@ackplus/nest-auth 1.1.18 → 1.1.20

package/src/lib/auth/services/auth.service.js

@@ -30,8 +30,10 @@ const debug_logger_service_1 = require("../../core/services/debug-logger.service
 const moment_1 = tslib_1.__importDefault(require("moment"));
 const auth_config_service_1 = require("../../core/services/auth-config.service");
 const cookie_helper_1 = require("../../utils/cookie.helper");
+const user_password_changed_event_1 = require("../events/user-password-changed.event");
+const user_service_1 = require("../../user/services/user.service");
 let AuthService = class AuthService {
-    constructor(userRepository, otpRepository, authProviderRegistry, mfaService, sessionManager, jwtService, eventEmitter, tenantService, debugLogger, authConfigService) {
+    constructor(userRepository, otpRepository, authProviderRegistry, mfaService, sessionManager, jwtService, eventEmitter, tenantService, debugLogger, authConfigService, userService) {
         this.userRepository = userRepository;
         this.otpRepository = otpRepository;
         this.authProviderRegistry = authProviderRegistry;
@@ -42,6 +44,7 @@ let AuthService = class AuthService {
         this.tenantService = tenantService;
         this.debugLogger = debugLogger;
         this.authConfigService = authConfigService;
+        this.userService = userService;
     }
     getUserWithRolesAndPermissions(userId, relations = []) {
         return this.userRepository.findOne({
@@ -57,14 +60,23 @@ let AuthService = class AuthService {
         if (!user) {
             return null;
         }
-        return this.getUserWithRolesAndPermissions(user.id);
+        const fullUser = await this.getUserWithRolesAndPermissions(user.id);
+        // Apply user.serialize hook if configured
+        const config = this.authConfigService.getConfig();
+        if (config.user?.serialize) {
+            return await config.user.serialize(fullUser);
+        }
+        return fullUser;
     }
     async signup(input) {
         this.debugLogger.logFunctionEntry('signup', 'AuthService', { email: input.email, phone: input.phone, hasPassword: !!input.password });
         try {
             const config = this.authConfigService.getConfig();
             if (config.registration?.enabled === false) {
-                throw new common_1.ForbiddenException('Registration is disabled');
+                throw new common_1.ForbiddenException({
+                    message: 'Registration is disabled',
+                    code: auth_constants_1.ERROR_CODES.REGISTRATION_DISABLED,
+                });
             }
             const { email, phone, password } = input;
             let { tenantId = null } = input;
@@ -73,7 +85,10 @@ let AuthService = class AuthService {
             this.debugLogger.logAuthOperation('signup', 'email|phone', undefined, { email, phone, resolvedTenantId: tenantId });
             if (!email && !phone) {
                 this.debugLogger.error('Signup failed: Neither email nor phone provided', 'AuthService');
-                throw new common_1.BadRequestException('Either email or phone must be provided');
+                throw new common_1.BadRequestException({
+                    message: 'Either email or phone must be provided',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_OR_PHONE_REQUIRED,
+                });
             }
             let provider = null;
             let providerUserId = null;
@@ -87,31 +102,42 @@ let AuthService = class AuthService {
             }
             if (!provider) {
                 this.debugLogger.error('Provider not found for signup', 'AuthService', { email: !!email, phone: !!phone });
-                throw new common_1.InternalServerErrorException('Phone or email authentication is not enabled');
+                throw new common_1.InternalServerErrorException({
+                    message: 'Phone or email authentication is not enabled',
+                    code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                });
             }
             this.debugLogger.debug('Checking for existing identity', 'AuthService', { providerUserId });
             const identity = await provider.findIdentity(providerUserId);
             if (identity) {
                 this.debugLogger.warn('Identity already exists', 'AuthService', { email: !!email, phone: !!phone, tenantId });
                 if (email) {
-                    throw new common_1.BadRequestException('Email already exists in this tenant');
+                    throw new common_1.BadRequestException({
+                        message: 'Email already exists in this tenant',
+                        code: auth_constants_1.ERROR_CODES.EMAIL_ALREADY_EXISTS,
+                    });
                 }
                 if (phone) {
-                    throw new common_1.BadRequestException('Phone number already exists in this tenant');
+                    throw new common_1.BadRequestException({
+                        message: 'Phone number already exists in this tenant',
