@flusys/nestjs-auth 1.0.0-rc → 1.0.1

package/fesm/services/branch.service.js

@@ -67,11 +67,15 @@ export class BranchService extends RequestScopedApiService {
     }
     async getExtraManipulateQuery(query, filterDto, user) {
         const result = await super.getExtraManipulateQuery(query, filterDto, user);
-        applyCompanyFilter(query, {
-            isCompanyFeatureEnabled: this.authConfig.isCompanyFeatureEnabled(),
-            entityAlias: 'company_branch',
-            columnName: 'company_id'
-        }, user);
+        // Only apply company filter if companyId is NOT explicitly provided in filter
+        // This prevents dual filtering when user selects a specific company
+        if (!filterDto?.filter?.companyId) {
+            applyCompanyFilter(query, {
+                isCompanyFeatureEnabled: this.authConfig.isCompanyFeatureEnabled(),
+                entityAlias: 'company_branch',
+                columnName: 'company_id'
+            }, user);
+        }
         return result;
     }
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig){

package/fesm/services/user-permission.service.js

@@ -25,124 +25,96 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { BadRequestException, Inject, Injectable, NotFoundException, Scope } from '@nestjs/common';
+import { ConflictException, Inject, Injectable, NotFoundException, Scope } from '@nestjs/common';
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class UserPermissionService {
-    /** Get repository lazily - initialized on first access */ async getRepository() {
+    async getRepository() {
         if (!this._repository) {
             this._repository = await this.dataSourceProvider.getRepository(UserCompanyPermission);
         }
         return this._repository;
     }
-    // Company Permissions
-    /** Find all companies a user has access to */ async findUserCompanies(userId) {
+    // Generic Permission Operations
+    /** Find all permissions of a specific type for a user */ async findUserPermissions(userId, type) {
         const repository = await this.getRepository();
         return repository.find({
             where: {
                 userId,
-                permissionType: PermissionType.COMPANY
+                permissionType: type
             },
             relations: [
-                'company'
+                type === PermissionType.COMPANY ? 'company' : 'branch'
             ],
             order: {
                 createdAt: 'DESC'
             }
         });
     }
-    /** Assign user to a company */ async assignUserToCompany(dto) {
+    /** Assign permission to user */ async assignPermission(userId, targetId, type, metadata) {
         const repository = await this.getRepository();
-        // Check if already exists
+        const typeName = type === PermissionType.COMPANY ? 'company' : 'branch';
         const existing = await repository.findOne({
             where: {
-                userId: dto.userId,
-                targetId: dto.companyId,
-                permissionType: PermissionType.COMPANY
+                userId,
+                targetId,
+                permissionType: type
             }
         });
         if (existing) {
-            throw new BadRequestException('User already assigned to this company');
+            throw new ConflictException(`User already assigned to this ${typeName}`);
         }
-        const permission = repository.create({
-            userId: dto.userId,
-            permissionType: PermissionType.COMPANY,
-            targetId: dto.companyId,
-            metadata: dto.metadata
-        });
-        await repository.save(permission);
-    }
-    /** Revoke user access to a company */ async revokeCompanyAccess(userId, companyId) {
-        const repository = await this.getRepository();
-        const permission = await repository.findOne({
-            where: {
+        try {
+            await repository.save(repository.create({
                 userId,
-                targetId: companyId,
-                permissionType: PermissionType.COMPANY
+                permissionType: type,
+                targetId,
+                metadata
+            }));
+        } catch (error) {
+            if (error?.code === 'ER_DUP_ENTRY' || error?.message?.includes('Duplicate entry')) {
+                throw new ConflictException(`User already assigned to this ${typeName}. Please refresh and try again.`);
             }
-        });
-        if (!permission) {
-            throw new NotFoundException('Company permission not found');
+            throw error;
         }
-        await repository.remove(permission);
     }
-    // Branch Permissions
-    /** Find all branches a user has access to */ async findUserBranches(userId) {
-        const repository = await this.getRepository();
-        return repository.find({
-            where: {
-                userId,
-                permissionType: PermissionType.BRANCH
-            },
-            relations: [
-                'branch'
-            ],
-            order: {
-                createdAt: 'DESC'
-            }
-        });
-    }
-    /** Assign user to a branch */ async assignUserToBranch(dto) {
-        const repository = await this.getRepository();
-        // Check if already exists
-        const existing = await repository.findOne({
-            where: {
-                userId: dto.userId,
-                targetId: dto.branchId,
-                permissionType: PermissionType.BRANCH
-            }
-        });
-        if (existing) {
-            throw new BadRequestException('User already assigned to this branch');
-        }
-        const permission = repository.create({
-            userId: dto.userId,
-            permissionType: PermissionType.BRANCH,
-            targetId: dto.branchId,
-            metadata: dto.metadata
-        });
-        await repository.save(permission);
-    }
-    /** Revoke user access to a branch */ async revokeBranchAccess(userId, branchId) {
+    /** Revoke permission from user */ async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
+        const typeName = type === PermissionType.COMPANY ? 'company' : 'branch';
         const permission = await repository.findOne({
             where: {
                 userId,
-                targetId: branchId,
-                permissionType: PermissionType.BRANCH
+                targetId,
+                permissionType: type
             }
         });
         if (!permission) {
-            throw new NotFoundException('Branch permission not found');
+            throw new NotFoundException(`${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`);
         }
         await repository.remove(permission);
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
+    /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
+        const repository = await this.getRepository();
+        const queryBuilder = repository.createQueryBuilder('permission').leftJoinAndSelect('permission.branch', 'branch').where('permission.userId = :userId', {
+            userId
+        }).andWhere('permission.permissionType = :type', {
+            type: PermissionType.BRANCH
+        }).orderBy('permission.createdAt', 'DESC');
+        if (companyId) {
+            queryBuilder.andWhere('branch.companyId = :companyId', {
+                companyId
+            });
+        }
+        return queryBuilder.getMany();
+    }
     constructor(dataSourceProvider){
         _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "_repository", void 0);
+        // Convenience Methods
+        _define_property(this, "findUserCompanies", void 0);
         this.dataSourceProvider = dataSourceProvider;
         this._repository = null;
+        this.findUserCompanies = (userId)=>this.findUserPermissions(userId, PermissionType.COMPANY);
     }
 }
 UserPermissionService = _ts_decorate([

