@flusys/nestjs-auth 1.0.0-beta → 1.0.0

package/cjs/config/auth.constants.js

@@ -16,14 +16,26 @@ _export(exports, {
     get BCRYPT_SALT_ROUNDS () {
         return BCRYPT_SALT_ROUNDS;
     },
+    get DEFAULT_COOKIE_NAME () {
+        return DEFAULT_COOKIE_NAME;
+    },
+    get MAX_COOKIE_BYTES () {
+        return MAX_COOKIE_BYTES;
+    },
     get SESSION_CACHE_PREFIX () {
         return SESSION_CACHE_PREFIX;
     },
     get TOKEN_REVOKED_PREFIX () {
         return TOKEN_REVOKED_PREFIX;
+    },
+    get USER_ENRICHER () {
+        return USER_ENRICHER;
     }
 });
 const AUTH_MODULE_OPTIONS = 'AUTH_MODULE_OPTIONS';
+const USER_ENRICHER = 'USER_ENRICHER';
 const BCRYPT_SALT_ROUNDS = 12;
+const DEFAULT_COOKIE_NAME = 'fsn_refresh_token';
+const MAX_COOKIE_BYTES = 3500;
 const SESSION_CACHE_PREFIX = 'auth:session';
 const TOKEN_REVOKED_PREFIX = 'auth:revoked';

package/cjs/controllers/authentication.controller.js

@@ -9,15 +9,19 @@ Object.defineProperty(exports, "AuthenticationController", {
     }
 });
 const _decorators = require("@flusys/nestjs-shared/decorators");
+const _dtos = require("@flusys/nestjs-shared/dtos");
 const _guards = require("@flusys/nestjs-shared/guards");
 const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
+const _throttler = require("@nestjs/throttler");
 const _express = require("express");
+const _config = require("../config");
 const _authenticationdto = require("../dtos/authentication.dto");
 const _cleartokeninterceptor = require("../interceptors/clear-token.interceptor");
 const _settokeninterceptor = require("../interceptors/set-token.interceptor");
 const _authconfigservice = require("../services/auth-config.service");
+const _authemailservice = require("../services/auth-email.service");
 const _authenticationservice = require("../services/authentication.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -47,24 +51,41 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthenticationController = class AuthenticationController {
-    // Core Endpoints
-    /** Login - Returns tokens or company/branch selection requirement */ async login(loginDto) {
+    buildAuthUrl(req, path) {
+        const frontendUrl = this.authConfig?.getFrontendUrl();
+        return frontendUrl ? `${frontendUrl}${path}` : `${req.protocol}://${req.get('host')}${path}`;
+    }
+    get emailService() {
+        if (!this.authEmailService) {
+            throw new Error('Email service is not configured');
+        }
+        return this.authEmailService;
+    }
+    get isEmailEnabled() {
+        return !!this.authEmailService;
+    }
+    async login(loginDto) {
         const result = await this.authService.login(loginDto.email, loginDto.password);
+        if ('requiresEmailVerification' in result) {
+            return result;
+        }
         if ('requiresSelection' in result) {
             return result;
         }
         return result;
     }
-    /** Register new user. If company feature enabled, can join/create company. */ async register(registrationDto) {
-        const result = await this.authService.register(registrationDto);
-        return {
-            ...result,
-            companyFeatureEnabled: this.authConfig?.isCompanyFeatureEnabled() ?? false
-        };
+    /** Register new user. If company feature enabled, can join/create company. */ async register(req, registrationDto) {
+        const verifyUrlBase = this.buildAuthUrl(req, '/auth/verify-email');
+        const result = await this.authService.register(registrationDto, verifyUrlBase);
+        return result;
     }
-    /** Refresh access token. Browser uses HTTP-only cookie, API/Mobile uses request body. */ async refreshToken(req, refreshTokenDto) {
-        // Get refresh token from cookie (browser) or body (API/mobile)
-        const cookieName = this.authConfig?.getRefreshTokenCookieName() ?? 'fsn_refresh_token';
+    /**
+   * Refresh access token.
+   * - **Browser**: Prefers HTTP-only cookie, falls back to body if cookie missing.
+   * - **API/Mobile**: Must send `refreshToken` in request body. Set header `x-client-type: mobile` or `x-client-type: api`.
