@flusys/nestjs-auth 1.0.0-rc → 2.0.0-rc.0

package/fesm/interceptors/clear-token.interceptor.js

@@ -25,6 +25,7 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
+import { buildCookieOptions, isBrowserRequest } from '@flusys/nestjs-shared/utils';
 import { Injectable, Optional } from '@nestjs/common';
 import { map } from 'rxjs';
 import { DEFAULT_COOKIE_NAME } from '../config';
@@ -37,27 +38,16 @@ export class ClearToken {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe(map((value)=>{
-            this.clearRefreshTokenCookie(req, res);
+            if (isBrowserRequest(req)) {
+                res.clearCookie(this.cookieName, {
+                    httpOnly: true,
+                    path: '/',
+                    ...buildCookieOptions(req)
+                });
+            }
             return value;
         }));
     }
-    clearRefreshTokenCookie(req, res) {
-        const origin = req.headers.origin || '';
-        const hostname = req.hostname || '';
-        const isHttps = origin.startsWith('https://') || req.secure;
-        let cookieDomain = hostname;
-        const domainParts = hostname.split('.');
-        if (domainParts.length > 2) {
-            cookieDomain = '.' + domainParts.slice(-2).join('.');
-        }
-        res.clearCookie(this.cookieName, {
-            httpOnly: true,
-            secure: isHttps,
-            sameSite: isHttps ? 'strict' : 'lax',
-            domain: cookieDomain,
-            path: '/'
-        });
-    }
     constructor(authConfig){
         _define_property(this, "authConfig", void 0);
         this.authConfig = authConfig;

package/fesm/interceptors/set-token.interceptor.js

@@ -25,6 +25,7 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
+import { buildCookieOptions, isBrowserRequest, parseDurationToMs } from '@flusys/nestjs-shared/utils';
 import { Inject, Injectable, Optional, PayloadTooLargeException } from '@nestjs/common';
 import { Buffer } from 'buffer';
 import { catchError, map, throwError } from 'rxjs';
@@ -34,67 +35,23 @@ export class SetToken {
     get cookieName() {
         return this.authConfig?.getRefreshTokenCookieName() ?? DEFAULT_COOKIE_NAME;
     }
-    /** Convert expiration string (e.g., '7d', '24h') to milliseconds */ getMaxAgeMs() {
-        const expiry = this.authConfig?.getRefreshTokenExpiration() ?? '7d';
-        const match = expiry.match(/^(\d+)(s|m|h|d|w)$/);
-        if (!match) {
-            return 7 * 24 * 60 * 60 * 1000; // Default 7 days
-        }
-        const value = parseInt(match[1], 10);
-        const unit = match[2];
-        const multipliers = {
-            s: 1000,
-            m: 60 * 1000,
-            h: 60 * 60 * 1000,
-            d: 24 * 60 * 60 * 1000,
-            w: 7 * 24 * 60 * 60 * 1000
-        };
-        return value * (multipliers[unit] || multipliers['d']);
+    get maxAgeMs() {
+        return parseDurationToMs(this.authConfig?.getRefreshTokenExpiration() ?? '7d');
