@flusys/nestjs-auth 0.1.0-beta.3 → 1.0.0-beta

package/cjs/services/user.service.js

@@ -15,6 +15,7 @@ const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _authconfigservice = require("./auth-config.service");
 const _authdatasourceprovider = require("./auth-datasource.provider");
+const _config = require("../config");
 const _enums = require("../enums");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
 const _userentity = require("../entities/user.entity");
@@ -87,22 +88,13 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let UserService = class UserService extends _classes.RequestScopedApiService {
-    /**
-   * Resolve entity class for this service
-   * @returns User entity class
-   */ resolveEntity() {
+    resolveEntity() {
         return _userentity.User;
     }
-    /**
-   * Get DataSource provider for this service
-   * @returns AuthDataSourceProvider instance
-   */ getDataSourceProvider() {
+    getDataSourceProvider() {
         return this.dataSourceProvider;
     }
-    /**
-   * Override ensureRepositoryInitialized to also initialize permission repository and dataSource
-   * CRITICAL: Also initializes permissionRepository and dataSource for company feature support
-   */ async ensureRepositoryInitialized() {
+    async ensureRepositoryInitialized() {
         await super.ensureRepositoryInitialized();
         // Initialize permission repository if company feature is enabled
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
@@ -116,26 +108,8 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
             this.dataSource = await this.getDataSourceForService();
         }
     }
-    // ==========================================================================
-    // CUSTOM METHODS (Beyond RequestScopedApiService)
-    // ==========================================================================
-    /**
-   * Update last login timestamp
-   */ async updateLastLogin(id) {
-        // Ensure repository is initialized for custom method
-        await this.ensureRepositoryInitialized();
-        await this.repository.update(id, {
-            lastLoginAt: new Date()
-        });
-        await this.clearCacheForId([
-            {
-                id
-            }
-        ]);
-    }
-    /**
-   * Verify email
-   */ async verifyEmail(id) {
+    // Custom Methods
+    /** Verify email */ async verifyEmail(id) {
         // Ensure repository is initialized for custom method
         await this.ensureRepositoryInitialized();
         await this.repository.update(id, {
@@ -148,9 +122,7 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
             }
         ]);
     }
-    /**
-   * Verify phone
-   */ async verifyPhone(id) {
+    /** Verify phone */ async verifyPhone(id) {
         // Ensure repository is initialized for custom method
         await this.ensureRepositoryInitialized();
         await this.repository.update(id, {
@@ -163,12 +135,7 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
             }
         ]);
     }
-    /**
-   * Update user status
-   *
-   * When company feature is disabled: Updates User.isActive directly
-   * When company feature is enabled: Updates UserCompanyPermission.isActive for the logged user's company
-   */ async updateStatus(id, isActive, user) {
+    /** Update user status. When company feature enabled, updates permission isActive for logged user's company. */ async updateStatus(id, isActive, user) {
         // Ensure repository is initialized for custom method
         await this.ensureRepositoryInitialized();
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
@@ -199,50 +166,43 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
             }
         ]);
     }
-    // ==========================================================================
-    // APISERVICE OVERRIDES (Customize behavior)
-    // ==========================================================================
-    /**
-   * Override: Convert DTO to entity (hash password before saving)
-   */ async convertSingleDtoToEntity(dto, user) {
+    // ApiService Overrides
+    /** Convert DTO to entity (hash password before saving) */ async convertSingleDtoToEntity(dto, user) {
         // Repository initialization is handled automatically by RequestScopedApiService
         const entity = await super.convertSingleDtoToEntity(dto, user);
         // Hash password if provided
         if (dto.password) {
-            entity.password = await _bcrypt.hash(dto.password, 10);
+            entity.password = await _bcrypt.hash(dto.password, _config.BCRYPT_SALT_ROUNDS);
         }
         return entity;
     }
-    /**
-   * Override: Convert entity to response DTO (remove password!)
-   *
-   * When company feature is enabled and raw mode is used, isActive comes from
-   * the permission table (user_companyIsActive). Otherwise, it comes from User entity.
-   */ convertEntityToResponseDto(entity, isRaw) {
+    /** Convert entity to response DTO (removes password). In raw mode with company feature, isActive comes from permission table. */ convertEntityToResponseDto(entity, isRaw) {
         // When raw mode is used with company feature, isActive comes from computed field
-        const isActive = isRaw && entity.user_companyIsActive !== undefined ? Boolean(entity.user_companyIsActive) : entity.isActive;
+        // Raw mode uses snake_case column names (due to SnakeNamingStrategy)
+        const isActive = isRaw && entity.user_companyIsActive !== undefined ? Boolean(entity.user_companyIsActive) : isRaw ? entity.user_is_active : entity.isActive;
         return {
             id: isRaw ? entity.user_id : entity.id,
