@flusys/nestjs-auth 4.1.1 → 5.0.1

package/fesm/services/authentication.service.js

@@ -25,18 +25,16 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
+import { LogAction } from '@flusys/nestjs-shared';
 import { HybridCache } from '@flusys/nestjs-shared/classes';
 import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
-import { LogAction } from '@flusys/nestjs-shared';
-import { AUTH_MESSAGES, EMAIL_VERIFICATION_MESSAGES, USER_MESSAGES } from '../config';
-import { INotificationAdapter, NOTIFICATION_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { NotificationType } from '@flusys/nestjs-shared/enums';
+import { INotificationAdapter, NOTIFICATION_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { generateUniqueSlug } from '@flusys/nestjs-shared/utils';
-import { BadRequestException, Inject, Injectable, InternalServerErrorException, NotFoundException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
+import { BadRequestException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import * as bcrypt from 'bcrypt';
-import { BCRYPT_SALT_ROUNDS, TOKEN_REVOKED_PREFIX, USER_ENRICHER } from '../config';
-import { IUserEnricher } from '../interfaces/user-enricher.interface';
+import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, TOKEN_REVOKED_PREFIX, USER_ENRICHER, USER_MESSAGES } from '../config';
 import { RegistrationDto } from '../dtos/authentication.dto';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
@@ -44,6 +42,7 @@ import { PendingRegistration } from '../entities/pending-registration.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { User } from '../entities/user.entity';
 import { PermissionType } from '../enums';
+import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 import { AuthEmailService } from './auth-email.service';
@@ -61,7 +60,10 @@ export class AuthenticationService {
         if (!this.dataSourceProvider) {
             throw new InternalServerErrorException({
                 message: 'User repository not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'User'
+                }
             });
         }
         return this.dataSourceProvider.getRepository(User);
@@ -89,7 +91,7 @@ export class AuthenticationService {
         }
         const user = await this.validateUser(email, password);
         if (!user.isActive) {
-            throw new UnauthorizedException({
+            throw new ForbiddenException({
                 message: 'User account is deactivated',
                 messageKey: AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED
             });
@@ -202,7 +204,10 @@ export class AuthenticationService {
         if (!permissionRepository || !companyRepository) {
             throw new BadRequestException({
                 message: 'Company feature repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Company feature'
+                }
             });
         }
         if (dto.companySlug) {
@@ -335,7 +340,10 @@ export class AuthenticationService {
         if (!companyRepository || !branchRepository || !permissionRepository) {
             if (throwOnUnavailable) throw new BadRequestException({
                 message: 'Company feature repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Company feature'
+                }
             });
             return this.generateRegistrationResponse(user);
         }
@@ -470,7 +478,10 @@ export class AuthenticationService {
         if (!permissionRepository || !companyRepository || !branchRepository) {
             throw new BadRequestException({
                 message: 'Repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Some'
+                }
             });
         }
         const hasCompanyAccess = await permissionRepository.findOne({
@@ -481,7 +492,7 @@ export class AuthenticationService {
             }
         });
         if (!hasCompanyAccess) {
-            throw new UnauthorizedException({
+            throw new ForbiddenException({
                 message: 'No access to this company',
                 messageKey: AUTH_MESSAGES.COMPANY_NO_ACCESS
             });
@@ -493,7 +504,7 @@ export class AuthenticationService {
             }
         });
         if (!company) {
-            throw new UnauthorizedException({
+            throw new NotFoundException({
                 message: 'Company not found or inactive',
                 messageKey: AUTH_MESSAGES.COMPANY_NOT_FOUND
             });
@@ -506,7 +517,7 @@ export class AuthenticationService {
             }
         });
         if (!hasBranchAccess) {
-            throw new UnauthorizedException({
+            throw new ForbiddenException({
                 message: 'No access to this branch',
                 messageKey: AUTH_MESSAGES.BRANCH_NO_ACCESS
             });
@@ -519,7 +530,7 @@ export class AuthenticationService {
             }
         });
         if (!branch) {
-            throw new UnauthorizedException({
+            throw new NotFoundException({
                 message: 'Branch not found or inactive',
                 messageKey: AUTH_MESSAGES.BRANCH_NOT_FOUND
             });
@@ -549,6 +560,72 @@ export class AuthenticationService {
                     messageKey: AUTH_MESSAGES.TOKEN_INVALID
                 });
             }
+            if (payload.companyId) {
+                const companyRepository = await this.getCompanyRepository();
+                const permissionRepository = await this.getPermissionRepository();
+                if (companyRepository) {
+                    const company = await companyRepository.findOne({
+                        where: {
+                            id: payload.companyId,
+                            isActive: true
+                        }
+                    });
+                    if (!company) {
+                        throw new UnauthorizedException({
+                            message: 'Company not found or inactive',
+                            messageKey: AUTH_MESSAGES.COMPANY_NOT_FOUND
+                        });
+                    }
+                }
+                if (permissionRepository) {
+                    const hasCompanyAccess = await permissionRepository.findOne({
+                        where: {
+                            userId: user.id,
+                            permissionType: PermissionType.COMPANY,
+                            targetId: payload.companyId
+                        }
+                    });
+                    if (!hasCompanyAccess) {
+                        throw new UnauthorizedException({
+                            message: 'No access to this company',
+                            messageKey: AUTH_MESSAGES.COMPANY_NO_ACCESS
+                        });
+                    }
+                }
+                if (payload.branchId) {
+                    const branchRepository = await this.getBranchRepository();
+                    if (branchRepository) {
+                        const branch = await branchRepository.findOne({
+                            where: {
+                                id: payload.branchId,
+                                companyId: payload.companyId,
+                                isActive: true
+                            }
+                        });
+                        if (!branch) {
+                            throw new UnauthorizedException({
+                                message: 'Branch not found or inactive',
+                                messageKey: AUTH_MESSAGES.BRANCH_NOT_FOUND
+                            });
+                        }
+                    }
+                    if (permissionRepository) {
+                        const hasBranchAccess = await permissionRepository.findOne({
+                            where: {
+                                userId: user.id,
+                                permissionType: PermissionType.BRANCH,
+                                targetId: payload.branchId
+                            }
+                        });
+                        if (!hasBranchAccess) {
+                            throw new UnauthorizedException({
+                                message: 'No access to this branch',
+                                messageKey: AUTH_MESSAGES.BRANCH_NO_ACCESS
+                            });
+                        }
+                    }
+                }
+            }
             return this.generateTokens({
                 id: user.id,
                 email: user.email,
@@ -637,7 +714,10 @@ export class AuthenticationService {
         if (!permissionRepository || !companyRepository) {
             throw new BadRequestException({
                 message: 'Repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Some'
+                }
             });
         }
         const permissions = await permissionRepository.find({
@@ -661,7 +741,10 @@ export class AuthenticationService {
         if (!permissionRepository || !branchRepository) {
             throw new BadRequestException({
                 message: 'Repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+                messageVariables: {
+                    entity: 'Some'
+                }
             });
         }
         const companyPermission = await permissionRepository.findOne({

