@flusys/nestjs-auth 0.1.0-beta.3 → 1.0.0-rc

package/cjs/services/authentication.service.js

@@ -10,13 +10,14 @@ Object.defineProperty(exports, "AuthenticationService", {
 });
 const _common = require("@nestjs/common");
 const _jwt = require("@nestjs/jwt");
-const _typeorm = require("@nestjs/typeorm");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
-const _typeorm1 = require("typeorm");
 const _utils = require("@flusys/nestjs-shared/utils");
 const _authconfigservice = require("./auth-config.service");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 const _enums = require("../enums");
+const _config = require("../config");
+const _classes = require("@flusys/nestjs-shared/classes");
+const _authemailservice = require("./auth-email.service");
 const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
@@ -90,62 +91,46 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-// Password hashing configuration
-const BCRYPT_SALT_ROUNDS = 12; // Increased from 10 for better security
 let AuthenticationService = class AuthenticationService {
-    // ==========================================================================
-    // REPOSITORY GETTERS
-    // ==========================================================================
+    // Repository Getters
     async getUserRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(_userentity.User);
+        if (!this.dataSourceProvider) {
+            throw new Error('User repository not available');
         }
-        if (this.injectedUserRepository) {
-            return this.injectedUserRepository;
-        }
-        throw new Error('User repository not available');
+        return this.dataSourceProvider.getRepository(_userentity.User);
     }
     async getPermissionRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(_usercompanypermissionentity.UserCompanyPermission);
-        }
-        return this.injectedPermissionRepository ?? null;
+        if (!this.authConfig.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(_usercompanypermissionentity.UserCompanyPermission);
     }
     async getCompanyRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(_companyentity.Company);
-        }
-        return this.injectedCompanyRepository ?? null;
+        if (!this.authConfig.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(_companyentity.Company);
     }
     async getBranchRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(_companybranchentity.CompanyBranch);
-        }
-        return this.injectedBranchRepository ?? null;
-    }
-    // ==========================================================================
-    // LOGIN
-    // ==========================================================================
-    /**
-   * Login with email and password
-   * Returns either tokens directly or requires company/branch selection
-   */ async login(email, password) {
+        if (!this.authConfig.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(_companybranchentity.CompanyBranch);
+    }
+    // Login
+    /** Login with email and password. Returns tokens or requires company/branch selection. */ async login(email, password) {
         const user = await this.validateUser(email, password);
         if (!user.isActive) {
             throw new _common.UnauthorizedException('User account is deactivated');
         }
-        // If company feature not enabled, return simple token
+        // Check email verification if email service is enabled
+        if (this.authEmailService?.isEmailEnabled() && !user.emailVerified) {
+            return {
+                requiresEmailVerification: true,
+                email: user.email,
+                message: 'Please verify your email address before logging in.'
+            };
+        }
         if (!this.authConfig.isCompanyFeatureEnabled()) {
             return this.generateLoginResponse(user);
         }
         return this.handleCompanyBasedLogin(user);
     }
-    /**
-   * Handle login when company feature is enabled
-   */ async handleCompanyBasedLogin(user) {
+    /** Handle login when company feature is enabled */ async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !branchRepository) {
@@ -195,16 +180,9 @@ let AuthenticationService = class AuthenticationService {
         // Returns all companies with their branches for frontend to display
         return await this.generateCompanySelectionResponse(user, companies, branches);
     }
-    // ==========================================================================
-    // REGISTRATION
-    // ==========================================================================
-    /**
-   * Register a new user
-   * If company feature enabled, optionally join/create company
-   */ async register(dto) {
+    // Registration
+    /** Register a new user. If email enabled, creates pending registration. Otherwise creates user directly. */ async register(dto, verifyUrlBase) {
         const userRepository = await this.getUserRepository();
-        // Check if user exists
