@flusys/nestjs-auth 1.1.0-beta → 1.1.0

package/fesm/modules/auth.module.js

@@ -5,98 +5,63 @@ function _ts_decorate(decorators, target, key, desc) {
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 import { CacheModule, UtilsModule } from '@flusys/nestjs-shared/modules';
-import { Module, Scope } from '@nestjs/common';
+import { Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
-import { getRepositoryToken } from '@nestjs/typeorm';
-import { AuthConfigService } from '../services/auth-config.service';
-import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
-import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
-import { AuthenticationController, BranchController, CompanyController, CompanySelectionController, UserController, UserPermissionController } from '../controllers';
-import { Company, CompanyBranch, User, UserCompanyPermission } from '../entities';
 import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
+import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
+import { AuthenticationController, BranchController, CompanyController, CompanySelectionController, EmailVerificationController, UserController, UserPermissionController } from '../controllers';
+import { getEntitiesByConfig } from '../entities';
 import { ClearToken } from '../interceptors/clear-token.interceptor';
 import { SetToken } from '../interceptors/set-token.interceptor';
 import { AuthEmailService, AuthenticationService, BranchService, CompanySelectionSessionService, CompanyService, UserPermissionService, UserService } from '../services';
+import { AuthConfigService } from '../services/auth-config.service';
+import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
 import { JwtStrategy } from '../strategies/jwt.strategy';
 export class AuthModule {
     static forRoot(options) {
-        return this.buildDynamicModule(options);
+        const optionsProvider = {
+            provide: AUTH_MODULE_OPTIONS,
+            useValue: options
+        };
+        return this.buildModule(options, [
+            optionsProvider,
+            ...options.providers ?? []
+        ]);
     }
-    static forRootAsync(asyncOptions) {
-        const { global = false, includeController = true, bootstrapAppConfig: { enableCompanyFeature } = {}, imports: externalImports = [], providers: additionalProviders = [] } = asyncOptions;
-        const asyncProviders = this.createAsyncProviders(asyncOptions);
-        // Build imports
-        const imports = [
-            ...externalImports,
-            PassportModule.register({
-                defaultStrategy: 'jwt'
-            }),
-            JwtModule.register({}),
-            CacheModule,
-            UtilsModule
-        ];
-        // Build controllers based on configuration
-        const controllers = [];
-        if (includeController) {
-            // Core authentication controller (always included)
-            controllers.push(AuthenticationController);
-            // User controller (always included)
-            controllers.push(UserController);
-            // Company feature controllers (conditional)
-            if (enableCompanyFeature) {
-                controllers.push(CompanySelectionController, CompanyController, BranchController, UserPermissionController);
-            }
-        }
-        // Build providers
-        const providers = [
+    static forRootAsync(options) {
+        const asyncProviders = this.createAsyncProviders(options);
+        return this.buildModule(options, [
             ...asyncProviders,
-            ...additionalProviders,
-            // Config & Infrastructure
-            AuthConfigService,
-            AuthDataSourceProvider,
-            // Auth core
-            JwtStrategy,
-            JwtAuthGuard,
-            AuthenticationService,
-            AuthEmailService,
-            // Interceptors
-            SetToken,
-            ClearToken,
-            // Core services (always included)
-            UserService
-        ];
-        // Company feature services (conditional)
-        if (enableCompanyFeature) {
-            providers.push(CompanySelectionSessionService, CompanyService, BranchService, UserPermissionService);
-        }
-        // Build exports
-        const exports = [
-            PassportModule,
-            AUTH_MODULE_OPTIONS,
-            AuthConfigService,
-            AuthDataSourceProvider,
-            JwtStrategy,
-            JwtAuthGuard,
-            AuthenticationService,
-            AuthEmailService,
-            UserService
-        ];
-        if (enableCompanyFeature) {
-            exports.push(CompanySelectionSessionService, CompanyService, BranchService, UserPermissionService);
-        }
