@ackplus/nest-auth 2.0.0-beta.10 → 2.0.0-beta.13

package/dist/lib/auth/events/user-logged-in.event.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-logged-in.event.js","sourceRoot":"","sources":["../../../../src/lib/auth/events/user-logged-in.event.ts"],"names":[],"mappings":";;;AAiBA,MAAa,iBAAiB;IAEN;IADpB,YACoB,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;CACR;AAJD,8CAIC"}
+{"version":3,"file":"user-logged-in.event.js","sourceRoot":"","sources":["../../../../src/lib/auth/events/user-logged-in.event.ts"],"names":[],"mappings":";;;AAmBA,MAAa,iBAAiB;IAEN;IADpB,YACoB,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;IACjD,CAAC;CACR;AAJD,8CAIC"}

package/dist/lib/auth/events/user-registered.event.d.ts

@@ -1,10 +1,11 @@
 import { NestAuthUser } from "../../user/entities/user.entity";
 import { AuthTokensResponseDto } from "../dto/responses/auth.response.dto";
 import { NestAuthSignupRequestDto } from '../dto/requests/signup.request.dto';
-import { SessionPayload } from "../../core";
+import { NestAuthUserAccess, SessionPayload } from "../../core";
 import { BaseAuthProvider } from "../../core/providers/base-auth.provider";
 export interface UserRegisteredEventPayload {
     user: NestAuthUser;
+    userAccess: NestAuthUserAccess;
     tenantId?: string;
     input: NestAuthSignupRequestDto;
     provider: BaseAuthProvider;

package/dist/lib/auth/events/user-registered.event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-registered.event.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/events/user-registered.event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAE3E,MAAM,WAAW,0BAA0B;IACvC,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,wBAAwB,CAAC;IAChC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,aAAa,EAAE,OAAO,CAAC;CAC1B;AAGD,qBAAa,mBAAmB;aAER,OAAO,EAAE,0BAA0B;gBAAnC,OAAO,EAAE,0BAA0B;CAE1D"}
+{"version":3,"file":"user-registered.event.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/events/user-registered.event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAE3E,MAAM,WAAW,0BAA0B;IACvC,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,wBAAwB,CAAC;IAChC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,aAAa,EAAE,OAAO,CAAC;CAC1B;AAGD,qBAAa,mBAAmB;aAER,OAAO,EAAE,0BAA0B;gBAAnC,OAAO,EAAE,0BAA0B;CAE1D"}

package/dist/lib/auth/events/user-registered.event.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-registered.event.js","sourceRoot":"","sources":["../../../../src/lib/auth/events/user-registered.event.ts"],"names":[],"mappings":";;;AAkBA,MAAa,mBAAmB;IAER;IADpB,YACoB,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;IACnD,CAAC;CACR;AAJD,kDAIC"}
+{"version":3,"file":"user-registered.event.js","sourceRoot":"","sources":["../../../../src/lib/auth/events/user-registered.event.ts"],"names":[],"mappings":";;;AAmBA,MAAa,mBAAmB;IAER;IADpB,YACoB,OAAmC;QAAnC,YAAO,GAAP,OAAO,CAA4B;IACnD,CAAC;CACR;AAJD,kDAIC"}

package/dist/lib/auth/services/auth.service.d.ts

@@ -18,6 +18,8 @@ import { AuthTokensResponseDto } from '../dto/responses/auth.response.dto';
 import { UserService } from '../../user/services/user.service';
 import { ITenantContextService } from '../../tenant/tenant-context/tenant-context.interface';
 import { OtpFlowService } from './otp-flow.service';
+import { NestAuthUserAccess } from '../../user/entities/user-access.entity';
+import { NestAuthPlatformAccess } from '../../user/entities/platform-access.entity';
 export declare class AuthService {
     private readonly userRepository;
     private readonly authProviderRegistry;
@@ -34,7 +36,11 @@ export declare class AuthService {
     private readonly authConfig;
     constructor(userRepository: Repository<NestAuthUser>, authProviderRegistry: AuthProviderRegistryService, mfaService: MfaService, sessionManager: SessionManagerService, jwtService: JwtService, eventEmitter: EventEmitter2, tenantService: TenantService, debugLogger: DebugLoggerService, authConfigService: AuthConfigService, userService: UserService, otpFlow: OtpFlowService, tenantContext: ITenantContextService);
     getUserWithRoles(userId: string, relations?: string[]): Promise<NestAuthUser>;
-    getUser(): Promise<any>;
+    getUserWithAccess(userId: string, tenantId: string, isPlatformAccess?: boolean): Promise<{
+        user: NestAuthUser;
+        userAccess?: NestAuthUserAccess;
+        platformAccess?: NestAuthPlatformAccess;
+    }>;