-        // Note: Generic error message to prevent email enumeration attacks
         const existingUser = await userRepository.findOne({
             where: {
                 email: dto.email
@@ -213,8 +191,34 @@ let AuthenticationService = class AuthenticationService {
         if (existingUser) {
             throw new _common.BadRequestException('Registration failed. Please try again or contact support.');
         }
-        // Create user
-        const hashedPassword = await _bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
+        // If email verification is enabled, create pending registration instead of user
+        if (this.authEmailService?.isEmailEnabled() && verifyUrlBase) {
+            const companyData = this.authConfig.isCompanyFeatureEnabled() ? {
+                companySlug: dto.companySlug,
+                branchSlug: dto.branchSlug,
+                newCompanyName: dto.newCompanyName,
+                newCompanyPhone: dto.newCompanyPhone,
+                newCompanyAddress: dto.newCompanyAddress
+            } : undefined;
+            const result = await this.authEmailService.createPendingRegistration({
+                email: dto.email,
+                name: dto.name,
+                phone: dto.phone,
+                password: dto.password,
+                companyData,
+                verifyUrlBase
+            });
+            return {
+                requiresEmailVerification: true,
+                message: result.message
+            };
+        }
+        // No email verification - create user directly
+        return this.createUserDirectly(dto);
+    }
+    /** Create user directly (no email verification) */ async createUserDirectly(dto) {
+        const userRepository = await this.getUserRepository();
+        const hashedPassword = await _bcrypt.hash(dto.password, _config.BCRYPT_SALT_ROUNDS);
         const user = userRepository.create({
             name: dto.name,
             email: dto.email,
@@ -225,40 +229,68 @@ let AuthenticationService = class AuthenticationService {
             phoneVerified: false
         });
         await userRepository.save(user);
-        // If company feature not enabled, return simple response
         if (!this.authConfig.isCompanyFeatureEnabled()) {
-            return this.generateLoginResponse(user, false);
+            return this.generateRegistrationResponse(user, false, false);
         }
-        // Handle company feature
-        return this.handleCompanyRegistration(user, dto);
+        return this.handleCompanyRegistration(user, dto, false);
+    }
+    /** Create user from pending registration (after email verification) */ async createUserFromPendingRegistration(pending) {
+        const userRepository = await this.getUserRepository();
+        // Check if user already exists (race condition protection)
+        const existingUser = await userRepository.findOne({
+            where: {
+                email: pending.email
+            }
+        });
+        if (existingUser) {
+            throw new _common.BadRequestException('This email has already been registered.');
+        }
+        // Create user with verified email
+        const user = userRepository.create({
+            name: pending.name,
+            email: pending.email,
+            phone: pending.phone,
+            password: pending.passwordHash,
+            isActive: true,
+            emailVerified: true,
+            phoneVerified: false
+        });
+        await userRepository.save(user);
+        // Handle company feature if enabled
+        if (this.authConfig.isCompanyFeatureEnabled() && pending.companyData) {
+            return this.handleCompanyRegistrationFromPending(user, pending.companyData);
+        }
+        return this.generateRegistrationResponse(user, this.authConfig.isCompanyFeatureEnabled(), false);
+    }
+    /** Handle company registration from pending registration data */ async handleCompanyRegistrationFromPending(user, companyData) {
+        return this.processCompanyRegistration(user, companyData, false);
     }
-    /**
-   * Handle company-related registration logic
-   */ async handleCompanyRegistration(user, dto) {
+    /** Handle company-related registration logic */ async handleCompanyRegistration(user, dto, requiresEmailVerification) {
+        return this.processCompanyRegistration(user, dto, requiresEmailVerification);
+    }
+    /** Shared logic for company registration (join existing or create new) */ async processCompanyRegistration(user, data, requiresEmailVerification) {
         const companyRepository = await this.getCompanyRepository();
         const branchRepository = await this.getBranchRepository();
         const permissionRepository = await this.getPermissionRepository();
         if (!companyRepository || !branchRepository || !permissionRepository) {
-            return this.generateLoginResponse(user, true);
+            return this.generateRegistrationResponse(user, true, requiresEmailVerification);
         }
         let company = null;
         let branch = null;