package/fesm/services/user-permission.service.js

@@ -53,7 +53,7 @@ export class UserPermissionService {
             }
         });
     }
-    /** Assign permission to user */ async assignPermission(userId, targetId, type, metadata) {
+    /** Assign permission to user */ async assignPermission(userId, targetId, type) {
         const repository = await this.getRepository();
         const typeName = type === PermissionType.COMPANY ? 'company' : 'branch';
         const existing = await repository.findOne({
@@ -67,7 +67,7 @@ export class UserPermissionService {
             throw new ConflictException({
                 message: `User already assigned to this ${typeName}`,
                 messageKey: USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED,
-                messageParams: {
+                messageVariables: {
                     type: typeName
                 }
             });
@@ -76,8 +76,7 @@ export class UserPermissionService {
             await repository.save(repository.create({
                 userId,
                 permissionType: type,
-                targetId,
-                metadata
+                targetId
             }));
         } catch (error) {
             const err = error;
@@ -85,7 +84,7 @@ export class UserPermissionService {
                 throw new ConflictException({
                     message: `User already assigned to this ${typeName}. Please refresh and try again.`,
                     messageKey: USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED,
-                    messageParams: {
+                    messageVariables: {
                         type: typeName
                     }
                 });
@@ -107,7 +106,7 @@ export class UserPermissionService {
             throw new NotFoundException({
                 message: `${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`,
                 messageKey: USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND,
-                messageParams: {
+                messageVariables: {
                     type: typeName.charAt(0).toUpperCase() + typeName.slice(1)
                 }
             });
@@ -147,8 +146,7 @@ _ts_decorate([
     _ts_metadata("design:paramtypes", [
         String,
         String,
-        typeof PermissionType === "undefined" ? Object : PermissionType,
-        typeof Record === "undefined" ? Object : Record
+        typeof PermissionType === "undefined" ? Object : PermissionType
     ]),
     _ts_metadata("design:returntype", Promise)
 ], UserPermissionService.prototype, "assignPermission", null);

