@ackplus/nest-auth 2.0.0-beta.2 → 2.0.0-beta.21

package/dist/lib/auth/services/auth.service.js

@@ -18,6 +18,7 @@ const common_2 = require("@nestjs/common");
 const typeorm_1 = require("@nestjs/typeorm");
 const typeorm_2 = require("typeorm");
 const user_entity_1 = require("../../user/entities/user.entity");
+const access_role_resolver_util_1 = require("../../role/utils/access-role-resolver.util");
 const auth_constants_1 = require("../../auth.constants");
 const mfa_service_1 = require("./mfa.service");
 const jwt_service_1 = require("../../core/services/jwt.service");
@@ -43,6 +44,8 @@ const utils_1 = require("../../utils");
 const otp_flow_service_1 = require("./otp-flow.service");
 const passwordless_code_requested_event_1 = require("../events/passwordless-code-requested.event");
 const lodash_1 = require("lodash");
+const user_access_entity_1 = require("../../user/entities/user-access.entity");
+const platform_access_entity_1 = require("../../user/entities/platform-access.entity");
 let AuthService = class AuthService {
     userRepository;
     authProviderRegistry;
@@ -72,7 +75,7 @@ let AuthService = class AuthService {
         this.tenantContext = tenantContext;
         this.authConfig = this.authConfigService.getConfig();
     }
-    getUserWithRolesAndPermissions(userId, relations = []) {
+    getUserWithRoles(userId, relations = []) {
         return this.userRepository.findOne({
             where: { id: userId },
             relations: [
@@ -82,23 +85,32 @@ let AuthService = class AuthService {
             ],
         });
     }
-    async getUser() {
-        const user = await request_context_1.RequestContext.currentUser();
-        if (!user) {
-            return null;
-        }
-        const fullUser = await this.getUserWithRolesAndPermissions(user.id);
-        let serializedUser = fullUser;
-        if (this.authConfig.user?.serialize) {
-            serializedUser = await this.authConfig.user.serialize(fullUser);
+    async getUserWithAccess(userId, tenantId, isPlatformAccess = false) {
+        const user = await this.userRepository.findOne({
+            where: {
+                id: userId,
+                ...(tenantId ? { userAccesses: { tenantId } } : {}),
+            }
+        });
+        if (isPlatformAccess) {
+            const platformAccess = await platform_access_entity_1.NestAuthPlatformAccess.findOne({
+                where: { userId, isActive: true },
+                relations: ['roles', 'roles.rolePermissions', 'roles.rolePermissions.permission'],
+            });
+            return { user, platformAccess };
         }
-        return serializedUser;
+        const userAccess = await user_access_entity_1.NestAuthUserAccess.findOne({
+            where: {
+                userId,
+                isActive: true,
+                tenantId: tenantId ? (0, typeorm_2.Equal)(tenantId) : (0, typeorm_2.IsNull)(),
+            },
+            relations: ['roles', 'roles.rolePermissions', 'roles.rolePermissions.permission'],
+        });
+        return { user, userAccess };
     }
     async signup(input) {
         this.debugLogger.logFunctionEntry('signup', 'AuthService', { email: input.email, phone: input.phone, hasPassword: !!input.password });
-        const config = this.authConfigService.getConfig();
-        const tenantMode = config.tenant?.mode ?? nest_auth_contracts_1.TenantModeEnum.ISOLATED;
-        const tenetEnabled = config.tenant?.enabled ?? false;
         try {
             if (this.authConfig.registration?.enabled === false) {
                 throw new common_1.ForbiddenException({
@@ -140,11 +152,9 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
                 });
             }
-            console.log('providersToLink', providersToLink);
             for (const item of providersToLink) {
-                this.debugLogger.debug('Checking for existing identity', 'AuthService', { providerId: item.providerId, type: item.type });
-                const identity = await item.provider.findIdentity(item.providerId, (tenantMode === nest_auth_contracts_1.TenantModeEnum.ISOLATED && tenetEnabled) ? tenantId : undefined);
-                console.log('identity', identity);
+                const requiredTenantId = this.tenantService.checkRequiredTenant(tenantId);
+                const identity = await item.provider.findIdentity(item.providerId, requiredTenantId ? tenantId : undefined);
                 if (identity) {
                     this.debugLogger.warn('Identity already exists', 'AuthService', { email: !!email, phone: !!phone, tenantId });
