@flusys/nestjs-auth 1.0.1 → 1.1.0

package/README.md

@@ -1,6 +1,7 @@
 # Authentication Package Guide
 
 > **Package:** `@flusys/nestjs-auth`
+> **Version:** 1.1.0
 > **Type:** Authentication system with JWT, email verification, multi-tenant, and company/branch support
 
 ## Table of Contents
@@ -153,6 +154,7 @@ interface AuthModuleOptions {
   bootstrapAppConfig?: {
     databaseMode: 'single' | 'multi-tenant';
     enableCompanyFeature: boolean;
+    enableEmailVerification?: boolean; // Default: true
   };
   config?: {
     defaultDatabaseConfig?: IDatabaseConfig;
@@ -169,6 +171,13 @@ interface AuthModuleOptions {
 }
 ```
 
+**Bootstrap Configuration Flags:**
+
+| Flag | Type | Default | Effect |
+|------|------|---------|--------|
+| `enableCompanyFeature` | `boolean` | `false` | Enables company/branch entities and APIs |
+| `enableEmailVerification` | `boolean` | `true` | When `false`: excludes `AuthEmailService`, hides email-related APIs (forgot-password, reset-password, verify-email, resend-verification), and excludes `PendingRegistration` entity from migrations |
+
 ## Constants
 
 ```typescript
@@ -192,22 +201,53 @@ export const TOKEN_REVOKED_PREFIX = 'auth:revoked';
 
 ### Entity Groups
 
-```typescript
-// Core entities (always loaded)
-export const CoreEntities = [User, UserToken, PendingRegistration];
+The auth module organizes entities into groups based on feature flags:
 
-// Company entities (when enableCompanyFeature: true)
-export const CompanyEntities = [Company, CompanyBranch, UserCompanyPermission];
+```typescript
+// Internal entity groups (not exported directly)
+// Base entities: User, UserToken
+// Email entities: PendingRegistration
+// Company entities: Company, CompanyBranch, UserCompanyPermission
+
+// Exported interface for configuration
+export interface IAuthEntitiesConfig {
+  enableCompanyFeature?: boolean;
+  enableEmailVerification?: boolean;  // Default: true
+}
 
-// All entities
-export const AllEntities = [...CoreEntities, ...CompanyEntities];
+// Get entities based on feature flags (exported)
+export function getEntitiesByConfig(config: IAuthEntitiesConfig): any[] {
+  const { enableCompanyFeature = false, enableEmailVerification = true } = config;
 
-// Helper function
-export function getEntitiesByConfig(enableCompanyFeature: boolean) {
-  return enableCompanyFeature ? AllEntities : CoreEntities;
+  const entities = [User, UserToken];
+  if (enableEmailVerification) entities.push(PendingRegistration);
+  if (enableCompanyFeature) entities.push(Company, CompanyBranch, UserCompanyPermission);
+  return entities;
 }
 ```
 
+**Usage:**
+```typescript
+import { getEntitiesByConfig } from '@flusys/nestjs-auth/entities';
+
+// Get entities for single database without company feature
+const entities = getEntitiesByConfig({ enableCompanyFeature: false });
+// Returns: [User, UserToken, PendingRegistration]
+
+// Get entities with company feature, no email verification
+const entities = getEntitiesByConfig({ enableCompanyFeature: true, enableEmailVerification: false });
+// Returns: [User, UserToken, Company, CompanyBranch, UserCompanyPermission]
+```
+
+**Entity Selection by Feature Flags:**
+
+| enableEmailVerification | enableCompanyFeature | Entities |
+|------------------------|---------------------|----------|
+| `true` (default) | `false` | User, UserToken, PendingRegistration |
+| `true` | `true` | All entities |
+| `false` | `false` | User, UserToken only |
+| `false` | `true` | User, UserToken, Company, CompanyBranch, UserCompanyPermission |
+
 ### User Entity
 
 Extends `UserRoot` from `@flusys/nestjs-shared`:
@@ -813,7 +853,7 @@ export { PendingRegistration } from './entities/pending-registration.entity';
 export { Company } from './entities/company.entity';
 export { CompanyBranch } from './entities/company-branch.entity';
 export { UserCompanyPermission, PermissionType } from './entities/user-company-permission.entity';
-export { CoreEntities, CompanyEntities, AllEntities, getEntitiesByConfig } from './entities';
+export { getEntitiesByConfig, IAuthEntitiesConfig } from './entities';
 
 // Enums
 export { PermissionType } from './enums';
@@ -856,7 +896,15 @@ export { authSwaggerConfig } from './docs/auth-swagger.config';
 
