@flusys/nestjs-auth 0.1.0-beta.2 → 1.0.0-beta

package/cjs/services/authentication.service.js

@@ -17,6 +17,8 @@ const _utils = require("@flusys/nestjs-shared/utils");
 const _authconfigservice = require("./auth-config.service");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 const _enums = require("../enums");
+const _config = require("../config");
+const _classes = require("@flusys/nestjs-shared/classes");
 const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
@@ -90,12 +92,8 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-// Password hashing configuration
-const BCRYPT_SALT_ROUNDS = 12; // Increased from 10 for better security
 let AuthenticationService = class AuthenticationService {
-    // ==========================================================================
-    // REPOSITORY GETTERS
-    // ==========================================================================
+    // Repository Getters
     async getUserRepository() {
         if (this.dataSourceProvider) {
             return this.dataSourceProvider.getRepository(_userentity.User);
@@ -126,13 +124,8 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.injectedBranchRepository ?? null;
     }
-    // ==========================================================================
-    // LOGIN
-    // ==========================================================================
-    /**
-   * Login with email and password
-   * Returns either tokens directly or requires company/branch selection
-   */ async login(email, password) {
+    // Login
+    /** Login with email and password. Returns tokens or requires company/branch selection. */ async login(email, password) {
         const user = await this.validateUser(email, password);
         if (!user.isActive) {
             throw new _common.UnauthorizedException('User account is deactivated');
@@ -143,9 +136,7 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.handleCompanyBasedLogin(user);
     }
-    /**
-   * Handle login when company feature is enabled
-   */ async handleCompanyBasedLogin(user) {
+    /** Handle login when company feature is enabled */ async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !branchRepository) {
@@ -195,13 +186,8 @@ let AuthenticationService = class AuthenticationService {
         // Returns all companies with their branches for frontend to display
         return await this.generateCompanySelectionResponse(user, companies, branches);
     }
-    // ==========================================================================
-    // REGISTRATION
-    // ==========================================================================
-    /**
-   * Register a new user
-   * If company feature enabled, optionally join/create company
-   */ async register(dto) {
+    // Registration
+    /** Register a new user. If company feature enabled, optionally join/create company. */ async register(dto) {
         const userRepository = await this.getUserRepository();
         // Check if user exists
         // Note: Generic error message to prevent email enumeration attacks
@@ -214,7 +200,7 @@ let AuthenticationService = class AuthenticationService {
             throw new _common.BadRequestException('Registration failed. Please try again or contact support.');
         }
         // Create user
-        const hashedPassword = await _bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
+        const hashedPassword = await _bcrypt.hash(dto.password, _config.BCRYPT_SALT_ROUNDS);
         const user = userRepository.create({
             name: dto.name,
             email: dto.email,
@@ -232,9 +218,7 @@ let AuthenticationService = class AuthenticationService {
         // Handle company feature
         return this.handleCompanyRegistration(user, dto);
     }
-    /**
-   * Handle company-related registration logic
-   */ async handleCompanyRegistration(user, dto) {
+    /** Handle company-related registration logic */ async handleCompanyRegistration(user, dto) {
         const companyRepository = await this.getCompanyRepository();
         const branchRepository = await this.getBranchRepository();
         const permissionRepository = await this.getPermissionRepository();
@@ -331,18 +315,11 @@ let AuthenticationService = class AuthenticationService {
         // No company assigned
         return this.generateLoginResponse(user, true);
     }
-    /**
-   * Generate URL-friendly slug from name
-   */ generateSlug(name) {
+    /** Generate URL-friendly slug from name */ generateSlug(name) {
         return name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').substring(0, 100);
     }
-    // ==========================================================================
-    // COMPANY/BRANCH SELECTION
-    // ==========================================================================
-    /**
-   * Select company and branch (step 2 of login)
-   * Frontend receives all options and user selects both together
-   */ async select(sessionId, companyId, branchId) {
+    // Company/Branch Selection
+    /** Select company and branch (step 2 of login). Frontend receives all options and user selects both. */ async select(sessionId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         if (!this.sessionService) {