                     if (item.type === 'email') {
@@ -162,10 +172,11 @@ let AuthService = class AuthService {
                 }
             }
             this.debugLogger.debug('Creating new user via UserService', 'AuthService', { email: !!email, phone: !!phone, tenantId });
-            let user = await this.userService.createUser({
+            const user = await this.userService.createUser({
                 email,
                 phone,
-                isVerified: false,
+                emailVerifiedAt: null,
+                phoneVerifiedAt: null,
                 password
             }, tenantId, input);
             this.debugLogger.info('User created successfully', 'AuthService', { userId: user.id, tenantId });
@@ -176,32 +187,19 @@ let AuthService = class AuthService {
             if (this.authConfig.registrationHooks?.onSignup) {
                 this.debugLogger.debug('Applying registrationHooks.onSignup hook', 'AuthService', { userId: user.id });
                 const request = request_context_1.RequestContext.currentRequest();
-                const modifiedUser = await this.authConfig.registrationHooks.onSignup(user, input, { request });
-                if (modifiedUser) {
-                    user = modifiedUser;
-                }
+                await this.authConfig.registrationHooks.onSignup(user, input, { request });
             }
-            user = await this.getUserWithRolesAndPermissions(user.id);
-            const userRoles = user.userAccesses?.map(access => access.roles).flat();
-            if (input?.guard) {
-                const isExistsGuard = userRoles?.some(r => r.guard === input.guard);
-                if (!isExistsGuard) {
-                    await this.userService.deleteUser(user.id);
-                    throw new common_1.UnauthorizedException({
-                        message: 'Not allowed to signup with this guard',
-                        code: auth_constants_1.ERROR_CODES.FORBIDDEN,
-                    });
-                }
-            }
-            this.debugLogger.debug('Creating session for new user', 'AuthService', { userId: user.id });
-            const session = await this.sessionManager.createSessionFromUser(user, { tenantId });
+            const { user: authUser, userAccess } = await this.getUserWithAccess(user.id, tenantId);
+            this.debugLogger.debug('Creating session for new user', 'AuthService', { userId: authUser.id });
+            const session = await this.sessionManager.createSessionFromUser(authUser, userAccess, { tenantId });
             const tokens = await this.generateTokensFromSession(session);
-            const isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
-            this.debugLogger.debug('Signup tokens generated', 'AuthService', { userId: user.id, isRequiresMfa });
-            this.debugLogger.debug('Emitting user registration event', 'AuthService', { userId: user.id });
+            const isRequiresMfa = await this.mfaService.isRequiresMfa(authUser.id);
+            this.debugLogger.debug('Signup tokens generated', 'AuthService', { userId: authUser.id, isRequiresMfa });
+            this.debugLogger.debug('Emitting user registration event', 'AuthService', { userId: authUser.id });
             const provider = providersToLink[0]?.provider;
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.REGISTERED, new user_registered_event_1.UserRegisteredEvent({
-                user,
+                user: authUser,
+                userAccess,
                 tenantId,
                 input,
                 provider,
@@ -219,7 +217,7 @@ let AuthService = class AuthService {
                     isRequiresMfa: false,
                 };
             }
-            return this.generateAuthResponse(user, session, tokens, isRequiresMfa, undefined);
+            return this.generateAuthResponse(authUser, session, tokens, isRequiresMfa, undefined);
         }
         catch (error) {
             this.debugLogger.logError(error, 'signup', { email: input.email, phone: input.phone });
@@ -229,10 +227,18 @@ let AuthService = class AuthService {
     }
     async login(input) {
         let { credentials, providerName, createUserIfNotExists = false, guard, tenantId } = input;
+        const isPlatformAccess = await access_role_resolver_util_1.AccessRoleResolver.isPlatformAccess();
         this.debugLogger.logFunctionEntry('login', 'AuthService', { providerName, createUserIfNotExists, guard, tenantId });