-        // Case 1: Join existing company by slug
-        if (dto.companySlug) {
+        if (data.companySlug) {
             company = await companyRepository.findOne({
                 where: {
-                    slug: dto.companySlug,
+                    slug: data.companySlug,
                     isActive: true
                 }
             });
             if (!company) {
                 throw new _common.BadRequestException('Company not found or inactive');
             }
-            // Find branch by slug or get default
-            if (dto.branchSlug) {
+            if (data.branchSlug) {
                 branch = await branchRepository.findOne({
                     where: {
-                        slug: dto.branchSlug,
+                        slug: data.branchSlug,
                         companyId: company.id,
                         isActive: true
                     }
@@ -267,7 +299,6 @@ let AuthenticationService = class AuthenticationService {
                     throw new _common.BadRequestException('Branch not found or inactive');
                 }
             } else {
-                // Get first active branch
                 branch = await branchRepository.findOne({
                     where: {
                         companyId: company.id,
@@ -279,9 +310,8 @@ let AuthenticationService = class AuthenticationService {
                     }
                 });
             }
-        } else if (dto.newCompanyName) {
-            const slug = this.generateSlug(dto.newCompanyName);
-            // Check if slug exists
+        } else if (data.newCompanyName) {
+            const slug = this.generateSlug(data.newCompanyName);
             const existingCompany = await companyRepository.findOne({
                 where: {
                     slug
@@ -290,16 +320,14 @@ let AuthenticationService = class AuthenticationService {
             if (existingCompany) {
                 throw new _common.BadRequestException('Company creation failed. Please try a different name.');
             }
-            // Create company
             company = companyRepository.create({
-                name: dto.newCompanyName,
+                name: data.newCompanyName,
                 slug,
-                phone: dto.newCompanyPhone,
-                address: dto.newCompanyAddress,
+                phone: data.newCompanyPhone,
+                address: data.newCompanyAddress,
                 isActive: true
             });
             await companyRepository.save(company);
-            // Create default branch
             branch = branchRepository.create({
                 name: 'Main Branch',
                 slug: 'main-branch',
@@ -308,16 +336,13 @@ let AuthenticationService = class AuthenticationService {
             });
             await branchRepository.save(branch);
         }
-        // Create permissions if company exists
         if (company) {
-            // Create company permission
             const companyPermission = permissionRepository.create({
                 userId: user.id,
                 permissionType: _enums.PermissionType.COMPANY,
                 targetId: company.id
             });
             await permissionRepository.save(companyPermission);
-            // Create branch permission if branch exists
             if (branch) {
                 const branchPermission = permissionRepository.create({
                     userId: user.id,
@@ -326,23 +351,15 @@ let AuthenticationService = class AuthenticationService {
                 });
                 await permissionRepository.save(branchPermission);
             }
-            return this.generateLoginResponseWithCompany(user, company, branch ?? undefined);
+            return this.generateRegistrationResponseWithCompany(user, company, branch ?? undefined, requiresEmailVerification);
         }
-        // No company assigned
-        return this.generateLoginResponse(user, true);
+        return this.generateRegistrationResponse(user, true, requiresEmailVerification);
     }
-    /**
-   * Generate URL-friendly slug from name
-   */ generateSlug(name) {
+    /** Generate URL-friendly slug from name */ generateSlug(name) {
         return name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').substring(0, 100);
     }
-    // ==========================================================================
-    // COMPANY/BRANCH SELECTION
-    // ==========================================================================
-    /**
-   * Select company and branch (step 2 of login)
-   * Frontend receives all options and user selects both together
-   */ async select(sessionId, companyId, branchId) {
+    // Company/Branch Selection
+    /** Select company and branch (step 2 of login). Frontend receives all options and user selects both. */ async select(sessionId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         if (!this.sessionService) {
             throw new _common.BadRequestException('Session service not available');
