@flusys/nestjs-auth 0.1.0-beta.3 → 1.1.0-beta

package/README.md

@@ -763,14 +763,4 @@ The authentication package provides:
 
 ---
 
-**Last Updated:** 2026-02-09
-**Version:** 4.1.6
-
-**Recent Improvements:**
-- 2026-02-09: Added explicit `@Inject()` decorators to all services for esbuild bundling compatibility
-- 2026-02-09: All services now use REQUEST scope with DataSource Provider pattern
-- 2026-02-07: Fixed entity diagram to show polymorphic design (permissionType/targetId)
-- 2026-02-07: Updated service names to match actual implementation
-- 2026-02-07: Simplified login flow diagrams
-- 2026-01-15: Fixed JwtStrategy to use `ModuleRef` for request-scoped `AuthDataSourceProvider` resolution
-- 2026-01-14: Added `UserPermissionController` for batch permission management
+**Last Updated:** 2026-02-16

package/cjs/config/auth.constants.js

@@ -1,7 +1,5 @@
-// =============================================================================
-// INJECTION TOKENS
-// =============================================================================
-/** Injection token for auth module options */ "use strict";
+// Injection Tokens
+"use strict";
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
@@ -15,9 +13,21 @@ _export(exports, {
     get AUTH_MODULE_OPTIONS () {
         return AUTH_MODULE_OPTIONS;
     },
+    get BCRYPT_SALT_ROUNDS () {
+        return BCRYPT_SALT_ROUNDS;
+    },
     get SESSION_CACHE_PREFIX () {
         return SESSION_CACHE_PREFIX;
+    },
+    get TOKEN_REVOKED_PREFIX () {
+        return TOKEN_REVOKED_PREFIX;
+    },
+    get USER_ENRICHER () {
+        return USER_ENRICHER;
     }
 });
 const AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
+const USER_ENRICHER = 'USER_ENRICHER';
+const BCRYPT_SALT_ROUNDS = 12;
 const SESSION_CACHE_PREFIX = 'auth:session';
+const TOKEN_REVOKED_PREFIX = 'auth:revoked';

