@flusys/nestjs-auth 3.0.0 → 4.0.0-rc

package/cjs/services/authentication.service.js

@@ -9,17 +9,23 @@ Object.defineProperty(exports, "AuthenticationService", {
     }
 });
 const _classes = require("@flusys/nestjs-shared/classes");
+const _constants = require("@flusys/nestjs-shared/constants");
+const _nestjsshared = require("@flusys/nestjs-shared");
+const _config = require("../config");
+const _interfaces = require("@flusys/nestjs-shared/interfaces");
+const _enums = require("@flusys/nestjs-shared/enums");
 const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
 const _jwt = require("@nestjs/jwt");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
-const _config = require("../config");
 const _userenricherinterface = require("../interfaces/user-enricher.interface");
+const _authenticationdto = require("../dtos/authentication.dto");
 const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
+const _pendingregistrationentity = require("../entities/pending-registration.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
 const _userentity = require("../entities/user.entity");
-const _enums = require("../enums");
+const _enums1 = require("../enums");
 const _authconfigservice = require("./auth-config.service");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 const _authemailservice = require("./auth-email.service");
@@ -103,7 +109,10 @@ let AuthenticationService = class AuthenticationService {
     }
     async getUserRepository() {
         if (!this.dataSourceProvider) {
-            throw new Error('User repository not available');
+            throw new _common.InternalServerErrorException({
+                message: 'User repository not available',
+                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+            });
         }
         return this.dataSourceProvider.getRepository(_userentity.User);
     }
@@ -124,24 +133,29 @@ let AuthenticationService = class AuthenticationService {
             return {
                 requiresEmailVerification: true,
                 email,
-                message: 'Please verify your email address to complete registration.'
+                message: 'Please verify your email address to complete registration.',
+                messageKey: _config.EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT
             };
         }
         const user = await this.validateUser(email, password);
         if (!user.isActive) {
-            throw new _common.UnauthorizedException('User account is deactivated');
+            throw new _common.UnauthorizedException({
+                message: 'User account is deactivated',
+                messageKey: _config.AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED
+            });
         }
         if (this.isEmailVerificationEnabled() && !user.emailVerified) {
             return {
                 requiresEmailVerification: true,
                 email: user.email,
-                message: 'Please verify your email address before logging in.'
+                message: 'Please verify your email address before logging in.',
+                messageKey: _config.AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED
             };
         }
         if (!this.isCompanyFeatureEnabled()) {
             return this.generateLoginResponse(user);
         }
-        return this.handleCompanyBasedLogin(user);
+        return await this.handleCompanyBasedLogin(user);
     }
     async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getPermissionRepository();
@@ -152,7 +166,7 @@ let AuthenticationService = class AuthenticationService {
         const companyPermissions = await permissionRepository.find({
             where: {
                 userId: user.id,
-                permissionType: _enums.PermissionType.COMPANY
+                permissionType: _enums1.PermissionType.COMPANY
             }
         });
         const companyRepository = await this.getCompanyRepository();
@@ -171,7 +185,7 @@ let AuthenticationService = class AuthenticationService {
         const branchPermissions = await permissionRepository.find({
             where: {
                 userId: user.id,
-                permissionType: _enums.PermissionType.BRANCH
+                permissionType: _enums1.PermissionType.BRANCH
             }
         });
         const branchIds = branchPermissions.map((p)=>p.targetId);
@@ -193,10 +207,13 @@ let AuthenticationService = class AuthenticationService {
             }
         });
         if (existingUser && this.isCompanyFeatureEnabled()) {
-            return this.handleExistingUserCompanyRegistration(existingUser, dto);
+            return await this.handleExistingUserCompanyRegistration(existingUser, dto);
         }
         if (existingUser) {
-            throw new _common.BadRequestException('Registration failed due to email exists. Please try again or contact support.');
