@flusys/nestjs-auth 1.1.0-beta → 2.0.0

package/modules/auth.module.d.ts

@@ -2,9 +2,12 @@ import { DynamicModule } from '@nestjs/common';
 import { AuthModuleAsyncOptions, AuthModuleOptions } from '../interfaces/auth-module-options.interface';
 export declare class AuthModule {
     static forRoot(options: AuthModuleOptions): DynamicModule;
-    static forRootAsync(asyncOptions: AuthModuleAsyncOptions): DynamicModule;
-    private static buildDynamicModule;
+    static forRootAsync(options: AuthModuleAsyncOptions): DynamicModule;
+    private static buildModule;
+    private static buildImports;
+    private static buildControllers;
+    private static buildProviders;
+    private static buildExports;
     private static createAsyncProviders;
-    private static getRepositoryProviders;
     static getEntities(enableCompanyFeature?: boolean): any[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "1.1.0-beta",
+  "version": "2.0.0",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -84,14 +84,14 @@
     "bcrypt": "^5.0.0 || ^6.0.0",
     "class-transformer": "^0.5.0",
     "class-validator": "^0.14.0",
-    "nodemailer": "^6.0.0",
+    "nodemailer": "^7.0.0",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.0",
     "passport-local": "^1.0.0",
     "typeorm": "^0.3.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "1.1.0-beta",
-    "@flusys/nestjs-shared": "1.1.0-beta"
+    "@flusys/nestjs-core": "2.0.0",
+    "@flusys/nestjs-shared": "2.0.0"
   }
 }

package/services/auth-config.service.d.ts

@@ -1,8 +1,11 @@
-import { DatabaseMode, IDatabaseConfig, ITenantDatabaseConfig } from '@flusys/nestjs-core';
-import { AuthModuleOptions, IAuthModuleConfig } from '../interfaces/auth-module-options.interface';
-export declare class AuthConfigService {
+import { DatabaseMode } from '@flusys/nestjs-core';
+import { IModuleConfigService } from '@flusys/nestjs-shared/interfaces';
+import { AuthModuleOptions } from '../interfaces/auth-module-options.interface';
+export declare class AuthConfigService implements IModuleConfigService {
+    private readonly logger;
     private readonly options;
     private readonly config;
+    private refreshTokenSecretWarned;
     constructor(injectedOptions?: AuthModuleOptions);
     getDatabaseMode(): DatabaseMode;
     isMultiTenant(): boolean;
@@ -13,9 +16,4 @@ export declare class AuthConfigService {
     getRefreshTokenExpiration(): string;
     getRefreshTokenCookieName(): string;
     getFrontendUrl(): string | undefined;
-    getDefaultDatabaseConfig(): IDatabaseConfig | undefined;
-    getTenantDefaultDatabaseConfig(): IDatabaseConfig | undefined;
-    getTenants(): ITenantDatabaseConfig[];
-    getOptions(): AuthModuleOptions;
-    getConfig(): IAuthModuleConfig;
 }

package/services/auth-datasource.provider.d.ts

@@ -17,9 +17,7 @@ export declare class AuthDataSourceProvider extends MultiTenantDataSourceService
     protected getSingleDataSource(): Promise<DataSource>;
     protected getOrCreateTenantConnection(tenant: ITenantDatabaseConfig): Promise<DataSource>;
     private static buildParentOptions;
-    getEnableCompanyFeature(): boolean;
-    getEnableCompanyFeatureForTenant(tenant?: ITenantDatabaseConfig): boolean;
-    getEnableCompanyFeatureForCurrentTenant(): boolean;
-    getAuthEntities(enableCompanyFeature?: boolean): Promise<any[]>;
+    isCompanyFeatureEnabled(tenant?: ITenantDatabaseConfig): boolean;
+    getAuthEntities(): Promise<any[]>;
     protected createDataSourceFromConfig(config: IDatabaseConfig): Promise<DataSource>;
 }