package/cjs/controllers/authentication.controller.js

@@ -15,9 +15,11 @@ const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _express = require("express");
 const _authenticationdto = require("../dtos/authentication.dto");
+const _dtos = require("@flusys/nestjs-shared/dtos");
 const _cleartokeninterceptor = require("../interceptors/clear-token.interceptor");
 const _settokeninterceptor = require("../interceptors/set-token.interceptor");
 const _authconfigservice = require("../services/auth-config.service");
+const _authemailservice = require("../services/auth-email.service");
 const _authenticationservice = require("../services/authentication.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -47,37 +49,27 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthenticationController = class AuthenticationController {
-    // ==========================================================================
-    // CORE ENDPOINTS (Always available)
-    // ==========================================================================
-    /**
-   * Login
-   * Returns either tokens directly or company/branch selection requirement
-   * Browser: refreshToken set in HTTP-only cookie, not in response body
-   * API/Mobile: refreshToken included in response body
-   */ async login(loginDto) {
+    /** Build auth URL for email links */ buildAuthUrl(req, path) {
+        const frontendUrl = this.authConfig?.getFrontendUrl();
+        return frontendUrl ? `${frontendUrl}${path}` : `${req.protocol}://${req.get('host')}${path}`;
+    }
+    // Core Endpoints
+    /** Login - Returns tokens or company/branch selection requirement */ async login(loginDto) {
         const result = await this.authService.login(loginDto.email, loginDto.password);
         if ('requiresSelection' in result) {
             return result;
         }
         return result;
     }
-    /**
-   * Register new user
-   * If company feature enabled, can optionally join/create company
-   * Browser: refreshToken set in HTTP-only cookie
-   */ async register(registrationDto) {
-        const result = await this.authService.register(registrationDto);
+    /** Register new user. If company feature enabled, can join/create company. */ async register(req, registrationDto) {
+        const verifyUrlBase = this.buildAuthUrl(req, '/auth/verify-email');
+        const result = await this.authService.register(registrationDto, verifyUrlBase);
         return {
             ...result,
             companyFeatureEnabled: this.authConfig?.isCompanyFeatureEnabled() ?? false
         };
     }
-    /**
-   * Refresh access token
-   * Browser: Gets refreshToken from HTTP-only cookie
-   * API/Mobile: Gets refreshToken from request body
-   */ async refreshToken(req, refreshTokenDto) {
+    /** Refresh access token. Browser uses HTTP-only cookie, API/Mobile uses request body. */ async refreshToken(req, refreshTokenDto) {
         // Get refresh token from cookie (browser) or body (API/mobile)
         const cookieName = this.authConfig?.getRefreshTokenCookieName() ?? 'fsn_refresh_token';
         const refreshToken = req.cookies?.[cookieName] || refreshTokenDto.refreshToken;
@@ -86,37 +78,80 @@ let AuthenticationController = class AuthenticationController {
         }
         return this.authService.refreshToken(refreshToken);
     }
-    /**
-   * Get current user info
-   * Returns only user, company, and branch data (no tokens)
-   * Uses existing access token from Authorization header
-   * Company/branch fields are automatically excluded from Swagger when company feature is disabled
-   */ async getCurrentUser(user) {
+    /** Get current user info. Returns user, company, and branch data (no tokens). */ async getCurrentUser(user) {
         return this.authService.getUserInfo(user.id, user.companyId, user.branchId);
     }
-    /**
-   * Logout
-   * Clears refresh token cookie for browsers
-   */ async logout(userId) {
+    /** Logout - Clears refresh token cookie for browsers */ async logout(userId) {
         await this.authService.logout(userId);
         return {
+            success: true,
             message: 'Logged out successfully'
         };
     }
-    /**
-   * Change password
-   */ async changePassword(userId, dto) {
+    /** Change password */ async changePassword(userId, dto) {
         await this.authService.changePassword(userId, dto.currentPassword, dto.newPassword);
         return {
+            success: true,
             message: 'Password changed successfully'
         };
     }
+    // Email Auth Endpoints
+    /** Forgot password - Request password reset email */ async forgotPassword(req, dto) {
+        if (!this.authEmailService) {
+            return {
+                success: false,
+                message: 'Email service is not configured'
+            };
+        }
+        return this.authEmailService.forgotPassword(dto.email, this.buildAuthUrl(req, '/auth/reset-password'));
+    }
+    /** Reset password - Reset password using token */ async resetPassword(dto) {
+        if (!this.authEmailService) {
+            return {
+                success: false,
+                message: 'Email service is not configured'
+            };
+        }
+        return this.authEmailService.resetPassword(dto.token, dto.newPassword);
+    }
+    /** Resend verification email - For unauthenticated users (handles both pending registration and existing users) */ async resendVerification(req, dto) {
+        if (!this.authEmailService) {
+            return {
+                success: false,
+                message: 'Email service is not configured'
+            };
+        }
+        return this.authEmailService.resendVerificationEmail(dto.email, this.buildAuthUrl(req, '/auth/verify-email'));
+    }
+    /** Verify email - Verify email using token. Handles both pending registration and existing user verification. */ async verifyEmail(dto) {