             throw new _common.BadRequestException('Session service not available');
@@ -409,9 +386,7 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
-    /**
-   * Switch company/branch after login
-   */ async switchCompany(userId, companyId, branchId) {
+    /** Switch company/branch after login */ async switchCompany(userId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
@@ -470,13 +445,8 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
-    // ==========================================================================
-    // TOKEN MANAGEMENT
-    // ==========================================================================
-    /**
-   * Refresh access token (with token rotation)
-   * Returns new access token and new refresh token
-   */ async refreshToken(refreshToken) {
+    // Token Management
+    /** Refresh access token (with token rotation). Returns new access token and new refresh token. */ async refreshToken(refreshToken) {
         try {
             const payload = this.jwtService.verify(refreshToken, {
                 secret: this.authConfig.getRefreshTokenSecret()
@@ -542,9 +512,7 @@ let AuthenticationService = class AuthenticationService {
             throw new _common.UnauthorizedException('Invalid or expired refresh token');
         }
     }
-    /**
-   * Change password
-   */ async changePassword(userId, currentPassword, newPassword) {
+    /** Change password */ async changePassword(userId, currentPassword, newPassword) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -558,18 +526,53 @@ let AuthenticationService = class AuthenticationService {
         if (!isPasswordValid) {
             throw new _common.UnauthorizedException('Current password is incorrect');
         }
-        user.password = await _bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
+        user.password = await _bcrypt.hash(newPassword, _config.BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
     }
-    /**
-   * Logout (placeholder for token blacklisting if needed)
-   */ async logout(_userId) {}
-    // ==========================================================================
-    // QUERY METHODS
-    // ==========================================================================
-    /**
-   * Get user's companies
-   */ async getUserCompanies(userId) {
+    /** Logout - Revokes all tokens. Stores revocation timestamp in cache. */ async logout(userId) {
+        if (!this.cacheManager) {
+            // Cache not available - graceful degradation (client-side logout only)
+            return;
+        }
+        const revokedAt = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
+        const cacheKey = `${_config.TOKEN_REVOKED_PREFIX}:${userId}`;
+        // TTL matches refresh token expiry (tokens older than this are already expired)
+        const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
+        const ttlMs = this.parseExpiryToMs(refreshTokenExpiry);
+        await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+    }
+    /** Check if a token is revoked (issued before user's revocation timestamp) */ async isTokenRevoked(userId, tokenIssuedAt) {
+        if (!this.cacheManager || !tokenIssuedAt) {
+            return false;
+        }
+        const cacheKey = `${_config.TOKEN_REVOKED_PREFIX}:${userId}`;
+        const revokedAt = await this.cacheManager.get(cacheKey);
+        if (!revokedAt) {
+            return false;
+        }
+        // Token is revoked if it was issued before the revocation timestamp
+        return tokenIssuedAt < revokedAt;
+    }
+    /** Parse JWT expiry string to milliseconds */ parseExpiryToMs(expiry) {
+        const match = expiry.match(/^(\d+)([smhd])$/);
+        if (!match) return 7 * 24 * 60 * 60 * 1000; // Default 7 days
+        const value = parseInt(match[1], 10);
+        const unit = match[2];
+        switch(unit){
+            case 's':
+                return value * 1000;
+            case 'm':
+                return value * 60 * 1000;
+            case 'h':
+                return value * 60 * 60 * 1000;
+            case 'd':
+                return value * 24 * 60 * 60 * 1000;
+            default:
+                return 7 * 24 * 60 * 60 * 1000;
+        }
+    }
+    // Query Methods
+    /** Get user's companies */ async getUserCompanies(userId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
@@ -590,9 +593,7 @@ let AuthenticationService = class AuthenticationService {
             active: true
         }).orderBy('c.name', 'ASC').getMany();
     }
-    /**
-   * Get branches for a company that user has access to
-   */ async getUserBranches(userId, companyId) {
+    /** Get branches for a company that user has access to */ async getUserBranches(userId, companyId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
@@ -627,9 +628,7 @@ let AuthenticationService = class AuthenticationService {
             active: true
         }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
     }
-    /**
-   * Get company by ID
-   */ async getCompanyById(companyId) {
+    /** Get company by ID */ async getCompanyById(companyId) {
         const companyRepository = await this.getCompanyRepository();
