@flusys/nestjs-auth 0.1.0-beta.3 → 1.0.0-beta

package/README.md

@@ -763,14 +763,4 @@ The authentication package provides:
 
 ---
 
-**Last Updated:** 2026-02-09
-**Version:** 4.1.6
-
-**Recent Improvements:**
-- 2026-02-09: Added explicit `@Inject()` decorators to all services for esbuild bundling compatibility
-- 2026-02-09: All services now use REQUEST scope with DataSource Provider pattern
-- 2026-02-07: Fixed entity diagram to show polymorphic design (permissionType/targetId)
-- 2026-02-07: Updated service names to match actual implementation
-- 2026-02-07: Simplified login flow diagrams
-- 2026-01-15: Fixed JwtStrategy to use `ModuleRef` for request-scoped `AuthDataSourceProvider` resolution
-- 2026-01-14: Added `UserPermissionController` for batch permission management
+**Last Updated:** 2026-02-16

package/cjs/config/auth.constants.js

@@ -1,7 +1,5 @@
-// =============================================================================
-// INJECTION TOKENS
-// =============================================================================
-/** Injection token for auth module options */ "use strict";
+// Injection Tokens
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
@@ -15,9 +13,17 @@ _export(exports, {
     get AUTH_MODULE_OPTIONS () {
         return AUTH_MODULE_OPTIONS;
     },
+    get BCRYPT_SALT_ROUNDS () {
+        return BCRYPT_SALT_ROUNDS;
+    },
     get SESSION_CACHE_PREFIX () {
         return SESSION_CACHE_PREFIX;
+    },
+    get TOKEN_REVOKED_PREFIX () {
+        return TOKEN_REVOKED_PREFIX;
     }
 });
 const AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
+const BCRYPT_SALT_ROUNDS = 12;
 const SESSION_CACHE_PREFIX = 'auth:session';
+const TOKEN_REVOKED_PREFIX = 'auth:revoked';

package/cjs/controllers/authentication.controller.js

@@ -47,37 +47,22 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthenticationController = class AuthenticationController {
-    // ==========================================================================
-    // CORE ENDPOINTS (Always available)
-    // ==========================================================================
-    /**
-   * Login
-   * Returns either tokens directly or company/branch selection requirement
-   * Browser: refreshToken set in HTTP-only cookie, not in response body
-   * API/Mobile: refreshToken included in response body
-   */ async login(loginDto) {
+    // Core Endpoints
+    /** Login - Returns tokens or company/branch selection requirement */ async login(loginDto) {
         const result = await this.authService.login(loginDto.email, loginDto.password);
         if ('requiresSelection' in result) {
             return result;
         }
         return result;
     }
-    /**
-   * Register new user
-   * If company feature enabled, can optionally join/create company
-   * Browser: refreshToken set in HTTP-only cookie
-   */ async register(registrationDto) {
+    /** Register new user. If company feature enabled, can join/create company. */ async register(registrationDto) {
         const result = await this.authService.register(registrationDto);
         return {
             ...result,
             companyFeatureEnabled: this.authConfig?.isCompanyFeatureEnabled() ?? false
         };
     }
-    /**
-   * Refresh access token
-   * Browser: Gets refreshToken from HTTP-only cookie
-   * API/Mobile: Gets refreshToken from request body
-   */ async refreshToken(req, refreshTokenDto) {
+    /** Refresh access token. Browser uses HTTP-only cookie, API/Mobile uses request body. */ async refreshToken(req, refreshTokenDto) {
         // Get refresh token from cookie (browser) or body (API/mobile)
         const cookieName = this.authConfig?.getRefreshTokenCookieName() ?? 'fsn_refresh_token';
         const refreshToken = req.cookies?.[cookieName] || refreshTokenDto.refreshToken;
@@ -86,26 +71,16 @@ let AuthenticationController = class AuthenticationController {
         }
         return this.authService.refreshToken(refreshToken);
     }
-    /**
-   * Get current user info
-   * Returns only user, company, and branch data (no tokens)
-   * Uses existing access token from Authorization header
-   * Company/branch fields are automatically excluded from Swagger when company feature is disabled
-   */ async getCurrentUser(user) {
+    /** Get current user info. Returns user, company, and branch data (no tokens). */ async getCurrentUser(user) {
         return this.authService.getUserInfo(user.id, user.companyId, user.branchId);
     }
-    /**
-   * Logout
-   * Clears refresh token cookie for browsers
-   */ async logout(userId) {
+    /** Logout - Clears refresh token cookie for browsers */ async logout(userId) {
         await this.authService.logout(userId);
         return {
             message: 'Logged out successfully'
         };
     }
-    /**
-   * Change password
-   */ async changePassword(userId, dto) {
+    /** Change password */ async changePassword(userId, dto) {
         await this.authService.changePassword(userId, dto.currentPassword, dto.newPassword);
         return {
             message: 'Password changed successfully'

