@flusys/nestjs-auth 1.0.0-beta → 1.0.0

package/fesm/services/branch.service.js

@@ -27,6 +27,7 @@ function _ts_param(paramIndex, decorator) {
 }
 import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { applyCompanyFilter } from '@flusys/nestjs-shared/utils';
 import { Inject, Injectable, Scope } from '@nestjs/common';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { AuthConfigService } from './auth-config.service';
@@ -66,10 +67,14 @@ export class BranchService extends RequestScopedApiService {
     }
     async getExtraManipulateQuery(query, filterDto, user) {
         const result = await super.getExtraManipulateQuery(query, filterDto, user);
-        if (this.authConfig.isCompanyFeatureEnabled() && user?.companyId) {
-            query.andWhere('company_branch.company_id = :companyId', {
-                companyId: user.companyId
-            });
+        // Only apply company filter if companyId is NOT explicitly provided in filter
+        // This prevents dual filtering when user selects a specific company
+        if (!filterDto?.filter?.companyId) {
+            applyCompanyFilter(query, {
+                isCompanyFeatureEnabled: this.authConfig.isCompanyFeatureEnabled(),
+                entityAlias: 'company_branch',
+                columnName: 'company_id'
+            }, user);
         }
         return result;
     }

package/fesm/services/company-selection-session.service.js

@@ -33,7 +33,7 @@ const SESSION_TTL_MS = 5 * 60 * 1000; // 5 minutes
 export class CompanySelectionSessionService {
     /**
    * Create a new session for company/branch selection
-   */ async createSession(userId, companyId) {
+   */ async createSession(userId) {
         const sessionId = randomUUID();
         const now = new Date();
         const expiresAt = new Date(now.getTime() + SESSION_TTL_MS);

package/fesm/services/index.js

@@ -1,4 +1,5 @@
 export * from './authentication.service';
+export * from './auth-email.service';
 export * from './company-selection-session.service';
 export * from './user.service';
 export * from './company.service';

