@ackplus/nest-auth 2.0.0-beta.8 → 2.0.1

package/dist/lib/auth/services/auth.service.js

@@ -18,6 +18,7 @@ const common_2 = require("@nestjs/common");
 const typeorm_1 = require("@nestjs/typeorm");
 const typeorm_2 = require("typeorm");
 const user_entity_1 = require("../../user/entities/user.entity");
+const access_role_resolver_util_1 = require("../../role/utils/access-role-resolver.util");
 const auth_constants_1 = require("../../auth.constants");
 const mfa_service_1 = require("./mfa.service");
 const jwt_service_1 = require("../../core/services/jwt.service");
@@ -26,11 +27,12 @@ const session_manager_service_1 = require("../../session/services/session-manage
 const request_context_1 = require("../../request-context/request-context");
 const nest_auth_contracts_1 = require("@ackplus/nest-auth-contracts");
 const user_registered_event_1 = require("../events/user-registered.event");
+const user_created_event_1 = require("../../user/events/user-created.event");
+const has_token_1 = require("../../utils/has-token");
 const user_logged_in_event_1 = require("../events/user-logged-in.event");
+const login_failed_event_1 = require("../events/login-failed.event");
 const user_2fa_verified_event_1 = require("../events/user-2fa-verified.event");
 const user_refresh_token_event_1 = require("../events/user-refresh-token.event");
-const logged_out_event_1 = require("../events/logged-out.event");
-const logged_out_all_event_1 = require("../events/logged-out-all.event");
 const auth_provider_registry_service_1 = require("../../core/services/auth-provider-registry.service");
 const tenant_service_1 = require("../../tenant/services/tenant.service");
 const debug_logger_service_1 = require("../../core/services/debug-logger.service");
@@ -41,8 +43,11 @@ const auth_constants_2 = require("../../auth.constants");
 const role_mapper_util_1 = require("../../role/utils/role-mapper.util");
 const utils_1 = require("../../utils");
 const otp_flow_service_1 = require("./otp-flow.service");
+const logout_service_1 = require("./logout.service");
+const session_token_service_1 = require("./session-token.service");
 const passwordless_code_requested_event_1 = require("../events/passwordless-code-requested.event");
 const lodash_1 = require("lodash");
+const platform_access_entity_1 = require("../../user/entities/platform-access.entity");
 let AuthService = class AuthService {
     userRepository;
     authProviderRegistry;
@@ -55,9 +60,11 @@ let AuthService = class AuthService {
     authConfigService;
     userService;
     otpFlow;
+    logoutService;
+    sessionTokenService;
     tenantContext;
     authConfig;
-    constructor(userRepository, authProviderRegistry, mfaService, sessionManager, jwtService, eventEmitter, tenantService, debugLogger, authConfigService, userService, otpFlow, tenantContext) {
+    constructor(userRepository, authProviderRegistry, mfaService, sessionManager, jwtService, eventEmitter, tenantService, debugLogger, authConfigService, userService, otpFlow, logoutService, sessionTokenService, tenantContext) {
         this.userRepository = userRepository;
         this.authProviderRegistry = authProviderRegistry;
         this.mfaService = mfaService;
@@ -69,36 +76,19 @@ let AuthService = class AuthService {
         this.authConfigService = authConfigService;
         this.userService = userService;
         this.otpFlow = otpFlow;
+        this.logoutService = logoutService;
+        this.sessionTokenService = sessionTokenService;
         this.tenantContext = tenantContext;
         this.authConfig = this.authConfigService.getConfig();
     }
     getUserWithRoles(userId, relations = []) {
-        return this.userRepository.findOne({
-            where: { id: userId },
-            relations: [
-                'userAccesses',
-                'userAccesses.roles',
-                ...relations
-            ],
-        });
+        return this.sessionTokenService.getUserWithRoles(userId, relations);
     }
-    async getUser() {
-        const user = await request_context_1.RequestContext.currentUser();
-        if (!user) {
-            return null;
-        }
-        const fullUser = await this.getUserWithRoles(user.id);
-        let serializedUser = fullUser;
-        if (this.authConfig.user?.serialize) {
-            serializedUser = await this.authConfig.user.serialize(fullUser);
-        }
-        return serializedUser;
+    getUserWithAccess(userId, tenantId, isPlatformAccess = false) {
+        return this.sessionTokenService.getUserWithAccess(userId, tenantId, isPlatformAccess);
     }
     async signup(input) {
         this.debugLogger.logFunctionEntry('signup', 'AuthService', { email: input.email, phone: input.phone, hasPassword: !!input.password });
-        const config = this.authConfigService.getConfig();
-        const tenantMode = config.tenant?.mode ?? nest_auth_contracts_1.TenantModeEnum.ISOLATED;
-        const tenetEnabled = config.tenant?.enabled ?? false;
         try {
             if (this.authConfig.registration?.enabled === false) {
                 throw new common_1.ForbiddenException({
@@ -111,6 +101,7 @@ let AuthService = class AuthService {
                 input = await this.authConfig.registrationHooks.beforeSignup(input, { request: req });
             }
             const { email, phone, password, tenantId } = input;
+            this.assertTenantIdAllowed(tenantId);
             await this.tenantService.resolveTenantId(tenantId);
