@flusys/nestjs-auth 1.1.0-beta → 1.1.0

package/fesm/services/authentication.service.js

@@ -25,75 +25,77 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
+import { HybridCache } from '@flusys/nestjs-shared/classes';
+import { ErrorHandler, generateUniqueSlug } from '@flusys/nestjs-shared/utils';
 import { BadRequestException, Inject, Injectable, Logger, NotFoundException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
-import { InjectRepository } from '@nestjs/typeorm';
 import * as bcrypt from 'bcrypt';
-import { Repository } from 'typeorm';
-import { ErrorHandler } from '@flusys/nestjs-shared/utils';
-import { AuthConfigService } from './auth-config.service';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
-import { PermissionType } from '../enums';
 import { BCRYPT_SALT_ROUNDS, TOKEN_REVOKED_PREFIX } from '../config';
-import { HybridCache } from '@flusys/nestjs-shared/classes';
-import { AuthEmailService } from './auth-email.service';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { User } from '../entities/user.entity';
+import { PermissionType } from '../enums';
+import { AuthConfigService } from './auth-config.service';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { AuthEmailService } from './auth-email.service';
 import { CompanySelectionSessionService } from './company-selection-session.service';
 export class AuthenticationService {
+    // Feature Flags
+    isCompanyFeatureEnabled() {
+        return this.dataSourceProvider?.isCompanyFeatureEnabled() ?? this.authConfig.isCompanyFeatureEnabled();
+    }
+    isEmailVerificationEnabled() {
+        const featureEnabled = this.dataSourceProvider?.isEmailVerificationEnabled() ?? this.authConfig.isEmailVerificationEnabled();
+        const providerAvailable = this.authEmailService?.isEmailEnabled() ?? false;
+        return featureEnabled && providerAvailable;
+    }
     // Repository Getters
     async getUserRepository() {
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(User);
+        if (!this.dataSourceProvider) {
+            throw new Error('User repository not available');
         }
-        if (this.injectedUserRepository) {
-            return this.injectedUserRepository;
-        }
-        throw new Error('User repository not available');
+        return this.dataSourceProvider.getRepository(User);
     }
     async getPermissionRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(UserCompanyPermission);
-        }
-        return this.injectedPermissionRepository ?? null;
+        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(UserCompanyPermission);
     }
     async getCompanyRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(Company);
-        }
-        return this.injectedCompanyRepository ?? null;
+        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(Company);
     }
     async getBranchRepository() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) return null;
-        if (this.dataSourceProvider) {
-            return this.dataSourceProvider.getRepository(CompanyBranch);
-        }
-        return this.injectedBranchRepository ?? null;
+        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
+        return this.dataSourceProvider.getRepository(CompanyBranch);
     }
     // Login
-    /** Login with email and password. Returns tokens or requires company/branch selection. */ async login(email, password) {
+    async login(email, password) {
+        // Check for pending registration first (user registered but hasn't verified email yet)
+        if (this.isEmailVerificationEnabled() && await this.authEmailService.hasPendingRegistration(email)) {
+            return {
+                requiresEmailVerification: true,
+                email,
+                message: 'Please verify your email address to complete registration.'
+            };
+        }
         const user = await this.validateUser(email, password);
         if (!user.isActive) {
             throw new UnauthorizedException('User account is deactivated');
         }
-        // Check email verification if email service is enabled
-        if (this.authEmailService?.isEmailEnabled() && !user.emailVerified) {
+        if (this.isEmailVerificationEnabled() && !user.emailVerified) {
             return {
                 requiresEmailVerification: true,
                 email: user.email,
                 message: 'Please verify your email address before logging in.'
