@flusys/nestjs-auth 1.0.0-beta → 1.0.0

package/fesm/services/authentication.service.js

@@ -25,62 +25,67 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
+import { HybridCache } from '@flusys/nestjs-shared/classes';
+import { ErrorHandler, generateUniqueSlug } from '@flusys/nestjs-shared/utils';
 import { BadRequestException, Inject, Injectable, Logger, NotFoundException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
-import { InjectRepository } from '@nestjs/typeorm';
 import * as bcrypt from 'bcrypt';
-import { Repository } from 'typeorm';
-import { ErrorHandler } from '@flusys/nestjs-shared/utils';
-import { AuthConfigService } from './auth-config.service';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
-import { PermissionType } from '../enums';
 import { BCRYPT_SALT_ROUNDS, TOKEN_REVOKED_PREFIX } from '../config';
-import { HybridCache } from '@flusys/nestjs-shared/classes';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { User } from '../entities/user.entity';
+import { PermissionType } from '../enums';
+import { AuthConfigService } from './auth-config.service';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { AuthEmailService } from './auth-email.service';
 import { CompanySelectionSessionService } from './company-selection-session.service';
 export class AuthenticationService {
+    // Feature Flags
+    /** Check if company feature is enabled (tenant-aware with global fallback) */ isCompanyFeatureEnabled() {
+        return this.dataSourceProvider?.isCompanyFeatureEnabled() ?? this.authConfig.isCompanyFeatureEnabled();
+    }
     // Repository Getters
     async getUserRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(User);
-        }
-        if (this.injectedUserRepository) {
-            return this.injectedUserRepository;
+        if (!this.dataSourceProvider) {
+            throw new Error('User repository not available');
         }
-        throw new Error('User repository not available');
+        return this.dataSourceProvider.getRepository(User);
     }
     async getPermissionRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(UserCompanyPermission);
-        }
-        return this.injectedPermissionRepository ?? null;
+        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(UserCompanyPermission);
     }
     async getCompanyRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(Company);
-        }
-        return this.injectedCompanyRepository ?? null;
+        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(Company);
     }
     async getBranchRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(CompanyBranch);
-        }
-        return this.injectedBranchRepository ?? null;
+        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(CompanyBranch);
     }
     // Login
-    /** Login with email and password. Returns tokens or requires company/branch selection. */ async login(email, password) {
+    async login(email, password) {
+        // Check for pending registration first (user registered but hasn't verified email yet)
+        if (await this.authEmailService?.hasPendingRegistration(email)) {
+            return {
+                requiresEmailVerification: true,
+                email,
+                message: 'Please verify your email address to complete registration.'
+            };
+        }
         const user = await this.validateUser(email, password);
         if (!user.isActive) {
             throw new UnauthorizedException('User account is deactivated');
         }
-        // If company feature not enabled, return simple token
-        if (!this.authConfig.isCompanyFeatureEnabled()) {
+        if (this.authEmailService?.isEmailEnabled() && !user.emailVerified) {
+            return {
+                requiresEmailVerification: true,
+                email: user.email,
+                message: 'Please verify your email address before logging in.'