     }
     intercept(context, next) {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe(map((value)=>{
-            if (!value || !value.refreshToken) {
-                return value;
-            }
-            const isBrowser = this.isBrowserRequest(req);
-            const tokenValue = value.refreshToken;
-            if (isBrowser) {
-                this.setRefreshTokenCookie(req, res, tokenValue);
+            if (!value?.refreshToken) return value;
+            if (isBrowserRequest(req)) {
+                this.setRefreshTokenCookie(req, res, value.refreshToken);
                 const { refreshToken, ...responseWithoutToken } = value;
                 return responseWithoutToken;
             }
             return value;
         }), catchError((err)=>throwError(()=>err)));
     }
-    isBrowserRequest(req) {
-        const clientType = req.headers['x-client-type'];
-        if (clientType) {
-            return clientType.toLowerCase() === 'browser' || clientType.toLowerCase() === 'web';
-        }
-        const accept = req.headers['accept'] || '';
-        if (accept.includes('text/html')) {
-            return true;
-        }
-        const userAgent = req.headers['user-agent'] || '';
-        const browserPatterns = /mozilla|chrome|safari|firefox|edge|opera|msie/i;
-        return browserPatterns.test(userAgent) && !userAgent.includes('Postman');
-    }
     setRefreshTokenCookie(req, res, tokenValue) {
-        const hostname = req.hostname || '';
-        // Determine if we're in production - always use secure cookies in production
-        // This handles TLS-terminating proxies correctly (they set x-forwarded-proto)
-        const isProduction = process.env.NODE_ENV === 'production';
-        const forwardedProto = req.headers['x-forwarded-proto'];
-        const isHttps = isProduction || forwardedProto === 'https' || req.secure;
-        // Set cookie domain - only for subdomains with 3+ parts
-        // For security, limit to same domain unless explicitly configured
-        let cookieDomain;
-        const domainParts = hostname.split('.');
-        if (domainParts.length > 2 && !hostname.includes('localhost')) {
-            cookieDomain = '.' + domainParts.slice(-2).join('.');
-        }
         const rawCookieString = `${this.cookieName}=${tokenValue}; HttpOnly`;
         const estimatedBytes = Buffer.byteLength(rawCookieString, 'utf8');
         if (estimatedBytes > MAX_COOKIE_BYTES) {
@@ -102,13 +59,9 @@ export class SetToken {
         }
         res.cookie(this.cookieName, tokenValue, {
             httpOnly: true,
-            secure: isHttps,
-            sameSite: isHttps ? 'strict' : 'lax',
-            ...cookieDomain && {
-                domain: cookieDomain
-            },
             path: '/',
-            maxAge: this.getMaxAgeMs()
+            maxAge: this.maxAgeMs,
+            ...buildCookieOptions(req)
         });
     }
     constructor(authConfig){