+   */ async refreshToken(req, refreshTokenDto) {
+        const cookieName = this.authConfig?.getRefreshTokenCookieName() ?? _config.DEFAULT_COOKIE_NAME;
+        // Always check cookie first, then body - handles Browser, SSR, and Mobile/API
         const refreshToken = req.cookies?.[cookieName] || refreshTokenDto.refreshToken;
         if (!refreshToken) {
             throw new _common.UnauthorizedException('Refresh token is required');
@@ -77,26 +98,78 @@ let AuthenticationController = class AuthenticationController {
     /** Logout - Clears refresh token cookie for browsers */ async logout(userId) {
         await this.authService.logout(userId);
         return {
+            success: true,
             message: 'Logged out successfully'
         };
     }
-    /** Change password */ async changePassword(userId, dto) {
+    async changePassword(userId, dto) {
         await this.authService.changePassword(userId, dto.currentPassword, dto.newPassword);
         return {
+            success: true,
             message: 'Password changed successfully'
         };
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(authService, authConfig){
+    async forgotPassword(req, dto) {
+        if (!this.isEmailEnabled) {
+            return {
+                success: false,
+                message: 'Email service is not configured'
+            };
+        }
+        return this.emailService.forgotPassword(dto.email, this.buildAuthUrl(req, '/auth/reset-password'));
+    }
+    async resetPassword(dto) {
+        if (!this.isEmailEnabled) {
+            return {
+                success: false,
+                message: 'Email service is not configured'
+            };
+        }
+        return this.emailService.resetPassword(dto.token, dto.newPassword);
+    }
+    async resendVerification(req, dto) {
+        if (!this.isEmailEnabled) {
+            return {
+                success: false,
+                message: 'Email service is not configured'
+            };
+        }
+        return this.emailService.resendVerificationEmail(dto.email, this.buildAuthUrl(req, '/auth/verify-email'));
+    }
+    /** Verify email - Verify email using token. Handles both pending registration and existing user verification. */ async verifyEmail(dto) {
+        if (!this.isEmailEnabled) {
+            return {
+                success: false,
+                message: 'Email service is not configured'
+            };
+        }
+        const result = await this.emailService.verifyEmail(dto.token);
+        if (result.type === 'pending') {
+            return this.authService.createUserFromPendingRegistration(result.pending);
+        }
+        return {
+            success: true,
+            message: result.message
+        };
+    }
+    constructor(authService, authConfig, authEmailService){
         _define_property(this, "authService", void 0);
         _define_property(this, "authConfig", void 0);
+        _define_property(this, "authEmailService", void 0);
         this.authService = authService;
         this.authConfig = authConfig;
+        this.authEmailService = authEmailService;
     }
 };
 _ts_decorate([
     (0, _common.Post)('login'),
     (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 5,
+            ttl: 60000
+        }
+    }),
     (0, _common.UseInterceptors)(_settokeninterceptor.SetToken),
     (0, _swagger.ApiOperation)({
         summary: 'User login'
@@ -104,13 +177,102 @@ _ts_decorate([
     (0, _swagger.ApiBody)({
         type: _authenticationdto.LoginDto
     }),
+    (0, _swagger.ApiExtraModels)(_authenticationdto.LoginResponseDto, _authenticationdto.CompanySelectionResponseDto, _authenticationdto.LoginResponseRequiresEmailVerificationDto),
     (0, _swagger.ApiResponse)({
         status: 200,
-        type: _authenticationdto.LoginResponseDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        type: _authenticationdto.CompanySelectionResponseDto
+        description: 'Login successful, requires company selection, or requires email verification',
+        content: {
+            'application/json': {
+                schema: {
+                    oneOf: [
+                        {
+                            $ref: (0, _swagger.getSchemaPath)(_authenticationdto.LoginResponseDto)
+                        },
+                        {
+                            $ref: (0, _swagger.getSchemaPath)(_authenticationdto.CompanySelectionResponseDto)
+                        },
+                        {
+                            $ref: (0, _swagger.getSchemaPath)(_authenticationdto.LoginResponseRequiresEmailVerificationDto)
+                        }
+                    ]
+                },
+                examples: {
+                    loginSuccess: {
+                        summary: 'Login Success',
+                        description: 'Successful login with tokens (company/branch included when company feature enabled)',
+                        value: {
+                            accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+                            refreshToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+                            user: {
+                                id: '550e8400-e29b-41d4-a716-446655440000',
+                                email: 'john@example.com',
+                                name: 'John Doe'
+                            }
+                        }
+                    },
+                    loginSuccessWithCompany: {