+            };
+        }
+        if (!this.isCompanyFeatureEnabled()) {
             return this.generateLoginResponse(user);
         }
         return this.handleCompanyBasedLogin(user);
@@ -112,7 +117,7 @@ export class AuthenticationService {
         // If user has no company assignments yet, return simple login response
         // This allows users to login and be assigned to companies later
         if (companies.length === 0) {
-            return this.generateLoginResponse(user, true);
+            return this.generateLoginResponse(user);
         }
         // Get branch permissions
         const branchPermissions = await permissionRepository.find({
@@ -136,19 +141,80 @@ export class AuthenticationService {
         return await this.generateCompanySelectionResponse(user, companies, branches);
     }
     // Registration
-    /** Register a new user. If company feature enabled, optionally join/create company. */ async register(dto) {
+    /** Register a new user. If email enabled, creates pending registration. Otherwise creates user directly. */ async register(dto, verifyUrlBase) {
         const userRepository = await this.getUserRepository();
-        // Check if user exists
-        // Note: Generic error message to prevent email enumeration attacks
         const existingUser = await userRepository.findOne({
             where: {
                 email: dto.email
             }
         });
+        // When company feature is enabled and user exists, allow joining/creating company
+        if (existingUser && this.isCompanyFeatureEnabled()) {
+            return this.handleExistingUserCompanyRegistration(existingUser, dto);
+        }
+        // User exists but company feature is off - email must be unique
         if (existingUser) {
-            throw new BadRequestException('Registration failed. Please try again or contact support.');
+            throw new BadRequestException('Registration failed due to email exists. Please try again or contact support.');
+        }
+        // If email verification is enabled, create pending registration instead of user
+        if (this.authEmailService?.isEmailEnabled() && verifyUrlBase) {
+            const companyData = this.isCompanyFeatureEnabled() ? {
+                companySlug: dto.companySlug,
+                branchSlug: dto.branchSlug,
+                newCompanyName: dto.newCompanyName,
+                newCompanyPhone: dto.newCompanyPhone,
+                newCompanyAddress: dto.newCompanyAddress
+            } : undefined;
+            const result = await this.authEmailService.createPendingRegistration({
+                email: dto.email,
+                name: dto.name,
+                phone: dto.phone,
+                password: dto.password,
+                companyData,
+                verifyUrlBase
+            });
+            return {
+                requiresEmailVerification: true,
+                message: result.message
+            };
+        }
+        // No email verification - create user directly
+        return this.createUserDirectly(dto);
+    }
+    /** Handle registration for existing user when company feature is enabled */ async handleExistingUserCompanyRegistration(existingUser, dto) {
+        if (!dto.companySlug && !dto.newCompanyName) {
+            throw new BadRequestException('Email already registered. Please login or provide a company to join/create.');
+        }
+        const permissionRepository = await this.getPermissionRepository();
+        const companyRepository = await this.getCompanyRepository();
+        if (!permissionRepository || !companyRepository) {
+            throw new BadRequestException('Company feature repositories not available');
         }
-        // Create user
+        // For existing users joining a company, check if already assigned
+        if (dto.companySlug) {
+            const company = await companyRepository.findOne({
+                where: {
+                    slug: dto.companySlug,
+                    isActive: true
+                }
+            });
+            if (company) {
+                const existingPermission = await permissionRepository.findOne({
+                    where: {
+                        userId: existingUser.id,
+                        permissionType: PermissionType.COMPANY,
+                        targetId: company.id
+                    }
+                });
+                if (existingPermission) {
+                    throw new BadRequestException('You are already assigned to this company. Please login.');
+                }
+            }
+        }
+        return this.processCompanyRegistration(existingUser, dto, true);
+    }
+    /** Create user directly (no email verification) */ async createUserDirectly(dto) {
+        const userRepository = await this.getUserRepository();
         const hashedPassword = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
         const user = userRepository.create({
             name: dto.name,
@@ -160,112 +226,128 @@ export class AuthenticationService {