+                        code: auth_constants_1.ERROR_CODES.PHONE_ALREADY_EXISTS,
+                    });
                 }
             }
-            this.debugLogger.debug('Creating new user', 'AuthService', { email: !!email, phone: !!phone, tenantId });
-            let user = this.userRepository.create({
+            this.debugLogger.debug('Creating new user via UserService', 'AuthService', { email: !!email, phone: !!phone, tenantId });
+            // Use UserService to create user, which handles hooks and password hashing
+            // We pass the plain password, UserService will hash it if provided
+            let user = await this.userService.createUser({
                 email,
                 phone,
                 tenantId,
                 isVerified: false,
-            });
-            await user.setPassword(password);
-            await this.userRepository.save(user);
+                password
+            }, input);
             this.debugLogger.info('User created successfully', 'AuthService', { userId: user.id, tenantId });
             user = await this.getUserWithRolesAndPermissions(user.id);
             this.debugLogger.debug('Linking user to provider', 'AuthService', { userId: user.id, providerName: provider.providerName });
+            // Note: UserService might have already created the identity, but we ensure it's linked here
             await provider.linkToUser(user.id, providerUserId);
             this.debugLogger.debug('Creating session for new user', 'AuthService', { userId: user.id });
             const session = await this.sessionManager.createSessionFromUser(user);
@@ -130,14 +156,21 @@ let AuthService = class AuthService {
                 isRequiresMfa
             }));
             this.debugLogger.logFunctionExit('signup', 'AuthService', { userId: user.id, isRequiresMfa });
-            return {
+            // Build default response
+            let response = {
                 accessToken: tokens.accessToken,
                 refreshToken: tokens.refreshToken,
                 isRequiresMfa: isRequiresMfa,
             };
+            // Apply auth.transformResponse hook if configured
+            if (config.auth?.transformResponse) {
+                response = await config.auth.transformResponse(response, user, session);
+            }
+            return response;
         }
         catch (error) {
             this.debugLogger.logError(error, 'signup', { email: input.email, phone: input.phone });
+            this.handleError(error, 'signup');
             throw error;
         }
     }
@@ -145,76 +178,100 @@ let AuthService = class AuthService {
         const { credentials, providerName, createUserIfNotExists = false } = input;
         this.debugLogger.logFunctionEntry('login', 'AuthService', { providerName, createUserIfNotExists });
         let { tenantId = null } = input;
-        // Resolve tenant ID - use provided or default
-        tenantId = await this.tenantService.resolveTenantId(tenantId);
-        this.debugLogger.logAuthOperation('login', providerName, undefined, { resolvedTenantId: tenantId, createUserIfNotExists });
-        const provider = this.authProviderRegistry.getProvider(providerName);
-        if (!provider) {
-            throw new common_1.UnauthorizedException('Invalid authentication providerName or provider is not enabled');
-        }
-        const requiredFields = provider.getRequiredFields();
-        if (!requiredFields.every(field => credentials[field])) {
-            throw new common_1.BadRequestException(`Missing ${requiredFields.join(', ')} required fields`);
-        }
-        const authProviderUser = await provider.validate(credentials);
-        const identity = await provider.findIdentity(authProviderUser.userId);
-        let user = identity?.user || null;
-        if (!user) {
-            if (!createUserIfNotExists) {
-                throw new common_1.UnauthorizedException('Invalid credentials');
+        try {
+            // Resolve tenant ID - use provided or default
+            tenantId = await this.tenantService.resolveTenantId(tenantId);
+            this.debugLogger.logAuthOperation('login', providerName, undefined, { resolvedTenantId: tenantId, createUserIfNotExists });
+            const provider = this.authProviderRegistry.getProvider(providerName);
+            if (!provider) {
+                throw new common_1.UnauthorizedException({
+                    message: 'Invalid authentication providerName or provider is not enabled',
+                    code: auth_constants_1.ERROR_CODES.INVALID_PROVIDER,
+                });
             }
-            // Create new user if not exists and link to provider
-            user = await this.handleSocialLogin(provider, authProviderUser, tenantId);
-        }
-        if (user.isActive === false) {
-            throw new common_1.UnauthorizedException({
-                message: 'Your account is suspended, please contact support',
-                code: auth_constants_1.USER_NOT_ACTIVE_ERROR,
-            });
-        }
