@flusys/nestjs-auth 1.0.0-beta → 1.0.0-rc

package/fesm/services/user.service.js

@@ -28,12 +28,13 @@ function _ts_param(paramIndex, decorator) {
 import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { ErrorHandler } from '@flusys/nestjs-shared/utils';
-import { BadRequestException, Inject, Injectable, NotFoundException, Scope } from '@nestjs/common';
+import { BadRequestException, ForbiddenException, Inject, Injectable, NotFoundException, Optional, Scope } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
-import { BCRYPT_SALT_ROUNDS } from '../config';
+import { BCRYPT_SALT_ROUNDS, USER_ENRICHER } from '../config';
 import { PermissionType } from '../enums';
+import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { User } from '../entities/user.entity';
 export class UserService extends RequestScopedApiService {
@@ -58,6 +59,14 @@ export class UserService extends RequestScopedApiService {
         }
     }
     // Custom Methods
+    /**
+   * Validate that the requesting user owns the target profile.
+   * Users can only access/modify their own profile data.
+   */ validateProfileOwnership(targetUserId, requestingUser) {
+        if (targetUserId !== requestingUser.id) {
+            throw new ForbiddenException('Cannot access another user\'s profile');
+        }
+    }
     /** Verify email */ async verifyEmail(id) {
         // Ensure repository is initialized for custom method
         await this.ensureRepositoryInitialized();
@@ -119,33 +128,58 @@ export class UserService extends RequestScopedApiService {
     /** Convert DTO to entity (hash password before saving) */ async convertSingleDtoToEntity(dto, user) {
         // Repository initialization is handled automatically by RequestScopedApiService
         const entity = await super.convertSingleDtoToEntity(dto, user);
-        // Hash password if provided
-        if (dto.password) {
+        // Hash password if provided (CreateUserDto has password field)
+        if ('password' in dto && dto.password) {
             entity.password = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
         }
         return entity;
     }
     /** Convert entity to response DTO (removes password). In raw mode with company feature, isActive comes from permission table. */ convertEntityToResponseDto(entity, isRaw) {
+        if (isRaw) {
+            return this.convertRawToResponseDto(entity);
+        }
+        return this.convertEntityToDto(entity);
+    }
+    /** Convert raw query result to response DTO */ convertRawToResponseDto(raw) {
         // When raw mode is used with company feature, isActive comes from computed field
-        // Raw mode uses snake_case column names (due to SnakeNamingStrategy)
-        const isActive = isRaw && entity.user_companyIsActive !== undefined ? Boolean(entity.user_companyIsActive) : isRaw ? entity.user_is_active : entity.isActive;
+        const isActive = raw.user_companyIsActive !== undefined ? Boolean(raw.user_companyIsActive) : raw.user_is_active;
         return {
-            id: isRaw ? entity.user_id : entity.id,
-            name: isRaw ? entity.user_name : entity.name,
-            phone: isRaw ? entity.user_phone : entity.phone,
-            email: isRaw ? entity.user_email : entity.email,
-            profilePictureId: isRaw ? entity.user_profile_picture_id : entity.profilePictureId,
+            id: raw.user_id,
+            name: raw.user_name,
+            phone: raw.user_phone,
+            email: raw.user_email,
+            profilePictureId: raw.user_profile_picture_id,
             isActive,
-            emailVerified: isRaw ? entity.user_email_verified : entity.emailVerified,
-            phoneVerified: isRaw ? entity.user_phone_verified : entity.phoneVerified,
-            lastLoginAt: isRaw ? entity.user_last_login_at : entity.lastLoginAt,
-            additionalFields: isRaw ? entity.user_additional_fields : entity.additionalFields,
-            createdAt: isRaw ? entity.user_created_at : entity.createdAt,
-            updatedAt: isRaw ? entity.user_updated_at : entity.updatedAt,
-            deletedAt: isRaw ? entity.user_deleted_at : entity.deletedAt,
-            createdById: isRaw ? entity.user_created_by_id : entity.createdById,
-            updatedById: isRaw ? entity.user_updated_by_id : entity.updatedById,
-            deletedById: isRaw ? entity.user_deleted_by_id : entity.deletedById
+            emailVerified: raw.user_email_verified,
+            phoneVerified: raw.user_phone_verified,
+            lastLoginAt: raw.user_last_login_at,
+            additionalFields: raw.user_additional_fields,
+            createdAt: raw.user_created_at,
+            updatedAt: raw.user_updated_at,
+            deletedAt: raw.user_deleted_at,
+            createdById: raw.user_created_by_id,
+            updatedById: raw.user_updated_by_id,
+            deletedById: raw.user_deleted_by_id
+        };
+    }
+    /** Convert entity to response DTO */ convertEntityToDto(entity) {
+        return {
+            id: entity.id,
+            name: entity.name,
+            phone: entity.phone,
+            email: entity.email,
+            profilePictureId: entity.profilePictureId,
+            isActive: entity.isActive,
