@flusys/nestjs-auth 1.0.1 → 1.1.0

package/fesm/services/auth-datasource.provider.js

@@ -32,8 +32,7 @@ import { Request } from 'express';
 import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
 export class AuthDataSourceProvider extends MultiTenantDataSourceService {
-    // Override Static Cache Access Methods
-    /** Override to access Auth-specific static properties */ async getSingleDataSource() {
+    async getSingleDataSource() {
         if (!AuthDataSourceProvider.singleDataSource) {
             if (AuthDataSourceProvider.singleConnectionLock) {
                 return AuthDataSourceProvider.singleConnectionLock;
@@ -57,18 +56,15 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
         }
         return AuthDataSourceProvider.singleDataSource;
     }
-    /** Override to use Auth-specific static cache for tenant connections */ async getOrCreateTenantConnection(tenant) {
-        // Return existing initialized connection from Auth-specific cache
+    async getOrCreateTenantConnection(tenant) {
         const existing = AuthDataSourceProvider.tenantConnections.get(tenant.id);
         if (existing?.isInitialized) {
             return existing;
         }
-        // If another request is creating this tenant's connection, wait for it
         const pendingConnection = AuthDataSourceProvider.connectionLocks.get(tenant.id);
         if (pendingConnection) {
             return pendingConnection;
         }
-        // Create connection with lock to prevent race conditions
         const config = this.buildTenantDatabaseConfig(tenant);
         const connectionPromise = this.createDataSourceFromConfig(config);
         AuthDataSourceProvider.connectionLocks.set(tenant.id, connectionPromise);
@@ -80,8 +76,7 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
             AuthDataSourceProvider.connectionLocks.delete(tenant.id);
         }
     }
-    // Factory Methods
-    /** Build parent options from AuthModuleOptions */ static buildParentOptions(options) {
+    static buildParentOptions(options) {
         return {
             bootstrapAppConfig: options.bootstrapAppConfig,
             defaultDatabaseConfig: options.config?.defaultDatabaseConfig,
@@ -89,35 +84,28 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
             tenants: options.config?.tenants
         };
     }
-    // Feature Flags
-    /** Check if company feature is enabled (tenant-specific or global fallback) */ isCompanyFeatureEnabled(tenant) {
+    isCompanyFeatureEnabled(tenant) {
         const effectiveTenant = tenant ?? this.getCurrentTenant();
         return effectiveTenant?.enableCompanyFeature ?? this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
-    // Entity Management
-    /** Get auth entities based on company feature flag */ async getAuthEntities() {
-        const { Company, CompanyBranch, User, UserCompanyPermission, UserToken, PendingRegistration } = await import('../entities');
-        const coreEntities = [
-            User,
-            UserToken,
-            PendingRegistration
-        ];
-        return this.isCompanyFeatureEnabled() ? [
-            ...coreEntities,
-            Company,
-            CompanyBranch,
-            UserCompanyPermission
-        ] : coreEntities;
+    isEmailVerificationEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableEmailVerification ?? this.authOptions.bootstrapAppConfig?.enableEmailVerification ?? true;
+    }
+    async getAuthEntities() {
+        const { getEntitiesByConfig } = await import('../entities');
+        return getEntitiesByConfig({
+            enableCompanyFeature: this.isCompanyFeatureEnabled(),
+            enableEmailVerification: this.isEmailVerificationEnabled()
+        });
     }
-    // Overrides
-    /** Override to dynamically set entities based on tenant config */ async createDataSourceFromConfig(config) {
+    async createDataSourceFromConfig(config) {
         return super.createDataSourceFromConfig(config, await this.getAuthEntities());
     }
     constructor(authOptions, request){
         super(AuthDataSourceProvider.buildParentOptions(authOptions), request), _define_property(this, "authOptions", void 0), _define_property(this, "logger", void 0), this.authOptions = authOptions, this.logger = new Logger(AuthDataSourceProvider.name);
     }
 }
-// Override parent's static properties to have Auth-specific cache (isolated from IAM/Storage)
 _define_property(AuthDataSourceProvider, "tenantConnections", new Map());
 _define_property(AuthDataSourceProvider, "singleDataSource", null);
 _define_property(AuthDataSourceProvider, "tenantsRegistry", new Map());