             name: isRaw ? entity.user_name : entity.name,
             phone: isRaw ? entity.user_phone : entity.phone,
             email: isRaw ? entity.user_email : entity.email,
-            profilePictureId: isRaw ? entity.user_profilePictureId : entity.profilePictureId,
+            profilePictureId: isRaw ? entity.user_profile_picture_id : entity.profilePictureId,
             isActive,
-            emailVerified: isRaw ? entity.user_emailVerified : entity.emailVerified,
-            phoneVerified: isRaw ? entity.user_phoneVerified : entity.phoneVerified,
-            lastLoginAt: isRaw ? entity.user_lastLoginAt : entity.lastLoginAt,
-            additionalFields: isRaw ? entity.user_additionalFields : entity.additionalFields,
-            createdAt: isRaw ? entity.user_createdAt : entity.createdAt,
-            updatedAt: isRaw ? entity.user_updatedAt : entity.updatedAt,
-            deletedAt: isRaw ? entity.user_deletedAt : entity.deletedAt,
-            createdById: isRaw ? entity.user_createdById : entity.createdById,
-            updatedById: isRaw ? entity.user_updatedById : entity.updatedById,
-            deletedById: isRaw ? entity.user_deletedById : entity.deletedById
+            emailVerified: isRaw ? entity.user_email_verified : entity.emailVerified,
+            phoneVerified: isRaw ? entity.user_phone_verified : entity.phoneVerified,
+            lastLoginAt: isRaw ? entity.user_last_login_at : entity.lastLoginAt,
+            additionalFields: isRaw ? entity.user_additional_fields : entity.additionalFields,
+            createdAt: isRaw ? entity.user_created_at : entity.createdAt,
+            updatedAt: isRaw ? entity.user_updated_at : entity.updatedAt,
+            deletedAt: isRaw ? entity.user_deleted_at : entity.deletedAt,
+            createdById: isRaw ? entity.user_created_by_id : entity.createdById,
+            updatedById: isRaw ? entity.user_updated_by_id : entity.updatedById,
+            deletedById: isRaw ? entity.user_deleted_by_id : entity.deletedById
         };
     }
-    /**
-   * Override: Global search - search by name, email, or phone
-   */ async getGlobalSearchQuery(query, search, _user) {
+    /** Convert entity list to response DTO list */ convertEntityListToResponseListDto(entities, isRaw) {
+        return entities.map((entity)=>this.convertEntityToResponseDto(entity, isRaw));
+    }
+    /** Global search - search by name, email, or phone */ async getGlobalSearchQuery(query, search, _user) {
         query.andWhere('(user.name LIKE :search OR user.email LIKE :search OR user.phone LIKE :search)', {
             search: `%${search}%`
         });
@@ -251,16 +211,7 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
             isRaw: false
         };
     }
-    /**
-   * Override: getExtraManipulateQuery - Add company permission-based isActive check when company feature enabled
-   *
-   * Note: When company feature is disabled at bootstrap, this method returns without modifications.
-   * All company-related filtering is skipped, and users are returned normally with isActive from User entity.
-   *
-   * When company feature is enabled:
-   * - isActive is computed from UserCompanyPermission table
-   * - Returns isRaw: true to use raw query results
-   */ async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
+    /** Add company permission-based isActive check when company feature enabled. Returns isRaw: true for computed fields. */ async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
         // Repository initialization is handled automatically by RequestScopedApiService
         const result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
         // Only apply company filtering if:
@@ -315,12 +266,7 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
         }
         return result;
     }
-    /**
-   * Override: insert - Create company permission when company feature is enabled
-   *
-   * Note: When company feature is disabled at bootstrap, this method falls back to parent implementation.
-   * No company permissions are created, and user is inserted normally.
-   */ async insert(dto, user) {
+    /** Insert user. Creates company permission when company feature is enabled. */ async insert(dto, user) {
         // Repository initialization is handled automatically by RequestScopedApiService
         // Check if company feature is enabled
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
@@ -387,9 +333,7 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
             await queryRunner.release();
         }
     }
-    /**
-   * Update user profile with password handling
-   */ async profile(dto, user) {
+    /** Update user profile with password handling */ async profile(dto, user) {
         // Repository initialization is handled automatically by RequestScopedApiService
         if (!this.dataSource) {
             throw new _common.BadRequestException('DataSource not available');
@@ -436,10 +380,8 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
             await queryRunner.release();
         }
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig){
-        // Repository will be set asynchronously by RequestScopedApiService
-        super('user', null, cacheManager, utilsService, UserService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "logger", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.logger = new _common.Logger(UserService.name);
+        super('user', null, cacheManager, utilsService, UserService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig;
     }
 };
 UserService = _ts_decorate([