-        user = await this.getUserWithRolesAndPermissions(user.id);
-        const session = await this.sessionManager.createSessionFromUser(user);
-        const tokens = await this.generateTokensFromSession(session);
-        let isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
-        // Check for trusted device cookie or header if MFA is required
-        if (isRequiresMfa) {
-            // Set Mfa enbale if requred for all user, set in properly in session
-            await this.sessionManager.updateSession(session.id, {
-                data: { ...session.data, isMfaEnabled: true }
-            });
-            const trustCookieName = auth_config_service_1.AuthConfigService.getOptions().mfa?.trustDeviceStorageName || auth_constants_1.NEST_AUTH_TRUST_DEVICE_KEY;
-            const req = request_context_1.RequestContext.currentRequest();
-            let trustToken = cookie_helper_1.CookieHelper.get(req, trustCookieName);
-            // If not in cookie, check header
-            if (!trustToken) {
-                trustToken = req.headers[trustCookieName];
-            }
-            if (trustToken) {
-                const isTrusted = await this.mfaService.validateTrustedDevice(user.id, trustToken);
-                if (isTrusted) {
-                    isRequiresMfa = false;
-                    // Update session to indicate MFA is verified by trust
-                    await this.sessionManager.updateSession(session.id, {
-                        data: { ...session.data, isMfaVerified: true }
+            const requiredFields = provider.getRequiredFields();
+            if (!requiredFields.every(field => credentials[field])) {
+                throw new common_1.BadRequestException({
+                    message: `Missing ${requiredFields.join(', ')} required fields`,
+                    code: auth_constants_1.ERROR_CODES.MISSING_REQUIRED_FIELDS,
+                });
+            }
+            const authProviderUser = await provider.validate(credentials);
+            const identity = await provider.findIdentity(authProviderUser.userId);
+            let user = identity?.user || null;
+            if (!user) {
+                if (!createUserIfNotExists) {
+                    throw new common_1.UnauthorizedException({
+                        message: 'Invalid credentials',
+                        code: auth_constants_1.ERROR_CODES.INVALID_CREDENTIALS,
                     });
                 }
+                // Create new user if not exists and link to provider
+                user = await this.handleSocialLogin(provider, authProviderUser, tenantId);
+            }
+            if (user.isActive === false) {
+                throw new common_1.UnauthorizedException({
+                    message: 'Your account is suspended, please contact support',
+                    code: auth_constants_1.ERROR_CODES.ACCOUNT_INACTIVE,
+                });
             }
+            user = await this.getUserWithRolesAndPermissions(user.id);
+            let isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+            user.isMfaEnabled = isRequiresMfa;
+            let session = await this.sessionManager.createSessionFromUser(user);
+            // Check for trusted device cookie or header if MFA is required
+            if (isRequiresMfa) {
+                // Set Mfa enbale if requred for all user, set in properly in session
+                await this.sessionManager.updateSession(session.id, {
+                    data: { ...session.data, isMfaEnabled: true }
+                });
+                const trustCookieName = auth_config_service_1.AuthConfigService.getOptions().mfa?.trustDeviceStorageName || auth_constants_1.NEST_AUTH_TRUST_DEVICE_KEY;
+                const req = request_context_1.RequestContext.currentRequest();
+                let trustToken = cookie_helper_1.CookieHelper.get(req, trustCookieName);
+                // If not in cookie, check header
+                if (!trustToken) {
+                    trustToken = req.headers[trustCookieName];
+                }
+                if (trustToken) {
+                    const isTrusted = await this.mfaService.validateTrustedDevice(user.id, trustToken);
+                    if (isTrusted) {
+                        isRequiresMfa = false;
+                        // Update session to indicate MFA is verified by trust
+                        session = await this.sessionManager.updateSession(session.id, {
+                            data: { ...session.data, isMfaVerified: true }
+                        });
+                    }
+                }
+            }
+            const tokens = await this.generateTokensFromSession(session);
+            // Emit login event
+            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_IN, new user_logged_in_event_1.UserLoggedInEvent({
+                user,
+                tenantId: user.tenantId,
+                input,
+                provider,
+                session,
+                tokens,
+                isRequiresMfa
+            }));