             phoneVerified: false
         });
         await userRepository.save(user);
-        // If company feature not enabled, return simple response
-        if (!this.authConfig.isCompanyFeatureEnabled()) {
-            return this.generateLoginResponse(user, false);
+        if (!this.isCompanyFeatureEnabled()) {
+            return this.generateRegistrationResponse(user);
+        }
+        return this.processCompanyRegistration(user, dto);
+    }
+    /** Create user from pending registration (after email verification) */ async createUserFromPendingRegistration(pending) {
+        const userRepository = await this.getUserRepository();
+        const existingUser = await userRepository.findOne({
+            where: {
+                email: pending.email
+            }
+        });
+        if (existingUser) {
+            throw new BadRequestException('This email has already been registered.');
+        }
+        const user = userRepository.create({
+            name: pending.name,
+            email: pending.email,
+            phone: pending.phone,
+            password: pending.passwordHash,
+            isActive: true,
+            emailVerified: true,
+            phoneVerified: false
+        });
+        await userRepository.save(user);
+        if (this.isCompanyFeatureEnabled() && pending.companyData) {
+            return this.processCompanyRegistration(user, pending.companyData);
         }
-        // Handle company feature
-        return this.handleCompanyRegistration(user, dto);
+        return this.generateRegistrationResponse(user);
     }
-    /** Handle company-related registration logic */ async handleCompanyRegistration(user, dto) {
+    /** Process company registration (join existing or create new) */ async processCompanyRegistration(user, data, throwOnUnavailable = false) {
         const companyRepository = await this.getCompanyRepository();
         const branchRepository = await this.getBranchRepository();
         const permissionRepository = await this.getPermissionRepository();
         if (!companyRepository || !branchRepository || !permissionRepository) {
-            return this.generateLoginResponse(user, true);
+            if (throwOnUnavailable) throw new BadRequestException('Company feature repositories not available');
+            return this.generateRegistrationResponse(user);
         }
-        let company = null;
-        let branch = null;
-        // Case 1: Join existing company by slug
-        if (dto.companySlug) {
-            company = await companyRepository.findOne({
+        const { company, branch } = await this.findOrCreateCompanyAndBranch(data, companyRepository, branchRepository);
+        if (company) {
+            await this.assignUserPermissions(user.id, company.id, branch?.id, permissionRepository);
+            return this.generateRegistrationResponseWithCompany(user, company, branch ?? undefined);
+        }
+        return this.generateRegistrationResponse(user);
+    }
+    /** Find existing company/branch or create new ones */ async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
+        if (data.companySlug) {
+            const company = await companyRepo.findOne({
                 where: {
-                    slug: dto.companySlug,
+                    slug: data.companySlug,
                     isActive: true
                 }
             });
-            if (!company) {
-                throw new BadRequestException('Company not found or inactive');
-            }
-            // Find branch by slug or get default
-            if (dto.branchSlug) {
-                branch = await branchRepository.findOne({
-                    where: {
-                        slug: dto.branchSlug,
-                        companyId: company.id,
-                        isActive: true
-                    }
-                });
-                if (!branch) {
-                    throw new BadRequestException('Branch not found or inactive');
+            if (!company) throw new BadRequestException('Company not found or inactive');
+            const branch = data.branchSlug ? await branchRepo.findOne({
+                where: {
+                    slug: data.branchSlug,
+                    companyId: company.id,
+                    isActive: true
                 }
-            } else {
-                // Get first active branch
-                branch = await branchRepository.findOne({
-                    where: {
-                        companyId: company.id,
-                        isActive: true
-                    },
-                    order: {
-                        serial: 'ASC',
-                        createdAt: 'ASC'
-                    }
-                });
-            }
-        } else if (dto.newCompanyName) {
-            const slug = this.generateSlug(dto.newCompanyName);
-            // Check if slug exists
-            const existingCompany = await companyRepository.findOne({
+            }) : await branchRepo.findOne({
                 where: {
-                    slug
+                    companyId: company.id,
