Decouple UserType, add Role entity and management

Removed all UserType logic and references, replacing them with a new Role model and management system. Introduced RoleManager service, repository, and API endpoint for role CRUD operations. Updated user flows and JWT claims to use RoleCode. Removed admin-only user CRUD endpoints. Updated DI, documentation, and error handling for consistency. Appsettings and DTOs now reflect the new role-based approach.

Services/AltOptionManager/AltOptionManagerService.cs

@@ -160,7 +160,7 @@ public class AltOptionManagerService
 
             //exisiting one
 
-            var user = await _userRepository.GetUserByIdentifierAndType(identifier, null);
+            var user = await _userRepository.GetUserByIdentifierAndType(identifier);
 
             if (user == null)
                 throw new KeyNotFoundException("No user found with the provided identifier.");
@@ -293,7 +293,7 @@ public class AltOptionManagerService
             User? user = null;
             if (!string.IsNullOrWhiteSpace(identifier))
             {
-                user = await _userRepository.GetUserByIdentifierAndType(identifier, null);
+                user = await _userRepository.GetUserByIdentifierAndType(identifier);
             }
 
             if (user is null && userId.HasValue)
@@ -377,7 +377,7 @@ public class AltOptionManagerService
                         user.EmailVerified,
                         user.MobileNumberVerified,
                         user.IsMfaEnabled,
-                        UserTypeId = user.UserTypeId
+                        RoleId = user.RoleCode
                     }
                 }
             };

Services/FunctionHandler/RoleManager.cs

@@ -0,0 +1,72 @@
+using AuthHex.Models.IOs;
+using AuthHex.Services.RoleManager;
+
+namespace AuthHex.Services.FunctionHandler
+{
+    public class RoleManager
+    {
+        public readonly Dictionary<string, Func<object, HttpContext, Task<object>>> _functionHandler;
+
+        public RoleManager(RoleManagerService roleManagerService)
+        {
+            _functionHandler = new()
+            {
+                { "createRole", roleManagerService.CreateRole },
+                { "getRole", roleManagerService.GetRole },
+                { "listRoles", async (payload, context) => await roleManagerService.ListRoles(context) },
+                { "updateRole", roleManagerService.UpdateRole },
+                { "deleteRole", roleManagerService.DeleteRole }
+            };
+        }
+
+        public async Task<ApiResponse> Execute(ApiRequest request, HttpContext httpContext)
+        {
+            if (!_functionHandler.TryGetValue(request.FunctionName, out var handler))
+            {
+                return new ApiResponse
+                {
+                    StatusCode = 404,
+                    Message = $"Function '{request.FunctionName}' not found.",
+                    Data = null
+                };
+            }
+            try
+            {
+                var results = await handler(request.Payload, httpContext);
+                return new ApiResponse
+                {
+                    StatusCode = 200,
+                    Message = "success",
+                    Data = results
+                };
+            }
+            catch (KeyNotFoundException ex)
+            {
+                return new ApiResponse
+                {
+                    StatusCode = 400,
+                    Message = ex.Message,
+                    Data = null
+                };
+            }
+            catch (InvalidOperationException ex)
+            {
+                return new ApiResponse
+                {
+                    StatusCode = 400,
+                    Message = ex.Message,
+                    Data = null
+                };
+            }
+            catch (ArgumentException ex)
+            {
+                return new ApiResponse
+                {
+                    StatusCode = 500,
+                    Message = ex.Message,
+                    Data = null
+                };
+            }
+        }
+    }
+}

Services/FunctionHandler/UserManager.cs

@@ -18,19 +18,13 @@ namespace AuthHex.Services.FunctionHandler
                 { "refreshToken", UserManagerService.RefreshToken },
                 { "getUserDetails", UserManagerService.GetUserDetails }, 
                 { "getUserSessions", async (payload, context) => await UserManagerService.GetUserSessions(context)  },
-                { "listUserTypes", async (payload, context) => await UserManagerService.ListUserTypes(context) },
-                { "ChangeUserStatus", UserManagerService.ChangeUserStatus},
+{ "ChangeUserStatus", UserManagerService.ChangeUserStatus},
                 {"LockUserAccount" , UserManagerService.LockUserAccount  },
                 {"ChangeUserPassword" , UserManagerService.ChangeUserPassword  },
                 {"VerifyPassword" , UserManagerService.VerifyPassword  },
                 {"LogoutUser" , UserManagerService.LogoutUser},
                 {"UpdateUser", UserManagerService.UpdateUser},
                 {"VerifyOtpForLogin",UserManagerService.VerifyOtpForLogin},
-
-                // Admin-only — require X-Admin-Api-Key, act on an arbitrary target user.
-                {"AdminUpdateUser", UserManagerService.AdminUpdateUser},
-                {"AdminSetUserStatus", UserManagerService.AdminSetUserStatus},
-                {"deleteUser", UserManagerService.DeleteUser},
                 