+        if (!this.authEmailService) {
+            return {
+                success: false,
+                message: 'Email service is not configured'
+            };
+        }
+        const result = await this.authEmailService.verifyEmail(dto.token);
+        if (result.type === 'pending') {
+            // Create user from pending registration
+            const registrationResult = await this.authService.createUserFromPendingRegistration(result.pending);
+            return {
+                ...registrationResult,
+                companyFeatureEnabled: this.authConfig?.isCompanyFeatureEnabled() ?? false
+            };
+        }
+        return {
+            success: true,
+            message: result.message
+        };
+    }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(authService, authConfig){
+    constructor(authService, authConfig, authEmailService){
         _define_property(this, "authService", void 0);
         _define_property(this, "authConfig", void 0);
+        _define_property(this, "authEmailService", void 0);
         this.authService = authService;
         this.authConfig = authConfig;
+        this.authEmailService = authEmailService;
     }
 };
 _ts_decorate([
@@ -158,9 +193,11 @@ _ts_decorate([
         status: 201,
         type: _authenticationdto.RegistrationResponseDto
     }),
-    _ts_param(0, (0, _common.Body)()),
+    _ts_param(0, (0, _common.Req)()),
+    _ts_param(1, (0, _common.Body)()),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        typeof _express.Request === "undefined" ? Object : _express.Request,
         typeof _authenticationdto.RegistrationDto === "undefined" ? Object : _authenticationdto.RegistrationDto
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -210,6 +247,10 @@ _ts_decorate([
     (0, _swagger.ApiOperation)({
         summary: 'Logout user'
     }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
     _ts_param(0, (0, _decorators.CurrentUser)('id')),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
@@ -228,6 +269,10 @@ _ts_decorate([
     (0, _swagger.ApiBody)({
         type: _authenticationdto.ChangePasswordDto
     }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
     _ts_param(0, (0, _decorators.CurrentUser)('id')),
     _ts_param(1, (0, _common.Body)()),
     _ts_metadata("design:type", Function),
@@ -237,15 +282,107 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], AuthenticationController.prototype, "changePassword", null);
+_ts_decorate([
+    (0, _common.Post)('forgot-password'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _swagger.ApiOperation)({
+        summary: 'Request password reset email'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ForgotPasswordDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Req)()),
+    _ts_param(1, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _express.Request === "undefined" ? Object : _express.Request,
+        typeof _authenticationdto.ForgotPasswordDto === "undefined" ? Object : _authenticationdto.ForgotPasswordDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationController.prototype, "forgotPassword", null);
+_ts_decorate([
+    (0, _common.Post)('reset-password'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _swagger.ApiOperation)({
+        summary: 'Reset password using token'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ResetPasswordDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationdto.ResetPasswordDto === "undefined" ? Object : _authenticationdto.ResetPasswordDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationController.prototype, "resetPassword", null);
+_ts_decorate([
+    (0, _common.Post)('resend-verification'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _swagger.ApiOperation)({
+        summary: 'Resend email verification link'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ResendVerificationDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Req)()),
+    _ts_param(1, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _express.Request === "undefined" ? Object : _express.Request,
+        typeof _authenticationdto.ResendVerificationDto === "undefined" ? Object : _authenticationdto.ResendVerificationDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationController.prototype, "resendVerification", null);
+_ts_decorate([
+    (0, _common.Post)('verify-email'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _common.UseInterceptors)(_settokeninterceptor.SetToken),
+    (0, _swagger.ApiOperation)({
+        summary: 'Verify email using token'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.VerifyEmailDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _authenticationdto.RegistrationResponseDto
+    }),
+    _ts_param(0, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationdto.VerifyEmailDto === "undefined" ? Object : _authenticationdto.VerifyEmailDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationController.prototype, "verifyEmail", null);
 AuthenticationController = _ts_decorate([
     (0, _swagger.ApiTags)('Authentication'),
     (0, _common.Controller)('auth'),
     _ts_param(0, (0, _common.Inject)(_authenticationservice.AuthenticationService)),
     _ts_param(1, (0, _common.Optional)()),
     _ts_param(1, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
+    _ts_param(2, (0, _common.Optional)()),
+    _ts_param(2, (0, _common.Inject)(_authemailservice.AuthEmailService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _authenticationservice.AuthenticationService === "undefined" ? Object : _authenticationservice.AuthenticationService,
-        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService
+        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
+        typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService
     ])
 ], AuthenticationController);

