@flusys/nestjs-auth 2.0.0 → 3.0.0

package/cjs/services/authentication.service.js

@@ -14,6 +14,7 @@ const _common = require("@nestjs/common");
 const _jwt = require("@nestjs/jwt");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _config = require("../config");
+const _userenricherinterface = require("../interfaces/user-enricher.interface");
 const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
@@ -92,11 +93,14 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let AuthenticationService = class AuthenticationService {
-    // Feature Flags
-    /** Check if company feature is enabled (tenant-aware with global fallback) */ isCompanyFeatureEnabled() {
+    isCompanyFeatureEnabled() {
         return this.dataSourceProvider?.isCompanyFeatureEnabled() ?? this.authConfig.isCompanyFeatureEnabled();
     }
-    // Repository Getters
+    isEmailVerificationEnabled() {
+        const featureEnabled = this.dataSourceProvider?.isEmailVerificationEnabled() ?? this.authConfig.isEmailVerificationEnabled();
+        const providerAvailable = this.authEmailService?.isEmailEnabled() ?? false;
+        return featureEnabled && providerAvailable;
+    }
     async getUserRepository() {
         if (!this.dataSourceProvider) {
             throw new Error('User repository not available');
@@ -115,10 +119,8 @@ let AuthenticationService = class AuthenticationService {
         if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
         return this.dataSourceProvider.getRepository(_companybranchentity.CompanyBranch);
     }
-    // Login
     async login(email, password) {
-        // Check for pending registration first (user registered but hasn't verified email yet)
-        if (await this.authEmailService?.hasPendingRegistration(email)) {
+        if (this.isEmailVerificationEnabled() && await this.authEmailService.hasPendingRegistration(email)) {
             return {
                 requiresEmailVerification: true,
                 email,
@@ -129,7 +131,7 @@ let AuthenticationService = class AuthenticationService {
         if (!user.isActive) {
             throw new _common.UnauthorizedException('User account is deactivated');
         }
-        if (this.authEmailService?.isEmailEnabled() && !user.emailVerified) {
+        if (this.isEmailVerificationEnabled() && !user.emailVerified) {
             return {
                 requiresEmailVerification: true,
                 email: user.email,
@@ -141,20 +143,18 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.handleCompanyBasedLogin(user);
     }
-    /** Handle login when company feature is enabled */ async handleCompanyBasedLogin(user) {
+    async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !branchRepository) {
             return this.generateLoginResponse(user);
         }
-        // Get company permissions
         const companyPermissions = await permissionRepository.find({
             where: {
                 userId: user.id,
                 permissionType: _enums.PermissionType.COMPANY
             }
         });
-        // Load companies
         const companyRepository = await this.getCompanyRepository();
         if (!companyRepository) {
             return this.generateLoginResponse(user);
@@ -165,12 +165,9 @@ let AuthenticationService = class AuthenticationService {
         }).andWhere('c.is_active = :active', {
             active: true
         }).getMany() : [];
-        // If user has no company assignments yet, return simple login response
-        // This allows users to login and be assigned to companies later
         if (companies.length === 0) {
             return this.generateLoginResponse(user);
         }
-        // Get branch permissions
         const branchPermissions = await permissionRepository.find({
             where: {
                 userId: user.id,
@@ -183,32 +180,25 @@ let AuthenticationService = class AuthenticationService {
         }).andWhere('b.is_active = :active', {
             active: true
         }).getMany() : [];
-        // Case 1: Single company, single branch → Direct login
         if (companies.length === 1 && branches.length === 1) {
             return this.generateLoginResponseWithCompany(user, companies[0], branches[0]);
         }
-        // Case 2: Multiple options → Selection required (frontend handles UI)
-        // Returns all companies with their branches for frontend to display
         return await this.generateCompanySelectionResponse(user, companies, branches);
     }
-    // Registration
-    /** Register a new user. If email enabled, creates pending registration. Otherwise creates user directly. */ async register(dto, verifyUrlBase) {
+    async register(dto, verifyUrlBase) {
         const userRepository = await this.getUserRepository();
         const existingUser = await userRepository.findOne({
             where: {
                 email: dto.email
             }
         });
-        // When company feature is enabled and user exists, allow joining/creating company
         if (existingUser && this.isCompanyFeatureEnabled()) {
             return this.handleExistingUserCompanyRegistration(existingUser, dto);
