@flusys/nestjs-auth 4.1.0 → 5.0.0

package/cjs/docs/auth-swagger.config.js

@@ -8,36 +8,17 @@ Object.defineProperty(exports, "authSwaggerConfig", {
         return authSwaggerConfig;
     }
 });
-/** Tags used for company-related APIs (excluded when company feature is disabled) */ const COMPANY_RELATED_TAGS = [
+// ============================================================================
+// Company feature exclusions
+// ============================================================================
+const COMPANY_RELATED_TAGS = [
     'Companies',
     'Branches',
     'User Permissions',
     'Company Selection'
 ];
-/** Examples to exclude when company feature is disabled */ const COMPANY_EXAMPLE_EXCLUSIONS = [
-    {
-        pathPattern: '/auth/login',
-        method: 'post',
-        examples: [
-            'loginSuccessWithCompany',
-            'companySelection'
-        ]
-    }
-];
-/**
- * Schema properties to exclude when company feature is disabled
- *
- * This list controls which DTO properties are hidden from Swagger documentation
- * when bootstrapConfig.enableCompanyFeature = false
- *
- * **Documentation:**
- * - Usage: See FLUSYS_NEST/docs/AUTH-GUIDE.md "Swagger Schema Behavior" section
- * - Mechanism: See FLUSYS_NEST/docs/CORE-GUIDE.md "excludeSchemaProperties" section
- *
- * @see setupSwaggerDocs in @flusys/nestjs-core/docs
- * @see ISchemaPropertyExclusion interface
- */ const COMPANY_SCHEMA_EXCLUSIONS = [
-    // ===== Authentication Request DTOs =====
+const COMPANY_SCHEMA_EXCLUSIONS = [
+    // Request DTOs
     {
         schemaName: 'RegistrationDto',
         properties: [
@@ -63,7 +44,7 @@ Object.defineProperty(exports, "authSwaggerConfig", {
             'branchId'
         ]
     },
-    // ===== Authentication Response DTOs =====
+    // Response DTOs
     {
         schemaName: 'RegistrationResponseDto',
         properties: [
@@ -85,7 +66,7 @@ Object.defineProperty(exports, "authSwaggerConfig", {
             'branch'
         ]
     },
-    // ===== Nested/Helper DTOs (completely excluded) =====
+    // Nested helper DTOs
     {
         schemaName: 'CompanyInfoDto',
         properties: [
@@ -133,7 +114,7 @@ Object.defineProperty(exports, "authSwaggerConfig", {
             'companies'
         ]
     },
-    // ===== Company Management DTOs =====
+    // Company management DTOs
     {
         schemaName: 'CreateCompanyDto',
         properties: [
@@ -187,7 +168,7 @@ Object.defineProperty(exports, "authSwaggerConfig", {
             'updatedAt'
         ]
     },
-    // ===== Branch Management DTOs =====
+    // Branch management DTOs
     {
         schemaName: 'CreateCompanyBranchDto',
         properties: [
@@ -241,7 +222,7 @@ Object.defineProperty(exports, "authSwaggerConfig", {
             'updatedAt'
         ]
     },
-    // ===== User Permission DTOs =====
+    // User permission DTOs
     {
         schemaName: 'UserCompanyPermissionDto',
         properties: [
@@ -297,120 +278,176 @@ Object.defineProperty(exports, "authSwaggerConfig", {
         ]
     }
 ];
-function authSwaggerConfig(bootstrapConfig) {
-    const enableCompanyFeature = bootstrapConfig?.enableCompanyFeature ?? true;
-    // Exclude company-related tags when company feature is disabled
-    const excludeTags = enableCompanyFeature ? [] : COMPANY_RELATED_TAGS;
-    return {
-        title: 'Auth API',
-        description: enableCompanyFeature ? `
-## Authentication API
-
-Handles user authentication, registration, and company/branch management.
-
-### Features
-- User registration (with optional company assignment)
-- Login with email/password
-- JWT token-based authentication
-- Company/Branch selection flow (when multi-company enabled)
-- Token refresh
-- Password change
-
+const COMPANY_EXAMPLE_EXCLUSIONS = [
+    {
+        pathPattern: '/auth/login',
+        method: 'post',
+        examples: [
+            'loginSuccessWithCompany',
+            'companySelection'
+        ]
+    }
+];
+// ============================================================================
+// Email verification exclusions
+// ============================================================================
+const EMAIL_VERIFICATION_PATHS = [
+    '/auth/forgot-password',
+    '/auth/reset-password',
+    '/auth/resend-verification',
+    '/auth/verify-email'
+];
+const EMAIL_VERIFICATION_SCHEMA_EXCLUSIONS = [
+    {
+        schemaName: 'RegistrationResponseDto',
+        properties: [
+            'requiresEmailVerification'
+        ]
+    },
+    {
+        schemaName: 'LoginResponseRequiresEmailVerificationDto',
+        properties: [
+            'requiresEmailVerification',
+            'email'
+        ]
+    }
+];
+const EMAIL_VERIFICATION_EXAMPLE_EXCLUSIONS = [
+    {
+        pathPattern: '/auth/login',
+        method: 'post',
+        examples: [
+            'emailVerification'
+        ]
+    }
+];
+// ============================================================================
+// Description builder
+// ============================================================================
+function buildDescription(enableCompanyFeature, enableEmailVerification, isMultiTenant) {
+    const multiTenantNote = isMultiTenant ? `\n> **Multi-Tenant Mode**: Include \`x-tenant-id\` header to target a specific tenant database.\n` : '';
+    const features = [
+        '- User registration',
+        '- Login with email/password',
+        '- JWT token-based authentication',
+        ...enableEmailVerification ? [
+            '- Email verification',
+            '- Forgot/reset password'
+        ] : [],
+        ...enableCompanyFeature ? [
+            '- Company/Branch selection flow (multi-company enabled)'
+        ] : [],
+        '- Token refresh',
+        '- Password change'
+    ].join('\n');
+    const loginFlowSection = enableCompanyFeature ? `
 ### Authentication Flow
 