+            ...options.providers ?? []
+        ], options.imports);
+    }
+    static buildModule(options, providers, externalImports = []) {
+        const { global = false, includeController = true, bootstrapAppConfig } = options;
+        const featureFlags = this.getFeatureFlags(bootstrapAppConfig);
         return {
             module: AuthModule,
             global,
-            imports,
-            controllers,
-            providers,
-            exports
+            imports: [
+                ...externalImports,
+                ...this.buildImports()
+            ],
+            controllers: this.buildControllers(includeController, featureFlags),
+            providers: [
+                ...providers,
+                ...this.buildProviders(featureFlags)
+            ],
+            exports: this.buildExports(featureFlags)
+        };
+    }
+    static getFeatureFlags(bootstrapAppConfig) {
+        return {
+            enableCompanyFeature: bootstrapAppConfig?.enableCompanyFeature ?? false,
+            enableEmailVerification: bootstrapAppConfig?.enableEmailVerification ?? true
         };
     }
-    static buildDynamicModule(options) {
-        const { bootstrapAppConfig: { enableCompanyFeature } = {}, includeController = true, global = false, providers: additionalProviders = [] } = options;
-        const imports = [
+    static buildImports() {
+        return [
             PassportModule.register({
                 defaultStrategy: 'jwt'
             }),
@@ -104,42 +69,41 @@ export class AuthModule {
             CacheModule,
             UtilsModule
         ];
-        // Build controllers based on configuration
-        const controllers = [];
-        if (includeController) {
-            // Core authentication controller (always included)
-            controllers.push(AuthenticationController);
-            // User controller (always included)
-            controllers.push(UserController);
-            // Company feature controllers (conditional)
-            if (enableCompanyFeature) {
-                controllers.push(CompanySelectionController, CompanyController, BranchController, UserPermissionController);
-            }
+    }
+    static buildControllers(includeController, flags) {
+        if (!includeController) return [];
+        const controllers = [
+            AuthenticationController,
+            UserController
+        ];
+        if (flags.enableEmailVerification) {
+            controllers.push(EmailVerificationController);
         }
+        if (flags.enableCompanyFeature) {
+            controllers.push(CompanySelectionController, CompanyController, BranchController, UserPermissionController);
+        }
+        return controllers;
+    }
+    static buildProviders(flags) {
         const providers = [
-            {
-                provide: AUTH_MODULE_OPTIONS,
-                useValue: options
-            },
-            ...additionalProviders,
-            // Config & Infrastructure
             AuthConfigService,
             AuthDataSourceProvider,
-            // Auth core
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
-            AuthEmailService,
-            // Interceptors
             SetToken,
             ClearToken,
-            // Core services (always included)
             UserService
         ];
-        // Company feature services (conditional)
-        if (enableCompanyFeature) {
+        if (flags.enableEmailVerification) {
+            providers.push(AuthEmailService);
+        }
+        if (flags.enableCompanyFeature) {
             providers.push(CompanySelectionSessionService, CompanyService, BranchService, UserPermissionService);
         }
+        return providers;
+    }
+    static buildExports(flags) {
         const exports = [
             PassportModule,
             AUTH_MODULE_OPTIONS,
@@ -148,20 +112,15 @@ export class AuthModule {
             JwtStrategy,
             JwtAuthGuard,
             AuthenticationService,
-            AuthEmailService,
             UserService
         ];
-        if (enableCompanyFeature) {
+        if (flags.enableEmailVerification) {
+            exports.push(AuthEmailService);
+        }
+        if (flags.enableCompanyFeature) {
             exports.push(CompanySelectionSessionService, CompanyService, BranchService, UserPermissionService);
         }
-        return {
-            module: AuthModule,
-            global,
-            imports,
-            controllers,
-            providers,
-            exports
-        };
+        return exports;
     }
     static createAsyncProviders(options) {
         const staticOptions = {
@@ -173,13 +132,10 @@ export class AuthModule {
             return [
                 {