+            throw new _common.BadRequestException({
+                message: 'Registration failed due to email exists. Please try again or contact support.',
+                messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
+            });
         }
         if (this.isEmailVerificationEnabled() && verifyUrlBase) {
             const companyData = this.isCompanyFeatureEnabled() ? {
@@ -217,19 +234,26 @@ let AuthenticationService = class AuthenticationService {
             });
             return {
                 requiresEmailVerification: true,
-                message: result.message
+                message: result.message,
+                messageKey: _config.EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT
             };
         }
-        return this.createUserDirectly(dto);
+        return await this.createUserDirectly(dto);
     }
     async handleExistingUserCompanyRegistration(existingUser, dto) {
         if (!dto.companySlug && !dto.newCompanyName) {
-            throw new _common.BadRequestException('Email already registered. Please login or provide a company to join/create.');
+            throw new _common.BadRequestException({
+                message: 'Email already registered. Please login or provide a company to join/create.',
+                messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
+            });
         }
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
         if (!permissionRepository || !companyRepository) {
-            throw new _common.BadRequestException('Company feature repositories not available');
+            throw new _common.BadRequestException({
+                message: 'Company feature repositories not available',
+                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+            });
         }
         if (dto.companySlug) {
             const company = await companyRepository.findOne({
@@ -242,20 +266,26 @@ let AuthenticationService = class AuthenticationService {
                 const existingPermission = await permissionRepository.findOne({
                     where: {
                         userId: existingUser.id,
-                        permissionType: _enums.PermissionType.COMPANY,
+                        permissionType: _enums1.PermissionType.COMPANY,
                         targetId: company.id
                     }
                 });
                 if (existingPermission) {
-                    throw new _common.BadRequestException('You are already assigned to this company. Please login.');
+                    throw new _common.BadRequestException({
+                        message: 'You are already assigned to this company. Please login.',
+                        messageKey: _config.AUTH_MESSAGES.REGISTER_COMPANY_ALREADY_ASSIGNED
+                    });
                 }
             }
         }
-        return this.processCompanyRegistration(existingUser, dto, true);
+        return await this.processCompanyRegistration(existingUser, dto, true);
     }
     async createUserDirectly(dto) {
         if (!this.dataSourceProvider) {
-            throw new _common.BadRequestException('Data source not available');
+            throw new _common.BadRequestException({
+                message: 'Data source not available',
+                messageKey: _constants.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
+            });
         }
         const dataSource = await this.dataSourceProvider.getDataSource();
         const queryRunner = dataSource.createQueryRunner();
@@ -280,21 +310,26 @@ let AuthenticationService = class AuthenticationService {
             if (!this.isCompanyFeatureEnabled()) {
                 return this.generateRegistrationResponse(user);
             }
-            return this.processCompanyRegistration(user, dto);
+            return await this.processCompanyRegistration(user, dto);
         } catch (error) {
             await queryRunner.rollbackTransaction();
             if (error instanceof _common.BadRequestException) {
                 throw error;
             }
-            _utils.ErrorHandler.logError(this.logger, error, 'createUserDirectly');
-            throw new _common.BadRequestException('Registration failed. Please try again.');
+            throw new _common.BadRequestException({
+                message: 'Registration failed. Please try again.',
+                messageKey: _config.AUTH_MESSAGES.REGISTER_FAILED
+            });
         } finally{
             await queryRunner.release();
         }
     }
     async createUserFromPendingRegistration(pending) {
         if (!this.dataSourceProvider) {
-            throw new _common.BadRequestException('Data source not available');
+            throw new _common.BadRequestException({
+                message: 'Data source not available',
+                messageKey: _constants.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