         }
-        // User exists but company feature is off - email must be unique
         if (existingUser) {
             throw new _common.BadRequestException('Registration failed due to email exists. Please try again or contact support.');
         }
-        // If email verification is enabled, create pending registration instead of user
-        if (this.authEmailService?.isEmailEnabled() && verifyUrlBase) {
+        if (this.isEmailVerificationEnabled() && verifyUrlBase) {
             const companyData = this.isCompanyFeatureEnabled() ? {
                 companySlug: dto.companySlug,
                 branchSlug: dto.branchSlug,
@@ -222,6 +212,7 @@ let AuthenticationService = class AuthenticationService {
                 phone: dto.phone,
                 password: dto.password,
                 companyData,
+                additionalFields: dto.additionalFields,
                 verifyUrlBase
             });
             return {
@@ -229,10 +220,9 @@ let AuthenticationService = class AuthenticationService {
                 message: result.message
             };
         }
-        // No email verification - create user directly
         return this.createUserDirectly(dto);
     }
-    /** Handle registration for existing user when company feature is enabled */ async handleExistingUserCompanyRegistration(existingUser, dto) {
+    async handleExistingUserCompanyRegistration(existingUser, dto) {
         if (!dto.companySlug && !dto.newCompanyName) {
             throw new _common.BadRequestException('Email already registered. Please login or provide a company to join/create.');
         }
@@ -241,7 +231,6 @@ let AuthenticationService = class AuthenticationService {
         if (!permissionRepository || !companyRepository) {
             throw new _common.BadRequestException('Company feature repositories not available');
         }
-        // For existing users joining a company, check if already assigned
         if (dto.companySlug) {
             const company = await companyRepository.findOne({
                 where: {
@@ -264,50 +253,92 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.processCompanyRegistration(existingUser, dto, true);
     }
-    /** Create user directly (no email verification) */ async createUserDirectly(dto) {
-        const userRepository = await this.getUserRepository();
-        const hashedPassword = await _bcrypt.hash(dto.password, _config.BCRYPT_SALT_ROUNDS);
-        const user = userRepository.create({
-            name: dto.name,
-            email: dto.email,
-            phone: dto.phone,
-            password: hashedPassword,
-            isActive: true,
-            emailVerified: false,
-            phoneVerified: false
-        });
-        await userRepository.save(user);
-        if (!this.isCompanyFeatureEnabled()) {
-            return this.generateRegistrationResponse(user);
+    async createUserDirectly(dto) {
+        if (!this.dataSourceProvider) {
+            throw new _common.BadRequestException('Data source not available');
+        }
+        const dataSource = await this.dataSourceProvider.getDataSource();
+        const queryRunner = dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            const hashedPassword = await _bcrypt.hash(dto.password, _config.BCRYPT_SALT_ROUNDS);
+            const user = queryRunner.manager.create(_userentity.User, {
+                name: dto.name,
+                email: dto.email,
+                phone: dto.phone,
+                password: hashedPassword,
+                isActive: true,
+                emailVerified: false,
+                phoneVerified: false
+            });
+            await queryRunner.manager.save(_userentity.User, user);
+            if (this.userEnricher?.onUserCreated) {
+                await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
+            }
+            await queryRunner.commitTransaction();
+            if (!this.isCompanyFeatureEnabled()) {
+                return this.generateRegistrationResponse(user);
+            }
+            return this.processCompanyRegistration(user, dto);
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            if (error instanceof _common.BadRequestException) {
+                throw error;
+            }
+            _utils.ErrorHandler.logError(this.logger, error, 'createUserDirectly');
+            throw new _common.BadRequestException('Registration failed. Please try again.');
+        } finally{
+            await queryRunner.release();
         }
-        return this.processCompanyRegistration(user, dto);
     }
-    /** Create user from pending registration (after email verification) */ async createUserFromPendingRegistration(pending) {
-        const userRepository = await this.getUserRepository();
-        const existingUser = await userRepository.findOne({
-            where: {
-                email: pending.email
+    async createUserFromPendingRegistration(pending) {
+        if (!this.dataSourceProvider) {
+            throw new _common.BadRequestException('Data source not available');
