@flusys/nestjs-auth 0.1.0-beta.3 → 1.0.0-beta

package/fesm/services/authentication.service.js

@@ -34,17 +34,15 @@ import { ErrorHandler } from '@flusys/nestjs-shared/utils';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 import { PermissionType } from '../enums';
-// Password hashing configuration
-const BCRYPT_SALT_ROUNDS = 12; // Increased from 10 for better security
+import { BCRYPT_SALT_ROUNDS, TOKEN_REVOKED_PREFIX } from '../config';
+import { HybridCache } from '@flusys/nestjs-shared/classes';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { User } from '../entities/user.entity';
 import { CompanySelectionSessionService } from './company-selection-session.service';
 export class AuthenticationService {
-    // ==========================================================================
-    // REPOSITORY GETTERS
-    // ==========================================================================
+    // Repository Getters
     async getUserRepository() {
         if (this.dataSourceProvider) {
             return this.dataSourceProvider.getRepository(User);
@@ -75,13 +73,8 @@ export class AuthenticationService {
         }
         return this.injectedBranchRepository ?? null;
     }
-    // ==========================================================================
-    // LOGIN
-    // ==========================================================================
-    /**
-   * Login with email and password
-   * Returns either tokens directly or requires company/branch selection
-   */ async login(email, password) {
+    // Login
+    /** Login with email and password. Returns tokens or requires company/branch selection. */ async login(email, password) {
         const user = await this.validateUser(email, password);
         if (!user.isActive) {
             throw new UnauthorizedException('User account is deactivated');
@@ -92,9 +85,7 @@ export class AuthenticationService {
         }
         return this.handleCompanyBasedLogin(user);
     }
-    /**
-   * Handle login when company feature is enabled
-   */ async handleCompanyBasedLogin(user) {
+    /** Handle login when company feature is enabled */ async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !branchRepository) {
@@ -144,13 +135,8 @@ export class AuthenticationService {
         // Returns all companies with their branches for frontend to display
         return await this.generateCompanySelectionResponse(user, companies, branches);
     }
-    // ==========================================================================
-    // REGISTRATION
-    // ==========================================================================
-    /**
-   * Register a new user
-   * If company feature enabled, optionally join/create company
-   */ async register(dto) {
+    // Registration
+    /** Register a new user. If company feature enabled, optionally join/create company. */ async register(dto) {
         const userRepository = await this.getUserRepository();
         // Check if user exists
         // Note: Generic error message to prevent email enumeration attacks
@@ -181,9 +167,7 @@ export class AuthenticationService {
         // Handle company feature
         return this.handleCompanyRegistration(user, dto);
     }
-    /**
-   * Handle company-related registration logic
-   */ async handleCompanyRegistration(user, dto) {
+    /** Handle company-related registration logic */ async handleCompanyRegistration(user, dto) {
         const companyRepository = await this.getCompanyRepository();
         const branchRepository = await this.getBranchRepository();
         const permissionRepository = await this.getPermissionRepository();
@@ -280,18 +264,11 @@ export class AuthenticationService {
         // No company assigned
         return this.generateLoginResponse(user, true);
     }
-    /**
-   * Generate URL-friendly slug from name
-   */ generateSlug(name) {
+    /** Generate URL-friendly slug from name */ generateSlug(name) {
         return name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').substring(0, 100);
     }
-    // ==========================================================================
-    // COMPANY/BRANCH SELECTION
-    // ==========================================================================
-    /**
-   * Select company and branch (step 2 of login)
-   * Frontend receives all options and user selects both together
-   */ async select(sessionId, companyId, branchId) {
+    // Company/Branch Selection
+    /** Select company and branch (step 2 of login). Frontend receives all options and user selects both. */ async select(sessionId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         if (!this.sessionService) {
             throw new BadRequestException('Session service not available');
@@ -358,9 +335,7 @@ export class AuthenticationService {
         }
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
-    /**
-   * Switch company/branch after login