             this.debugLogger.logAuthOperation('signup', 'email|phone', undefined, { email, phone, resolvedTenantId: tenantId });
             if (!email && !phone) {
@@ -140,11 +131,9 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.PROVIDER_NOT_FOUND,
                 });
             }
-            console.log('providersToLink', providersToLink);
             for (const item of providersToLink) {
-                this.debugLogger.debug('Checking for existing identity', 'AuthService', { providerId: item.providerId, type: item.type });
-                const identity = await item.provider.findIdentity(item.providerId, (tenantMode === nest_auth_contracts_1.TenantModeEnum.ISOLATED && tenetEnabled) ? tenantId : undefined);
-                console.log('identity', identity);
+                const requiredTenantId = this.tenantService.checkRequiredTenant(tenantId);
+                const identity = await item.provider.findIdentity(item.providerId, requiredTenantId ? tenantId : undefined);
                 if (identity) {
                     this.debugLogger.warn('Identity already exists', 'AuthService', { email: !!email, phone: !!phone, tenantId });
                     if (item.type === 'email') {
@@ -162,46 +151,34 @@ let AuthService = class AuthService {
                 }
             }
             this.debugLogger.debug('Creating new user via UserService', 'AuthService', { email: !!email, phone: !!phone, tenantId });
-            let user = await this.userService.createUser({
-                email,
-                phone,
-                isVerified: false,
-                password
-            }, tenantId, input);
-            this.debugLogger.info('User created successfully', 'AuthService', { userId: user.id, tenantId });
-            for (const item of providersToLink) {
-                this.debugLogger.debug('Linking user to provider', 'AuthService', { userId: user.id, providerName: item.provider.providerName });
-                await item.provider.linkToUser(user.id, item.providerId);
-            }
-            if (this.authConfig.registrationHooks?.onSignup) {
-                this.debugLogger.debug('Applying registrationHooks.onSignup hook', 'AuthService', { userId: user.id });
-                const request = request_context_1.RequestContext.currentRequest();
-                const modifiedUser = await this.authConfig.registrationHooks.onSignup(user, input, { request });
-                if (modifiedUser) {
-                    user = modifiedUser;
-                }
-            }
-            user = await this.getUserWithRoles(user.id, ['userAccesses.roles.permissions', 'userAccesses.tenant']);
-            const userRoles = user.userAccesses?.map(access => access.roles).flat();
-            if (input?.guard) {
-                const isExistsGuard = userRoles?.some(r => r.guard === input.guard);
-                if (!isExistsGuard) {
-                    await this.userService.deleteUser(user.id);
-                    throw new common_1.UnauthorizedException({
-                        message: 'Not allowed to signup with this guard',
-                        code: auth_constants_1.ERROR_CODES.FORBIDDEN,
-                    });
+            const request = request_context_1.RequestContext.currentRequest();
+            const user = await this.userService.runInTransaction(async (manager) => {
+                const created = await this.userService.createUser({
+                    email,
+                    phone,
+                    emailVerifiedAt: null,
+                    phoneVerifiedAt: null,
+                    password
+                }, tenantId, input, manager);
+                if (this.authConfig.registrationHooks?.onSignup) {
+                    this.debugLogger.debug('Applying registrationHooks.onSignup hook', 'AuthService', { userId: created.id });
+                    await this.authConfig.registrationHooks.onSignup(created, input, { request, manager });
                 }
-            }
-            this.debugLogger.debug('Creating session for new user', 'AuthService', { userId: user.id });
-            const session = await this.sessionManager.createSessionFromUser(user, { tenantId });
+                return created;
+            });
+            this.debugLogger.info('User created successfully', 'AuthService', { userId: user.id, tenantId });
+            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.USER_CREATED, new user_created_event_1.UserCreatedEvent({ user, input, tenantId }));
+            const { user: authUser, userAccess } = await this.getUserWithAccess(user.id, tenantId);
+            this.debugLogger.debug('Creating session for new user', 'AuthService', { userId: authUser.id });
+            const session = await this.sessionManager.createSessionFromUser(authUser, userAccess, { tenantId });
             const tokens = await this.generateTokensFromSession(session);
-            const isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
-            this.debugLogger.debug('Signup tokens generated', 'AuthService', { userId: user.id, isRequiresMfa });
-            this.debugLogger.debug('Emitting user registration event', 'AuthService', { userId: user.id });
+            const isRequiresMfa = await this.mfaService.isRequiresMfa(authUser.id);
+            this.debugLogger.debug('Signup tokens generated', 'AuthService', { userId: authUser.id, isRequiresMfa });
+            this.debugLogger.debug('Emitting user registration event', 'AuthService', { userId: authUser.id });
             const provider = providersToLink[0]?.provider;