+        }
+        const dataSource = await this.dataSourceProvider.getDataSource();
+        const queryRunner = dataSource.createQueryRunner();
+        await queryRunner.connect();
+        await queryRunner.startTransaction();
+        try {
+            const existingUser = await queryRunner.manager.findOne(_userentity.User, {
+                where: {
+                    email: pending.email
+                }
+            });
+            if (existingUser) {
+                throw new _common.BadRequestException('This email has already been registered.');
             }
-        });
-        if (existingUser) {
-            throw new _common.BadRequestException('This email has already been registered.');
-        }
-        const user = userRepository.create({
-            name: pending.name,
-            email: pending.email,
-            phone: pending.phone,
-            password: pending.passwordHash,
-            isActive: true,
-            emailVerified: true,
-            phoneVerified: false
-        });
-        await userRepository.save(user);
-        if (this.isCompanyFeatureEnabled() && pending.companyData) {
-            return this.processCompanyRegistration(user, pending.companyData);
+            const user = queryRunner.manager.create(_userentity.User, {
+                name: pending.name,
+                email: pending.email,
+                phone: pending.phone,
+                password: pending.passwordHash,
+                isActive: true,
+                emailVerified: true,
+                phoneVerified: false
+            });
+            await queryRunner.manager.save(_userentity.User, user);
+            if (this.userEnricher?.onUserCreated) {
+                await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
+            }
+            await queryRunner.commitTransaction();
+            if (this.isCompanyFeatureEnabled() && pending.companyData) {
+                return this.processCompanyRegistration(user, pending.companyData);
+            }
+            return this.generateRegistrationResponse(user);
+        } catch (error) {
+            await queryRunner.rollbackTransaction();
+            if (error instanceof _common.BadRequestException) {
+                throw error;
+            }
+            _utils.ErrorHandler.logError(this.logger, error, 'createUserFromPendingRegistration');
+            throw new _common.BadRequestException('Registration failed. Please try again.');
+        } finally{
+            await queryRunner.release();
         }
-        return this.generateRegistrationResponse(user);
     }
-    /** Process company registration (join existing or create new) */ async processCompanyRegistration(user, data, throwOnUnavailable = false) {
+    async processCompanyRegistration(user, data, throwOnUnavailable = false) {
         const companyRepository = await this.getCompanyRepository();
         const branchRepository = await this.getBranchRepository();
         const permissionRepository = await this.getPermissionRepository();
@@ -322,7 +353,7 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.generateRegistrationResponse(user);
     }
-    /** Find existing company/branch or create new ones */ async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
+    async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
         if (data.companySlug) {
             const company = await companyRepo.findOne({
                 where: {
@@ -386,7 +417,7 @@ let AuthenticationService = class AuthenticationService {
             branch: null
         };
     }
-    /** Assign user to company and optionally branch */ async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
+    async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
         await permissionRepo.save(permissionRepo.create({
             userId,
             permissionType: _enums.PermissionType.COMPANY,
@@ -400,8 +431,7 @@ let AuthenticationService = class AuthenticationService {
             }));
         }
     }
-    // Company/Branch Selection
-    /** Select company and branch (step 2 of login). Frontend receives all options and user selects both. */ async select(sessionId, companyId, branchId) {
+    async select(sessionId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         if (!this.sessionService) {
             throw new _common.BadRequestException('Session service not available');
@@ -412,11 +442,11 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.validateAndLoginWithCompany(session.userId, companyId, branchId);
     }
-    /** Switch company/branch after login */ async switchCompany(userId, companyId, branchId) {
+    async switchCompany(userId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         return this.validateAndLoginWithCompany(userId, companyId, branchId);
     }
-    /** Shared: Validate user access to company/branch and generate login response */ async validateAndLoginWithCompany(userId, companyId, branchId) {
+    async validateAndLoginWithCompany(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -432,7 +462,6 @@ let AuthenticationService = class AuthenticationService {