-   */ async switchCompany(userId, companyId, branchId) {
+    /** Switch company/branch after login */ async switchCompany(userId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
@@ -419,13 +394,8 @@ export class AuthenticationService {
         }
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
-    // ==========================================================================
-    // TOKEN MANAGEMENT
-    // ==========================================================================
-    /**
-   * Refresh access token (with token rotation)
-   * Returns new access token and new refresh token
-   */ async refreshToken(refreshToken) {
+    // Token Management
+    /** Refresh access token (with token rotation). Returns new access token and new refresh token. */ async refreshToken(refreshToken) {
         try {
             const payload = this.jwtService.verify(refreshToken, {
                 secret: this.authConfig.getRefreshTokenSecret()
@@ -491,9 +461,7 @@ export class AuthenticationService {
             throw new UnauthorizedException('Invalid or expired refresh token');
         }
     }
-    /**
-   * Change password
-   */ async changePassword(userId, currentPassword, newPassword) {
+    /** Change password */ async changePassword(userId, currentPassword, newPassword) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -510,15 +478,50 @@ export class AuthenticationService {
         user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
     }
-    /**
-   * Logout (placeholder for token blacklisting if needed)
-   */ async logout(_userId) {}
-    // ==========================================================================
-    // QUERY METHODS
-    // ==========================================================================
-    /**
-   * Get user's companies
-   */ async getUserCompanies(userId) {
+    /** Logout - Revokes all tokens. Stores revocation timestamp in cache. */ async logout(userId) {
+        if (!this.cacheManager) {
+            // Cache not available - graceful degradation (client-side logout only)
+            return;
+        }
+        const revokedAt = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
+        const cacheKey = `${TOKEN_REVOKED_PREFIX}:${userId}`;
+        // TTL matches refresh token expiry (tokens older than this are already expired)
+        const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
+        const ttlMs = this.parseExpiryToMs(refreshTokenExpiry);
+        await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+    }
+    /** Check if a token is revoked (issued before user's revocation timestamp) */ async isTokenRevoked(userId, tokenIssuedAt) {
+        if (!this.cacheManager || !tokenIssuedAt) {
+            return false;
+        }
+        const cacheKey = `${TOKEN_REVOKED_PREFIX}:${userId}`;
+        const revokedAt = await this.cacheManager.get(cacheKey);
+        if (!revokedAt) {
+            return false;
+        }
+        // Token is revoked if it was issued before the revocation timestamp
+        return tokenIssuedAt < revokedAt;
+    }
+    /** Parse JWT expiry string to milliseconds */ parseExpiryToMs(expiry) {
+        const match = expiry.match(/^(\d+)([smhd])$/);
+        if (!match) return 7 * 24 * 60 * 60 * 1000; // Default 7 days
+        const value = parseInt(match[1], 10);
+        const unit = match[2];
+        switch(unit){
+            case 's':
+                return value * 1000;
+            case 'm':
+                return value * 60 * 1000;
+            case 'h':
+                return value * 60 * 60 * 1000;
+            case 'd':
+                return value * 24 * 60 * 60 * 1000;
+            default:
+                return 7 * 24 * 60 * 60 * 1000;
+        }
+    }
+    // Query Methods
+    /** Get user's companies */ async getUserCompanies(userId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
@@ -539,9 +542,7 @@ export class AuthenticationService {
             active: true
         }).orderBy('c.name', 'ASC').getMany();
     }
-    /**
-   * Get branches for a company that user has access to
-   */ async getUserBranches(userId, companyId) {
+    /** Get branches for a company that user has access to */ async getUserBranches(userId, companyId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
@@ -576,9 +577,7 @@ export class AuthenticationService {
             active: true
         }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
     }
-    /**
-   * Get company by ID
-   */ async getCompanyById(companyId) {
+    /** Get company by ID */ async getCompanyById(companyId) {
         const companyRepository = await this.getCompanyRepository();
         if (!companyRepository) {
             return null;
@@ -589,9 +588,7 @@ export class AuthenticationService {
             }
         });
     }
-    /**
-   * Get branch by ID
-   */ async getBranchById(branchId) {
+    /** Get branch by ID */ async getBranchById(branchId) {