package/fesm/services/authentication.service.js

@@ -42,9 +42,14 @@ import { AuthEmailService } from './auth-email.service';
 import { CompanySelectionSessionService } from './company-selection-session.service';
 export class AuthenticationService {
     // Feature Flags
-    /** Check if company feature is enabled (tenant-aware with global fallback) */ isCompanyFeatureEnabled() {
+    isCompanyFeatureEnabled() {
         return this.dataSourceProvider?.isCompanyFeatureEnabled() ?? this.authConfig.isCompanyFeatureEnabled();
     }
+    isEmailVerificationEnabled() {
+        const featureEnabled = this.dataSourceProvider?.isEmailVerificationEnabled() ?? this.authConfig.isEmailVerificationEnabled();
+        const providerAvailable = this.authEmailService?.isEmailEnabled() ?? false;
+        return featureEnabled && providerAvailable;
+    }
     // Repository Getters
     async getUserRepository() {
         if (!this.dataSourceProvider) {
@@ -67,7 +72,7 @@ export class AuthenticationService {
     // Login
     async login(email, password) {
         // Check for pending registration first (user registered but hasn't verified email yet)
-        if (await this.authEmailService?.hasPendingRegistration(email)) {
+        if (this.isEmailVerificationEnabled() && await this.authEmailService.hasPendingRegistration(email)) {
             return {
                 requiresEmailVerification: true,
                 email,
@@ -78,7 +83,7 @@ export class AuthenticationService {
         if (!user.isActive) {
             throw new UnauthorizedException('User account is deactivated');
         }
-        if (this.authEmailService?.isEmailEnabled() && !user.emailVerified) {
+        if (this.isEmailVerificationEnabled() && !user.emailVerified) {
             return {
                 requiresEmailVerification: true,
                 email: user.email,
@@ -90,7 +95,7 @@ export class AuthenticationService {
         }
         return this.handleCompanyBasedLogin(user);
     }
-    /** Handle login when company feature is enabled */ async handleCompanyBasedLogin(user) {
+    async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !branchRepository) {
@@ -141,7 +146,7 @@ export class AuthenticationService {
         return await this.generateCompanySelectionResponse(user, companies, branches);
     }
     // Registration
-    /** Register a new user. If email enabled, creates pending registration. Otherwise creates user directly. */ async register(dto, verifyUrlBase) {
+    async register(dto, verifyUrlBase) {
         const userRepository = await this.getUserRepository();
         const existingUser = await userRepository.findOne({
             where: {
@@ -157,7 +162,7 @@ export class AuthenticationService {
             throw new BadRequestException('Registration failed due to email exists. Please try again or contact support.');
         }
         // If email verification is enabled, create pending registration instead of user
-        if (this.authEmailService?.isEmailEnabled() && verifyUrlBase) {
+        if (this.isEmailVerificationEnabled() && verifyUrlBase) {
             const companyData = this.isCompanyFeatureEnabled() ? {
                 companySlug: dto.companySlug,
                 branchSlug: dto.branchSlug,
@@ -181,7 +186,7 @@ export class AuthenticationService {
         // No email verification - create user directly
         return this.createUserDirectly(dto);
     }
-    /** Handle registration for existing user when company feature is enabled */ async handleExistingUserCompanyRegistration(existingUser, dto) {
+    async handleExistingUserCompanyRegistration(existingUser, dto) {
         if (!dto.companySlug && !dto.newCompanyName) {
             throw new BadRequestException('Email already registered. Please login or provide a company to join/create.');
         }
@@ -213,7 +218,7 @@ export class AuthenticationService {
         }
         return this.processCompanyRegistration(existingUser, dto, true);
     }
-    /** Create user directly (no email verification) */ async createUserDirectly(dto) {
+    async createUserDirectly(dto) {
         const userRepository = await this.getUserRepository();
         const hashedPassword = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
         const user = userRepository.create({
@@ -231,7 +236,7 @@ export class AuthenticationService {
         }
         return this.processCompanyRegistration(user, dto);
     }
-    /** Create user from pending registration (after email verification) */ async createUserFromPendingRegistration(pending) {
+    async createUserFromPendingRegistration(pending) {
         const userRepository = await this.getUserRepository();
         const existingUser = await userRepository.findOne({
             where: {
@@ -256,7 +261,7 @@ export class AuthenticationService {
         }
         return this.generateRegistrationResponse(user);
     }
-    /** Process company registration (join existing or create new) */ async processCompanyRegistration(user, data, throwOnUnavailable = false) {
+    async processCompanyRegistration(user, data, throwOnUnavailable = false) {
         const companyRepository = await this.getCompanyRepository();
         const branchRepository = await this.getBranchRepository();
         const permissionRepository = await this.getPermissionRepository();
@@ -271,7 +276,7 @@ export class AuthenticationService {
         }
         return this.generateRegistrationResponse(user);
     }
-    /** Find existing company/branch or create new ones */ async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
+    async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
         if (data.companySlug) {
             const company = await companyRepo.findOne({
                 where: {
@@ -335,7 +340,7 @@ export class AuthenticationService {
             branch: null
         };
     }
-    /** Assign user to company and optionally branch */ async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
+    async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
         await permissionRepo.save(permissionRepo.create({
             userId,
             permissionType: PermissionType.COMPANY,
@@ -350,7 +355,7 @@ export class AuthenticationService {