package/fesm/services/user-permission.service.js

@@ -25,126 +25,96 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { BadRequestException, Inject, Injectable, Logger, NotFoundException, Scope } from '@nestjs/common';
+import { ConflictException, Inject, Injectable, NotFoundException, Scope } from '@nestjs/common';
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class UserPermissionService {
-    /** Get repository lazily - initialized on first access */ async getRepository() {
+    async getRepository() {
         if (!this._repository) {
             this._repository = await this.dataSourceProvider.getRepository(UserCompanyPermission);
         }
         return this._repository;
     }
-    // Company Permissions
-    /** Find all companies a user has access to */ async findUserCompanies(userId) {
+    // Generic Permission Operations
+    /** Find all permissions of a specific type for a user */ async findUserPermissions(userId, type) {
         const repository = await this.getRepository();
         return repository.find({
             where: {
                 userId,
-                permissionType: PermissionType.COMPANY
+                permissionType: type
             },
             relations: [
-                'company'
+                type === PermissionType.COMPANY ? 'company' : 'branch'
             ],
             order: {
                 createdAt: 'DESC'
             }
         });
     }
-    /** Assign user to a company */ async assignUserToCompany(dto) {
+    /** Assign permission to user */ async assignPermission(userId, targetId, type, metadata) {
         const repository = await this.getRepository();
-        // Check if already exists
+        const typeName = type === PermissionType.COMPANY ? 'company' : 'branch';
         const existing = await repository.findOne({
             where: {
-                userId: dto.userId,
-                targetId: dto.companyId,
-                permissionType: PermissionType.COMPANY
+                userId,
+                targetId,
+                permissionType: type
             }
         });
         if (existing) {
-            throw new BadRequestException('User already assigned to this company');
+            throw new ConflictException(`User already assigned to this ${typeName}`);
         }
-        const permission = repository.create({
-            userId: dto.userId,
-            permissionType: PermissionType.COMPANY,
-            targetId: dto.companyId,
-            metadata: dto.metadata
-        });
-        await repository.save(permission);
-    }
-    /** Revoke user access to a company */ async revokeCompanyAccess(userId, companyId) {
-        const repository = await this.getRepository();
-        const permission = await repository.findOne({
-            where: {
+        try {
+            await repository.save(repository.create({
                 userId,
-                targetId: companyId,
-                permissionType: PermissionType.COMPANY
+                permissionType: type,
+                targetId,
+                metadata
+            }));
+        } catch (error) {
+            if (error?.code === 'ER_DUP_ENTRY' || error?.message?.includes('Duplicate entry')) {
+                throw new ConflictException(`User already assigned to this ${typeName}. Please refresh and try again.`);
             }
-        });
-        if (!permission) {
-            throw new NotFoundException('Company permission not found');
+            throw error;
         }
-        await repository.remove(permission);
     }
-    // Branch Permissions
-    /** Find all branches a user has access to */ async findUserBranches(userId) {
-        const repository = await this.getRepository();
-        return repository.find({
-            where: {
-                userId,
-                permissionType: PermissionType.BRANCH
-            },
-            relations: [
-                'branch'
-            ],
-            order: {
-                createdAt: 'DESC'
-            }
-        });
-    }
-    /** Assign user to a branch */ async assignUserToBranch(dto) {
-        const repository = await this.getRepository();
-        // Check if already exists
-        const existing = await repository.findOne({
-            where: {
-                userId: dto.userId,
-                targetId: dto.branchId,
-                permissionType: PermissionType.BRANCH
-            }
-        });
-        if (existing) {
-            throw new BadRequestException('User already assigned to this branch');
-        }
-        const permission = repository.create({
-            userId: dto.userId,
-            permissionType: PermissionType.BRANCH,
-            targetId: dto.branchId,
-            metadata: dto.metadata
-        });
-        await repository.save(permission);
-    }
-    /** Revoke user access to a branch */ async revokeBranchAccess(userId, branchId) {
+    /** Revoke permission from user */ async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
+        const typeName = type === PermissionType.COMPANY ? 'company' : 'branch';
         const permission = await repository.findOne({
             where: {
                 userId,
-                targetId: branchId,
-                permissionType: PermissionType.BRANCH
+                targetId,
+                permissionType: type
             }
         });
         if (!permission) {
-            throw new NotFoundException('Branch permission not found');
+            throw new NotFoundException(`${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`);
         }
         await repository.remove(permission);
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
+    /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
+        const repository = await this.getRepository();
+        const queryBuilder = repository.createQueryBuilder('permission').leftJoinAndSelect('permission.branch', 'branch').where('permission.userId = :userId', {
+            userId
+        }).andWhere('permission.permissionType = :type', {
+            type: PermissionType.BRANCH
+        }).orderBy('permission.createdAt', 'DESC');
+        if (companyId) {
+            queryBuilder.andWhere('branch.companyId = :companyId', {
+                companyId
+            });
+        }
+        return queryBuilder.getMany();
+    }
     constructor(dataSourceProvider){
         _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "logger", void 0);
         _define_property(this, "_repository", void 0);
+        // Convenience Methods
+        _define_property(this, "findUserCompanies", void 0);
         this.dataSourceProvider = dataSourceProvider;
-        this.logger = new Logger(UserPermissionService.name);
         this._repository = null;
+        this.findUserCompanies = (userId)=>this.findUserPermissions(userId, PermissionType.COMPANY);
     }
 }
 UserPermissionService = _ts_decorate([