package/cjs/strategies/jwt.strategy.js

@@ -14,6 +14,7 @@ const _passport = require("@nestjs/passport");
 const _passportjwt = require("passport-jwt");
 const _authconfigservice = require("../services/auth-config.service");
 const _authdatasourceprovider = require("../services/auth-datasource.provider");
+const _authenticationservice = require("../services/authentication.service");
 const _userentity = require("../entities/user.entity");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -44,8 +45,9 @@ function _ts_metadata(k, v) {
 }
 let JwtStrategy = class JwtStrategy extends (0, _passport.PassportStrategy)(_passportjwt.Strategy, 'jwt') {
     async validate(_req, payload) {
-        // Resolve request-scoped AuthDataSourceProvider for this request
+        // Resolve request-scoped services for this request
         let userRepository = null;
+        let authService = null;
         try {
             const dataSourceProvider = await this.moduleRef.resolve(_authdatasourceprovider.AuthDataSourceProvider, undefined, {
                 strict: false
@@ -53,12 +55,23 @@ let JwtStrategy = class JwtStrategy extends (0, _passport.PassportStrategy)(_pas
             if (dataSourceProvider) {
                 userRepository = await dataSourceProvider.getRepository(_userentity.User);
             }
+            // Resolve AuthenticationService for token revocation check
+            authService = await this.moduleRef.resolve(_authenticationservice.AuthenticationService, undefined, {
+                strict: false
+            });
         } catch (error) {
             throw new _common.UnauthorizedException('Unable to access user data');
         }
         if (!userRepository) {
             throw new _common.UnauthorizedException('User repository not available');
         }
+        // Check if token is revoked (logged out)
+        if (authService && payload.iat) {
+            const isRevoked = await authService.isTokenRevoked(payload.id, payload.iat);
+            if (isRevoked) {
+                throw new _common.UnauthorizedException('Token has been revoked');
+            }
+        }
         // Find user and check if active
         const user = await userRepository.findOne({
             where: {

package/config/auth.constants.d.ts

@@ -1,2 +1,4 @@
 export declare const AUTH_MODULE_OPTIONS = "AUTH_MODULE_OPTIONS";
+export declare const BCRYPT_SALT_ROUNDS = 12;
 export declare const SESSION_CACHE_PREFIX = "auth:session";
+export declare const TOKEN_REVOKED_PREFIX = "auth:revoked";