package/fesm/interfaces/auth-email-provider.interface.js

@@ -1,5 +1,5 @@
 /**
- * Auth Email Provider Interface
+ * Auth Email  Provider Interface
  *
  * This interface defines the contract for email sending in the auth module.
  * It allows auth to work independently of the email module.

package/fesm/modules/auth.module.js

@@ -8,94 +8,54 @@ import { CacheModule, UtilsModule } from '@flusys/nestjs-shared/modules';
 import { Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
-import { AuthConfigService } from '../services/auth-config.service';
-import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
+import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
 import { AuthenticationController, BranchController, CompanyController, CompanySelectionController, UserController, UserPermissionController } from '../controllers';
 import { Company, CompanyBranch, User, UserCompanyPermission } from '../entities';
-import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { ClearToken } from '../interceptors/clear-token.interceptor';
 import { SetToken } from '../interceptors/set-token.interceptor';
 import { AuthEmailService, AuthenticationService, BranchService, CompanySelectionSessionService, CompanyService, UserPermissionService, UserService } from '../services';
+import { AuthConfigService } from '../services/auth-config.service';
+import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
 import { JwtStrategy } from '../strategies/jwt.strategy';
 export class AuthModule {
     static forRoot(options) {
-        return this.buildDynamicModule(options);
+        const optionsProvider = {
+            provide: AUTH_MODULE_OPTIONS,
+            useValue: options
+        };
+        return this.buildModule(options, [
+            optionsProvider,
+            ...options.providers ?? []
+        ]);
     }
-    static forRootAsync(asyncOptions) {
-        const { global = false, includeController = true, bootstrapAppConfig: { enableCompanyFeature } = {}, imports: externalImports = [], providers: additionalProviders = [] } = asyncOptions;
-        const asyncProviders = this.createAsyncProviders(asyncOptions);
-        // Build imports
-        const imports = [
-            ...externalImports,
-            PassportModule.register({
-                defaultStrategy: 'jwt'
-            }),
-            JwtModule.register({}),
-            CacheModule,
-            UtilsModule
-        ];
-        // Build controllers based on configuration
-        const controllers = [];
-        if (includeController) {
-            // Core authentication controller (always included)
-            controllers.push(AuthenticationController);
-            // User controller (always included)
-            controllers.push(UserController);
-            // Company feature controllers (conditional)
-            if (enableCompanyFeature) {
-                controllers.push(CompanySelectionController, CompanyController, BranchController, UserPermissionController);
-            }
-        }
-        // Build providers
-        const providers = [
+    static forRootAsync(options) {
+        const asyncProviders = this.createAsyncProviders(options);
+        return this.buildModule(options, [
             ...asyncProviders,
-            ...additionalProviders,
-            // Config & Infrastructure
-            AuthConfigService,
-            AuthDataSourceProvider,
-            // Auth core
-            JwtStrategy,
-            JwtAuthGuard,
-            AuthenticationService,
-            AuthEmailService,
-            // Interceptors
-            SetToken,
-            ClearToken,
-            // Core services (always included)
-            UserService
-        ];
-        // Company feature services (conditional)
-        if (enableCompanyFeature) {
-            providers.push(CompanySelectionSessionService, CompanyService, BranchService, UserPermissionService);
-        }
-        // Build exports
-        const exports = [
-            PassportModule,
-            AUTH_MODULE_OPTIONS,
-            AuthConfigService,
-            AuthDataSourceProvider,
-            JwtStrategy,
-            JwtAuthGuard,
-            AuthenticationService,
-            AuthEmailService,
-            UserService
-        ];
-        if (enableCompanyFeature) {
-            exports.push(CompanySelectionSessionService, CompanyService, BranchService, UserPermissionService);
-        }
+            ...options.providers ?? []
+        ], options.imports);
+    }
+    /** Build the dynamic module with shared logic */ static buildModule(options, providers, externalImports = []) {
+        const { global = false, includeController = true, bootstrapAppConfig } = options;
+        const enableCompanyFeature = bootstrapAppConfig?.enableCompanyFeature ?? false;
         return {
             module: AuthModule,
             global,
-            imports,
-            controllers,
-            providers,
-            exports
+            imports: [
+                ...externalImports,
+                ...this.buildImports()
+            ],
+            controllers: this.buildControllers(includeController, enableCompanyFeature),
+            providers: [
+                ...providers,
+                ...this.buildProviders(enableCompanyFeature)
+            ],
+            exports: this.buildExports(enableCompanyFeature)
         };
     }
-    static buildDynamicModule(options) {
-        const { bootstrapAppConfig: { enableCompanyFeature } = {}, includeController = true, global = false, providers: additionalProviders = [] } = options;
-        const imports = [
+    /** Common module imports */ static buildImports() {
+        return [
             PassportModule.register({