package/fesm/services/user.service.js

@@ -28,12 +28,13 @@ function _ts_param(paramIndex, decorator) {
 import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { ErrorHandler } from '@flusys/nestjs-shared/utils';
-import { BadRequestException, Inject, Injectable, NotFoundException, Scope } from '@nestjs/common';
+import { BadRequestException, ForbiddenException, Inject, Injectable, NotFoundException, Optional, Scope } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
-import { BCRYPT_SALT_ROUNDS } from '../config';
+import { BCRYPT_SALT_ROUNDS, USER_ENRICHER } from '../config';
 import { PermissionType } from '../enums';
+import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { User } from '../entities/user.entity';
 export class UserService extends RequestScopedApiService {
@@ -58,6 +59,24 @@ export class UserService extends RequestScopedApiService {
         }
     }
     // Custom Methods
+    /**
+   * Validate profile ownership, ensure repository initialized, and fetch user.
+   * Throws ForbiddenException if not owner, NotFoundException if user not found.
+   */ async getUserForProfile(userId, user) {
+        if (userId !== user.id) {
+            throw new ForbiddenException('Cannot access another user\'s profile');
+        }
+        await this.ensureRepositoryInitialized();
+        const userEntity = await this.repository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!userEntity) {
+            throw new NotFoundException('User not found');
+        }
+        return userEntity;
+    }
     /** Verify email */ async verifyEmail(id) {
         // Ensure repository is initialized for custom method
         await this.ensureRepositoryInitialized();
@@ -119,33 +138,58 @@ export class UserService extends RequestScopedApiService {
     /** Convert DTO to entity (hash password before saving) */ async convertSingleDtoToEntity(dto, user) {
         // Repository initialization is handled automatically by RequestScopedApiService
         const entity = await super.convertSingleDtoToEntity(dto, user);
-        // Hash password if provided
-        if (dto.password) {
+        // Hash password if provided (CreateUserDto has password field)
+        if ('password' in dto && dto.password) {
             entity.password = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
         }
         return entity;
     }
     /** Convert entity to response DTO (removes password). In raw mode with company feature, isActive comes from permission table. */ convertEntityToResponseDto(entity, isRaw) {
+        if (isRaw) {
+            return this.convertRawToResponseDto(entity);
+        }
+        return this.convertEntityToDto(entity);
+    }
+    /** Convert raw query result to response DTO */ convertRawToResponseDto(raw) {
         // When raw mode is used with company feature, isActive comes from computed field
-        // Raw mode uses snake_case column names (due to SnakeNamingStrategy)
-        const isActive = isRaw && entity.user_companyIsActive !== undefined ? Boolean(entity.user_companyIsActive) : isRaw ? entity.user_is_active : entity.isActive;
+        const isActive = raw.user_companyIsActive !== undefined ? Boolean(raw.user_companyIsActive) : raw.user_is_active;
         return {
-            id: isRaw ? entity.user_id : entity.id,
-            name: isRaw ? entity.user_name : entity.name,
-            phone: isRaw ? entity.user_phone : entity.phone,
-            email: isRaw ? entity.user_email : entity.email,
-            profilePictureId: isRaw ? entity.user_profile_picture_id : entity.profilePictureId,
+            id: raw.user_id,
+            name: raw.user_name,
+            phone: raw.user_phone,
+            email: raw.user_email,
+            profilePictureId: raw.user_profile_picture_id,
             isActive,
-            emailVerified: isRaw ? entity.user_email_verified : entity.emailVerified,
-            phoneVerified: isRaw ? entity.user_phone_verified : entity.phoneVerified,
-            lastLoginAt: isRaw ? entity.user_last_login_at : entity.lastLoginAt,
-            additionalFields: isRaw ? entity.user_additional_fields : entity.additionalFields,
-            createdAt: isRaw ? entity.user_created_at : entity.createdAt,
-            updatedAt: isRaw ? entity.user_updated_at : entity.updatedAt,
-            deletedAt: isRaw ? entity.user_deleted_at : entity.deletedAt,
-            createdById: isRaw ? entity.user_created_by_id : entity.createdById,
-            updatedById: isRaw ? entity.user_updated_by_id : entity.updatedById,
-            deletedById: isRaw ? entity.user_deleted_by_id : entity.deletedById
+            emailVerified: raw.user_email_verified,
+            phoneVerified: raw.user_phone_verified,
+            lastLoginAt: raw.user_last_login_at,
+            additionalFields: raw.user_additional_fields,
+            createdAt: raw.user_created_at,
+            updatedAt: raw.user_updated_at,