package/fesm/services/user.service.js

@@ -25,22 +25,21 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { LogAction } from '@flusys/nestjs-shared';
+import { HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
+import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { BadRequestException, ForbiddenException, Inject, Injectable, NotFoundException, Optional, Scope } from '@nestjs/common';
-import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
-import { AUTH_MESSAGES, USER_MESSAGES, USER_PERMISSION_MESSAGES } from '../config';
 import * as bcrypt from 'bcrypt';
-import { AuthConfigService } from './auth-config.service';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
-import { BCRYPT_SALT_ROUNDS, USER_ENRICHER } from '../config';
+import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, USER_ENRICHER, USER_MESSAGES, USER_PERMISSION_MESSAGES } from '../config';
 import { CreateUserDto } from '../dtos/user.dto';
-import { PermissionType } from '../enums';
-import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { User } from '../entities/user.entity';
+import { PermissionType } from '../enums';
+import { IUserEnricher } from '../interfaces/user-enricher.interface';
+import { AuthConfigService } from './auth-config.service';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class UserService extends RequestScopedApiService {
     resolveEntity() {
         return User;
@@ -63,7 +62,7 @@ export class UserService extends RequestScopedApiService {
     async getUserForProfile(userId, user) {
         if (userId !== user.id) {
             throw new ForbiddenException({
-                message: 'Cannot access another user\'s profile',
+                message: "Cannot access another user's profile",
                 messageKey: AUTH_MESSAGES.PROFILE_ACCESS_DENIED
             });
         }
@@ -117,7 +116,10 @@ export class UserService extends RequestScopedApiService {
             if (!permission) {
                 throw new NotFoundException({
                     message: 'User company permission not found',
-                    messageKey: USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND
+                    messageKey: USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND,
+                    messageVariables: {
+                        type: 'User company'
+                    }
                 });
             }
             permission.isActive = isActive;
@@ -191,7 +193,7 @@ export class UserService extends RequestScopedApiService {
         return entities.map((entity)=>this.convertEntityToResponseDto(entity, isRaw));
     }
     async getGlobalSearchQuery(query, search, _user) {
-        query.andWhere('(user.name LIKE :search OR user.email LIKE :search OR user.phone LIKE :search)', {
+        query.andWhere('("user".name LIKE :search OR "user".email LIKE :search OR "user".phone LIKE :search)', {
             search: `%${search}%`
         });
         return {
@@ -210,7 +212,7 @@ export class UserService extends RequestScopedApiService {
         }
         if (user?.companyId && this.permissionRepository) {
             query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
-          WHERE perm.user_id = user.id
+          WHERE perm.user_id = "user".id
           AND perm.permission_type = :permissionType
           AND perm.target_id = :companyId
           LIMIT 1)`, 'user_companyIsActive');
@@ -219,7 +221,7 @@ export class UserService extends RequestScopedApiService {
             if (filterAndPaginationDto.filter?.isActive !== undefined) {
                 query.andWhere(`EXISTS (
             SELECT 1 FROM user_company_permissions perm
-            WHERE perm.user_id = user.id
+            WHERE perm.user_id = "user".id
             AND perm.permission_type = :permissionType
             AND perm.target_id = :companyId
             AND perm.is_active = :isActiveValue
@@ -231,7 +233,7 @@ export class UserService extends RequestScopedApiService {
             }
             query.andWhere(`EXISTS (
           SELECT 1 FROM user_company_permissions perm
-          WHERE perm.user_id = user.id
+          WHERE perm.user_id = "user".id
           AND perm.permission_type = :permissionType
           AND perm.target_id = :companyId
         )`, {

package/fesm/strategies/jwt.strategy.js

@@ -22,10 +22,10 @@ function _ts_metadata(k, v) {
 }
 import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
 import { Injectable, UnauthorizedException } from '@nestjs/common';
-import { AUTH_MESSAGES, USER_MESSAGES } from '../config';
 import { ModuleRef } from '@nestjs/core';
 import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
+import { AUTH_MESSAGES, USER_MESSAGES } from '../config';
 import { User } from '../entities/user.entity';
 import { AuthConfigService } from '../services/auth-config.service';
 import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
@@ -62,12 +62,19 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
         } catch  {
             throw new UnauthorizedException({
                 message: 'Unable to access user data',
-                messageKey: SYSTEM_MESSAGES.SERVICE_NOT_AVAILABLE
+                messageKey: SYSTEM_MESSAGES.SERVICE_NOT_AVAILABLE,
+                messageVariables: {
+                    provider: 'DataSourceProvider',
+                    available: ''
+                }
             });
         }
         throw new UnauthorizedException({
             message: 'User repository not available',
-            messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE
+            messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
+            messageVariables: {
+                entity: 'User'
+            }
         });
     }
     async checkTokenRevocation(payload) {