                     provide: AUTH_MODULE_OPTIONS,
-                    useFactory: async (...args)=>{
-                        const config = await options.useFactory(...args);
-                        return {
+                    useFactory: async (...args)=>({
                             ...staticOptions,
-                            config
-                        };
-                    },
+                            config: await options.useFactory(...args)
+                        }),
                     inject: options.inject || []
                 }
             ];
@@ -192,13 +148,10 @@ export class AuthModule {
                 },
                 {
                     provide: AUTH_MODULE_OPTIONS,
-                    useFactory: async (factory)=>{
-                        const config = await factory.createAuthOptions();
-                        return {
+                    useFactory: async (factory)=>({
                             ...staticOptions,
-                            config
-                        };
-                    },
+                            config: await factory.createAuthOptions()
+                        }),
                     inject: [
                         options.useClass
                     ]
@@ -209,13 +162,10 @@ export class AuthModule {
             return [
                 {
                     provide: AUTH_MODULE_OPTIONS,
-                    useFactory: async (factory)=>{
-                        const config = await factory.createAuthOptions();
-                        return {
+                    useFactory: async (factory)=>({
                             ...staticOptions,
-                            config
-                        };
-                    },
+                            config: await factory.createAuthOptions()
+                        }),
                     inject: [
                         options.useExisting
                     ]
@@ -229,36 +179,11 @@ export class AuthModule {
             }
         ];
     }
-    /**
-   * Create repository providers that use AuthDataSourceProvider
-   * This replaces TypeOrmModule.forFeature() functionality
-   * Note: Must be REQUEST-scoped since AuthDataSourceProvider is REQUEST-scoped
-   */ static getRepositoryProviders(enableCompanyFeature) {
-        const entities = this.getEntities(enableCompanyFeature);
-        return entities.map((entity)=>({
-                provide: getRepositoryToken(entity),
-                scope: Scope.REQUEST,
-                useFactory: async (dataSourceProvider)=>{
-                    return await dataSourceProvider.getRepository(entity);
-                },
-                inject: [
-                    AuthDataSourceProvider
-                ]
-            }));
-    }
-    static getEntities(enableCompanyFeature = false) {
-        const coreEntities = [
-            User
-        ];
-        const companyEntities = enableCompanyFeature ? [
-            Company,
-            CompanyBranch,
-            UserCompanyPermission
-        ] : [];
-        return [
-            ...coreEntities,
-            ...companyEntities
-        ];
+    static getEntities(config) {
+        return getEntitiesByConfig({
+            enableCompanyFeature: config.enableCompanyFeature ?? false,
+            enableEmailVerification: config.enableEmailVerification ?? true
+        });
     }
 }
 AuthModule = _ts_decorate([

package/fesm/services/auth-config.service.js

@@ -25,65 +25,63 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { Inject, Injectable, Optional } from '@nestjs/common';
-import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
+import { envConfig } from '@flusys/nestjs-core/config';
+import { Inject, Injectable, InternalServerErrorException, Logger, Optional } from '@nestjs/common';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
+import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 export class AuthConfigService {
-    // Database Mode
-    /** Get database mode (single or multi-tenant) */ getDatabaseMode() {
+    // Database Mode (required by IModuleConfigService)
+    getDatabaseMode() {
         return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
     }
-    /** Check if running in multi-tenant mode */ isMultiTenant() {
+    isMultiTenant() {
         return this.getDatabaseMode() === 'multi-tenant';
     }
     // Feature Flags
-    /** Check if company feature is enabled */ isCompanyFeatureEnabled() {
+    isCompanyFeatureEnabled() {
         return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
+    isEmailVerificationEnabled() {
+        return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
+    }
     // JWT Configuration