+            // Build default response
+            let response = {
+                accessToken: tokens.accessToken,
+                refreshToken: tokens.refreshToken,
+                isRequiresMfa: isRequiresMfa,
+            };
+            // Apply auth.transformResponse hook if configured
+            const config = this.authConfigService.getConfig();
+            if (config.auth?.transformResponse) {
+                response = await config.auth.transformResponse(response, user, session);
+            }
+            return response;
+        }
+        catch (error) {
+            this.debugLogger.logError(error, 'login', { providerName, createUserIfNotExists });
+            this.handleError(error, 'login');
+            throw error;
         }
-        // Emit login event
-        await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_IN, new user_logged_in_event_1.UserLoggedInEvent({
-            user,
-            tenantId: user.tenantId,
-            input,
-            provider,
-            session,
-            tokens,
-            isRequiresMfa
-        }));
-        return {
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-            isRequiresMfa: isRequiresMfa,
-        };
     }
     async verify2fa(input) {
         this.debugLogger.logFunctionEntry('verify2fa', 'AuthService', { method: input.method });
@@ -224,7 +281,7 @@ let AuthService = class AuthService {
                 this.debugLogger.error('Session not found for 2FA verification', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'Session not found',
-                    code: auth_constants_1.SESSION_NOT_FOUND_ERROR,
+                    code: auth_constants_1.ERROR_CODES.SESSION_NOT_FOUND,
                 });
             }
             this.debugLogger.debug('Verifying MFA code', 'AuthService', { userId: session.userId, method: input.method });
@@ -233,7 +290,7 @@ let AuthService = class AuthService {
                 this.debugLogger.warn('Invalid MFA code provided', 'AuthService', { userId: session.userId, method: input.method });
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid MFA code',
-                    code: auth_constants_1.INVALID_MFA_EXCEPTION_CODE,
+                    code: auth_constants_1.ERROR_CODES.MFA_CODE_INVALID,
                 });
             }
             this.debugLogger.debug('Updating session with MFA verification', 'AuthService', { sessionId: session.id });
@@ -255,7 +312,7 @@ let AuthService = class AuthService {
             // Emit 2FA verified event
             this.debugLogger.debug('Emitting 2FA verified event', 'AuthService', { userId: user.id });
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.TWO_FACTOR_VERIFIED, new user_2fa_verified_event_1.User2faVerifiedEvent({
-                user,
+                user: user,
                 tenantId: user.tenantId,
                 input,
                 session,
@@ -270,13 +327,17 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'verify2fa', { method: input.method });
+            this.handleError(error, 'mfa');
             throw error;
         }
     }
     async send2faCode(userId, method) {
         const user = await this.userRepository.findOne({ where: { id: userId } });
         if (!user) {
-            throw new common_1.UnauthorizedException('User not found');
+            throw new common_1.UnauthorizedException({
+                message: 'User not found',
+                code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+            });
         }
         await this.mfaService.sendMfaCode(user.id, method);
         return true;
@@ -309,7 +370,7 @@ let AuthService = class AuthService {
                 this.debugLogger.error('No refresh token provided', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'No refresh token provided',
-                    code: auth_constants_1.REFRESH_TOKEN_INVALID,
+                    code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
             this.debugLogger.debug('Verifying refresh token', 'AuthService');
@@ -321,20 +382,18 @@ let AuthService = class AuthService {
                 this.debugLogger.warn('Invalid or expired refresh token', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid or expired refresh token',
-                    code: auth_constants_1.REFRESH_TOKEN_EXPIRED,
+                    code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_EXPIRED,
                 });
             }
             const session = await this.sessionManager.getSession(payload.sessionId);
             if (!session) {
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid refresh token',
-                    code: auth_constants_1.REFRESH_TOKEN_INVALID,
+                    code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
-            // Generate new session
-            const newSession = await this.sessionManager.createSessionFromSession(session);
-            // Revoke old session
-            await this.sessionManager.revokeSession(session.id);
+            // Refresh existing session