@@ -409,9 +426,7 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
-    /**
-   * Switch company/branch after login
-   */ async switchCompany(userId, companyId, branchId) {
+    /** Switch company/branch after login */ async switchCompany(userId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
@@ -470,17 +485,17 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
-    // ==========================================================================
-    // TOKEN MANAGEMENT
-    // ==========================================================================
-    /**
-   * Refresh access token (with token rotation)
-   * Returns new access token and new refresh token
-   */ async refreshToken(refreshToken) {
+    // Token Management
+    /** Refresh access token (with token rotation). Returns new access token and new refresh token. */ async refreshToken(refreshToken) {
         try {
             const payload = this.jwtService.verify(refreshToken, {
                 secret: this.authConfig.getRefreshTokenSecret()
             });
+            // Check if token has been revoked (user logged out after token was issued)
+            const isRevoked = await this.isTokenRevoked(payload.id, payload.iat);
+            if (isRevoked) {
+                throw new _common.UnauthorizedException('Token has been revoked');
+            }
             const userRepository = await this.getUserRepository();
             const user = await userRepository.findOne({
                 where: {
@@ -542,9 +557,7 @@ let AuthenticationService = class AuthenticationService {
             throw new _common.UnauthorizedException('Invalid or expired refresh token');
         }
     }
-    /**
-   * Change password
-   */ async changePassword(userId, currentPassword, newPassword) {
+    /** Change password */ async changePassword(userId, currentPassword, newPassword) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -558,18 +571,55 @@ let AuthenticationService = class AuthenticationService {
         if (!isPasswordValid) {
             throw new _common.UnauthorizedException('Current password is incorrect');
         }
-        user.password = await _bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
+        user.password = await _bcrypt.hash(newPassword, _config.BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
     }
-    /**
-   * Logout (placeholder for token blacklisting if needed)
-   */ async logout(_userId) {}
-    // ==========================================================================
-    // QUERY METHODS
-    // ==========================================================================
-    /**
-   * Get user's companies
-   */ async getUserCompanies(userId) {
+    /** Logout - Revokes all tokens. Stores revocation timestamp in cache. */ async logout(userId) {
+        if (!this.cacheManager) {
+            // Cache is required for secure logout - tokens cannot be revoked without it
+            this.logger.error(`SECURITY: Cache not available for logout (userId: ${userId}). ` + 'Token revocation failed - tokens will remain valid until expiry. ' + 'Configure cache (Redis) to enable proper token revocation.');
+            throw new _common.BadRequestException('Logout service temporarily unavailable. Please try again later.');
+        }
+        const revokedAt = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
+        const cacheKey = `${_config.TOKEN_REVOKED_PREFIX}:${userId}`;
+        // TTL matches refresh token expiry (tokens older than this are already expired)
+        const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
+        const ttlMs = this.parseExpiryToMs(refreshTokenExpiry);
+        await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+        this.logger.log(`User ${userId} logged out - all tokens revoked`);
+    }
+    /** Check if a token is revoked (issued before user's revocation timestamp) */ async isTokenRevoked(userId, tokenIssuedAt) {
+        if (!this.cacheManager || !tokenIssuedAt) {
+            return false;
+        }
+        const cacheKey = `${_config.TOKEN_REVOKED_PREFIX}:${userId}`;
+        const revokedAt = await this.cacheManager.get(cacheKey);
+        if (!revokedAt) {
+            return false;
+        }
+        // Token is revoked if it was issued before the revocation timestamp
+        return tokenIssuedAt < revokedAt;
+    }
+    /** Parse JWT expiry string to milliseconds */ parseExpiryToMs(expiry) {
+        const match = expiry.match(/^(\d+)([smhd])$/);
+        if (!match) return 7 * 24 * 60 * 60 * 1000; // Default 7 days
+        const value = parseInt(match[1], 10);
+        const unit = match[2];
+        switch(unit){
+            case 's':
+                return value * 1000;
+            case 'm':
+                return value * 60 * 1000;
+            case 'h':
+                return value * 60 * 60 * 1000;
+            case 'd':
+                return value * 24 * 60 * 60 * 1000;
+            default:
+                return 7 * 24 * 60 * 60 * 1000;
+        }
+    }
+    // Query Methods