+            emailVerified: entity.emailVerified,
+            phoneVerified: entity.phoneVerified,
+            lastLoginAt: entity.lastLoginAt,
+            additionalFields: entity.additionalFields,
+            createdAt: entity.createdAt,
+            updatedAt: entity.updatedAt,
+            deletedAt: entity.deletedAt,
+            createdById: entity.createdById,
+            updatedById: entity.updatedById,
+            deletedById: entity.deletedById
         };
     }
     /** Convert entity list to response DTO list */ convertEntityListToResponseListDto(entities, isRaw) {
@@ -162,7 +196,11 @@ export class UserService extends RequestScopedApiService {
     }
     /** Add company permission-based isActive check when company feature enabled. Returns isRaw: true for computed fields. */ async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
         // Repository initialization is handled automatically by RequestScopedApiService
-        const result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
+        let result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
+        // Apply user enricher query modifications if available
+        if (this.userEnricher?.enrichListQuery) {
+            await this.userEnricher.enrichListQuery(query, user);
+        }
         // Only apply company filtering if:
         // 1. Company feature is enabled at bootstrap
         // 2. User has company context
@@ -282,16 +320,144 @@ export class UserService extends RequestScopedApiService {
             await queryRunner.release();
         }
     }
-    /** Update user profile with password handling */ async profile(dto, user) {
-        // Repository initialization is handled automatically by RequestScopedApiService
+    /**
+   * Get user profile with extras from enricher
+   * Returns base user data plus any extra data provided by enricher (roles, permissions, etc.)
+   */ async getProfileWithExtras(userId, user) {
+        this.validateProfileOwnership(userId, user);
+        await this.ensureRepositoryInitialized();
+        const userEntity = await this.repository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!userEntity) {
+            throw new NotFoundException('User not found');
+        }
+        const userData = this.convertEntityToResponseDto(userEntity, false);
+        // Get extras from enricher if available
+        let extras;
+        if (this.userEnricher?.getProfileExtras) {
+            extras = await this.userEnricher.getProfileExtras(userId, user);
+        }
+        return {
+            user: userData,
+            extras
+        };
+    }
+    /**
+   * Get enriched user list
+   * Applies enricher transformations after query execution
+   */ async getEnrichedList(users, user) {
+        if (this.userEnricher?.enrichListItems) {
+            return this.userEnricher.enrichListItems(users, user);
+        }
+        return users;
+    }
+    // ============================================
+    // Multi-Step Profile Methods (via Enricher)
+    // ============================================
+    /**
+   * Get profile section definitions from enricher
+   */ async getProfileSections() {
+        if (this.userEnricher?.getProfileSections) {
+            return this.userEnricher.getProfileSections();
+        }
+        return [];
+    }
+    /**
+   * Get specific profile section data
+   */ async getProfileSectionData(userId, sectionId, user) {
+        this.validateProfileOwnership(userId, user);
+        await this.ensureRepositoryInitialized();
+        // Verify user exists
+        const userEntity = await this.repository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!userEntity) {
+            throw new NotFoundException('User not found');
+        }
+        if (this.userEnricher?.getProfileSectionData) {
+            return this.userEnricher.getProfileSectionData(userId, sectionId, user);
+        }
+        return null;
+    }
+    /**
+   * Update specific profile section
+   */ async updateProfileSection(userId, sectionId, data, user) {
+        this.validateProfileOwnership(userId, user);
+        await this.ensureRepositoryInitialized();
         if (!this.dataSource) {
             throw new BadRequestException('DataSource not available');
         }
+        // Verify user exists
+        const userEntity = await this.repository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!userEntity) {
+            throw new NotFoundException('User not found');
+        }
+        if (!this.userEnricher?.updateProfileSection) {
+            throw new BadRequestException('Profile sections not supported');
+        }
+        const queryRunner = this.dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            await this.userEnricher.updateProfileSection(userId, sectionId, data, queryRunner);
+            await queryRunner.commitTransaction();
+            await this.clearCacheForId([
+                userEntity
+            ]);
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            ErrorHandler.logError(this.logger, error, 'updateProfileSection', {
+                entity: this.entityName,
+                sectionId
+            });
