@flusys/nestjs-auth 1.1.0-beta → 2.0.0

package/fesm/controllers/company-selection.controller.js

@@ -26,42 +26,35 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { CurrentUser } from '@flusys/nestjs-shared/decorators';
-import { Body, Controller, Get, HttpCode, HttpStatus, Inject, Param, Post, UseGuards, UseInterceptors } from '@nestjs/common';
+import { Body, Controller, HttpCode, HttpStatus, Inject, Post, UseGuards, UseInterceptors } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
 import { LoginResponseDto, SelectDto, SwitchCompanyDto } from '../dtos/authentication.dto';
 import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { SetToken } from '../interceptors/set-token.interceptor';
 import { AuthenticationService } from '../services/authentication.service';
 export class CompanySelectionController {
-    /**
-   * Select Company & Branch
-   * Used after login when user needs to select company and branch
-   */ async select(dto) {
+    async select(dto) {
         return this.authService.select(dto.sessionId, dto.companyId, dto.branchId);
     }
-    /**
-   * Switch Company/Branch
-   * Used to switch company/branch after already logged in
-   */ async switchCompany(userId, dto) {
+    async switchCompany(userId, dto) {
         return this.authService.switchCompany(userId, dto.companyId, dto.branchId);
     }
-    /**
-   * Get user's companies
-   */ async getUserCompanies(userId) {
+    async getUserCompanies(userId) {
         const companies = await this.authService.getUserCompanies(userId);
         return {
-            companies
+            success: true,
+            message: 'User companies retrieved successfully',
+            data: companies
         };
     }
-    /**
-   * Get branches for a specific company
-   */ async getUserBranches(userId, companyId) {
+    async getUserBranches(userId, companyId) {
         const branches = await this.authService.getUserBranches(userId, companyId);
         return {
-            branches
+            success: true,
+            message: 'Company branches retrieved successfully',
+            data: branches
         };
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(authService){
         _define_property(this, "authService", void 0);
         this.authService = authService;
@@ -117,7 +110,8 @@ _ts_decorate([
 ], CompanySelectionController.prototype, "switchCompany", null);
 _ts_decorate([
     UseGuards(JwtAuthGuard),
-    Get('companies'),
+    Post('get-companies'),
+    HttpCode(HttpStatus.OK),
     ApiBearerAuth(),
     ApiOperation({
         summary: "Get user's available companies",
@@ -132,14 +126,27 @@ _ts_decorate([
 ], CompanySelectionController.prototype, "getUserCompanies", null);
 _ts_decorate([
     UseGuards(JwtAuthGuard),
-    Get('companies/:companyId/branches'),
+    Post('get-company-branches'),
+    HttpCode(HttpStatus.OK),
     ApiBearerAuth(),
     ApiOperation({
         summary: 'Get branches for a company',
         description: 'Get list of branches for a specific company that the user has access to'
     }),
+    ApiBody({
+        schema: {
+            properties: {
+                companyId: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'companyId'
+            ]
+        }
+    }),
     _ts_param(0, CurrentUser('id')),
-    _ts_param(1, Param('companyId')),
+    _ts_param(1, Body('companyId')),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         String,

package/fesm/controllers/company.controller.js

@@ -25,13 +25,56 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { createApiController } from '@flusys/nestjs-shared/classes';
+import { createApiController, COMPANY_PERMISSIONS } from '@flusys/nestjs-shared/classes';
 import { Controller, Inject } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
 import { CompanyResponseDto, CreateCompanyDto, UpdateCompanyDto } from '../dtos/company.dto';
 import { CompanyService } from '../services/company.service';
 export class CompanyController extends createApiController(CreateCompanyDto, UpdateCompanyDto, CompanyResponseDto, {
-    security: 'jwt'
+    security: {
+        insert: {
+            level: 'permission',
+            permissions: [
+                COMPANY_PERMISSIONS.CREATE
+            ]
+        },
+        insertMany: {
+            level: 'permission',
+            permissions: [
+                COMPANY_PERMISSIONS.CREATE
+            ]
+        },
+        getById: {
+            level: 'permission',
+            permissions: [
+                COMPANY_PERMISSIONS.READ
+            ]
+        },
+        getAll: {
+            level: 'permission',
+            permissions: [
+                COMPANY_PERMISSIONS.READ