-#### Simple Login (Company feature disabled)
-\`\`\`
-POST /auth/login → { accessToken, refreshToken, user }
-\`\`\`
-
-#### Company-Based Login (Company feature enabled)
-
-**Case 1: Single company, single branch**
+#### Simple Login (single company/branch)
 \`\`\`
 POST /auth/login → { accessToken, refreshToken, user, company, branch }
 \`\`\`
 
-**Case 2: Multiple companies or branches**
+#### Multi-Company Login (multiple companies or branches)
 \`\`\`
 POST /auth/login → { requiresSelection: true, sessionId, companies }
 POST /auth/select → { accessToken, refreshToken, user, company, branch }
 \`\`\`
-
+${enableEmailVerification ? `
+#### Email Verification Required
+\`\`\`
+POST /auth/login → { requiresEmailVerification: true, email }
+POST /auth/verify-email → { accessToken, refreshToken, user }
+\`\`\`
+` : ''}
 ### Company/Branch Selection Endpoints
 - \`POST /auth/select\` - Complete login by selecting company and branch
 - \`POST /auth/switch-company\` - Switch to different company/branch while logged in
-- \`GET /auth/companies\` - Get user's available companies
-- \`GET /auth/companies/:companyId/branches\` - Get branches for a company
-
+` : `
+### Authentication Flow
+\`\`\`
+POST /auth/login → { accessToken, refreshToken, user }
+\`\`\`
+${enableEmailVerification ? `
+#### Email Verification Required
+\`\`\`
+POST /auth/login → { requiresEmailVerification: true, email }
+POST /auth/verify-email → { accessToken, refreshToken, user }
+\`\`\`
+` : ''}`;
+    const emailVerificationSection = enableEmailVerification ? `
+### Email Verification Endpoints
+- \`POST /auth/forgot-password\` - Request password reset email
+- \`POST /auth/reset-password\` - Reset password using token
+- \`POST /auth/resend-verification\` - Resend verification email
+- \`POST /auth/verify-email\` - Verify email using token
+` : '';
+    const administrationSection = enableCompanyFeature ? `
 ### Administration Endpoints
 - \`POST /administration/users/*\` - User management
 - \`POST /administration/company/*\` - Company management
 - \`POST /administration/branch/*\` - Branch management
 - \`POST /administration/user-permissions/*\` - User permission management
-
+` : `
+### Administration Endpoints
+- \`POST /administration/users/*\` - User management
+`;
+    const registrationSection = enableCompanyFeature ? `
 ### Registration Flow
 