         try {
-            await this.tenantService.resolveTenantId(tenantId);
-            this.debugLogger.logAuthOperation('login', providerName, undefined, { resolvedTenantId: tenantId, createUserIfNotExists });
+            let resolvedTenantId = null;
+            if (isPlatformAccess) {
+                resolvedTenantId = null;
+            }
+            else {
+                await this.tenantService.resolveTenantId(tenantId);
+                resolvedTenantId = tenantId;
+            }
+            this.debugLogger.logAuthOperation('login', providerName, undefined, { tenantId, resolvedTenantId, createUserIfNotExists, isPlatformAccess });
             const provider = this.authProviderRegistry.getProvider(providerName);
             if (!provider) {
                 throw new common_1.UnauthorizedException({
@@ -247,8 +253,8 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.MISSING_REQUIRED_FIELDS,
                 });
             }
-            const authProviderUser = await provider.validate(credentials, tenantId);
-            const identity = await provider.findIdentity(authProviderUser.userId, tenantId);
+            const authProviderUser = await provider.validate(credentials, resolvedTenantId);
+            const identity = await provider.findIdentity(authProviderUser.userId, resolvedTenantId);
             let user = identity?.user || null;
             if (!user) {
                 if (!createUserIfNotExists) {
@@ -257,7 +263,7 @@ let AuthService = class AuthService {
                         code: auth_constants_1.ERROR_CODES.INVALID_CREDENTIALS,
                     });
                 }
-                user = await this.handleSocialLogin(provider, authProviderUser, tenantId);
+                user = await this.handleSocialLogin(provider, authProviderUser, resolvedTenantId);
             }
             if (user.isActive === false) {
                 throw new common_1.UnauthorizedException({
@@ -265,22 +271,38 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.ACCOUNT_INACTIVE,
                 });
             }
-            user = await this.getUserWithRolesAndPermissions(user.id);
+            const { user: authUser, userAccess, platformAccess } = await this.getUserWithAccess(user.id, resolvedTenantId, isPlatformAccess);
             if (this.authConfig.loginHooks?.onLogin) {
-                this.debugLogger.debug('Applying loginHooks.onLogin hook', 'AuthService', { userId: user.id });
+                this.debugLogger.debug('Applying loginHooks.onLogin hook', 'AuthService', { userId: authUser.id });
                 const request = request_context_1.RequestContext.currentRequest();
-                await this.authConfig.loginHooks.onLogin(user, input, { request, provider });
+                await this.authConfig.loginHooks.onLogin(authUser, input, { userAccess, platformAccess, request, provider });
+            }
+            if (isPlatformAccess) {
+                if (authUser && !platformAccess) {
+                    throw new common_1.ForbiddenException({
+                        message: 'Only platform admins can login',
+                        code: auth_constants_1.ERROR_CODES.ACCESS_DENIED,
+                    });
+                }
+            }
+            else {
+                await this.ensureTenantAccess(authUser, resolvedTenantId, createUserIfNotExists);
             }
-            await this.ensureTenantAccess(user, tenantId, createUserIfNotExists);
             let isRequiresMfa = false;
             let isTrusted = false;
             if (!provider.skipMfa) {
-                isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+                isRequiresMfa = await this.mfaService.isRequiresMfa(authUser.id);
             }
             user.isMfaEnabled = isRequiresMfa;
-            const userRoles = user.userAccesses?.map(access => access.roles).flat();
-            if (guard && userRoles?.length) {
-                const isExistsGuard = userRoles.some(r => r.guard === guard);
+            if (guard && (platformAccess || userAccess)) {
+                let guardRoles = [];
+                if (isPlatformAccess) {
+                    guardRoles = platformAccess?.roles ?? [];
+                }
+                else {
+                    guardRoles = userAccess?.roles ?? [];
+                }
+                const isExistsGuard = guardRoles.some(r => r.guard === guard);
                 if (!isExistsGuard) {
                     throw new common_1.UnauthorizedException({