package/cjs/controllers/branch.controller.js

@@ -12,7 +12,6 @@ const _classes = require("@flusys/nestjs-shared/classes");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _companybranchdto = require("../dtos/company-branch.dto");
-const _guards = require("@flusys/nestjs-shared/guards");
 const _branchservice = require("../services/branch.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -41,16 +40,16 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-let BranchController = class BranchController extends (0, _classes.createApiController)(_companybranchdto.CreateCompanyBranchDto, _companybranchdto.UpdateCompanyBranchDto, _companybranchdto.CompanyBranchResponseDto) {
+let BranchController = class BranchController extends (0, _classes.createApiController)(_companybranchdto.CreateCompanyBranchDto, _companybranchdto.UpdateCompanyBranchDto, _companybranchdto.CompanyBranchResponseDto, {
+    security: 'jwt'
+}) {
     constructor(branchService){
         super(branchService), _define_property(this, "branchService", void 0), this.branchService = branchService;
     }
 };
 BranchController = _ts_decorate([
     (0, _swagger.ApiTags)('Branches'),
-    (0, _swagger.ApiBearerAuth)(),
     (0, _common.Controller)('administration/branch'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
     _ts_param(0, (0, _common.Inject)(_branchservice.BranchService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/cjs/controllers/company.controller.js

@@ -12,7 +12,6 @@ const _classes = require("@flusys/nestjs-shared/classes");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _companydto = require("../dtos/company.dto");
-const _guards = require("@flusys/nestjs-shared/guards");
 const _companyservice = require("../services/company.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -41,16 +40,16 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-let CompanyController = class CompanyController extends (0, _classes.createApiController)(_companydto.CreateCompanyDto, _companydto.UpdateCompanyDto, _companydto.CompanyResponseDto) {
+let CompanyController = class CompanyController extends (0, _classes.createApiController)(_companydto.CreateCompanyDto, _companydto.UpdateCompanyDto, _companydto.CompanyResponseDto, {
+    security: 'jwt'
+}) {
     constructor(companyService){
         super(companyService), _define_property(this, "companyService", void 0), this.companyService = companyService;
     }
 };
 CompanyController = _ts_decorate([
     (0, _swagger.ApiTags)('Companies'),
-    (0, _swagger.ApiBearerAuth)(),
     (0, _common.Controller)('administration/company'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
     _ts_param(0, (0, _common.Inject)(_companyservice.CompanyService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/cjs/controllers/user-permission.controller.js