+            ]
+        },
+        update: {
+            level: 'permission',
+            permissions: [
+                COMPANY_PERMISSIONS.UPDATE
+            ]
+        },
+        updateMany: {
+            level: 'permission',
+            permissions: [
+                COMPANY_PERMISSIONS.UPDATE
+            ]
+        },
+        delete: {
+            level: 'permission',
+            permissions: [
+                COMPANY_PERMISSIONS.DELETE
+            ]
+        }
+    }
 }) {
     constructor(companyService){
         super(companyService), _define_property(this, "companyService", void 0), this.companyService = companyService;

package/fesm/controllers/user-permission.controller.js

@@ -25,129 +25,74 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { Body, Controller, Get, Inject, Post, Query, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiBody, ApiOperation, ApiQuery, ApiResponse, ApiTags } from '@nestjs/swagger';
-import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
-import { AssignUserCompanyDto, AssignUserBranchDto, UserCompaniesResponseDto, UserBranchesResponseDto } from '../dtos/user-permission.dto';
+import { JwtAuthGuard, RequirePermission, USER_PERMISSIONS } from '@flusys/nestjs-shared';
+import { Body, Controller, Inject, Post, UseGuards } from '@nestjs/common';
+import { ApiBearerAuth, ApiBody, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+import { AssignUserBranchDto, AssignUserCompanyDto, UserBranchesResponseDto, UserCompaniesResponseDto } from '../dtos/user-permission.dto';
+import { PermissionType } from '../entities/user-company-permission.entity';
 import { UserPermissionService } from '../services/user-permission.service';
 export class UserPermissionController {
-    // User-Company Permissions
-    /** Batch assign/revoke user-company permissions */ async assignUserCompany(dto) {
-        let addedCount = 0;
-        let removedCount = 0;
-        for (const item of dto.items){
-            if (item.isAdd) {
-                await this.userPermissionService.assignUserToCompany({
-                    userId: dto.userId,
-                    companyId: item.targetId
-                });
-                addedCount++;
-            } else {
-                await this.userPermissionService.revokeCompanyAccess(dto.userId, item.targetId);
-                removedCount++;
-            }
-        }
+    async assignUserCompany(dto) {
+        return this.processBatchPermissions(dto.userId, dto.items, PermissionType.COMPANY);
+    }
+    async getUserCompanies(userId) {
+        const permissions = await this.permissionService.findUserCompanies(userId);
         return {
             success: true,
-            message: `Processed ${addedCount} additions and ${removedCount} removals`
+            message: 'User companies retrieved successfully',
+            data: permissions.map((p)=>({
+                    id: p.id,
+                    userId: p.userId,
+                    companyId: p.company?.id || p.targetId,
+                    companyName: p.company?.name || '',
+                    companySlug: p.company?.slug || ''
+                }))
         };
     }
-    /** Get user's companies */ async getUserCompanies(userId) {
-        const permissions = await this.userPermissionService.findUserCompanies(userId);
-        // Map to DTO format with populated company details
-        const data = permissions.map((permission)=>({
-                id: permission.id,
-                userId: permission.userId,
-                companyId: permission.company?.id || permission.targetId,
-                companyName: permission.company?.name || '',
-                companySlug: permission.company?.slug || ''
-            }));
+    async assignUserBranch(dto) {
+        return this.processBatchPermissions(dto.userId, dto.items, PermissionType.BRANCH);
+    }
+    async getUserBranches(userId, companyId) {
+        const permissions = await this.permissionService.findUserBranches(userId, companyId);
         return {
-            data
+            success: true,
+            message: 'User branches retrieved successfully',
+            data: permissions.map((p)=>({
+                    id: p.id,
+                    userId: p.userId,
+                    branchId: p.branch?.id || p.targetId,
+                    branchName: p.branch?.name || '',
+                    branchSlug: p.branch?.slug || '',
+                    companyId: p.branch?.companyId || ''
+                }))
         };
     }
-    // User-Branch Permissions
-    /** Batch assign/revoke user-branch permissions */ async assignUserBranch(dto) {
-        let addedCount = 0;