package/fesm/services/user.service.js

@@ -60,12 +60,22 @@ export class UserService extends RequestScopedApiService {
     }
     // Custom Methods
     /**
-   * Validate that the requesting user owns the target profile.
-   * Users can only access/modify their own profile data.
-   */ validateProfileOwnership(targetUserId, requestingUser) {
-        if (targetUserId !== requestingUser.id) {
+   * Validate profile ownership, ensure repository initialized, and fetch user.
+   * Throws ForbiddenException if not owner, NotFoundException if user not found.
+   */ async getUserForProfile(userId, user) {
+        if (userId !== user.id) {
             throw new ForbiddenException('Cannot access another user\'s profile');
         }
+        await this.ensureRepositoryInitialized();
+        const userEntity = await this.repository.findOne({
+            where: {
+                id: userId
+            }
+        });
+        if (!userEntity) {
+            throw new NotFoundException('User not found');
+        }
+        return userEntity;
     }
     /** Verify email */ async verifyEmail(id) {
         // Ensure repository is initialized for custom method
@@ -324,16 +334,7 @@ export class UserService extends RequestScopedApiService {
    * Get user profile with extras from enricher
    * Returns base user data plus any extra data provided by enricher (roles, permissions, etc.)
    */ async getProfileWithExtras(userId, user) {
-        this.validateProfileOwnership(userId, user);
-        await this.ensureRepositoryInitialized();
-        const userEntity = await this.repository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!userEntity) {
-            throw new NotFoundException('User not found');
-        }
+        const userEntity = await this.getUserForProfile(userId, user);
         const userData = this.convertEntityToResponseDto(userEntity, false);
         // Get extras from enricher if available
         let extras;
@@ -368,17 +369,7 @@ export class UserService extends RequestScopedApiService {
     /**
    * Get specific profile section data
    */ async getProfileSectionData(userId, sectionId, user) {
-        this.validateProfileOwnership(userId, user);
-        await this.ensureRepositoryInitialized();
-        // Verify user exists
-        const userEntity = await this.repository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!userEntity) {
-            throw new NotFoundException('User not found');
-        }
+        await this.getUserForProfile(userId, user);
         if (this.userEnricher?.getProfileSectionData) {
             return this.userEnricher.getProfileSectionData(userId, sectionId, user);
         }
@@ -387,20 +378,10 @@ export class UserService extends RequestScopedApiService {
     /**
    * Update specific profile section
    */ async updateProfileSection(userId, sectionId, data, user) {
-        this.validateProfileOwnership(userId, user);
-        await this.ensureRepositoryInitialized();
+        const userEntity = await this.getUserForProfile(userId, user);
         if (!this.dataSource) {
             throw new BadRequestException('DataSource not available');
         }
-        // Verify user exists
-        const userEntity = await this.repository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!userEntity) {
-            throw new NotFoundException('User not found');
-        }
         if (!this.userEnricher?.updateProfileSection) {
             throw new BadRequestException('Profile sections not supported');
         }
@@ -427,17 +408,7 @@ export class UserService extends RequestScopedApiService {
     /**
    * Get profile completion percentage
    */ async getProfileCompletion(userId, user) {
-        this.validateProfileOwnership(userId, user);
-        await this.ensureRepositoryInitialized();
-        // Verify user exists
-        const userEntity = await this.repository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!userEntity) {
-            throw new NotFoundException('User not found');
-        }
+        await this.getUserForProfile(userId, user);
         if (this.userEnricher?.calculateProfileCompletion) {
             return this.userEnricher.calculateProfileCompletion(userId, user);
         }