@@ -41,12 +41,8 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let UserPermissionController = class UserPermissionController {
-    // ========================================================================
-    // USER-COMPANY PERMISSIONS
-    // ========================================================================
-    /**
-   * Batch assign/revoke user-company permissions
-   */ async assignUserCompany(dto) {
+    // User-Company Permissions
+    /** Batch assign/revoke user-company permissions */ async assignUserCompany(dto) {
         let addedCount = 0;
         let removedCount = 0;
         for (const item of dto.items){
@@ -66,9 +62,7 @@ let UserPermissionController = class UserPermissionController {
             message: `Processed ${addedCount} additions and ${removedCount} removals`
         };
     }
-    /**
-   * Get user's companies
-   */ async getUserCompanies(userId) {
+    /** Get user's companies */ async getUserCompanies(userId) {
         const permissions = await this.userPermissionService.findUserCompanies(userId);
         // Map to DTO format with populated company details
         const data = permissions.map((permission)=>({
@@ -82,12 +76,8 @@ let UserPermissionController = class UserPermissionController {
             data
         };
     }
-    // ========================================================================
-    // USER-BRANCH PERMISSIONS
-    // ========================================================================
-    /**
-   * Batch assign/revoke user-branch permissions
-   */ async assignUserBranch(dto) {
+    // User-Branch Permissions
+    /** Batch assign/revoke user-branch permissions */ async assignUserBranch(dto) {
         let addedCount = 0;
         let removedCount = 0;
         for (const item of dto.items){
@@ -107,9 +97,7 @@ let UserPermissionController = class UserPermissionController {
             message: `Processed ${addedCount} additions and ${removedCount} removals`
         };
     }
-    /**
-   * Get user's branches
-   */ async getUserBranches(userId) {
+    /** Get user's branches */ async getUserBranches(userId) {
         const permissions = await this.userPermissionService.findUserBranches(userId);
         // Map to DTO format with populated branch details
         const data = permissions.map((permission)=>({

package/cjs/controllers/user.controller.js

@@ -10,11 +10,11 @@ Object.defineProperty(exports, "UserController", {
 });
 const _classes = require("@flusys/nestjs-shared/classes");
 const _decorators = require("@flusys/nestjs-shared/decorators");
+const _guards = require("@flusys/nestjs-shared/guards");
 const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _userdto = require("../dtos/user.dto");
-const _guards = require("@flusys/nestjs-shared/guards");
 const _userservice = require("../services/user.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -43,40 +43,29 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-let UserController = class UserController extends (0, _classes.createApiController)(_userdto.CreateUserDto, _userdto.UpdateUserDto, _userdto.UserResponseDto) {
-    // ==========================================================================
-    // CUSTOM ENDPOINTS (Beyond standard CRUD)
-    // ==========================================================================
-    /**
-   * Verify user email
-   */ async verifyEmail(id) {
+let UserController = class UserController extends (0, _classes.createApiController)(_userdto.CreateUserDto, _userdto.UpdateUserDto, _userdto.UserResponseDto, {
+    security: 'jwt'
+}) {
+    // Custom Endpoints
+    /** Verify user email */ async verifyEmail(id) {
         await this.service.verifyEmail(id);
         return {
             message: 'Email verified successfully'
         };
     }
-    /**
-   * Verify user phone
-   */ async verifyPhone(id) {
+    /** Verify user phone */ async verifyPhone(id) {
         await this.service.verifyPhone(id);
         return {
             message: 'Phone verified successfully'
         };
     }
-    /**
-   * Update user active status
-   *
-   * When company feature is disabled: Updates User.isActive directly
-   * When company feature is enabled: Updates UserCompanyPermission.isActive for logged user's company
-   */ async updateStatus(id, isActive, user) {
+    /** Update user active status. When company feature enabled, updates permission isActive for logged user's company. */ async updateStatus(id, isActive, user) {
         await this.service.updateStatus(id, isActive, user);
         return {
             message: 'Status updated successfully'
         };
     }
-    /**
-   * Update user profile
-   */ async profile(dto, user) {
+    /** Update user profile */ async profile(dto, user) {
         const data = await this.service.profile(dto, user);
         return {
             message: 'Profile updated successfully',
@@ -89,6 +78,8 @@ let UserController = class UserController extends (0, _classes.createApiControll
 };
 _ts_decorate([
     (0, _common.Post)(':id/verify-email'),
+    (0, _common.UseGuards)(_guards.JwtAuthGuard),
+    (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Verify user email'
     }),
@@ -105,6 +96,8 @@ _ts_decorate([
 ], UserController.prototype, "verifyEmail", null);
 _ts_decorate([
     (0, _common.Post)(':id/verify-phone'),
+    (0, _common.UseGuards)(_guards.JwtAuthGuard),
+    (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Verify user phone'
     }),
@@ -121,6 +114,8 @@ _ts_decorate([
 ], UserController.prototype, "verifyPhone", null);
 _ts_decorate([
     (0, _common.Put)(':id/status'),
+    (0, _common.UseGuards)(_guards.JwtAuthGuard),
+    (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Update user active status',
         description: 'Updates user active status. When company feature is enabled, updates the status for the current company context.'
@@ -149,6 +144,8 @@ _ts_decorate([
 ], UserController.prototype, "updateStatus", null);
 _ts_decorate([
     (0, _common.Post)('profile'),
+    (0, _common.UseGuards)(_guards.JwtAuthGuard),
+    (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Update user profile'
     }),
@@ -166,9 +163,7 @@ _ts_decorate([
 ], UserController.prototype, "profile", null);
 UserController = _ts_decorate([
     (0, _swagger.ApiTags)('Users'),
-    (0, _swagger.ApiBearerAuth)(),
     (0, _common.Controller)('administration/users'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
     _ts_param(0, (0, _common.Inject)(_userservice.UserService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/cjs/interfaces/authentication.interface.js