+                        summary: 'Login Success (Company Feature)',
+                        description: 'Login with company/branch - only when company feature is enabled',
+                        value: {
+                            accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+                            refreshToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+                            user: {
+                                id: '550e8400-e29b-41d4-a716-446655440000',
+                                email: 'john@example.com',
+                                name: 'John Doe'
+                            },
+                            company: {
+                                id: '550e8400-e29b-41d4-a716-446655440001',
+                                name: 'Acme Corporation',
+                                slug: 'acme-corp'
+                            },
+                            branch: {
+                                id: '550e8400-e29b-41d4-a716-446655440002',
+                                name: 'Main Branch',
+                                slug: 'main-branch'
+                            }
+                        }
+                    },
+                    companySelection: {
+                        summary: 'Company Selection Required (Company Feature)',
+                        description: 'User has multiple companies/branches - only when company feature is enabled',
+                        value: {
+                            requiresSelection: true,
+                            sessionId: 'sess_abc123def456',
+                            expiresAt: '2024-12-18T15:30:00.000Z',
+                            user: {
+                                id: '550e8400-e29b-41d4-a716-446655440000',
+                                email: 'john@example.com',
+                                name: 'John Doe'
+                            },
+                            companies: [
+                                {
+                                    id: '550e8400-e29b-41d4-a716-446655440001',
+                                    name: 'Company A',
+                                    slug: 'company-a',
+                                    branches: [
+                                        {
+                                            id: '550e8400-e29b-41d4-a716-446655440010',
+                                            name: 'Branch 1',
+                                            slug: 'branch-1'
+                                        }
+                                    ]
+                                }
+                            ]
+                        }
+                    },
+                    emailVerification: {
+                        summary: 'Email Verification Required',
+                        description: 'User must verify email before logging in',
+                        value: {
+                            requiresEmailVerification: true,
+                            email: 'john@example.com',
+                            message: 'Please verify your email address before logging in.'
+                        }
+                    }
+                }
+            }
+        }
     }),
     _ts_param(0, (0, _common.Body)()),
     _ts_metadata("design:type", Function),
@@ -122,6 +284,12 @@ _ts_decorate([
 _ts_decorate([
     (0, _common.Post)('register'),
     (0, _common.HttpCode)(_common.HttpStatus.CREATED),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 3,
+            ttl: 60000
+        }
+    }),
     (0, _common.UseInterceptors)(_settokeninterceptor.SetToken),
     (0, _swagger.ApiOperation)({
         summary: 'Register new user'
@@ -133,9 +301,11 @@ _ts_decorate([
         status: 201,
         type: _authenticationdto.RegistrationResponseDto
     }),
-    _ts_param(0, (0, _common.Body)()),
+    _ts_param(0, (0, _common.Req)()),
+    _ts_param(1, (0, _common.Body)()),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        typeof _express.Request === "undefined" ? Object : _express.Request,
         typeof _authenticationdto.RegistrationDto === "undefined" ? Object : _authenticationdto.RegistrationDto
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -143,11 +313,50 @@ _ts_decorate([
 _ts_decorate([
     (0, _common.Post)('refresh'),
     (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 30,
+            ttl: 60000
+        }
+    }),
     (0, _swagger.ApiOperation)({
-        summary: 'Refresh access token'
+        summary: 'Refresh access token',
+        description: `
+**Browser clients**: Refresh token is read from HTTP-only cookie (automatically set on login/register).
+Falls back to request body if cookie is not available.
+
+**API/Mobile clients**: Must send \`refreshToken\` in request body.
+Set header \`x-client-type: mobile\` or \`x-client-type: api\` to identify as non-browser client.
+
+**Client detection**: Uses \`x-client-type\` header first, then falls back to User-Agent detection.
+    `
+    }),
+    (0, _swagger.ApiHeader)({
+        name: 'x-client-type',
+        required: false,
+        description: 'Client type: "browser"/"web" for cookie-based auth, "mobile"/"api" for body-based auth',
+        example: 'mobile'
     }),
     (0, _swagger.ApiBody)({
-        type: _authenticationdto.RefreshTokenDto
+        type: _authenticationdto.RefreshTokenDto,
+        description: 'Required for API/Mobile clients. Browser clients prefer HTTP-only cookie with body fallback.'