package/fesm/strategies/jwt.strategy.js

@@ -24,75 +24,75 @@ import { Injectable, UnauthorizedException } from '@nestjs/common';
 import { ModuleRef } from '@nestjs/core';
 import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
+import { User } from '../entities/user.entity';
 import { AuthConfigService } from '../services/auth-config.service';
 import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
 import { AuthenticationService } from '../services/authentication.service';
-import { User } from '../entities/user.entity';
-/**
- * Type guard to check if payload includes company context
- */ function isTokenPayloadWithCompany(payload) {
+function hasCompanyContext(payload) {
     return 'companyId' in payload && 'branchId' in payload;
 }
 export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
     async validate(_req, payload) {
-        // Resolve request-scoped services for this request
-        let userRepository = null;
-        let authService = null;
+        const userRepo = await this.resolveUserRepository();
+        await this.checkTokenRevocation(payload);
+        const user = await userRepo.findOne({
+            where: {
+                id: payload.id,
+                isActive: true
+            }
+        });
+        if (!user) {
+            throw new UnauthorizedException('User not found or inactive');
+        }
+        return this.buildUserInfo(payload);
+    }
+    async resolveUserRepository() {
         try {
-            const dataSourceProvider = await this.moduleRef.resolve(AuthDataSourceProvider, undefined, {
+            const provider = await this.moduleRef.resolve(AuthDataSourceProvider, undefined, {
                 strict: false
             });
-            if (dataSourceProvider) {
-                userRepository = await dataSourceProvider.getRepository(User);
+            if (provider) {
+                return provider.getRepository(User);
             }
-            // Resolve AuthenticationService for token revocation check
-            authService = await this.moduleRef.resolve(AuthenticationService, undefined, {
-                strict: false
-            });
-        } catch (error) {
+        } catch  {
             throw new UnauthorizedException('Unable to access user data');
         }
-        if (!userRepository) {
-            throw new UnauthorizedException('User repository not available');
-        }
-        // Check if token is revoked (logged out)
-        if (authService && payload.iat) {
-            const isRevoked = await authService.isTokenRevoked(payload.id, payload.iat);
-            if (isRevoked) {
+        throw new UnauthorizedException('User repository not available');
+    }
+    async checkTokenRevocation(payload) {
+        if (!payload.iat) return;
+        try {
+            const authService = await this.moduleRef.resolve(AuthenticationService, undefined, {
+                strict: false
+            });
+            if (authService && await authService.isTokenRevoked(payload.id, payload.iat)) {
                 throw new UnauthorizedException('Token has been revoked');
             }
+        } catch (err) {
+            if (err instanceof UnauthorizedException) throw err;
         }
-        // Find user and check if active
-        const user = await userRepository.findOne({
-            where: {
-                id: payload.id,
-                isActive: true
-            }
-        });
-        if (!user) {
-            throw new UnauthorizedException('User not found or inactive');
-        }
-        const result = {
+    }
+    buildUserInfo(payload) {
+        const base = {
             id: payload.id,
             email: payload.email
         };
-        // Company context - use type guard for type safety
-        if (isTokenPayloadWithCompany(payload)) {
-            result.companyId = payload.companyId;
-            // Only set branchId if it's not empty string
-            if (payload.branchId) {
-                result.branchId = payload.branchId;
-            }
+        if (!hasCompanyContext(payload)) {
+            return base;
         }
-        return result;
+        return {
+            ...base,
+            companyId: payload.companyId,
+            ...payload.branchId && {
+                branchId: payload.branchId
+            }
+        };
     }
     constructor(authConfig, moduleRef){
         super({
             jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
             ignoreExpiration: false,
-            // Use secretOrKeyProvider instead of secretOrKey to defer secret lookup
-            // This ensures AuthConfigService is fully initialized when using forRootAsync
-            secretOrKeyProvider: (_request, _rawJwtToken, done)=>{
+            secretOrKeyProvider: (_req, _token, done)=>{
                 done(null, this.authConfig.getJwtSecret());
             },
             passReqToCallback: true