package/fesm/config/auth.constants.js

@@ -1,8 +1,7 @@
-// =============================================================================
-// INJECTION TOKENS
-// =============================================================================
-/** Injection token for auth module options */ export const AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
-// =============================================================================
-// CACHE KEY PREFIXES (Auth-specific)
-// =============================================================================
-/** Cache key prefix for authentication sessions */ export const SESSION_CACHE_PREFIX = 'auth:session';
+// Injection Tokens
+export const AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
+// Security Configuration
+/** Bcrypt salt rounds (12 = ~250ms hashing time) */ export const BCRYPT_SALT_ROUNDS = 12;
+// Cache Key Prefixes
+export const SESSION_CACHE_PREFIX = 'auth:session';
+export const TOKEN_REVOKED_PREFIX = 'auth:revoked';

package/fesm/controllers/authentication.controller.js

@@ -37,37 +37,22 @@ import { SetToken } from '../interceptors/set-token.interceptor';
 import { AuthConfigService } from '../services/auth-config.service';
 import { AuthenticationService } from '../services/authentication.service';
 export class AuthenticationController {
-    // ==========================================================================
-    // CORE ENDPOINTS (Always available)
-    // ==========================================================================
-    /**
-   * Login
-   * Returns either tokens directly or company/branch selection requirement
-   * Browser: refreshToken set in HTTP-only cookie, not in response body
-   * API/Mobile: refreshToken included in response body
-   */ async login(loginDto) {
+    // Core Endpoints
+    /** Login - Returns tokens or company/branch selection requirement */ async login(loginDto) {
         const result = await this.authService.login(loginDto.email, loginDto.password);
         if ('requiresSelection' in result) {
             return result;
         }
         return result;
     }
-    /**
-   * Register new user
-   * If company feature enabled, can optionally join/create company
-   * Browser: refreshToken set in HTTP-only cookie
-   */ async register(registrationDto) {
+    /** Register new user. If company feature enabled, can join/create company. */ async register(registrationDto) {
         const result = await this.authService.register(registrationDto);
         return {
             ...result,
             companyFeatureEnabled: this.authConfig?.isCompanyFeatureEnabled() ?? false
         };
     }
-    /**
-   * Refresh access token
-   * Browser: Gets refreshToken from HTTP-only cookie
-   * API/Mobile: Gets refreshToken from request body
-   */ async refreshToken(req, refreshTokenDto) {
+    /** Refresh access token. Browser uses HTTP-only cookie, API/Mobile uses request body. */ async refreshToken(req, refreshTokenDto) {
         // Get refresh token from cookie (browser) or body (API/mobile)
         const cookieName = this.authConfig?.getRefreshTokenCookieName() ?? 'fsn_refresh_token';
         const refreshToken = req.cookies?.[cookieName] || refreshTokenDto.refreshToken;
@@ -76,26 +61,16 @@ export class AuthenticationController {
         }
         return this.authService.refreshToken(refreshToken);
     }
-    /**
-   * Get current user info
-   * Returns only user, company, and branch data (no tokens)
-   * Uses existing access token from Authorization header
-   * Company/branch fields are automatically excluded from Swagger when company feature is disabled
-   */ async getCurrentUser(user) {
+    /** Get current user info. Returns user, company, and branch data (no tokens). */ async getCurrentUser(user) {
         return this.authService.getUserInfo(user.id, user.companyId, user.branchId);
     }
-    /**
-   * Logout
-   * Clears refresh token cookie for browsers
-   */ async logout(userId) {
+    /** Logout - Clears refresh token cookie for browsers */ async logout(userId) {
         await this.authService.logout(userId);
         return {
             message: 'Logged out successfully'
         };
     }
-    /**
-   * Change password
-   */ async changePassword(userId, dto) {
+    /** Change password */ async changePassword(userId, dto) {
         await this.authService.changePassword(userId, dto.currentPassword, dto.newPassword);
         return {
             message: 'Password changed successfully'