 **Simple registration:**
 \`\`\`json
-{
-  "name": "John Doe",
-  "email": "john@example.com",
-  "password": "password123"
-}
+{ "name": "John Doe", "email": "john@example.com", "password": "password123" }
 \`\`\`
 
 **Join existing company:**
 \`\`\`json
-{
-  "name": "John Doe",
-  "email": "john@example.com",
-  "password": "password123",
-  "companySlug": "acme-corp",
-  "branchSlug": "main-branch"
-}
+{ "name": "John Doe", "email": "john@example.com", "password": "password123", "companySlug": "acme-corp", "branchSlug": "main-branch" }
 \`\`\`
 
 **Create new company:**
 \`\`\`json
-{
-  "name": "John Doe",
-  "email": "john@example.com",
-  "password": "password123",
-  "newCompanyName": "My New Company",
-  "newCompanyPhone": "+1234567890"
-}
+{ "name": "John Doe", "email": "john@example.com", "password": "password123", "newCompanyName": "My New Company" }
+\`\`\`
+` : `
+### Registration Flow
+\`\`\`json
+{ "name": "John Doe", "email": "john@example.com", "password": "password123" }
 \`\`\`
-  ` : `
+`;
+    return `
 ## Authentication API
-
-Handles user authentication and registration.
+${multiTenantNote}
+Handles user authentication${enableCompanyFeature ? ', company/branch management' : ''}, and registration.
 
 ### Features
-- User registration
-- Login with email/password
-- JWT token-based authentication
-- Token refresh
-- Password change
-
-### Authentication Flow
-\`\`\`
-POST /auth/login → { accessToken, refreshToken, user }
-\`\`\`
-
-### Registration Flow
-\`\`\`json
-{
-  "name": "John Doe",
-  "email": "john@example.com",
-  "password": "password123"
+${features}
+${loginFlowSection}${emailVerificationSection}${administrationSection}${registrationSection}`;
 }
-\`\`\`
-  `,
+function authSwaggerConfig(bootstrapConfig) {
+    const enableCompanyFeature = bootstrapConfig?.enableCompanyFeature ?? true;
+    const enableEmailVerification = bootstrapConfig?.enableEmailVerification ?? true;
+    const isMultiTenant = bootstrapConfig?.databaseMode === 'multi-tenant';
+    const excludeTags = enableCompanyFeature ? [] : COMPANY_RELATED_TAGS;
+    const excludeSchemaProperties = [
+        ...enableCompanyFeature ? [] : COMPANY_SCHEMA_EXCLUSIONS,
+        ...enableEmailVerification ? [] : EMAIL_VERIFICATION_SCHEMA_EXCLUSIONS
+    ];
+    // Merge example exclusions — both may target /auth/login with different example names
+    const excludeExamples = [
+        ...enableCompanyFeature ? [] : COMPANY_EXAMPLE_EXCLUSIONS,
+        ...enableEmailVerification ? [] : EMAIL_VERIFICATION_EXAMPLE_EXCLUSIONS
+    ];
+    const excludePaths = enableEmailVerification ? undefined : EMAIL_VERIFICATION_PATHS;
+    return {
+        title: 'Auth API',
+        description: buildDescription(enableCompanyFeature, enableEmailVerification, isMultiTenant),
         version: '1.0',
         path: 'api/docs/auth',
         bearerAuth: true,
         excludeTags,
-        excludeSchemaProperties: enableCompanyFeature ? undefined : COMPANY_SCHEMA_EXCLUSIONS,
-        excludeExamples: enableCompanyFeature ? undefined : COMPANY_EXAMPLE_EXCLUSIONS
+        excludeSchemaProperties: excludeSchemaProperties.length ? excludeSchemaProperties : undefined,
+        excludeExamples: excludeExamples.length ? excludeExamples : undefined,
+        excludePaths
     };
 }