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.REGISTERED, new user_registered_event_1.UserRegisteredEvent({
-                user,
+                user: authUser,
+                userAccess,
                 tenantId,
                 input,
                 provider,
@@ -219,7 +196,7 @@ let AuthService = class AuthService {
                     isRequiresMfa: false,
                 };
             }
-            return this.generateAuthResponse(user, session, tokens, isRequiresMfa, undefined);
+            return this.generateAuthResponse(authUser, session, tokens, isRequiresMfa, undefined);
         }
         catch (error) {
             this.debugLogger.logError(error, 'signup', { email: input.email, phone: input.phone });
@@ -229,10 +206,21 @@ let AuthService = class AuthService {
     }
     async login(input) {
         let { credentials, providerName, createUserIfNotExists = false, guard, tenantId } = input;
+        const isPlatformAccess = await access_role_resolver_util_1.AccessRoleResolver.isPlatformAccess();
         this.debugLogger.logFunctionEntry('login', 'AuthService', { providerName, createUserIfNotExists, guard, tenantId });
         try {
-            await this.tenantService.resolveTenantId(tenantId);
-            this.debugLogger.logAuthOperation('login', providerName, undefined, { resolvedTenantId: tenantId, createUserIfNotExists });
+            if (!isPlatformAccess) {
+                this.assertTenantIdAllowed(tenantId);
+            }
+            let resolvedTenantId = null;
+            if (isPlatformAccess) {
+                resolvedTenantId = null;
+            }
+            else {
+                await this.tenantService.resolveTenantId(tenantId);
+                resolvedTenantId = tenantId;
+            }
+            this.debugLogger.logAuthOperation('login', providerName, undefined, { tenantId, resolvedTenantId, createUserIfNotExists, isPlatformAccess });
             const provider = this.authProviderRegistry.getProvider(providerName);
             if (!provider) {
                 throw new common_1.UnauthorizedException({
@@ -247,8 +235,8 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.MISSING_REQUIRED_FIELDS,
                 });
             }
-            const authProviderUser = await provider.validate(credentials, tenantId);
-            const identity = await provider.findIdentity(authProviderUser.userId, tenantId);
+            const authProviderUser = await provider.validate(credentials, resolvedTenantId);
+            const identity = await provider.findIdentityByUserId(authProviderUser.userId);
             let user = identity?.user || null;
             if (!user) {
                 if (!createUserIfNotExists) {
@@ -257,7 +245,10 @@ let AuthService = class AuthService {
                         code: auth_constants_1.ERROR_CODES.INVALID_CREDENTIALS,
                     });
                 }
-                user = await this.handleSocialLogin(provider, authProviderUser, tenantId);
+                user = await this.handleSocialLogin(provider, authProviderUser, resolvedTenantId);
+            }
+            else {
+                user = await this.applyProviderVerification(user, authProviderUser);
             }
             if (user.isActive === false) {
                 throw new common_1.UnauthorizedException({
@@ -265,22 +256,38 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.ACCOUNT_INACTIVE,
                 });
             }
-            user = await this.getUserWithRoles(user.id, ['userAccesses.tenant']);
+            const { user: authUser, userAccess, platformAccess } = await this.getUserWithAccess(user.id, resolvedTenantId, isPlatformAccess);
             if (this.authConfig.loginHooks?.onLogin) {
-                this.debugLogger.debug('Applying loginHooks.onLogin hook', 'AuthService', { userId: user.id });
+                this.debugLogger.debug('Applying loginHooks.onLogin hook', 'AuthService', { userId: authUser.id });
                 const request = request_context_1.RequestContext.currentRequest();
-                await this.authConfig.loginHooks.onLogin(user, input, { request, provider });
+                await this.authConfig.loginHooks.onLogin(authUser, input, { userAccess, platformAccess, request, provider });
+            }
+            if (isPlatformAccess) {
+                if (authUser && !platformAccess) {
+                    throw new common_1.ForbiddenException({
+                        message: 'Only platform admins can login',
+                        code: auth_constants_1.ERROR_CODES.ACCESS_DENIED,
+                    });
+                }
+            }
+            else {
+                await this.ensureTenantAccess(authUser, resolvedTenantId, createUserIfNotExists);
             }
-            await this.ensureTenantAccess(user, tenantId, createUserIfNotExists);
             let isRequiresMfa = false;
             let isTrusted = false;
             if (!provider.skipMfa) {
-                isRequiresMfa = await this.mfaService.isRequiresMfa(user.id);
+                isRequiresMfa = await this.mfaService.isRequiresMfa(authUser.id);
             }
             user.isMfaEnabled = isRequiresMfa;
-            const userRoles = user.userAccesses?.map(access => access.roles).flat();
-            if (guard && userRoles?.length) {
-                const isExistsGuard = userRoles.some(r => r.guard === guard);
+            if (guard && (platformAccess || userAccess)) {
+                let guardRoles = [];