+                    isActive: true
+                },
+                order: {
+                    serial: 'ASC',
+                    createdAt: 'ASC'
                 }
             });
-            if (existingCompany) {
-                throw new BadRequestException('Company creation failed. Please try a different name.');
-            }
-            // Create company
-            company = companyRepository.create({
-                name: dto.newCompanyName,
+            if (data.branchSlug && !branch) throw new BadRequestException('Branch not found or inactive');
+            return {
+                company,
+                branch
+            };
+        }
+        if (data.newCompanyName) {
+            const slug = await generateUniqueSlug(data.newCompanyName, async (baseSlug)=>{
+                const rows = await companyRepo.createQueryBuilder('c').select('c.slug').where('c.slug = :base OR c.slug LIKE :pattern', {
+                    base: baseSlug,
+                    pattern: `${baseSlug}-%`
+                }).getMany();
+                return rows.map((r)=>r.slug);
+            });
+            const company = companyRepo.create({
+                name: data.newCompanyName,
                 slug,
-                phone: dto.newCompanyPhone,
-                address: dto.newCompanyAddress,
+                phone: data.newCompanyPhone,
+                address: data.newCompanyAddress,
                 isActive: true
             });
-            await companyRepository.save(company);
-            // Create default branch
-            branch = branchRepository.create({
+            await companyRepo.save(company);
+            const branch = branchRepo.create({
                 name: 'Main Branch',
                 slug: 'main-branch',
                 companyId: company.id,
                 isActive: true
             });
-            await branchRepository.save(branch);
-        }
-        // Create permissions if company exists
-        if (company) {
-            // Create company permission
-            const companyPermission = permissionRepository.create({
-                userId: user.id,
-                permissionType: PermissionType.COMPANY,
-                targetId: company.id
-            });
-            await permissionRepository.save(companyPermission);
-            // Create branch permission if branch exists
-            if (branch) {
-                const branchPermission = permissionRepository.create({
-                    userId: user.id,
-                    permissionType: PermissionType.BRANCH,
-                    targetId: branch.id
-                });
-                await permissionRepository.save(branchPermission);
-            }
-            return this.generateLoginResponseWithCompany(user, company, branch ?? undefined);
+            await branchRepo.save(branch);
+            return {
+                company,
+                branch
+            };
         }
-        // No company assigned
-        return this.generateLoginResponse(user, true);
+        return {
+            company: null,
+            branch: null
+        };
     }
-    /** Generate URL-friendly slug from name */ generateSlug(name) {
-        return name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').substring(0, 100);
+    /** Assign user to company and optionally branch */ async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
+        await permissionRepo.save(permissionRepo.create({
+            userId,
+            permissionType: PermissionType.COMPANY,
+            targetId: companyId
+        }));
+        if (branchId) {
+            await permissionRepo.save(permissionRepo.create({
+                userId,
+                permissionType: PermissionType.BRANCH,
+                targetId: branchId
+            }));
+        }
     }
     // Company/Branch Selection
     /** Select company and branch (step 2 of login). Frontend receives all options and user selects both. */ async select(sessionId, companyId, branchId) {
@@ -277,66 +359,13 @@ export class AuthenticationService {
         if (!session) {
             throw new UnauthorizedException('Invalid or expired session');
         }
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                id: session.userId
-            }
-        });
-        if (!user) {
-            throw new NotFoundException('User not found');
-        }
-        const permissionRepository = await this.getPermissionRepository();
-        const companyRepository = await this.getCompanyRepository();
-        const branchRepository = await this.getBranchRepository();
-        if (!permissionRepository || !companyRepository || !branchRepository) {
-            throw new BadRequestException('Repositories not available');
-        }
-        // Validate company access
-        const companyPermission = await permissionRepository.findOne({
-            where: {
-                userId: user.id,
-                permissionType: PermissionType.COMPANY,
-                targetId: companyId
-            }