 ```typescript
 // Get entities based on feature flags
-AuthModule.getEntities(enableCompanyFeature?: boolean): any[]
+// Supports both boolean (legacy) and config object signatures
+AuthModule.getEntities(config?: boolean | IBootstrapAppConfig): any[]
+
+// Examples:
+AuthModule.getEntities()                                    // BaseEntities + EmailEntities
+AuthModule.getEntities(true)                                // All entities (backward compat)
+AuthModule.getEntities(false)                               // BaseEntities + EmailEntities
+AuthModule.getEntities(bootstrapAppConfig)                  // Based on config flags
+AuthModule.getEntities({ enableCompanyFeature: true, enableEmailVerification: false })
 
 // Configure module
 AuthModule.forRoot(options: AuthModuleOptions): DynamicModule
@@ -880,4 +928,4 @@ When `enableCompanyFeature: false`, the following are automatically hidden from
 
 ---
 
-**Last Updated:** 2026-02-21
+**Last Updated:** 2026-02-22

package/cjs/controllers/authentication.controller.js

@@ -21,7 +21,6 @@ const _authenticationdto = require("../dtos/authentication.dto");
 const _cleartokeninterceptor = require("../interceptors/clear-token.interceptor");
 const _settokeninterceptor = require("../interceptors/set-token.interceptor");
 const _authconfigservice = require("../services/auth-config.service");
-const _authemailservice = require("../services/auth-email.service");
 const _authenticationservice = require("../services/authentication.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -55,15 +54,6 @@ let AuthenticationController = class AuthenticationController {
         const frontendUrl = this.authConfig?.getFrontendUrl();
         return frontendUrl ? `${frontendUrl}${path}` : `${req.protocol}://${req.get('host')}${path}`;
     }
-    get emailService() {
-        if (!this.authEmailService) {
-            throw new Error('Email service is not configured');
-        }
-        return this.authEmailService;
-    }
-    get isEmailEnabled() {
-        return !!this.authEmailService;
-    }
     async login(loginDto) {
         const result = await this.authService.login(loginDto.email, loginDto.password);
         if ('requiresEmailVerification' in result) {
@@ -109,56 +99,11 @@ let AuthenticationController = class AuthenticationController {
             message: 'Password changed successfully'
         };
     }
-    async forgotPassword(req, dto) {
-        if (!this.isEmailEnabled) {
-            return {
-                success: false,
-                message: 'Email service is not configured'
-            };
-        }
-        return this.emailService.forgotPassword(dto.email, this.buildAuthUrl(req, '/auth/reset-password'));
-    }
-    async resetPassword(dto) {
-        if (!this.isEmailEnabled) {
-            return {
-                success: false,
-                message: 'Email service is not configured'
-            };
-        }
-        return this.emailService.resetPassword(dto.token, dto.newPassword);
-    }
-    async resendVerification(req, dto) {
-        if (!this.isEmailEnabled) {
-            return {
-                success: false,
-                message: 'Email service is not configured'
-            };
-        }
-        return this.emailService.resendVerificationEmail(dto.email, this.buildAuthUrl(req, '/auth/verify-email'));
-    }
-    /** Verify email - Verify email using token. Handles both pending registration and existing user verification. */ async verifyEmail(dto) {
-        if (!this.isEmailEnabled) {
-            return {
-                success: false,
-                message: 'Email service is not configured'
-            };
-        }
-        const result = await this.emailService.verifyEmail(dto.token);
-        if (result.type === 'pending') {
-            return this.authService.createUserFromPendingRegistration(result.pending);
-        }
-        return {
-            success: true,
-            message: result.message
-        };
-    }
-    constructor(authService, authConfig, authEmailService){
+    constructor(authService, authConfig){
         _define_property(this, "authService", void 0);
         _define_property(this, "authConfig", void 0);
-        _define_property(this, "authEmailService", void 0);
         this.authService = authService;
         this.authConfig = authConfig;
-        this.authEmailService = authEmailService;
     }
 };
 _ts_decorate([