         const branchRepository = await this.getBranchRepository();
         if (!branchRepository) {
             return null;
@@ -602,10 +599,7 @@ export class AuthenticationService {
             }
         });
     }
-    /**
-   * Get user info for /auth/me endpoint
-   * Returns only user, company, and branch information (no tokens)
-   */ async getUserInfo(userId, companyId, branchId) {
+    /** Get user info for /auth/me endpoint. Returns user, company, and branch info (no tokens). */ async getUserInfo(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -656,9 +650,7 @@ export class AuthenticationService {
         }
         return response;
     }
-    // ==========================================================================
-    // HELPER METHODS
-    // ==========================================================================
+    // Helper Methods
     ensureCompanyFeatureEnabled() {
         if (!this.authConfig.isCompanyFeatureEnabled()) {
             throw new BadRequestException('Company feature is not enabled');
@@ -682,9 +674,7 @@ export class AuthenticationService {
         await userRepository.save(user);
         return user;
     }
-    // ==========================================================================
-    // RESPONSE GENERATORS
-    // ==========================================================================
+    // Response Generators
     generateLoginResponse(user, companyFeatureEnabled = false) {
         const payload = {
             id: user.id,
@@ -797,9 +787,10 @@ export class AuthenticationService {
         };
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, dataSourceProvider, sessionService, injectedUserRepository, injectedPermissionRepository, injectedCompanyRepository, injectedBranchRepository){
+    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, injectedUserRepository, injectedPermissionRepository, injectedCompanyRepository, injectedBranchRepository){
         _define_property(this, "jwtService", void 0);
         _define_property(this, "authConfig", void 0);
+        _define_property(this, "cacheManager", void 0);
         _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "sessionService", void 0);
         _define_property(this, "injectedUserRepository", void 0);
@@ -809,6 +800,7 @@ export class AuthenticationService {
         _define_property(this, "logger", void 0);
         this.jwtService = jwtService;
         this.authConfig = authConfig;
+        this.cacheManager = cacheManager;
         this.dataSourceProvider = dataSourceProvider;
         this.sessionService = sessionService;
         this.injectedUserRepository = injectedUserRepository;
@@ -825,21 +817,24 @@ AuthenticationService = _ts_decorate([
     _ts_param(0, Inject(JwtService)),
     _ts_param(1, Inject(AuthConfigService)),
     _ts_param(2, Optional()),
-    _ts_param(2, Inject(AuthDataSourceProvider)),
+    _ts_param(2, Inject('CACHE_INSTANCE')),
     _ts_param(3, Optional()),
-    _ts_param(3, Inject(CompanySelectionSessionService)),
+    _ts_param(3, Inject(AuthDataSourceProvider)),
     _ts_param(4, Optional()),
-    _ts_param(4, InjectRepository(User)),
+    _ts_param(4, Inject(CompanySelectionSessionService)),
     _ts_param(5, Optional()),
-    _ts_param(5, InjectRepository(UserCompanyPermission)),
+    _ts_param(5, InjectRepository(User)),
     _ts_param(6, Optional()),
-    _ts_param(6, InjectRepository(Company)),
+    _ts_param(6, InjectRepository(UserCompanyPermission)),
     _ts_param(7, Optional()),
-    _ts_param(7, InjectRepository(CompanyBranch)),
+    _ts_param(7, InjectRepository(Company)),
+    _ts_param(8, Optional()),
+    _ts_param(8, InjectRepository(CompanyBranch)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof JwtService === "undefined" ? Object : JwtService,
         typeof AuthConfigService === "undefined" ? Object : AuthConfigService,
+        typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
         typeof CompanySelectionSessionService === "undefined" ? Object : CompanySelectionSessionService,
         typeof Repository === "undefined" ? Object : Repository,

package/fesm/services/branch.service.js

@@ -27,46 +27,20 @@ function _ts_param(paramIndex, decorator) {
 }
 import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { Inject, Injectable, Logger, NotFoundException, Scope } from '@nestjs/common';
+import { Inject, Injectable, Scope } from '@nestjs/common';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class BranchService extends RequestScopedApiService {
-    /**
-   * Resolve entity class for this service
-   * @returns CompanyBranch entity class
-   */ resolveEntity() {
+    resolveEntity() {
         return CompanyBranch;
     }
-    /**
-   * Get DataSource provider for this service
-   * @returns AuthDataSourceProvider instance
-   */ getDataSourceProvider() {
+    getDataSourceProvider() {
         return this.dataSourceProvider;
     }
-    // ==================== Entity Conversion ====================