     signup(input: NestAuthSignupRequestDto): Promise<AuthResponseDto>;
     login(input: NestAuthLoginRequestDto): Promise<AuthResponseDto>;
     private resolveOrCreateUserForSend;
@@ -53,7 +59,6 @@ export declare class AuthService {
     refreshToken(refreshToken: string): Promise<import("../dto/responses/auth.response.dto").AuthWithTokensResponseDto>;
     logout(logoutType?: 'user' | 'admin' | 'system', reason?: string): Promise<boolean>;
     logoutAll(userId: string, logoutType?: 'user' | 'admin' | 'system', reason?: string): Promise<boolean>;
-    private getTenantMode;
     private ensureTenantAccess;
     private generateTokensPayload;
     private handleError;

package/dist/lib/auth/services/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/services/auth.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAS/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAuC,MAAM,8BAA8B,CAAC;AAS1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAI7F,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAMpD,qBACa,WAAW;IAMhB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IA3BlC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;gBAI3B,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,EAExC,oBAAoB,EAAE,2BAA2B,EAEjD,UAAU,EAAE,UAAU,EAEtB,cAAc,EAAE,qBAAqB,EAErC,UAAU,EAAE,UAAU,EAEtB,YAAY,EAAE,aAAa,EAE3B,aAAa,EAAE,aAAa,EAE5B,WAAW,EAAE,kBAAkB,EAE/B,iBAAiB,EAAE,iBAAiB,EAEpC,WAAW,EAAE,WAAW,EAExB,OAAO,EAAE,cAAc,EAGvB,aAAa,EAAE,qBAAqB;IAOzD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IAW3E,OAAO;IAgBP,MAAM,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC;IAiLjE,KAAK,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;YA2JvD,0BAA0B;IA0FlC,gBAAgB,CAAC,KAAK,EAAE;QAC1B,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,GAAG,KAAK,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA2C1B,SAAS,CAAC,KAAK,EAAE,2BAA2B;IAwE5C,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IAwDhE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB;YAejD,iBAAiB;YAwDjB,wBAAwB;IA4BhC,YAAY,CAAC,YAAY,EAAE,MAAM;IA4HjC,MAAM,CAAC,UAAU,GAAE,MAAM,GAAG,OAAO,GAAG,QAAiB,EAAE,MAAM,CAAC,EAAE,MAAM;IAwBxE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,GAAG,OAAO,GAAG,QAAiB,EAAE,MAAM,CAAC,EAAE,MAAM;IA0BjG,OAAO,CAAC,aAAa;YAMP,kBAAkB;YAqBlB,qBAAqB;IA4BnC,OAAO,CAAC,WAAW;IAYb,yBAAyB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAMnF,oBAAoB,CACtB,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACrD,aAAa,EAAE,OAAO,EACtB,UAAU,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,CAAC;YAqFb,kBAAkB;CAgBnC"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/auth/services/auth.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAiB,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAS/D,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAuC,MAAM,8BAA8B,CAAC;AAS1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yCAAyC,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAE/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAI7F,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAGpF,qBACa,WAAW;IAMhB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAErC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAElC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IA3BlC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;gBAI3B,cAAc,EAAE,UAAU,CAAC,YAAY,CAAC,EAExC,oBAAoB,EAAE,2BAA2B,EAEjD,UAAU,EAAE,UAAU,EAEtB,cAAc,EAAE,qBAAqB,EAErC,UAAU,EAAE,UAAU,EAEtB,YAAY,EAAE,aAAa,EAE3B,aAAa,EAAE,aAAa,EAE5B,WAAW,EAAE,kBAAkB,EAE/B,iBAAiB,EAAE,iBAAiB,EAEpC,WAAW,EAAE,WAAW,EAExB,OAAO,EAAE,cAAc,EAGvB,aAAa,EAAE,qBAAqB;IAOzD,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,GAAE,MAAM,EAAO,GAAG,OAAO,CAAC,YAAY,CAAC;IAU3E,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,UAAQ,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;QAAC,cAAc,CAAC,EAAE,sBAAsB,CAAA;KAAE,CAAC;IA0BxL,MAAM,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,eAAe,CAAC;IA6KjE,KAAK,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,eAAe,CAAC;YAuJvD,0BAA0B;IA0FlC,gBAAgB,CAAC,KAAK,EAAE;QAC1B,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,OAAO,GAAG,KAAK,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IA2C1B,SAAS,CAAC,KAAK,EAAE,2BAA2B;IAsE5C,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC;IA2ChE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB;YAejD,iBAAiB;YAwDjB,wBAAwB;IA4BhC,YAAY,CAAC,YAAY,EAAE,MAAM;IAqJjC,MAAM,CAAC,UAAU,GAAE,MAAM,GAAG,OAAO,GAAG,QAAiB,EAAE,MAAM,CAAC,EAAE,MAAM;IAwBxE,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,GAAG,OAAO,GAAG,QAAiB,EAAE,MAAM,CAAC,EAAE,MAAM;YAyBnF,kBAAkB;YAqBlB,qBAAqB;IA4BnC,OAAO,CAAC,WAAW;IAYb,yBAAyB,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAMnF,oBAAoB,CACtB,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,GAAG,EACZ,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACrD,aAAa,EAAE,OAAO,EACtB,UAAU,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,CAAC;YA2Db,kBAAkB;CAgBnC"}