+            });
         }
         const dataSource = await this.dataSourceProvider.getDataSource();
         const queryRunner = dataSource.createQueryRunner();
@@ -307,7 +342,10 @@ let AuthenticationService = class AuthenticationService {
                 }
             });
             if (existingUser) {
-                throw new _common.BadRequestException('This email has already been registered.');
+                throw new _common.BadRequestException({
+                    message: 'This email has already been registered.',
+                    messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
+                });
             }
             const user = queryRunner.manager.create(_userentity.User, {
                 name: pending.name,
@@ -324,7 +362,7 @@ let AuthenticationService = class AuthenticationService {
             }
             await queryRunner.commitTransaction();
             if (this.isCompanyFeatureEnabled() && pending.companyData) {
-                return this.processCompanyRegistration(user, pending.companyData);
+                return await this.processCompanyRegistration(user, pending.companyData);
             }
             return this.generateRegistrationResponse(user);
         } catch (error) {
@@ -332,8 +370,10 @@ let AuthenticationService = class AuthenticationService {
             if (error instanceof _common.BadRequestException) {
                 throw error;
             }
-            _utils.ErrorHandler.logError(this.logger, error, 'createUserFromPendingRegistration');
-            throw new _common.BadRequestException('Registration failed. Please try again.');
+            throw new _common.BadRequestException({
+                message: 'Registration failed. Please try again.',
+                messageKey: _config.AUTH_MESSAGES.REGISTER_FAILED
+            });
         } finally{
             await queryRunner.release();
         }
@@ -343,7 +383,10 @@ let AuthenticationService = class AuthenticationService {
         const branchRepository = await this.getBranchRepository();
         const permissionRepository = await this.getPermissionRepository();
         if (!companyRepository || !branchRepository || !permissionRepository) {
-            if (throwOnUnavailable) throw new _common.BadRequestException('Company feature repositories not available');
+            if (throwOnUnavailable) throw new _common.BadRequestException({
+                message: 'Company feature repositories not available',
+                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+            });
             return this.generateRegistrationResponse(user);
         }
         const { company, branch } = await this.findOrCreateCompanyAndBranch(data, companyRepository, branchRepository);
@@ -361,7 +404,10 @@ let AuthenticationService = class AuthenticationService {
                     isActive: true
                 }
             });
-            if (!company) throw new _common.BadRequestException('Company not found or inactive');
+            if (!company) throw new _common.BadRequestException({
+                message: 'Company not found or inactive',
+                messageKey: _config.AUTH_MESSAGES.COMPANY_NOT_FOUND
+            });
             const branch = data.branchSlug ? await branchRepo.findOne({
                 where: {
                     slug: data.branchSlug,
@@ -378,7 +424,10 @@ let AuthenticationService = class AuthenticationService {
                     createdAt: 'ASC'
                 }
             });
-            if (data.branchSlug && !branch) throw new _common.BadRequestException('Branch not found or inactive');
+            if (data.branchSlug && !branch) throw new _common.BadRequestException({
+                message: 'Branch not found or inactive',
+                messageKey: _config.AUTH_MESSAGES.BRANCH_NOT_FOUND
+            });
             return {
                 company,
                 branch
@@ -420,13 +469,13 @@ let AuthenticationService = class AuthenticationService {
     async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
         await permissionRepo.save(permissionRepo.create({
             userId,
-            permissionType: _enums.PermissionType.COMPANY,
+            permissionType: _enums1.PermissionType.COMPANY,
             targetId: companyId
         }));
         if (branchId) {
             await permissionRepo.save(permissionRepo.create({
                 userId,
-                permissionType: _enums.PermissionType.BRANCH,
+                permissionType: _enums1.PermissionType.BRANCH,
                 targetId: branchId
             }));
         }
@@ -434,17 +483,23 @@ let AuthenticationService = class AuthenticationService {
     async select(sessionId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
         if (!this.sessionService) {
-            throw new _common.BadRequestException('Session service not available');