-        let removedCount = 0;
-        for (const item of dto.items){
+    /** Process batch permission assignments/revocations */ async processBatchPermissions(userId, items, type) {
+        let added = 0, removed = 0;
+        for (const item of items){
             if (item.isAdd) {
-                await this.userPermissionService.assignUserToBranch({
-                    userId: dto.userId,
-                    branchId: item.targetId
-                });
-                addedCount++;
+                await this.permissionService.assignPermission(userId, item.targetId, type);
+                added++;
             } else {
-                await this.userPermissionService.revokeBranchAccess(dto.userId, item.targetId);
-                removedCount++;
+                await this.permissionService.revokePermission(userId, item.targetId, type);
+                removed++;
             }
         }
         return {
             success: true,
-            message: `Processed ${addedCount} additions and ${removedCount} removals`
-        };
-    }
-    /** Get user's branches */ async getUserBranches(userId) {
-        const permissions = await this.userPermissionService.findUserBranches(userId);
-        // Map to DTO format with populated branch details
-        const data = permissions.map((permission)=>({
-                id: permission.id,
-                userId: permission.userId,
-                branchId: permission.branch?.id || permission.targetId,
-                branchName: permission.branch?.name || '',
-                branchSlug: permission.branch?.slug || '',
-                companyId: permission.branch?.companyId || ''
-            }));
-        return {
-            data
+            message: `Processed ${added} additions and ${removed} removals`
         };
     }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(userPermissionService){
-        _define_property(this, "userPermissionService", void 0);
-        this.userPermissionService = userPermissionService;
+    constructor(permissionService){
+        _define_property(this, "permissionService", void 0);
+        this.permissionService = permissionService;
     }
 }
 _ts_decorate([
     Post('user-company/assign'),
+    RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
-        summary: 'Batch assign/revoke user-company permissions',
-        description: `
-Batch operation to assign or revoke user permissions to companies.
-
-**Example: Add company permissions**
-\`\`\`json
-{
-  "userId": "user-id",
-  "items": [
-    { "targetId": "company-id-1", "isAdd": true },
-    { "targetId": "company-id-2", "isAdd": true }
-  ]
-}
-\`\`\`
-
-**Example: Remove company permissions**
-\`\`\`json
-{
-  "userId": "user-id",
-  "items": [
-    { "targetId": "company-id-1", "isAdd": false },
-    { "targetId": "company-id-2", "isAdd": false }
-  ]
-}
-\`\`\`
-
-**Example: Mix add and remove**
-\`\`\`json
-{
-  "userId": "user-id",
-  "items": [
-    { "targetId": "company-id-1", "isAdd": true },
-    { "targetId": "company-id-2", "isAdd": false }
-  ]
-}
-\`\`\`
-    `
+        summary: 'Batch assign/revoke user-company permissions'
     }),
     ApiResponse({
         status: 200,
@@ -164,22 +109,28 @@ Batch operation to assign or revoke user permissions to companies.
     _ts_metadata("design:returntype", Promise)
 ], UserPermissionController.prototype, "assignUserCompany", null);
 _ts_decorate([
-    Get('user-company'),
+    Post('get-user-company'),
+    RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
-        summary: 'Get user companies',
-        description: 'Returns all companies the user has access to.'
+        summary: 'Get user companies'
     }),
-    ApiQuery({
-        name: 'userId',
-        required: true,
-        description: 'User ID to get companies for',
-        example: '550e8400-e29b-41d4-a716-446655440000'
+    ApiBody({
+        schema: {
+            properties: {
+                userId: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'userId'
+            ]
+        }
     }),
     ApiResponse({
         status: 200,
         type: UserCompaniesResponseDto
     }),
-    _ts_param(0, Query('userId')),
+    _ts_param(0, Body('userId')),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         String
@@ -188,44 +139,9 @@ _ts_decorate([
 ], UserPermissionController.prototype, "getUserCompanies", null);
 _ts_decorate([
     Post('user-branch/assign'),
+    RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
-        summary: 'Batch assign/revoke user-branch permissions',
-        description: `
-Batch operation to assign or revoke user permissions to branches.