                 defaultStrategy: 'jwt'
             }),
@@ -103,42 +63,36 @@ export class AuthModule {
             CacheModule,
             UtilsModule
         ];
-        // Build controllers based on configuration
-        const controllers = [];
-        if (includeController) {
-            // Core authentication controller (always included)
-            controllers.push(AuthenticationController);
-            // User controller (always included)
-            controllers.push(UserController);
-            // Company feature controllers (conditional)
-            if (enableCompanyFeature) {
-                controllers.push(CompanySelectionController, CompanyController, BranchController, UserPermissionController);
-            }
+    }
+    /** Build controllers based on feature flags */ static buildControllers(includeController, enableCompanyFeature) {
+        if (!includeController) return [];
+        const controllers = [
+            AuthenticationController,
+            UserController
+        ];
+        if (enableCompanyFeature) {
+            controllers.push(CompanySelectionController, CompanyController, BranchController, UserPermissionController);
         }
+        return controllers;
+    }
+    /** Core providers (without AUTH_MODULE_OPTIONS - that's added separately) */ static buildProviders(enableCompanyFeature) {
         const providers = [
-            {
-                provide: AUTH_MODULE_OPTIONS,
-                useValue: options
-            },
-            ...additionalProviders,
-            // Config & Infrastructure
             AuthConfigService,
             AuthDataSourceProvider,
-            // Auth core
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
             AuthEmailService,
-            // Interceptors
             SetToken,
             ClearToken,
-            // Core services (always included)
             UserService
         ];
-        // Company feature services (conditional)
         if (enableCompanyFeature) {
             providers.push(CompanySelectionSessionService, CompanyService, BranchService, UserPermissionService);
         }
+        return providers;
+    }
+    /** Build module exports */ static buildExports(enableCompanyFeature) {
         const exports = [
             PassportModule,
             AUTH_MODULE_OPTIONS,
@@ -153,16 +107,9 @@ export class AuthModule {
         if (enableCompanyFeature) {
             exports.push(CompanySelectionSessionService, CompanyService, BranchService, UserPermissionService);
         }
-        return {
-            module: AuthModule,
-            global,
-            imports,
-            controllers,
-            providers,
-            exports
-        };
+        return exports;
     }
-    static createAsyncProviders(options) {
+    /** Create async providers for forRootAsync */ static createAsyncProviders(options) {
         const staticOptions = {
             global: options.global,
             includeController: options.includeController,
@@ -172,13 +119,10 @@ export class AuthModule {
             return [
                 {
                     provide: AUTH_MODULE_OPTIONS,
-                    useFactory: async (...args)=>{
-                        const config = await options.useFactory(...args);
-                        return {
+                    useFactory: async (...args)=>({
                             ...staticOptions,
-                            config
-                        };
-                    },
+                            config: await options.useFactory(...args)
+                        }),
                     inject: options.inject || []
                 }
             ];
@@ -191,13 +135,10 @@ export class AuthModule {
                 },
                 {
                     provide: AUTH_MODULE_OPTIONS,
-                    useFactory: async (factory)=>{
-                        const config = await factory.createAuthOptions();
-                        return {
+                    useFactory: async (factory)=>({
                             ...staticOptions,
-                            config
-                        };
-                    },
+                            config: await factory.createAuthOptions()
+                        }),
                     inject: [
                         options.useClass
                     ]
@@ -208,13 +149,10 @@ export class AuthModule {
             return [
                 {
                     provide: AUTH_MODULE_OPTIONS,
-                    useFactory: async (factory)=>{
-                        const config = await factory.createAuthOptions();
-                        return {
+                    useFactory: async (factory)=>({
                             ...staticOptions,
-                            config
-                        };
-                    },
+                            config: await factory.createAuthOptions()
+                        }),
                     inject: [
                         options.useExisting
                     ]
@@ -228,18 +166,14 @@ export class AuthModule {
             }
         ];
     }
-    static getEntities(enableCompanyFeature = false) {
-        const coreEntities = [
-            User
-        ];
-        const companyEntities = enableCompanyFeature ? [
+    /** Get auth entities based on feature flags */ static getEntities(enableCompanyFeature = false) {
+        return enableCompanyFeature ? [
+            User,
             Company,
             CompanyBranch,
             UserCompanyPermission
-        ] : [];
-        return [
-            ...coreEntities,
-            ...companyEntities
+        ] : [
+            User
         ];
     }
 }