package/services/auth-email.service.d.ts

@@ -1,6 +1,6 @@
-import { AuthDataSourceProvider } from './auth-datasource.provider';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { IAuthEmailProvider } from '../interfaces';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
 export declare class AuthEmailService {
     private readonly dataSourceProvider?;
     private readonly emailProvider?;
@@ -8,11 +8,15 @@ export declare class AuthEmailService {
     private readonly PASSWORD_RESET_EXPIRY;
     private readonly EMAIL_VERIFICATION_EXPIRY;
     constructor(dataSourceProvider?: AuthDataSourceProvider, emailProvider?: IAuthEmailProvider);
-    private getUserRepository;
-    private getUserTokenRepository;
-    private getPendingRegistrationRepository;
     isEmailEnabled(): boolean;
+    private getRepository;
     private generateToken;
+    private hashToken;
+    private getErrorMessage;
+    private assertEmailEnabled;
+    private sendVerificationEmailSafe;
+    private validateTokenNotExpiredOrUsed;
+    hasPendingRegistration(email: string): Promise<boolean>;
     createPendingRegistration(data: {
         email: string;
         name?: string;

package/services/authentication.service.d.ts

@@ -1,16 +1,13 @@
+import { HybridCache } from '@flusys/nestjs-shared/classes';
 import { JwtService } from '@nestjs/jwt';
-import { Repository } from 'typeorm';
-import { AuthConfigService } from './auth-config.service';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
 import { RegistrationDto } from '../dtos/authentication.dto';
-import { HybridCache } from '@flusys/nestjs-shared/classes';
-import { LoginResponse, LoginResponseRequiresEmailVerification, LoginResponseRequiresSelection, MeResponse, RegistrationResponse } from '../interfaces/authentication.interface';
-import { AuthEmailService } from './auth-email.service';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
-import { UserCompanyPermission } from '../entities/user-company-permission.entity';
-import { User } from '../entities/user.entity';
+import { LoginResponse, LoginResponseRequiresEmailVerification, LoginResponseRequiresSelection, MeResponse, RegistrationResponse } from '../interfaces/authentication.interface';
+import { AuthConfigService } from './auth-config.service';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+import { AuthEmailService } from './auth-email.service';
 import { CompanySelectionSessionService } from './company-selection-session.service';
 export declare class AuthenticationService {
     private readonly jwtService;
@@ -19,12 +16,9 @@ export declare class AuthenticationService {
     private readonly dataSourceProvider?;
     private readonly sessionService?;
     private readonly authEmailService?;
-    private readonly injectedUserRepository?;
-    private readonly injectedPermissionRepository?;
-    private readonly injectedCompanyRepository?;
-    private readonly injectedBranchRepository?;
     private readonly logger;
-    constructor(jwtService: JwtService, authConfig: AuthConfigService, cacheManager?: HybridCache, dataSourceProvider?: AuthDataSourceProvider, sessionService?: CompanySelectionSessionService, authEmailService?: AuthEmailService, injectedUserRepository?: Repository<User>, injectedPermissionRepository?: Repository<UserCompanyPermission>, injectedCompanyRepository?: Repository<Company>, injectedBranchRepository?: Repository<CompanyBranch>);
+    constructor(jwtService: JwtService, authConfig: AuthConfigService, cacheManager?: HybridCache, dataSourceProvider?: AuthDataSourceProvider, sessionService?: CompanySelectionSessionService, authEmailService?: AuthEmailService);
+    private isCompanyFeatureEnabled;
     private getUserRepository;
     private getPermissionRepository;
     private getCompanyRepository;
@@ -35,14 +29,15 @@ export declare class AuthenticationService {
         requiresEmailVerification: true;
         message: string;
     }>;
+    private handleExistingUserCompanyRegistration;
     private createUserDirectly;
     createUserFromPendingRegistration(pending: PendingRegistration): Promise<RegistrationResponse>;
-    private handleCompanyRegistrationFromPending;
-    private handleCompanyRegistration;
     private processCompanyRegistration;
-    private generateSlug;
+    private findOrCreateCompanyAndBranch;
+    private assignUserPermissions;
     select(sessionId: string, companyId: string, branchId: string): Promise<LoginResponse>;
     switchCompany(userId: string, companyId: string, branchId: string): Promise<LoginResponse>;
+    private validateAndLoginWithCompany;
     refreshToken(refreshToken: string): Promise<{
         accessToken: string;
         refreshToken: string;
@@ -58,6 +53,10 @@ export declare class AuthenticationService {
     getUserInfo(userId: string, companyId?: string, branchId?: string): Promise<MeResponse>;
     private ensureCompanyFeatureEnabled;
     private validateUser;
+    private toUserInfo;
+    private toCompanyInfo;
+    private toBranchInfo;
+    private generateTokens;
     private generateLoginResponse;
     private generateLoginResponseWithCompany;
     private generateCompanySelectionResponse;