         if (!permissionRepository || !companyRepository || !branchRepository) {
             throw new _common.BadRequestException('Repositories not available');
         }
-        // Validate company access
         const hasCompanyAccess = await permissionRepository.findOne({
             where: {
                 userId,
@@ -452,7 +481,6 @@ let AuthenticationService = class AuthenticationService {
         if (!company) {
             throw new _common.UnauthorizedException('Company not found or inactive');
         }
-        // Validate branch access
         const hasBranchAccess = await permissionRepository.findOne({
             where: {
                 userId,
@@ -475,8 +503,7 @@ let AuthenticationService = class AuthenticationService {
         }
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
-    // Token Management
-    /** Refresh access token (with token rotation). Returns new access token and new refresh token. */ async refreshToken(refreshToken) {
+    async refreshToken(refreshToken) {
         try {
             const payload = this.jwtService.verify(refreshToken, {
                 secret: this.authConfig.getRefreshTokenSecret()
@@ -510,7 +537,7 @@ let AuthenticationService = class AuthenticationService {
             throw new _common.UnauthorizedException('Invalid or expired refresh token');
         }
     }
-    /** Change password */ async changePassword(userId, currentPassword, newPassword) {
+    async changePassword(userId, currentPassword, newPassword) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -524,21 +551,19 @@ let AuthenticationService = class AuthenticationService {
         user.password = await _bcrypt.hash(newPassword, _config.BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
     }
-    /** Logout - Revokes all tokens. Stores revocation timestamp in cache. */ async logout(userId) {
+    async logout(userId) {
         if (!this.cacheManager) {
-            // Cache is required for secure logout - tokens cannot be revoked without it
             this.logger.error(`SECURITY: Cache not available for logout (userId: ${userId}). ` + 'Token revocation failed - tokens will remain valid until expiry. ' + 'Configure cache (Redis) to enable proper token revocation.');
             throw new _common.BadRequestException('Logout service temporarily unavailable. Please try again later.');
         }
-        const revokedAt = Math.floor(Date.now() / 1000); // Unix timestamp in seconds
+        const revokedAt = Math.floor(Date.now() / 1000);
         const cacheKey = `${_config.TOKEN_REVOKED_PREFIX}:${userId}`;
-        // TTL matches refresh token expiry (tokens older than this are already expired)
         const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
         const ttlMs = this.parseExpiryToMs(refreshTokenExpiry);
         await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
         this.logger.log(`User ${userId} logged out - all tokens revoked`);
     }
-    /** Check if a token is revoked (issued before user's revocation timestamp) */ async isTokenRevoked(userId, tokenIssuedAt) {
+    async isTokenRevoked(userId, tokenIssuedAt) {
         if (!this.cacheManager || !tokenIssuedAt) {
             return false;
         }
@@ -547,12 +572,11 @@ let AuthenticationService = class AuthenticationService {
         if (!revokedAt) {
             return false;
         }
-        // Token is revoked if it was issued before the revocation timestamp
         return tokenIssuedAt < revokedAt;
     }
-    /** Parse JWT expiry string to milliseconds */ parseExpiryToMs(expiry) {
+    parseExpiryToMs(expiry) {
         const match = expiry.match(/^(\d+)([smhd])$/);
-        if (!match) return 7 * 24 * 60 * 60 * 1000; // Default 7 days
+        if (!match) return 7 * 24 * 60 * 60 * 1000;
         const value = parseInt(match[1], 10);
         const unit = match[2];
         switch(unit){
@@ -568,8 +592,7 @@ let AuthenticationService = class AuthenticationService {
                 return 7 * 24 * 60 * 60 * 1000;
         }
     }
-    // Query Methods
-    /** Get user's companies */ async getUserCompanies(userId) {
+    async getUserCompanies(userId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
@@ -590,14 +613,13 @@ let AuthenticationService = class AuthenticationService {
             active: true
         }).orderBy('c.name', 'ASC').getMany();
     }
-    /** Get branches for a company that user has access to */ async getUserBranches(userId, companyId) {
+    async getUserBranches(userId, companyId) {
         this.ensureCompanyFeatureEnabled();
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !branchRepository) {
             throw new _common.BadRequestException('Repositories not available');
         }
-        // Verify company access
         const companyPermission = await permissionRepository.findOne({
             where: {
                 userId,
@@ -608,7 +630,6 @@ let AuthenticationService = class AuthenticationService {
         if (!companyPermission) {
             throw new _common.UnauthorizedException('No access to this company');