package/interceptors/clear-token.interceptor.d.ts

@@ -6,5 +6,4 @@ export declare class ClearToken implements NestInterceptor {
     constructor(authConfig?: AuthConfigService);
     private get cookieName();
     intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
-    private clearRefreshTokenCookie;
 }

package/interceptors/set-token.interceptor.d.ts

@@ -5,8 +5,7 @@ export declare class SetToken implements NestInterceptor {
     private readonly authConfig?;
     constructor(authConfig?: AuthConfigService);
     private get cookieName();
-    private getMaxAgeMs;
+    private get maxAgeMs();
     intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
-    private isBrowserRequest;
     private setRefreshTokenCookie;
 }

package/interfaces/authentication.interface.d.ts

@@ -22,7 +22,6 @@ export interface LoginResponse {
     user: IUserMini;
     company?: ICompanyMini;
     branch?: ICompanyBranchMini;
-    companyFeatureEnabled?: boolean;
 }
 export interface MeResponse {
     user: IUserMini;
@@ -33,14 +32,12 @@ export interface BranchForSelection {
     id: string;
     name: string;
     slug: string;
-    isActive: boolean;
     logoId?: string | null;
 }
 export interface CompanyWithBranches {
     id: string;
     name: string;
     slug: string;
-    isActive: boolean;
     logoId?: string | null;
     branches: BranchForSelection[];
 }
@@ -57,7 +54,6 @@ export interface RegistrationResponse {
     user: IUserMini;
     company?: ICompanyMini;
     branch?: ICompanyBranchMini;
-    companyFeatureEnabled?: boolean;
     requiresEmailVerification?: boolean;
 }
 export interface LoginResponseRequiresEmailVerification {

package/modules/auth.module.d.ts

@@ -2,8 +2,12 @@ import { DynamicModule } from '@nestjs/common';
 import { AuthModuleAsyncOptions, AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 export declare class AuthModule {
     static forRoot(options: AuthModuleOptions): DynamicModule;
-    static forRootAsync(asyncOptions: AuthModuleAsyncOptions): DynamicModule;
-    private static buildDynamicModule;
+    static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule;
+    private static buildModule;
+    private static buildImports;
+    private static buildControllers;
+    private static buildProviders;
+    private static buildExports;
     private static createAsyncProviders;
     static getEntities(enableCompanyFeature?: boolean): any[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "1.0.0-rc",
+  "version": "1.0.1",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -91,7 +91,7 @@
     "typeorm": "^0.3.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "1.0.0-rc",
-    "@flusys/nestjs-shared": "1.0.0-rc"
+    "@flusys/nestjs-core": "1.0.1",
+    "@flusys/nestjs-shared": "1.0.1"
   }
 }

