@flusys/nestjs-auth 1.1.0-beta → 2.0.0

package/cjs/dtos/authentication.dto.js

@@ -72,6 +72,7 @@ _export(exports, {
 });
 const _swagger = require("@nestjs/swagger");
 const _classvalidator = require("class-validator");
+const _passwordvalidator = require("../validators/password.validator");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -111,12 +112,12 @@ _ts_decorate([
 ], LoginDto.prototype, "email", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: '123456',
-        description: 'User password (min 6 chars)'
+        example: 'SecureP@ss1',
+        description: 'User password'
     }),
     (0, _classvalidator.IsString)(),
     (0, _classvalidator.IsNotEmpty)(),
-    (0, _classvalidator.MinLength)(6),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], LoginDto.prototype, "password", void 0);
 let RegistrationDto = class RegistrationDto {
@@ -155,13 +156,13 @@ _ts_decorate([
 ], RegistrationDto.prototype, "email", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: 'strongPassword123',
-        description: 'Password (min 6 chars)'
+        example: 'StrongP@ss123',
+        description: 'Password (min 8 chars, requires uppercase, lowercase, number, special char)'
     }),
     (0, _classvalidator.IsNotEmpty)(),
     (0, _classvalidator.IsString)(),
-    (0, _classvalidator.MinLength)(6),
-    (0, _classvalidator.MaxLength)(60),
+    (0, _passwordvalidator.IsStrongPassword)(),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], RegistrationDto.prototype, "password", void 0);
 _ts_decorate([
@@ -222,6 +223,7 @@ _ts_decorate([
     }),
     (0, _classvalidator.IsOptional)(),
     (0, _classvalidator.IsString)(),
+    (0, _classvalidator.MaxLength)(500),
     _ts_metadata("design:type", String)
 ], RegistrationDto.prototype, "newCompanyAddress", void 0);
 let RefreshTokenDto = class RefreshTokenDto {
@@ -251,16 +253,17 @@ _ts_decorate([
     }),
     (0, _classvalidator.IsString)(),
     (0, _classvalidator.IsNotEmpty)(),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], ChangePasswordDto.prototype, "currentPassword", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: 'newPassword456',
-        description: 'New password (min 6 chars)'
+        example: 'NewP@ssword456',
+        description: 'New password (min 8 chars, requires uppercase, lowercase, number, special char)'
     }),
     (0, _classvalidator.IsString)(),
     (0, _classvalidator.IsNotEmpty)(),
-    (0, _classvalidator.MinLength)(6),
+    (0, _passwordvalidator.IsStrongPassword)(),
     _ts_metadata("design:type", String)
 ], ChangePasswordDto.prototype, "newPassword", void 0);
 let SelectDto = class SelectDto {
@@ -428,7 +431,6 @@ let BranchSelectionInfoDto = class BranchSelectionInfoDto {
         _define_property(this, "id", void 0);
         _define_property(this, "name", void 0);
         _define_property(this, "slug", void 0);
-        _define_property(this, "isActive", void 0);
         _define_property(this, "logoId", void 0);
     }
 };
@@ -450,12 +452,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", String)
 ], BranchSelectionInfoDto.prototype, "slug", void 0);
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        example: true
-    }),
-    _ts_metadata("design:type", Boolean)
-], BranchSelectionInfoDto.prototype, "isActive", void 0);
 _ts_decorate([
     (0, _swagger.ApiPropertyOptional)({
         example: '550e8400-e29b-41d4-a716-446655440077',
@@ -469,7 +465,6 @@ let CompanyWithBranchesDto = class CompanyWithBranchesDto {
         _define_property(this, "id", void 0);
         _define_property(this, "name", void 0);
         _define_property(this, "slug", void 0);
-        _define_property(this, "isActive", void 0);
         _define_property(this, "logoId", void 0);
         _define_property(this, "branches", void 0);
     }
@@ -492,12 +487,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", String)
 ], CompanyWithBranchesDto.prototype, "slug", void 0);
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        example: true
-    }),
-    _ts_metadata("design:type", Boolean)
-], CompanyWithBranchesDto.prototype, "isActive", void 0);
 _ts_decorate([
     (0, _swagger.ApiPropertyOptional)({
         example: '550e8400-e29b-41d4-a716-446655440088',
@@ -522,7 +511,6 @@ let LoginResponseDto = class LoginResponseDto {
         _define_property(this, "user", void 0);
         _define_property(this, "company", void 0);
         _define_property(this, "branch", void 0);
-        _define_property(this, "companyFeatureEnabled", void 0);
     }
 };
 _ts_decorate([
@@ -558,13 +546,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", typeof BranchInfoDto === "undefined" ? Object : BranchInfoDto)
 ], LoginResponseDto.prototype, "branch", void 0);
-_ts_decorate([
-    (0, _swagger.ApiPropertyOptional)({
-        example: true,
-        description: 'Whether company feature is enabled'
-    }),
-    _ts_metadata("design:type", Boolean)
-], LoginResponseDto.prototype, "companyFeatureEnabled", void 0);
 let RegistrationResponseDto = class RegistrationResponseDto {
     constructor(){
         _define_property(this, "accessToken", void 0);
@@ -572,7 +553,6 @@ let RegistrationResponseDto = class RegistrationResponseDto {
         _define_property(this, "user", void 0);
         _define_property(this, "company", void 0);
         _define_property(this, "branch", void 0);
-        _define_property(this, "companyFeatureEnabled", void 0);
         _define_property(this, "requiresEmailVerification", void 0);
     }
 };
@@ -609,13 +589,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", typeof BranchInfoDto === "undefined" ? Object : BranchInfoDto)
 ], RegistrationResponseDto.prototype, "branch", void 0);
-_ts_decorate([
-    (0, _swagger.ApiPropertyOptional)({
-        example: true,
-        description: 'Whether company feature is enabled'
-    }),
-    _ts_metadata("design:type", Boolean)
-], RegistrationResponseDto.prototype, "companyFeatureEnabled", void 0);
 _ts_decorate([
     (0, _swagger.ApiPropertyOptional)({
         example: true,
@@ -753,12 +726,12 @@ _ts_decorate([
 ], ResetPasswordDto.prototype, "token", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: 'newSecurePassword123',
-        description: 'New password (min 6 chars)'
+        example: 'NewSecureP@ss123',
+        description: 'New password (min 8 chars, requires uppercase, lowercase, number, special char)'
     }),
     (0, _classvalidator.IsString)(),
     (0, _classvalidator.IsNotEmpty)(),
-    (0, _classvalidator.MinLength)(6),
+    (0, _passwordvalidator.IsStrongPassword)(),
     _ts_metadata("design:type", String)
 ], ResetPasswordDto.prototype, "newPassword", void 0);
 let VerifyEmailDto = class VerifyEmailDto {