@@ -437,131 +382,15 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], AuthenticationController.prototype, "changePassword", null);
-_ts_decorate([
-    (0, _common.Post)('forgot-password'),
-    (0, _common.HttpCode)(_common.HttpStatus.OK),
-    (0, _throttler.Throttle)({
-        default: {
-            limit: 3,
-            ttl: 300000
-        }
-    }),
-    (0, _swagger.ApiOperation)({
-        summary: 'Request password reset email'
-    }),
-    (0, _swagger.ApiBody)({
-        type: _authenticationdto.ForgotPasswordDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        type: _dtos.MessageResponseDto
-    }),
-    _ts_param(0, (0, _common.Req)()),
-    _ts_param(1, (0, _common.Body)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _express.Request === "undefined" ? Object : _express.Request,
-        typeof _authenticationdto.ForgotPasswordDto === "undefined" ? Object : _authenticationdto.ForgotPasswordDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "forgotPassword", null);
-_ts_decorate([
-    (0, _common.Post)('reset-password'),
-    (0, _common.HttpCode)(_common.HttpStatus.OK),
-    (0, _throttler.Throttle)({
-        default: {
-            limit: 5,
-            ttl: 900000
-        }
-    }),
-    (0, _swagger.ApiOperation)({
-        summary: 'Reset password using token'
-    }),
-    (0, _swagger.ApiBody)({
-        type: _authenticationdto.ResetPasswordDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        type: _dtos.MessageResponseDto
-    }),
-    _ts_param(0, (0, _common.Body)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authenticationdto.ResetPasswordDto === "undefined" ? Object : _authenticationdto.ResetPasswordDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "resetPassword", null);
-_ts_decorate([
-    (0, _common.Post)('resend-verification'),
-    (0, _common.HttpCode)(_common.HttpStatus.OK),
-    (0, _throttler.Throttle)({
-        default: {
-            limit: 3,
-            ttl: 300000
-        }
-    }),
-    (0, _swagger.ApiOperation)({
-        summary: 'Resend email verification link'
-    }),
-    (0, _swagger.ApiBody)({
-        type: _authenticationdto.ResendVerificationDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        type: _dtos.MessageResponseDto
-    }),
-    _ts_param(0, (0, _common.Req)()),
-    _ts_param(1, (0, _common.Body)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _express.Request === "undefined" ? Object : _express.Request,
-        typeof _authenticationdto.ResendVerificationDto === "undefined" ? Object : _authenticationdto.ResendVerificationDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "resendVerification", null);
-_ts_decorate([
-    (0, _common.Post)('verify-email'),
-    (0, _common.HttpCode)(_common.HttpStatus.OK),
-    (0, _throttler.Throttle)({
-        default: {
-            limit: 10,
-            ttl: 60000
-        }
-    }),
-    (0, _common.UseInterceptors)(_settokeninterceptor.SetToken),
-    (0, _swagger.ApiOperation)({
-        summary: 'Verify email using token'
-    }),
-    (0, _swagger.ApiBody)({
-        type: _authenticationdto.VerifyEmailDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        type: _dtos.MessageResponseDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        type: _authenticationdto.RegistrationResponseDto
-    }),
-    _ts_param(0, (0, _common.Body)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authenticationdto.VerifyEmailDto === "undefined" ? Object : _authenticationdto.VerifyEmailDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "verifyEmail", null);
 AuthenticationController = _ts_decorate([
     (0, _swagger.ApiTags)('Authentication'),
     (0, _common.Controller)('auth'),
     _ts_param(0, (0, _common.Inject)(_authenticationservice.AuthenticationService)),
     _ts_param(1, (0, _common.Optional)()),
     _ts_param(1, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
-    _ts_param(2, (0, _common.Optional)()),
-    _ts_param(2, (0, _common.Inject)(_authemailservice.AuthEmailService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _authenticationservice.AuthenticationService === "undefined" ? Object : _authenticationservice.AuthenticationService,
-        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
-        typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService
+        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService
     ])
 ], AuthenticationController);