+                if (isPlatformAccess) {
+                    guardRoles = platformAccess?.roles ?? [];
+                }
+                else {
+                    guardRoles = userAccess?.roles ?? [];
+                }
+                const isExistsGuard = guardRoles.some(r => r.guard === guard);
                 if (!isExistsGuard) {
                     throw new common_1.UnauthorizedException({
                         message: 'Invalid credentials',
@@ -288,7 +295,11 @@ let AuthService = class AuthService {
                     });
                 }
             }
-            let session = await this.sessionManager.createSessionFromUser(user, { tenantId });
+            let session = await this.sessionManager.createSessionFromUser(authUser, userAccess, {
+                tenantId: resolvedTenantId,
+                platformAccess: platformAccess,
+                isPlatformAccess: isPlatformAccess ?? false
+            });
             if (isRequiresMfa) {
                 isTrusted = await this.checkTrustedDevice(user);
                 if (isTrusted) {
@@ -300,7 +311,9 @@ let AuthService = class AuthService {
             }
             const tokens = await this.generateTokensFromSession(session);
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_IN, new user_logged_in_event_1.UserLoggedInEvent({
-                user,
+                user: authUser,
+                userAccess,
+                platformAccess,
                 tenantId,
                 input,
                 provider,
@@ -308,14 +321,39 @@ let AuthService = class AuthService {
                 tokens,
                 isRequiresMfa
             }));
-            return this.generateAuthResponse(user, session, tokens, isRequiresMfa);
+            return this.generateAuthResponse(authUser, session, tokens, isRequiresMfa);
         }
         catch (error) {
             this.debugLogger.logError(error, 'login', { providerName, createUserIfNotExists });
+            await this.emitLoginFailed(input, error);
             this.handleError(error, 'login');
             throw error;
         }
     }
+    async emitLoginFailed(input, error) {
+        try {
+            const creds = input?.credentials ?? {};
+            const identifier = creds.email ?? creds.phone ?? creds.identifier ?? undefined;
+            const req = request_context_1.RequestContext.currentRequest?.();
+            const resp = error?.getResponse?.();
+            const status = error?.getStatus?.();
+            const reasonCode = (typeof resp === 'object' && resp?.code) ||
+                error?.code ||
+                (status ? `HTTP_${status}` : 'LOGIN_FAILED');
+            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGIN_FAILED, new login_failed_event_1.LoginFailedEvent({
+                identifier,
+                providerName: input?.providerName,
+                reasonCode,
+                reason: error?.message,
+                ip: req?.ip ?? req?.headers?.['x-forwarded-for'],
+                userAgent: req?.headers?.['user-agent'],
+                tenantId: input?.tenantId ?? null,
+                at: new Date(),
+            }));
+        }
+        catch {
+        }
+    }
     async resolveOrCreateUserForSend(input) {
         const passwordlessConfig = this.authConfigService.getConfig().passwordless;
         const { channel, tenantId } = input;
@@ -355,7 +393,7 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REGISTRATION_DISABLED,
                 });
             }
-            return this.userService.createUser({ email: emailNorm, isVerified: true }, tenantId ?? undefined, { source: 'passwordless', channel: 'email' });
+            return this.userService.createUser({ email: emailNorm }, tenantId ?? undefined, { source: 'passwordless', channel: 'email' });
         }
         else {
             const phoneNorm = (0, utils_1.normalizedPhone)(raw);
@@ -386,7 +424,7 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REGISTRATION_DISABLED,
                 });
             }
-            return this.userService.createUser({ phone: phoneNorm, isVerified: true }, tenantId ?? undefined, { source: 'passwordless', channel: 'sms' });
+            return this.userService.createUser({ phone: phoneNorm }, tenantId ?? undefined, { source: 'passwordless', channel: 'sms' });
         }
     }
     async passwordlessSend(input) {
@@ -427,9 +465,9 @@ let AuthService = class AuthService {
     async verify2fa(input) {
         this.debugLogger.logFunctionEntry('verify2fa', 'AuthService', { method: input.method });
         try {
+            let user = await request_context_1.RequestContext.currentUser();
             const session = request_context_1.RequestContext.currentSession();
             if (!session) {
-                this.debugLogger.error('Session not found for 2FA verification', 'AuthService');
                 throw new common_1.UnauthorizedException({
                     message: 'Session not found',
                     code: auth_constants_1.ERROR_CODES.SESSION_NOT_FOUND,
@@ -438,13 +476,11 @@ let AuthService = class AuthService {
             this.debugLogger.debug('Verifying MFA code', 'AuthService', { userId: session.userId, method: input.method });
             const isValid = await this.mfaService.verifyMfa(session.userId, input.otp, input.method);
             if (!isValid) {
-                this.debugLogger.warn('Invalid MFA code provided', 'AuthService', { userId: session.userId, method: input.method });