-        });
-        if (!companyPermission) {
-            throw new UnauthorizedException('No access to this company');
-        }
-        const company = await companyRepository.findOne({
-            where: {
-                id: companyId,
-                isActive: true
-            }
-        });
-        if (!company) {
-            throw new UnauthorizedException('Company not found or inactive');
-        }
-        // Validate branch access
-        const branchPermission = await permissionRepository.findOne({
-            where: {
-                userId: user.id,
-                permissionType: PermissionType.BRANCH,
-                targetId: branchId
-            }
-        });
-        if (!branchPermission) {
-            throw new UnauthorizedException('No access to this branch');
-        }
-        const branch = await branchRepository.findOne({
-            where: {
-                id: branchId,
-                companyId,
-                isActive: true
-            }
-        });
-        if (!branch) {
-            throw new UnauthorizedException('Branch not found or inactive');
-        }
-        return this.generateLoginResponseWithCompany(user, company, branch);
+        return this.validateAndLoginWithCompany(session.userId, companyId, branchId);
     }
     /** Switch company/branch after login */ async switchCompany(userId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
+        return this.validateAndLoginWithCompany(userId, companyId, branchId);
+    }
+    /** Shared: Validate user access to company/branch and generate login response */ async validateAndLoginWithCompany(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -353,14 +382,14 @@ export class AuthenticationService {
             throw new BadRequestException('Repositories not available');
         }
         // Validate company access
-        const companyPermission = await permissionRepository.findOne({
+        const hasCompanyAccess = await permissionRepository.findOne({
             where: {
                 userId,
                 permissionType: PermissionType.COMPANY,
                 targetId: companyId
             }
         });
-        if (!companyPermission) {
+        if (!hasCompanyAccess) {
             throw new UnauthorizedException('No access to this company');
         }
         const company = await companyRepository.findOne({
@@ -372,14 +401,15 @@ export class AuthenticationService {
         if (!company) {
             throw new UnauthorizedException('Company not found or inactive');
         }
-        const branchPermission = await permissionRepository.findOne({
+        // Validate branch access
+        const hasBranchAccess = await permissionRepository.findOne({
             where: {
                 userId,
                 permissionType: PermissionType.BRANCH,
                 targetId: branchId
             }
         });
-        if (!branchPermission) {
+        if (!hasBranchAccess) {
             throw new UnauthorizedException('No access to this branch');
         }
         const branch = await branchRepository.findOne({
@@ -400,6 +430,9 @@ export class AuthenticationService {
             const payload = this.jwtService.verify(refreshToken, {
                 secret: this.authConfig.getRefreshTokenSecret()
             });
+            if (await this.isTokenRevoked(payload.id, payload.iat)) {
+                throw new UnauthorizedException('Token has been revoked');
+            }
             const userRepository = await this.getUserRepository();
             const user = await userRepository.findOne({
                 where: {
@@ -409,7 +442,7 @@ export class AuthenticationService {
             if (!user || !user.isActive) {
                 throw new UnauthorizedException('Invalid refresh token');
             }
-            const accessPayload = {
+            return this.generateTokens({
                 id: user.id,
                 email: user.email,
                 type: 'access',
@@ -419,44 +452,9 @@ export class AuthenticationService {
                 },
                 ...payload.branchId && {
                     branchId: payload.branchId
-                },
-                ...payload.companyLogoId && {
-                    companyLogoId: payload.companyLogoId
-                },
-                ...payload.branchLogoId && {
-                    branchLogoId: payload.branchLogoId
                 }
-            };
-            const refreshPayload = {
-                id: user.id,
-                email: user.email,
-                type: 'refresh',
-                profilePictureId: user.profilePictureId ?? undefined,
-                ...payload.companyId && {
-                    companyId: payload.companyId
-                },
-                ...payload.branchId && {
-                    branchId: payload.branchId
-                },
-                ...payload.companyLogoId && {
-                    companyLogoId: payload.companyLogoId
-                },
-                ...payload.branchLogoId && {
-                    branchLogoId: payload.branchLogoId