-    /** Get JWT secret key */ getJwtSecret() {
-        return this.config.jwtSecret ?? 'default-secret-change-in-production';
+    getJwtSecret() {
+        if (!this.config.jwtSecret) {
+            throw new InternalServerErrorException('[AuthModule] JWT_SECRET is required - set via environment or module config');
+        }
+        return this.config.jwtSecret;
     }
-    /** Get JWT expiration time */ getJwtExpiration() {
+    getJwtExpiration() {
         return this.config.jwtExpiration ?? '1h';
     }
-    /** Get refresh token secret key */ getRefreshTokenSecret() {
-        return this.config.refreshTokenSecret ?? this.getJwtSecret();
-    }
-    /** Get refresh token expiration time */ getRefreshTokenExpiration() {
+    getRefreshTokenSecret() {
+        if (this.config.refreshTokenSecret) {
+            return this.config.refreshTokenSecret;
+        }
+        if (envConfig.isProduction()) {
+            throw new InternalServerErrorException('[AuthModule] REFRESH_TOKEN_SECRET is required in production - ' + 'using the same secret for access and refresh tokens is a security risk');
+        }
+        if (!this.refreshTokenSecretWarned) {
+            this.refreshTokenSecretWarned = true;
+            this.logger.warn('REFRESH_TOKEN_SECRET not configured - using JWT_SECRET as fallback. ' + 'For better security, configure a separate refresh token secret.');
+        }
+        return this.getJwtSecret();
+    }
+    getRefreshTokenExpiration() {
         return this.config.refreshTokenExpiration ?? '7d';
     }
-    /** Get refresh token cookie name */ getRefreshTokenCookieName() {
+    getRefreshTokenCookieName() {
         return this.config.refreshTokenCookieName ?? 'fsn_refresh_token';
     }
     // Frontend Configuration
-    /** Get frontend URL for email links */ getFrontendUrl() {
+    getFrontendUrl() {
         return this.config.frontendUrl;
     }
-    // Database Configuration
-    /** Get default database config */ getDefaultDatabaseConfig() {
-        return this.config.defaultDatabaseConfig ?? this.config.tenantDefaultDatabaseConfig;
-    }
-    /** Get tenant default database config (for multi-tenant) */ getTenantDefaultDatabaseConfig() {
-        return this.config.tenantDefaultDatabaseConfig;
-    }
-    /** Get registered tenants */ getTenants() {
-        return this.config.tenants ?? [];
-    }
-    // Raw Options
-    /** Get full module options */ getOptions() {
-        return {
-            ...this.options
-        };
-    }
-    /** Get runtime config */ getConfig() {
-        return {
-            ...this.config
-        };
-    }
     constructor(injectedOptions){
+        _define_property(this, "logger", new Logger(AuthConfigService.name));
         _define_property(this, "options", void 0);
         _define_property(this, "config", void 0);
+        _define_property(this, "refreshTokenSecretWarned", false);
         this.options = injectedOptions ?? {
             global: false,
             includeController: true

package/fesm/services/auth-datasource.provider.js

@@ -26,14 +26,13 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { MultiTenantDataSourceService } from '@flusys/nestjs-shared/modules';
-import { Inject, Injectable, Logger, Optional, Scope } from '@nestjs/common';
+import { Inject, Injectable, InternalServerErrorException, Logger, Optional, Scope } from '@nestjs/common';
 import { REQUEST } from '@nestjs/core';
 import { Request } from 'express';
 import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 import { AUTH_MODULE_OPTIONS } from '../config/auth.constants';
 export class AuthDataSourceProvider extends MultiTenantDataSourceService {
-    // Override Static Cache Access Methods
-    /** Override to access Auth-specific static properties */ async getSingleDataSource() {
+    async getSingleDataSource() {
         if (!AuthDataSourceProvider.singleDataSource) {
             if (AuthDataSourceProvider.singleConnectionLock) {
                 return AuthDataSourceProvider.singleConnectionLock;
@@ -41,7 +40,7 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
             const lockPromise = (async ()=>{
                 const config = this.getDefaultDatabaseConfig();
                 if (!config) {
-                    throw new Error('Default database config is not available');
+                    throw new InternalServerErrorException('Default database config is not available');
                 }
                 const ds = await this.createDataSourceFromConfig(config);
                 AuthDataSourceProvider.singleDataSource = ds;
@@ -57,18 +56,15 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
         }
         return AuthDataSourceProvider.singleDataSource;
     }