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        description: 'New access token',
+        schema: {
+            type: 'object',
+            properties: {
+                accessToken: {
+                    type: 'string',
+                    example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
+                }
+            }
+        }
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 401,
+        description: 'Invalid or missing refresh token'
     }),
     _ts_param(0, (0, _common.Req)()),
     _ts_param(1, (0, _common.Body)()),
@@ -160,7 +369,8 @@ _ts_decorate([
 ], AuthenticationController.prototype, "refreshToken", null);
 _ts_decorate([
     (0, _common.UseGuards)(_guards.JwtAuthGuard),
-    (0, _common.Get)('me'),
+    (0, _common.Post)('me'),
+    (0, _throttler.SkipThrottle)(),
     (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Get current user info'
@@ -180,11 +390,16 @@ _ts_decorate([
     (0, _common.UseGuards)(_guards.JwtAuthGuard),
     (0, _common.Post)('logout'),
     (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.SkipThrottle)(),
     (0, _common.UseInterceptors)(_cleartokeninterceptor.ClearToken),
     (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Logout user'
     }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
     _ts_param(0, (0, _decorators.CurrentUser)('id')),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
@@ -196,6 +411,12 @@ _ts_decorate([
     (0, _common.UseGuards)(_guards.JwtAuthGuard),
     (0, _common.Post)('change-password'),
     (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 5,
+            ttl: 60000
+        }
+    }),
     (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Change password'
@@ -203,6 +424,10 @@ _ts_decorate([
     (0, _swagger.ApiBody)({
         type: _authenticationdto.ChangePasswordDto
     }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
     _ts_param(0, (0, _decorators.CurrentUser)('id')),
     _ts_param(1, (0, _common.Body)()),
     _ts_metadata("design:type", Function),
@@ -212,15 +437,131 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], AuthenticationController.prototype, "changePassword", null);
+_ts_decorate([
+    (0, _common.Post)('forgot-password'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 3,
+            ttl: 300000
+        }
+    }),
+    (0, _swagger.ApiOperation)({
+        summary: 'Request password reset email'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ForgotPasswordDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Req)()),
+    _ts_param(1, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _express.Request === "undefined" ? Object : _express.Request,
+        typeof _authenticationdto.ForgotPasswordDto === "undefined" ? Object : _authenticationdto.ForgotPasswordDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationController.prototype, "forgotPassword", null);
+_ts_decorate([
+    (0, _common.Post)('reset-password'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 5,
+            ttl: 900000
+        }
+    }),
+    (0, _swagger.ApiOperation)({
+        summary: 'Reset password using token'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ResetPasswordDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationdto.ResetPasswordDto === "undefined" ? Object : _authenticationdto.ResetPasswordDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationController.prototype, "resetPassword", null);
+_ts_decorate([
+    (0, _common.Post)('resend-verification'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 3,
+            ttl: 300000
+        }
+    }),
+    (0, _swagger.ApiOperation)({
+        summary: 'Resend email verification link'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ResendVerificationDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Req)()),
+    _ts_param(1, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _express.Request === "undefined" ? Object : _express.Request,
+        typeof _authenticationdto.ResendVerificationDto === "undefined" ? Object : _authenticationdto.ResendVerificationDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationController.prototype, "resendVerification", null);
+_ts_decorate([
+    (0, _common.Post)('verify-email'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 10,
+            ttl: 60000
+        }
+    }),
+    (0, _common.UseInterceptors)(_settokeninterceptor.SetToken),
+    (0, _swagger.ApiOperation)({
+        summary: 'Verify email using token'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.VerifyEmailDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _authenticationdto.RegistrationResponseDto
+    }),
+    _ts_param(0, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationdto.VerifyEmailDto === "undefined" ? Object : _authenticationdto.VerifyEmailDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationController.prototype, "verifyEmail", null);
 AuthenticationController = _ts_decorate([
     (0, _swagger.ApiTags)('Authentication'),
     (0, _common.Controller)('auth'),
     _ts_param(0, (0, _common.Inject)(_authenticationservice.AuthenticationService)),
     _ts_param(1, (0, _common.Optional)()),
     _ts_param(1, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