+            throw new _common.BadRequestException({
+                message: 'Session service not available',
+                messageKey: _config.AUTH_MESSAGES.SESSION_NOT_AVAILABLE
+            });
         }
         const session = await this.sessionService.consumeSession(sessionId);
         if (!session) {
-            throw new _common.UnauthorizedException('Invalid or expired session');
+            throw new _common.UnauthorizedException({
+                message: 'Invalid or expired session',
+                messageKey: _config.AUTH_MESSAGES.SESSION_INVALID
+            });
         }
-        return this.validateAndLoginWithCompany(session.userId, companyId, branchId);
+        return await this.validateAndLoginWithCompany(session.userId, companyId, branchId);
     }
     async switchCompany(userId, companyId, branchId) {
         this.ensureCompanyFeatureEnabled();
-        return this.validateAndLoginWithCompany(userId, companyId, branchId);
+        return await this.validateAndLoginWithCompany(userId, companyId, branchId);
     }
     async validateAndLoginWithCompany(userId, companyId, branchId) {
         const userRepository = await this.getUserRepository();
@@ -454,23 +509,32 @@ let AuthenticationService = class AuthenticationService {
             }
         });
         if (!user) {
-            throw new _common.NotFoundException('User not found');
+            throw new _common.NotFoundException({
+                message: 'User not found',
+                messageKey: _config.USER_MESSAGES.NOT_FOUND
+            });
         }
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !companyRepository || !branchRepository) {
-            throw new _common.BadRequestException('Repositories not available');
+            throw new _common.BadRequestException({
+                message: 'Repositories not available',
+                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+            });
         }
         const hasCompanyAccess = await permissionRepository.findOne({
             where: {
                 userId,
-                permissionType: _enums.PermissionType.COMPANY,
+                permissionType: _enums1.PermissionType.COMPANY,
                 targetId: companyId
             }
         });
         if (!hasCompanyAccess) {
-            throw new _common.UnauthorizedException('No access to this company');
+            throw new _common.UnauthorizedException({
+                message: 'No access to this company',
+                messageKey: _config.AUTH_MESSAGES.COMPANY_NO_ACCESS
+            });
         }
         const company = await companyRepository.findOne({
             where: {
@@ -479,17 +543,23 @@ let AuthenticationService = class AuthenticationService {
             }
         });
         if (!company) {
-            throw new _common.UnauthorizedException('Company not found or inactive');
+            throw new _common.UnauthorizedException({
+                message: 'Company not found or inactive',
+                messageKey: _config.AUTH_MESSAGES.COMPANY_NOT_FOUND
+            });
         }
         const hasBranchAccess = await permissionRepository.findOne({
             where: {
                 userId,
-                permissionType: _enums.PermissionType.BRANCH,
+                permissionType: _enums1.PermissionType.BRANCH,
                 targetId: branchId
             }
         });
         if (!hasBranchAccess) {
-            throw new _common.UnauthorizedException('No access to this branch');
+            throw new _common.UnauthorizedException({
+                message: 'No access to this branch',
+                messageKey: _config.AUTH_MESSAGES.BRANCH_NO_ACCESS
+            });
         }
         const branch = await branchRepository.findOne({
             where: {
@@ -499,7 +569,10 @@ let AuthenticationService = class AuthenticationService {
             }
         });
         if (!branch) {
-            throw new _common.UnauthorizedException('Branch not found or inactive');
+            throw new _common.UnauthorizedException({
+                message: 'Branch not found or inactive',
+                messageKey: _config.AUTH_MESSAGES.BRANCH_NOT_FOUND
+            });
         }
         return this.generateLoginResponseWithCompany(user, company, branch);
     }
@@ -509,7 +582,10 @@ let AuthenticationService = class AuthenticationService {
                 secret: this.authConfig.getRefreshTokenSecret()
             });
             if (await this.isTokenRevoked(payload.id, payload.iat)) {
-                throw new _common.UnauthorizedException('Token has been revoked');
+                throw new _common.UnauthorizedException({
+                    message: 'Token has been revoked',
+                    messageKey: _config.AUTH_MESSAGES.TOKEN_REVOKED
+                });
             }
             const userRepository = await this.getUserRepository();