                 // 2FA Management Functions
                 { "initiateTwoFASetup", async (payload, context) => await UserManagerService.InitiateTwoFASetup(context) },
@@ -62,15 +56,6 @@ namespace AuthHex.Services.FunctionHandler
                     Data = results
                 };
             }
-            catch (UnauthorizedAccessException ex)
-            {
-                return new ApiResponse
-                {
-                    StatusCode = 401,
-                    Message = ex.Message,
-                    Data = null
-                };
-            }
             catch (KeyNotFoundException ex)
             {
                 return new ApiResponse

Services/RecoveryManager/RecoveryManagerService.cs

@@ -53,7 +53,7 @@ public class RecoveryManagerService
             if (string.IsNullOrEmpty(identifier))
                 throw new ArgumentException("Identifier is required.");
 
-            var user = await _userRepository.GetUserByIdentifierAndType(identifier, null);
+            var user = await _userRepository.GetUserByIdentifierAndType(identifier);
             if (user == null)
                 throw new KeyNotFoundException("No user found with the provided identifier.");
 
@@ -119,9 +119,14 @@ public class RecoveryManagerService
 
                 return new
                 {
-                    ReferenceNumber = recovery.RecoveryReferenceNum,
-                    ExpiresAt = recovery.ExpirationTime,
-                    RecoveryType = "ResetLink"
+                    Success = true,
+                    Message = "Password reset link sent to your email.",
+                    Data = new
+                    {
+                        ReferenceNumber = recovery.RecoveryReferenceNum,
+                        ExpiresAt = recovery.ExpirationTime,
+                        RecoveryType = "ResetLink"
+                    }
                 };
             }
             else
@@ -171,9 +176,14 @@ public class RecoveryManagerService
 
                 return new
                 {
-                    ReferenceNumber = recovery.RecoveryReferenceNum,
-                    ExpiresAt = recovery.ExpirationTime,
-                    RecoveryType = "OTP"
+                    Success = true,
+                    Message = "OTP sent successfully.",
+                    Data = new
+                    {
+                        ReferenceNumber = recovery.RecoveryReferenceNum,
+                        ExpiresAt = recovery.ExpirationTime,
+                        RecoveryType = "OTP"
+                    }
                 };
             }
         }
@@ -227,9 +237,14 @@ public class RecoveryManagerService
 
             return new
             {
-                ReferenceNumber = recovery.RecoveryReferenceNum,
-                UserId = recovery.UserId,
-                Verified = true
+                Success = true,
+                Message = "OTP verified successfully. You can now reset your password.",
+                Data = new
+                {
+                    ReferenceNumber = recovery.RecoveryReferenceNum,
+                    UserId = recovery.UserId,
+                    Verified = true
+                }
             };
         }
         catch
@@ -328,9 +343,14 @@ public class RecoveryManagerService
 
             return new
             {
-                UserId = user.Id,
-                Email = user.Email,
-                ResetAt = DateTime.UtcNow
+                Success = true,
+                Message = "Password reset successful. Please login with your new password.",
+                Data = new
+                {
+                    UserId = user.Id,
+                    Email = user.Email,
+                    ResetAt = DateTime.UtcNow
+                }
             };
         }
         catch
@@ -421,9 +441,14 @@ public class RecoveryManagerService
 
             return new
             {
-                UserId = user.Id,
-                Email = user.Email,
-                ResetAt = DateTime.UtcNow
+                Success = true,
+                Message = "Password reset successful. Please login with your new password.",
+                Data = new
+                {
+                    UserId = user.Id,
+                    Email = user.Email,
+                    ResetAt = DateTime.UtcNow
+                }
             };
         }
         catch