+            ErrorHandler.rethrowError(error);
+        } finally{
+            await queryRunner.release();
+        }
+    }
+    /**
+   * Get profile completion percentage
+   */ async getProfileCompletion(userId, user) {
+        this.validateProfileOwnership(userId, user);
+        await this.ensureRepositoryInitialized();
+        // Verify user exists
+        const userEntity = await this.repository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!userEntity) {
+            throw new NotFoundException('User not found');
+        }
+        if (this.userEnricher?.calculateProfileCompletion) {
+            return this.userEnricher.calculateProfileCompletion(userId, user);
+        }
+        return 100; // Default to 100% if no enricher
+    }
+    /** Update user profile with password handling and extras */ async profile(dto, user) {
+        // Ensure repository and dataSource are initialized
+        await this.ensureRepositoryInitialized();
+        if (!this.dataSource) {
+            throw new BadRequestException('DataSource not available');
+        }
+        const userId = dto.id ?? user.id;
+        // Validate extras if enricher provides validation
+        if (dto.extras && this.userEnricher?.validateProfileExtras) {
+            await this.userEnricher.validateProfileExtras(userId, dto.extras, user);
+        }
         const queryRunner = this.dataSource.createQueryRunner();
         await queryRunner.connect();
         await queryRunner.startTransaction();
         try {
-            const userId = dto.id ?? user.id;
             const findUser = await queryRunner.manager.findOne(this.repository.target, {
                 where: {
                     id: userId
@@ -302,18 +468,28 @@ export class UserService extends RequestScopedApiService {
             }
             // Handle password update
             if (dto.password) {
-                // If updating own profile, require old password
-                if (!dto.id || dto.id === user.id) {
-                // This would need oldPassword in DTO - for now, skip if not provided
-                // In real implementation, add oldPassword to UpdateUserDto
+                // If updating own profile, require old password verification
+                const isOwnProfile = !dto.id || dto.id === user.id;
+                if (isOwnProfile) {
+                    if (!dto.oldPassword) {
+                        throw new BadRequestException('Current password is required to change your password');
+                    }
+                    const isPasswordValid = await bcrypt.compare(dto.oldPassword, findUser.password);
+                    if (!isPasswordValid) {
+                        throw new BadRequestException('Current password is incorrect');
+                    }
                 }
-                const salt = await bcrypt.genSalt();
-                findUser.password = await bcrypt.hash(dto.password, salt);
+                findUser.password = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
             }
-            // Merge other fields (excluding password)
-            const { password, ...restDto } = dto;
+            // Merge other fields (excluding password, oldPassword, extras, and sensitive flags)
+            // Users cannot self-modify emailVerified, phoneVerified, or isActive via profile update
+            const { password, oldPassword, extras, emailVerified, phoneVerified, isActive, ...restDto } = dto;
             Object.assign(findUser, restDto);
             await queryRunner.manager.save(this.repository.target, findUser);
+            // Handle extras update via enricher
+            if (extras && this.userEnricher?.updateProfileExtras) {
+                await this.userEnricher.updateProfileExtras(userId, extras, queryRunner);
+            }
             await queryRunner.commitTransaction();
             await this.clearCacheForId([
                 findUser
@@ -329,8 +505,8 @@ export class UserService extends RequestScopedApiService {
             await queryRunner.release();
         }
     }
-    constructor(cacheManager, utilsService, dataSourceProvider, authConfig){
-        super('user', null, cacheManager, utilsService, UserService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig;
+    constructor(cacheManager, utilsService, dataSourceProvider, authConfig, userEnricher){
+        super('user', null, cacheManager, utilsService, UserService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher;
     }
 }
 UserService = _ts_decorate([
@@ -341,11 +517,14 @@ UserService = _ts_decorate([
     _ts_param(1, Inject(UtilsService)),
     _ts_param(2, Inject(AuthDataSourceProvider)),
     _ts_param(3, Inject(AuthConfigService)),
+    _ts_param(4, Optional()),
+    _ts_param(4, Inject(USER_ENRICHER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof UtilsService === "undefined" ? Object : UtilsService,
         typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
-        typeof AuthConfigService === "undefined" ? Object : AuthConfigService
+        typeof AuthConfigService === "undefined" ? Object : AuthConfigService,
+        typeof IUserEnricher === "undefined" ? Object : IUserEnricher
     ])
 ], UserService);