-    async convertSingleDtoToEntity(dto, _user) {
-        // Repository initialization is handled automatically by RequestScopedApiService
-        let branch = new CompanyBranch();
-        if ('id' in dto && dto.id && typeof dto.id === 'string') {
-            const dbData = await this.repository.findOne({
-                where: {
-                    id: dto.id
-                }
-            });
-            if (!dbData) {
-                throw new NotFoundException('Branch not found');
-            }
-            branch = dbData;
-        }
-        return {
-            ...branch,
-            ...dto
-        };
-    }
+    // Query Customization
     async getSelectQuery(query, _user, select) {
-        // Repository initialization is handled automatically by RequestScopedApiService
-        if (!select || !select.length) {
+        if (!select?.length) {
             select = [
                 'id',
                 'name',
@@ -75,14 +49,13 @@ export class BranchService extends RequestScopedApiService {
                 'createdAt'
             ];
         }
-        const selectFields = select.map((field)=>`${this.entityName}.${field}`);
-        query.select(selectFields);
+        query.select(select.map((f)=>`${this.entityName}.${f}`));
         return {
             query,
             isRaw: false
         };
     }
-    async getGlobalSearchQuery(query, search, _user) {
+    async getGlobalSearchQuery(query, search) {
         query.andWhere('(company_branch.name LIKE :search OR company_branch.slug LIKE :search OR company_branch.email LIKE :search)', {
             search: `%${search}%`
         });
@@ -91,24 +64,17 @@ export class BranchService extends RequestScopedApiService {
             isRaw: false
         };
     }
-    /**
-   * Override: Filter branches by user's company
-   * Ensures users can only see branches belonging to their company
-   */ async getExtraManipulateQuery(query, _filterAndPaginationDto, user) {
-        const result = await super.getExtraManipulateQuery(query, _filterAndPaginationDto, user);
-        // Only apply company filtering if company feature is enabled and user has company context
-        const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
-        if (isCompanyFeatureEnabled && user?.companyId) {
+    async getExtraManipulateQuery(query, filterDto, user) {
+        const result = await super.getExtraManipulateQuery(query, filterDto, user);
+        if (this.authConfig.isCompanyFeatureEnabled() && user?.companyId) {
             query.andWhere('company_branch.company_id = :companyId', {
                 companyId: user.companyId
             });
         }
         return result;
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig){
-        // Repository will be set asynchronously by RequestScopedApiService
-        super('company_branch', null, cacheManager, utilsService, BranchService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "logger", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.logger = new Logger(BranchService.name);
+        super('company_branch', null, cacheManager, utilsService, BranchService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig;
     }
 }
 BranchService = _ts_decorate([

package/fesm/services/company.service.js

@@ -27,45 +27,19 @@ function _ts_param(paramIndex, decorator) {
 }
 import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { Inject, Injectable, Logger, NotFoundException, Scope } from '@nestjs/common';
+import { Inject, Injectable, Scope } from '@nestjs/common';
 import { Company } from '../entities/company.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class CompanyService extends RequestScopedApiService {
-    /**
-   * Resolve entity class for this service
-   * @returns Company entity class
-   */ resolveEntity() {
+    resolveEntity() {
         return Company;
     }
-    /**
-   * Get DataSource provider for this service
-   * @returns AuthDataSourceProvider instance
-   */ getDataSourceProvider() {
+    getDataSourceProvider() {
         return this.dataSourceProvider;
     }
-    // ==================== Entity Conversion ====================
-    async convertSingleDtoToEntity(dto, _user) {
-        // Repository initialization is handled automatically by RequestScopedApiService
-        let company = new Company();
-        if ('id' in dto && dto.id && typeof dto.id === 'string') {
-            const dbData = await this.repository.findOne({
-                where: {
-                    id: dto.id
-                }
-            });
-            if (!dbData) {
-                throw new NotFoundException('Company not found');
-            }
-            company = dbData;
-        }
-        return {
-            ...company,
-            ...dto
-        };
-    }
+    // Query Customization
     async getSelectQuery(query, _user, select) {
-        // Repository initialization is handled automatically by RequestScopedApiService