                         message: 'Invalid credentials',
@@ -288,7 +310,11 @@ let AuthService = class AuthService {
                     });
                 }
             }
-            let session = await this.sessionManager.createSessionFromUser(user, { tenantId });
+            let session = await this.sessionManager.createSessionFromUser(authUser, userAccess, {
+                tenantId: resolvedTenantId,
+                platformAccess: platformAccess,
+                isPlatformAccess: isPlatformAccess ?? false
+            });
             if (isRequiresMfa) {
                 isTrusted = await this.checkTrustedDevice(user);
                 if (isTrusted) {
@@ -300,7 +326,9 @@ let AuthService = class AuthService {
             }
             const tokens = await this.generateTokensFromSession(session);
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_IN, new user_logged_in_event_1.UserLoggedInEvent({
-                user,
+                user: authUser,
+                userAccess,
+                platformAccess,
                 tenantId,
                 input,
                 provider,
@@ -308,7 +336,7 @@ let AuthService = class AuthService {
                 tokens,
                 isRequiresMfa
             }));
-            return this.generateAuthResponse(user, session, tokens, isRequiresMfa);
+            return this.generateAuthResponse(authUser, session, tokens, isRequiresMfa);
         }
         catch (error) {
             this.debugLogger.logError(error, 'login', { providerName, createUserIfNotExists });
@@ -355,7 +383,7 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REGISTRATION_DISABLED,
                 });
             }
-            return this.userService.createUser({ email: emailNorm, isVerified: true }, tenantId ?? undefined, { source: 'passwordless', channel: 'email' });
+            return this.userService.createUser({ email: emailNorm }, tenantId ?? undefined, { source: 'passwordless', channel: 'email' });
         }
         else {
             const phoneNorm = (0, utils_1.normalizedPhone)(raw);
@@ -386,7 +414,7 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REGISTRATION_DISABLED,
                 });
             }
-            return this.userService.createUser({ phone: phoneNorm, isVerified: true }, tenantId ?? undefined, { source: 'passwordless', channel: 'sms' });
+            return this.userService.createUser({ phone: phoneNorm }, tenantId ?? undefined, { source: 'passwordless', channel: 'sms' });
         }
     }
     async passwordlessSend(input) {
@@ -427,9 +455,9 @@ let AuthService = class AuthService {
     async verify2fa(input) {
         this.debugLogger.logFunctionEntry('verify2fa', 'AuthService', { method: input.method });
         try {
+            let user = await request_context_1.RequestContext.currentUser();
             const session = request_context_1.RequestContext.currentSession();
             if (!session) {
-                this.debugLogger.error('Session not found for 2FA verification', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'Session not found',
                     code: auth_constants_1.ERROR_CODES.SESSION_NOT_FOUND,
@@ -438,13 +466,11 @@ let AuthService = class AuthService {
             this.debugLogger.debug('Verifying MFA code', 'AuthService', { userId: session.userId, method: input.method });
             const isValid = await this.mfaService.verifyMfa(session.userId, input.otp, input.method);
             if (!isValid) {
-                this.debugLogger.warn('Invalid MFA code provided', 'AuthService', { userId: session.userId, method: input.method });
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid MFA code',
                     code: auth_constants_1.ERROR_CODES.MFA_CODE_INVALID,
                 });
             }
-            this.debugLogger.debug('Updating session with MFA verification', 'AuthService', { sessionId: session.id });
             const payload = await this.sessionManager.updateSession(session.id, {
                 data: {
                     ...session.data,
@@ -461,10 +487,12 @@ let AuthService = class AuthService {
                     trustToken = await this.mfaService.createTrustedDevice(session.userId, userAgent, ip);
                 }
             }
-            const user = await this.getUser();
+            if (!user) {
+                return null;
+            }
             this.debugLogger.debug('Emitting 2FA verified event', 'AuthService', { userId: user.id });