package/fesm/validators/password.validator.js

@@ -0,0 +1,48 @@
+import { registerDecorator } from 'class-validator';
+/**
+ * Strong password validation decorator.
+ * Validates that passwords meet complexity requirements to prevent weak passwords.
+ *
+ * @example
+ * ```typescript
+ * @IsStrongPassword()
+ * password!: string;
+ *
+ * // With custom options
+ * @IsStrongPassword({ minLength: 12, requireSpecialChar: false })
+ * password!: string;
+ * ```
+ */ export function IsStrongPassword(options = {}, validationOptions) {
+    const { minLength = 8, maxLength = 128, requireUppercase = true, requireLowercase = true, requireNumber = true, requireSpecialChar = true } = options;
+    return function(object, propertyName) {
+        registerDecorator({
+            name: 'isStrongPassword',
+            target: object.constructor,
+            propertyName: propertyName,
+            options: validationOptions,
+            validator: {
+                validate (value) {
+                    if (typeof value !== 'string') return false;
+                    const checks = [
+                        value.length >= minLength,
+                        value.length <= maxLength,
+                        !requireUppercase || /[A-Z]/.test(value),
+                        !requireLowercase || /[a-z]/.test(value),
+                        !requireNumber || /[0-9]/.test(value),
+                        !requireSpecialChar || /[!@#$%^&*()_+\-=\[\]{};':"\\|,.<>\/?~`]/.test(value)
+                    ];
+                    return checks.every(Boolean);
+                },
+                defaultMessage (args) {
+                    const requirements = [];
+                    if (minLength > 0) requirements.push(`at least ${minLength} characters`);
+                    if (requireUppercase) requirements.push('one uppercase letter');
+                    if (requireLowercase) requirements.push('one lowercase letter');
+                    if (requireNumber) requirements.push('one number');
+                    if (requireSpecialChar) requirements.push('one special character (!@#$%^&*...)');
+                    return `Password must contain ${requirements.join(', ')}`;
+                }
+            }
+        });
+    };
+}

package/guards/auth-throttler.guard.d.ts

@@ -0,0 +1,7 @@
+import { ExecutionContext } from '@nestjs/common';
+import { ThrottlerGuard } from '@nestjs/throttler';
+export declare class AuthThrottlerGuard extends ThrottlerGuard {
+    protected getTracker(req: Record<string, unknown>): Promise<string>;
+    protected throwThrottlingException(): Promise<void>;
+    protected shouldSkip(context: ExecutionContext): Promise<boolean>;
+}

package/interceptors/set-token.interceptor.d.ts

@@ -5,6 +5,7 @@ export declare class SetToken implements NestInterceptor {
     private readonly authConfig?;
     constructor(authConfig?: AuthConfigService);
     private get cookieName();
+    private getMaxAgeMs;
     intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
     private isBrowserRequest;
     private setRefreshTokenCookie;

package/interfaces/auth-email-provider.interface.d.ts

@@ -0,0 +1,6 @@
+export interface IAuthEmailProvider {
+    sendPasswordResetEmail(email: string, token: string, resetUrl: string): Promise<void>;
+    sendVerificationEmail(email: string, token: string, verifyUrl: string): Promise<void>;
+    sendWelcomeEmail?(email: string, name: string): Promise<void>;
+}
+export declare const AUTH_EMAIL_PROVIDER = "AUTH_EMAIL_PROVIDER";