package/services/company-selection-session.service.d.ts

@@ -8,7 +8,7 @@ interface StoredSession {
 export declare class CompanySelectionSessionService {
     protected cacheManager: HybridCache;
     constructor(cacheManager: HybridCache);
-    createSession(userId: string, companyId?: string): Promise<string>;
+    createSession(userId: string): Promise<string>;
     getSession(sessionId: string): Promise<StoredSession | null>;
     consumeSession(sessionId: string): Promise<StoredSession | null>;
     deleteSession(sessionId: string): Promise<void>;

package/services/user-permission.service.d.ts

@@ -1,16 +1,13 @@
-import { AssignBranchPermissionDto, AssignCompanyPermissionDto } from '../dtos/user-company-permission.dto';
-import { UserCompanyPermission } from '../entities/user-company-permission.entity';
+import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export declare class UserPermissionService {
     private readonly dataSourceProvider;
-    private readonly logger;
     private _repository;
     constructor(dataSourceProvider: AuthDataSourceProvider);
     private getRepository;
-    findUserCompanies(userId: string): Promise<UserCompanyPermission[]>;
-    assignUserToCompany(dto: AssignCompanyPermissionDto): Promise<void>;
-    revokeCompanyAccess(userId: string, companyId: string): Promise<void>;
-    findUserBranches(userId: string): Promise<UserCompanyPermission[]>;
-    assignUserToBranch(dto: AssignBranchPermissionDto): Promise<void>;
-    revokeBranchAccess(userId: string, branchId: string): Promise<void>;
+    findUserPermissions(userId: string, type: PermissionType): Promise<UserCompanyPermission[]>;
+    assignPermission(userId: string, targetId: string, type: PermissionType, metadata?: Record<string, any>): Promise<void>;
+    revokePermission(userId: string, targetId: string, type: PermissionType): Promise<void>;
+    findUserCompanies: (userId: string) => Promise<UserCompanyPermission[]>;
+    findUserBranches(userId: string, companyId?: string): Promise<UserCompanyPermission[]>;
 }

package/services/user.service.d.ts

@@ -20,11 +20,14 @@ export declare class UserService extends RequestScopedApiService<CreateUserDto,
     protected resolveEntity(): EntityTarget<User>;
     protected getDataSourceProvider(): AuthDataSourceProvider;
     protected ensureRepositoryInitialized(): Promise<void>;
+    private getUserForProfile;
     verifyEmail(id: string): Promise<void>;
     verifyPhone(id: string): Promise<void>;
     updateStatus(id: string, isActive: boolean, user?: ILoggedUserInfo | null): Promise<void>;
     protected convertSingleDtoToEntity(dto: CreateUserDto | UpdateUserDto, user: ILoggedUserInfo | null): Promise<User>;
     protected convertEntityToResponseDto(entity: User, isRaw: boolean): IUser;
+    private convertRawToResponseDto;
+    private convertEntityToDto;
     protected convertEntityListToResponseListDto(entities: User[], isRaw: boolean): IUser[];
     protected getGlobalSearchQuery(query: any, search: string, _user: any): Promise<{
         query: any;