@@ -1,6 +1,3 @@
-// =============================================================================
-// TOKEN INTERFACES
-// =============================================================================
 "use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true

package/cjs/services/auth-config.service.js

@@ -39,76 +39,50 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthConfigService = class AuthConfigService {
-    // ==================== Database Mode ====================
-    /**
-   * Get database mode (single or multi-tenant)
-   */ getDatabaseMode() {
+    // Database Mode
+    /** Get database mode (single or multi-tenant) */ getDatabaseMode() {
         return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
     }
-    /**
-   * Check if running in multi-tenant mode
-   */ isMultiTenant() {
+    /** Check if running in multi-tenant mode */ isMultiTenant() {
         return this.getDatabaseMode() === 'multi-tenant';
     }
-    // ==================== Feature Flags ====================
-    /**
-   * Check if company feature is enabled
-   */ isCompanyFeatureEnabled() {
+    // Feature Flags
+    /** Check if company feature is enabled */ isCompanyFeatureEnabled() {
         return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
-    // ==================== JWT Configuration ====================
-    /**
-   * Get JWT secret key
-   */ getJwtSecret() {
+    // JWT Configuration
+    /** Get JWT secret key */ getJwtSecret() {
         return this.config.jwtSecret ?? 'default-secret-change-in-production';
     }
-    /**
-   * Get JWT expiration time
-   */ getJwtExpiration() {
+    /** Get JWT expiration time */ getJwtExpiration() {
         return this.config.jwtExpiration ?? '1h';
     }
-    /**
-   * Get refresh token secret key
-   */ getRefreshTokenSecret() {
+    /** Get refresh token secret key */ getRefreshTokenSecret() {
         return this.config.refreshTokenSecret ?? this.getJwtSecret();
     }
-    /**
-   * Get refresh token expiration time
-   */ getRefreshTokenExpiration() {
+    /** Get refresh token expiration time */ getRefreshTokenExpiration() {
         return this.config.refreshTokenExpiration ?? '7d';
     }
-    /**
-   * Get refresh token cookie name
-   */ getRefreshTokenCookieName() {
+    /** Get refresh token cookie name */ getRefreshTokenCookieName() {
         return this.config.refreshTokenCookieName ?? 'fsn_refresh_token';
     }
-    // ==================== Database Configuration ====================
-    /**
-   * Get default database config
-   */ getDefaultDatabaseConfig() {
+    // Database Configuration
+    /** Get default database config */ getDefaultDatabaseConfig() {
         return this.config.defaultDatabaseConfig ?? this.config.tenantDefaultDatabaseConfig;
     }
-    /**
-   * Get tenant default database config (for multi-tenant)
-   */ getTenantDefaultDatabaseConfig() {
+    /** Get tenant default database config (for multi-tenant) */ getTenantDefaultDatabaseConfig() {
         return this.config.tenantDefaultDatabaseConfig;
     }
-    /**
-   * Get registered tenants
-   */ getTenants() {
+    /** Get registered tenants */ getTenants() {
         return this.config.tenants ?? [];
     }
-    // ==================== Raw Options ====================
-    /**
-   * Get full module options
-   */ getOptions() {
+    // Raw Options
+    /** Get full module options */ getOptions() {
         return {
             ...this.options
         };
     }
-    /**
-   * Get runtime config
-   */ getConfig() {
+    /** Get runtime config */ getConfig() {
         return {
             ...this.config
         };