package/dist/lib/auth/services/auth.service.js

@@ -44,6 +44,8 @@ const utils_1 = require("../../utils");
 const otp_flow_service_1 = require("./otp-flow.service");
 const passwordless_code_requested_event_1 = require("../events/passwordless-code-requested.event");
 const lodash_1 = require("lodash");
+const user_access_entity_1 = require("../../user/entities/user-access.entity");
+const platform_access_entity_1 = require("../../user/entities/platform-access.entity");
 let AuthService = class AuthService {
     userRepository;
     authProviderRegistry;
@@ -83,17 +85,29 @@ let AuthService = class AuthService {
             ],
         });
     }
-    async getUser() {
-        const user = await request_context_1.RequestContext.currentUser();
-        if (!user) {
-            return null;
-        }
-        const fullUser = await this.getUserWithRoles(user.id);
-        let serializedUser = fullUser;
-        if (this.authConfig.user?.serialize) {
-            serializedUser = await this.authConfig.user.serialize(fullUser);
+    async getUserWithAccess(userId, tenantId, isPlatformAccess = false) {
+        const user = await this.userRepository.findOne({
+            where: {
+                id: userId,
+                ...(tenantId ? { userAccesses: { tenantId } } : {}),
+            }
+        });
+        if (isPlatformAccess) {
+            const platformAccess = await platform_access_entity_1.NestAuthPlatformAccess.findOne({
+                where: { userId, isActive: true },
+                relations: ['roles', 'roles.rolePermissions', 'roles.rolePermissions.permission'],
+            });
+            return { user, platformAccess };
         }
-        return serializedUser;
+        const userAccess = await user_access_entity_1.NestAuthUserAccess.findOne({
+            where: {
+                userId,
+                isActive: true,
+                tenantId: tenantId ? (0, typeorm_2.Equal)(tenantId) : (0, typeorm_2.IsNull)(),
+            },
+            relations: ['roles', 'roles.rolePermissions', 'roles.rolePermissions.permission'],
+        });
+        return { user, userAccess };
     }
     async signup(input) {
         this.debugLogger.logFunctionEntry('signup', 'AuthService', { email: input.email, phone: input.phone, hasPassword: !!input.password });
@@ -141,11 +155,9 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
                 });
             }
-            console.log('providersToLink', providersToLink);
             for (const item of providersToLink) {
-                this.debugLogger.debug('Checking for existing identity', 'AuthService', { providerId: item.providerId, type: item.type });
-                const identity = await item.provider.findIdentity(item.providerId, (tenantMode === nest_auth_contracts_1.TenantModeEnum.ISOLATED && tenetEnabled) ? tenantId : undefined);
-                console.log('identity', identity);
+                const requiredTenantId = this.tenantService.checkRequiredTenant(tenantId);
+                const identity = await item.provider.findIdentity(item.providerId, requiredTenantId ? tenantId : undefined);
                 if (identity) {
                     this.debugLogger.warn('Identity already exists', 'AuthService', { email: !!email, phone: !!phone, tenantId });
                     if (item.type === 'email') {
@@ -163,7 +175,7 @@ let AuthService = class AuthService {
                 }
             }
             this.debugLogger.debug('Creating new user via UserService', 'AuthService', { email: !!email, phone: !!phone, tenantId });
-            let user = await this.userService.createUser({
+            const user = await this.userService.createUser({
                 email,
                 phone,
                 isVerified: false,
@@ -177,15 +189,11 @@ let AuthService = class AuthService {
             if (this.authConfig.registrationHooks?.onSignup) {