package/services/auth-config.service.d.ts

@@ -1,6 +1,6 @@
-import { DatabaseMode, IDatabaseConfig, ITenantDatabaseConfig } from '@flusys/nestjs-core';
+import { DatabaseMode } from '@flusys/nestjs-core';
 import { IModuleConfigService } from '@flusys/nestjs-shared/interfaces';
-import { AuthModuleOptions, IAuthModuleConfig } from '../interfaces/auth-module-options.interface';
+import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 export declare class AuthConfigService implements IModuleConfigService {
     private readonly logger;
     private readonly options;
@@ -16,9 +16,4 @@ export declare class AuthConfigService implements IModuleConfigService {
     getRefreshTokenExpiration(): string;
     getRefreshTokenCookieName(): string;
     getFrontendUrl(): string | undefined;
-    getDefaultDatabaseConfig(): IDatabaseConfig | undefined;
-    getTenantDefaultDatabaseConfig(): IDatabaseConfig | undefined;
-    getTenants(): ITenantDatabaseConfig[];
-    getOptions(): AuthModuleOptions;
-    getConfig(): IAuthModuleConfig;
 }

package/services/auth-datasource.provider.d.ts

@@ -17,9 +17,7 @@ export declare class AuthDataSourceProvider extends MultiTenantDataSourceService
     protected getSingleDataSource(): Promise<DataSource>;
     protected getOrCreateTenantConnection(tenant: ITenantDatabaseConfig): Promise<DataSource>;
     private static buildParentOptions;
-    getEnableCompanyFeature(): boolean;
-    getEnableCompanyFeatureForTenant(tenant?: ITenantDatabaseConfig): boolean;
-    getEnableCompanyFeatureForCurrentTenant(): boolean;
-    getAuthEntities(enableCompanyFeature?: boolean): Promise<any[]>;
+    isCompanyFeatureEnabled(tenant?: ITenantDatabaseConfig): boolean;
+    getAuthEntities(): Promise<any[]>;
     protected createDataSourceFromConfig(config: IDatabaseConfig): Promise<DataSource>;
 }

package/services/auth-email.service.d.ts

@@ -1,6 +1,6 @@
-import { AuthDataSourceProvider } from './auth-datasource.provider';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { IAuthEmailProvider } from '../interfaces';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
 export declare class AuthEmailService {
     private readonly dataSourceProvider?;
     private readonly emailProvider?;
@@ -8,12 +8,15 @@ export declare class AuthEmailService {
     private readonly PASSWORD_RESET_EXPIRY;
     private readonly EMAIL_VERIFICATION_EXPIRY;
     constructor(dataSourceProvider?: AuthDataSourceProvider, emailProvider?: IAuthEmailProvider);
-    private getUserRepository;
-    private getUserTokenRepository;
-    private getPendingRegistrationRepository;
     isEmailEnabled(): boolean;
+    private getRepository;
     private generateToken;
     private hashToken;
+    private getErrorMessage;
+    private assertEmailEnabled;
+    private sendVerificationEmailSafe;
+    private validateTokenNotExpiredOrUsed;
+    hasPendingRegistration(email: string): Promise<boolean>;
     createPendingRegistration(data: {
         email: string;
         name?: string;