Services/RoleManager/RoleManagerService.cs

@@ -0,0 +1,151 @@
+using System.Text.Json;
+using AuthHex.Infra.UoW;
+using AuthHex.Interfaces;
+using AuthHex.Models;
+using Core_Archi.Helpers;
+using Microsoft.AspNetCore.Http;
+
+namespace AuthHex.Services.RoleManager;
+
+public class RoleManagerService
+{
+    private readonly IRoleManageRepository _repository;
+    private readonly IUnitOfWork _uow;
+
+    public RoleManagerService(IRoleManageRepository repository, IUnitOfWork uow)
+    {
+        _repository = repository;
+        _uow = uow;
+    }
+
+    public async Task<object> CreateRole(object payload, HttpContext httpContext)
+    {
+        await _uow.BeginAsync();
+        try
+        {
+            var data = DeserializePayload.Deserialize(payload);
+
+            var code = data.ContainsKey("code") ? data["code"].GetString() : null;
+            var name = data.ContainsKey("name") ? data["name"].GetString() : null;
+            var isSystemRole = data.ContainsKey("isSystemRole")
+                && data["isSystemRole"].ValueKind != JsonValueKind.Null
+                && data["isSystemRole"].GetBoolean();
+
+            if (string.IsNullOrWhiteSpace(code))
+                throw new ArgumentException("code is required");
+
+            var role = new Role
+            {
+                RoleId = Guid.NewGuid(),
+                Code = code,
+                Name = string.IsNullOrWhiteSpace(name) ? code : name,
+                IsSystemRole = isSystemRole,
+                CreatedAt = DateTime.UtcNow
+            };
+
+            await _repository.AddRoleAsync(role);
+            await _uow.CommitAsync();
+
+            return ToDto(role);
+        }
+        catch
+        {
+            await _uow.RollbackAsync();
+            throw;
+        }
+    }
+
+    public async Task<object> GetRole(object payload, HttpContext httpContext)
+    {
+        var data = DeserializePayload.Deserialize(payload);
+
+        if (!data.ContainsKey("roleId") || !Guid.TryParse(data["roleId"].GetString(), out var roleId))
+            throw new ArgumentException("Invalid roleId");
+
+        var role = await _repository.GetRoleByIdAsync(roleId)
+            ?? throw new KeyNotFoundException("Role not found");
+
+        return ToDto(role);
+    }
+
+    public async Task<object> ListRoles(HttpContext httpContext)
+    {
+        var roles = await _repository.ListRolesAsync();
+        return roles.Select(ToDto).ToList();
+    }
+
+    public async Task<object> UpdateRole(object payload, HttpContext httpContext)
+    {
+        await _uow.BeginAsync();
+        try
+        {
+            var data = DeserializePayload.Deserialize(payload);
+
+            if (!data.ContainsKey("roleId") || !Guid.TryParse(data["roleId"].GetString(), out var roleId))
+                throw new ArgumentException("Invalid roleId");
+
+            var role = await _repository.GetRoleByIdAsync(roleId)
+                ?? throw new KeyNotFoundException("Role not found");
+
+            if (data.ContainsKey("code"))
+            {
+                var code = data["code"].GetString();
+                if (string.IsNullOrWhiteSpace(code))
+                    throw new ArgumentException("code cannot be empty");
+                role.Code = code;
+            }
+
+            if (data.ContainsKey("name"))
+                role.Name = data["name"].GetString();
+
+            if (data.ContainsKey("isSystemRole") && data["isSystemRole"].ValueKind != JsonValueKind.Null)
+                role.IsSystemRole = data["isSystemRole"].GetBoolean();
+
+            await _uow.CommitAsync();
+
+            return ToDto(role);
+        }
+        catch
+        {
+            await _uow.RollbackAsync();
+            throw;
+        }
+    }
+
+    public async Task<object> DeleteRole(object payload, HttpContext httpContext)
+    {
+        await _uow.BeginAsync();
+        try
+        {
+            var data = DeserializePayload.Deserialize(payload);
+
+            if (!data.ContainsKey("roleId") || !Guid.TryParse(data["roleId"].GetString(), out var roleId))
+                throw new ArgumentException("Invalid roleId");
+
+            var role = await _repository.GetRoleByIdAsync(roleId)
+                ?? throw new KeyNotFoundException("Role not found");
+
+            //if (await _repository.RoleInUseAsync(roleId))
+            //    throw new InvalidOperationException("ROLE_IN_USE: role is assigned to one or more users");
+
+            await _repository.DeleteRoleAsync(role);
+            await _uow.CommitAsync();
+
+            return new { message = "Role deleted successfully" };
+        }
+        catch
+        {
+            await _uow.RollbackAsync();
+            throw;
+        }
+    }
+
+    private static object ToDto(Role role) => new
+    {
+        role.RoleId,
+        role.Code,
+        role.Name,
+        role.IsSystemRole,
+        role.CreatedAt
+    };
+}