-                }
-            };
-            return {
-                accessToken: this.jwtService.sign(accessPayload, {
-                    secret: this.authConfig.getJwtSecret(),
-                    expiresIn: this.authConfig.getJwtExpiration()
-                }),
-                refreshToken: this.jwtService.sign(refreshPayload, {
-                    secret: this.authConfig.getRefreshTokenSecret(),
-                    expiresIn: this.authConfig.getRefreshTokenExpiration()
-                })
-            };
+            });
         } catch (error) {
-            // Log error details for debugging (not exposed to client)
             ErrorHandler.logError(this.logger, error, 'refreshToken');
             throw new UnauthorizedException('Invalid or expired refresh token');
         }
@@ -468,11 +466,8 @@ export class AuthenticationService {
                 id: userId
             }
         });
-        if (!user) {
-            throw new UnauthorizedException('User not found');
-        }
-        const isPasswordValid = await bcrypt.compare(currentPassword, user.password || '');
-        if (!isPasswordValid) {
+        if (!user) throw new UnauthorizedException('User not found');
+        if (!await bcrypt.compare(currentPassword, user.password || '')) {
             throw new UnauthorizedException('Current password is incorrect');
         }
         user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
@@ -480,8 +475,9 @@ export class AuthenticationService {
     }
     /** Logout - Revokes all tokens. Stores revocation timestamp in cache. */ async logout(userId) {
         if (!this.cacheManager) {
-            // Cache not available - graceful degradation (client-side logout only)
-            return;
+            // Cache is required for secure logout - tokens cannot be revoked without it
+            this.logger.error(`SECURITY: Cache not available for logout (userId: ${userId}). ` + 'Token revocation failed - tokens will remain valid until expiry. ' + 'Configure cache (Redis) to enable proper token revocation.');
+            throw new BadRequestException('Logout service temporarily unavailable. Please try again later.');
         }
         const revokedAt = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
         const cacheKey = `${TOKEN_REVOKED_PREFIX}:${userId}`;
@@ -489,6 +485,7 @@ export class AuthenticationService {
         const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
         const ttlMs = this.parseExpiryToMs(refreshTokenExpiry);
         await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+        this.logger.log(`User ${userId} logged out - all tokens revoked`);
     }
     /** Check if a token is revoked (issued before user's revocation timestamp) */ async isTokenRevoked(userId, tokenIssuedAt) {
         if (!this.cacheManager || !tokenIssuedAt) {
@@ -606,53 +603,28 @@ export class AuthenticationService {
                 id: userId
             }
         });
-        if (!user) {
-            throw new UnauthorizedException('User not found');
-        }
-        // Build response (no tokens)
+        if (!user) throw new UnauthorizedException('User not found');
         const response = {
-            user: {
-                id: user.id,
-                email: user.email,
-                name: user.name ?? undefined,
-                profilePictureId: user.profilePictureId ?? undefined
-            }
+            user: this.toUserInfo(user)
         };
-        // Add company/branch if available (when company feature is enabled)
-        if (this.authConfig.isCompanyFeatureEnabled()) {
-            // When company feature is enabled, companyId MUST be present
+        if (this.isCompanyFeatureEnabled()) {
             if (!companyId) {
-                throw new UnauthorizedException('Company feature is enabled but user has no company assigned. Please select a company.');
+                throw new UnauthorizedException('Company feature is enabled but user has no company assigned.');
             }
             const company = await this.getCompanyById(companyId);
-            if (!company) {
-                throw new UnauthorizedException(`Company with ID ${companyId} not found. Please select a valid company.`);
-            }
-            response.company = {
-                id: company.id,
-                name: company.name,
-                slug: company.slug,
-                logoId: company.logoId ?? null
-            };
-            // Branch is optional in some configurations, but if provided it must exist
+            if (!company) throw new UnauthorizedException('Company not found.');
+            response.company = this.toCompanyInfo(company);
             if (branchId) {
                 const branch = await this.getBranchById(branchId);
-                if (!branch) {
-                    throw new UnauthorizedException(`Branch with ID ${branchId} not found. Please select a valid branch.`);
-                }
-                response.branch = {
-                    id: branch.id,