+    _ts_param(2, (0, _common.Optional)()),
+    _ts_param(2, (0, _common.Inject)(_authemailservice.AuthEmailService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _authenticationservice.AuthenticationService === "undefined" ? Object : _authenticationservice.AuthenticationService,
-        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService
+        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
+        typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService
     ])
 ], AuthenticationController);

package/cjs/controllers/branch.controller.js

@@ -41,7 +41,50 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let BranchController = class BranchController extends (0, _classes.createApiController)(_companybranchdto.CreateCompanyBranchDto, _companybranchdto.UpdateCompanyBranchDto, _companybranchdto.CompanyBranchResponseDto, {
-    security: 'jwt'
+    security: {
+        insert: {
+            level: 'permission',
+            permissions: [
+                _classes.BRANCH_PERMISSIONS.CREATE
+            ]
+        },
+        insertMany: {
+            level: 'permission',
+            permissions: [
+                _classes.BRANCH_PERMISSIONS.CREATE
+            ]
+        },
+        getById: {
+            level: 'permission',
+            permissions: [
+                _classes.BRANCH_PERMISSIONS.READ
+            ]
+        },
+        getAll: {
+            level: 'permission',
+            permissions: [
+                _classes.BRANCH_PERMISSIONS.READ
+            ]
+        },
+        update: {
+            level: 'permission',
+            permissions: [
+                _classes.BRANCH_PERMISSIONS.UPDATE
+            ]
+        },
+        updateMany: {
+            level: 'permission',
+            permissions: [
+                _classes.BRANCH_PERMISSIONS.UPDATE
+            ]
+        },
+        delete: {
+            level: 'permission',
+            permissions: [
+                _classes.BRANCH_PERMISSIONS.DELETE
+            ]
+        }
+    }
 }) {
     constructor(branchService){
         super(branchService), _define_property(this, "branchService", void 0), this.branchService = branchService;

package/cjs/controllers/company-selection.controller.js

@@ -43,35 +43,28 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let CompanySelectionController = class CompanySelectionController {
-    /**
-   * Select Company & Branch
-   * Used after login when user needs to select company and branch
-   */ async select(dto) {
+    async select(dto) {
         return this.authService.select(dto.sessionId, dto.companyId, dto.branchId);
     }
-    /**
-   * Switch Company/Branch
-   * Used to switch company/branch after already logged in
-   */ async switchCompany(userId, dto) {
+    async switchCompany(userId, dto) {
         return this.authService.switchCompany(userId, dto.companyId, dto.branchId);
     }
-    /**
-   * Get user's companies
-   */ async getUserCompanies(userId) {
+    async getUserCompanies(userId) {
         const companies = await this.authService.getUserCompanies(userId);
         return {
-            companies
+            success: true,
+            message: 'User companies retrieved successfully',
+            data: companies
         };
     }
-    /**
-   * Get branches for a specific company
-   */ async getUserBranches(userId, companyId) {
+    async getUserBranches(userId, companyId) {
         const branches = await this.authService.getUserBranches(userId, companyId);
         return {
-            branches
+            success: true,
+            message: 'Company branches retrieved successfully',
+            data: branches
         };
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(authService){
         _define_property(this, "authService", void 0);
         this.authService = authService;
@@ -127,7 +120,8 @@ _ts_decorate([
 ], CompanySelectionController.prototype, "switchCompany", null);
 _ts_decorate([
     (0, _common.UseGuards)(_guards.JwtAuthGuard),
-    (0, _common.Get)('companies'),
+    (0, _common.Post)('get-companies'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
     (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: "Get user's available companies",
@@ -142,14 +136,27 @@ _ts_decorate([
 ], CompanySelectionController.prototype, "getUserCompanies", null);
 _ts_decorate([
     (0, _common.UseGuards)(_guards.JwtAuthGuard),
-    (0, _common.Get)('companies/:companyId/branches'),
+    (0, _common.Post)('get-company-branches'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
     (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Get branches for a company',
         description: 'Get list of branches for a specific company that the user has access to'
     }),
+    (0, _swagger.ApiBody)({
+        schema: {
+            properties: {
+                companyId: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'companyId'
+            ]
+        }
+    }),
     _ts_param(0, (0, _decorators.CurrentUser)('id')),
-    _ts_param(1, (0, _common.Param)('companyId')),
+    _ts_param(1, (0, _common.Body)('companyId')),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         String,