         }
     }
     // Company/Branch Selection
-    /** Select company and branch (step 2 of login). Frontend receives all options and user selects both. */ async select(sessionId, companyId, branchId) {
+    async select(sessionId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         if (!this.sessionService) {
             throw new BadRequestException('Session service not available');
@@ -361,11 +366,11 @@ export class AuthenticationService {
         }
         return this.validateAndLoginWithCompany(session.userId, companyId, branchId);
     }
-    /** Switch company/branch after login */ async switchCompany(userId, companyId, branchId) {
+    async switchCompany(userId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         return this.validateAndLoginWithCompany(userId, companyId, branchId);
     }
-    /** Shared: Validate user access to company/branch and generate login response */ async validateAndLoginWithCompany(userId, companyId, branchId) {
+    async validateAndLoginWithCompany(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -425,7 +430,7 @@ export class AuthenticationService {
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
     // Token Management
-    /** Refresh access token (with token rotation). Returns new access token and new refresh token. */ async refreshToken(refreshToken) {
+    async refreshToken(refreshToken) {
         try {
             const payload = this.jwtService.verify(refreshToken, {
                 secret: this.authConfig.getRefreshTokenSecret()
@@ -459,7 +464,7 @@ export class AuthenticationService {
             throw new UnauthorizedException('Invalid or expired refresh token');
         }
     }
-    /** Change password */ async changePassword(userId, currentPassword, newPassword) {
+    async changePassword(userId, currentPassword, newPassword) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -473,7 +478,7 @@ export class AuthenticationService {
         user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
     }
-    /** Logout - Revokes all tokens. Stores revocation timestamp in cache. */ async logout(userId) {
+    async logout(userId) {
         if (!this.cacheManager) {
             // Cache is required for secure logout - tokens cannot be revoked without it
             this.logger.error(`SECURITY: Cache not available for logout (userId: ${userId}). ` + 'Token revocation failed - tokens will remain valid until expiry. ' + 'Configure cache (Redis) to enable proper token revocation.');
@@ -487,7 +492,7 @@ export class AuthenticationService {
         await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
         this.logger.log(`User ${userId} logged out - all tokens revoked`);
     }
-    /** Check if a token is revoked (issued before user's revocation timestamp) */ async isTokenRevoked(userId, tokenIssuedAt) {
+    async isTokenRevoked(userId, tokenIssuedAt) {
         if (!this.cacheManager || !tokenIssuedAt) {
             return false;
         }
@@ -499,7 +504,7 @@ export class AuthenticationService {
         // Token is revoked if it was issued before the revocation timestamp
         return tokenIssuedAt < revokedAt;
     }
-    /** Parse JWT expiry string to milliseconds */ parseExpiryToMs(expiry) {
+    parseExpiryToMs(expiry) {
         const match = expiry.match(/^(\d+)([smhd])$/);
         if (!match) return 7 * 24 * 60 * 60 * 1000; // Default 7 days
         const value = parseInt(match[1], 10);
@@ -518,7 +523,7 @@ export class AuthenticationService {
         }
     }
     // Query Methods
-    /** Get user's companies */ async getUserCompanies(userId) {
+    async getUserCompanies(userId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
@@ -539,7 +544,7 @@ export class AuthenticationService {
             active: true
         }).orderBy('c.name', 'ASC').getMany();
     }
-    /** Get branches for a company that user has access to */ async getUserBranches(userId, companyId) {
+    async getUserBranches(userId, companyId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
@@ -574,7 +579,7 @@ export class AuthenticationService {
             active: true
         }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
     }
-    /** Get company by ID */ async getCompanyById(companyId) {
+    async getCompanyById(companyId) {
         const companyRepository = await this.getCompanyRepository();
         if (!companyRepository) {
             return null;
@@ -585,7 +590,7 @@ export class AuthenticationService {
             }
         });
     }
-    /** Get branch by ID */ async getBranchById(branchId) {
+    async getBranchById(branchId) {
         const branchRepository = await this.getBranchRepository();
         if (!branchRepository) {
             return null;
@@ -596,7 +601,7 @@ export class AuthenticationService {
             }
         });
     }
-    /** Get user info for /auth/me endpoint. Returns user, company, and branch info (no tokens). */ async getUserInfo(userId, companyId, branchId) {
+    async getUserInfo(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -643,7 +648,7 @@ export class AuthenticationService {
         return user;
     }
     // Response Generators
-    /** Create user info object */ toUserInfo(user) {
+    toUserInfo(user) {
         return {
             id: user.id,
             email: user.email,
@@ -652,7 +657,7 @@ export class AuthenticationService {
             profilePictureId: user.profilePictureId ?? null
         };
     }
-    /** Create company info object */ toCompanyInfo(company) {
+    toCompanyInfo(company) {
         return {
             id: company.id,
             name: company.name,
@@ -660,7 +665,7 @@ export class AuthenticationService {
             logoId: company.logoId ?? null
         };
     }
-    /** Create branch info object */ toBranchInfo(branch) {
+    toBranchInfo(branch) {
         return {
             id: branch.id,
             name: branch.name,
@@ -668,7 +673,7 @@ export class AuthenticationService {
             logoId: branch.logoId ?? null
         };
     }
-    /** Generate JWT tokens */ generateTokens(payload) {
+    generateTokens(payload) {
         const accessToken = this.jwtService.sign({
             ...payload,
             type: 'access'