             };
         }
-        if (!this.authConfig.isCompanyFeatureEnabled()) {
+        if (!this.isCompanyFeatureEnabled()) {
             return this.generateLoginResponse(user);
         }
         return this.handleCompanyBasedLogin(user);
     }
-    /** Handle login when company feature is enabled */ async handleCompanyBasedLogin(user) {
+    async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !branchRepository) {
@@ -120,7 +122,7 @@ export class AuthenticationService {
         // If user has no company assignments yet, return simple login response
         // This allows users to login and be assigned to companies later
         if (companies.length === 0) {
-            return this.generateLoginResponse(user, true);
+            return this.generateLoginResponse(user);
         }
         // Get branch permissions
         const branchPermissions = await permissionRepository.find({
@@ -144,19 +146,24 @@ export class AuthenticationService {
         return await this.generateCompanySelectionResponse(user, companies, branches);
     }
     // Registration
-    /** Register a new user. If email enabled, creates pending registration. Otherwise creates user directly. */ async register(dto, verifyUrlBase) {
+    async register(dto, verifyUrlBase) {
         const userRepository = await this.getUserRepository();
         const existingUser = await userRepository.findOne({
             where: {
                 email: dto.email
             }
         });
+        // When company feature is enabled and user exists, allow joining/creating company
+        if (existingUser && this.isCompanyFeatureEnabled()) {
+            return this.handleExistingUserCompanyRegistration(existingUser, dto);
+        }
+        // User exists but company feature is off - email must be unique
         if (existingUser) {
-            throw new BadRequestException('Registration failed. Please try again or contact support.');
+            throw new BadRequestException('Registration failed due to email exists. Please try again or contact support.');
         }
         // If email verification is enabled, create pending registration instead of user
-        if (this.authEmailService?.isEmailEnabled() && verifyUrlBase) {
-            const companyData = this.authConfig.isCompanyFeatureEnabled() ? {
+        if (this.isEmailVerificationEnabled() && verifyUrlBase) {
+            const companyData = this.isCompanyFeatureEnabled() ? {
                 companySlug: dto.companySlug,
                 branchSlug: dto.branchSlug,
                 newCompanyName: dto.newCompanyName,
@@ -179,7 +186,39 @@ export class AuthenticationService {
         // No email verification - create user directly
         return this.createUserDirectly(dto);
     }
-    /** Create user directly (no email verification) */ async createUserDirectly(dto) {
+    async handleExistingUserCompanyRegistration(existingUser, dto) {
+        if (!dto.companySlug && !dto.newCompanyName) {
+            throw new BadRequestException('Email already registered. Please login or provide a company to join/create.');
+        }
+        const permissionRepository = await this.getPermissionRepository();
+        const companyRepository = await this.getCompanyRepository();
+        if (!permissionRepository || !companyRepository) {
+            throw new BadRequestException('Company feature repositories not available');
+        }
+        // For existing users joining a company, check if already assigned
+        if (dto.companySlug) {
+            const company = await companyRepository.findOne({
+                where: {
+                    slug: dto.companySlug,
+                    isActive: true
+                }
+            });
+            if (company) {
+                const existingPermission = await permissionRepository.findOne({
+                    where: {
+                        userId: existingUser.id,
+                        permissionType: PermissionType.COMPANY,
+                        targetId: company.id
+                    }
+                });
+                if (existingPermission) {
+                    throw new BadRequestException('You are already assigned to this company. Please login.');
+                }
+            }
+        }
+        return this.processCompanyRegistration(existingUser, dto, true);
+    }
+    async createUserDirectly(dto) {
         const userRepository = await this.getUserRepository();
         const hashedPassword = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
         const user = userRepository.create({
@@ -192,14 +231,13 @@ export class AuthenticationService {
             phoneVerified: false
         });
         await userRepository.save(user);
-        if (!this.authConfig.isCompanyFeatureEnabled()) {
-            return this.generateRegistrationResponse(user, false, false);
+        if (!this.isCompanyFeatureEnabled()) {
+            return this.generateRegistrationResponse(user);
         }
-        return this.handleCompanyRegistration(user, dto, false);
+        return this.processCompanyRegistration(user, dto);
     }
-    /** Create user from pending registration (after email verification) */ async createUserFromPendingRegistration(pending) {
+    async createUserFromPendingRegistration(pending) {
         const userRepository = await this.getUserRepository();
-        // Check if user already exists (race condition protection)
         const existingUser = await userRepository.findOne({
             where: {
                 email: pending.email
@@ -208,7 +246,6 @@ export class AuthenticationService {
         if (existingUser) {
             throw new BadRequestException('This email has already been registered.');