+    /** Get user's companies */ async getUserCompanies(userId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
@@ -590,9 +640,7 @@ let AuthenticationService = class AuthenticationService {
             active: true
         }).orderBy('c.name', 'ASC').getMany();
     }
-    /**
-   * Get branches for a company that user has access to
-   */ async getUserBranches(userId, companyId) {
+    /** Get branches for a company that user has access to */ async getUserBranches(userId, companyId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
@@ -627,9 +675,7 @@ let AuthenticationService = class AuthenticationService {
             active: true
         }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
     }
-    /**
-   * Get company by ID
-   */ async getCompanyById(companyId) {
+    /** Get company by ID */ async getCompanyById(companyId) {
         const companyRepository = await this.getCompanyRepository();
         if (!companyRepository) {
             return null;
@@ -640,9 +686,7 @@ let AuthenticationService = class AuthenticationService {
             }
         });
     }
-    /**
-   * Get branch by ID
-   */ async getBranchById(branchId) {
+    /** Get branch by ID */ async getBranchById(branchId) {
         const branchRepository = await this.getBranchRepository();
         if (!branchRepository) {
             return null;
@@ -653,10 +697,7 @@ let AuthenticationService = class AuthenticationService {
             }
         });
     }
-    /**
-   * Get user info for /auth/me endpoint
-   * Returns only user, company, and branch information (no tokens)
-   */ async getUserInfo(userId, companyId, branchId) {
+    /** Get user info for /auth/me endpoint. Returns user, company, and branch info (no tokens). */ async getUserInfo(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -672,6 +713,7 @@ let AuthenticationService = class AuthenticationService {
                 id: user.id,
                 email: user.email,
                 name: user.name ?? undefined,
+                phone: user.phone ?? undefined,
                 profilePictureId: user.profilePictureId ?? undefined
             }
         };
@@ -707,9 +749,7 @@ let AuthenticationService = class AuthenticationService {
         }
         return response;
     }
-    // ==========================================================================
-    // HELPER METHODS
-    // ==========================================================================
+    // Helper Methods
     ensureCompanyFeatureEnabled() {
         if (!this.authConfig.isCompanyFeatureEnabled()) {
             throw new _common.BadRequestException('Company feature is not enabled');
@@ -733,9 +773,7 @@ let AuthenticationService = class AuthenticationService {
         await userRepository.save(user);
         return user;
     }
-    // ==========================================================================
-    // RESPONSE GENERATORS
-    // ==========================================================================
+    // Response Generators
     generateLoginResponse(user, companyFeatureEnabled = false) {
         const payload = {
             id: user.id,
@@ -762,6 +800,7 @@ let AuthenticationService = class AuthenticationService {
                 id: user.id,
                 email: user.email,
                 name: user.name ?? undefined,
+                phone: user.phone ?? null,
                 profilePictureId: user.profilePictureId ?? null
             },
             companyFeatureEnabled
@@ -797,6 +836,7 @@ let AuthenticationService = class AuthenticationService {
                 id: user.id,
                 email: user.email,
                 name: user.name ?? undefined,
+                phone: user.phone ?? null,
                 profilePictureId: user.profilePictureId ?? null
             },
             company: {
@@ -842,30 +882,83 @@ let AuthenticationService = class AuthenticationService {
                 id: user.id,
                 email: user.email,
                 name: user.name ?? undefined,
+                phone: user.phone ?? null,
                 profilePictureId: user.profilePictureId ?? null
             },
             companies: companiesWithBranches
         };
     }
+    /** Generate registration response - tokens included only if email verification not required */ generateRegistrationResponse(user, companyFeatureEnabled, requiresEmailVerification) {
+        const userInfo = {
+            id: user.id,
+            email: user.email,
+            name: user.name ?? undefined,
+            phone: user.phone ?? null,
+            profilePictureId: user.profilePictureId ?? null
+        };
+        if (requiresEmailVerification) {
+            return {
+                user: userInfo,
+                companyFeatureEnabled,
+                requiresEmailVerification: true
+            };
+        }
+        const loginResponse = this.generateLoginResponse(user, companyFeatureEnabled);
+        return {
+            ...loginResponse,
+            requiresEmailVerification: false