-                    name: branch.name,
-                    slug: branch.slug,
-                    logoId: branch.logoId ?? null
-                };
+                if (!branch) throw new UnauthorizedException('Branch not found.');
+                response.branch = this.toBranchInfo(branch);
             }
         }
         return response;
     }
     // Helper Methods
     ensureCompanyFeatureEnabled() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) {
+        if (!this.isCompanyFeatureEnabled()) {
             throw new BadRequestException('Company feature is not enabled');
         }
     }
@@ -663,11 +635,7 @@ export class AuthenticationService {
                 email
             }
         });
-        if (!user) {
-            throw new UnauthorizedException('Invalid credentials');
-        }
-        const isPasswordValid = await bcrypt.compare(password, user.password || '');
-        if (!isPasswordValid) {
+        if (!user || !await bcrypt.compare(password, user.password || '')) {
             throw new UnauthorizedException('Invalid credentials');
         }
         user.lastLoginAt = new Date();
@@ -675,82 +643,77 @@ export class AuthenticationService {
         return user;
     }
     // Response Generators
-    generateLoginResponse(user, companyFeatureEnabled = false) {
-        const payload = {
+    /** Create user info object */ toUserInfo(user) {
+        return {
             id: user.id,
             email: user.email,
-            type: 'access'
+            name: user.name ?? undefined,
+            phone: user.phone ?? null,
+            profilePictureId: user.profilePictureId ?? null
         };
-        const accessToken = this.jwtService.sign(payload, {
+    }
+    /** Create company info object */ toCompanyInfo(company) {
+        return {
+            id: company.id,
+            name: company.name,
+            slug: company.slug,
+            logoId: company.logoId ?? null
+        };
+    }
+    /** Create branch info object */ toBranchInfo(branch) {
+        return {
+            id: branch.id,
+            name: branch.name,
+            slug: branch.slug,
+            logoId: branch.logoId ?? null
+        };
+    }
+    /** Generate JWT tokens */ generateTokens(payload) {
+        const accessToken = this.jwtService.sign({
+            ...payload,
+            type: 'access'
+        }, {
             secret: this.authConfig.getJwtSecret(),
             expiresIn: this.authConfig.getJwtExpiration()
         });
-        const refreshPayload = {
-            id: user.id,
-            email: user.email,
+        const refreshToken = this.jwtService.sign({
+            ...payload,
             type: 'refresh'
-        };
-        const refreshToken = this.jwtService.sign(refreshPayload, {
+        }, {
             secret: this.authConfig.getRefreshTokenSecret(),
             expiresIn: this.authConfig.getRefreshTokenExpiration()
         });
         return {
             accessToken,
-            refreshToken,
-            user: {
-                id: user.id,
-                email: user.email,
-                name: user.name ?? undefined,
-                profilePictureId: user.profilePictureId ?? null
-            },
-            companyFeatureEnabled
+            refreshToken
         };
     }
-    generateLoginResponseWithCompany(user, company, branch) {
-        const payload = {
+    generateLoginResponse(user) {
+        const { accessToken, refreshToken } = this.generateTokens({
             id: user.id,
             email: user.email,
-            type: 'access',
-            companyId: company.id,
-            branchId: branch?.id
-        };
-        const accessToken = this.jwtService.sign(payload, {
-            secret: this.authConfig.getJwtSecret(),
-            expiresIn: this.authConfig.getJwtExpiration()
+            type: 'access'
         });
-        const refreshPayload = {
+        return {
+            accessToken,
+            refreshToken,
+            user: this.toUserInfo(user)
+        };
+    }
+    generateLoginResponseWithCompany(user, company, branch) {
+        const { accessToken, refreshToken } = this.generateTokens({
             id: user.id,
             email: user.email,
-            type: 'refresh',
+            type: 'access',
             companyId: company.id,
             branchId: branch?.id
-        };
-        const refreshToken = this.jwtService.sign(refreshPayload, {
-            secret: this.authConfig.getRefreshTokenSecret(),
-            expiresIn: this.authConfig.getRefreshTokenExpiration()
         });
         return {
             accessToken,
             refreshToken,
-            user: {
-                id: user.id,
-                email: user.email,
-                name: user.name ?? undefined,
-                profilePictureId: user.profilePictureId ?? null
-            },
-            company: {
-                id: company.id,
-                name: company.name,
-                slug: company.slug,
-                logoId: company.logoId ?? null
-            },
-            branch: branch ? {