         }
-        // Create user with verified email
         const user = userRepository.create({
             name: pending.name,
             email: pending.email,
@@ -219,110 +256,106 @@ export class AuthenticationService {
             phoneVerified: false
         });
         await userRepository.save(user);
-        // Handle company feature if enabled
-        if (this.authConfig.isCompanyFeatureEnabled() && pending.companyData) {
-            return this.handleCompanyRegistrationFromPending(user, pending.companyData);
+        if (this.isCompanyFeatureEnabled() && pending.companyData) {
+            return this.processCompanyRegistration(user, pending.companyData);
         }
-        return this.generateRegistrationResponse(user, this.authConfig.isCompanyFeatureEnabled(), false);
-    }
-    /** Handle company registration from pending registration data */ async handleCompanyRegistrationFromPending(user, companyData) {
-        return this.processCompanyRegistration(user, companyData, false);
+        return this.generateRegistrationResponse(user);
     }
-    /** Handle company-related registration logic */ async handleCompanyRegistration(user, dto, requiresEmailVerification) {
-        return this.processCompanyRegistration(user, dto, requiresEmailVerification);
-    }
-    /** Shared logic for company registration (join existing or create new) */ async processCompanyRegistration(user, data, requiresEmailVerification) {
+    async processCompanyRegistration(user, data, throwOnUnavailable = false) {
         const companyRepository = await this.getCompanyRepository();
         const branchRepository = await this.getBranchRepository();
         const permissionRepository = await this.getPermissionRepository();
         if (!companyRepository || !branchRepository || !permissionRepository) {
-            return this.generateRegistrationResponse(user, true, requiresEmailVerification);
+            if (throwOnUnavailable) throw new BadRequestException('Company feature repositories not available');
+            return this.generateRegistrationResponse(user);
+        }
+        const { company, branch } = await this.findOrCreateCompanyAndBranch(data, companyRepository, branchRepository);
+        if (company) {
+            await this.assignUserPermissions(user.id, company.id, branch?.id, permissionRepository);
+            return this.generateRegistrationResponseWithCompany(user, company, branch ?? undefined);
         }
-        let company = null;
-        let branch = null;
+        return this.generateRegistrationResponse(user);
+    }
+    async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
         if (data.companySlug) {
-            company = await companyRepository.findOne({
+            const company = await companyRepo.findOne({
                 where: {
                     slug: data.companySlug,
                     isActive: true
                 }
             });
-            if (!company) {
-                throw new BadRequestException('Company not found or inactive');
-            }
-            if (data.branchSlug) {
-                branch = await branchRepository.findOne({
-                    where: {
-                        slug: data.branchSlug,
-                        companyId: company.id,
-                        isActive: true
-                    }
-                });
-                if (!branch) {
-                    throw new BadRequestException('Branch not found or inactive');
+            if (!company) throw new BadRequestException('Company not found or inactive');
+            const branch = data.branchSlug ? await branchRepo.findOne({
+                where: {
+                    slug: data.branchSlug,
+                    companyId: company.id,
+                    isActive: true
                 }
-            } else {
-                branch = await branchRepository.findOne({
-                    where: {
-                        companyId: company.id,
-                        isActive: true
-                    },
-                    order: {
-                        serial: 'ASC',
-                        createdAt: 'ASC'
-                    }
-                });
-            }
-        } else if (data.newCompanyName) {
-            const slug = this.generateSlug(data.newCompanyName);
-            const existingCompany = await companyRepository.findOne({
+            }) : await branchRepo.findOne({
                 where: {
-                    slug
+                    companyId: company.id,
+                    isActive: true
+                },
+                order: {
+                    serial: 'ASC',
+                    createdAt: 'ASC'
                 }
             });
-            if (existingCompany) {
-                throw new BadRequestException('Company creation failed. Please try a different name.');
-            }
-            company = companyRepository.create({
+            if (data.branchSlug && !branch) throw new BadRequestException('Branch not found or inactive');
+            return {
+                company,
+                branch
+            };
+        }
+        if (data.newCompanyName) {
+            const slug = await generateUniqueSlug(data.newCompanyName, async (baseSlug)=>{
+                const rows = await companyRepo.createQueryBuilder('c').select('c.slug').where('c.slug = :base OR c.slug LIKE :pattern', {
+                    base: baseSlug,
+                    pattern: `${baseSlug}-%`
+                }).getMany();
+                return rows.map((r)=>r.slug);
+            });
+            const company = companyRepo.create({
                 name: data.newCompanyName,
                 slug,
                 phone: data.newCompanyPhone,