             const user = await userRepository.findOne({
@@ -518,7 +594,10 @@ let AuthenticationService = class AuthenticationService {
                 }
             });
             if (!user || !user.isActive) {
-                throw new _common.UnauthorizedException('Invalid refresh token');
+                throw new _common.UnauthorizedException({
+                    message: 'Invalid refresh token',
+                    messageKey: _config.AUTH_MESSAGES.TOKEN_INVALID
+                });
             }
             return this.generateTokens({
                 id: user.id,
@@ -532,9 +611,11 @@ let AuthenticationService = class AuthenticationService {
                     branchId: payload.branchId
                 }
             });
-        } catch (error) {
-            _utils.ErrorHandler.logError(this.logger, error, 'refreshToken');
-            throw new _common.UnauthorizedException('Invalid or expired refresh token');
+        } catch  {
+            throw new _common.UnauthorizedException({
+                message: 'Invalid or expired refresh token',
+                messageKey: _config.AUTH_MESSAGES.TOKEN_EXPIRED
+            });
         }
     }
     async changePassword(userId, currentPassword, newPassword) {
@@ -544,24 +625,31 @@ let AuthenticationService = class AuthenticationService {
                 id: userId
             }
         });
-        if (!user) throw new _common.UnauthorizedException('User not found');
+        if (!user) throw new _common.UnauthorizedException({
+            message: 'User not found',
+            messageKey: _config.USER_MESSAGES.NOT_FOUND
+        });
         if (!await _bcrypt.compare(currentPassword, user.password || '')) {
-            throw new _common.UnauthorizedException('Current password is incorrect');
+            throw new _common.UnauthorizedException({
+                message: 'Current password is incorrect',
+                messageKey: _config.AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT
+            });
         }
         user.password = await _bcrypt.hash(newPassword, _config.BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
     }
     async logout(userId) {
         if (!this.cacheManager) {
-            this.logger.error(`SECURITY: Cache not available for logout (userId: ${userId}). ` + 'Token revocation failed - tokens will remain valid until expiry. ' + 'Configure cache (Redis) to enable proper token revocation.');
-            throw new _common.BadRequestException('Logout service temporarily unavailable. Please try again later.');
+            throw new _common.BadRequestException({
+                message: 'Logout service temporarily unavailable. Please try again later.',
+                messageKey: _config.AUTH_MESSAGES.LOGOUT_SERVICE_UNAVAILABLE
+            });
         }
         const revokedAt = Math.floor(Date.now() / 1000);
         const cacheKey = `${_config.TOKEN_REVOKED_PREFIX}:${userId}`;
         const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
         const ttlMs = this.parseExpiryToMs(refreshTokenExpiry);
         await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
-        this.logger.log(`User ${userId} logged out - all tokens revoked`);
     }
     async isTokenRevoked(userId, tokenIssuedAt) {
         if (!this.cacheManager || !tokenIssuedAt) {
@@ -597,12 +685,15 @@ let AuthenticationService = class AuthenticationService {
         const permissionRepository = await this.getPermissionRepository();
         const companyRepository = await this.getCompanyRepository();
         if (!permissionRepository || !companyRepository) {
-            throw new _common.BadRequestException('Repositories not available');
+            throw new _common.BadRequestException({
+                message: 'Repositories not available',
+                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+            });
         }
         const permissions = await permissionRepository.find({
             where: {
                 userId,
-                permissionType: _enums.PermissionType.COMPANY
+                permissionType: _enums1.PermissionType.COMPANY
             }
         });
         const companyIds = permissions.map((p)=>p.targetId);
@@ -618,22 +709,28 @@ let AuthenticationService = class AuthenticationService {
         const permissionRepository = await this.getPermissionRepository();
         const branchRepository = await this.getBranchRepository();
         if (!permissionRepository || !branchRepository) {
-            throw new _common.BadRequestException('Repositories not available');
+            throw new _common.BadRequestException({
+                message: 'Repositories not available',
+                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+            });
         }
         const companyPermission = await permissionRepository.findOne({