+            deletedAt: raw.user_deleted_at,
+            createdById: raw.user_created_by_id,
+            updatedById: raw.user_updated_by_id,
+            deletedById: raw.user_deleted_by_id
+        };
+    }
+    /** Convert entity to response DTO */ convertEntityToDto(entity) {
+        return {
+            id: entity.id,
+            name: entity.name,
+            phone: entity.phone,
+            email: entity.email,
+            profilePictureId: entity.profilePictureId,
+            isActive: entity.isActive,
+            emailVerified: entity.emailVerified,
+            phoneVerified: entity.phoneVerified,
+            lastLoginAt: entity.lastLoginAt,
+            additionalFields: entity.additionalFields,
+            createdAt: entity.createdAt,
+            updatedAt: entity.updatedAt,
+            deletedAt: entity.deletedAt,
+            createdById: entity.createdById,
+            updatedById: entity.updatedById,
+            deletedById: entity.deletedById
         };
     }
     /** Convert entity list to response DTO list */ convertEntityListToResponseListDto(entities, isRaw) {
@@ -162,7 +206,11 @@ export class UserService extends RequestScopedApiService {
     }
     /** Add company permission-based isActive check when company feature enabled. Returns isRaw: true for computed fields. */ async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
         // Repository initialization is handled automatically by RequestScopedApiService
-        const result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
+        let result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
+        // Apply user enricher query modifications if available
+        if (this.userEnricher?.enrichListQuery) {
+            await this.userEnricher.enrichListQuery(query, user);
+        }
         // Only apply company filtering if:
         // 1. Company feature is enabled at bootstrap
         // 2. User has company context
@@ -282,16 +330,105 @@ export class UserService extends RequestScopedApiService {
             await queryRunner.release();
         }
     }
-    /** Update user profile with password handling */ async profile(dto, user) {
-        // Repository initialization is handled automatically by RequestScopedApiService
+    /**
+   * Get user profile with extras from enricher
+   * Returns base user data plus any extra data provided by enricher (roles, permissions, etc.)
+   */ async getProfileWithExtras(userId, user) {
+        const userEntity = await this.getUserForProfile(userId, user);
+        const userData = this.convertEntityToResponseDto(userEntity, false);
+        // Get extras from enricher if available
+        let extras;
+        if (this.userEnricher?.getProfileExtras) {
+            extras = await this.userEnricher.getProfileExtras(userId, user);
+        }
+        return {
+            user: userData,
+            extras
+        };
+    }
+    /**
+   * Get enriched user list
+   * Applies enricher transformations after query execution
+   */ async getEnrichedList(users, user) {
+        if (this.userEnricher?.enrichListItems) {
+            return this.userEnricher.enrichListItems(users, user);
+        }
+        return users;
+    }
+    // ============================================
+    // Multi-Step Profile Methods (via Enricher)
+    // ============================================
+    /**
+   * Get profile section definitions from enricher
+   */ async getProfileSections() {
+        if (this.userEnricher?.getProfileSections) {
+            return this.userEnricher.getProfileSections();
+        }
+        return [];
+    }
+    /**
+   * Get specific profile section data
+   */ async getProfileSectionData(userId, sectionId, user) {
+        await this.getUserForProfile(userId, user);
+        if (this.userEnricher?.getProfileSectionData) {
+            return this.userEnricher.getProfileSectionData(userId, sectionId, user);
+        }
+        return null;
+    }
+    /**
+   * Update specific profile section
+   */ async updateProfileSection(userId, sectionId, data, user) {
+        const userEntity = await this.getUserForProfile(userId, user);
         if (!this.dataSource) {
             throw new BadRequestException('DataSource not available');
         }
+        if (!this.userEnricher?.updateProfileSection) {
+            throw new BadRequestException('Profile sections not supported');
+        }
+        const queryRunner = this.dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            await this.userEnricher.updateProfileSection(userId, sectionId, data, queryRunner);
+            await queryRunner.commitTransaction();
+            await this.clearCacheForId([
+                userEntity
+            ]);
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            ErrorHandler.logError(this.logger, error, 'updateProfileSection', {
+                entity: this.entityName,
+                sectionId
+            });