                 address: data.newCompanyAddress,
                 isActive: true
             });
-            await companyRepository.save(company);
-            branch = branchRepository.create({
+            await companyRepo.save(company);
+            const branch = branchRepo.create({
                 name: 'Main Branch',
                 slug: 'main-branch',
                 companyId: company.id,
                 isActive: true
             });
-            await branchRepository.save(branch);
-        }
-        if (company) {
-            const companyPermission = permissionRepository.create({
-                userId: user.id,
-                permissionType: PermissionType.COMPANY,
-                targetId: company.id
-            });
-            await permissionRepository.save(companyPermission);
-            if (branch) {
-                const branchPermission = permissionRepository.create({
-                    userId: user.id,
-                    permissionType: PermissionType.BRANCH,
-                    targetId: branch.id
-                });
-                await permissionRepository.save(branchPermission);
-            }
-            return this.generateRegistrationResponseWithCompany(user, company, branch ?? undefined, requiresEmailVerification);
+            await branchRepo.save(branch);
+            return {
+                company,
+                branch
+            };
         }
-        return this.generateRegistrationResponse(user, true, requiresEmailVerification);
+        return {
+            company: null,
+            branch: null
+        };
     }
-    /** Generate URL-friendly slug from name */ generateSlug(name) {
-        return name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').substring(0, 100);
+    async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
+        await permissionRepo.save(permissionRepo.create({
+            userId,
+            permissionType: PermissionType.COMPANY,
+            targetId: companyId
+        }));
+        if (branchId) {
+            await permissionRepo.save(permissionRepo.create({
+                userId,
+                permissionType: PermissionType.BRANCH,
+                targetId: branchId
+            }));
+        }
     }
     // Company/Branch Selection
-    /** Select company and branch (step 2 of login). Frontend receives all options and user selects both. */ async select(sessionId, companyId, branchId) {
+    async select(sessionId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         if (!this.sessionService) {
             throw new BadRequestException('Session service not available');
@@ -331,66 +364,13 @@ export class AuthenticationService {
         if (!session) {
             throw new UnauthorizedException('Invalid or expired session');
         }
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                id: session.userId
-            }
-        });
-        if (!user) {
-            throw new NotFoundException('User not found');
-        }
-        const permissionRepository = await this.getPermissionRepository();
-        const companyRepository = await this.getCompanyRepository();
-        const branchRepository = await this.getBranchRepository();
-        if (!permissionRepository || !companyRepository || !branchRepository) {
-            throw new BadRequestException('Repositories not available');
-        }
-        // Validate company access
-        const companyPermission = await permissionRepository.findOne({
-            where: {
-                userId: user.id,
-                permissionType: PermissionType.COMPANY,
-                targetId: companyId
-            }
-        });
-        if (!companyPermission) {
-            throw new UnauthorizedException('No access to this company');
-        }
-        const company = await companyRepository.findOne({
-            where: {
-                id: companyId,
-                isActive: true
-            }
-        });
-        if (!company) {
-            throw new UnauthorizedException('Company not found or inactive');
-        }
-        // Validate branch access
-        const branchPermission = await permissionRepository.findOne({
-            where: {
-                userId: user.id,
-                permissionType: PermissionType.BRANCH,
-                targetId: branchId
-            }
-        });
-        if (!branchPermission) {
-            throw new UnauthorizedException('No access to this branch');
-        }
-        const branch = await branchRepository.findOne({
-            where: {
-                id: branchId,
-                companyId,
-                isActive: true
-            }
-        });
-        if (!branch) {
-            throw new UnauthorizedException('Branch not found or inactive');
-        }
-        return this.generateLoginResponseWithCompany(user, company, branch);
+        return this.validateAndLoginWithCompany(session.userId, companyId, branchId);
     }
-    /** Switch company/branch after login */ async switchCompany(userId, companyId, branchId) {
+    async switchCompany(userId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
+        return this.validateAndLoginWithCompany(userId, companyId, branchId);
+    }
+    async validateAndLoginWithCompany(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -407,14 +387,14 @@ export class AuthenticationService {
             throw new BadRequestException('Repositories not available');
         }
         // Validate company access
-        const companyPermission = await permissionRepository.findOne({
+        const hasCompanyAccess = await permissionRepository.findOne({
             where: {
                 userId,