package/cjs/services/auth-datasource.provider.js

@@ -83,11 +83,8 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.MultiTenantDataSourceService {
-    // ==================== Override Static Cache Access Methods ====================
-    /**
-   * CRITICAL: Override to access Auth-specific static properties
-   * Without this, parent class methods would access parent's static properties
-   */ async getSingleDataSource() {
+    // Override Static Cache Access Methods
+    /** Override to access Auth-specific static properties */ async getSingleDataSource() {
         if (!AuthDataSourceProvider.singleDataSource) {
             if (AuthDataSourceProvider.singleConnectionLock) {
                 return AuthDataSourceProvider.singleConnectionLock;
@@ -111,9 +108,7 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
         }
         return AuthDataSourceProvider.singleDataSource;
     }
-    /**
-   * CRITICAL: Override to use Auth-specific static cache for tenant connections
-   */ async getOrCreateTenantConnection(tenant) {
+    /** Override to use Auth-specific static cache for tenant connections */ async getOrCreateTenantConnection(tenant) {
         // Return existing initialized connection from Auth-specific cache
         const existing = AuthDataSourceProvider.tenantConnections.get(tenant.id);
         if (existing?.isInitialized) {
@@ -136,10 +131,8 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
             AuthDataSourceProvider.connectionLocks.delete(tenant.id);
         }
     }
-    // ==================== Factory Methods ====================
-    /**
-   * Build parent options from AuthModuleOptions
-   */ static buildParentOptions(options) {
+    // Factory Methods
+    /** Build parent options from AuthModuleOptions */ static buildParentOptions(options) {
         return {
             bootstrapAppConfig: options.bootstrapAppConfig,
             defaultDatabaseConfig: options.config?.defaultDatabaseConfig,
@@ -147,27 +140,18 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
             tenants: options.config?.tenants
         };
     }
-    // ==================== Feature Flags ====================
-    /**
-   * Get global enable company feature flag
-   */ getEnableCompanyFeature() {
+    // Feature Flags
+    /** Get global enable company feature flag */ getEnableCompanyFeature() {
         return this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
-    /**
-   * Get enable company feature for specific tenant
-   * Falls back to global setting if not specified per-tenant
-   */ getEnableCompanyFeatureForTenant(tenant) {
+    /** Get enable company feature for specific tenant. Falls back to global setting. */ getEnableCompanyFeatureForTenant(tenant) {
         return tenant?.enableCompanyFeature ?? this.getEnableCompanyFeature();
     }
-    /**
-   * Get enable company feature for current request context
-   */ getEnableCompanyFeatureForCurrentTenant() {
+    /** Get enable company feature for current request context */ getEnableCompanyFeatureForCurrentTenant() {
         return this.getEnableCompanyFeatureForTenant(this.getCurrentTenant() ?? undefined);
     }
-    // ==================== Entity Management ====================
-    /**
-   * Get auth entities based on company feature flag
-   */ async getAuthEntities(enableCompanyFeature) {
+    // Entity Management
+    /** Get auth entities based on company feature flag */ async getAuthEntities(enableCompanyFeature) {
         const enable = enableCompanyFeature ?? this.getEnableCompanyFeature();
         const { Company, CompanyBranch, User, UserCompanyPermission } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("../entities")));
         const coreEntities = [
@@ -183,10 +167,8 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _modules.Multi
             ...companyEntities
         ];
     }
-    // ==================== Overrides ====================
-    /**
-   * Override to dynamically set entities based on tenant config
-   */ async createDataSourceFromConfig(config) {
+    // Overrides
+    /** Override to dynamically set entities based on tenant config */ async createDataSourceFromConfig(config) {
         const currentTenant = this.getCurrentTenant();
         const enableCompanyFeature = this.getEnableCompanyFeatureForTenant(currentTenant ?? undefined);
         const entities = await this.getAuthEntities(enableCompanyFeature);