package/interfaces/auth-module-options.interface.d.ts

@@ -1,15 +1,17 @@
 import { IBootstrapAppConfig, IDataSourceServiceOptions, IDynamicModuleConfig, IModuleOptionsFactory } from '@flusys/nestjs-core';
-import { ModuleMetadata, Type } from '@nestjs/common';
+import { ModuleMetadata, Provider, Type } from '@nestjs/common';
 export interface IAuthModuleConfig extends IDataSourceServiceOptions {
     jwtSecret?: string;
     jwtExpiration?: string;
     refreshTokenSecret?: string;
     refreshTokenExpiration?: string;
     refreshTokenCookieName?: string;
+    frontendUrl?: string;
 }
 export interface AuthModuleOptions extends IDynamicModuleConfig {
     bootstrapAppConfig?: IBootstrapAppConfig;
     config?: IAuthModuleConfig;
+    providers?: Provider[];
 }
 export interface AuthOptionsFactory extends IModuleOptionsFactory<IAuthModuleConfig> {
     createAuthOptions(): Promise<IAuthModuleConfig> | IAuthModuleConfig;
@@ -21,4 +23,5 @@ export interface AuthModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'>,
     inject?: any[];
     useClass?: Type<AuthOptionsFactory>;
     useExisting?: Type<AuthOptionsFactory>;
+    providers?: Provider[];
 }

package/interfaces/authentication.interface.d.ts

@@ -51,3 +51,17 @@ export interface LoginResponseRequiresSelection {
     user: IUserMini;
     companies: CompanyWithBranches[];
 }
+export interface RegistrationResponse {
+    accessToken?: string;
+    refreshToken?: string;
+    user: IUserMini;
+    company?: ICompanyMini;
+    branch?: ICompanyBranchMini;
+    companyFeatureEnabled?: boolean;
+    requiresEmailVerification?: boolean;
+}
+export interface LoginResponseRequiresEmailVerification {
+    requiresEmailVerification: true;
+    email: string;
+    message: string;
+}

package/interfaces/index.d.ts

@@ -1,5 +1,7 @@
 export * from './authentication.interface';
+export * from './auth-email-provider.interface';
 export * from './company-branch.interface';
 export * from './company.interface';
 export * from './user.interface';
+export * from './user-enricher.interface';
 export * from './auth-module-options.interface';

package/interfaces/user-enricher.interface.d.ts

@@ -0,0 +1,64 @@
+import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
+import { QueryRunner, SelectQueryBuilder } from 'typeorm';
+import { User } from '../entities/user.entity';
+import { IUser } from './user.interface';
+export interface IProfileSection {
+    id: string;
+    name: string;
+    order: number;
+    icon?: string;
+    required?: boolean;
+    hasFileUpload?: boolean;
+    editPermission?: string;
+}
+export interface IProfileSectionData {
+    sectionId: string;
+    data: Record<string, any>;
+    isComplete: boolean;
+    files?: IProfileFile[];
+}
+export interface IProfileFile {
+    field: string;
+    id: string;
+    name: string;
+    url?: string;
+    type?: string;
+}
+export interface IProfileExtras {
+    roles?: IProfileRole[];
+    actions?: IProfileAction[];
+    sections?: IProfileSectionData[];
+    completionPercentage?: number;
+}
+export interface IProfileRole {
+    id: string;
+    name: string;
+    description?: string | null;
+}
+export interface IProfileAction {
+    id: string;
+    name: string;
+    code: string;
+    description?: string | null;
+}
+export type IEnrichedUser = IUser & IProfileExtras;
+export interface IUserEnricher {
+    enrichListQuery?(query: SelectQueryBuilder<User>, user: ILoggedUserInfo | null): Promise<{
+        extraFields: string[];
+    }>;
+    enrichListItems?(users: IUser[], user: ILoggedUserInfo | null): Promise<IEnrichedUser[]>;
+    getProfileExtras?(userId: string, user: ILoggedUserInfo): Promise<IProfileExtras>;
+    updateProfileExtras?(userId: string, extras: Record<string, any>, queryRunner: QueryRunner): Promise<void>;
+    validateProfileExtras?(userId: string, extras: Record<string, any>, user: ILoggedUserInfo): Promise<void>;
+    getProfileSections?(): IProfileSection[];
+    getProfileSectionData?(userId: string, sectionId: string, user: ILoggedUserInfo): Promise<IProfileSectionData>;
+    updateProfileSection?(userId: string, sectionId: string, data: Record<string, any>, queryRunner: QueryRunner): Promise<void>;
+    handleSectionFileUpload?(userId: string, sectionId: string, field: string, fileInfo: {
+        name: string;
+        url: string;
+        size: number;
+        type: string;
+    }, queryRunner: QueryRunner): Promise<IProfileFile>;
+    handleSectionFileDelete?(userId: string, sectionId: string, field: string, fileId: string, queryRunner: QueryRunner): Promise<void>;
+    calculateProfileCompletion?(userId: string, user: ILoggedUserInfo): Promise<number>;
+}