package/fesm/services/auth-config.service.js

@@ -26,18 +26,18 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { Inject, Injectable, InternalServerErrorException, Logger, Optional } from '@nestjs/common';
-import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
+import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 export class AuthConfigService {
-    // Database Mode
-    /** Get database mode (single or multi-tenant) */ getDatabaseMode() {
+    // Database Mode (required by IModuleConfigService)
+    getDatabaseMode() {
         return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
     }
-    /** Check if running in multi-tenant mode */ isMultiTenant() {
+    isMultiTenant() {
         return this.getDatabaseMode() === 'multi-tenant';
     }
     // Feature Flags
-    /** Check if company feature is enabled */ isCompanyFeatureEnabled() {
+    isCompanyFeatureEnabled() {
         return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
     // JWT Configuration
@@ -54,16 +54,14 @@ export class AuthConfigService {
         if (this.config.refreshTokenSecret) {
             return this.config.refreshTokenSecret;
         }
-        // Production: require separate refresh token secret for security
         if (process.env.NODE_ENV === 'production') {
             throw new InternalServerErrorException('[AuthModule] REFRESH_TOKEN_SECRET is required in production - ' + 'using the same secret for access and refresh tokens is a security risk');
         }
-        // Development: warn once about fallback to JWT secret
         if (!this.refreshTokenSecretWarned) {
             this.refreshTokenSecretWarned = true;
             this.logger.warn('REFRESH_TOKEN_SECRET not configured - using JWT_SECRET as fallback. ' + 'For better security, configure a separate refresh token secret.');
         }
-        return this.config.jwtSecret ?? this.getJwtSecret();
+        return this.getJwtSecret();
     }
     /** Get refresh token expiration time */ getRefreshTokenExpiration() {
         return this.config.refreshTokenExpiration ?? '7d';
@@ -75,27 +73,6 @@ export class AuthConfigService {
     /** Get frontend URL for email links */ getFrontendUrl() {
         return this.config.frontendUrl;
     }
-    // Database Configuration
-    /** Get default database config */ getDefaultDatabaseConfig() {
-        return this.config.defaultDatabaseConfig ?? this.config.tenantDefaultDatabaseConfig;
-    }
-    /** Get tenant default database config (for multi-tenant) */ getTenantDefaultDatabaseConfig() {
-        return this.config.tenantDefaultDatabaseConfig;
-    }
-    /** Get registered tenants */ getTenants() {
-        return this.config.tenants ?? [];
-    }
-    // Raw Options
-    /** Get full module options */ getOptions() {
-        return {
-            ...this.options
-        };
-    }
-    /** Get runtime config */ getConfig() {
-        return {
-            ...this.config
-        };
-    }
     constructor(injectedOptions){
         _define_property(this, "logger", new Logger(AuthConfigService.name));
         _define_property(this, "options", void 0);

package/fesm/services/auth-datasource.provider.js

@@ -90,40 +90,28 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
         };
     }
     // Feature Flags
-    /** Get global enable company feature flag */ getEnableCompanyFeature() {
-        return this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
-    }
-    /** Get enable company feature for specific tenant. Falls back to global setting. */ getEnableCompanyFeatureForTenant(tenant) {
-        return tenant?.enableCompanyFeature ?? this.getEnableCompanyFeature();
-    }
-    /** Get enable company feature for current request context */ getEnableCompanyFeatureForCurrentTenant() {
-        return this.getEnableCompanyFeatureForTenant(this.getCurrentTenant() ?? undefined);
+    /** Check if company feature is enabled (tenant-specific or global fallback) */ isCompanyFeatureEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableCompanyFeature ?? this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
     // Entity Management
-    /** Get auth entities based on company feature flag */ async getAuthEntities(enableCompanyFeature) {
-        const enable = enableCompanyFeature ?? this.getEnableCompanyFeature();
+    /** Get auth entities based on company feature flag */ async getAuthEntities() {
         const { Company, CompanyBranch, User, UserCompanyPermission, UserToken, PendingRegistration } = await import('../entities');
         const coreEntities = [
             User,
             UserToken,
             PendingRegistration
         ];
-        const companyEntities = enable ? [
+        return this.isCompanyFeatureEnabled() ? [
+            ...coreEntities,
             Company,
             CompanyBranch,
             UserCompanyPermission
-        ] : [];
-        return [
-            ...coreEntities,
-            ...companyEntities
-        ];
+        ] : coreEntities;
     }
     // Overrides
     /** Override to dynamically set entities based on tenant config */ async createDataSourceFromConfig(config) {
-        const currentTenant = this.getCurrentTenant();
-        const enableCompanyFeature = this.getEnableCompanyFeatureForTenant(currentTenant ?? undefined);
-        const entities = await this.getAuthEntities(enableCompanyFeature);
-        return super.createDataSourceFromConfig(config, entities);
+        return super.createDataSourceFromConfig(config, await this.getAuthEntities());
     }
     constructor(authOptions, request){
         super(AuthDataSourceProvider.buildParentOptions(authOptions), request), _define_property(this, "authOptions", void 0), _define_property(this, "logger", void 0), this.authOptions = authOptions, this.logger = new Logger(AuthDataSourceProvider.name);