                 throw new common_1.UnauthorizedException({
                     message: 'Invalid MFA code',
                     code: auth_constants_1.ERROR_CODES.MFA_CODE_INVALID,
                 });
             }
-            this.debugLogger.debug('Updating session with MFA verification', 'AuthService', { sessionId: session.id });
             const payload = await this.sessionManager.updateSession(session.id, {
                 data: {
                     ...session.data,
@@ -461,10 +497,12 @@ let AuthService = class AuthService {
                     trustToken = await this.mfaService.createTrustedDevice(session.userId, userAgent, ip);
                 }
             }
-            const user = await this.getUser();
+            if (!user) {
+                return null;
+            }
             this.debugLogger.debug('Emitting 2FA verified event', 'AuthService', { userId: user.id });
             await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.TWO_FACTOR_VERIFIED, new user_2fa_verified_event_1.User2faVerifiedEvent({
-                user: user,
+                user,
                 tenantId: payload.data?.tenantId ?? user?.tenantId,
                 input,
                 session: payload,
@@ -487,29 +525,40 @@ let AuthService = class AuthService {
                 code: auth_constants_1.ERROR_CODES.SESSION_NOT_FOUND,
             });
         }
+        if (!this.authConfig.tenant?.enabled) {
+            throw new common_1.BadRequestException({
+                message: 'Multi-tenancy is disabled on this deployment.',
+                code: auth_constants_1.ERROR_CODES.TENANT_SWITCHING_DISABLED,
+            });
+        }
+        const tenantMode = this.authConfig.tenant?.mode ?? nest_auth_contracts_1.TenantModeEnum.ISOLATED;
+        if (tenantMode === nest_auth_contracts_1.TenantModeEnum.ISOLATED) {
+            throw new common_1.BadRequestException({
+                message: 'Tenant switching is not supported in isolated mode. Sign in to the target tenant directly.',
+                code: auth_constants_1.ERROR_CODES.TENANT_SWITCHING_NOT_SUPPORTED,
+            });
+        }
         const resolvedTenantId = await this.tenantService.resolveTenantId(tenantId || null);
-        const user = await this.userRepository.findOne({
-            where: { id: session.userId },
-            relations: [
-                'userAccesses',
-                'userAccesses.tenant',
-                'userAccesses.roles',
-                'userAccesses.roles.rolePermissions',
-                'userAccesses.roles.rolePermissions.permission',
-            ],
-        });
+        const { user, userAccess } = await this.getUserWithAccess(session.userId, resolvedTenantId);
         if (!user) {
             throw new common_1.UnauthorizedException({
                 message: 'User not found',
                 code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
             });
         }
+        if (resolvedTenantId && !userAccess) {
+            const platformAccess = await platform_access_entity_1.NestAuthPlatformAccess.findOne({
+                where: { userId: user.id, isActive: true },
+            });
+            if (!platformAccess) {
+                throw new common_1.ForbiddenException({
+                    message: 'You do not have access to that tenant.',
+                    code: auth_constants_1.ERROR_CODES.NOT_A_MEMBER_OF_TENANT,
+                });
+            }
+        }
         await this.ensureTenantAccess(user, resolvedTenantId, false);
-        const accessForTenant = (user.userAccesses ?? []).find((a) => {
-            const aTenantId = a?.tenantId ?? null;
-            return aTenantId === (resolvedTenantId ?? null);
-        });
-        const rolesWithPermissions = accessForTenant?.roles ?? [];
+        const rolesWithPermissions = userAccess?.roles ?? [];
         const permissions = (0, lodash_1.chain)(rolesWithPermissions)
             .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
             .flatten()
@@ -528,6 +577,36 @@ let AuthService = class AuthService {
         const tokens = await this.generateTokensFromSession(updatedSession);
         return this.generateAuthResponse(user, updatedSession, tokens, false);
     }
+    async getSessionUserData() {
+        const session = request_context_1.RequestContext.currentSession();
+        const tenantId = request_context_1.RequestContext.currentTenantId();
+        const isPlatformAccess = await access_role_resolver_util_1.AccessRoleResolver.isPlatformAccess();
+        const { user, userAccess, platformAccess } = await this.getUserWithAccess(session.userId, tenantId, isPlatformAccess);
+        let rolesWithPermissions = [];
+        if (isPlatformAccess) {
+            rolesWithPermissions = platformAccess?.roles ?? [];
+        }
+        else {
+            rolesWithPermissions = userAccess?.roles ?? [];
+        }
+        const permissions = (0, lodash_1.chain)(rolesWithPermissions)
+            .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
+            .flatten()
+            .uniq()
+            .value();
+        const userRoles = rolesWithPermissions.map((role) => (0, lodash_1.pick)(role, ['id', 'name', 'guard']));
+        const config = this.authConfigService.getConfig();
+        let serializedUser = {};
+        if (config.user?.getSessionUserData) {
+            serializedUser = await config.user.getSessionUserData(user);
+        }
+        return {