package/cjs/controllers/email-verification.controller.js

@@ -0,0 +1,220 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "EmailVerificationController", {
+    enumerable: true,
+    get: function() {
+        return EmailVerificationController;
+    }
+});
+const _dtos = require("@flusys/nestjs-shared/dtos");
+const _common = require("@nestjs/common");
+const _swagger = require("@nestjs/swagger");
+const _throttler = require("@nestjs/throttler");
+const _express = require("express");
+const _authenticationdto = require("../dtos/authentication.dto");
+const _settokeninterceptor = require("../interceptors/set-token.interceptor");
+const _authconfigservice = require("../services/auth-config.service");
+const _authdatasourceprovider = require("../services/auth-datasource.provider");
+const _authemailservice = require("../services/auth-email.service");
+const _authenticationservice = require("../services/authentication.service");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+let EmailVerificationController = class EmailVerificationController {
+    ensureEmailVerificationEnabled() {
+        if (!this.dataSourceProvider.isEmailVerificationEnabled()) {
+            throw new _common.BadRequestException('Email verification is not enabled for this tenant');
+        }
+    }
+    buildAuthUrl(req, path) {
+        const frontendUrl = this.authConfig.getFrontendUrl();
+        return frontendUrl ? `${frontendUrl}${path}` : `${req.protocol}://${req.get('host')}${path}`;
+    }
+    async forgotPassword(req, dto) {
+        this.ensureEmailVerificationEnabled();
+        return this.authEmailService.forgotPassword(dto.email, this.buildAuthUrl(req, '/auth/reset-password'));
+    }
+    async resetPassword(dto) {
+        this.ensureEmailVerificationEnabled();
+        return this.authEmailService.resetPassword(dto.token, dto.newPassword);
+    }
+    async resendVerification(req, dto) {
+        this.ensureEmailVerificationEnabled();
+        return this.authEmailService.resendVerificationEmail(dto.email, this.buildAuthUrl(req, '/auth/verify-email'));
+    }
+    async verifyEmail(dto) {
+        this.ensureEmailVerificationEnabled();
+        const result = await this.authEmailService.verifyEmail(dto.token);
+        if (result.type === 'pending') {
+            return this.authService.createUserFromPendingRegistration(result.pending);
+        }
+        return {
+            success: true,
+            message: result.message
+        };
+    }
+    constructor(authService, authEmailService, authConfig, dataSourceProvider){
+        _define_property(this, "authService", void 0);
+        _define_property(this, "authEmailService", void 0);
+        _define_property(this, "authConfig", void 0);
+        _define_property(this, "dataSourceProvider", void 0);
+        this.authService = authService;
+        this.authEmailService = authEmailService;
+        this.authConfig = authConfig;
+        this.dataSourceProvider = dataSourceProvider;
+    }
+};
+_ts_decorate([
+    (0, _common.Post)('forgot-password'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 3,
+            ttl: 300000
+        }
+    }),
+    (0, _swagger.ApiOperation)({
+        summary: 'Request password reset email'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ForgotPasswordDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Req)()),
+    _ts_param(1, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _express.Request === "undefined" ? Object : _express.Request,
+        typeof _authenticationdto.ForgotPasswordDto === "undefined" ? Object : _authenticationdto.ForgotPasswordDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], EmailVerificationController.prototype, "forgotPassword", null);
+_ts_decorate([
+    (0, _common.Post)('reset-password'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 5,
+            ttl: 900000
+        }
+    }),
+    (0, _swagger.ApiOperation)({
+        summary: 'Reset password using token'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ResetPasswordDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationdto.ResetPasswordDto === "undefined" ? Object : _authenticationdto.ResetPasswordDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], EmailVerificationController.prototype, "resetPassword", null);
+_ts_decorate([
+    (0, _common.Post)('resend-verification'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 3,
+            ttl: 300000
+        }
+    }),
+    (0, _swagger.ApiOperation)({
+        summary: 'Resend email verification link'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.ResendVerificationDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    _ts_param(0, (0, _common.Req)()),
+    _ts_param(1, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _express.Request === "undefined" ? Object : _express.Request,
+        typeof _authenticationdto.ResendVerificationDto === "undefined" ? Object : _authenticationdto.ResendVerificationDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], EmailVerificationController.prototype, "resendVerification", null);
+_ts_decorate([
+    (0, _common.Post)('verify-email'),
+    (0, _common.HttpCode)(_common.HttpStatus.OK),
+    (0, _throttler.Throttle)({
+        default: {
+            limit: 10,
+            ttl: 60000
+        }
+    }),
+    (0, _common.UseInterceptors)(_settokeninterceptor.SetToken),
+    (0, _swagger.ApiOperation)({
+        summary: 'Verify email using token'
+    }),
+    (0, _swagger.ApiBody)({
+        type: _authenticationdto.VerifyEmailDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _dtos.MessageResponseDto
+    }),
+    (0, _swagger.ApiResponse)({
+        status: 200,
+        type: _authenticationdto.RegistrationResponseDto
+    }),
+    _ts_param(0, (0, _common.Body)()),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationdto.VerifyEmailDto === "undefined" ? Object : _authenticationdto.VerifyEmailDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], EmailVerificationController.prototype, "verifyEmail", null);
+EmailVerificationController = _ts_decorate([
+    (0, _swagger.ApiTags)('Authentication'),
+    (0, _common.Controller)('auth'),
+    _ts_param(0, (0, _common.Inject)(_authenticationservice.AuthenticationService)),
+    _ts_param(1, (0, _common.Inject)(_authemailservice.AuthEmailService)),
+    _ts_param(2, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
+    _ts_param(3, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationservice.AuthenticationService === "undefined" ? Object : _authenticationservice.AuthenticationService,
+        typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService,
+        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
+        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider
+    ])
+], EmailVerificationController);