                 this.debugLogger.debug('Applying registrationHooks.onSignup hook', 'AuthService', { userId: user.id });
                 const request = request_context_1.RequestContext.currentRequest();
-                const modifiedUser = await this.authConfig.registrationHooks.onSignup(user, input, { request });
-                if (modifiedUser) {
-                    user = modifiedUser;
-                }
+                await this.authConfig.registrationHooks.onSignup(user, input, { request });
             }
-            user = await this.getUserWithRoles(user.id, ['userAccesses', 'userAccesses.roles', 'userAccesses.tenant']);
-            const userRoles = user.userAccesses?.map(access => access.roles).flat();
+            const { user: authUser, userAccess } = await this.getUserWithAccess(user.id, tenantId);
             if (input?.guard) {
-                const isExistsGuard = userRoles?.some(r => r.guard === input.guard);
+                const isExistsGuard = userAccess?.roles?.some(r => r?.guard === input.guard);
                 if (!isExistsGuard) {
                     await this.userService.deleteUser(user.id);
                     throw new common_1.UnauthorizedException({
@@ -194,15 +202,16 @@ let AuthService = class AuthService {
                     });
                 }
             }
-            this.debugLogger.debug('Creating session for new user', 'AuthService', { userId: user.id });
-            const session = await this.sessionManager.createSessionFromUser(user, { tenantId });
+            this.debugLogger.debug('Creating session for new user', 'AuthService', { userId: authUser.id });
+            const session = await this.sessionManager.createSessionFromUser(authUser, userAccess, { tenantId });
             const tokens = await this.generateTokensFromSession(session);
-            const isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
-            this.debugLogger.debug('Signup tokens generated', 'AuthService', { userId: user.id, isRequiresMfa });
-            this.debugLogger.debug('Emitting user registration event', 'AuthService', { userId: user.id });
+            const isRequiresMfa = await this.mfaService.isRequiresMfa(authUser.id);
+            this.debugLogger.debug('Signup tokens generated', 'AuthService', { userId: authUser.id, isRequiresMfa });
+            this.debugLogger.debug('Emitting user registration event', 'AuthService', { userId: authUser.id });
             const provider = providersToLink[0]?.provider;
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.REGISTERED, new user_registered_event_1.UserRegisteredEvent({
-                user,
+                user: authUser,
+                userAccess,
                 tenantId,
                 input,
                 provider,
@@ -220,7 +229,7 @@ let AuthService = class AuthService {
                     isRequiresMfa: false,
                 };
             }
-            return this.generateAuthResponse(user, session, tokens, isRequiresMfa, undefined);
+            return this.generateAuthResponse(authUser, session, tokens, isRequiresMfa, undefined);
         }
         catch (error) {
             this.debugLogger.logError(error, 'signup', { email: input.email, phone: input.phone });
@@ -274,15 +283,14 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.ACCOUNT_INACTIVE,
                 });
             }
-            user = await this.getUserWithRoles(user.id, ['userAccesses.tenant']);
+            const { user: authUser, userAccess, platformAccess } = await this.getUserWithAccess(user.id, resolvedTenantId, isPlatformAccess);
             if (this.authConfig.loginHooks?.onLogin) {
-                this.debugLogger.debug('Applying loginHooks.onLogin hook', 'AuthService', { userId: user.id });
+                this.debugLogger.debug('Applying loginHooks.onLogin hook', 'AuthService', { userId: authUser.id });
                 const request = request_context_1.RequestContext.currentRequest();
-                await this.authConfig.loginHooks.onLogin(user, input, { request, provider });
+                await this.authConfig.loginHooks.onLogin(authUser, input, { request, provider });
             }
             if (isPlatformAccess) {
-                const isPlatformAdmin = await access_role_resolver_util_1.AccessRoleResolver.isPlatformAdminUser(user.id);
-                if (!isPlatformAdmin) {