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.TWO_FACTOR_VERIFIED, new user_2fa_verified_event_1.User2faVerifiedEvent({
-                user: user,
+                user,
                 tenantId: payload.data?.tenantId ?? user?.tenantId,
                 input,
                 session: payload,
@@ -488,16 +516,7 @@ let AuthService = class AuthService {
             });
         }
         const resolvedTenantId = await this.tenantService.resolveTenantId(tenantId || null);
-        const user = await this.userRepository.findOne({
-            where: { id: session.userId },
-            relations: [
-                'userAccesses',
-                'userAccesses.tenant',
-                'userAccesses.roles',
-                'userAccesses.roles.rolePermissions',
-                'userAccesses.roles.rolePermissions.permission',
-            ],
-        });
+        const { user, userAccess } = await this.getUserWithAccess(session.userId, resolvedTenantId);
         if (!user) {
             throw new common_1.UnauthorizedException({
                 message: 'User not found',
@@ -505,13 +524,12 @@ let AuthService = class AuthService {
             });
         }
         await this.ensureTenantAccess(user, resolvedTenantId, false);
-        const rolesWithPermissions = user.userAccesses?.map(access => access.roles).flat();
+        const rolesWithPermissions = userAccess?.roles ?? [];
         const permissions = (0, lodash_1.chain)(rolesWithPermissions)
             .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
             .flatten()
             .uniq()
             .value();
-        ;
         const roles = rolesWithPermissions?.map((role) => (0, role_mapper_util_1.mapRoleToSessionSnapshot)(role));
         const updatedSession = await this.sessionManager.updateSession(session.id, {
             data: {
@@ -525,6 +543,36 @@ let AuthService = class AuthService {
         const tokens = await this.generateTokensFromSession(updatedSession);
         return this.generateAuthResponse(user, updatedSession, tokens, false);
     }
+    async getSessionUserData() {
+        const session = request_context_1.RequestContext.currentSession();
+        const tenantId = request_context_1.RequestContext.currentTenantId();
+        const isPlatformAccess = await access_role_resolver_util_1.AccessRoleResolver.isPlatformAccess();
+        const { user, userAccess, platformAccess } = await this.getUserWithAccess(session.userId, tenantId, isPlatformAccess);
+        let rolesWithPermissions = [];
+        if (isPlatformAccess) {
+            rolesWithPermissions = platformAccess?.roles ?? [];
+        }
+        else {
+            rolesWithPermissions = userAccess?.roles ?? [];
+        }
+        const permissions = (0, lodash_1.chain)(rolesWithPermissions)
+            .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
+            .flatten()
+            .uniq()
+            .value();
+        const userRoles = rolesWithPermissions.map((role) => (0, lodash_1.pick)(role, ['id', 'name', 'guard']));
+        const config = this.authConfigService.getConfig();
+        let serializedUser = {};
+        if (config.user?.getSessionUserData) {
+            serializedUser = await config.user.getSessionUserData(user);
+        }
+        return {
+            ...(0, lodash_1.pick)(user, ['id', 'email', 'phone', 'emailVerifiedAt', 'phoneVerifiedAt', 'isMfaEnabled', 'metadata']),
+            ...(serializedUser || {}),
+            roles: userRoles,
+            permissions,
+        };
+    }
     async send2faCode(userId, method) {
         const user = await this.userRepository.findOne({ where: { id: userId } });
         if (!user) {
@@ -548,7 +596,7 @@ let AuthService = class AuthService {
             try {
                 user = await this.userService.createUser({
                     [linkUserWith]: linkUserValue,
-                    isVerified: true,
+                    emailVerifiedAt: new Date(),
                     metadata: providerUser.metadata || {},
                 }, tenantId, {
                     [linkUserWith]: linkUserValue,
@@ -584,11 +632,11 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
+            const isPlatformAccess = await access_role_resolver_util_1.AccessRoleResolver.isPlatformAccess();
             this.debugLogger.debug('Verifying refresh token', 'AuthService');
             let payload;
             try {
                 payload = await this.jwtService.verifyToken(refreshToken);
-                console.log('payload', payload);
             }
