@ciscode/authentication-kit 1.1.2 → 1.1.3

package/README.md

@@ -1,14 +1,13 @@
-Auth Service (NestJS, JWT, Multi-tenant, RBAC)
+Auth Service (NestJS, JWT, RBAC)
 Internal package - private to the company.
 This package is not published on npmjs. Install it only from the company Azure Artifacts feed using a project or user-level .npmrc.
 
 Authentication and authorization module for NestJS apps.
-Provides local email/password auth with lockout, JWT access tokens and refresh, tenant scoping, RBAC, and optional OAuth (Microsoft Entra, Google, Facebook).
+Provides local email/password auth with lockout, JWT access tokens and refresh, RBAC, and optional OAuth (Microsoft Entra, Google, Facebook).
 
 Features
 Local auth (email/password) with account lockout policy.
 JWT access tokens (Bearer) and refresh endpoint (cookie or body).
-Multi-tenant scope on requests.
 RBAC (roles -> permission strings).
 Microsoft Entra (Azure AD), Google, Facebook OAuth (optional).
 MongoDB/Mongoose models.
@@ -47,7 +46,6 @@ MAX_FAILED_LOGIN_ATTEMPTS=5
 ACCOUNT_LOCK_TIME_MINUTES=15
 
 # (Optional) Microsoft Entra ID (Azure AD)
-MICROSOFT_TENANT_ID=common
 MICROSOFT_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 MICROSOFT_CLIENT_SECRET=your-secret
 MICROSOFT_CALLBACK_URL=${BASE_URL}/api/auth/microsoft/callback
@@ -77,11 +75,11 @@ POST /api/auth/request-password-reset - Sends a reset token (e.g., by email).
 POST /api/auth/reset-password - Consumes the reset token and sets a new password.
 GET /api/auth/microsoft - GET /api/auth/microsoft/callback - Optional Microsoft Entra OAuth; issues first-party tokens.
 Users
-GET /api/users - List users (tenant-scoped, paginated).
+GET /api/users - List users (paginated).
 POST /api/users - Create a user.
 Additional CRUD endpoints as exposed by controllers.
 Roles and Permissions
-GET/POST /api/auth/roles - Manage roles (name, tenantId, permissions: string[]).
+GET/POST /api/auth/roles - Manage roles (name, permissions: string[]).
 GET /api/auth/permissions - List permission strings and metadata.
 
 Protecting your own routes (host app)
@@ -94,18 +92,16 @@ getReports() {
   return { ok: true };
 }
 
-Tenant scope comes from the JWT payload (e.g., tenantId) and is used inside controllers/guards to filter queries.
-
 Quick start (smoke tests)
 Start your host app, then create a user and log in:
 
 curl -X POST http://localhost:3000/api/users \
   -H 'Content-Type: application/json' \
-  -d '{"email":"a@b.com","password":"Secret123!","tenantId":"t-001","name":"Alice"}'
+  -d '{"email":"a@b.com","password":"Secret123!","name":"Alice"}'
 
 curl -X POST http://localhost:3000/api/auth/login \
   -H 'Content-Type: application/json' \
-  -d '{"email":"a@b.com","password":"Secret123!","tenantId":"t-001"}'
+  -d '{"email":"a@b.com","password":"Secret123!"}'
 # => { "accessToken": "...", "refreshToken": "..." }
 