+            const newSession = await this.sessionManager.refreshSession(session);
             // Generate new tokens
             this.debugLogger.debug('Generating new tokens from refreshed session', 'AuthService', { sessionId: newSession.id });
             const tokens = await this.generateTokensFromSession(newSession);
@@ -350,6 +409,7 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'refreshToken', { hasRefreshToken: !!refreshToken });
+            this.handleError(error, 'refresh');
             throw error;
         }
     }
@@ -358,20 +418,32 @@ let AuthService = class AuthService {
         try {
             const currentUser = request_context_1.RequestContext.currentUser();
             if (!currentUser?.id) {
-                throw new common_1.UnauthorizedException('User not found');
+                throw new common_1.UnauthorizedException({
+                    message: 'User not found',
+                    code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+                });
             }
             const user = await this.userRepository.findOne({
                 where: { id: currentUser.id },
             });
             if (!user) {
-                throw new common_1.UnauthorizedException('User not found');
+                throw new common_1.UnauthorizedException({
+                    message: 'User not found',
+                    code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+                });
             }
             const isValid = await user.validatePassword(input.currentPassword);
             if (!isValid) {
-                throw new common_1.BadRequestException('Current password is incorrect');
+                throw new common_1.BadRequestException({
+                    message: 'Current password is incorrect',
+                    code: auth_constants_1.ERROR_CODES.CURRENT_PASSWORD_INCORRECT,
+                });
             }
             if (input.currentPassword === input.newPassword) {
-                throw new common_1.BadRequestException('New password must be different from the current password');
+                throw new common_1.BadRequestException({
+                    message: 'New password must be different from the current password',
+                    code: auth_constants_1.ERROR_CODES.NEW_PASSWORD_SAME_AS_CURRENT,
+                });
             }
             await user.setPassword(input.newPassword);
             await this.userRepository.save(user);
@@ -380,6 +452,10 @@ let AuthService = class AuthService {
             const session = await this.sessionManager.createSessionFromUser(hydratedUser);
             const tokens = await this.generateTokensFromSession(session);
             const isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.PASSWORD_CHANGED, new user_password_changed_event_1.UserPasswordChangedEvent({
+                user,
+                initiatedBy: 'user'
+            }));
             this.debugLogger.logFunctionExit('changePassword', 'AuthService', { userId: user.id });
             return {
                 accessToken: tokens.accessToken,
@@ -389,6 +465,7 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'changePassword');
+            this.handleError(error, 'password_change');
             throw error;
         }
     }
@@ -407,17 +484,29 @@ let AuthService = class AuthService {
                 provider = this.authProviderRegistry.getProvider(auth_constants_1.EMAIL_AUTH_PROVIDER);
             }
             else {
-                throw new common_1.BadRequestException('Either email or phone must be provided');
+                throw new common_1.BadRequestException({
+                    message: 'Either email or phone must be provided',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_OR_PHONE_REQUIRED,
+                });
             }
             if (!provider) {
-                throw new common_1.BadRequestException('Phone or email authentication is not enabled');
+                throw new common_1.BadRequestException({
+                    message: 'Phone or email authentication is not enabled',
+                    code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                });
             }
             if (!provider.enabled) {
                 if (email) {
-                    throw new common_1.BadRequestException('Email authentication is not enabled');
+                    throw new common_1.BadRequestException({
+                        message: 'Email authentication is not enabled',
+                        code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                    });
                 }
                 else if (phone) {
-                    throw new common_1.BadRequestException('Phone authentication is not enabled');
+                    throw new common_1.BadRequestException({
+                        message: 'Phone authentication is not enabled',
+                        code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                    });
                 }
             }