package/interfaces/user.interface.d.ts

@@ -3,6 +3,7 @@ export interface IUserMini {
     id: string;
     email: string;
     name?: string;
+    phone?: string | null;
     profilePictureId?: string | null;
 }
 export interface IUser extends Identity {

package/modules/auth.module.d.ts

@@ -5,6 +5,5 @@ export declare class AuthModule {
     static forRootAsync(asyncOptions: AuthModuleAsyncOptions): DynamicModule;
     private static buildDynamicModule;
     private static createAsyncProviders;
-    private static getRepositoryProviders;
     static getEntities(enableCompanyFeature?: boolean): any[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "1.0.0-beta",
+  "version": "1.0.0-rc",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -84,14 +84,14 @@
     "bcrypt": "^5.0.0 || ^6.0.0",
     "class-transformer": "^0.5.0",
     "class-validator": "^0.14.0",
-    "nodemailer": "^6.0.0",
+    "nodemailer": "^7.0.0",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0",
     "typeorm": "^0.3.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "1.0.0-beta",
-    "@flusys/nestjs-shared": "1.0.0-beta"
+    "@flusys/nestjs-core": "1.0.0-rc",
+    "@flusys/nestjs-shared": "1.0.0-rc"
   }
 }

package/services/auth-config.service.d.ts

@@ -1,8 +1,11 @@
 import { DatabaseMode, IDatabaseConfig, ITenantDatabaseConfig } from '@flusys/nestjs-core';
+import { IModuleConfigService } from '@flusys/nestjs-shared/interfaces';
 import { AuthModuleOptions, IAuthModuleConfig } from '../interfaces/auth-module-options.interface';
-export declare class AuthConfigService {
+export declare class AuthConfigService implements IModuleConfigService {
+    private readonly logger;
     private readonly options;
     private readonly config;
+    private refreshTokenSecretWarned;
     constructor(injectedOptions?: AuthModuleOptions);
     getDatabaseMode(): DatabaseMode;
     isMultiTenant(): boolean;
@@ -12,6 +15,7 @@ export declare class AuthConfigService {
     getRefreshTokenSecret(): string;
     getRefreshTokenExpiration(): string;
     getRefreshTokenCookieName(): string;
+    getFrontendUrl(): string | undefined;
     getDefaultDatabaseConfig(): IDatabaseConfig | undefined;
     getTenantDefaultDatabaseConfig(): IDatabaseConfig | undefined;
     getTenants(): ITenantDatabaseConfig[];

package/services/auth-email.service.d.ts

@@ -0,0 +1,51 @@
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { PendingRegistration } from '../entities/pending-registration.entity';
+import { IAuthEmailProvider } from '../interfaces';
+export declare class AuthEmailService {
+    private readonly dataSourceProvider?;
+    private readonly emailProvider?;
+    private readonly logger;
+    private readonly PASSWORD_RESET_EXPIRY;
+    private readonly EMAIL_VERIFICATION_EXPIRY;
+    constructor(dataSourceProvider?: AuthDataSourceProvider, emailProvider?: IAuthEmailProvider);
+    private getUserRepository;
+    private getUserTokenRepository;
+    private getPendingRegistrationRepository;
+    isEmailEnabled(): boolean;
+    private generateToken;
+    private hashToken;
+    createPendingRegistration(data: {
+        email: string;
+        name?: string;
+        phone?: string;
+        password: string;
+        companyData?: PendingRegistration['companyData'];
+        verifyUrlBase: string;
+    }): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    forgotPassword(email: string, resetUrlBase: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    resetPassword(token: string, newPassword: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    verifyEmail(token: string): Promise<{
+        type: 'pending';
+        pending: PendingRegistration;
+    } | {
+        type: 'verified';
+        message: string;
+    }>;
+    resendVerificationEmail(email: string, verifyUrlBase: string): Promise<{
+        success: boolean;
+        message: string;
+    }>;
+    cleanupExpired(): Promise<{
+        deletedTokens: number;
+        deletedPending: number;
+    }>;
+}