 Call a protected route

package/dist/config/passport.config.js

@@ -16,15 +16,11 @@ require("dotenv/config");
 const MAX_FAILED = parseInt(process.env.MAX_FAILED_LOGIN_ATTEMPTS || '', 10) || 3;
 const LOCK_TIME_MIN = parseInt(process.env.ACCOUNT_LOCK_TIME_MINUTES || '', 10) || 15;
 const LOCK_TIME_MS = LOCK_TIME_MIN * 60 * 1000;
-const DEFAULT_TENANT_ID = process.env.DEFAULT_TENANT_ID || 'social-staff';
 passport_1.default.use(new passport_local_1.Strategy({ usernameField: 'email', passwordField: 'password', passReqToCallback: true }, async (req, email, password, done) => {
     try {
-        const query = { email };
-        if (req.body.tenantId)
-            query.tenantId = String(req.body.tenantId).trim();
-        const user = await user_model_1.default.findOne(query);
+        const user = await user_model_1.default.findOne({ email });
         if (!user)
-            return done(null, false, { message: 'Incorrect email (or tenant).' });
+            return done(null, false, { message: 'Incorrect email.' });
         if (user.lockUntil && user.lockUntil > Date.now()) {
             return done(null, false, { message: `Account locked until ${new Date(user.lockUntil).toLocaleString()}.` });
         }
@@ -55,10 +51,9 @@ passport_1.default.use(new passport_azure_ad_oauth2_1.Strategy({
         const microsoftId = decoded.oid;
         const email = decoded.preferred_username;
         const name = decoded.name;
-        const tenantId = decoded.tid;
         let user = await user_model_1.default.findOne({ $or: [{ microsoftId }, { email }] });
         if (!user) {
-            user = new user_model_1.default({ email, name, tenantId, microsoftId, roles: [], status: 'active' });
+            user = new user_model_1.default({ email, name, microsoftId, roles: [], status: 'active' });
             await user.save();
         }
         else {
@@ -67,10 +62,6 @@ passport_1.default.use(new passport_azure_ad_oauth2_1.Strategy({
                 user.microsoftId = microsoftId;
                 changed = true;
             }
-            if (!user.tenantId) {
-                user.tenantId = tenantId;
-                changed = true;
-            }
             if (changed)
                 await user.save();
         }
@@ -121,7 +112,6 @@ if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET && process.
                 user = new user_model_1.default({
                     email,
                     name: profile.displayName,
-                    tenantId: DEFAULT_TENANT_ID,
                     googleId: profile.id,
                     roles: [],
                     status: 'active'
@@ -134,10 +124,6 @@ if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET && process.
                     user.googleId = profile.id;
                     changed = true;
                 }
-                if (!user.tenantId) {
-                    user.tenantId = DEFAULT_TENANT_ID;
-                    changed = true;
-                }
                 if (changed)
                     await user.save();
             }
@@ -197,7 +183,6 @@ if (process.env.FB_CLIENT_ID && process.env.FB_CLIENT_SECRET && process.env.FB_C
                 user = new user_model_1.default({
                     email,
                     name: profile.displayName,
-                    tenantId: DEFAULT_TENANT_ID,
                     facebookId: profile.id,
                     roles: [],
                     status: 'active'
@@ -210,10 +195,6 @@ if (process.env.FB_CLIENT_ID && process.env.FB_CLIENT_SECRET && process.env.FB_C
                     user.facebookId = profile.id;
                     changed = true;
                 }
-                if (!user.tenantId) {
-                    user.tenantId = DEFAULT_TENANT_ID;
-                    changed = true;
-                }
                 if (changed)
                     await user.save();
             }