+            ErrorHandler.rethrowError(error);
+        } finally{
+            await queryRunner.release();
+        }
+    }
+    /**
+   * Get profile completion percentage
+   */ async getProfileCompletion(userId, user) {
+        await this.getUserForProfile(userId, user);
+        if (this.userEnricher?.calculateProfileCompletion) {
+            return this.userEnricher.calculateProfileCompletion(userId, user);
+        }
+        return 100; // Default to 100% if no enricher
+    }
+    /** Update user profile with password handling and extras */ async profile(dto, user) {
+        // Ensure repository and dataSource are initialized
+        await this.ensureRepositoryInitialized();
+        if (!this.dataSource) {
+            throw new BadRequestException('DataSource not available');
+        }
+        const userId = dto.id ?? user.id;
+        // Validate extras if enricher provides validation
+        if (dto.extras && this.userEnricher?.validateProfileExtras) {
+            await this.userEnricher.validateProfileExtras(userId, dto.extras, user);
+        }
         const queryRunner = this.dataSource.createQueryRunner();
         await queryRunner.connect();
         await queryRunner.startTransaction();
         try {
-            const userId = dto.id ?? user.id;
             const findUser = await queryRunner.manager.findOne(this.repository.target, {
                 where: {
                     id: userId
@@ -302,18 +439,28 @@ export class UserService extends RequestScopedApiService {
             }
             // Handle password update
             if (dto.password) {
-                // If updating own profile, require old password
-                if (!dto.id || dto.id === user.id) {
-                // This would need oldPassword in DTO - for now, skip if not provided
-                // In real implementation, add oldPassword to UpdateUserDto
+                // If updating own profile, require old password verification
+                const isOwnProfile = !dto.id || dto.id === user.id;
+                if (isOwnProfile) {
+                    if (!dto.oldPassword) {
+                        throw new BadRequestException('Current password is required to change your password');
+                    }
+                    const isPasswordValid = await bcrypt.compare(dto.oldPassword, findUser.password);
+                    if (!isPasswordValid) {
+                        throw new BadRequestException('Current password is incorrect');
+                    }
                 }
-                const salt = await bcrypt.genSalt();
-                findUser.password = await bcrypt.hash(dto.password, salt);
+                findUser.password = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
             }
-            // Merge other fields (excluding password)
-            const { password, ...restDto } = dto;
+            // Merge other fields (excluding password, oldPassword, extras, and sensitive flags)
+            // Users cannot self-modify emailVerified, phoneVerified, or isActive via profile update
+            const { password, oldPassword, extras, emailVerified, phoneVerified, isActive, ...restDto } = dto;
             Object.assign(findUser, restDto);
             await queryRunner.manager.save(this.repository.target, findUser);
+            // Handle extras update via enricher
+            if (extras && this.userEnricher?.updateProfileExtras) {
+                await this.userEnricher.updateProfileExtras(userId, extras, queryRunner);
+            }
             await queryRunner.commitTransaction();
             await this.clearCacheForId([
                 findUser
@@ -329,8 +476,8 @@ export class UserService extends RequestScopedApiService {
             await queryRunner.release();
         }
     }
-    constructor(cacheManager, utilsService, dataSourceProvider, authConfig){
-        super('user', null, cacheManager, utilsService, UserService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig;
+    constructor(cacheManager, utilsService, dataSourceProvider, authConfig, userEnricher){
+        super('user', null, cacheManager, utilsService, UserService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher;
     }
 }
 UserService = _ts_decorate([
@@ -341,11 +488,14 @@ UserService = _ts_decorate([
     _ts_param(1, Inject(UtilsService)),
     _ts_param(2, Inject(AuthDataSourceProvider)),
     _ts_param(3, Inject(AuthConfigService)),
+    _ts_param(4, Optional()),
+    _ts_param(4, Inject(USER_ENRICHER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof UtilsService === "undefined" ? Object : UtilsService,
         typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
-        typeof AuthConfigService === "undefined" ? Object : AuthConfigService
+        typeof AuthConfigService === "undefined" ? Object : AuthConfigService,
+        typeof IUserEnricher === "undefined" ? Object : IUserEnricher
     ])
 ], UserService);