Services/UserManager/UserManagerService.cs

@@ -28,9 +28,8 @@ public class UserManagerService
     private readonly AppDBContext _dbContext;
     private readonly ThirdPartyService _thirdPartyService;
     private readonly UserHelper _userHelper;
-    private readonly IConfiguration _configuration;
 
-    public UserManagerService(IUserManageRepository repository, IRecoveryManagerRepository recoveryRepository, IUnitOfWork uow, JwtTokenHelper jwt, AppDBContext dbContext, ThirdPartyService thirdPartyService, UserHelper userHelper, IConfiguration configuration)
+    public UserManagerService(IUserManageRepository repository, IRecoveryManagerRepository recoveryRepository, IUnitOfWork uow, JwtTokenHelper jwt, AppDBContext dbContext, ThirdPartyService thirdPartyService, UserHelper userHelper)
     {
         _repository = repository;
         _recoveryRepository = recoveryRepository;
@@ -39,7 +38,6 @@ public class UserManagerService
         _dbContext = dbContext;
         _thirdPartyService = thirdPartyService;
         _userHelper = userHelper;
-        _configuration = configuration;
     }
 
     public async Task<object> RegisterUser(object payload, HttpContext httpContext)
@@ -65,27 +63,19 @@ public class UserManagerService
 
             var deviceName = data.ContainsKey("deviceName") ? data["deviceName"].GetString() : "Unknown Device";
 
-            // A "roleId" in the payload (old ERP builds still send one) is accepted and ignored: roles are the ERP's business.
-
-            if (!data.ContainsKey("userTypeId") || !Guid.TryParse(data["userTypeId"].GetString(), out var UserTypeId))
-                throw new ArgumentException("Invalid userTypeId");
-
+            if (!data.ContainsKey("roleId") || !Guid.TryParse(data["roleId"].GetString(), out var RoleId))
+                throw new ArgumentException("Invalid roleId");
 
             //chk user exist
-            if (data.ContainsKey("chkUser") == true) {
-                var userToCheck = new User
-                {
-                    FullName = FullName,
-                    Email = Email,
-                    MobileNumber = MobileNumber,
-                    Nic = Nic,
-                    UserTypeId = UserTypeId
-                };
-                bool canSave = await CanRegisterUser(userToCheck);
-
-                if (!canSave)
-                    throw new InvalidOperationException("User already exists");
-            }
+            var userToCheck = new User
+            {
+                Email = Email,
+                MobileNumber = MobileNumber,
+                Nic = Nic,
+            };
+            bool canSave = await CanRegisterUser(userToCheck);
+            if (!canSave)
+                throw new InvalidOperationException("User already exists");
 
 
             // if send password empty generate random password
@@ -108,7 +98,7 @@ public class UserManagerService
                 Nic = Nic,
                 Email = Email,
                 MobileNumber = MobileNumber,
-                UserTypeId = UserTypeId,
+                RoleCode = RoleId.ToString(),
                 CreatedAt = DateTime.UtcNow,
                 IsActive = true,
                 IsLocked = false,
@@ -191,7 +181,7 @@ public class UserManagerService
                     user.EmailVerified,
                     user.MobileNumberVerified,
                     user.IsMfaEnabled,
-                    UserTypeId = user.UserTypeId
+                    RoleId = user.RoleCode
                 }
             };
         }
@@ -219,13 +209,12 @@ public class UserManagerService
 
             var identifier = data.ContainsKey("identifier") ? data["identifier"].GetString() : null;
             var password = data.ContainsKey("password") ? data["password"].GetString() : null;
-            var userTypeId = data.ContainsKey("userTypeId") && Guid.TryParse(data["userTypeId"].GetString(), out var utid) ? utid : (Guid?)null;
             var deviceName = data.ContainsKey("deviceName") ? data["deviceName"].GetString() : "Unknown Device";
 
             if (string.IsNullOrWhiteSpace(identifier))
                 throw new ArgumentException("Identifier and password are required");
 
-            var user = await _repository.GetUserByIdentifierAndType(identifier, userTypeId);
+            var user = await _repository.GetUserByIdentifierAndType(identifier);
 
             
 