                 permissionType: PermissionType.COMPANY,
                 targetId: companyId
             }
         });
-        if (!companyPermission) {
+        if (!hasCompanyAccess) {
             throw new UnauthorizedException('No access to this company');
         }
         const company = await companyRepository.findOne({
@@ -426,14 +406,15 @@ export class AuthenticationService {
         if (!company) {
             throw new UnauthorizedException('Company not found or inactive');
         }
-        const branchPermission = await permissionRepository.findOne({
+        // Validate branch access
+        const hasBranchAccess = await permissionRepository.findOne({
             where: {
                 userId,
                 permissionType: PermissionType.BRANCH,
                 targetId: branchId
             }
         });
-        if (!branchPermission) {
+        if (!hasBranchAccess) {
             throw new UnauthorizedException('No access to this branch');
         }
         const branch = await branchRepository.findOne({
@@ -449,11 +430,14 @@ export class AuthenticationService {
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
     // Token Management
-    /** Refresh access token (with token rotation). Returns new access token and new refresh token. */ async refreshToken(refreshToken) {
+    async refreshToken(refreshToken) {
         try {
             const payload = this.jwtService.verify(refreshToken, {
                 secret: this.authConfig.getRefreshTokenSecret()
             });
+            if (await this.isTokenRevoked(payload.id, payload.iat)) {
+                throw new UnauthorizedException('Token has been revoked');
+            }
             const userRepository = await this.getUserRepository();
             const user = await userRepository.findOne({
                 where: {
@@ -463,7 +447,7 @@ export class AuthenticationService {
             if (!user || !user.isActive) {
                 throw new UnauthorizedException('Invalid refresh token');
             }
-            const accessPayload = {
+            return this.generateTokens({
                 id: user.id,
                 email: user.email,
                 type: 'access',
@@ -473,69 +457,32 @@ export class AuthenticationService {
                 },
                 ...payload.branchId && {
                     branchId: payload.branchId
-                },
-                ...payload.companyLogoId && {
-                    companyLogoId: payload.companyLogoId
-                },
-                ...payload.branchLogoId && {
-                    branchLogoId: payload.branchLogoId
                 }
-            };
-            const refreshPayload = {
-                id: user.id,
-                email: user.email,
-                type: 'refresh',
-                profilePictureId: user.profilePictureId ?? undefined,
-                ...payload.companyId && {
-                    companyId: payload.companyId
-                },
-                ...payload.branchId && {
-                    branchId: payload.branchId
-                },
-                ...payload.companyLogoId && {
-                    companyLogoId: payload.companyLogoId
-                },
-                ...payload.branchLogoId && {
-                    branchLogoId: payload.branchLogoId
-                }
-            };
-            return {
-                accessToken: this.jwtService.sign(accessPayload, {
-                    secret: this.authConfig.getJwtSecret(),
-                    expiresIn: this.authConfig.getJwtExpiration()
-                }),
-                refreshToken: this.jwtService.sign(refreshPayload, {
-                    secret: this.authConfig.getRefreshTokenSecret(),
-                    expiresIn: this.authConfig.getRefreshTokenExpiration()
-                })
-            };
+            });
         } catch (error) {
-            // Log error details for debugging (not exposed to client)
             ErrorHandler.logError(this.logger, error, 'refreshToken');
             throw new UnauthorizedException('Invalid or expired refresh token');
         }
     }
-    /** Change password */ async changePassword(userId, currentPassword, newPassword) {
+    async changePassword(userId, currentPassword, newPassword) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
                 id: userId
             }
         });
-        if (!user) {
-            throw new UnauthorizedException('User not found');
-        }
-        const isPasswordValid = await bcrypt.compare(currentPassword, user.password || '');
-        if (!isPasswordValid) {
+        if (!user) throw new UnauthorizedException('User not found');
+        if (!await bcrypt.compare(currentPassword, user.password || '')) {
             throw new UnauthorizedException('Current password is incorrect');
         }
         user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
     }
-    /** Logout - Revokes all tokens. Stores revocation timestamp in cache. */ async logout(userId) {
+    async logout(userId) {
         if (!this.cacheManager) {
-            // Cache not available - graceful degradation (client-side logout only)
-            return;
+            // Cache is required for secure logout - tokens cannot be revoked without it
+            this.logger.error(`SECURITY: Cache not available for logout (userId: ${userId}). ` + 'Token revocation failed - tokens will remain valid until expiry. ' + 'Configure cache (Redis) to enable proper token revocation.');
+            throw new BadRequestException('Logout service temporarily unavailable. Please try again later.');
         }
         const revokedAt = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