             where: {
                 userId,
-                permissionType: _enums.PermissionType.COMPANY,
+                permissionType: _enums1.PermissionType.COMPANY,
                 targetId: companyId
             }
         });
         if (!companyPermission) {
-            throw new _common.UnauthorizedException('No access to this company');
+            throw new _common.UnauthorizedException({
+                message: 'No access to this company',
+                messageKey: _config.AUTH_MESSAGES.COMPANY_NO_ACCESS
+            });
         }
         const branchPermissions = await permissionRepository.find({
             where: {
                 userId,
-                permissionType: _enums.PermissionType.BRANCH
+                permissionType: _enums1.PermissionType.BRANCH
             }
         });
         const branchIds = branchPermissions.map((p)=>p.targetId);
@@ -675,20 +772,32 @@ let AuthenticationService = class AuthenticationService {
                 id: userId
             }
         });
-        if (!user) throw new _common.UnauthorizedException('User not found');
+        if (!user) throw new _common.UnauthorizedException({
+            message: 'User not found',
+            messageKey: _config.USER_MESSAGES.NOT_FOUND
+        });
         const response = {
             user: this.toUserInfo(user)
         };
         if (this.isCompanyFeatureEnabled()) {
             if (!companyId) {
-                throw new _common.UnauthorizedException('Company feature is enabled but user has no company assigned.');
+                throw new _common.UnauthorizedException({
+                    message: 'Company feature is enabled but user has no company assigned.',
+                    messageKey: _config.AUTH_MESSAGES.COMPANY_REQUIRED
+                });
             }
             const company = await this.getCompanyById(companyId);
-            if (!company) throw new _common.UnauthorizedException('Company not found.');
+            if (!company) throw new _common.UnauthorizedException({
+                message: 'Company not found.',
+                messageKey: _config.AUTH_MESSAGES.COMPANY_NOT_FOUND
+            });
             response.company = this.toCompanyInfo(company);
             if (branchId) {
                 const branch = await this.getBranchById(branchId);
-                if (!branch) throw new _common.UnauthorizedException('Branch not found.');
+                if (!branch) throw new _common.UnauthorizedException({
+                    message: 'Branch not found.',
+                    messageKey: _config.AUTH_MESSAGES.BRANCH_NOT_FOUND
+                });
                 response.branch = this.toBranchInfo(branch);
             }
         }
@@ -696,7 +805,10 @@ let AuthenticationService = class AuthenticationService {
     }
     ensureCompanyFeatureEnabled() {
         if (!this.isCompanyFeatureEnabled()) {
-            throw new _common.BadRequestException('Company feature is not enabled');
+            throw new _common.BadRequestException({
+                message: 'Company feature is not enabled',
+                messageKey: _config.AUTH_MESSAGES.COMPANY_FEATURE_NOT_ENABLED
+            });
         }
     }
     async validateUser(email, password) {
@@ -707,7 +819,10 @@ let AuthenticationService = class AuthenticationService {
             }
         });
         if (!user || !await _bcrypt.compare(password, user.password || '')) {
-            throw new _common.UnauthorizedException('Invalid credentials');
+            throw new _common.UnauthorizedException({
+                message: 'Invalid credentials',
+                messageKey: _config.AUTH_MESSAGES.LOGIN_INVALID_CREDENTIALS
+            });
         }
         user.lastLoginAt = new Date();
         await userRepository.save(user);
@@ -764,6 +879,7 @@ let AuthenticationService = class AuthenticationService {
             email: user.email,
             type: 'access'
         });
+        this.sendLoginNotification(user.id);
         return {
             accessToken,
             refreshToken,
@@ -778,6 +894,7 @@ let AuthenticationService = class AuthenticationService {
             companyId: company.id,
             branchId: branch?.id
         });
+        this.sendLoginNotification(user.id, company.id);
         return {
             accessToken,
             refreshToken,
@@ -786,9 +903,24 @@ let AuthenticationService = class AuthenticationService {
             branch: branch ? this.toBranchInfo(branch) : undefined
         };
     }
+    sendLoginNotification(userId, companyId) {
+        if (!this.notificationAdapter) return;
+        this.notificationAdapter.send({
+            userId,
+            title: 'Login successful',
+            message: 'You have successfully logged in to your account.',
+            type: _enums.NotificationType.INFO,
+            companyId
+        }).catch(()=>{