         if (!companyRepository) {
             return null;
@@ -640,9 +639,7 @@ let AuthenticationService = class AuthenticationService {
             }
         });
     }
-    /**
-   * Get branch by ID
-   */ async getBranchById(branchId) {
+    /** Get branch by ID */ async getBranchById(branchId) {
         const branchRepository = await this.getBranchRepository();
         if (!branchRepository) {
             return null;
@@ -653,10 +650,7 @@ let AuthenticationService = class AuthenticationService {
             }
         });
     }
-    /**
-   * Get user info for /auth/me endpoint
-   * Returns only user, company, and branch information (no tokens)
-   */ async getUserInfo(userId, companyId, branchId) {
+    /** Get user info for /auth/me endpoint. Returns user, company, and branch info (no tokens). */ async getUserInfo(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -707,9 +701,7 @@ let AuthenticationService = class AuthenticationService {
         }
         return response;
     }
-    // ==========================================================================
-    // HELPER METHODS
-    // ==========================================================================
+    // Helper Methods
     ensureCompanyFeatureEnabled() {
         if (!this.authConfig.isCompanyFeatureEnabled()) {
             throw new _common.BadRequestException('Company feature is not enabled');
@@ -733,9 +725,7 @@ let AuthenticationService = class AuthenticationService {
         await userRepository.save(user);
         return user;
     }
-    // ==========================================================================
-    // RESPONSE GENERATORS
-    // ==========================================================================
+    // Response Generators
     generateLoginResponse(user, companyFeatureEnabled = false) {
         const payload = {
             id: user.id,
@@ -848,9 +838,10 @@ let AuthenticationService = class AuthenticationService {
         };
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, dataSourceProvider, sessionService, injectedUserRepository, injectedPermissionRepository, injectedCompanyRepository, injectedBranchRepository){
+    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, injectedUserRepository, injectedPermissionRepository, injectedCompanyRepository, injectedBranchRepository){
         _define_property(this, "jwtService", void 0);
         _define_property(this, "authConfig", void 0);
+        _define_property(this, "cacheManager", void 0);
         _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "sessionService", void 0);
         _define_property(this, "injectedUserRepository", void 0);
@@ -860,6 +851,7 @@ let AuthenticationService = class AuthenticationService {
         _define_property(this, "logger", void 0);
         this.jwtService = jwtService;
         this.authConfig = authConfig;
+        this.cacheManager = cacheManager;
         this.dataSourceProvider = dataSourceProvider;
         this.sessionService = sessionService;
         this.injectedUserRepository = injectedUserRepository;
@@ -876,21 +868,24 @@ AuthenticationService = _ts_decorate([
     _ts_param(0, (0, _common.Inject)(_jwt.JwtService)),
     _ts_param(1, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
     _ts_param(2, (0, _common.Optional)()),
-    _ts_param(2, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
+    _ts_param(2, (0, _common.Inject)('CACHE_INSTANCE')),
     _ts_param(3, (0, _common.Optional)()),
-    _ts_param(3, (0, _common.Inject)(_companyselectionsessionservice.CompanySelectionSessionService)),
+    _ts_param(3, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
     _ts_param(4, (0, _common.Optional)()),
-    _ts_param(4, (0, _typeorm.InjectRepository)(_userentity.User)),
+    _ts_param(4, (0, _common.Inject)(_companyselectionsessionservice.CompanySelectionSessionService)),
     _ts_param(5, (0, _common.Optional)()),
-    _ts_param(5, (0, _typeorm.InjectRepository)(_usercompanypermissionentity.UserCompanyPermission)),
+    _ts_param(5, (0, _typeorm.InjectRepository)(_userentity.User)),
     _ts_param(6, (0, _common.Optional)()),
-    _ts_param(6, (0, _typeorm.InjectRepository)(_companyentity.Company)),
+    _ts_param(6, (0, _typeorm.InjectRepository)(_usercompanypermissionentity.UserCompanyPermission)),
     _ts_param(7, (0, _common.Optional)()),
-    _ts_param(7, (0, _typeorm.InjectRepository)(_companybranchentity.CompanyBranch)),
+    _ts_param(7, (0, _typeorm.InjectRepository)(_companyentity.Company)),
+    _ts_param(8, (0, _common.Optional)()),
+    _ts_param(8, (0, _typeorm.InjectRepository)(_companybranchentity.CompanyBranch)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _jwt.JwtService === "undefined" ? Object : _jwt.JwtService,
         typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
+        typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
         typeof _companyselectionsessionservice.CompanySelectionSessionService === "undefined" ? Object : _companyselectionsessionservice.CompanySelectionSessionService,
         typeof _typeorm1.Repository === "undefined" ? Object : _typeorm1.Repository,

package/cjs/services/branch.service.js