package/cjs/dtos/index.js

@@ -5,7 +5,6 @@ Object.defineProperty(exports, "__esModule", {
 _export_star(require("./authentication.dto"), exports);
 _export_star(require("./company-branch.dto"), exports);
 _export_star(require("./company.dto"), exports);
-_export_star(require("./user-company-permission.dto"), exports);
 _export_star(require("./user.dto"), exports);
 _export_star(require("./user-permission.dto"), exports);
 function _export_star(from, to) {

package/cjs/dtos/user-permission.dto.js

@@ -254,9 +254,23 @@ _ts_decorate([
 ], UserBranchPermissionDto.prototype, "companyId", void 0);
 let UserCompaniesResponseDto = class UserCompaniesResponseDto {
     constructor(){
+        _define_property(this, "success", void 0);
+        _define_property(this, "message", void 0);
         _define_property(this, "data", void 0);
     }
 };
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: true
+    }),
+    _ts_metadata("design:type", Boolean)
+], UserCompaniesResponseDto.prototype, "success", void 0);
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'User companies retrieved successfully'
+    }),
+    _ts_metadata("design:type", String)
+], UserCompaniesResponseDto.prototype, "message", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
         description: 'List of companies the user has access to',
@@ -284,9 +298,23 @@ _ts_decorate([
 ], UserCompaniesResponseDto.prototype, "data", void 0);
 let UserBranchesResponseDto = class UserBranchesResponseDto {
     constructor(){
+        _define_property(this, "success", void 0);
+        _define_property(this, "message", void 0);
         _define_property(this, "data", void 0);
     }
 };
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: true
+    }),
+    _ts_metadata("design:type", Boolean)
+], UserBranchesResponseDto.prototype, "success", void 0);
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        example: 'User branches retrieved successfully'
+    }),
+    _ts_metadata("design:type", String)
+], UserBranchesResponseDto.prototype, "message", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
         description: 'List of branches the user has access to',