package/dist/controllers/auth.controller.js

@@ -26,7 +26,6 @@ const user_model_1 = __importDefault(require("../models/user.model"));
 const client_model_1 = __importDefault(require("../models/client.model"));
 const role_model_1 = __importDefault(require("../models/role.model"));
 const helper_1 = require("../utils/helper");
-const TENANT_ID = process.env.MICROSOFT_TENANT_ID || 'common';
 const MSAL_MOBILE_CLIENT_ID = process.env.MSAL_MOBILE_CLIENT_ID;
 const resolveJwtExpiry = (value, fallback) => (value || fallback);
 const msJwks = (0, jwks_rsa_1.default)({
@@ -58,7 +57,6 @@ let AuthController = class AuthController {
         const payload = {
             id: principal._id,
             email: principal.email,
-            tenantId: principal.tenantId,
             roles,
             permissions,
         };
@@ -92,7 +90,6 @@ let AuthController = class AuthController {
         const payload = {
             id: principal._id,
             email: principal.email,
-            tenantId: principal.tenantId,
             roles,
             permissions,
         };
@@ -231,10 +228,6 @@ let AuthController = class AuthController {
             }
             const email = ms.preferred_username || ms.email;
             const name = ms.name;
-            const tid = ms.tid;
-            if (TENANT_ID && TENANT_ID !== 'common' && tid && tid !== TENANT_ID) {
-                return res.status(401).json({ message: 'Tenant mismatch.' });
-            }
             if (!email) {
                 return res.status(400).json({ message: 'Email claim missing in Microsoft ID token.' });
             }
@@ -244,7 +237,6 @@ let AuthController = class AuthController {
                 user = new user_model_1.default({
                     email,
                     name,
-                    tenantId: tid || TENANT_ID,
                     microsoftId,
                     roles: [],
                     status: 'active',
@@ -257,10 +249,6 @@ let AuthController = class AuthController {
                     user.microsoftId = microsoftId;
                     changed = true;
                 }
-                if (!user.tenantId) {
-                    user.tenantId = tid || TENANT_ID;
-                    changed = true;
-                }
                 if (changed)
                     await user.save();
             }
@@ -302,17 +290,10 @@ let AuthController = class AuthController {
     async googleExchange(req, res) {
         var _a, _b, _c, _d, _e, _f, _g, _h;
         try {
-            let { code, idToken, type = 'user', tenantId } = req.body || {};
+            let { code, idToken, type = 'user' } = req.body || {};
             if (!['user', 'client'].includes(type)) {
                 return res.status(400).json({ message: 'invalid type; must be "user" or "client"' });
             }
-            let resolvedTenantId;
-            if (type === 'user') {
-                resolvedTenantId = tenantId || process.env.DEFAULT_TENANT_ID;
-                if (!resolvedTenantId) {
-                    return res.status(400).json({ message: 'tenantId is required for user login.' });
-                }
-            }
             let email;
             let name;
             let googleId;
@@ -352,14 +333,12 @@ let AuthController = class AuthController {
             let principal = await Model.findOne({ $or: [{ email }, { googleId }] });
             if (!principal) {
                 principal = new Model(type === 'user'
-                    ? { email, name, googleId, tenantId: resolvedTenantId, roles: [], status: 'active' }
+                    ? { email, name, googleId, roles: [], status: 'active' }
                     : { email, name, googleId, roles: [] });
                 await principal.save();
             }
             else if (!principal.googleId) {
                 principal.googleId = googleId;
-                if (type === 'user' && !principal.tenantId)
-                    principal.tenantId = resolvedTenantId;
                 await principal.save();
             }
             const roleDocs = await role_model_1.default.find({ _id: { $in: principal.roles } })
@@ -368,7 +347,7 @@ let AuthController = class AuthController {
             const permissions = Array.from(new Set(roleDocs.flatMap((r) => r.permissions)));
             const accessTTL = resolveJwtExpiry(process.env.JWT_ACCESS_TOKEN_EXPIRES_IN, '15m');
             const refreshTTL = resolveJwtExpiry(process.env.JWT_REFRESH_TOKEN_EXPIRES_IN, '7d');
-            const payload = { id: principal._id, email: principal.email, tenantId: principal.tenantId, roles, permissions };
+            const payload = { id: principal._id, email: principal.email, roles, permissions };
             const accessToken = jsonwebtoken_1.default.sign(payload, process.env.JWT_SECRET, { expiresIn: accessTTL });
             const refreshToken = jsonwebtoken_1.default.sign({ id: principal._id }, process.env.JWT_REFRESH_SECRET, { expiresIn: refreshTTL });
             principal.refreshToken = refreshToken;
@@ -468,7 +447,6 @@ let AuthController = class AuthController {
             const payload = {
                 id: principal._id,
                 email: principal.email,
-                tenantId: principal.tenantId,
                 roles,
                 permissions,
             };

package/dist/controllers/roles.controller.js

@@ -21,11 +21,11 @@ const role_model_1 = __importDefault(require("../models/role.model"));
 let RolesController = class RolesController {
     async createRole(req, res) {
         try {
-            const { tenantId, name, description, permissions } = req.body;
-            if (!tenantId || !name) {
-                return res.status(400).json({ message: 'tenantId and role name are required.' });
+            const { name, description, permissions } = req.body;
+            if (!name) {
+                return res.status(400).json({ message: 'Role name is required.' });
             }
-            const newRole = new role_model_1.default({ tenantId, name, description, permissions });
+            const newRole = new role_model_1.default({ name, description, permissions });
             await newRole.save();
             return res.status(201).json(newRole);
         }
@@ -36,11 +36,7 @@ let RolesController = class RolesController {
     }
     async getRoles(req, res) {
         try {
-            const { tenantId } = req.params;
-            if (!tenantId) {
-                return res.status(400).json({ message: 'tenantId is required in the URL.' });
-            }
-            const roles = await role_model_1.default.paginate({ tenantId }, { page: 1, limit: 100 });
+            const roles = await role_model_1.default.paginate({}, { page: 1, limit: 100 });
             return res.status(200).json(roles);
         }
         catch (error) {
@@ -85,7 +81,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], RolesController.prototype, "createRole", null);
 __decorate([
-    (0, common_1.Get)(':tenantId'),
+    (0, common_1.Get)(),
     __param(0, (0, common_1.Req)()),
     __param(1, (0, common_1.Res)()),
     __metadata("design:type", Function),