package/cjs/dtos/authentication.dto.js

@@ -684,8 +684,6 @@ let LoginResponseRequiresEmailVerificationDto = class LoginResponseRequiresEmail
     constructor(){
         _define_property(this, "requiresEmailVerification", void 0);
         _define_property(this, "email", void 0);
-        _define_property(this, "message", void 0);
-        _define_property(this, "messageKey", void 0);
     }
 };
 _ts_decorate([
@@ -700,19 +698,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", String)
 ], LoginResponseRequiresEmailVerificationDto.prototype, "email", void 0);
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        example: 'Please verify your email address before logging in.'
-    }),
-    _ts_metadata("design:type", String)
-], LoginResponseRequiresEmailVerificationDto.prototype, "message", void 0);
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        example: 'auth.login.email.not.verified',
-        description: 'Translation key for localization'
-    }),
-    _ts_metadata("design:type", String)
-], LoginResponseRequiresEmailVerificationDto.prototype, "messageKey", void 0);
 let ForgotPasswordDto = class ForgotPasswordDto {
     constructor(){
         _define_property(this, "email", void 0);

package/cjs/entities/user-company-permission.entity.js

@@ -50,7 +50,6 @@ let UserCompanyPermission = class UserCompanyPermission {
         _define_property(this, "user", void 0);
         /* ---------- Polymorphic Target ---------- */ _define_property(this, "permissionType", void 0);
         _define_property(this, "targetId", void 0);
-        _define_property(this, "metadata", void 0);
         _define_property(this, "isActive", void 0);
         /* ---------- Optional Relations (no FK - polymorphic) ---------- */ _define_property(this, "company", void 0);
         _define_property(this, "branch", void 0);
@@ -93,13 +92,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", String)
 ], UserCompanyPermission.prototype, "targetId", void 0);
-_ts_decorate([
-    (0, _typeorm.Column)({
-        type: 'json',
-        nullable: true
-    }),
-    _ts_metadata("design:type", typeof Record === "undefined" ? Object : Record)
-], UserCompanyPermission.prototype, "metadata", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({
         type: 'boolean',

package/cjs/entities/user-token.entity.js

@@ -53,7 +53,6 @@ let UserToken = class UserToken {
         _define_property(this, "token", void 0);
         _define_property(this, "expiresAt", void 0);
         _define_property(this, "usedAt", void 0);
-        _define_property(this, "metadata", void 0);
         _define_property(this, "createdAt", void 0);
     }
 };
@@ -97,14 +96,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Object)
 ], UserToken.prototype, "usedAt", void 0);
-_ts_decorate([
-    (0, _typeorm.Column)({
-        type: 'varchar',
-        length: 255,
-        nullable: true
-    }),
-    _ts_metadata("design:type", Object)
-], UserToken.prototype, "metadata", void 0);
 _ts_decorate([
     (0, _typeorm.CreateDateColumn)({
         type: 'timestamp',