             catch (error) {
                 this.debugLogger.warn('Invalid or expired refresh token', 'AuthService');
@@ -610,17 +658,80 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
-            const newSession = await this.sessionManager.refreshSession(session);
-            this.debugLogger.debug('Generating new tokens from refreshed session', 'AuthService', { sessionId: newSession.id });
-            const tokens = await this.generateTokensFromSession(newSession);
-            this.debugLogger.debug('Emitting refresh token event', 'AuthService', { sessionId: newSession.id });
+            const { user, userAccess, platformAccess } = await this.getUserWithAccess(session.userId, session.data?.tenantId ?? null, isPlatformAccess);
+            if (!user) {
+                await this.sessionManager.revokeSession(session.id);
+                throw new common_1.UnauthorizedException({
+                    message: 'User not found',
+                    code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
+                });
+            }
+            if (user.isActive === false) {
+                await this.sessionManager.revokeSession(session.id);
+                throw new common_1.UnauthorizedException({
+                    message: 'Your account is suspended, please contact support',
+                    code: auth_constants_1.ERROR_CODES.ACCOUNT_INACTIVE,
+                });
+            }
+            const tenantId = session.data?.tenantId ?? null;
+            if (!isPlatformAccess && !userAccess) {
+                try {
+                    await this.ensureTenantAccess(user, tenantId, false);
+                }
+                catch (error) {
+                    await this.sessionManager.revokeSession(session.id);
+                    throw error;
+                }
+            }
+            if (isPlatformAccess && !platformAccess) {
+                await this.sessionManager.revokeSession(session.id);
+                throw new common_1.UnauthorizedException({
+                    message: 'You are not authorized to platform access',
+                    code: auth_constants_1.ERROR_CODES.ACCESS_DENIED,
+                });
+            }
+            const isMfaVerified = !!session.data?.isMfaVerified;
+            let roles = [];
+            if (isPlatformAccess) {
+                roles = platformAccess?.roles ?? [];
+            }
+            else {
+                roles = userAccess?.roles ?? [];
+            }
+            const permissions = (0, lodash_1.chain)(roles)
+                .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
+                .flatten()
+                .uniq()
+                .value();
+            let freshSessionData = {
+                user,
+                isMfaVerified,
+                roles: roles.map((role) => (0, role_mapper_util_1.mapRoleToSessionSnapshot)(role)),
+                permissions,
+                tenantId,
+                isPlatformAccess: isPlatformAccess ?? false,
+            };
+            const customize = auth_config_service_1.AuthConfigService.getOptions().session?.customizeSessionData;
+            if (customize) {
+                freshSessionData = await customize(freshSessionData, user);
+            }
+            const refreshedSession = await this.sessionManager.refreshSession(session);
+            const updatedSession = await this.sessionManager.updateSession(refreshedSession.id, {
+                data: {
+                    ...(refreshedSession.data ?? {}),
+                    ...freshSessionData,
+                },
+            });
+            this.debugLogger.debug('Generating new tokens from refreshed session', 'AuthService', { sessionId: updatedSession.id });
+            const tokens = await this.generateTokensFromSession(updatedSession);
+            this.debugLogger.debug('Emitting refresh token event', 'AuthService', { sessionId: updatedSession.id });
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.REFRESH_TOKEN, new user_refresh_token_event_1.UserRefreshTokenEvent({
                 oldRefreshToken: refreshToken,
-                session: newSession,
+                session: updatedSession,
                 tokens,
             }));
-            this.debugLogger.logFunctionExit('refreshToken', 'AuthService', { sessionId: newSession.id });
-            return tokens;
+            this.debugLogger.logFunctionExit('refreshToken', 'AuthService', { sessionId: updatedSession.id });
+            return this.generateAuthResponse(user, updatedSession, tokens, false);