@@ -42,41 +42,15 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let BranchService = class BranchService extends _classes.RequestScopedApiService {
-    /**
-   * Resolve entity class for this service
-   * @returns CompanyBranch entity class
-   */ resolveEntity() {
+    resolveEntity() {
         return _companybranchentity.CompanyBranch;
     }
-    /**
-   * Get DataSource provider for this service
-   * @returns AuthDataSourceProvider instance
-   */ getDataSourceProvider() {
+    getDataSourceProvider() {
         return this.dataSourceProvider;
     }
-    // ==================== Entity Conversion ====================
-    async convertSingleDtoToEntity(dto, _user) {
-        // Repository initialization is handled automatically by RequestScopedApiService
-        let branch = new _companybranchentity.CompanyBranch();
-        if ('id' in dto && dto.id && typeof dto.id === 'string') {
-            const dbData = await this.repository.findOne({
-                where: {
-                    id: dto.id
-                }
-            });
-            if (!dbData) {
-                throw new _common.NotFoundException('Branch not found');
-            }
-            branch = dbData;
-        }
-        return {
-            ...branch,
-            ...dto
-        };
-    }
+    // Query Customization
     async getSelectQuery(query, _user, select) {
-        // Repository initialization is handled automatically by RequestScopedApiService
-        if (!select || !select.length) {
+        if (!select?.length) {
             select = [
                 'id',
                 'name',
@@ -85,14 +59,13 @@ let BranchService = class BranchService extends _classes.RequestScopedApiService
                 'createdAt'
             ];
         }
-        const selectFields = select.map((field)=>`${this.entityName}.${field}`);
-        query.select(selectFields);
+        query.select(select.map((f)=>`${this.entityName}.${f}`));
         return {
             query,
             isRaw: false
         };
     }
-    async getGlobalSearchQuery(query, search, _user) {
+    async getGlobalSearchQuery(query, search) {
         query.andWhere('(company_branch.name LIKE :search OR company_branch.slug LIKE :search OR company_branch.email LIKE :search)', {
             search: `%${search}%`
         });
@@ -101,24 +74,17 @@ let BranchService = class BranchService extends _classes.RequestScopedApiService
             isRaw: false
         };
     }
-    /**
-   * Override: Filter branches by user's company
-   * Ensures users can only see branches belonging to their company
-   */ async getExtraManipulateQuery(query, _filterAndPaginationDto, user) {
-        const result = await super.getExtraManipulateQuery(query, _filterAndPaginationDto, user);
-        // Only apply company filtering if company feature is enabled and user has company context
-        const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
-        if (isCompanyFeatureEnabled && user?.companyId) {
+    async getExtraManipulateQuery(query, filterDto, user) {
+        const result = await super.getExtraManipulateQuery(query, filterDto, user);
+        if (this.authConfig.isCompanyFeatureEnabled() && user?.companyId) {
             query.andWhere('company_branch.company_id = :companyId', {
                 companyId: user.companyId
             });
         }
         return result;
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig){
-        // Repository will be set asynchronously by RequestScopedApiService
-        super('company_branch', null, cacheManager, utilsService, BranchService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "logger", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.logger = new _common.Logger(BranchService.name);
+        super('company_branch', null, cacheManager, utilsService, BranchService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig;
     }
 };
 BranchService = _ts_decorate([

package/cjs/services/company.service.js

@@ -41,41 +41,15 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let CompanyService = class CompanyService extends _classes.RequestScopedApiService {
-    /**
-   * Resolve entity class for this service
-   * @returns Company entity class
-   */ resolveEntity() {
+    resolveEntity() {
         return _companyentity.Company;
     }
-    /**
-   * Get DataSource provider for this service
-   * @returns AuthDataSourceProvider instance
-   */ getDataSourceProvider() {
+    getDataSourceProvider() {
         return this.dataSourceProvider;
     }
-    // ==================== Entity Conversion ====================
-    async convertSingleDtoToEntity(dto, _user) {
-        // Repository initialization is handled automatically by RequestScopedApiService
-        let company = new _companyentity.Company();
-        if ('id' in dto && dto.id && typeof dto.id === 'string') {
-            const dbData = await this.repository.findOne({
-                where: {
-                    id: dto.id
-                }
-            });
-            if (!dbData) {
-                throw new _common.NotFoundException('Company not found');
-            }
-            company = dbData;
-        }
-        return {
-            ...company,
-            ...dto
-        };