+                if (authUser && !platformAccess) {
                     throw new common_1.ForbiddenException({
                         message: 'Only platform admins can login',
                         code: auth_constants_1.ERROR_CODES.ACCESS_DENIED,
@@ -290,26 +298,21 @@ let AuthService = class AuthService {
                 }
             }
             else {
-                await this.ensureTenantAccess(user, resolvedTenantId, createUserIfNotExists);
+                await this.ensureTenantAccess(authUser, resolvedTenantId, createUserIfNotExists);
             }
             let isRequiresMfa = false;
             let isTrusted = false;
             if (!provider.skipMfa) {
-                isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+                isRequiresMfa = await this.mfaService.isRequiresMfa(authUser.id);
             }
             user.isMfaEnabled = isRequiresMfa;
             if (guard) {
                 let guardRoles = [];
                 if (isPlatformAccess) {
-                    const { roles } = await access_role_resolver_util_1.AccessRoleResolver.resolvePlatformAccessRolesAndPermissions(user.id);
-                    guardRoles = roles;
+                    guardRoles = platformAccess?.roles ?? [];
                 }
                 else {
-                    const { roles } = await access_role_resolver_util_1.AccessRoleResolver.resolveRolesAndPermissionsForTenantContext({
-                        userId: user.id,
-                        tenantId: resolvedTenantId ?? null,
-                    });
-                    guardRoles = roles;
+                    guardRoles = userAccess?.roles ?? [];
                 }
                 const isExistsGuard = guardRoles.some(r => r.guard === guard);
                 if (!isExistsGuard) {
@@ -319,8 +322,9 @@ let AuthService = class AuthService {
                     });
                 }
             }
-            let session = await this.sessionManager.createSessionFromUser(user, {
+            let session = await this.sessionManager.createSessionFromUser(authUser, userAccess, {
                 tenantId: resolvedTenantId,
+                platformAccess: platformAccess,
                 isPlatformAccess: isPlatformAccess ?? false
             });
             if (isRequiresMfa) {
@@ -334,7 +338,9 @@ let AuthService = class AuthService {
             }
             const tokens = await this.generateTokensFromSession(session);
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_IN, new user_logged_in_event_1.UserLoggedInEvent({
-                user,
+                user: authUser,
+                userAccess,
+                platformAccess,
                 tenantId,
                 input,
                 provider,
@@ -342,7 +348,7 @@ let AuthService = class AuthService {
                 tokens,
                 isRequiresMfa
             }));
-            return this.generateAuthResponse(user, session, tokens, isRequiresMfa);
+            return this.generateAuthResponse(authUser, session, tokens, isRequiresMfa);
         }
         catch (error) {
             this.debugLogger.logError(error, 'login', { providerName, createUserIfNotExists });
@@ -461,9 +467,9 @@ let AuthService = class AuthService {
     async verify2fa(input) {
         this.debugLogger.logFunctionEntry('verify2fa', 'AuthService', { method: input.method });
         try {
+            let user = await request_context_1.RequestContext.currentUser();
             const session = request_context_1.RequestContext.currentSession();
             if (!session) {
-                this.debugLogger.error('Session not found for 2FA verification', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'Session not found',
                     code: auth_constants_1.ERROR_CODES.SESSION_NOT_FOUND,
@@ -472,13 +478,11 @@ let AuthService = class AuthService {
             this.debugLogger.debug('Verifying MFA code', 'AuthService', { userId: session.userId, method: input.method });
             const isValid = await this.mfaService.verifyMfa(session.userId, input.otp, input.method);
             if (!isValid) {
-                this.debugLogger.warn('Invalid MFA code provided', 'AuthService', { userId: session.userId, method: input.method });
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid MFA code',
                     code: auth_constants_1.ERROR_CODES.MFA_CODE_INVALID,