@@ -299,7 +288,7 @@ public class UserManagerService
                     user.EmailVerified,
                     user.MobileNumberVerified,
                     user.IsMfaEnabled,
-                    UserTypeId = user.UserTypeId
+                    RoleId = user.RoleCode
                 }
             };
         }
@@ -407,7 +396,7 @@ public class UserManagerService
                         user.EmailVerified,
                         user.MobileNumberVerified,
                         user.IsMfaEnabled,
-                        UserTypeId = user.UserTypeId
+                        RoleId = user.RoleCode
                     }
                 }
             };
@@ -499,7 +488,7 @@ public class UserManagerService
                     user.EmailVerified,
                     user.MobileNumberVerified,
                     user.IsMfaEnabled,
-                    UserTypeId = user.UserTypeId
+                    RoleId = user.RoleCode
                 }
             };
         }
@@ -545,12 +534,7 @@ public class UserManagerService
                 user.IsActive,
                 user.IsLocked,
                 user.CreatedAt,
-                UserType = new
-                {
-                    user.UserType?.UserTypeId,
-                    user.UserType?.Code,
-                    user.UserType?.Description
-                }
+                Role = user.RoleCode
             };
         }
         catch
@@ -559,17 +543,6 @@ public class UserManagerService
         }
     }
 
-    public async Task<object> ListUserTypes(HttpContext httpContext)
-    {
-        var userTypes = await _dbContext.UserType.OrderBy(t => t.Code).ToListAsync();
-        return userTypes.Select(t => new
-        {
-            t.UserTypeId,
-            t.Code,
-            t.Description
-        }).ToList();
-    }
-
     public async Task<object> GetUserSessions(HttpContext httpContext)
     {
         try
@@ -782,7 +755,8 @@ public class UserManagerService
             if (data == null || !data.Any())
                 throw new ArgumentException("Invalid payload data");
 
-            var userId = _userHelper.GetUserIdFromClaims(httpContext);
+            if (!data.ContainsKey("userId") || !Guid.TryParse(data["userId"].GetString(), out var userId))
+                throw new ArgumentException("Invalid userId");
 
             var user = await _repository.GetUserByIdAsync(userId);
 
@@ -851,6 +825,12 @@ public class UserManagerService
                 updated = true;
             }
 
+            if (data.ContainsKey("roleCode"))
+            {
+                user.RoleCode = data["roleCode"].GetString();
+                updated = true;
+            }
+
             if (data.ContainsKey("newPassword"))
             {
                 var currentPassword = data.ContainsKey("currentPassword") ? data["currentPassword"].GetString() : null;
@@ -1199,7 +1179,7 @@ public class UserManagerService
 
         foreach (var user in existingUsers)
         {
-            if (user.UserTypeId == userToCheck.UserTypeId)
+            if (user.RoleCode == userToCheck.RoleCode)
                 return false;
 
             if (user.IsLocked == false)
@@ -1245,162 +1225,4 @@ public class UserManagerService
         return System.Text.RegularExpressions.Regex.IsMatch(cleaned, @"^\d{7,15}$");
     }
 