             const identity = await provider.findIdentity(email || phone);
@@ -449,6 +538,7 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'forgotPassword', { email: input.email, phone: input.phone });
+            this.handleError(error, 'password_reset');
             throw error;
         }
     }
@@ -460,7 +550,10 @@ let AuthService = class AuthService {
             // Resolve tenant ID - use provided or default
             tenantId = await this.tenantService.resolveTenantId(tenantId);
             if (!email && !phone) {
-                throw new common_1.BadRequestException('Either email or phone must be provided');
+                throw new common_1.BadRequestException({
+                    message: 'Either email or phone must be provided',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_OR_PHONE_REQUIRED,
+                });
             }
             let provider = null;
             if (phone) {
@@ -470,11 +563,17 @@ let AuthService = class AuthService {
                 provider = this.authProviderRegistry.getProvider(auth_constants_1.EMAIL_AUTH_PROVIDER);
             }
             if (!provider) {
-                throw new common_1.BadRequestException('Phone or email authentication is not enabled');
+                throw new common_1.BadRequestException({
+                    message: 'Phone or email authentication is not enabled',
+                    code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
+                });
             }
             const identity = await provider.findIdentity(email || phone);
             if (!identity) {
-                throw new common_1.BadRequestException('Invalid reset request');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid reset request',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_INVALID_REQUEST,
+                });
             }
             const validOtp = await this.otpRepository.findOne({
                 where: {
@@ -486,10 +585,16 @@ let AuthService = class AuthService {
                 relations: ['user']
             });
             if (!validOtp) {
-                throw new common_1.BadRequestException('Invalid OTP code');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid OTP code',
+                    code: auth_constants_1.ERROR_CODES.OTP_INVALID,
+                });
             }
             if ((0, moment_1.default)(validOtp.expiresAt).isBefore(new Date())) {
-                throw new common_1.BadRequestException('OTP code expired');
+                throw new common_1.BadRequestException({
+                    message: 'OTP code expired',
+                    code: auth_constants_1.ERROR_CODES.OTP_EXPIRED,
+                });
             }
             const user = validOtp.user;
             // Generate JWT-based password reset token
@@ -510,6 +615,7 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'verifyForgotPasswordOtp', { email: input.email, phone: input.phone });
+            this.handleError(error, 'password_reset');
             throw error;
         }
     }
@@ -521,7 +627,10 @@ let AuthService = class AuthService {
             // Resolve tenant ID - use provided or default
             tenantId = await this.tenantService.resolveTenantId(tenantId);
             if (!email && !phone) {
-                throw new common_1.BadRequestException('Either email or phone must be provided');
+                throw new common_1.BadRequestException({
+                    message: 'Either email or phone must be provided',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_OR_PHONE_REQUIRED,
+                });
             }
             // Find user by email or phone
             const user = await this.userRepository.findOne({
@@ -531,7 +640,10 @@ let AuthService = class AuthService {
                 ]
             });
             if (!user) {
-                throw new common_1.BadRequestException('Invalid reset request');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid reset request',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_INVALID_REQUEST,
+                });
             }
             // Find valid OTP
             const validOtp = await this.otpRepository.findOne({
@@ -544,7 +656,10 @@ let AuthService = class AuthService {
                 }
             });
             if (!validOtp) {
-                throw new common_1.BadRequestException('Invalid or expired OTP');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid or expired OTP',
+                    code: auth_constants_1.ERROR_CODES.OTP_INVALID,
+                });
             }
             // Update password
             await user.setPassword(newPassword);
@@ -563,6 +678,7 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'resetPassword', { email: input.email, phone: input.phone });
+            this.handleError(error, 'password_reset');
             throw error;
         }
     }
@@ -576,23 +692,35 @@ let AuthService = class AuthService {
                 decoded = await this.jwtService.verifyPasswordResetToken(token);
             }
             catch (error) {