+            ...(0, lodash_1.pick)(user, ['id', 'email', 'phone', 'emailVerifiedAt', 'phoneVerifiedAt', 'isMfaEnabled', 'metadata']),
+            ...(serializedUser || {}),
+            roles: userRoles,
+            permissions,
+        };
+    }
     async send2faCode(userId, method) {
         const user = await this.userRepository.findOne({ where: { id: userId } });
         if (!user) {
@@ -551,7 +630,7 @@ let AuthService = class AuthService {
             try {
                 user = await this.userService.createUser({
                     [linkUserWith]: linkUserValue,
-                    isVerified: true,
+                    emailVerifiedAt: new Date(),
                     metadata: providerUser.metadata || {},
                 }, tenantId, {
                     [linkUserWith]: linkUserValue,
@@ -577,43 +656,6 @@ let AuthService = class AuthService {
         await provider.linkToUser(user.id, providerUser.userId, providerUser.metadata || {});
         return user;
     }
-    async buildSessionDataFromUser(params) {
-        const { user, tenantId = null, isMfaVerified = false } = params;
-        const accessForTenant = (user.userAccesses ?? []).find((a) => {
-            const aTenantId = a?.tenantId ?? null;
-            return (tenantId ?? null) === aTenantId;
-        });
-        const rolesFromUser = accessForTenant?.roles ?? [];
-        const hasRolesPreloaded = Array.isArray(rolesFromUser) && rolesFromUser.length >= 0;
-        const hasRolePermissionsPreloaded = rolesFromUser?.some((r) => Array.isArray(r?.rolePermissions) &&
-            r.rolePermissions.some((rp) => !!rp?.permission?.name)) ?? false;
-        const roles = hasRolesPreloaded && rolesFromUser.length
-            ? rolesFromUser
-            : await user.getRoles(tenantId, true);
-        const permissions = hasRolePermissionsPreloaded
-            ? (0, lodash_1.chain)(rolesFromUser)
-                .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
-                .flatten()
-                .uniq()
-                .value()
-            : (0, lodash_1.chain)(roles)
-                .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
-                .flatten()
-                .uniq()
-                .value();
-        let sessionData = {
-            user,
-            isMfaVerified,
-            roles: roles.map((role) => (0, role_mapper_util_1.mapRoleToSessionSnapshot)(role)),
-            permissions,
-            tenantId,
-        };
-        const customize = auth_config_service_1.AuthConfigService.getOptions().session?.customizeSessionData;
-        if (customize) {
-            sessionData = await customize(sessionData, user);
-        }
-        return sessionData;
-    }
     async refreshToken(refreshToken) {
         this.debugLogger.logFunctionEntry('refreshToken', 'AuthService', { hasRefreshToken: !!refreshToken });
         try {
@@ -624,6 +666,7 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
+            const isPlatformAccess = await access_role_resolver_util_1.AccessRoleResolver.isPlatformAccess();
             this.debugLogger.debug('Verifying refresh token', 'AuthService');
             let payload;
             try {
@@ -649,38 +692,73 @@ let AuthService = class AuthService {
                     code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
                 });
             }
-            const user = await this.userRepository.findOne({
-                where: { id: session.userId },
-                relations: ['userAccesses.roles.permissions', 'userAccesses.tenant']
-            });
+            const storedRefreshHash = session.refreshToken;
+            if (storedRefreshHash) {
+                const secret = this.authConfig.session?.jwt?.secret ?? '';
+                if (!(0, has_token_1.timingSafeEqualHex)(storedRefreshHash, (0, has_token_1.hmacSha256Hex)(secret, refreshToken))) {
+                    throw new common_1.UnauthorizedException({
+                        message: 'Refresh token is no longer valid (rotated or replayed)',
+                        code: auth_constants_1.ERROR_CODES.REFRESH_TOKEN_INVALID,
+                    });
+                }
+            }
+            const { user, userAccess, platformAccess } = await this.getUserWithAccess(session.userId, session.data?.tenantId ?? null, isPlatformAccess);
             if (!user) {
-                await this.sessionManager.revokeSession(session.id);
+                await this.sessionManager.revokeSession(session.id, 'security');
                 throw new common_1.UnauthorizedException({
                     message: 'User not found',
                     code: auth_constants_1.ERROR_CODES.USER_NOT_FOUND,
                 });
             }
             if (user.isActive === false) {
-                await this.sessionManager.revokeSession(session.id);
+                await this.sessionManager.revokeSession(session.id, 'security');
                 throw new common_1.UnauthorizedException({
                     message: 'Your account is suspended, please contact support',
                     code: auth_constants_1.ERROR_CODES.ACCOUNT_INACTIVE,
                 });
             }
             const tenantId = session.data?.tenantId ?? null;
-            try {
-                await this.ensureTenantAccess(user, tenantId, false);
+            if (!isPlatformAccess && !userAccess) {
+                try {
+                    await this.ensureTenantAccess(user, tenantId, false);
+                }
+                catch (error) {