package/strategies/jwt.strategy.d.ts

@@ -1,13 +1,16 @@
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { ModuleRef } from '@nestjs/core';
 import { Request } from 'express';
-import { AuthConfigService } from '../services/auth-config.service';
 import { TokenPayload, TokenPayloadWithCompany } from '../interfaces/authentication.interface';
+import { AuthConfigService } from '../services/auth-config.service';
 declare const JwtStrategy_base: new (...args: any) => any;
 export declare class JwtStrategy extends JwtStrategy_base {
     private readonly authConfig;
     private readonly moduleRef;
     constructor(authConfig: AuthConfigService, moduleRef: ModuleRef);
     validate(_req: Request, payload: TokenPayload | TokenPayloadWithCompany): Promise<ILoggedUserInfo>;
+    private resolveUserRepository;
+    private checkTokenRevocation;
+    private buildUserInfo;
 }
 export {};

package/validators/password.validator.d.ts

@@ -0,0 +1,10 @@
+import { ValidationOptions } from 'class-validator';
+export interface PasswordComplexityOptions {
+    minLength?: number;
+    maxLength?: number;
+    requireUppercase?: boolean;
+    requireLowercase?: boolean;
+    requireNumber?: boolean;
+    requireSpecialChar?: boolean;
+}
+export declare function IsStrongPassword(options?: PasswordComplexityOptions, validationOptions?: ValidationOptions): (object: object, propertyName: string) => void;

package/cjs/dtos/user-company-permission.dto.js

@@ -1,110 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get AssignBranchPermissionDto () {
-        return AssignBranchPermissionDto;
-    },
-    get AssignCompanyPermissionDto () {
-        return AssignCompanyPermissionDto;
-    }
-});
-const _swagger = require("@nestjs/swagger");
-const _classvalidator = require("class-validator");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-let AssignCompanyPermissionDto = class AssignCompanyPermissionDto {
-    constructor(){
-        _define_property(this, "userId", void 0);
-        _define_property(this, "companyId", void 0);
-        _define_property(this, "metadata", void 0);
-    }
-};
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        example: '550e8400-e29b-41d4-a716-446655440000',
-        description: 'User ID to assign company access to'
-    }),
-    (0, _classvalidator.IsUUID)(),
-    _ts_metadata("design:type", String)
-], AssignCompanyPermissionDto.prototype, "userId", void 0);
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        example: '550e8400-e29b-41d4-a716-446655440001',
-        description: 'Company ID to grant access to'
-    }),
-    (0, _classvalidator.IsUUID)(),
-    _ts_metadata("design:type", String)
-], AssignCompanyPermissionDto.prototype, "companyId", void 0);
-_ts_decorate([
-    (0, _swagger.ApiPropertyOptional)({
-        example: {
-            role: 'member'
-        },
-        description: 'Additional permission metadata'
-    }),
-    (0, _classvalidator.IsOptional)(),
-    (0, _classvalidator.IsObject)(),
-    _ts_metadata("design:type", typeof Record === "undefined" ? Object : Record)
-], AssignCompanyPermissionDto.prototype, "metadata", void 0);
-let AssignBranchPermissionDto = class AssignBranchPermissionDto {
-    constructor(){
-        _define_property(this, "userId", void 0);
-        _define_property(this, "branchId", void 0);
-        _define_property(this, "metadata", void 0);
-    }
-};
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        example: '550e8400-e29b-41d4-a716-446655440000',
-        description: 'User ID to assign branch access to'
-    }),
-    (0, _classvalidator.IsUUID)(),
-    _ts_metadata("design:type", String)
-], AssignBranchPermissionDto.prototype, "userId", void 0);
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        example: '550e8400-e29b-41d4-a716-446655440002',
-        description: 'Branch ID to grant access to'
-    }),
-    (0, _classvalidator.IsUUID)(),
-    _ts_metadata("design:type", String)
-], AssignBranchPermissionDto.prototype, "branchId", void 0);
-_ts_decorate([
-    (0, _swagger.ApiPropertyOptional)({
-        example: {
-            role: 'staff'
-        },
-        description: 'Additional permission metadata'
-    }),
-    (0, _classvalidator.IsOptional)(),
-    (0, _classvalidator.IsObject)(),
-    _ts_metadata("design:type", typeof Record === "undefined" ? Object : Record)
-], AssignBranchPermissionDto.prototype, "metadata", void 0);