-                id: branch.id,
-                name: branch.name,
-                slug: branch.slug,
-                logoId: branch.logoId ?? null
-            } : undefined,
-            companyFeatureEnabled: true
+            user: this.toUserInfo(user),
+            company: this.toCompanyInfo(company),
+            branch: branch ? this.toBranchInfo(branch) : undefined
         };
     }
     async generateCompanySelectionResponse(user, companies, branches) {
@@ -758,55 +721,49 @@ export class AuthenticationService {
             throw new BadRequestException('Session service not available');
         }
         const sessionId = await this.sessionService.createSession(user.id);
-        // Build companies with their branches
         const companiesWithBranches = companies.map((company)=>({
-                id: company.id,
-                name: company.name,
-                slug: company.slug,
+                ...this.toCompanyInfo(company),
                 isActive: company.isActive,
-                logoId: company.logoId ?? null,
                 branches: branches.filter((b)=>b.companyId === company.id).map((b)=>({
-                        id: b.id,
-                        name: b.name,
-                        slug: b.slug,
-                        isActive: b.isActive,
-                        logoId: b.logoId ?? null
+                        ...this.toBranchInfo(b),
+                        isActive: b.isActive
                     }))
             }));
         return {
             requiresSelection: true,
             sessionId,
             expiresAt: new Date(Date.now() + 5 * 60 * 1000),
-            user: {
-                id: user.id,
-                email: user.email,
-                name: user.name ?? undefined,
-                profilePictureId: user.profilePictureId ?? null
-            },
+            user: this.toUserInfo(user),
             companies: companiesWithBranches
         };
     }
+    generateRegistrationResponse(user) {
+        return {
+            ...this.generateLoginResponse(user),
+            requiresEmailVerification: false
+        };
+    }
+    generateRegistrationResponseWithCompany(user, company, branch) {
+        return {
+            ...this.generateLoginResponseWithCompany(user, company, branch),
+            requiresEmailVerification: false
+        };
+    }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, injectedUserRepository, injectedPermissionRepository, injectedCompanyRepository, injectedBranchRepository){
+    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService){
         _define_property(this, "jwtService", void 0);
         _define_property(this, "authConfig", void 0);
         _define_property(this, "cacheManager", void 0);
         _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "sessionService", void 0);
-        _define_property(this, "injectedUserRepository", void 0);
-        _define_property(this, "injectedPermissionRepository", void 0);
-        _define_property(this, "injectedCompanyRepository", void 0);
-        _define_property(this, "injectedBranchRepository", void 0);
+        _define_property(this, "authEmailService", void 0);
         _define_property(this, "logger", void 0);
         this.jwtService = jwtService;
         this.authConfig = authConfig;
         this.cacheManager = cacheManager;
         this.dataSourceProvider = dataSourceProvider;
         this.sessionService = sessionService;
-        this.injectedUserRepository = injectedUserRepository;
-        this.injectedPermissionRepository = injectedPermissionRepository;
-        this.injectedCompanyRepository = injectedCompanyRepository;
-        this.injectedBranchRepository = injectedBranchRepository;
+        this.authEmailService = authEmailService;
         this.logger = new Logger(AuthenticationService.name);
     }
 }
@@ -823,13 +780,7 @@ AuthenticationService = _ts_decorate([
     _ts_param(4, Optional()),
     _ts_param(4, Inject(CompanySelectionSessionService)),
     _ts_param(5, Optional()),
-    _ts_param(5, InjectRepository(User)),
-    _ts_param(6, Optional()),
-    _ts_param(6, InjectRepository(UserCompanyPermission)),
-    _ts_param(7, Optional()),
-    _ts_param(7, InjectRepository(Company)),
-    _ts_param(8, Optional()),
-    _ts_param(8, InjectRepository(CompanyBranch)),
+    _ts_param(5, Inject(AuthEmailService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof JwtService === "undefined" ? Object : JwtService,
@@ -837,9 +788,6 @@ AuthenticationService = _ts_decorate([
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
         typeof CompanySelectionSessionService === "undefined" ? Object : CompanySelectionSessionService,
-        typeof Repository === "undefined" ? Object : Repository,
-        typeof Repository === "undefined" ? Object : Repository,
-        typeof Repository === "undefined" ? Object : Repository,
-        typeof Repository === "undefined" ? Object : Repository
+        typeof AuthEmailService === "undefined" ? Object : AuthEmailService
     ])
 ], AuthenticationService);