package/cjs/dtos/user.dto.js

@@ -21,6 +21,7 @@ _export(exports, {
 });
 const _swagger = require("@nestjs/swagger");
 const _classvalidator = require("class-validator");
+const _passwordvalidator = require("../validators/password.validator");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -83,10 +84,13 @@ _ts_decorate([
 ], CreateUserDto.prototype, "email", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
-        example: 'password123',
-        description: 'Password'
+        example: 'SecureP@ss123',
+        description: 'Password (must meet complexity requirements)'
     }),
     (0, _classvalidator.IsString)(),
+    (0, _classvalidator.IsNotEmpty)(),
+    (0, _passwordvalidator.IsStrongPassword)(),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], CreateUserDto.prototype, "password", void 0);
 _ts_decorate([
@@ -139,6 +143,7 @@ let UpdateUserDto = class UpdateUserDto {
         _define_property(this, "phone", void 0);
         _define_property(this, "email", void 0);
         _define_property(this, "password", void 0);
+        _define_property(this, "oldPassword", void 0);
         _define_property(this, "profilePictureId", void 0);
         _define_property(this, "isActive", void 0);
         _define_property(this, "emailVerified", void 0);
@@ -150,7 +155,7 @@ _ts_decorate([
     (0, _swagger.ApiProperty)({
         description: 'User ID'
     }),
-    (0, _classvalidator.IsString)(),
+    (0, _classvalidator.IsUUID)(),
     _ts_metadata("design:type", String)
 ], UpdateUserDto.prototype, "id", void 0);
 _ts_decorate([
@@ -182,12 +187,22 @@ _ts_decorate([
 ], UpdateUserDto.prototype, "email", void 0);
 _ts_decorate([
     (0, _swagger.ApiPropertyOptional)({
-        description: 'New password'
+        description: 'New password (must meet complexity requirements)'
     }),
     (0, _classvalidator.IsOptional)(),
     (0, _classvalidator.IsString)(),
+    (0, _passwordvalidator.IsStrongPassword)(),
+    (0, _classvalidator.MaxLength)(128),
     _ts_metadata("design:type", String)
 ], UpdateUserDto.prototype, "password", void 0);
+_ts_decorate([
+    (0, _swagger.ApiPropertyOptional)({
+        description: 'Current password (required when changing password on own profile)'
+    }),
+    (0, _classvalidator.IsOptional)(),
+    (0, _classvalidator.IsString)(),
+    _ts_metadata("design:type", String)
+], UpdateUserDto.prototype, "oldPassword", void 0);
 _ts_decorate([
     (0, _swagger.ApiPropertyOptional)({
         description: 'Profile picture file ID'

package/cjs/entities/user-company-permission.entity.js

@@ -44,12 +44,6 @@ function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 let UserCompanyPermission = class UserCompanyPermission {
-    /* ---------- Helpers ---------- */ isCompanyPermission() {
-        return this.permissionType === _enums.PermissionType.COMPANY;
-    }
-    isBranchPermission() {
-        return this.permissionType === _enums.PermissionType.BRANCH;
-    }
     constructor(){
         _define_property(this, "id", void 0);
         /* ---------- Ownership ---------- */ _define_property(this, "userId", void 0);

package/cjs/interceptors/clear-token.interceptor.js

@@ -8,8 +8,10 @@ Object.defineProperty(exports, "ClearToken", {
         return ClearToken;
     }
 });
+const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
 const _rxjs = require("rxjs");
+const _config = require("../config");
 const _authconfigservice = require("../services/auth-config.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -38,39 +40,24 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-const DEFAULT_COOKIE_NAME = 'fsn_refresh_token';
 let ClearToken = class ClearToken {
     get cookieName() {
-        return this.authConfig?.getRefreshTokenCookieName() ?? DEFAULT_COOKIE_NAME;
+        return this.authConfig?.getRefreshTokenCookieName() ?? _config.DEFAULT_COOKIE_NAME;
     }
     intercept(context, next) {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe((0, _rxjs.map)((value)=>{
-            // Clear the refresh token cookie
-            this.clearRefreshTokenCookie(req, res);
+            if ((0, _utils.isBrowserRequest)(req)) {
+                res.clearCookie(this.cookieName, {
+                    httpOnly: true,
+                    path: '/',
+                    ...(0, _utils.buildCookieOptions)(req)
+                });
+            }
             return value;
         }));
     }
-    /**
-   * Clear refresh token cookie
-   */ clearRefreshTokenCookie(req, res) {
-        const origin = req.headers.origin || '';
-        const hostname = req.hostname || '';
-        const isHttps = origin.startsWith('https://') || req.secure;
-        let cookieDomain = hostname;
-        const domainParts = hostname.split('.');
-        if (domainParts.length > 2) {
-            cookieDomain = '.' + domainParts.slice(-2).join('.');
-        }
-        res.clearCookie(this.cookieName, {
-            httpOnly: true,
-            secure: isHttps,
-            sameSite: isHttps ? 'strict' : 'lax',
-            domain: cookieDomain,
-            path: '/'
-        });
-    }
     constructor(authConfig){
         _define_property(this, "authConfig", void 0);
         this.authConfig = authConfig;