package/dtos/user-company-permission.dto.d.ts

@@ -1,10 +0,0 @@
-export declare class AssignCompanyPermissionDto {
-    userId: string;
-    companyId: string;
-    metadata?: Record<string, any>;
-}
-export declare class AssignBranchPermissionDto {
-    userId: string;
-    branchId: string;
-    metadata?: Record<string, any>;
-}

package/fesm/dtos/user-company-permission.dto.js

@@ -1,98 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
-import { IsObject, IsOptional, IsUUID } from 'class-validator';
-/**
- * Assign Company Permission DTO
- * Used internally by UserPermissionService
- */ export class AssignCompanyPermissionDto {
-    constructor(){
-        _define_property(this, "userId", void 0);
-        _define_property(this, "companyId", void 0);
-        _define_property(this, "metadata", void 0);
-    }
-}
-_ts_decorate([
-    ApiProperty({
-        example: '550e8400-e29b-41d4-a716-446655440000',
-        description: 'User ID to assign company access to'
-    }),
-    IsUUID(),
-    _ts_metadata("design:type", String)
-], AssignCompanyPermissionDto.prototype, "userId", void 0);
-_ts_decorate([
-    ApiProperty({
-        example: '550e8400-e29b-41d4-a716-446655440001',
-        description: 'Company ID to grant access to'
-    }),
-    IsUUID(),
-    _ts_metadata("design:type", String)
-], AssignCompanyPermissionDto.prototype, "companyId", void 0);
-_ts_decorate([
-    ApiPropertyOptional({
-        example: {
-            role: 'member'
-        },
-        description: 'Additional permission metadata'
-    }),
-    IsOptional(),
-    IsObject(),
-    _ts_metadata("design:type", typeof Record === "undefined" ? Object : Record)
-], AssignCompanyPermissionDto.prototype, "metadata", void 0);
-/**
- * Assign Branch Permission DTO
- * Used internally by UserPermissionService
- */ export class AssignBranchPermissionDto {
-    constructor(){
-        _define_property(this, "userId", void 0);
-        _define_property(this, "branchId", void 0);
-        _define_property(this, "metadata", void 0);
-    }
-}
-_ts_decorate([
-    ApiProperty({
-        example: '550e8400-e29b-41d4-a716-446655440000',
-        description: 'User ID to assign branch access to'
-    }),
-    IsUUID(),
-    _ts_metadata("design:type", String)
-], AssignBranchPermissionDto.prototype, "userId", void 0);
-_ts_decorate([
-    ApiProperty({
-        example: '550e8400-e29b-41d4-a716-446655440002',
-        description: 'Branch ID to grant access to'
-    }),
-    IsUUID(),
-    _ts_metadata("design:type", String)
-], AssignBranchPermissionDto.prototype, "branchId", void 0);
-_ts_decorate([
-    ApiPropertyOptional({
-        example: {
-            role: 'staff'
-        },
-        description: 'Additional permission metadata'
-    }),
-    IsOptional(),
-    IsObject(),
-    _ts_metadata("design:type", typeof Record === "undefined" ? Object : Record)
-], AssignBranchPermissionDto.prototype, "metadata", void 0);