         const cacheKey = `${TOKEN_REVOKED_PREFIX}:${userId}`;
@@ -543,8 +490,9 @@ export class AuthenticationService {
         const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
         const ttlMs = this.parseExpiryToMs(refreshTokenExpiry);
         await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+        this.logger.log(`User ${userId} logged out - all tokens revoked`);
     }
-    /** Check if a token is revoked (issued before user's revocation timestamp) */ async isTokenRevoked(userId, tokenIssuedAt) {
+    async isTokenRevoked(userId, tokenIssuedAt) {
         if (!this.cacheManager || !tokenIssuedAt) {
             return false;
         }
@@ -556,7 +504,7 @@ export class AuthenticationService {
         // Token is revoked if it was issued before the revocation timestamp
         return tokenIssuedAt < revokedAt;
     }
-    /** Parse JWT expiry string to milliseconds */ parseExpiryToMs(expiry) {
+    parseExpiryToMs(expiry) {
         const match = expiry.match(/^(\d+)([smhd])$/);
         if (!match) return 7 * 24 * 60 * 60 * 1000; // Default 7 days
         const value = parseInt(match[1], 10);
@@ -575,7 +523,7 @@ export class AuthenticationService {
         }
     }
     // Query Methods
-    /** Get user's companies */ async getUserCompanies(userId) {
+    async getUserCompanies(userId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
@@ -596,7 +544,7 @@ export class AuthenticationService {
             active: true
         }).orderBy('c.name', 'ASC').getMany();
     }
-    /** Get branches for a company that user has access to */ async getUserBranches(userId, companyId) {
+    async getUserBranches(userId, companyId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
@@ -631,7 +579,7 @@ export class AuthenticationService {
             active: true
         }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
     }
-    /** Get company by ID */ async getCompanyById(companyId) {
+    async getCompanyById(companyId) {
         const companyRepository = await this.getCompanyRepository();
         if (!companyRepository) {
             return null;
@@ -642,7 +590,7 @@ export class AuthenticationService {
             }
         });
     }
-    /** Get branch by ID */ async getBranchById(branchId) {
+    async getBranchById(branchId) {
         const branchRepository = await this.getBranchRepository();
         if (!branchRepository) {
             return null;
@@ -653,61 +601,35 @@ export class AuthenticationService {
             }
         });
     }
-    /** Get user info for /auth/me endpoint. Returns user, company, and branch info (no tokens). */ async getUserInfo(userId, companyId, branchId) {
+    async getUserInfo(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
                 id: userId
             }
         });
-        if (!user) {
-            throw new UnauthorizedException('User not found');
-        }
-        // Build response (no tokens)
+        if (!user) throw new UnauthorizedException('User not found');
         const response = {
-            user: {
-                id: user.id,
-                email: user.email,
-                name: user.name ?? undefined,
-                phone: user.phone ?? undefined,
-                profilePictureId: user.profilePictureId ?? undefined
-            }
+            user: this.toUserInfo(user)
         };
-        // Add company/branch if available (when company feature is enabled)
-        if (this.authConfig.isCompanyFeatureEnabled()) {
-            // When company feature is enabled, companyId MUST be present
+        if (this.isCompanyFeatureEnabled()) {
             if (!companyId) {
-                throw new UnauthorizedException('Company feature is enabled but user has no company assigned. Please select a company.');
+                throw new UnauthorizedException('Company feature is enabled but user has no company assigned.');
             }
             const company = await this.getCompanyById(companyId);
-            if (!company) {
-                throw new UnauthorizedException(`Company with ID ${companyId} not found. Please select a valid company.`);
-            }
-            response.company = {
-                id: company.id,
-                name: company.name,
-                slug: company.slug,
-                logoId: company.logoId ?? null
-            };
-            // Branch is optional in some configurations, but if provided it must exist
+            if (!company) throw new UnauthorizedException('Company not found.');
+            response.company = this.toCompanyInfo(company);
             if (branchId) {
                 const branch = await this.getBranchById(branchId);
-                if (!branch) {
-                    throw new UnauthorizedException(`Branch with ID ${branchId} not found. Please select a valid branch.`);
-                }
-                response.branch = {
-                    id: branch.id,
-                    name: branch.name,
-                    slug: branch.slug,
-                    logoId: branch.logoId ?? null
-                };
+                if (!branch) throw new UnauthorizedException('Branch not found.');
+                response.branch = this.toBranchInfo(branch);
             }
         }
         return response;
     }
     // Helper Methods
     ensureCompanyFeatureEnabled() {
-        if (!this.authConfig.isCompanyFeatureEnabled()) {
+        if (!this.isCompanyFeatureEnabled()) {
             throw new BadRequestException('Company feature is not enabled');
         }
     }
@@ -718,11 +640,7 @@ export class AuthenticationService {
                 email
             }
         });
-        if (!user) {
-            throw new UnauthorizedException('Invalid credentials');