package/dist/controllers/users.controller.js

@@ -24,17 +24,14 @@ const node_crypto_1 = require("node:crypto");
 let UsersController = class UsersController {
     async createUser(req, res) {
         try {
-            const { email, password, name, tenantId, microsoftId, roles } = req.body;
+            const { email, password, name, microsoftId, roles, jobTitle, company } = req.body;
             if (!email) {
                 return res.status(400).json({ message: 'Email is required.' });
             }
-            if (!tenantId) {
-                return res.status(400).json({ message: 'TenantId is required.' });
-            }
             if (!microsoftId && !password) {
                 return res.status(400).json({ message: 'Password is required for local login.' });
             }
-            const existingUser = await user_model_1.default.findOne({ email, tenantId });
+            const existingUser = await user_model_1.default.findOne({ email });
             if (existingUser) {
                 return res.status(400).json({ message: 'User with this email already exists.' });
             }
@@ -48,9 +45,10 @@ let UsersController = class UsersController {
                 email,
                 password: hashedPassword,
                 name,
-                tenantId,
                 microsoftId,
                 roles,
+                jobTitle,
+                company,
                 status,
                 resetPasswordToken: confirmationToken,
                 resetPasswordExpires: tokenExpiration
@@ -124,14 +122,11 @@ Thank you.`
     }
     async createUserInvitation(req, res) {
         try {
-            const { email, tenantId, name } = req.body;
+            const { email, name } = req.body;
             if (!email) {
                 return res.status(400).json({ message: 'Email is required.' });
             }
-            if (!tenantId) {
-                return res.status(400).json({ message: 'TenantId is required.' });
-            }
-            const existingUser = await user_model_1.default.findOne({ email, tenantId });
+            const existingUser = await user_model_1.default.findOne({ email });
             if (existingUser) {
                 return res.status(400).json({ message: 'User with this email already exists.' });
             }
@@ -139,7 +134,6 @@ Thank you.`
             const tokenExpiration = Date.now() + 24 * 60 * 60 * 1000;
             const newUser = new user_model_1.default({
                 email,
-                tenantId,
                 name,
                 resetPasswordToken: token,
                 resetPasswordExpires: tokenExpiration
@@ -180,8 +174,6 @@ Thank you!`
     async getAllUsers(req, res) {
         try {
             const filter = {};
-            if (req.query.tenantId)
-                filter.tenantId = req.query.tenantId;
             if (req.query.email)
                 filter.email = req.query.email;
             const page = Math.max(parseInt(req.query.page, 10) || 1, 1);

package/dist/index.d.ts

@@ -2,5 +2,4 @@ import 'reflect-metadata';
 export { AuthKitModule } from './auth-kit.module';
 export { AuthenticateGuard } from './middleware/authenticate.guard';
 export { AuthGuard } from './middleware/auth.guard';
-export { TenantGuard } from './middleware/tenant.guard';
 export { hasPermission } from './middleware/permission.guard';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasPermission = exports.TenantGuard = exports.AuthGuard = exports.AuthenticateGuard = exports.AuthKitModule = void 0;
+exports.hasPermission = exports.AuthGuard = exports.AuthenticateGuard = exports.AuthKitModule = void 0;
 require("reflect-metadata");
 var auth_kit_module_1 = require("./auth-kit.module");
 Object.defineProperty(exports, "AuthKitModule", { enumerable: true, get: function () { return auth_kit_module_1.AuthKitModule; } });
@@ -8,7 +8,5 @@ var authenticate_guard_1 = require("./middleware/authenticate.guard");
 Object.defineProperty(exports, "AuthenticateGuard", { enumerable: true, get: function () { return authenticate_guard_1.AuthenticateGuard; } });
 var auth_guard_1 = require("./middleware/auth.guard");
 Object.defineProperty(exports, "AuthGuard", { enumerable: true, get: function () { return auth_guard_1.AuthGuard; } });
-var tenant_guard_1 = require("./middleware/tenant.guard");
-Object.defineProperty(exports, "TenantGuard", { enumerable: true, get: function () { return tenant_guard_1.TenantGuard; } });
 var permission_guard_1 = require("./middleware/permission.guard");
 Object.defineProperty(exports, "hasPermission", { enumerable: true, get: function () { return permission_guard_1.hasPermission; } });