-
-**Example: Add branch permissions**
-\`\`\`json
-{
-  "userId": "user-id",
-  "items": [
-    { "targetId": "branch-id-1", "isAdd": true },
-    { "targetId": "branch-id-2", "isAdd": true }
-  ]
-}
-\`\`\`
-
-**Example: Remove branch permissions**
-\`\`\`json
-{
-  "userId": "user-id",
-  "items": [
-    { "targetId": "branch-id-1", "isAdd": false },
-    { "targetId": "branch-id-2", "isAdd": false }
-  ]
-}
-\`\`\`
-
-**Example: Mix add and remove**
-\`\`\`json
-{
-  "userId": "user-id",
-  "items": [
-    { "targetId": "branch-id-1", "isAdd": true },
-    { "targetId": "branch-id-2", "isAdd": false }
-  ]
-}
-\`\`\`
-    `
+        summary: 'Batch assign/revoke user-branch permissions'
     }),
     ApiResponse({
         status: 200,
@@ -242,24 +158,36 @@ Batch operation to assign or revoke user permissions to branches.
     _ts_metadata("design:returntype", Promise)
 ], UserPermissionController.prototype, "assignUserBranch", null);
 _ts_decorate([
-    Get('user-branch'),
+    Post('get-user-branch'),
+    RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
-        summary: 'Get user branches',
-        description: 'Returns all branches the user has access to.'
+        summary: 'Get user branches'
     }),
-    ApiQuery({
-        name: 'userId',
-        required: true,
-        description: 'User ID to get branches for',
-        example: '550e8400-e29b-41d4-a716-446655440000'
+    ApiBody({
+        schema: {
+            properties: {
+                userId: {
+                    type: 'string'
+                },
+                companyId: {
+                    type: 'string',
+                    description: 'Optional company ID to filter branches'
+                }
+            },
+            required: [
+                'userId'
+            ]
+        }
     }),
     ApiResponse({
         status: 200,
         type: UserBranchesResponseDto
     }),
-    _ts_param(0, Query('userId')),
+    _ts_param(0, Body('userId')),
+    _ts_param(1, Body('companyId')),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        String,
         String
     ]),
     _ts_metadata("design:returntype", Promise)

package/fesm/controllers/user.controller.js

@@ -25,44 +25,89 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { createApiController } from '@flusys/nestjs-shared/classes';
-import { CurrentUser } from '@flusys/nestjs-shared/decorators';
+import { createApiController, USER_PERMISSIONS } from '@flusys/nestjs-shared/classes';
+import { CurrentUser, RequirePermission } from '@flusys/nestjs-shared/decorators';
 import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
-import { Body, Controller, Inject, Param, Post, Put, UseGuards } from '@nestjs/common';
+import { Body, Controller, Inject, Param, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiParam, ApiTags } from '@nestjs/swagger';
 import { CreateUserDto, UpdateUserDto, UserResponseDto } from '../dtos/user.dto';
 import { UserService } from '../services/user.service';
 export class UserController extends createApiController(CreateUserDto, UpdateUserDto, UserResponseDto, {
-    security: 'jwt'
+    security: {
+        insert: {
+            level: 'permission',
+            permissions: [
+                USER_PERMISSIONS.CREATE
+            ]
+        },
+        insertMany: {
+            level: 'permission',
+            permissions: [
+                USER_PERMISSIONS.CREATE
+            ]
+        },
+        getById: {
+            level: 'permission',
+            permissions: [
+                USER_PERMISSIONS.READ
+            ]
+        },
+        getAll: {
+            level: 'permission',
+            permissions: [
+                USER_PERMISSIONS.READ
+            ]
+        },
+        update: {
+            level: 'permission',
+            permissions: [
+                USER_PERMISSIONS.UPDATE
+            ]
+        },
+        updateMany: {
+            level: 'permission',
+            permissions: [
+                USER_PERMISSIONS.UPDATE
+            ]
+        },
+        delete: {
+            level: 'permission',
+            permissions: [
+                USER_PERMISSIONS.DELETE
+            ]
+        }
+    }
 }) {
-    // Custom Endpoints
-    /** Get user profile with extras (roles, permissions, etc.) from enricher */ async getProfileWithExtras(id, user) {
+    async getProfileWithExtras(id, user) {
         const data = await this.service.getProfileWithExtras(id, user);
         return {
             success: true,
             data
         };
     }
-    /** Verify user email */ async verifyEmail(id) {
+    async verifyEmail(id) {
         await this.service.verifyEmail(id);
         return {
+            success: true,