         }
-        // Get branch permissions
         const branchPermissions = await permissionRepository.find({
             where: {
                 userId,
@@ -625,7 +646,7 @@ let AuthenticationService = class AuthenticationService {
             active: true
         }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
     }
-    /** Get company by ID */ async getCompanyById(companyId) {
+    async getCompanyById(companyId) {
         const companyRepository = await this.getCompanyRepository();
         if (!companyRepository) {
             return null;
@@ -636,7 +657,7 @@ let AuthenticationService = class AuthenticationService {
             }
         });
     }
-    /** Get branch by ID */ async getBranchById(branchId) {
+    async getBranchById(branchId) {
         const branchRepository = await this.getBranchRepository();
         if (!branchRepository) {
             return null;
@@ -647,7 +668,7 @@ let AuthenticationService = class AuthenticationService {
             }
         });
     }
-    /** Get user info for /auth/me endpoint. Returns user, company, and branch info (no tokens). */ async getUserInfo(userId, companyId, branchId) {
+    async getUserInfo(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
         const user = await userRepository.findOne({
             where: {
@@ -673,7 +694,6 @@ let AuthenticationService = class AuthenticationService {
         }
         return response;
     }
-    // Helper Methods
     ensureCompanyFeatureEnabled() {
         if (!this.isCompanyFeatureEnabled()) {
             throw new _common.BadRequestException('Company feature is not enabled');
@@ -693,8 +713,7 @@ let AuthenticationService = class AuthenticationService {
         await userRepository.save(user);
         return user;
     }
-    // Response Generators
-    /** Create user info object */ toUserInfo(user) {
+    toUserInfo(user) {
         return {
             id: user.id,
             email: user.email,
@@ -703,7 +722,7 @@ let AuthenticationService = class AuthenticationService {
             profilePictureId: user.profilePictureId ?? null
         };
     }
-    /** Create company info object */ toCompanyInfo(company) {
+    toCompanyInfo(company) {
         return {
             id: company.id,
             name: company.name,
@@ -711,7 +730,7 @@ let AuthenticationService = class AuthenticationService {
             logoId: company.logoId ?? null
         };
     }
-    /** Create branch info object */ toBranchInfo(branch) {
+    toBranchInfo(branch) {
         return {
             id: branch.id,
             name: branch.name,
@@ -719,7 +738,7 @@ let AuthenticationService = class AuthenticationService {
             logoId: branch.logoId ?? null
         };
     }
-    /** Generate JWT tokens */ generateTokens(payload) {
+    generateTokens(payload) {
         const accessToken = this.jwtService.sign({
             ...payload,
             type: 'access'
@@ -801,13 +820,14 @@ let AuthenticationService = class AuthenticationService {
         };
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService){
+    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher){
         _define_property(this, "jwtService", void 0);
         _define_property(this, "authConfig", void 0);
         _define_property(this, "cacheManager", void 0);
         _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "sessionService", void 0);
         _define_property(this, "authEmailService", void 0);
+        _define_property(this, "userEnricher", void 0);
         _define_property(this, "logger", void 0);
         this.jwtService = jwtService;
         this.authConfig = authConfig;
@@ -815,6 +835,7 @@ let AuthenticationService = class AuthenticationService {
         this.dataSourceProvider = dataSourceProvider;
         this.sessionService = sessionService;
         this.authEmailService = authEmailService;
+        this.userEnricher = userEnricher;
         this.logger = new _common.Logger(AuthenticationService.name);
     }
 };
@@ -832,6 +853,8 @@ AuthenticationService = _ts_decorate([
     _ts_param(4, (0, _common.Inject)(_companyselectionsessionservice.CompanySelectionSessionService)),
     _ts_param(5, (0, _common.Optional)()),
     _ts_param(5, (0, _common.Inject)(_authemailservice.AuthEmailService)),
+    _ts_param(6, (0, _common.Optional)()),
+    _ts_param(6, (0, _common.Inject)(_config.USER_ENRICHER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _jwt.JwtService === "undefined" ? Object : _jwt.JwtService,
@@ -839,6 +862,7 @@ AuthenticationService = _ts_decorate([
         typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
         typeof _companyselectionsessionservice.CompanySelectionSessionService === "undefined" ? Object : _companyselectionsessionservice.CompanySelectionSessionService,
-        typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService
+        typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService,
+        typeof _userenricherinterface.IUserEnricher === "undefined" ? Object : _userenricherinterface.IUserEnricher
     ])
 ], AuthenticationService);