package/dist/middleware/permission.guard.js

@@ -18,18 +18,18 @@ const hasPermission = (requiredPermission) => {
             const req = context.switchToHttp().getRequest();
             const res = context.switchToHttp().getResponse();
             try {
-                const { tenantId, roleIds, roles, permissions } = req.user || {};
+                const { roleIds, roles, permissions } = req.user || {};
                 const tokenPermissions = Array.isArray(permissions) ? permissions : [];
                 if (tokenPermissions.includes(requiredPermission)) {
                     return true;
                 }
                 let resolvedPermissions = [];
                 if (Array.isArray(roleIds) && roleIds.length > 0) {
-                    const roleDocs = await role_model_1.default.find({ _id: { $in: roleIds }, tenantId });
+                    const roleDocs = await role_model_1.default.find({ _id: { $in: roleIds } });
                     resolvedPermissions = roleDocs.flatMap((role) => role.permissions);
                 }
-                else if (Array.isArray(roles) && roles.length > 0 && tenantId) {
-                    const roleDocs = await role_model_1.default.find({ name: { $in: roles }, tenantId });
+                else if (Array.isArray(roles) && roles.length > 0) {
+                    const roleDocs = await role_model_1.default.find({ name: { $in: roles } });
                     resolvedPermissions = roleDocs.flatMap((role) => role.permissions);
                 }
                 if (resolvedPermissions.includes(requiredPermission)) {

package/dist/models/role.model.d.ts

@@ -6,7 +6,6 @@ declare const RoleSchema: mongoose.Schema<any, mongoose.Model<any, any, any, any
     updatedAt: NativeDate;
 } & {
     name: string;
-    tenantId: string;
     permissions: string[];
     description?: string;
 }, mongoose.Document<unknown, {}, mongoose.FlatRecord<{
@@ -14,7 +13,6 @@ declare const RoleSchema: mongoose.Schema<any, mongoose.Model<any, any, any, any
     updatedAt: NativeDate;
 } & {
     name: string;
-    tenantId: string;
     permissions: string[];
     description?: string;
 }>> & mongoose.FlatRecord<{
@@ -22,7 +20,6 @@ declare const RoleSchema: mongoose.Schema<any, mongoose.Model<any, any, any, any
     updatedAt: NativeDate;
 } & {
     name: string;
-    tenantId: string;
     permissions: string[];
     description?: string;
 }> & {

package/dist/models/role.model.js

@@ -7,13 +7,11 @@ exports.RoleSchema = void 0;
 const mongoose_1 = __importDefault(require("mongoose"));
 const mongoose_paginate_v2_1 = __importDefault(require("mongoose-paginate-v2"));
 const RoleSchema = new mongoose_1.default.Schema({
-    tenantId: { type: String, required: true },
-    name: { type: String, required: true },
+    name: { type: String, required: true, unique: true },
     description: { type: String },
     permissions: [{ type: String }]
 }, { timestamps: true });
 exports.RoleSchema = RoleSchema;
 RoleSchema.plugin(mongoose_paginate_v2_1.default);
-RoleSchema.index({ tenantId: 1, name: 1 }, { unique: true });
 const Role = mongoose_1.default.models.Role || mongoose_1.default.model('Role', RoleSchema);
 exports.default = Role;