package/fesm/strategies/jwt.strategy.js

@@ -24,75 +24,75 @@ import { Injectable, UnauthorizedException } from '@nestjs/common';
 import { ModuleRef } from '@nestjs/core';
 import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
+import { User } from '../entities/user.entity';
 import { AuthConfigService } from '../services/auth-config.service';
 import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
 import { AuthenticationService } from '../services/authentication.service';
-import { User } from '../entities/user.entity';
-/**
- * Type guard to check if payload includes company context
- */ function isTokenPayloadWithCompany(payload) {
+function hasCompanyContext(payload) {
     return 'companyId' in payload && 'branchId' in payload;
 }
 export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
     async validate(_req, payload) {
-        // Resolve request-scoped services for this request
-        let userRepository = null;
-        let authService = null;
+        const userRepo = await this.resolveUserRepository();
+        await this.checkTokenRevocation(payload);
+        const user = await userRepo.findOne({
+            where: {
+                id: payload.id,
+                isActive: true
+            }
+        });
+        if (!user) {
+            throw new UnauthorizedException('User not found or inactive');
+        }
+        return this.buildUserInfo(payload);
+    }
+    async resolveUserRepository() {
         try {
-            const dataSourceProvider = await this.moduleRef.resolve(AuthDataSourceProvider, undefined, {
+            const provider = await this.moduleRef.resolve(AuthDataSourceProvider, undefined, {
                 strict: false
             });
-            if (dataSourceProvider) {
-                userRepository = await dataSourceProvider.getRepository(User);
+            if (provider) {
+                return provider.getRepository(User);
             }
-            // Resolve AuthenticationService for token revocation check
-            authService = await this.moduleRef.resolve(AuthenticationService, undefined, {
-                strict: false
-            });
-        } catch (error) {
+        } catch  {
             throw new UnauthorizedException('Unable to access user data');
         }
-        if (!userRepository) {
-            throw new UnauthorizedException('User repository not available');
-        }
-        // Check if token is revoked (logged out)
-        if (authService && payload.iat) {
-            const isRevoked = await authService.isTokenRevoked(payload.id, payload.iat);
-            if (isRevoked) {
+        throw new UnauthorizedException('User repository not available');
+    }
+    async checkTokenRevocation(payload) {
+        if (!payload.iat) return;
+        try {
+            const authService = await this.moduleRef.resolve(AuthenticationService, undefined, {
+                strict: false
+            });
+            if (authService && await authService.isTokenRevoked(payload.id, payload.iat)) {
                 throw new UnauthorizedException('Token has been revoked');
             }
+        } catch (err) {
+            if (err instanceof UnauthorizedException) throw err;
         }
-        // Find user and check if active
-        const user = await userRepository.findOne({
-            where: {
-                id: payload.id,
-                isActive: true
-            }
-        });
-        if (!user) {
-            throw new UnauthorizedException('User not found or inactive');
-        }
-        const result = {
+    }
+    buildUserInfo(payload) {
+        const base = {
             id: payload.id,
             email: payload.email
         };
-        // Company context - use type guard for type safety
-        if (isTokenPayloadWithCompany(payload)) {
-            result.companyId = payload.companyId;
-            // Only set branchId if it's not empty string
-            if (payload.branchId) {
-                result.branchId = payload.branchId;
-            }
+        if (!hasCompanyContext(payload)) {
+            return base;
         }
-        return result;
+        return {
+            ...base,
+            companyId: payload.companyId,
+            ...payload.branchId && {
+                branchId: payload.branchId
+            }
+        };
     }
     constructor(authConfig, moduleRef){
         super({
             jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
             ignoreExpiration: false,
-            // Use secretOrKeyProvider instead of secretOrKey to defer secret lookup
-            // This ensures AuthConfigService is fully initialized when using forRootAsync
-            secretOrKeyProvider: (_request, _rawJwtToken, done)=>{
+            secretOrKeyProvider: (_req, _token, done)=>{
                 done(null, this.authConfig.getJwtSecret());
             },
             passReqToCallback: true