package/cjs/controllers/branch.controller.js

@@ -12,7 +12,6 @@ const _classes = require("@flusys/nestjs-shared/classes");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _companybranchdto = require("../dtos/company-branch.dto");
-const _guards = require("@flusys/nestjs-shared/guards");
 const _branchservice = require("../services/branch.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -41,16 +40,16 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-let BranchController = class BranchController extends (0, _classes.createApiController)(_companybranchdto.CreateCompanyBranchDto, _companybranchdto.UpdateCompanyBranchDto, _companybranchdto.CompanyBranchResponseDto) {
+let BranchController = class BranchController extends (0, _classes.createApiController)(_companybranchdto.CreateCompanyBranchDto, _companybranchdto.UpdateCompanyBranchDto, _companybranchdto.CompanyBranchResponseDto, {
+    security: 'jwt'
+}) {
     constructor(branchService){
         super(branchService), _define_property(this, "branchService", void 0), this.branchService = branchService;
     }
 };
 BranchController = _ts_decorate([
     (0, _swagger.ApiTags)('Branches'),
-    (0, _swagger.ApiBearerAuth)(),
     (0, _common.Controller)('administration/branch'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
     _ts_param(0, (0, _common.Inject)(_branchservice.BranchService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/cjs/controllers/company.controller.js

@@ -12,7 +12,6 @@ const _classes = require("@flusys/nestjs-shared/classes");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _companydto = require("../dtos/company.dto");
-const _guards = require("@flusys/nestjs-shared/guards");
 const _companyservice = require("../services/company.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -41,16 +40,16 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-let CompanyController = class CompanyController extends (0, _classes.createApiController)(_companydto.CreateCompanyDto, _companydto.UpdateCompanyDto, _companydto.CompanyResponseDto) {
+let CompanyController = class CompanyController extends (0, _classes.createApiController)(_companydto.CreateCompanyDto, _companydto.UpdateCompanyDto, _companydto.CompanyResponseDto, {
+    security: 'jwt'
+}) {
     constructor(companyService){
         super(companyService), _define_property(this, "companyService", void 0), this.companyService = companyService;
     }
 };
 CompanyController = _ts_decorate([
     (0, _swagger.ApiTags)('Companies'),
-    (0, _swagger.ApiBearerAuth)(),
     (0, _common.Controller)('administration/company'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
     _ts_param(0, (0, _common.Inject)(_companyservice.CompanyService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/cjs/controllers/user-permission.controller.js

@@ -41,12 +41,8 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let UserPermissionController = class UserPermissionController {
-    // ========================================================================
-    // USER-COMPANY PERMISSIONS
-    // ========================================================================
-    /**
-   * Batch assign/revoke user-company permissions
-   */ async assignUserCompany(dto) {
+    // User-Company Permissions
+    /** Batch assign/revoke user-company permissions */ async assignUserCompany(dto) {
         let addedCount = 0;
         let removedCount = 0;
         for (const item of dto.items){
@@ -66,9 +62,7 @@ let UserPermissionController = class UserPermissionController {
             message: `Processed ${addedCount} additions and ${removedCount} removals`
         };
     }
-    /**
-   * Get user's companies
-   */ async getUserCompanies(userId) {
+    /** Get user's companies */ async getUserCompanies(userId) {
         const permissions = await this.userPermissionService.findUserCompanies(userId);
         // Map to DTO format with populated company details
         const data = permissions.map((permission)=>({
@@ -82,12 +76,8 @@ let UserPermissionController = class UserPermissionController {
             data
         };
     }
-    // ========================================================================
-    // USER-BRANCH PERMISSIONS
-    // ========================================================================
-    /**
-   * Batch assign/revoke user-branch permissions
-   */ async assignUserBranch(dto) {
+    // User-Branch Permissions
+    /** Batch assign/revoke user-branch permissions */ async assignUserBranch(dto) {
         let addedCount = 0;
         let removedCount = 0;
         for (const item of dto.items){
@@ -107,9 +97,7 @@ let UserPermissionController = class UserPermissionController {
             message: `Processed ${addedCount} additions and ${removedCount} removals`
         };
     }
-    /**
-   * Get user's branches
-   */ async getUserBranches(userId) {
+    /** Get user's branches */ async getUserBranches(userId) {
         const permissions = await this.userPermissionService.findUserBranches(userId);
         // Map to DTO format with populated branch details
         const data = permissions.map((permission)=>({