package/dist/models/user.model.d.ts

@@ -6,12 +6,13 @@ declare const UserSchema: mongoose.Schema<any, mongoose.Model<any, any, any, any
     updatedAt: NativeDate;
 } & {
     email: string;
-    tenantId: string;
     roles: mongoose.Types.ObjectId[];
     status: "pending" | "active" | "suspended" | "deactivated";
     failedLoginAttempts: number;
     name?: string;
     password?: string;
+    jobTitle?: string;
+    company?: string;
     microsoftId?: string;
     googleId?: string;
     facebookId?: string;
@@ -24,12 +25,13 @@ declare const UserSchema: mongoose.Schema<any, mongoose.Model<any, any, any, any
     updatedAt: NativeDate;
 } & {
     email: string;
-    tenantId: string;
     roles: mongoose.Types.ObjectId[];
     status: "pending" | "active" | "suspended" | "deactivated";
     failedLoginAttempts: number;
     name?: string;
     password?: string;
+    jobTitle?: string;
+    company?: string;
     microsoftId?: string;
     googleId?: string;
     facebookId?: string;
@@ -42,12 +44,13 @@ declare const UserSchema: mongoose.Schema<any, mongoose.Model<any, any, any, any
     updatedAt: NativeDate;
 } & {
     email: string;
-    tenantId: string;
     roles: mongoose.Types.ObjectId[];
     status: "pending" | "active" | "suspended" | "deactivated";
     failedLoginAttempts: number;
     name?: string;
     password?: string;
+    jobTitle?: string;
+    company?: string;
     microsoftId?: string;
     googleId?: string;
     facebookId?: string;

package/dist/models/user.model.js

@@ -9,7 +9,8 @@ const mongoose_paginate_v2_1 = __importDefault(require("mongoose-paginate-v2"));
 const UserSchema = new mongoose_1.default.Schema({
     email: {
         type: String,
-        required: true
+        required: true,
+        unique: true
     },
     password: {
         type: String,
@@ -18,7 +19,8 @@ const UserSchema = new mongoose_1.default.Schema({
         }
     },
     name: { type: String },
-    tenantId: { type: String, required: true },
+    jobTitle: { type: String },
+    company: { type: String },
     microsoftId: { type: String, index: true },
     googleId: { type: String, index: true },
     facebookId: { type: String, index: true },
@@ -36,6 +38,5 @@ const UserSchema = new mongoose_1.default.Schema({
 }, { timestamps: true });
 exports.UserSchema = UserSchema;
 UserSchema.plugin(mongoose_paginate_v2_1.default);
-UserSchema.index({ tenantId: 1, email: 1 }, { unique: true });
 const User = mongoose_1.default.models.User || mongoose_1.default.model('User', UserSchema);
 exports.default = User;

package/package.json

@@ -7,8 +7,8 @@
     "type": "git",
     "url": "git+https://github.com/CISCODE-MA/AuthKit.git"
   },
-  "version": "1.1.2",
-  "description": "A login library with local login, Microsoft Entra ID authentication, password reset, and roles/permissions for multi-tenant applications.",
+  "version": "1.1.3",
+  "description": "A login library with local login, Microsoft Entra ID authentication, password reset, and roles/permissions.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -30,7 +30,7 @@
     "password-reset",
     "roles",
     "permissions",
-    "multi-tenant"
+    "users"
   ],
   "author": "Ciscode",
   "license": "MIT",

package/dist/middleware/tenant.guard.d.ts

@@ -1,4 +0,0 @@
-import { CanActivate, ExecutionContext } from '@nestjs/common';
-export declare class TenantGuard implements CanActivate {
-    canActivate(context: ExecutionContext): boolean;
-}

package/dist/middleware/tenant.guard.js

@@ -1,39 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TenantGuard = void 0;
-const common_1 = require("@nestjs/common");
-const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
-let TenantGuard = class TenantGuard {
-    canActivate(context) {
-        var _a, _b;
-        const req = context.switchToHttp().getRequest();
-        const res = context.switchToHttp().getResponse();
-        const token = (_b = (_a = req.headers) === null || _a === void 0 ? void 0 : _a.authorization) === null || _b === void 0 ? void 0 : _b.split(' ')[1];
-        if (!token) {
-            res.status(401).json({ error: 'Unauthorized' });
-            return false;
-        }
-        try {
-            const decoded = jsonwebtoken_1.default.verify(token, process.env.JWT_SECRET);
-            req.tenantId = decoded.tenantId;
-            return true;
-        }
-        catch (error) {
-            res.status(403).json({ error: 'Invalid token' });
-            return false;
-        }
-    }
-};
-exports.TenantGuard = TenantGuard;
-exports.TenantGuard = TenantGuard = __decorate([
-    (0, common_1.Injectable)()
-], TenantGuard);