-                throw new common_1.BadRequestException('Invalid or expired reset token');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid or expired reset token',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_TOKEN_INVALID,
+                });
             }
             if (decoded.type !== 'password-reset') {
-                throw new common_1.BadRequestException('Invalid token type');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid token type',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_TOKEN_INVALID,
+                });
             }
             // Get user
             const user = await this.userRepository.findOne({
                 where: { id: decoded.userId }
             });
             if (!user) {
-                throw new common_1.BadRequestException('User not found');
+                throw new common_1.BadRequestException({
+                    message: 'User not found',
+                    code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+                });
             }
             // Verify password hasn't changed since token was issued
             // This makes the token single-use in practice
             const currentPasswordHashPrefix = user.passwordHash ? user.passwordHash.substring(0, 10) : '';
             if (decoded.passwordHashPrefix !== currentPasswordHashPrefix) {
-                throw new common_1.BadRequestException('Reset token is no longer valid');
+                throw new common_1.BadRequestException({
+                    message: 'Reset token is no longer valid',
+                    code: auth_constants_1.ERROR_CODES.PASSWORD_RESET_TOKEN_INVALID,
+                });
             }
             // Update password
             await user.setPassword(newPassword);
@@ -608,6 +736,7 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'resetPasswordWithToken');
+            this.handleError(error, 'password_reset');
             throw error;
         }
     }
@@ -616,7 +745,7 @@ let AuthService = class AuthService {
         const user = await this.getUser();
         // Emit logout event
         await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_OUT, new logged_out_event_1.LoggedOutEvent({
-            user,
+            user: user,
             tenantId: user?.tenantId,
             session,
             logoutType,
@@ -630,20 +759,25 @@ let AuthService = class AuthService {
     async logoutAll(userId, logoutType = 'user', reason) {
         const session = request_context_1.RequestContext.currentSession();
         if (!session) {
-            throw new common_1.UnauthorizedException('Session not found');
+            throw new common_1.UnauthorizedException({
+                message: 'Session not found',
+                code: auth_constants_1.ERROR_CODES.SESSION_NOT_FOUND,
+            });
         }
         const sessions = await this.sessionManager.getUserSessions(userId);
         await this.sessionManager.revokeAllUserSessions(userId);
-        const user = await this.getUser();
-        // Emit logout event
-        await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_OUT_ALL, new logged_out_all_event_1.LoggedOutAllEvent({
-            user,
-            tenantId: user?.tenantId,
-            logoutType,
-            reason,
-            currentSessionId: session.id,
-            sessions,
-        }));
+        const user = await this.userRepository.findOne({ where: { id: userId } });
+        if (user) {
+            // Emit logout event
+            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_OUT_ALL, new logged_out_all_event_1.LoggedOutAllEvent({
+                user,
+                tenantId: user.tenantId,
+                logoutType,
+                reason,
+                currentSessionId: session.id,
+                sessions,
+            }));
+        }
         return true;
     }
     async sendEmailVerification(input) {
@@ -651,14 +785,23 @@ let AuthService = class AuthService {
         try {
             const user = request_context_1.RequestContext.currentUser();
             if (!user) {
-                throw new common_1.UnauthorizedException('User not authenticated');
+                throw new common_1.UnauthorizedException({
+                    message: 'User not authenticated',
+                    code: auth_constants_1.ERROR_CODES.UNAUTHORIZED,
+                });
             }
             const fullUser = await this.getUserWithRolesAndPermissions(user.id);
             if (!fullUser.email) {
-                throw new common_1.BadRequestException('User does not have an email address');
+                throw new common_1.BadRequestException({
+                    message: 'User does not have an email address',
+                    code: auth_constants_1.ERROR_CODES.NO_EMAIL_ADDRESS,
+                });
             }
             if (fullUser.emailVerifiedAt) {
-                throw new common_1.BadRequestException('Email is already verified');
+                throw new common_1.BadRequestException({