-    }
+    // Query Customization
     async getSelectQuery(query, _user, select) {
-        // Repository initialization is handled automatically by RequestScopedApiService
-        if (!select || !select.length) {
+        if (!select?.length) {
             select = [
                 'id',
                 'name',
@@ -84,14 +58,13 @@ let CompanyService = class CompanyService extends _classes.RequestScopedApiServi
                 'createdAt'
             ];
         }
-        const selectFields = select.map((field)=>`${this.entityName}.${field}`);
-        query.select(selectFields);
+        query.select(select.map((f)=>`${this.entityName}.${f}`));
         return {
             query,
             isRaw: false
         };
     }
-    async getGlobalSearchQuery(query, search, _user) {
+    async getGlobalSearchQuery(query, search) {
         query.andWhere('(company.name LIKE :search OR company.slug LIKE :search OR company.email LIKE :search)', {
             search: `%${search}%`
         });
@@ -100,10 +73,8 @@ let CompanyService = class CompanyService extends _classes.RequestScopedApiServi
             isRaw: false
         };
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(cacheManager, utilsService, dataSourceProvider){
-        // Repository will be set asynchronously by RequestScopedApiService
-        super('company', null, cacheManager, utilsService, CompanyService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "logger", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.logger = new _common.Logger(CompanyService.name);
+        super('company', null, cacheManager, utilsService, CompanyService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider;
     }
 };
 CompanyService = _ts_decorate([

package/cjs/services/user-permission.service.js

@@ -39,20 +39,14 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let UserPermissionService = class UserPermissionService {
-    /**
-   * Get repository lazily - initialized on first access
-   */ async getRepository() {
+    /** Get repository lazily - initialized on first access */ async getRepository() {
         if (!this._repository) {
             this._repository = await this.dataSourceProvider.getRepository(_usercompanypermissionentity.UserCompanyPermission);
         }
         return this._repository;
     }
-    // ==========================================================================
-    // COMPANY PERMISSIONS
-    // ==========================================================================
-    /**
-   * Find all companies a user has access to
-   */ async findUserCompanies(userId) {
+    // Company Permissions
+    /** Find all companies a user has access to */ async findUserCompanies(userId) {
         const repository = await this.getRepository();
         return repository.find({
             where: {
@@ -67,9 +61,7 @@ let UserPermissionService = class UserPermissionService {
             }
         });
     }
-    /**
-   * Assign user to a company
-   */ async assignUserToCompany(dto) {
+    /** Assign user to a company */ async assignUserToCompany(dto) {
         const repository = await this.getRepository();
         // Check if already exists
         const existing = await repository.findOne({
@@ -90,9 +82,7 @@ let UserPermissionService = class UserPermissionService {
         });
         await repository.save(permission);
     }
-    /**
-   * Revoke user access to a company
-   */ async revokeCompanyAccess(userId, companyId) {
+    /** Revoke user access to a company */ async revokeCompanyAccess(userId, companyId) {
         const repository = await this.getRepository();
         const permission = await repository.findOne({
             where: {
@@ -106,12 +96,8 @@ let UserPermissionService = class UserPermissionService {
         }
         await repository.remove(permission);
     }
-    // ==========================================================================
-    // BRANCH PERMISSIONS
-    // ==========================================================================
-    /**
-   * Find all branches a user has access to
-   */ async findUserBranches(userId) {
+    // Branch Permissions
+    /** Find all branches a user has access to */ async findUserBranches(userId) {
         const repository = await this.getRepository();
         return repository.find({
             where: {
@@ -126,9 +112,7 @@ let UserPermissionService = class UserPermissionService {
             }
         });
     }
-    /**
-   * Assign user to a branch
-   */ async assignUserToBranch(dto) {
+    /** Assign user to a branch */ async assignUserToBranch(dto) {
         const repository = await this.getRepository();
         // Check if already exists
         const existing = await repository.findOne({
@@ -149,9 +133,7 @@ let UserPermissionService = class UserPermissionService {
         });
         await repository.save(permission);
     }
-    /**
-   * Revoke user access to a branch
-   */ async revokeBranchAccess(userId, branchId) {
+    /** Revoke user access to a branch */ async revokeBranchAccess(userId, branchId) {
         const repository = await this.getRepository();
         const permission = await repository.findOne({
             where: {