package/cjs/controllers/index.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 _export_star(require("./authentication.controller"), exports);
 _export_star(require("./company-selection.controller"), exports);
+_export_star(require("./email-verification.controller"), exports);
 _export_star(require("./user.controller"), exports);
 _export_star(require("./company.controller"), exports);
 _export_star(require("./branch.controller"), exports);

package/cjs/entities/index.js

@@ -9,15 +9,6 @@ function _export(target, all) {
     });
 }
 _export(exports, {
-    get AllEntities () {
-        return AllEntities;
-    },
-    get CompanyEntities () {
-        return CompanyEntities;
-    },
-    get CoreEntities () {
-        return CoreEntities;
-    },
     get PermissionType () {
         return _usercompanypermissionentity.PermissionType;
     },
@@ -47,9 +38,11 @@ function _export_star(from, to) {
     });
     return from;
 }
-const CoreEntities = [
+const BaseEntities = [
     _userentity.User,
-    _usertokenentity.UserToken,
+    _usertokenentity.UserToken
+];
+const EmailEntities = [
     _pendingregistrationentity.PendingRegistration
 ];
 const CompanyEntities = [
@@ -57,10 +50,16 @@ const CompanyEntities = [
     _companybranchentity.CompanyBranch,
     _usercompanypermissionentity.UserCompanyPermission
 ];
-const AllEntities = [
-    ...CoreEntities,
-    ...CompanyEntities
-];
-function getEntitiesByConfig(enableCompanyFeature) {
-    return enableCompanyFeature ? AllEntities : CoreEntities;
+function getEntitiesByConfig(config) {
+    const { enableCompanyFeature = false, enableEmailVerification = true } = config;
+    const entities = [
+        ...BaseEntities
+    ];
+    if (enableEmailVerification) {
+        entities.push(...EmailEntities);
+    }
+    if (enableCompanyFeature) {
+        entities.push(...CompanyEntities);
+    }
+    return entities;
 }