-        }
-        const isPasswordValid = await bcrypt.compare(password, user.password || '');
-        if (!isPasswordValid) {
+        if (!user || !await bcrypt.compare(password, user.password || '')) {
             throw new UnauthorizedException('Invalid credentials');
         }
         user.lastLoginAt = new Date();
@@ -730,84 +648,77 @@ export class AuthenticationService {
         return user;
     }
     // Response Generators
-    generateLoginResponse(user, companyFeatureEnabled = false) {
-        const payload = {
+    toUserInfo(user) {
+        return {
             id: user.id,
             email: user.email,
-            type: 'access'
+            name: user.name ?? undefined,
+            phone: user.phone ?? null,
+            profilePictureId: user.profilePictureId ?? null
         };
-        const accessToken = this.jwtService.sign(payload, {
+    }
+    toCompanyInfo(company) {
+        return {
+            id: company.id,
+            name: company.name,
+            slug: company.slug,
+            logoId: company.logoId ?? null
+        };
+    }
+    toBranchInfo(branch) {
+        return {
+            id: branch.id,
+            name: branch.name,
+            slug: branch.slug,
+            logoId: branch.logoId ?? null
+        };
+    }
+    generateTokens(payload) {
+        const accessToken = this.jwtService.sign({
+            ...payload,
+            type: 'access'
+        }, {
             secret: this.authConfig.getJwtSecret(),
             expiresIn: this.authConfig.getJwtExpiration()
         });
-        const refreshPayload = {
-            id: user.id,
-            email: user.email,
+        const refreshToken = this.jwtService.sign({
+            ...payload,
             type: 'refresh'
-        };
-        const refreshToken = this.jwtService.sign(refreshPayload, {
+        }, {
             secret: this.authConfig.getRefreshTokenSecret(),
             expiresIn: this.authConfig.getRefreshTokenExpiration()
         });
         return {
             accessToken,
-            refreshToken,
-            user: {
-                id: user.id,
-                email: user.email,
-                name: user.name ?? undefined,
-                phone: user.phone ?? null,
-                profilePictureId: user.profilePictureId ?? null
-            },
-            companyFeatureEnabled
+            refreshToken
         };
     }
-    generateLoginResponseWithCompany(user, company, branch) {
-        const payload = {
+    generateLoginResponse(user) {
+        const { accessToken, refreshToken } = this.generateTokens({
             id: user.id,
             email: user.email,
-            type: 'access',
-            companyId: company.id,
-            branchId: branch?.id
-        };
-        const accessToken = this.jwtService.sign(payload, {
-            secret: this.authConfig.getJwtSecret(),
-            expiresIn: this.authConfig.getJwtExpiration()
+            type: 'access'
         });
-        const refreshPayload = {
+        return {
+            accessToken,
+            refreshToken,
+            user: this.toUserInfo(user)
+        };
+    }
+    generateLoginResponseWithCompany(user, company, branch) {
+        const { accessToken, refreshToken } = this.generateTokens({
             id: user.id,
             email: user.email,
-            type: 'refresh',
+            type: 'access',
             companyId: company.id,
             branchId: branch?.id
-        };
-        const refreshToken = this.jwtService.sign(refreshPayload, {
-            secret: this.authConfig.getRefreshTokenSecret(),
-            expiresIn: this.authConfig.getRefreshTokenExpiration()
         });
         return {
             accessToken,
             refreshToken,
-            user: {
-                id: user.id,
-                email: user.email,
-                name: user.name ?? undefined,
-                phone: user.phone ?? null,
-                profilePictureId: user.profilePictureId ?? null
-            },
-            company: {
-                id: company.id,
-                name: company.name,
-                slug: company.slug,
-                logoId: company.logoId ?? null
-            },
-            branch: branch ? {
-                id: branch.id,
-                name: branch.name,
-                slug: branch.slug,
-                logoId: branch.logoId ?? null
-            } : undefined,
-            companyFeatureEnabled: true
+            user: this.toUserInfo(user),
+            company: this.toCompanyInfo(company),
+            branch: branch ? this.toBranchInfo(branch) : undefined
         };
     }
     async generateCompanySelectionResponse(user, companies, branches) {
@@ -815,103 +726,42 @@ export class AuthenticationService {
             throw new BadRequestException('Session service not available');
         }
         const sessionId = await this.sessionService.createSession(user.id);
-        // Build companies with their branches
         const companiesWithBranches = companies.map((company)=>({
-                id: company.id,
-                name: company.name,
-                slug: company.slug,
+                ...this.toCompanyInfo(company),
                 isActive: company.isActive,
-                logoId: company.logoId ?? null,
                 branches: branches.filter((b)=>b.companyId === company.id).map((b)=>({
-                        id: b.id,
-                        name: b.name,
-                        slug: b.slug,
-                        isActive: b.isActive,
-                        logoId: b.logoId ?? null
+                        ...this.toBranchInfo(b),
+                        isActive: b.isActive
                     }))