package/modules/auth.module.d.ts

@@ -1,13 +1,15 @@
+import { IBootstrapAppConfig } from '@flusys/nestjs-core';
 import { DynamicModule } from '@nestjs/common';
 import { AuthModuleAsyncOptions, AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 export declare class AuthModule {
     static forRoot(options: AuthModuleOptions): DynamicModule;
     static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule;
     private static buildModule;
+    private static getFeatureFlags;
     private static buildImports;
     private static buildControllers;
     private static buildProviders;
     private static buildExports;
     private static createAsyncProviders;
-    static getEntities(enableCompanyFeature?: boolean): any[];
+    static getEntities(config: IBootstrapAppConfig): any[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -91,7 +91,7 @@
     "typeorm": "^0.3.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "1.0.1",
-    "@flusys/nestjs-shared": "1.0.1"
+    "@flusys/nestjs-core": "1.1.0",
+    "@flusys/nestjs-shared": "1.1.0"
   }
 }

package/services/auth-config.service.d.ts

@@ -10,6 +10,7 @@ export declare class AuthConfigService implements IModuleConfigService {
     getDatabaseMode(): DatabaseMode;
     isMultiTenant(): boolean;
     isCompanyFeatureEnabled(): boolean;
+    isEmailVerificationEnabled(): boolean;
     getJwtSecret(): string;
     getJwtExpiration(): string;
     getRefreshTokenSecret(): string;

package/services/auth-datasource.provider.d.ts

@@ -18,6 +18,7 @@ export declare class AuthDataSourceProvider extends MultiTenantDataSourceService
     protected getOrCreateTenantConnection(tenant: ITenantDatabaseConfig): Promise<DataSource>;
     private static buildParentOptions;
     isCompanyFeatureEnabled(tenant?: ITenantDatabaseConfig): boolean;
+    isEmailVerificationEnabled(tenant?: ITenantDatabaseConfig): boolean;
     getAuthEntities(): Promise<any[]>;
     protected createDataSourceFromConfig(config: IDatabaseConfig): Promise<DataSource>;
 }

package/services/authentication.service.d.ts

@@ -19,6 +19,7 @@ export declare class AuthenticationService {
     private readonly logger;
     constructor(jwtService: JwtService, authConfig: AuthConfigService, cacheManager?: HybridCache, dataSourceProvider?: AuthDataSourceProvider, sessionService?: CompanySelectionSessionService, authEmailService?: AuthEmailService);
     private isCompanyFeatureEnabled;
+    private isEmailVerificationEnabled;
     private getUserRepository;
     private getPermissionRepository;
     private getCompanyRepository;