                 });
             }
-            this.debugLogger.debug('Updating session with MFA verification', 'AuthService', { sessionId: session.id });
             const payload = await this.sessionManager.updateSession(session.id, {
                 data: {
                     ...session.data,
@@ -495,10 +499,12 @@ let AuthService = class AuthService {
                     trustToken = await this.mfaService.createTrustedDevice(session.userId, userAgent, ip);
                 }
             }
-            const user = await this.getUser();
+            if (!user) {
+                return null;
+            }
             this.debugLogger.debug('Emitting 2FA verified event', 'AuthService', { userId: user.id });
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.TWO_FACTOR_VERIFIED, new user_2fa_verified_event_1.User2faVerifiedEvent({
-                user: user,
+                user,
                 tenantId: payload.data?.tenantId ?? user?.tenantId,
                 input,
                 session: payload,
@@ -522,16 +528,7 @@ let AuthService = class AuthService {
             });
         }
         const resolvedTenantId = await this.tenantService.resolveTenantId(tenantId || null);
-        const user = await this.userRepository.findOne({
-            where: { id: session.userId },
-            relations: [
-                'userAccesses',
-                'userAccesses.tenant',
-                'userAccesses.roles',
-                'userAccesses.roles.rolePermissions',
-                'userAccesses.roles.rolePermissions.permission',
-            ],
-        });
+        const { user, userAccess } = await this.getUserWithAccess(session.userId, resolvedTenantId);
         if (!user) {
             throw new common_1.UnauthorizedException({
                 message: 'User not found',
@@ -539,11 +536,7 @@ let AuthService = class AuthService {
             });
         }
         await this.ensureTenantAccess(user, resolvedTenantId, false);
-        const accessForTenant = (user.userAccesses ?? []).find((a) => {
-            const aTenantId = a?.tenantId ?? null;
-            return aTenantId === (resolvedTenantId ?? null);
-        });
-        const rolesWithPermissions = accessForTenant?.roles ?? [];
+        const rolesWithPermissions = userAccess?.roles ?? [];
         const permissions = (0, lodash_1.chain)(rolesWithPermissions)
             .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
             .flatten()
@@ -640,6 +633,7 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
+            const isPlatformAccess = await access_role_resolver_util_1.AccessRoleResolver.isPlatformAccess();
             this.debugLogger.debug('Verifying refresh token', 'AuthService');
             let payload;
             try {
@@ -665,16 +659,7 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
-            const user = await this.userRepository.findOne({
-                where: { id: session.userId },
-                relations: [
-                    'userAccesses',
-                    'userAccesses.roles',
-                    'userAccesses.roles.rolePermissions',
-                    'userAccesses.roles.rolePermissions.permission',
-                    'userAccesses.tenant'
-                ]
-            });
+            const { user, userAccess, platformAccess } = await this.getUserWithAccess(session.userId, session.data?.tenantId ?? null, isPlatformAccess);
             if (!user) {
                 await this.sessionManager.revokeSession(session.id);
                 throw new common_1.UnauthorizedException({
@@ -690,19 +675,47 @@ let AuthService = class AuthService {
                 });
             }
             const tenantId = session.data?.tenantId ?? null;
-            try {
-                await this.ensureTenantAccess(user, tenantId, false);
+            if (!isPlatformAccess && !userAccess) {
+                try {
+                    await this.ensureTenantAccess(user, tenantId, false);
+                }
+                catch (error) {
+                    await this.sessionManager.revokeSession(session.id);
+                    throw error;
+                }
             }
-            catch (e) {
+            if (isPlatformAccess && !platformAccess) {
                 await this.sessionManager.revokeSession(session.id);
-                throw e;