         }
         catch (error) {
             this.debugLogger.logError(error, 'refreshToken', { hasRefreshToken: !!refreshToken });
@@ -630,10 +741,10 @@ let AuthService = class AuthService {
     }
     async logout(logoutType = 'user', reason) {
         const session = request_context_1.RequestContext.currentSession();
-        const user = await this.getUser();
+        const user = await request_context_1.RequestContext.currentUser();
         if (session) {
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_OUT, new logged_out_event_1.LoggedOutEvent({
-                user: user,
+                user,
                 tenantId: session?.data?.tenantId ?? user?.tenantId,
                 session,
                 logoutType,
@@ -658,11 +769,6 @@ let AuthService = class AuthService {
         }
         return true;
     }
-    getTenantMode() {
-        const config = this.authConfigService.getConfig();
-        const mode = config.tenant?.mode;
-        return mode === nest_auth_contracts_1.TenantModeEnum.SHARED ? nest_auth_contracts_1.TenantModeEnum.SHARED : nest_auth_contracts_1.TenantModeEnum.ISOLATED;
-    }
     async ensureTenantAccess(user, tenantId, allowAutoJoin = false) {
         if (!tenantId || !this.tenantContext.isEnabled()) {
             return;
@@ -686,7 +792,8 @@ let AuthService = class AuthService {
             sessionId: session.id,
             email: session.data?.user?.email,
             phone: session.data?.user?.phone,
-            isVerified: session.data?.user?.isVerified,
+            emailVerifiedAt: session.data?.user?.emailVerifiedAt,
+            phoneVerifiedAt: session.data?.user?.phoneVerifiedAt,
             roles: session.data?.roles || [],
             tenantId: session.data?.tenantId,
             isMfaEnabled: session.data?.user?.isMfaEnabled,
@@ -715,10 +822,6 @@ let AuthService = class AuthService {
     }
     async generateAuthResponse(user, session, tokens, isRequiresMfa, trustToken) {
         const config = this.authConfigService.getConfig();
-        let serializedUser = user;
-        if (config.user?.serialize) {
-            serializedUser = await config.user.serialize(user);
-        }
         const activeTenantId = session?.data?.tenantId;
         let tenants = await this.userService.getUserTenants(user.id);
         if (!tenants.length && activeTenantId) {
@@ -727,51 +830,10 @@ let AuthService = class AuthService {
                 tenants = [fallbackTenant];
             }
         }
-        let userWithAccesses;
-        if (!user?.userAccesses?.length) {
-            userWithAccesses = await this.getUserWithRolesAndPermissions(user.id, [
-                'userAccesses',
-                'userAccesses.tenant',
-            ]);
-        }
-        const userAccesses = (userWithAccesses.userAccesses ?? []).map((access) => ({
-            id: access.id,
-            userId: access.userId,
-            tenantId: access.tenantId,
-            tenant: access.tenant ? {
-                id: access.tenant.id,
-                name: access.tenant.name,
-                slug: access.tenant.slug,
-                description: access.tenant.description,
-                metadata: access.tenant.metadata,
-                isActive: access.tenant.isActive,
-            } : undefined,
-            isActive: access.isActive,
-            isDefault: access.isDefault,
-            status: access.status,
-            metadata: access.metadata ?? {},
-            createdAt: access.createdAt,
-            updatedAt: access.updatedAt,
-        }));
-        const rolesForResponse = session?.data?.roles || [];
-        const roleNames = rolesForResponse?.map(r => r.name) || [];
-        const permissions = session?.data?.permissions || [];
         let response = {
             accessToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
             isRequiresMfa: isRequiresMfa,
-            user: {
-                id: serializedUser.id,
-                email: serializedUser.email,
-                phone: serializedUser.phone,
-                isVerified: serializedUser.isVerified,
-                isMfaEnabled: serializedUser.isMfaEnabled,
-                roles: roleNames,
-                permissions,
-                metadata: serializedUser.metadata,
-                tenantId: activeTenantId,
-                userAccesses,
-            },
         };
         if (isRequiresMfa) {
             const enabledMethods = await this.mfaService.getEnabledMethods(user.id);