package/cjs/interceptors/set-token.interceptor.js

@@ -8,9 +8,11 @@ Object.defineProperty(exports, "SetToken", {
         return SetToken;
     }
 });
+const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
 const _buffer = require("buffer");
 const _rxjs = require("rxjs");
+const _config = require("../config");
 const _authconfigservice = require("../services/auth-config.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -39,80 +41,37 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-const DEFAULT_COOKIE_NAME = 'fsn_refresh_token';
-const MAX_COOKIE_BYTES = 3500;
 let SetToken = class SetToken {
     get cookieName() {
-        return this.authConfig?.getRefreshTokenCookieName() ?? DEFAULT_COOKIE_NAME;
+        return this.authConfig?.getRefreshTokenCookieName() ?? _config.DEFAULT_COOKIE_NAME;
+    }
+    get maxAgeMs() {
+        return (0, _utils.parseDurationToMs)(this.authConfig?.getRefreshTokenExpiration() ?? '7d');
     }
     intercept(context, next) {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe((0, _rxjs.map)((value)=>{
-            // Skip if no refreshToken in response
-            if (!value || !value.refreshToken) {
-                return value;
-            }
-            const isBrowser = this.isBrowserRequest(req);
-            const tokenValue = value.refreshToken;
-            if (isBrowser) {
-                // Browser: Set cookie and remove from response body
-                this.setRefreshTokenCookie(req, res, tokenValue);
-                // Return response without refreshToken for browsers
+            if (!value?.refreshToken) return value;
+            if ((0, _utils.isBrowserRequest)(req)) {
+                this.setRefreshTokenCookie(req, res, value.refreshToken);
                 const { refreshToken, ...responseWithoutToken } = value;
                 return responseWithoutToken;
             }
-            // API/Mobile: Keep refreshToken in response body
             return value;
         }), (0, _rxjs.catchError)((err)=>(0, _rxjs.throwError)(()=>err)));
     }
-    /**
-   * Detect if request is from a browser
-   * Checks Accept header and custom X-Client-Type header
-   */ isBrowserRequest(req) {
-        // Check custom header first (allows explicit client identification)
-        const clientType = req.headers['x-client-type'];
-        if (clientType) {
-            return clientType.toLowerCase() === 'browser' || clientType.toLowerCase() === 'web';
-        }
-        // Check Accept header - browsers typically include text/html
-        const accept = req.headers['accept'] || '';
-        if (accept.includes('text/html')) {
-            return true;
-        }
-        // Check User-Agent for common browsers
-        const userAgent = req.headers['user-agent'] || '';
-        const browserPatterns = /mozilla|chrome|safari|firefox|edge|opera|msie/i;
-        if (browserPatterns.test(userAgent) && !userAgent.includes('Postman')) {
-            return true;
-        }
-        return false;
-    }
-    /**
-   * Set refresh token in HTTP-only cookie
-   */ setRefreshTokenCookie(req, res, tokenValue) {
-        const origin = req.headers.origin || '';
-        const hostname = req.hostname || '';
-        const isHttps = origin.startsWith('https://') || req.secure;
-        let cookieDomain = hostname;
-        const domainParts = hostname.split('.');
-        if (domainParts.length > 2) {
-            cookieDomain = '.' + domainParts.slice(-2).join('.');
-        }
-        // Check cookie size
-        const rawCookieString = `${this.cookieName}=${tokenValue}; HttpOnly; Domain=${cookieDomain}`;
+    setRefreshTokenCookie(req, res, tokenValue) {
+        const rawCookieString = `${this.cookieName}=${tokenValue}; HttpOnly`;
         const estimatedBytes = _buffer.Buffer.byteLength(rawCookieString, 'utf8');
-        if (estimatedBytes > MAX_COOKIE_BYTES) {
+        if (estimatedBytes > _config.MAX_COOKIE_BYTES) {
             throw new _common.PayloadTooLargeException(`Refresh token too large (≈${estimatedBytes} bytes)`);
         }
-        // Set HTTP-only secure cookie
         res.cookie(this.cookieName, tokenValue, {
             httpOnly: true,
-            secure: isHttps,
-            sameSite: isHttps ? 'strict' : 'lax',
-            domain: cookieDomain,
             path: '/',
-            maxAge: 7 * 24 * 60 * 60 * 1000
+            maxAge: this.maxAgeMs,
+            ...(0, _utils.buildCookieOptions)(req)
         });
     }
     constructor(authConfig){
@@ -123,6 +82,7 @@ let SetToken = class SetToken {
 SetToken = _ts_decorate([
     (0, _common.Injectable)(),
     _ts_param(0, (0, _common.Optional)()),
+    _ts_param(0, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService

package/cjs/interfaces/auth-email-provider.interface.js

@@ -1,5 +1,5 @@
 /**
- * Auth Email Provider Interface
+ * Auth Email  Provider Interface
  *
  * This interface defines the contract for email sending in the auth module.
  * It allows auth to work independently of the email module.