             message: 'Email verified successfully'
         };
     }
-    /** Verify user phone */ async verifyPhone(id) {
+    async verifyPhone(id) {
         await this.service.verifyPhone(id);
         return {
+            success: true,
             message: 'Phone verified successfully'
         };
     }
-    /** Update user active status. When company feature enabled, updates permission isActive for logged user's company. */ async updateStatus(id, isActive, user) {
+    async updateStatus(id, isActive, user) {
         await this.service.updateStatus(id, isActive, user);
         return {
+            success: true,
             message: 'Status updated successfully'
         };
     }
-    /** Update user profile */ async profile(dto, user) {
+    async profile(dto, user) {
         const data = await this.service.profile(dto, user);
         return {
             success: true,
@@ -70,34 +115,34 @@ export class UserController extends createApiController(CreateUserDto, UpdateUse
             data
         };
     }
-    // ============================================
-    // Multi-Step Profile Endpoints (via Enricher)
-    // ============================================
-    /** Get profile section definitions */ async getProfileSections() {
+    async getProfileSections() {
         const sections = await this.service.getProfileSections();
         return {
             success: true,
+            message: 'Profile sections retrieved successfully',
             data: sections
         };
     }
-    /** Get specific profile section data */ async getProfileSectionData(id, sectionId, user) {
+    async getProfileSectionData(id, sectionId, user) {
         const data = await this.service.getProfileSectionData(id, sectionId, user);
         return {
             success: true,
+            message: 'Profile section data retrieved successfully',
             data
         };
     }
-    /** Update specific profile section */ async updateProfileSection(id, sectionId, data, user) {
+    async updateProfileSection(id, sectionId, data, user) {
         await this.service.updateProfileSection(id, sectionId, data, user);
         return {
             success: true,
             message: 'Section updated successfully'
         };
     }
-    /** Get profile completion percentage */ async getProfileCompletion(id, user) {
+    async getProfileCompletion(id, user) {
         const percentage = await this.service.getProfileCompletion(id, user);
         return {
             success: true,
+            message: 'Profile completion retrieved successfully',
             data: {
                 completionPercentage: percentage
             }
@@ -111,6 +156,7 @@ _ts_decorate([
     Post(':id/profile-extras'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
         summary: 'Get user profile with extras',
         description: 'Returns user profile along with extra data (roles, permissions, etc.) if UserEnricher is provided.'
@@ -132,6 +178,7 @@ _ts_decorate([
     Post(':id/verify-email'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
         summary: 'Verify user email'
     }),
@@ -150,6 +197,7 @@ _ts_decorate([
     Post(':id/verify-phone'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
         summary: 'Verify user phone'
     }),
@@ -165,9 +213,10 @@ _ts_decorate([
     _ts_metadata("design:returntype", Promise)
 ], UserController.prototype, "verifyPhone", null);
 _ts_decorate([
-    Put(':id/status'),
+    Post(':id/status'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
         summary: 'Update user active status',
         description: 'Updates user active status. When company feature is enabled, updates the status for the current company context.'
@@ -217,6 +266,7 @@ _ts_decorate([
     Post('profile-sections'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
         summary: 'Get profile section definitions',
         description: 'Returns available profile sections for multi-step profile (if enricher configured).'
@@ -229,6 +279,7 @@ _ts_decorate([
     Post(':id/profile-section/:sectionId'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
         summary: 'Get profile section data',
         description: 'Returns data for a specific profile section.'
@@ -256,6 +307,7 @@ _ts_decorate([
     Post(':id/profile-section/:sectionId/update'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
         summary: 'Update profile section',
         description: 'Updates a specific profile section data.'
@@ -285,6 +337,7 @@ _ts_decorate([
     Post(':id/profile-completion'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
         summary: 'Get profile completion percentage',
         description: 'Returns overall profile completion percentage.'