+                throw new common_1.UnauthorizedException({
+                    message: 'You are not authorized to platform access',
+                    code: auth_constants_1.ERROR_CODES.ACCESS_DENIED,
+                });
             }
             const isMfaVerified = !!session.data?.isMfaVerified;
-            const freshSessionData = await this.buildSessionDataFromUser({
+            let roles = [];
+            if (isPlatformAccess) {
+                roles = platformAccess?.roles ?? [];
+            }
+            else {
+                roles = userAccess?.roles ?? [];
+            }
+            const permissions = (0, lodash_1.chain)(roles)
+                .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
+                .flatten()
+                .uniq()
+                .value();
+            let freshSessionData = {
                 user,
-                tenantId,
                 isMfaVerified,
-            });
+                roles: roles.map((role) => (0, role_mapper_util_1.mapRoleToSessionSnapshot)(role)),
+                permissions,
+                tenantId,
+                isPlatformAccess: isPlatformAccess ?? false,
+            };
+            const customize = auth_config_service_1.AuthConfigService.getOptions().session?.customizeSessionData;
+            if (customize) {
+                freshSessionData = await customize(freshSessionData, user);
+            }
             const refreshedSession = await this.sessionManager.refreshSession(session);
             const updatedSession = await this.sessionManager.updateSession(refreshedSession.id, {
                 data: {
@@ -729,10 +742,10 @@ let AuthService = class AuthService {
     }
     async logout(logoutType = 'user', reason) {
         const session = request_context_1.RequestContext.currentSession();
-        const user = await this.getUser();
+        const user = await request_context_1.RequestContext.currentUser();
         if (session) {
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_OUT, new logged_out_event_1.LoggedOutEvent({
-                user: user,
+                user,
                 tenantId: session?.data?.tenantId ?? user?.tenantId,
                 session,
                 logoutType,
@@ -757,11 +770,6 @@ let AuthService = class AuthService {
         }
         return true;
     }
-    getTenantMode() {
-        const config = this.authConfigService.getConfig();
-        const mode = config.tenant?.mode;
-        return mode === nest_auth_contracts_1.TenantModeEnum.SHARED ? nest_auth_contracts_1.TenantModeEnum.SHARED : nest_auth_contracts_1.TenantModeEnum.ISOLATED;
-    }
     async ensureTenantAccess(user, tenantId, allowAutoJoin = false) {
         if (!tenantId || !this.tenantContext.isEnabled()) {
             return;
@@ -826,31 +834,6 @@ let AuthService = class AuthService {
                 tenants = [fallbackTenant];
             }
         }
-        let userWithAccesses = user;
-        if (!user?.userAccesses?.length) {
-            userWithAccesses = await this.getUserWithRoles(user.id, [
-                'userAccesses.tenant',
-            ]);
-        }
-        const userAccesses = (userWithAccesses.userAccesses ?? []).map((access) => ({
-            id: access.id,
-            userId: access.userId,
-            tenantId: access.tenantId,
-            tenant: access.tenant ? {
-                id: access.tenant.id,
-                name: access.tenant.name,
-                slug: access.tenant.slug,
-                description: access.tenant.description,
-                metadata: access.tenant.metadata,
-                isActive: access.tenant.isActive,
-            } : undefined,
-            isActive: access.isActive,
-            isDefault: access.isDefault,
-            status: access.status,
-            metadata: access.metadata ?? {},
-            createdAt: access.createdAt,
-            updatedAt: access.updatedAt,
-        }));
         const rolesForResponse = session?.data?.roles || [];
         const roleNames = rolesForResponse?.map(r => r.name) || [];
         const permissions = session?.data?.permissions || [];
@@ -868,7 +851,6 @@ let AuthService = class AuthService {
                 permissions,
                 metadata: serializedUser.metadata,
                 tenantId: activeTenantId,
-                userAccesses,
             },
         };
         if (isRequiresMfa) {