+        // Silent failure - notification is non-critical
+        });
+    }
     async generateCompanySelectionResponse(user, companies, branches) {
         if (!this.sessionService) {
-            throw new _common.BadRequestException('Session service not available');
+            throw new _common.BadRequestException({
+                message: 'Session service not available',
+                messageKey: _config.AUTH_MESSAGES.SESSION_NOT_AVAILABLE
+            });
         }
         const sessionId = await this.sessionService.createSession(user.id);
         const companiesWithBranches = companies.map((company)=>({
@@ -820,7 +952,7 @@ let AuthenticationService = class AuthenticationService {
         };
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher){
+    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher, notificationAdapter){
         _define_property(this, "jwtService", void 0);
         _define_property(this, "authConfig", void 0);
         _define_property(this, "cacheManager", void 0);
@@ -828,7 +960,7 @@ let AuthenticationService = class AuthenticationService {
         _define_property(this, "sessionService", void 0);
         _define_property(this, "authEmailService", void 0);
         _define_property(this, "userEnricher", void 0);
-        _define_property(this, "logger", void 0);
+        _define_property(this, "notificationAdapter", void 0);
         this.jwtService = jwtService;
         this.authConfig = authConfig;
         this.cacheManager = cacheManager;
@@ -836,9 +968,109 @@ let AuthenticationService = class AuthenticationService {
         this.sessionService = sessionService;
         this.authEmailService = authEmailService;
         this.userEnricher = userEnricher;
-        this.logger = new _common.Logger(AuthenticationService.name);
+        this.notificationAdapter = notificationAdapter;
     }
 };
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'auth.login',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "login", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'auth.register',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationdto.RegistrationDto === "undefined" ? Object : _authenticationdto.RegistrationDto,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "register", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'auth.createUser',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _authenticationdto.RegistrationDto === "undefined" ? Object : _authenticationdto.RegistrationDto
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "createUserDirectly", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'auth.createUserFromPending',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _pendingregistrationentity.PendingRegistration === "undefined" ? Object : _pendingregistrationentity.PendingRegistration
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "createUserFromPendingRegistration", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'auth.companySwitch',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "validateAndLoginWithCompany", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'auth.refreshToken',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "refreshToken", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'auth.changePassword',
+        module: 'auth',
+        includeParams: false
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "changePassword", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'auth.logout',
+        module: 'auth'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], AuthenticationService.prototype, "logout", null);
 AuthenticationService = _ts_decorate([
     (0, _common.Injectable)({
         scope: _common.Scope.REQUEST
@@ -855,6 +1087,8 @@ AuthenticationService = _ts_decorate([
     _ts_param(5, (0, _common.Inject)(_authemailservice.AuthEmailService)),
     _ts_param(6, (0, _common.Optional)()),
     _ts_param(6, (0, _common.Inject)(_config.USER_ENRICHER)),
+    _ts_param(7, (0, _common.Optional)()),
+    _ts_param(7, (0, _common.Inject)(_interfaces.NOTIFICATION_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _jwt.JwtService === "undefined" ? Object : _jwt.JwtService,
@@ -863,6 +1097,7 @@ AuthenticationService = _ts_decorate([
         typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
         typeof _companyselectionsessionservice.CompanySelectionSessionService === "undefined" ? Object : _companyselectionsessionservice.CompanySelectionSessionService,
         typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService,
-        typeof _userenricherinterface.IUserEnricher === "undefined" ? Object : _userenricherinterface.IUserEnricher
+        typeof _userenricherinterface.IUserEnricher === "undefined" ? Object : _userenricherinterface.IUserEnricher,
+        typeof _interfaces.INotificationAdapter === "undefined" ? Object : _interfaces.INotificationAdapter
     ])
 ], AuthenticationService);