package/interfaces/auth-module-options.interface.d.ts

@@ -6,7 +6,6 @@ export interface IAuthModuleConfig extends IDataSourceServiceOptions {
     refreshTokenSecret?: string;
     refreshTokenExpiration?: string;
     refreshTokenCookieName?: string;
-    frontendUrl?: string;
 }
 export interface AuthModuleOptions extends IDynamicModuleConfig {
     bootstrapAppConfig?: IBootstrapAppConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "4.1.1",
+  "version": "5.0.1",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -81,7 +81,7 @@
     "@nestjs/passport": "^10.0.0 || ^11.0.0",
     "@nestjs/swagger": "^7.0.0 || ^11.0.0",
     "@nestjs/typeorm": "^10.0.0 || ^11.0.0",
-    "bcrypt": "^5.0.0 || ^6.0.0",
+    "bcrypt": "^5.0.1 || ^6.0.0",
     "class-transformer": "^0.5.0",
     "class-validator": "^0.14.0",
     "nodemailer": "^7.0.0",
@@ -93,7 +93,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "4.1.1",
-    "@flusys/nestjs-shared": "4.1.1"
+    "@flusys/nestjs-core": "5.0.1",
+    "@flusys/nestjs-shared": "5.0.1"
   }
 }

package/services/auth-config.service.d.ts

@@ -14,5 +14,4 @@ export declare class AuthConfigService implements IModuleConfigService {
     getRefreshTokenSecret(): string;
     getRefreshTokenExpiration(): string;
     getRefreshTokenCookieName(): string;
-    getFrontendUrl(): string | undefined;
 }

package/services/auth-email.service.d.ts

@@ -51,8 +51,4 @@ export declare class AuthEmailService {
         message: string;
         messageKey: string;
     }>;
-    cleanupExpired(): Promise<{
-        deletedTokens: number;
-        deletedPending: number;
-    }>;
 }

package/services/authentication.service.d.ts

@@ -1,12 +1,12 @@
 import { HybridCache } from '@flusys/nestjs-shared/classes';
 import { INotificationAdapter } from '@flusys/nestjs-shared/interfaces';
 import { JwtService } from '@nestjs/jwt';
-import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { RegistrationDto } from '../dtos/authentication.dto';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { LoginResponse, LoginResponseRequiresEmailVerification, LoginResponseRequiresSelection, MeResponse, RegistrationResponse } from '../interfaces/authentication.interface';
+import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 import { AuthEmailService } from './auth-email.service';

package/services/user-permission.service.d.ts

@@ -6,7 +6,7 @@ export declare class UserPermissionService {
     constructor(dataSourceProvider: AuthDataSourceProvider);
     private getRepository;
     findUserPermissions(userId: string, type: PermissionType): Promise<UserCompanyPermission[]>;
-    assignPermission(userId: string, targetId: string, type: PermissionType, metadata?: Record<string, any>): Promise<void>;
+    assignPermission(userId: string, targetId: string, type: PermissionType): Promise<void>;
     revokePermission(userId: string, targetId: string, type: PermissionType): Promise<void>;
     findUserCompanies: (userId: string) => Promise<UserCompanyPermission[]>;
     findUserBranches(userId: string, companyId?: string): Promise<UserCompanyPermission[]>;

package/services/user.service.d.ts

@@ -1,14 +1,14 @@
-import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
 import { FilterAndPaginationDto } from '@flusys/nestjs-shared/dtos';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { EntityTarget, Repository, SelectQueryBuilder } from 'typeorm';
-import { AuthConfigService } from './auth-config.service';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
 import { CreateUserDto, UpdateUserDto } from '../dtos/user.dto';
-import { IUser } from '../interfaces/user.interface';
-import { IEnrichedUser, IProfileExtras, IProfileSection, IProfileSectionData, IUserEnricher } from '../interfaces/user-enricher.interface';
 import { User } from '../entities/user.entity';
+import { IEnrichedUser, IProfileExtras, IProfileSection, IProfileSectionData, IUserEnricher } from '../interfaces/user-enricher.interface';
+import { IUser } from '../interfaces/user.interface';
+import { AuthConfigService } from './auth-config.service';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
 export declare class UserService extends RequestScopedApiService<CreateUserDto, UpdateUserDto, IUser, User, Repository<User>> {
     protected cacheManager: HybridCache;
     protected utilsService: UtilsService;