-    /** Override to use Auth-specific static cache for tenant connections */ async getOrCreateTenantConnection(tenant) {
-        // Return existing initialized connection from Auth-specific cache
+    async getOrCreateTenantConnection(tenant) {
         const existing = AuthDataSourceProvider.tenantConnections.get(tenant.id);
         if (existing?.isInitialized) {
             return existing;
         }
-        // If another request is creating this tenant's connection, wait for it
         const pendingConnection = AuthDataSourceProvider.connectionLocks.get(tenant.id);
         if (pendingConnection) {
             return pendingConnection;
         }
-        // Create connection with lock to prevent race conditions
         const config = this.buildTenantDatabaseConfig(tenant);
         const connectionPromise = this.createDataSourceFromConfig(config);
         AuthDataSourceProvider.connectionLocks.set(tenant.id, connectionPromise);
@@ -80,8 +76,7 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
             AuthDataSourceProvider.connectionLocks.delete(tenant.id);
         }
     }
-    // Factory Methods
-    /** Build parent options from AuthModuleOptions */ static buildParentOptions(options) {
+    static buildParentOptions(options) {
         return {
             bootstrapAppConfig: options.bootstrapAppConfig,
             defaultDatabaseConfig: options.config?.defaultDatabaseConfig,
@@ -89,47 +84,28 @@ export class AuthDataSourceProvider extends MultiTenantDataSourceService {
             tenants: options.config?.tenants
         };
     }
-    // Feature Flags
-    /** Get global enable company feature flag */ getEnableCompanyFeature() {
-        return this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
+    isCompanyFeatureEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableCompanyFeature ?? this.authOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
     }
-    /** Get enable company feature for specific tenant. Falls back to global setting. */ getEnableCompanyFeatureForTenant(tenant) {
-        return tenant?.enableCompanyFeature ?? this.getEnableCompanyFeature();
+    isEmailVerificationEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableEmailVerification ?? this.authOptions.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
-    /** Get enable company feature for current request context */ getEnableCompanyFeatureForCurrentTenant() {
-        return this.getEnableCompanyFeatureForTenant(this.getCurrentTenant() ?? undefined);
-    }
-    // Entity Management
-    /** Get auth entities based on company feature flag */ async getAuthEntities(enableCompanyFeature) {
-        const enable = enableCompanyFeature ?? this.getEnableCompanyFeature();
-        const { Company, CompanyBranch, User, UserCompanyPermission, UserToken, PendingRegistration } = await import('../entities');
-        const coreEntities = [
-            User,
-            UserToken,
-            PendingRegistration
-        ];
-        const companyEntities = enable ? [
-            Company,
-            CompanyBranch,
-            UserCompanyPermission
-        ] : [];
-        return [
-            ...coreEntities,
-            ...companyEntities
-        ];
+    async getAuthEntities() {
+        const { getEntitiesByConfig } = await import('../entities');
+        return getEntitiesByConfig({
+            enableCompanyFeature: this.isCompanyFeatureEnabled(),
+            enableEmailVerification: this.isEmailVerificationEnabled()
+        });
     }
-    // Overrides
-    /** Override to dynamically set entities based on tenant config */ async createDataSourceFromConfig(config) {
-        const currentTenant = this.getCurrentTenant();
-        const enableCompanyFeature = this.getEnableCompanyFeatureForTenant(currentTenant ?? undefined);
-        const entities = await this.getAuthEntities(enableCompanyFeature);
-        return super.createDataSourceFromConfig(config, entities);
+    async createDataSourceFromConfig(config) {
+        return super.createDataSourceFromConfig(config, await this.getAuthEntities());
     }
     constructor(authOptions, request){
         super(AuthDataSourceProvider.buildParentOptions(authOptions), request), _define_property(this, "authOptions", void 0), _define_property(this, "logger", void 0), this.authOptions = authOptions, this.logger = new Logger(AuthDataSourceProvider.name);
     }
 }
-// Override parent's static properties to have Auth-specific cache (isolated from IAM/Storage)
 _define_property(AuthDataSourceProvider, "tenantConnections", new Map());
 _define_property(AuthDataSourceProvider, "singleDataSource", null);
 _define_property(AuthDataSourceProvider, "tenantsRegistry", new Map());