+                    message: 'Email is already verified',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_ALREADY_VERIFIED,
+                });
             }
             // Generate OTP
             const otp = (0, otp_1.generateOtp)();
@@ -682,6 +825,7 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'sendEmailVerification');
+            this.handleError(error, 'signup'); // Assuming email verification is part of signup flow or user profile management
             throw error;
         }
     }
@@ -690,14 +834,23 @@ let AuthService = class AuthService {
         try {
             const user = request_context_1.RequestContext.currentUser();
             if (!user) {
-                throw new common_1.UnauthorizedException('User not authenticated');
+                throw new common_1.UnauthorizedException({
+                    message: 'User not authenticated',
+                    code: auth_constants_1.ERROR_CODES.UNAUTHORIZED,
+                });
             }
             const fullUser = await this.getUserWithRolesAndPermissions(user.id);
             if (!fullUser.email) {
-                throw new common_1.BadRequestException('User does not have an email address');
+                throw new common_1.BadRequestException({
+                    message: 'User does not have an email address',
+                    code: auth_constants_1.ERROR_CODES.NO_EMAIL_ADDRESS,
+                });
             }
             if (fullUser.emailVerifiedAt) {
-                throw new common_1.BadRequestException('Email is already verified');
+                throw new common_1.BadRequestException({
+                    message: 'Email is already verified',
+                    code: auth_constants_1.ERROR_CODES.EMAIL_ALREADY_VERIFIED,
+                });
             }
             // Find valid OTP
             const validOtp = await this.otpRepository.findOne({
@@ -709,10 +862,16 @@ let AuthService = class AuthService {
                 }
             });
             if (!validOtp) {
-                throw new common_1.BadRequestException('Invalid verification code');
+                throw new common_1.BadRequestException({
+                    message: 'Invalid verification code',
+                    code: auth_constants_1.ERROR_CODES.VERIFICATION_CODE_INVALID,
+                });
             }
             if ((0, moment_1.default)(validOtp.expiresAt).isBefore(new Date())) {
-                throw new common_1.BadRequestException('Verification code has expired');
+                throw new common_1.BadRequestException({
+                    message: 'Verification code has expired',
+                    code: auth_constants_1.ERROR_CODES.VERIFICATION_CODE_EXPIRED,
+                });
             }
             // Mark OTP as used
             validOtp.used = true;
@@ -731,11 +890,12 @@ let AuthService = class AuthService {
         }
         catch (error) {
             this.debugLogger.logError(error, 'verifyEmail');
+            this.handleError(error, 'signup'); // Assuming email verification is part of signup flow or user profile management
             throw error;
         }
     }
-    generateTokensPayload(session, otherPayload = {}) {
-        const payload = {
+    async generateTokensPayload(session, otherPayload = {}) {
+        let payload = {
             id: session.userId,
             sub: session.userId,
             sessionId: session.id,
@@ -748,10 +908,29 @@ let AuthService = class AuthService {
             isMfaVerified: session.data?.isMfaVerified,
             ...otherPayload,
         };
+        // Apply custom token payload hook if configured
+        const config = this.authConfigService.getConfig();
+        if (config.session?.customizeTokenPayload) {
+            payload = await config.session.customizeTokenPayload(payload, session);
+        }
         return payload;
     }
+    /**
+     * Handle errors using the errorHandler hook if configured
+     */
+    handleError(error, context) {
+        const config = this.authConfigService.getConfig();
+        if (config.errorHandler) {
+            // The hook can throw a new error or return a modified one
+            // If it returns, we throw that. If it throws, it propagates.
+            const result = config.errorHandler(error, context);
+            if (result) {
+                throw result;
+            }
+        }
+    }
     async generateTokensFromSession(session) {
-        const payload = this.generateTokensPayload(session);
+        const payload = await this.generateTokensPayload(session);
         const tokens = await this.jwtService.generateTokens(payload);
         return tokens;
     }
@@ -770,5 +949,6 @@ exports.AuthService = AuthService = tslib_1.__decorate([
         event_emitter_1.EventEmitter2,
         tenant_service_1.TenantService,
         debug_logger_service_1.DebugLoggerService,
-        auth_config_service_1.AuthConfigService])
+        auth_config_service_1.AuthConfigService,
+        user_service_1.UserService])
 ], AuthService);