             }));
         return {
             requiresSelection: true,
             sessionId,
             expiresAt: new Date(Date.now() + 5 * 60 * 1000),
-            user: {
-                id: user.id,
-                email: user.email,
-                name: user.name ?? undefined,
-                phone: user.phone ?? null,
-                profilePictureId: user.profilePictureId ?? null
-            },
+            user: this.toUserInfo(user),
             companies: companiesWithBranches
         };
     }
-    /** Generate registration response - tokens included only if email verification not required */ generateRegistrationResponse(user, companyFeatureEnabled, requiresEmailVerification) {
-        const userInfo = {
-            id: user.id,
-            email: user.email,
-            name: user.name ?? undefined,
-            phone: user.phone ?? null,
-            profilePictureId: user.profilePictureId ?? null
-        };
-        if (requiresEmailVerification) {
-            return {
-                user: userInfo,
-                companyFeatureEnabled,
-                requiresEmailVerification: true
-            };
-        }
-        const loginResponse = this.generateLoginResponse(user, companyFeatureEnabled);
+    generateRegistrationResponse(user) {
         return {
-            ...loginResponse,
+            ...this.generateLoginResponse(user),
             requiresEmailVerification: false
         };
     }
-    /** Generate registration response with company - tokens included only if email verification not required */ generateRegistrationResponseWithCompany(user, company, branch, requiresEmailVerification = false) {
-        const userInfo = {
-            id: user.id,
-            email: user.email,
-            name: user.name ?? undefined,
-            phone: user.phone ?? null,
-            profilePictureId: user.profilePictureId ?? null
-        };
-        const companyInfo = {
-            id: company.id,
-            name: company.name,
-            slug: company.slug,
-            logoId: company.logoId ?? null
-        };
-        const branchInfo = branch ? {
-            id: branch.id,
-            name: branch.name,
-            slug: branch.slug,
-            logoId: branch.logoId ?? null
-        } : undefined;
-        if (requiresEmailVerification) {
-            return {
-                user: userInfo,
-                company: companyInfo,
-                branch: branchInfo,
-                companyFeatureEnabled: true,
-                requiresEmailVerification: true
-            };
-        }
-        const loginResponse = this.generateLoginResponseWithCompany(user, company, branch);
+    generateRegistrationResponseWithCompany(user, company, branch) {
         return {
-            ...loginResponse,
+            ...this.generateLoginResponseWithCompany(user, company, branch),
             requiresEmailVerification: false
         };
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, injectedUserRepository, injectedPermissionRepository, injectedCompanyRepository, injectedBranchRepository){
+    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService){
         _define_property(this, "jwtService", void 0);
         _define_property(this, "authConfig", void 0);
         _define_property(this, "cacheManager", void 0);
         _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "sessionService", void 0);
         _define_property(this, "authEmailService", void 0);
-        _define_property(this, "injectedUserRepository", void 0);
-        _define_property(this, "injectedPermissionRepository", void 0);
-        _define_property(this, "injectedCompanyRepository", void 0);
-        _define_property(this, "injectedBranchRepository", void 0);
         _define_property(this, "logger", void 0);
         this.jwtService = jwtService;
         this.authConfig = authConfig;
@@ -919,10 +769,6 @@ export class AuthenticationService {
         this.dataSourceProvider = dataSourceProvider;
         this.sessionService = sessionService;
         this.authEmailService = authEmailService;
-        this.injectedUserRepository = injectedUserRepository;
-        this.injectedPermissionRepository = injectedPermissionRepository;
-        this.injectedCompanyRepository = injectedCompanyRepository;
-        this.injectedBranchRepository = injectedBranchRepository;
         this.logger = new Logger(AuthenticationService.name);
     }
 }
@@ -940,14 +786,6 @@ AuthenticationService = _ts_decorate([
     _ts_param(4, Inject(CompanySelectionSessionService)),
     _ts_param(5, Optional()),
     _ts_param(5, Inject(AuthEmailService)),
-    _ts_param(6, Optional()),
-    _ts_param(6, InjectRepository(User)),
-    _ts_param(7, Optional()),
-    _ts_param(7, InjectRepository(UserCompanyPermission)),
-    _ts_param(8, Optional()),
-    _ts_param(8, InjectRepository(Company)),
-    _ts_param(9, Optional()),
-    _ts_param(9, InjectRepository(CompanyBranch)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof JwtService === "undefined" ? Object : JwtService,
@@ -955,10 +793,6 @@ AuthenticationService = _ts_decorate([
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
         typeof CompanySelectionSessionService === "undefined" ? Object : CompanySelectionSessionService,
-        typeof AuthEmailService === "undefined" ? Object : AuthEmailService,
-        typeof Repository === "undefined" ? Object : Repository,
-        typeof Repository === "undefined" ? Object : Repository,
-        typeof Repository === "undefined" ? Object : Repository,
-        typeof Repository === "undefined" ? Object : Repository
+        typeof AuthEmailService === "undefined" ? Object : AuthEmailService
     ])
 ], AuthenticationService);