package/cjs/interceptors/set-token.interceptor.js

@@ -52,16 +52,24 @@ let SetToken = class SetToken {
         const req = context.switchToHttp().getRequest();
         const res = context.switchToHttp().getResponse();
         return next.handle().pipe((0, _rxjs.map)((value)=>{
-            if (typeof value !== 'object' || value === null || !('refreshToken' in value)) {
+            if (typeof value !== 'object' || value === null) {
                 return value;
             }
             const response = value;
-            if ((0, _utils.isBrowserRequest)(req)) {
-                this.setRefreshTokenCookie(req, res, String(response.refreshToken));
-                const { refreshToken, ...responseWithoutToken } = response;
-                return responseWithoutToken;
+            const data = typeof response['data'] === 'object' && response['data'] !== null ? response['data'] : null;
+            const tokenInData = data && typeof data['refreshToken'] === 'string';
+            if (!tokenInData) {
+                return value;
+            }
+            if (!(0, _utils.isBrowserRequest)(req)) {
+                return value;
             }
-            return value;
+            this.setRefreshTokenCookie(req, res, data['refreshToken']);
+            const { refreshToken: _, ...dataWithoutToken } = data;
+            return {
+                ...response,
+                data: dataWithoutToken
+            };
         }), (0, _rxjs.catchError)((err)=>(0, _rxjs.throwError)(()=>err)));
     }
     setRefreshTokenCookie(req, res, tokenValue) {
@@ -71,7 +79,7 @@ let SetToken = class SetToken {
             throw new _common.PayloadTooLargeException({
                 message: `Refresh token too large (≈${estimatedBytes} bytes)`,
                 messageKey: _config.AUTH_MESSAGES.TOKEN_TOO_LARGE,
-                messageParams: {
+                messageVariables: {
                     size: estimatedBytes
                 }
             });

package/cjs/services/auth-config.service.js

@@ -86,10 +86,6 @@ let AuthConfigService = class AuthConfigService {
     getRefreshTokenCookieName() {
         return this.config.refreshTokenCookieName ?? 'fsn_refresh_token';
     }
-    // Frontend Configuration
-    getFrontendUrl() {
-        return this.config.frontendUrl;
-    }
     constructor(injectedOptions){
         _define_property(this, "options", void 0);
         _define_property(this, "config", void 0);

package/cjs/services/auth-email.service.js

@@ -8,13 +8,12 @@ Object.defineProperty(exports, "AuthEmailService", {
         return AuthEmailService;
     }
 });
-const _constants = require("@flusys/nestjs-shared/constants");
 const _nestjsshared = require("@flusys/nestjs-shared");
-const _config = require("../config");
+const _constants = require("@flusys/nestjs-shared/constants");
 const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _crypto = /*#__PURE__*/ _interop_require_wildcard(require("crypto"));
-const _typeorm = require("typeorm");
+const _config = require("../config");
 const _pendingregistrationentity = require("../entities/pending-registration.entity");
 const _usertokenentity = require("../entities/user-token.entity");
 const _userentity = require("../entities/user.entity");
@@ -97,7 +96,7 @@ let AuthEmailService = class AuthEmailService {
             throw new _common.InternalServerErrorException({
                 message: `${String(entity)} repository not available`,
                 messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageParams: {
+                messageVariables: {
                     entity: String(entity)
                 }
             });
@@ -236,7 +235,11 @@ let AuthEmailService = class AuthEmailService {
         } catch  {
             throw new _common.BadRequestException({
                 message: 'Failed to process request. Please try again later.',
-                messageKey: _constants.SYSTEM_MESSAGES.INTERNAL_ERROR
+                messageKey: _constants.SYSTEM_MESSAGES.INTERNAL_ERROR,
+                messageVariables: {
+                    provider: 'EmailProvider',
+                    error: 'Send email failed'
+                }
             });
         }
         return {
@@ -427,23 +430,6 @@ let AuthEmailService = class AuthEmailService {
             messageKey: _config.EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS
         };
     }
-    async cleanupExpired() {
-        const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
-        const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
-        const now = new Date();
-        const tokenResult = await tokenRepository.delete({
-            expiresAt: (0, _typeorm.LessThan)(now)
-        });
-        const pendingResult = await pendingRepository.delete({
-            expiresAt: (0, _typeorm.LessThan)(now)
-        });
-        const deletedTokens = tokenResult.affected ?? 0;
-        const deletedPending = pendingResult.affected ?? 0;
-        return {
-            deletedTokens,
-            deletedPending
-        };
-    }
     constructor(dataSourceProvider, emailProvider){
         _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "emailProvider", void 0);
@@ -516,15 +502,6 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], AuthEmailService.prototype, "resendVerificationEmail", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.cleanupExpiredTokens',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", []),
-    _ts_metadata("design:returntype", Promise)
-], AuthEmailService.prototype, "cleanupExpired", null);
 AuthEmailService = _ts_decorate([
     (0, _common.Injectable)({
         scope: _common.Scope.REQUEST