+                    await this.sessionManager.revokeSession(session.id, 'security');
+                    throw error;
+                }
             }
-            catch (e) {
-                await this.sessionManager.revokeSession(session.id);
-                throw e;
+            if (isPlatformAccess && !platformAccess) {
+                await this.sessionManager.revokeSession(session.id, 'security');
+                throw new common_1.UnauthorizedException({
+                    message: 'You are not authorized to platform access',
+                    code: auth_constants_1.ERROR_CODES.ACCESS_DENIED,
+                });
             }
             const isMfaVerified = !!session.data?.isMfaVerified;
-            const freshSessionData = await this.buildSessionDataFromUser({
+            let roles = [];
+            if (isPlatformAccess) {
+                roles = platformAccess?.roles ?? [];
+            }
+            else {
+                roles = userAccess?.roles ?? [];
+            }
+            const permissions = (0, lodash_1.chain)(roles)
+                .map((role) => (0, role_mapper_util_1.getRolePermissionNames)(role))
+                .flatten()
+                .uniq()
+                .value();
+            let freshSessionData = {
                 user,
-                tenantId,
                 isMfaVerified,
-            });
+                roles: roles.map((role) => (0, role_mapper_util_1.mapRoleToSessionSnapshot)(role)),
+                permissions,
+                tenantId,
+                isPlatformAccess: isPlatformAccess ?? false,
+            };
+            const customize = auth_config_service_1.AuthConfigService.getOptions().session?.customizeSessionData;
+            if (customize) {
+                freshSessionData = await customize(freshSessionData, user);
+            }
             const refreshedSession = await this.sessionManager.refreshSession(session);
             const updatedSession = await this.sessionManager.updateSession(refreshedSession.id, {
                 data: {
@@ -706,39 +784,10 @@ let AuthService = class AuthService {
         }
     }
     async logout(logoutType = 'user', reason) {
-        const session = request_context_1.RequestContext.currentSession();
-        const user = await this.getUser();
-        if (session) {
-            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_OUT, new logged_out_event_1.LoggedOutEvent({
-                user: user,
-                tenantId: session?.data?.tenantId ?? user?.tenantId,
-                session,
-                logoutType,
-                reason,
-            }));
-            await this.sessionManager.revokeSession(session.id);
-        }
-        return true;
+        return this.logoutService.logout(logoutType, reason);
     }
     async logoutAll(userId, logoutType = 'user', reason) {
-        const sessions = await this.sessionManager.getUserSessions(userId);
-        await this.sessionManager.revokeAllUserSessions(userId);
-        const user = await this.userRepository.findOne({ where: { id: userId } });
-        if (user) {
-            await this.eventEmitter.emitAsync(auth_constants_1.NestAuthEvents.LOGGED_OUT_ALL, new logged_out_all_event_1.LoggedOutAllEvent({
-                user,
-                tenantId: request_context_1.RequestContext.currentTenantId(),
-                logoutType,
-                reason,
-                sessions,
-            }));
-        }
-        return true;
-    }
-    getTenantMode() {
-        const config = this.authConfigService.getConfig();
-        const mode = config.tenant?.mode;
-        return mode === nest_auth_contracts_1.TenantModeEnum.SHARED ? nest_auth_contracts_1.TenantModeEnum.SHARED : nest_auth_contracts_1.TenantModeEnum.ISOLATED;
+        return this.logoutService.logoutAll(userId, logoutType, reason);
     }
     async ensureTenantAccess(user, tenantId, allowAutoJoin = false) {
         if (!tenantId || !this.tenantContext.isEnabled()) {
@@ -756,26 +805,6 @@ let AuthService = class AuthService {
             });
         }
     }
-    async generateTokensPayload(session, otherPayload = {}) {
-        let payload = {
-            id: session.userId,
-            sub: session.userId,
-            sessionId: session.id,
-            email: session.data?.user?.email,
-            phone: session.data?.user?.phone,
-            isVerified: session.data?.user?.isVerified,
-            roles: session.data?.roles || [],
-            tenantId: session.data?.tenantId,
-            isMfaEnabled: session.data?.user?.isMfaEnabled,
-            isMfaVerified: session.data?.isMfaVerified,
-            ...otherPayload,
-        };
-        const config = this.authConfigService.getConfig();
-        if (config.session?.customizeTokenPayload) {
-            payload = await config.session.customizeTokenPayload(payload, session);
-        }
-        return payload;
-    }
     handleError(error, context) {
         const config = this.authConfigService.getConfig();
         if (config.errorHandler) {
@@ -786,81 +815,40 @@ let AuthService = class AuthService {
         }
     }
     async generateTokensFromSession(session) {
-        const payload = await this.generateTokensPayload(session);
-        const tokens = await this.jwtService.generateTokens(payload);
-        return tokens;
+        return this.sessionTokenService.generateTokensFromSession(session);
     }
     async generateAuthResponse(user, session, tokens, isRequiresMfa, trustToken) {
-        const config = this.authConfigService.getConfig();
