }
++    }
++  }
++
++  async sendWelcomeEmail(to: string, userType: 'backup' | 'volunteer', username?: string): Promise<void> {
++    const isVolunteer = userType === 'volunteer';
++    const dashboardUrl = `${process.env.FRONTEND_URL || 'http://localhost:3000'}/dashboard`;
++
++    const html = `
++      <!DOCTYPE html>
++      <html>
++        <head>
++          <meta charset="utf-8">
++          <title>Welcome to ZephyrFS!</title>
++          <style>
++            body { font-family: Arial, sans-serif; line-height: 1.6; color: #333; }
++            .container { max-width: 600px; margin: 0 auto; padding: 20px; }
++            .header { background: #28a745; color: white; padding: 20px; text-align: center; }
++            .content { padding: 30px; background: #f9f9f9; }
++            .button {
++              display: inline-block;
++              background: #28a745;
++              color: white;
++              padding: 12px 30px;
++              text-decoration: none;
++              border-radius: 5px;
++              margin: 20px 0;
++            }
++            .footer { padding: 20px; text-align: center; color: #666; font-size: 14px; }
++            .feature { background: white; padding: 15px; margin: 10px 0; border-left: 4px solid #28a745; }
++          </style>
++        </head>
++        <body>
++          <div class="container">
++            <div class="header">
++              <h1>🎉 Welcome to ZephyrFS!</h1>
++            </div>
++            <div class="content">
++              <h2>Your account is ready!</h2>
++              <p>Hello${username ? ` ${username}` : ''}!</p>
++              <p>Welcome to ZephyrFS! Your email has been verified and your account is now active.</p>
++
++              ${isVolunteer ? `
++                <h3>🤝 Thank you for volunteering!</h3>
++                <p>As a storage volunteer, you're helping build a decentralized, secure backup network that benefits everyone.</p>
++
++                <div class="feature">
++                  <strong>📁 Safe Storage Allocation</strong><br>
++                  Choose how much disk space to contribute safely without risking your system.
++                </div>
++
++                <div class="feature">
++                  <strong>🔒 Zero-Knowledge Security</strong><br>
++                  All stored data is encrypted - you can't see what's stored on your system.
++                </div>
++
++                <div class="feature">
++                  <strong>💰 Earn Rewards</strong><br>
++                  Get compensated for providing reliable storage to the network.
++                </div>
++
++                <p>Ready to get started? Use our desktop app to set up your storage node:</p>
++              ` : `
++                <h3>☁️ Secure Backup Made Simple</h3>
++                <p>Your files will be encrypted, distributed, and safely backed up across our decentralized network.</p>
++
++                <div class="feature">
++                  <strong>🔐 Military-Grade Encryption</strong><br>
++                  Your files are encrypted before leaving your device.
++                </div>
++
++                <div class="feature">
++                  <strong>🌐 Distributed Storage</strong><br>
++                  Files are split and stored across multiple secure nodes.
++                </div>
++
++                <div class="feature">
++                  <strong>⚡ Simple as Google Drive</strong><br>
++                  Drag and drop to backup. That's it!
++                </div>
++
++                <p>Ready to start backing up your files?</p>
++              `}
++
++              <div style="text-align: center;">
++                <a href="${dashboardUrl}" class="button">Get Started</a>
++              </div>
++
++              <p>If you have any questions or need help getting started, our community is here to support you!</p>
++            </div>
++            <div class="footer">
++              <p>© 2024 ZephyrFS. All rights reserved.</p>
++              <p>Building the future of secure, decentralized storage.</p>
++            </div>
++          </div>
++        </body>
++      </html>
++    `;
++
++    const result = await this.transporter.sendMail({
++      from: this.config.from || 'ZephyrFS <welcome@zephyrfs.org>',
++      to,
++      subject: '🎉 Welcome to ZephyrFS - Your account is ready!',
++      html,
++    });
++
++    // In development, log preview URL
++    if (process.env.NODE_ENV === 'development') {
++      const previewUrl = nodemailer.getTestMessageUrl(result);
++      if (previewUrl) {
++        console.log('Welcome email preview:', previewUrl);
++      }
++    }
++  }
++}