-        if (!select || !select.length) {
+        if (!select?.length) {
             select = [
                 'id',
                 'name',
@@ -74,14 +48,13 @@ export class CompanyService extends RequestScopedApiService {
                 'createdAt'
             ];
         }
-        const selectFields = select.map((field)=>`${this.entityName}.${field}`);
-        query.select(selectFields);
+        query.select(select.map((f)=>`${this.entityName}.${f}`));
         return {
             query,
             isRaw: false
         };
     }
-    async getGlobalSearchQuery(query, search, _user) {
+    async getGlobalSearchQuery(query, search) {
         query.andWhere('(company.name LIKE :search OR company.slug LIKE :search OR company.email LIKE :search)', {
             search: `%${search}%`
         });
@@ -90,10 +63,8 @@ export class CompanyService extends RequestScopedApiService {
             isRaw: false
         };
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(cacheManager, utilsService, dataSourceProvider){
-        // Repository will be set asynchronously by RequestScopedApiService
-        super('company', null, cacheManager, utilsService, CompanyService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "logger", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.logger = new Logger(CompanyService.name);
+        super('company', null, cacheManager, utilsService, CompanyService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider;
     }
 }
 CompanyService = _ts_decorate([

package/fesm/services/user-permission.service.js

@@ -29,20 +29,14 @@ import { BadRequestException, Inject, Injectable, Logger, NotFoundException, Sco
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class UserPermissionService {
-    /**
-   * Get repository lazily - initialized on first access
-   */ async getRepository() {
+    /** Get repository lazily - initialized on first access */ async getRepository() {
         if (!this._repository) {
             this._repository = await this.dataSourceProvider.getRepository(UserCompanyPermission);
         }
         return this._repository;
     }
-    // ==========================================================================
-    // COMPANY PERMISSIONS
-    // ==========================================================================
-    /**
-   * Find all companies a user has access to
-   */ async findUserCompanies(userId) {
+    // Company Permissions
+    /** Find all companies a user has access to */ async findUserCompanies(userId) {
         const repository = await this.getRepository();
         return repository.find({
             where: {
@@ -57,9 +51,7 @@ export class UserPermissionService {
             }
         });
     }
-    /**
-   * Assign user to a company
-   */ async assignUserToCompany(dto) {
+    /** Assign user to a company */ async assignUserToCompany(dto) {
         const repository = await this.getRepository();
         // Check if already exists
         const existing = await repository.findOne({
@@ -80,9 +72,7 @@ export class UserPermissionService {
         });
         await repository.save(permission);
     }
-    /**
-   * Revoke user access to a company
-   */ async revokeCompanyAccess(userId, companyId) {
+    /** Revoke user access to a company */ async revokeCompanyAccess(userId, companyId) {
         const repository = await this.getRepository();
         const permission = await repository.findOne({
             where: {
@@ -96,12 +86,8 @@ export class UserPermissionService {
         }
         await repository.remove(permission);
     }
-    // ==========================================================================
-    // BRANCH PERMISSIONS
-    // ==========================================================================
-    /**
-   * Find all branches a user has access to
-   */ async findUserBranches(userId) {
+    // Branch Permissions
+    /** Find all branches a user has access to */ async findUserBranches(userId) {
         const repository = await this.getRepository();
         return repository.find({
             where: {
@@ -116,9 +102,7 @@ export class UserPermissionService {
             }
         });
     }
-    /**
-   * Assign user to a branch
-   */ async assignUserToBranch(dto) {
+    /** Assign user to a branch */ async assignUserToBranch(dto) {
         const repository = await this.getRepository();
         // Check if already exists
         const existing = await repository.findOne({
@@ -139,9 +123,7 @@ export class UserPermissionService {
         });
         await repository.save(permission);
     }
-    /**
-   * Revoke user access to a branch
-   */ async revokeBranchAccess(userId, branchId) {
+    /** Revoke user access to a branch */ async revokeBranchAccess(userId, branchId) {
         const repository = await this.getRepository();
         const permission = await repository.findOne({
             where: {