package/services/authentication.service.d.ts

@@ -1,13 +1,13 @@
+import { HybridCache } from '@flusys/nestjs-shared/classes';
 import { JwtService } from '@nestjs/jwt';
-import { AuthConfigService } from './auth-config.service';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
 import { RegistrationDto } from '../dtos/authentication.dto';
-import { HybridCache } from '@flusys/nestjs-shared/classes';
-import { LoginResponse, LoginResponseRequiresEmailVerification, LoginResponseRequiresSelection, MeResponse, RegistrationResponse } from '../interfaces/authentication.interface';
-import { AuthEmailService } from './auth-email.service';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
+import { LoginResponse, LoginResponseRequiresEmailVerification, LoginResponseRequiresSelection, MeResponse, RegistrationResponse } from '../interfaces/authentication.interface';
+import { AuthConfigService } from './auth-config.service';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { AuthEmailService } from './auth-email.service';
 import { CompanySelectionSessionService } from './company-selection-session.service';
 export declare class AuthenticationService {
     private readonly jwtService;
@@ -18,6 +18,7 @@ export declare class AuthenticationService {
     private readonly authEmailService?;
     private readonly logger;
     constructor(jwtService: JwtService, authConfig: AuthConfigService, cacheManager?: HybridCache, dataSourceProvider?: AuthDataSourceProvider, sessionService?: CompanySelectionSessionService, authEmailService?: AuthEmailService);
+    private isCompanyFeatureEnabled;
     private getUserRepository;
     private getPermissionRepository;
     private getCompanyRepository;
@@ -28,14 +29,15 @@ export declare class AuthenticationService {
         requiresEmailVerification: true;
         message: string;
     }>;
+    private handleExistingUserCompanyRegistration;
     private createUserDirectly;
     createUserFromPendingRegistration(pending: PendingRegistration): Promise<RegistrationResponse>;
-    private handleCompanyRegistrationFromPending;
-    private handleCompanyRegistration;
     private processCompanyRegistration;
-    private generateSlug;
+    private findOrCreateCompanyAndBranch;
+    private assignUserPermissions;
     select(sessionId: string, companyId: string, branchId: string): Promise<LoginResponse>;
     switchCompany(userId: string, companyId: string, branchId: string): Promise<LoginResponse>;
+    private validateAndLoginWithCompany;
     refreshToken(refreshToken: string): Promise<{
         accessToken: string;
         refreshToken: string;
@@ -51,6 +53,10 @@ export declare class AuthenticationService {
     getUserInfo(userId: string, companyId?: string, branchId?: string): Promise<MeResponse>;
     private ensureCompanyFeatureEnabled;
     private validateUser;
+    private toUserInfo;
+    private toCompanyInfo;
+    private toBranchInfo;
+    private generateTokens;
     private generateLoginResponse;
     private generateLoginResponseWithCompany;
     private generateCompanySelectionResponse;

package/services/user-permission.service.d.ts

@@ -1,15 +1,13 @@
-import { AssignBranchPermissionDto, AssignCompanyPermissionDto } from '../dtos/user-company-permission.dto';
-import { UserCompanyPermission } from '../entities/user-company-permission.entity';
+import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export declare class UserPermissionService {
     private readonly dataSourceProvider;
     private _repository;
     constructor(dataSourceProvider: AuthDataSourceProvider);
     private getRepository;
-    findUserCompanies(userId: string): Promise<UserCompanyPermission[]>;
-    assignUserToCompany(dto: AssignCompanyPermissionDto): Promise<void>;
-    revokeCompanyAccess(userId: string, companyId: string): Promise<void>;
-    findUserBranches(userId: string): Promise<UserCompanyPermission[]>;
-    assignUserToBranch(dto: AssignBranchPermissionDto): Promise<void>;
-    revokeBranchAccess(userId: string, branchId: string): Promise<void>;
+    findUserPermissions(userId: string, type: PermissionType): Promise<UserCompanyPermission[]>;
+    assignPermission(userId: string, targetId: string, type: PermissionType, metadata?: Record<string, any>): Promise<void>;
+    revokePermission(userId: string, targetId: string, type: PermissionType): Promise<void>;
+    findUserCompanies: (userId: string) => Promise<UserCompanyPermission[]>;
+    findUserBranches(userId: string, companyId?: string): Promise<UserCompanyPermission[]>;
 }

package/services/user.service.d.ts

@@ -20,7 +20,7 @@ export declare class UserService extends RequestScopedApiService<CreateUserDto,
     protected resolveEntity(): EntityTarget<User>;
     protected getDataSourceProvider(): AuthDataSourceProvider;
     protected ensureRepositoryInitialized(): Promise<void>;
-    private validateProfileOwnership;
+    private getUserForProfile;
     verifyEmail(id: string): Promise<void>;
     verifyPhone(id: string): Promise<void>;
     updateStatus(id: string, isActive: boolean, user?: ILoggedUserInfo | null): Promise<void>;