-        let serializedUser = user;
-        if (config.user?.serialize) {
-            serializedUser = await config.user.serialize(user);
-        }
-        const activeTenantId = session?.data?.tenantId;
-        let tenants = await this.userService.getUserTenants(user.id);
-        if (!tenants.length && activeTenantId) {
-            const fallbackTenant = await this.tenantService.getTenantById(activeTenantId);
-            if (fallbackTenant) {
-                tenants = [fallbackTenant];
-            }
-        }
-        let userWithAccesses = user;
-        if (!user?.userAccesses?.length) {
-            userWithAccesses = await this.getUserWithRoles(user.id, [
-                'userAccesses.tenant',
-            ]);
-        }
-        const userAccesses = (userWithAccesses.userAccesses ?? []).map((access) => ({
-            id: access.id,
-            userId: access.userId,
-            tenantId: access.tenantId,
-            tenant: access.tenant ? {
-                id: access.tenant.id,
-                name: access.tenant.name,
-                slug: access.tenant.slug,
-                description: access.tenant.description,
-                metadata: access.tenant.metadata,
-                isActive: access.tenant.isActive,
-            } : undefined,
-            isActive: access.isActive,
-            isDefault: access.isDefault,
-            status: access.status,
-            metadata: access.metadata ?? {},
-            createdAt: access.createdAt,
-            updatedAt: access.updatedAt,
-        }));
-        const rolesForResponse = session?.data?.roles || [];
-        const roleNames = rolesForResponse?.map(r => r.name) || [];
-        const permissions = session?.data?.permissions || [];
-        let response = {
-            accessToken: tokens.accessToken,
-            refreshToken: tokens.refreshToken,
-            isRequiresMfa: isRequiresMfa,
-            user: {
-                id: serializedUser.id,
-                email: serializedUser.email,
-                phone: serializedUser.phone,
-                isVerified: serializedUser.isVerified,
-                isMfaEnabled: serializedUser.isMfaEnabled,
-                roles: roleNames,
-                permissions,
-                metadata: serializedUser.metadata,
-                tenantId: activeTenantId,
-                userAccesses,
-            },
-        };
-        if (isRequiresMfa) {
-            const enabledMethods = await this.mfaService.getEnabledMethods(user.id);
-            response.mfaMethods = enabledMethods;
-            response.defaultMfaMethod = this.mfaService.mfaConfig?.defaultMethod || enabledMethods[0];
-        }
-        if (config.auth?.transformResponse) {
-            response = await config.auth.transformResponse(response, user, session);
-        }
-        if (trustToken) {
-            response.trustToken = trustToken;
+        return this.sessionTokenService.generateAuthResponse(user, session, tokens, isRequiresMfa, trustToken);
+    }
+    async applyProviderVerification(user, providerUser) {
+        const updates = {};
+        if (providerUser.emailVerified === true &&
+            !user.emailVerifiedAt &&
+            user.email &&
+            providerUser.email &&
+            user.email.toLowerCase() === providerUser.email.toLowerCase()) {
+            updates.emailVerifiedAt = new Date();
+        }
+        if (providerUser.phoneVerified === true &&
+            !user.phoneVerifiedAt &&
+            user.phone &&
+            providerUser.phone &&
+            user.phone === providerUser.phone) {
+            updates.phoneVerifiedAt = new Date();
+        }
+        if (Object.keys(updates).length === 0) {
+            return user;
+        }
+        await this.userRepository.update({ id: user.id }, updates);
+        return (await this.userRepository.findOne({ where: { id: user.id } })) ?? user;
+    }
+    assertTenantIdAllowed(tenantId) {
+        if (!this.authConfig.tenant?.enabled && tenantId) {
+            throw new common_1.BadRequestException({
+                message: 'tenantId provided but multi-tenancy is disabled on this deployment.',
+                code: auth_constants_1.ERROR_CODES.TENANT_NOT_ENABLED,
+            });
         }
-        return response;
     }
     async checkTrustedDevice(user) {
         const trustCookieName = auth_config_service_1.AuthConfigService.getOptions().mfa?.trustDeviceStorageName || auth_constants_1.NEST_AUTH_TRUST_DEVICE_KEY;
@@ -881,7 +869,7 @@ exports.AuthService = AuthService;
 exports.AuthService = AuthService = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, typeorm_1.InjectRepository)(user_entity_1.NestAuthUser)),
-    __param(11, (0, common_2.Inject)(auth_constants_2.NEST_AUTH_TENANT_CONTEXT_SERVICE)),
+    __param(13, (0, common_2.Inject)(auth_constants_2.NEST_AUTH_TENANT_CONTEXT_SERVICE)),
     __metadata("design:paramtypes", [typeorm_2.Repository,
         auth_provider_registry_service_1.AuthProviderRegistryService,
         mfa_service_1.MfaService,
@@ -892,6 +880,8 @@ exports.AuthService = AuthService = __decorate([
         debug_logger_service_1.DebugLoggerService,
         auth_config_service_1.AuthConfigService,
         user_service_1.UserService,
-        otp_flow_service_1.OtpFlowService, Object])
+        otp_flow_service_1.OtpFlowService,
+        logout_service_1.LogoutService,
+        session_token_service_1.SessionTokenService, Object])
 ], AuthService);
 //# sourceMappingURL=auth.service.js.map