+        };
+    }
+    /** Generate registration response with company - tokens included only if email verification not required */ generateRegistrationResponseWithCompany(user, company, branch, requiresEmailVerification = false) {
+        const userInfo = {
+            id: user.id,
+            email: user.email,
+            name: user.name ?? undefined,
+            phone: user.phone ?? null,
+            profilePictureId: user.profilePictureId ?? null
+        };
+        const companyInfo = {
+            id: company.id,
+            name: company.name,
+            slug: company.slug,
+            logoId: company.logoId ?? null
+        };
+        const branchInfo = branch ? {
+            id: branch.id,
+            name: branch.name,
+            slug: branch.slug,
+            logoId: branch.logoId ?? null
+        } : undefined;
+        if (requiresEmailVerification) {
+            return {
+                user: userInfo,
+                company: companyInfo,
+                branch: branchInfo,
+                companyFeatureEnabled: true,
+                requiresEmailVerification: true
+            };
+        }
+        const loginResponse = this.generateLoginResponseWithCompany(user, company, branch);
+        return {
+            ...loginResponse,
+            requiresEmailVerification: false
+        };
+    }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, dataSourceProvider, sessionService, injectedUserRepository, injectedPermissionRepository, injectedCompanyRepository, injectedBranchRepository){
+    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService){
         _define_property(this, "jwtService", void 0);
         _define_property(this, "authConfig", void 0);
+        _define_property(this, "cacheManager", void 0);
         _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "sessionService", void 0);
-        _define_property(this, "injectedUserRepository", void 0);
-        _define_property(this, "injectedPermissionRepository", void 0);
-        _define_property(this, "injectedCompanyRepository", void 0);
-        _define_property(this, "injectedBranchRepository", void 0);
+        _define_property(this, "authEmailService", void 0);
         _define_property(this, "logger", void 0);
         this.jwtService = jwtService;
         this.authConfig = authConfig;
+        this.cacheManager = cacheManager;
         this.dataSourceProvider = dataSourceProvider;
         this.sessionService = sessionService;
-        this.injectedUserRepository = injectedUserRepository;
-        this.injectedPermissionRepository = injectedPermissionRepository;
-        this.injectedCompanyRepository = injectedCompanyRepository;
-        this.injectedBranchRepository = injectedBranchRepository;
+        this.authEmailService = authEmailService;
         this.logger = new _common.Logger(AuthenticationService.name);
     }
 };
@@ -876,26 +969,20 @@ AuthenticationService = _ts_decorate([
     _ts_param(0, (0, _common.Inject)(_jwt.JwtService)),
     _ts_param(1, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
     _ts_param(2, (0, _common.Optional)()),
-    _ts_param(2, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
+    _ts_param(2, (0, _common.Inject)('CACHE_INSTANCE')),
     _ts_param(3, (0, _common.Optional)()),
-    _ts_param(3, (0, _common.Inject)(_companyselectionsessionservice.CompanySelectionSessionService)),
+    _ts_param(3, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
     _ts_param(4, (0, _common.Optional)()),
-    _ts_param(4, (0, _typeorm.InjectRepository)(_userentity.User)),
+    _ts_param(4, (0, _common.Inject)(_companyselectionsessionservice.CompanySelectionSessionService)),
     _ts_param(5, (0, _common.Optional)()),
-    _ts_param(5, (0, _typeorm.InjectRepository)(_usercompanypermissionentity.UserCompanyPermission)),
-    _ts_param(6, (0, _common.Optional)()),
-    _ts_param(6, (0, _typeorm.InjectRepository)(_companyentity.Company)),
-    _ts_param(7, (0, _common.Optional)()),
-    _ts_param(7, (0, _typeorm.InjectRepository)(_companybranchentity.CompanyBranch)),
+    _ts_param(5, (0, _common.Inject)(_authemailservice.AuthEmailService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _jwt.JwtService === "undefined" ? Object : _jwt.JwtService,
         typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
+        typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
         typeof _companyselectionsessionservice.CompanySelectionSessionService === "undefined" ? Object : _companyselectionsessionservice.CompanySelectionSessionService,
-        typeof _typeorm1.Repository === "undefined" ? Object : _typeorm1.Repository,
-        typeof _typeorm1.Repository === "undefined" ? Object : _typeorm1.Repository,
-        typeof _typeorm1.Repository === "undefined" ? Object : _typeorm1.Repository,
-        typeof _typeorm1.Repository === "undefined" ? Object : _typeorm1.Repository
+        typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService
     ])
 ], AuthenticationService);