package/fesm/controllers/branch.controller.js

@@ -26,21 +26,20 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { createApiController } from '@flusys/nestjs-shared/classes';
-import { Controller, Inject, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { Controller, Inject } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
 import { CompanyBranchResponseDto, CreateCompanyBranchDto, UpdateCompanyBranchDto } from '../dtos/company-branch.dto';
-import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { BranchService } from '../services/branch.service';
-export class BranchController extends createApiController(CreateCompanyBranchDto, UpdateCompanyBranchDto, CompanyBranchResponseDto) {
+export class BranchController extends createApiController(CreateCompanyBranchDto, UpdateCompanyBranchDto, CompanyBranchResponseDto, {
+    security: 'jwt'
+}) {
     constructor(branchService){
         super(branchService), _define_property(this, "branchService", void 0), this.branchService = branchService;
     }
 }
 BranchController = _ts_decorate([
     ApiTags('Branches'),
-    ApiBearerAuth(),
     Controller('administration/branch'),
-    UseGuards(JwtAuthGuard),
     _ts_param(0, Inject(BranchService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/fesm/controllers/company.controller.js

@@ -26,21 +26,20 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { createApiController } from '@flusys/nestjs-shared/classes';
-import { Controller, Inject, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { Controller, Inject } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
 import { CompanyResponseDto, CreateCompanyDto, UpdateCompanyDto } from '../dtos/company.dto';
-import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { CompanyService } from '../services/company.service';
-export class CompanyController extends createApiController(CreateCompanyDto, UpdateCompanyDto, CompanyResponseDto) {
+export class CompanyController extends createApiController(CreateCompanyDto, UpdateCompanyDto, CompanyResponseDto, {
+    security: 'jwt'
+}) {
     constructor(companyService){
         super(companyService), _define_property(this, "companyService", void 0), this.companyService = companyService;
     }
 }
 CompanyController = _ts_decorate([
     ApiTags('Companies'),
-    ApiBearerAuth(),
     Controller('administration/company'),
-    UseGuards(JwtAuthGuard),
     _ts_param(0, Inject(CompanyService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/fesm/controllers/user-permission.controller.js

@@ -31,12 +31,8 @@ import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { AssignUserCompanyDto, AssignUserBranchDto, UserCompaniesResponseDto, UserBranchesResponseDto } from '../dtos/user-permission.dto';
 import { UserPermissionService } from '../services/user-permission.service';
 export class UserPermissionController {
-    // ========================================================================
-    // USER-COMPANY PERMISSIONS
-    // ========================================================================
-    /**
-   * Batch assign/revoke user-company permissions
-   */ async assignUserCompany(dto) {
+    // User-Company Permissions
+    /** Batch assign/revoke user-company permissions */ async assignUserCompany(dto) {
         let addedCount = 0;
         let removedCount = 0;
         for (const item of dto.items){
@@ -56,9 +52,7 @@ export class UserPermissionController {
             message: `Processed ${addedCount} additions and ${removedCount} removals`
         };
     }
-    /**
-   * Get user's companies
-   */ async getUserCompanies(userId) {
+    /** Get user's companies */ async getUserCompanies(userId) {
         const permissions = await this.userPermissionService.findUserCompanies(userId);
         // Map to DTO format with populated company details
         const data = permissions.map((permission)=>({
@@ -72,12 +66,8 @@ export class UserPermissionController {
             data
         };
     }
-    // ========================================================================
-    // USER-BRANCH PERMISSIONS
-    // ========================================================================
-    /**
-   * Batch assign/revoke user-branch permissions
-   */ async assignUserBranch(dto) {
+    // User-Branch Permissions
+    /** Batch assign/revoke user-branch permissions */ async assignUserBranch(dto) {
         let addedCount = 0;
         let removedCount = 0;
         for (const item of dto.items){
@@ -97,9 +87,7 @@ export class UserPermissionController {
             message: `Processed ${addedCount} additions and ${removedCount} removals`
         };
     }
-    /**
-   * Get user's branches
-   */ async getUserBranches(userId) {
+    /** Get user's branches */ async getUserBranches(userId) {
         const permissions = await this.userPermissionService.findUserBranches(userId);
         // Map to DTO format with populated branch details
         const data = permissions.map((permission)=>({