-    // ---- Admin-only functions (require X-Admin-Api-Key) ----------------------------
-    // Everything above acts on the caller's own account, resolved from the bearer token's
-    // claims. These three act on an arbitrary target user (by id, or by identifier for
-    // delete) on an admin's behalf — ERPCore calls them with a shared secret instead of a
-    // user bearer token, since the admin and the target are different people.
-
-    private bool IsAuthorizedAdmin(HttpContext httpContext)
-    {
-        var expected = _configuration["AuthHex:AdminApiKey"];
-        var provided = httpContext.Request.Headers["X-Admin-Api-Key"].FirstOrDefault();
-        return !string.IsNullOrEmpty(expected) && provided == expected;
-    }
-
-    public async Task<object> AdminUpdateUser(object payload, HttpContext httpContext)
-    {
-        if (!IsAuthorizedAdmin(httpContext))
-            throw new UnauthorizedAccessException("A valid X-Admin-Api-Key header is required for this operation.");
-
-        var data = DeserializePayload.Deserialize(payload);
-        if (!data.ContainsKey("userId"))
-            throw new ArgumentException("userId is required");
-
-        var userId = Guid.Parse(data["userId"].GetString() ?? throw new ArgumentException("userId is required"));
-        var user = await _repository.GetUserByIdAsync(userId)
-            ?? throw new ArgumentException("User not found");
-
-        await _uow.BeginAsync();
-        try
-        {
-            if (data.ContainsKey("fullName")) user.FullName = data["fullName"].GetString();
-            if (data.ContainsKey("userName")) user.UserName = data["userName"].GetString();
-            if (data.ContainsKey("email"))
-            {
-                user.Email = data["email"].GetString();
-                user.EmailVerified = false;
-            }
-            if (data.ContainsKey("mobileNumber"))
-            {
-                user.MobileNumber = data["mobileNumber"].GetString();
-                user.MobileNumberVerified = false;
-            }
-
-            await _uow.CommitAsync();
-
-            return new
-            {
-                user.Id,
-                user.FullName,
-                user.UserName,
-                user.Email,
-                user.MobileNumber,
-                user.IsActive
-            };
-        }
-        catch
-        {
-            await _uow.RollbackAsync();
-            throw;
-        }
-    }
-
-    public async Task<object> AdminSetUserStatus(object payload, HttpContext httpContext)
-    {
-        if (!IsAuthorizedAdmin(httpContext))
-            throw new UnauthorizedAccessException("A valid X-Admin-Api-Key header is required for this operation.");
-
-        var data = DeserializePayload.Deserialize(payload);
-        if (!data.ContainsKey("userId"))
-            throw new ArgumentException("userId is required");
-
-        var userId = Guid.Parse(data["userId"].GetString() ?? throw new ArgumentException("userId is required"));
-        var isActive = data.ContainsKey("isActive") ? data["isActive"].GetBoolean() : (bool?)null;
-        if (isActive == null)
-            throw new ArgumentException("isActive is required");
-
-        var user = await _repository.GetUserByIdAsync(userId)
-            ?? throw new ArgumentException("User not found");
-
-        await _uow.BeginAsync();
-        try
-        {
-            user.IsActive = isActive.Value;
-
-            await _uow.CommitAsync();
-
-            // Deactivating must actually end any live sessions, not just flip a flag that
-            // existing refresh tokens ignore.
-            if (!isActive.Value)
-                await _repository.InvalidateUserSessionsAsync(user.Id);
-
-            return new
-            {
-                user.Id,
-                user.FullName,
-                user.UserName,
-                user.Email,
-                user.IsActive
-            };
-        }
-        catch
-        {
-            await _uow.RollbackAsync();
-            throw;
-        }
-    }
-
-    /// <summary>
-    /// Hard-deletes one or more users matched by any of the given identifiers. Sessions,
-    /// tokens, MFA and provider links cascade at the DB level (AppDBContext.OnModelCreating);
-    /// Recovery rows have a plain Restrict FK and must be removed explicitly first.
-    /// </summary>
-    public async Task<object> DeleteUser(object payload, HttpContext httpContext)
-    {
-        if (!IsAuthorizedAdmin(httpContext))
-            throw new UnauthorizedAccessException("A valid X-Admin-Api-Key header is required for this operation.");
-
-        var data = DeserializePayload.Deserialize(payload);
-        string? email = data.ContainsKey("email") ? data["email"].GetString() : null;
-        string? mobileNumber = data.ContainsKey("mobileNumber") ? data["mobileNumber"].GetString() : null;
-        string? nic = data.ContainsKey("nic") ? data["nic"].GetString() : null;
-        string? userName = data.ContainsKey("userName") ? data["userName"].GetString() : null;
-
-        if (string.IsNullOrWhiteSpace(email) && string.IsNullOrWhiteSpace(mobileNumber)
-            && string.IsNullOrWhiteSpace(nic) && string.IsNullOrWhiteSpace(userName))
-            throw new ArgumentException("At least one of email, mobileNumber, nic or userName is required.");
-
-        var matches = await _dbContext.Users
-            .Where(u =>
-                (email != null && u.Email == email) ||
-                (mobileNumber != null && u.MobileNumber == mobileNumber) ||
-                (nic != null && u.Nic == nic) ||
-                (userName != null && u.UserName == userName))
-            .ToListAsync();
-
-        if (matches.Count == 0)
-            throw new ArgumentException("No matching user was found.");
-
-        var ids = matches.Select(u => u.Id).ToList();
-        var deleted = matches.Select(u => new { u.Id, u.FullName, u.UserName, u.Email }).ToList();
-
-        await _uow.BeginAsync();
-        try
-        {
-            _dbContext.Recovery.RemoveRange(_dbContext.Recovery.Where(r => r.UserId != null && ids.Contains(r.UserId.Value)));
-            _dbContext.AuthEventLogs.RemoveRange(_dbContext.AuthEventLogs.Where(l => l.UserId != null && ids.Contains(l.UserId.Value)));
-            _dbContext.Users.RemoveRange(matches);
-
-            await _uow.CommitAsync();
-
-            return new { deletedCount = deleted.Count, deleted };
-        }
-        catch
-        {
-            await _uow.RollbackAsync();
-            throw;
-        }
-    }
-
 }