package/fesm/controllers/user.controller.js

@@ -27,46 +27,35 @@ function _ts_param(paramIndex, decorator) {
 }
 import { createApiController } from '@flusys/nestjs-shared/classes';
 import { CurrentUser } from '@flusys/nestjs-shared/decorators';
+import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { Body, Controller, Inject, Param, Post, Put, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiParam, ApiTags } from '@nestjs/swagger';
 import { CreateUserDto, UpdateUserDto, UserResponseDto } from '../dtos/user.dto';
-import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { UserService } from '../services/user.service';
-export class UserController extends createApiController(CreateUserDto, UpdateUserDto, UserResponseDto) {
-    // ==========================================================================
-    // CUSTOM ENDPOINTS (Beyond standard CRUD)
-    // ==========================================================================
-    /**
-   * Verify user email
-   */ async verifyEmail(id) {
+export class UserController extends createApiController(CreateUserDto, UpdateUserDto, UserResponseDto, {
+    security: 'jwt'
+}) {
+    // Custom Endpoints
+    /** Verify user email */ async verifyEmail(id) {
         await this.service.verifyEmail(id);
         return {
             message: 'Email verified successfully'
         };
     }
-    /**
-   * Verify user phone
-   */ async verifyPhone(id) {
+    /** Verify user phone */ async verifyPhone(id) {
         await this.service.verifyPhone(id);
         return {
             message: 'Phone verified successfully'
         };
     }
-    /**
-   * Update user active status
-   *
-   * When company feature is disabled: Updates User.isActive directly
-   * When company feature is enabled: Updates UserCompanyPermission.isActive for logged user's company
-   */ async updateStatus(id, isActive, user) {
+    /** Update user active status. When company feature enabled, updates permission isActive for logged user's company. */ async updateStatus(id, isActive, user) {
         await this.service.updateStatus(id, isActive, user);
         return {
             message: 'Status updated successfully'
         };
     }
-    /**
-   * Update user profile
-   */ async profile(dto, user) {
+    /** Update user profile */ async profile(dto, user) {
         const data = await this.service.profile(dto, user);
         return {
             message: 'Profile updated successfully',
@@ -79,6 +68,8 @@ export class UserController extends createApiController(CreateUserDto, UpdateUse
 }
 _ts_decorate([
     Post(':id/verify-email'),
+    UseGuards(JwtAuthGuard),
+    ApiBearerAuth(),
     ApiOperation({
         summary: 'Verify user email'
     }),
@@ -95,6 +86,8 @@ _ts_decorate([
 ], UserController.prototype, "verifyEmail", null);
 _ts_decorate([
     Post(':id/verify-phone'),
+    UseGuards(JwtAuthGuard),
+    ApiBearerAuth(),
     ApiOperation({
         summary: 'Verify user phone'
     }),
@@ -111,6 +104,8 @@ _ts_decorate([
 ], UserController.prototype, "verifyPhone", null);
 _ts_decorate([
     Put(':id/status'),
+    UseGuards(JwtAuthGuard),
+    ApiBearerAuth(),
     ApiOperation({
         summary: 'Update user active status',
         description: 'Updates user active status. When company feature is enabled, updates the status for the current company context.'
@@ -139,6 +134,8 @@ _ts_decorate([
 ], UserController.prototype, "updateStatus", null);
 _ts_decorate([
     Post('profile'),
+    UseGuards(JwtAuthGuard),
+    ApiBearerAuth(),
     ApiOperation({
         summary: 'Update user profile'
     }),
@@ -156,9 +153,7 @@ _ts_decorate([
 ], UserController.prototype, "profile", null);
 UserController = _ts_decorate([
     ApiTags('Users'),
-    ApiBearerAuth(),
     Controller('administration/users'),
-    UseGuards(JwtAuthGuard),
     _ts_param(0, Inject(UserService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [