@flusys/nestjs-auth 5.0.0 → 5.0.3

package/README.md

@@ -228,20 +228,19 @@ When `AUTH_EMAIL_PROVIDER` is not provided, registration still works but emails
 
 Extend user list and profile responses without creating circular imports. All methods are optional — implement only what you need.
 
-| Method | When called | Purpose |
-| --- | --- | --- |
-| `enrichListQuery` | User list query build | Add extra joins/selects to the query |
-| `enrichListItems` | After user list fetch | Attach computed data to list items |
-| `getProfileExtras` | `POST /users/get/:id` | Add roles, actions, sections to profile |
-| `updateProfileExtras` | Profile update (in tx) | Persist extra profile fields |
-| `validateProfileExtras` | Before profile update | Validate extra fields |
-| `getProfileSections` | Profile form init | Return multi-step section definitions |
-| `getProfileSectionData` | Section fetch | Return section-specific data |
-| `updateProfileSection` | Section save (in tx) | Persist section data |
-| `handleSectionFileUpload` | File upload (in tx) | Handle file attach to section |
-| `handleSectionFileDelete` | File delete (in tx) | Handle file removal from section |
-| `calculateProfileCompletion` | Profile fetch | Return 0–100 completion score |
-| `onUserCreated` | Registration (in tx) | Hook after user row created; throw to rollback |
+| Method                       | When called            | Purpose                                        |
+| ---------------------------- | ---------------------- | ---------------------------------------------- |
+| `enrichListItems`            | After user list fetch  | Attach computed data to list items             |
+| `getProfileExtras`           | `POST /users/get/:id`  | Add roles, actions, sections to profile        |
+| `updateProfileExtras`        | Profile update (in tx) | Persist extra profile fields                   |
+| `validateProfileExtras`      | Before profile update  | Validate extra fields                          |
+| `getProfileSections`         | Profile form init      | Return multi-step section definitions          |
+| `getProfileSectionData`      | Section fetch          | Return section-specific data                   |
+| `updateProfileSection`       | Section save (in tx)   | Persist section data                           |
+| `handleSectionFileUpload`    | File upload (in tx)    | Handle file attach to section                  |
+| `handleSectionFileDelete`    | File delete (in tx)    | Handle file removal from section               |
+| `calculateProfileCompletion` | Profile fetch          | Return 0–100 completion score                  |
+| `onUserCreated`              | Registration (in tx)   | Hook after user row created; throw to rollback |
 
 ```typescript
 import { USER_ENRICHER, IUserEnricher, IProfileExtras } from '@flusys/nestjs-auth';

package/cjs/entities/{user.entity.js → app-user.entity.js}

@@ -2,10 +2,10 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-Object.defineProperty(exports, "User", {
+Object.defineProperty(exports, "AppUser", {
     enumerable: true,
     get: function() {
-        return User;
+        return AppUser;
     }
 });
 const _nestjsshared = require("@flusys/nestjs-shared");
@@ -16,10 +16,10 @@ function _ts_decorate(decorators, target, key, desc) {
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-let User = class User extends _nestjsshared.UserRoot {
+let AppUser = class AppUser extends _nestjsshared.UserRoot {
 };
-User = _ts_decorate([
+AppUser = _ts_decorate([
     (0, _typeorm.Entity)({
-        name: 'user'
+        name: 'app_user'
     })
-], User);
+], AppUser);

package/cjs/entities/company-branch.entity.js

@@ -109,7 +109,7 @@ _ts_decorate([
 ], CompanyBranch.prototype, "isActive", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({
-        type: 'json',
+        type: (0, _nestjsshared.getJsonColumnType)(),
         nullable: true
     }),
     _ts_metadata("design:type", Object)

package/cjs/entities/company.entity.js

@@ -123,14 +123,14 @@ _ts_decorate([
 ], Company.prototype, "isActive", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({
-        type: 'json',
+        type: (0, _nestjsshared.getJsonColumnType)(),
         nullable: true
     }),
     _ts_metadata("design:type", Object)
 ], Company.prototype, "settings", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({
-        type: 'json',
+        type: (0, _nestjsshared.getJsonColumnType)(),
         nullable: true
     }),
     _ts_metadata("design:type", Object)

package/cjs/entities/index.js

@@ -19,11 +19,11 @@ _export(exports, {
         return getEntitiesByConfig;
     }
 });
+const _appuserentity = _export_star(require("./app-user.entity"), exports);
 const _companybranchentity = _export_star(require("./company-branch.entity"), exports);
 const _companyentity = _export_star(require("./company.entity"), exports);
 const _pendingregistrationentity = _export_star(require("./pending-registration.entity"), exports);
 const _usercompanypermissionentity = require("./user-company-permission.entity");
-const _userentity = _export_star(require("./user.entity"), exports);
 const _usertokenentity = _export_star(require("./user-token.entity"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {
@@ -39,7 +39,7 @@ function _export_star(from, to) {
     return from;
 }
 const BaseEntities = [
-    _userentity.User,
+    _appuserentity.AppUser,
     _usertokenentity.UserToken
 ];
 const EmailEntities = [

package/cjs/entities/pending-registration.entity.js

@@ -8,6 +8,7 @@ Object.defineProperty(exports, "PendingRegistration", {
         return PendingRegistration;
     }
 });
+const _nestjsshared = require("@flusys/nestjs-shared");
 const _typeorm = require("typeorm");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -95,7 +96,7 @@ _ts_decorate([
 ], PendingRegistration.prototype, "expiresAt", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({
-        type: 'json',
+        type: (0, _nestjsshared.getJsonColumnType)(),
         nullable: true,
         name: 'company_data'
     }),
@@ -103,7 +104,7 @@ _ts_decorate([
 ], PendingRegistration.prototype, "companyData", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({
-        type: 'json',
+        type: (0, _nestjsshared.getJsonColumnType)(),
         nullable: true,
         name: 'additional_fields'
     }),

package/cjs/entities/user-company-permission.entity.js

@@ -18,9 +18,9 @@ _export(exports, {
 });
 const _typeorm = require("typeorm");
 const _enums = require("../enums");
+const _appuserentity = require("./app-user.entity");
 const _companybranchentity = require("./company-branch.entity");
 const _companyentity = require("./company.entity");
-const _userentity = require("./user.entity");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -69,13 +69,13 @@ _ts_decorate([
     _ts_metadata("design:type", String)
 ], UserCompanyPermission.prototype, "userId", void 0);
 _ts_decorate([
-    (0, _typeorm.ManyToOne)(()=>_userentity.User, {
+    (0, _typeorm.ManyToOne)(()=>_appuserentity.AppUser, {
         onDelete: 'CASCADE'
     }),
     (0, _typeorm.JoinColumn)({
         name: 'user_id'
     }),
-    _ts_metadata("design:type", typeof _userentity.User === "undefined" ? Object : _userentity.User)
+    _ts_metadata("design:type", typeof _appuserentity.AppUser === "undefined" ? Object : _appuserentity.AppUser)
 ], UserCompanyPermission.prototype, "user", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({

package/cjs/services/auth-config.service.js

@@ -55,6 +55,9 @@ let AuthConfigService = class AuthConfigService {
     isEmailVerificationEnabled() {
         return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
+    isPermissionModeFound() {
+        return this.options.bootstrapAppConfig?.permissionMode !== undefined;
+    }
     // JWT Configuration
     getJwtSecret() {
         if (!this.config.jwtSecret) {

package/cjs/services/auth-email.service.js

@@ -14,9 +14,9 @@ const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _crypto = /*#__PURE__*/ _interop_require_wildcard(require("crypto"));
 const _config = require("../config");
+const _appuserentity = require("../entities/app-user.entity");
 const _pendingregistrationentity = require("../entities/pending-registration.entity");
 const _usertokenentity = require("../entities/user-token.entity");
-const _userentity = require("../entities/user.entity");
 const _interfaces = require("../interfaces");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 function _define_property(obj, key, value) {
@@ -153,7 +153,7 @@ let AuthEmailService = class AuthEmailService {
     }
     async createPendingRegistration(data) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
         // Check if user already exists
         const existingUser = await userRepository.findOne({
@@ -198,7 +198,7 @@ let AuthEmailService = class AuthEmailService {
     }
     async forgotPassword(email, resetUrlBase) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         const user = await userRepository.findOne({
             where: {
@@ -249,7 +249,7 @@ let AuthEmailService = class AuthEmailService {
         };
     }
     async resetPassword(token, newPassword) {
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
@@ -291,7 +291,7 @@ let AuthEmailService = class AuthEmailService {
     }
     async verifyEmail(token) {
         const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
@@ -375,7 +375,7 @@ let AuthEmailService = class AuthEmailService {
     async resendVerificationEmail(email, verifyUrlBase) {
         this.assertEmailEnabled();
         const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         // Check pending registration first
         const pending = await pendingRepository.findOne({

package/cjs/services/authentication.service.js

@@ -19,11 +19,11 @@ const _jwt = require("@nestjs/jwt");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _config = require("../config");
 const _authenticationdto = require("../dtos/authentication.dto");
+const _appuserentity = require("../entities/app-user.entity");
 const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
 const _pendingregistrationentity = require("../entities/pending-registration.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-const _userentity = require("../entities/user.entity");
 const _enums1 = require("../enums");
 const _userenricherinterface = require("../interfaces/user-enricher.interface");
 const _authconfigservice = require("./auth-config.service");
@@ -113,11 +113,11 @@ let AuthenticationService = class AuthenticationService {
                 message: 'User repository not available',
                 messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
                 messageVariables: {
-                    entity: 'User'
+                    entity: 'AppUser'
                 }
             });
         }
-        return this.dataSourceProvider.getRepository(_userentity.User);
+        return this.dataSourceProvider.getRepository(_appuserentity.AppUser);
     }
     async getPermissionRepository() {
         if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
@@ -299,7 +299,7 @@ let AuthenticationService = class AuthenticationService {
         await queryRunner.startTransaction();
         try {
             const hashedPassword = await _bcrypt.hash(dto.password, _config.BCRYPT_SALT_ROUNDS);
-            const user = queryRunner.manager.create(_userentity.User, {
+            const user = queryRunner.manager.create(_appuserentity.AppUser, {
                 name: dto.name,
                 email: dto.email,
                 phone: dto.phone,
@@ -308,7 +308,7 @@ let AuthenticationService = class AuthenticationService {
                 emailVerified: false,
                 phoneVerified: false
             });
-            await queryRunner.manager.save(_userentity.User, user);
+            await queryRunner.manager.save(_appuserentity.AppUser, user);
             if (this.userEnricher?.onUserCreated) {
                 await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
             }
@@ -342,7 +342,7 @@ let AuthenticationService = class AuthenticationService {
         await queryRunner.connect();
         await queryRunner.startTransaction();
         try {
-            const existingUser = await queryRunner.manager.findOne(_userentity.User, {
+            const existingUser = await queryRunner.manager.findOne(_appuserentity.AppUser, {
                 where: {
                     email: pending.email
                 }
@@ -353,7 +353,7 @@ let AuthenticationService = class AuthenticationService {
                     messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
                 });
             }
-            const user = queryRunner.manager.create(_userentity.User, {
+            const user = queryRunner.manager.create(_appuserentity.AppUser, {
                 name: pending.name,
                 email: pending.email,
                 phone: pending.phone,
@@ -362,7 +362,7 @@ let AuthenticationService = class AuthenticationService {
                 emailVerified: true,
                 phoneVerified: false
             });
-            await queryRunner.manager.save(_userentity.User, user);
+            await queryRunner.manager.save(_appuserentity.AppUser, user);
             if (this.userEnricher?.onUserCreated) {
                 await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
             }

package/cjs/services/user.service.js

@@ -17,8 +17,8 @@ const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _config = require("../config");
 const _userdto = require("../dtos/user.dto");
+const _appuserentity = require("../entities/app-user.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-const _userentity = require("../entities/user.entity");
 const _enums = require("../enums");
 const _userenricherinterface = require("../interfaces/user-enricher.interface");
 const _authconfigservice = require("./auth-config.service");
@@ -93,7 +93,7 @@ function _ts_param(paramIndex, decorator) {
 }
 let UserService = class UserService extends _classes.RequestScopedApiService {
     resolveEntity() {
-        return _userentity.User;
+        return _appuserentity.AppUser;
     }
     getDataSourceProvider() {
         return this.dataSourceProvider;
@@ -200,24 +200,24 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
         return this.convertEntityToDto(entity);
     }
     convertRawToResponseDto(raw) {
-        const isActive = raw.user_companyIsActive !== undefined ? Boolean(raw.user_companyIsActive) : raw.user_is_active;
+        const isActive = raw.appuser_companyIsActive !== undefined ? Boolean(raw.appuser_companyIsActive) : raw.appuser_is_active;
         return {
-            id: raw.user_id,
-            name: raw.user_name,
-            phone: raw.user_phone,
-            email: raw.user_email,
-            profilePictureId: raw.user_profile_picture_id,
+            id: raw.appuser_id,
+            name: raw.appuser_name,
+            phone: raw.appuser_phone,
+            email: raw.appuser_email,
+            profilePictureId: raw.appuser_profile_picture_id,
             isActive,
-            emailVerified: raw.user_email_verified,
-            phoneVerified: raw.user_phone_verified,
-            lastLoginAt: raw.user_last_login_at,
-            additionalFields: raw.user_additional_fields,
-            createdAt: raw.user_created_at,
-            updatedAt: raw.user_updated_at,
-            deletedAt: raw.user_deleted_at,
-            createdById: raw.user_created_by_id,
-            updatedById: raw.user_updated_by_id,
-            deletedById: raw.user_deleted_by_id
+            emailVerified: raw.appuser_email_verified,
+            phoneVerified: raw.appuser_phone_verified,
+            lastLoginAt: raw.appuser_last_login_at,
+            additionalFields: raw.appuser_additional_fields,
+            createdAt: raw.appuser_created_at,
+            updatedAt: raw.appuser_updated_at,
+            deletedAt: raw.appuser_deleted_at,
+            createdById: raw.appuser_created_by_id,
+            updatedById: raw.appuser_updated_by_id,
+            deletedById: raw.appuser_deleted_by_id
         };
     }
     convertEntityToDto(entity) {
@@ -243,8 +243,22 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
     convertEntityListToResponseListDto(entities, isRaw) {
         return entities.map((entity)=>this.convertEntityToResponseDto(entity, isRaw));
     }
+    async getFilterQuery(query, filter, _user) {
+        for (const [key, value] of Object.entries(filter)){
+            if (key === 'actionCode' || key === 'isActive') {
+                continue; // real continue
+            }
+            query.andWhere(`${this.entityName}.${key} = :value`, {
+                value
+            });
+        }
+        return {
+            query,
+            isRaw: false
+        };
+    }
     async getGlobalSearchQuery(query, search, _user) {
-        query.andWhere('(user.name LIKE :search OR user.email LIKE :search OR user.phone LIKE :search)', {
+        query.andWhere('(appuser.name LIKE :search OR appuser.email LIKE :search OR appuser.phone LIKE :search)', {
             search: `%${search}%`
         });
         return {
@@ -253,50 +267,99 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
         };
     }
     async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
-        let result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
-        if (this.userEnricher?.enrichListQuery) {
-            await this.userEnricher.enrichListQuery(query, user);
-        }
+        const superQuery = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
-        if (!isCompanyFeatureEnabled) {
-            return result;
-        }
-        if (user?.companyId && this.permissionRepository) {
-            query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
-          WHERE perm.user_id = user.id
-          AND perm.permission_type = :permissionType
-          AND perm.target_id = :companyId
-          LIMIT 1)`, 'user_companyIsActive');
-            query.setParameter('permissionType', _enums.PermissionType.COMPANY);
-            query.setParameter('companyId', user.companyId);
-            if (filterAndPaginationDto.filter?.isActive !== undefined) {
+        const filter = filterAndPaginationDto?.filter;
+        // --- Action code filter (applies regardless of company feature) ---
+        if (filter?.actionCode) {
+            const actionCode = filter.actionCode;
+            const companyId = isCompanyFeatureEnabled ? user?.companyId : undefined;
+            if (isCompanyFeatureEnabled && !companyId) {
+                // Company feature is on but no companyId — no results should match
+                query.andWhere('1 = 0');
+                return {
+                    query,
+                    isRaw: true
+                };
+            }
+            const isPermissionModeFound = this.authConfig.isPermissionModeFound();
+            if (!isPermissionModeFound) {
+                // Optionally log a warning so the caller knows the filter was ignored
+                this.logAdapter.warn(`actionCode filter was requested but permission mode is not set to 'found' — filter ignored`);
+            } else {
                 query.andWhere(`EXISTS (
-            SELECT 1 FROM user_company_permissions perm
-            WHERE perm.user_id = user.id
-            AND perm.permission_type = :permissionType
-            AND perm.target_id = :companyId
-            AND perm.is_active = :isActiveValue
-          )`, {
-                    permissionType: _enums.PermissionType.COMPANY,
-                    companyId: user.companyId,
-                    isActiveValue: filterAndPaginationDto.filter.isActive
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_role'
+          AND perm.source_id = appuser.id
+          AND perm.target_id IN (
+            SELECT source_id FROM user_iam_permission
+            WHERE permission_type = 'role_action'
+              AND target_id = (SELECT id FROM action WHERE code = :actionCode)
+              ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+          )
+      ) OR EXISTS (
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_action'
+          AND perm.source_id = appuser.id
+          AND perm.target_id = (SELECT id FROM action WHERE code = :actionCode)
+          ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+      )`, {
+                    actionCode,
+                    ...isCompanyFeatureEnabled && {
+                        actionCompanyId: companyId
+                    }
+                });
+            }
+        }
+        // --- Non-company path ---
+        if (!isCompanyFeatureEnabled) {
+            if (filter?.isActive !== undefined) {
+                query.andWhere(`${this.entityName}.isActive = :value`, {
+                    value: filter.isActive
                 });
             }
+            return superQuery;
+        }
+        // --- Company feature path ---
+        if (!user?.companyId || !this.permissionRepository) {
+            return superQuery;
+        }
+        // Add companyIsActive as a selected column
+        query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+      LIMIT 1)`, 'user_companyIsActive');
+        query.setParameter('permissionType', _enums.PermissionType.COMPANY);
+        query.setParameter('companyId', user.companyId);
+        // Filter by isActive within the company if requested
+        if (filter?.isActive !== undefined) {
             query.andWhere(`EXISTS (
-          SELECT 1 FROM user_company_permissions perm
-          WHERE perm.user_id = user.id
+        SELECT 1 FROM user_company_permissions perm
+        WHERE perm.user_id = appuser.id
           AND perm.permission_type = :permissionType
           AND perm.target_id = :companyId
-        )`, {
+          AND perm.is_active = :isActiveValue
+      )`, {
                 permissionType: _enums.PermissionType.COMPANY,
-                companyId: user.companyId
+                companyId: user.companyId,
+                isActiveValue: filter.isActive
             });
-            return {
-                query,
-                isRaw: true
-            };
         }
-        return result;
+        // Always restrict to users belonging to this company
+        query.andWhere(`EXISTS (
+      SELECT 1 FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+    )`, {
+            permissionType: _enums.PermissionType.COMPANY,
+            companyId: user.companyId
+        });
+        return {
+            query,
+            isRaw: true
+        };
     }
     async insert(dto, user) {
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
@@ -496,7 +559,7 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
         }
     }
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig, userEnricher){
-        super('user', null, cacheManager, utilsService, UserService.name, true, 'auth'), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher;
+        super('appuser', null, cacheManager, utilsService, UserService.name, true, 'auth'), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), _define_property(this, "logAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher, this.logAdapter = (0, _classes.createModuleLogger)(this.constructor.name);
     }
 };
 _ts_decorate([

package/cjs/strategies/jwt.strategy.js

@@ -14,7 +14,7 @@ const _core = require("@nestjs/core");
 const _passport = require("@nestjs/passport");
 const _passportjwt = require("passport-jwt");
 const _config = require("../config");
-const _userentity = require("../entities/user.entity");
+const _appuserentity = require("../entities/app-user.entity");
 const _authconfigservice = require("../services/auth-config.service");
 const _authdatasourceprovider = require("../services/auth-datasource.provider");
 const _authenticationservice = require("../services/authentication.service");
@@ -67,7 +67,7 @@ let JwtStrategy = class JwtStrategy extends (0, _passport.PassportStrategy)(_pas
                 strict: false
             });
             if (provider) {
-                return provider.getRepository(_userentity.User);
+                return provider.getRepository(_appuserentity.AppUser);
             }
         } catch  {
             throw new _common.UnauthorizedException({

package/entities/{user.entity.d.ts → app-user.entity.d.ts}

@@ -1,3 +1,3 @@
 import { UserRoot } from '@flusys/nestjs-shared';
-export declare class User extends UserRoot {
+export declare class AppUser extends UserRoot {
 }

package/entities/index.d.ts

@@ -1,20 +1,20 @@
+export * from './app-user.entity';
 export * from './company-branch.entity';
 export * from './company.entity';
 export * from './pending-registration.entity';
 export { PermissionType, UserCompanyPermission } from './user-company-permission.entity';
-export * from './user.entity';
 export * from './user-token.entity';
+import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
 import { PendingRegistration } from './pending-registration.entity';
 import { UserCompanyPermission } from './user-company-permission.entity';
-import { User } from './user.entity';
 import { UserToken } from './user-token.entity';
-declare const BaseEntities: (typeof User | typeof UserToken)[];
+declare const BaseEntities: (typeof AppUser | typeof UserToken)[];
 declare const EmailEntities: (typeof PendingRegistration)[];
 declare const CompanyEntities: (typeof Company | typeof CompanyBranch | typeof UserCompanyPermission)[];
 export interface IAuthEntitiesConfig {
     enableCompanyFeature?: boolean;
     enableEmailVerification?: boolean;
 }
-export declare function getEntitiesByConfig(config: IAuthEntitiesConfig): (typeof BaseEntities[number] | typeof EmailEntities[number] | typeof CompanyEntities[number])[];
+export declare function getEntitiesByConfig(config: IAuthEntitiesConfig): ((typeof BaseEntities)[number] | (typeof EmailEntities)[number] | (typeof CompanyEntities)[number])[];

package/entities/user-company-permission.entity.d.ts

@@ -1,12 +1,12 @@
 import { PermissionType } from '../enums';
+import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
-import { User } from './user.entity';
 export { PermissionType };
 export declare class UserCompanyPermission {
     id: string;
     userId: string;
-    user?: User;
+    user?: AppUser;
     permissionType: string;
     targetId: string;
     isActive: boolean;

package/fesm/entities/{user.entity.js → app-user.entity.js}

@@ -6,10 +6,10 @@ function _ts_decorate(decorators, target, key, desc) {
 }
 import { UserRoot } from '@flusys/nestjs-shared';
 import { Entity } from 'typeorm';
-export class User extends UserRoot {
+export class AppUser extends UserRoot {
 }
-User = _ts_decorate([
+AppUser = _ts_decorate([
     Entity({
-        name: 'user'
+        name: 'app_user'
     })
-], User);
+], AppUser);

package/fesm/entities/company-branch.entity.js

@@ -20,7 +20,7 @@ function _ts_decorate(decorators, target, key, desc) {
 function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-import { Identity } from '@flusys/nestjs-shared';
+import { getJsonColumnType, Identity } from '@flusys/nestjs-shared';
 import { Column, Entity, JoinColumn, ManyToOne, OneToMany, Unique } from 'typeorm';
 import { Company } from './company.entity';
 export class CompanyBranch extends Identity {
@@ -99,7 +99,7 @@ _ts_decorate([
 ], CompanyBranch.prototype, "isActive", void 0);
 _ts_decorate([
     Column({
-        type: 'json',
+        type: getJsonColumnType(),
         nullable: true
     }),
     _ts_metadata("design:type", Object)

package/fesm/entities/company.entity.js

@@ -20,7 +20,7 @@ function _ts_decorate(decorators, target, key, desc) {
 function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-import { Identity } from '@flusys/nestjs-shared';
+import { getJsonColumnType, Identity } from '@flusys/nestjs-shared';
 import { Column, Entity, OneToMany } from 'typeorm';
 import { CompanyBranch } from './company-branch.entity';
 export class Company extends Identity {
@@ -113,14 +113,14 @@ _ts_decorate([
 ], Company.prototype, "isActive", void 0);
 _ts_decorate([
     Column({
-        type: 'json',
+        type: getJsonColumnType(),
         nullable: true
     }),
     _ts_metadata("design:type", Object)
 ], Company.prototype, "settings", void 0);
 _ts_decorate([
     Column({
-        type: 'json',
+        type: getJsonColumnType(),
         nullable: true
     }),
     _ts_metadata("design:type", Object)

package/fesm/entities/index.js

@@ -1,17 +1,17 @@
+export * from './app-user.entity';
 export * from './company-branch.entity';
 export * from './company.entity';
 export * from './pending-registration.entity';
 export { PermissionType, UserCompanyPermission } from './user-company-permission.entity';
-export * from './user.entity';
 export * from './user-token.entity';
+import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
 import { PendingRegistration } from './pending-registration.entity';
 import { UserCompanyPermission } from './user-company-permission.entity';
-import { User } from './user.entity';
 import { UserToken } from './user-token.entity';
 const BaseEntities = [
-    User,
+    AppUser,
     UserToken
 ];
 const EmailEntities = [

package/fesm/entities/pending-registration.entity.js

@@ -20,6 +20,7 @@ function _ts_decorate(decorators, target, key, desc) {
 function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
+import { getJsonColumnType } from '@flusys/nestjs-shared';
 import { Column, CreateDateColumn, Entity, Index, PrimaryGeneratedColumn } from 'typeorm';
 export class PendingRegistration {
     constructor(){
@@ -85,7 +86,7 @@ _ts_decorate([
 ], PendingRegistration.prototype, "expiresAt", void 0);
 _ts_decorate([
     Column({
-        type: 'json',
+        type: getJsonColumnType(),
         nullable: true,
         name: 'company_data'
     }),
@@ -93,7 +94,7 @@ _ts_decorate([
 ], PendingRegistration.prototype, "companyData", void 0);
 _ts_decorate([
     Column({
-        type: 'json',
+        type: getJsonColumnType(),
         nullable: true,
         name: 'additional_fields'
     }),

package/fesm/entities/user-company-permission.entity.js

@@ -22,9 +22,9 @@ function _ts_metadata(k, v) {
 }
 import { Column, CreateDateColumn, Entity, Index, JoinColumn, ManyToOne, PrimaryGeneratedColumn, UpdateDateColumn } from 'typeorm';
 import { PermissionType } from '../enums';
+import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
-import { User } from './user.entity';
 export { PermissionType };
 export class UserCompanyPermission {
     constructor(){
@@ -52,13 +52,13 @@ _ts_decorate([
     _ts_metadata("design:type", String)
 ], UserCompanyPermission.prototype, "userId", void 0);
 _ts_decorate([
-    ManyToOne(()=>User, {
+    ManyToOne(()=>AppUser, {
         onDelete: 'CASCADE'
     }),
     JoinColumn({
         name: 'user_id'
     }),
-    _ts_metadata("design:type", typeof User === "undefined" ? Object : User)
+    _ts_metadata("design:type", typeof AppUser === "undefined" ? Object : AppUser)
 ], UserCompanyPermission.prototype, "user", void 0);
 _ts_decorate([
     Column({

package/fesm/services/auth-config.service.js

@@ -45,6 +45,9 @@ export class AuthConfigService {
     isEmailVerificationEnabled() {
         return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
+    isPermissionModeFound() {
+        return this.options.bootstrapAppConfig?.permissionMode !== undefined;
+    }
     // JWT Configuration
     getJwtSecret() {
         if (!this.config.jwtSecret) {

package/fesm/services/auth-email.service.js

@@ -31,9 +31,9 @@ import { BadRequestException, Inject, Injectable, InternalServerErrorException,
 import * as bcrypt from 'bcrypt';
 import * as crypto from 'crypto';
 import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, USER_MESSAGES } from '../config';
+import { AppUser } from '../entities/app-user.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { TokenType, UserToken } from '../entities/user-token.entity';
-import { User } from '../entities/user.entity';
 import { AUTH_EMAIL_PROVIDER, IAuthEmailProvider } from '../interfaces';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class AuthEmailService {
@@ -102,7 +102,7 @@ export class AuthEmailService {
     }
     async createPendingRegistration(data) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const pendingRepository = await this.getRepository(PendingRegistration);
         // Check if user already exists
         const existingUser = await userRepository.findOne({
@@ -147,7 +147,7 @@ export class AuthEmailService {
     }
     async forgotPassword(email, resetUrlBase) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const tokenRepository = await this.getRepository(UserToken);
         const user = await userRepository.findOne({
             where: {
@@ -198,7 +198,7 @@ export class AuthEmailService {
         };
     }
     async resetPassword(token, newPassword) {
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const tokenRepository = await this.getRepository(UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
@@ -240,7 +240,7 @@ export class AuthEmailService {
     }
     async verifyEmail(token) {
         const pendingRepository = await this.getRepository(PendingRegistration);
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const tokenRepository = await this.getRepository(UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
@@ -324,7 +324,7 @@ export class AuthEmailService {
     async resendVerificationEmail(email, verifyUrlBase) {
         this.assertEmailEnabled();
         const pendingRepository = await this.getRepository(PendingRegistration);
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const tokenRepository = await this.getRepository(UserToken);
         // Check pending registration first
         const pending = await pendingRepository.findOne({

package/fesm/services/authentication.service.js

@@ -36,11 +36,11 @@ import { JwtService } from '@nestjs/jwt';
 import * as bcrypt from 'bcrypt';
 import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, TOKEN_REVOKED_PREFIX, USER_ENRICHER, USER_MESSAGES } from '../config';
 import { RegistrationDto } from '../dtos/authentication.dto';
+import { AppUser } from '../entities/app-user.entity';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
-import { User } from '../entities/user.entity';
 import { PermissionType } from '../enums';
 import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { AuthConfigService } from './auth-config.service';
@@ -62,11 +62,11 @@ export class AuthenticationService {
                 message: 'User repository not available',
                 messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
                 messageVariables: {
-                    entity: 'User'
+                    entity: 'AppUser'
                 }
             });
         }
-        return this.dataSourceProvider.getRepository(User);
+        return this.dataSourceProvider.getRepository(AppUser);
     }
     async getPermissionRepository() {
         if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
@@ -248,7 +248,7 @@ export class AuthenticationService {
         await queryRunner.startTransaction();
         try {
             const hashedPassword = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
-            const user = queryRunner.manager.create(User, {
+            const user = queryRunner.manager.create(AppUser, {
                 name: dto.name,
                 email: dto.email,
                 phone: dto.phone,
@@ -257,7 +257,7 @@ export class AuthenticationService {
                 emailVerified: false,
                 phoneVerified: false
             });
-            await queryRunner.manager.save(User, user);
+            await queryRunner.manager.save(AppUser, user);
             if (this.userEnricher?.onUserCreated) {
                 await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
             }
@@ -291,7 +291,7 @@ export class AuthenticationService {
         await queryRunner.connect();
         await queryRunner.startTransaction();
         try {
-            const existingUser = await queryRunner.manager.findOne(User, {
+            const existingUser = await queryRunner.manager.findOne(AppUser, {
                 where: {
                     email: pending.email
                 }
@@ -302,7 +302,7 @@ export class AuthenticationService {
                     messageKey: AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
                 });
             }
-            const user = queryRunner.manager.create(User, {
+            const user = queryRunner.manager.create(AppUser, {
                 name: pending.name,
                 email: pending.email,
                 phone: pending.phone,
@@ -311,7 +311,7 @@ export class AuthenticationService {
                 emailVerified: true,
                 phoneVerified: false
             });
-            await queryRunner.manager.save(User, user);
+            await queryRunner.manager.save(AppUser, user);
             if (this.userEnricher?.onUserCreated) {
                 await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
             }

package/fesm/services/user.service.js

@@ -26,7 +26,7 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
-import { HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
+import { createModuleLogger, HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
 import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
@@ -34,15 +34,15 @@ import { BadRequestException, ForbiddenException, Inject, Injectable, NotFoundEx
 import * as bcrypt from 'bcrypt';
 import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, USER_ENRICHER, USER_MESSAGES, USER_PERMISSION_MESSAGES } from '../config';
 import { CreateUserDto } from '../dtos/user.dto';
+import { AppUser } from '../entities/app-user.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
-import { User } from '../entities/user.entity';
 import { PermissionType } from '../enums';
 import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class UserService extends RequestScopedApiService {
     resolveEntity() {
-        return User;
+        return AppUser;
     }
     getDataSourceProvider() {
         return this.dataSourceProvider;
@@ -149,24 +149,24 @@ export class UserService extends RequestScopedApiService {
         return this.convertEntityToDto(entity);
     }
     convertRawToResponseDto(raw) {
-        const isActive = raw.user_companyIsActive !== undefined ? Boolean(raw.user_companyIsActive) : raw.user_is_active;
+        const isActive = raw.appuser_companyIsActive !== undefined ? Boolean(raw.appuser_companyIsActive) : raw.appuser_is_active;
         return {
-            id: raw.user_id,
-            name: raw.user_name,
-            phone: raw.user_phone,
-            email: raw.user_email,
-            profilePictureId: raw.user_profile_picture_id,
+            id: raw.appuser_id,
+            name: raw.appuser_name,
+            phone: raw.appuser_phone,
+            email: raw.appuser_email,
+            profilePictureId: raw.appuser_profile_picture_id,
             isActive,
-            emailVerified: raw.user_email_verified,
-            phoneVerified: raw.user_phone_verified,
-            lastLoginAt: raw.user_last_login_at,
-            additionalFields: raw.user_additional_fields,
-            createdAt: raw.user_created_at,
-            updatedAt: raw.user_updated_at,
-            deletedAt: raw.user_deleted_at,
-            createdById: raw.user_created_by_id,
-            updatedById: raw.user_updated_by_id,
-            deletedById: raw.user_deleted_by_id
+            emailVerified: raw.appuser_email_verified,
+            phoneVerified: raw.appuser_phone_verified,
+            lastLoginAt: raw.appuser_last_login_at,
+            additionalFields: raw.appuser_additional_fields,
+            createdAt: raw.appuser_created_at,
+            updatedAt: raw.appuser_updated_at,
+            deletedAt: raw.appuser_deleted_at,
+            createdById: raw.appuser_created_by_id,
+            updatedById: raw.appuser_updated_by_id,
+            deletedById: raw.appuser_deleted_by_id
         };
     }
     convertEntityToDto(entity) {
@@ -192,8 +192,22 @@ export class UserService extends RequestScopedApiService {
     convertEntityListToResponseListDto(entities, isRaw) {
         return entities.map((entity)=>this.convertEntityToResponseDto(entity, isRaw));
     }
+    async getFilterQuery(query, filter, _user) {
+        for (const [key, value] of Object.entries(filter)){
+            if (key === 'actionCode' || key === 'isActive') {
+                continue; // real continue
+            }
+            query.andWhere(`${this.entityName}.${key} = :value`, {
+                value
+            });
+        }
+        return {
+            query,
+            isRaw: false
+        };
+    }
     async getGlobalSearchQuery(query, search, _user) {
-        query.andWhere('(user.name LIKE :search OR user.email LIKE :search OR user.phone LIKE :search)', {
+        query.andWhere('(appuser.name LIKE :search OR appuser.email LIKE :search OR appuser.phone LIKE :search)', {
             search: `%${search}%`
         });
         return {
@@ -202,50 +216,99 @@ export class UserService extends RequestScopedApiService {
         };
     }
     async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
-        let result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
-        if (this.userEnricher?.enrichListQuery) {
-            await this.userEnricher.enrichListQuery(query, user);
-        }
+        const superQuery = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
-        if (!isCompanyFeatureEnabled) {
-            return result;
-        }
-        if (user?.companyId && this.permissionRepository) {
-            query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
-          WHERE perm.user_id = user.id
-          AND perm.permission_type = :permissionType
-          AND perm.target_id = :companyId
-          LIMIT 1)`, 'user_companyIsActive');
-            query.setParameter('permissionType', PermissionType.COMPANY);
-            query.setParameter('companyId', user.companyId);
-            if (filterAndPaginationDto.filter?.isActive !== undefined) {
+        const filter = filterAndPaginationDto?.filter;
+        // --- Action code filter (applies regardless of company feature) ---
+        if (filter?.actionCode) {
+            const actionCode = filter.actionCode;
+            const companyId = isCompanyFeatureEnabled ? user?.companyId : undefined;
+            if (isCompanyFeatureEnabled && !companyId) {
+                // Company feature is on but no companyId — no results should match
+                query.andWhere('1 = 0');
+                return {
+                    query,
+                    isRaw: true
+                };
+            }
+            const isPermissionModeFound = this.authConfig.isPermissionModeFound();
+            if (!isPermissionModeFound) {
+                // Optionally log a warning so the caller knows the filter was ignored
+                this.logAdapter.warn(`actionCode filter was requested but permission mode is not set to 'found' — filter ignored`);
+            } else {
                 query.andWhere(`EXISTS (
-            SELECT 1 FROM user_company_permissions perm
-            WHERE perm.user_id = user.id
-            AND perm.permission_type = :permissionType
-            AND perm.target_id = :companyId
-            AND perm.is_active = :isActiveValue
-          )`, {
-                    permissionType: PermissionType.COMPANY,
-                    companyId: user.companyId,
-                    isActiveValue: filterAndPaginationDto.filter.isActive
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_role'
+          AND perm.source_id = appuser.id
+          AND perm.target_id IN (
+            SELECT source_id FROM user_iam_permission
+            WHERE permission_type = 'role_action'
+              AND target_id = (SELECT id FROM action WHERE code = :actionCode)
+              ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+          )
+      ) OR EXISTS (
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_action'
+          AND perm.source_id = appuser.id
+          AND perm.target_id = (SELECT id FROM action WHERE code = :actionCode)
+          ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+      )`, {
+                    actionCode,
+                    ...isCompanyFeatureEnabled && {
+                        actionCompanyId: companyId
+                    }
+                });
+            }
+        }
+        // --- Non-company path ---
+        if (!isCompanyFeatureEnabled) {
+            if (filter?.isActive !== undefined) {
+                query.andWhere(`${this.entityName}.isActive = :value`, {
+                    value: filter.isActive
                 });
             }
+            return superQuery;
+        }
+        // --- Company feature path ---
+        if (!user?.companyId || !this.permissionRepository) {
+            return superQuery;
+        }
+        // Add companyIsActive as a selected column
+        query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+      LIMIT 1)`, 'user_companyIsActive');
+        query.setParameter('permissionType', PermissionType.COMPANY);
+        query.setParameter('companyId', user.companyId);
+        // Filter by isActive within the company if requested
+        if (filter?.isActive !== undefined) {
             query.andWhere(`EXISTS (
-          SELECT 1 FROM user_company_permissions perm
-          WHERE perm.user_id = user.id
+        SELECT 1 FROM user_company_permissions perm
+        WHERE perm.user_id = appuser.id
           AND perm.permission_type = :permissionType
           AND perm.target_id = :companyId
-        )`, {
+          AND perm.is_active = :isActiveValue
+      )`, {
                 permissionType: PermissionType.COMPANY,
-                companyId: user.companyId
+                companyId: user.companyId,
+                isActiveValue: filter.isActive
             });
-            return {
-                query,
-                isRaw: true
-            };
         }
-        return result;
+        // Always restrict to users belonging to this company
+        query.andWhere(`EXISTS (
+      SELECT 1 FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+    )`, {
+            permissionType: PermissionType.COMPANY,
+            companyId: user.companyId
+        });
+        return {
+            query,
+            isRaw: true
+        };
     }
     async insert(dto, user) {
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
@@ -445,7 +508,7 @@ export class UserService extends RequestScopedApiService {
         }
     }
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig, userEnricher){
-        super('user', null, cacheManager, utilsService, UserService.name, true, 'auth'), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher;
+        super('appuser', null, cacheManager, utilsService, UserService.name, true, 'auth'), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), _define_property(this, "logAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher, this.logAdapter = createModuleLogger(this.constructor.name);
     }
 }
 _ts_decorate([

package/fesm/strategies/jwt.strategy.js

@@ -26,7 +26,7 @@ import { ModuleRef } from '@nestjs/core';
 import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
 import { AUTH_MESSAGES, USER_MESSAGES } from '../config';
-import { User } from '../entities/user.entity';
+import { AppUser } from '../entities/app-user.entity';
 import { AuthConfigService } from '../services/auth-config.service';
 import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
 import { AuthenticationService } from '../services/authentication.service';
@@ -57,7 +57,7 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
                 strict: false
             });
             if (provider) {
-                return provider.getRepository(User);
+                return provider.getRepository(AppUser);
             }
         } catch  {
             throw new UnauthorizedException({

package/interfaces/user-enricher.interface.d.ts

@@ -1,6 +1,5 @@
 import { ILoggedUserInfo, IPermissionLogic } from '@flusys/nestjs-shared/interfaces';
-import { QueryRunner, SelectQueryBuilder } from 'typeorm';
-import { User } from '../entities/user.entity';
+import { QueryRunner } from 'typeorm';
 import { IUser } from './user.interface';
 export interface IProfileSection {
     id: string;
@@ -43,9 +42,6 @@ export interface IProfileAction {
 }
 export type IEnrichedUser = IUser & IProfileExtras;
 export interface IUserEnricher {
-    enrichListQuery?(query: SelectQueryBuilder<User>, user: ILoggedUserInfo | null): Promise<{
-        extraFields: string[];
-    }>;
     enrichListItems?(users: IUser[], user: ILoggedUserInfo | null): Promise<IEnrichedUser[]>;
     getProfileExtras?(userId: string, user: ILoggedUserInfo): Promise<IProfileExtras>;
     updateProfileExtras?(userId: string, extras: Record<string, any>, queryRunner: QueryRunner): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "5.0.0",
+  "version": "5.0.3",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -81,7 +81,7 @@
     "@nestjs/passport": "^10.0.0 || ^11.0.0",
     "@nestjs/swagger": "^7.0.0 || ^11.0.0",
     "@nestjs/typeorm": "^10.0.0 || ^11.0.0",
-    "bcrypt": "^5.0.0 || ^6.0.0",
+    "bcrypt": "^5.0.1 || ^6.0.0",
     "class-transformer": "^0.5.0",
     "class-validator": "^0.14.0",
     "nodemailer": "^7.0.0",
@@ -93,7 +93,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "5.0.0",
-    "@flusys/nestjs-shared": "5.0.0"
+    "@flusys/nestjs-core": "5.0.3",
+    "@flusys/nestjs-shared": "5.0.3"
   }
 }

package/services/auth-config.service.d.ts

@@ -9,6 +9,7 @@ export declare class AuthConfigService implements IModuleConfigService {
     isMultiTenant(): boolean;
     isCompanyFeatureEnabled(): boolean;
     isEmailVerificationEnabled(): boolean;
+    isPermissionModeFound(): boolean;
     getJwtSecret(): string;
     getJwtExpiration(): string;
     getRefreshTokenSecret(): string;

package/services/user.service.d.ts

@@ -4,12 +4,12 @@ import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { EntityTarget, Repository, SelectQueryBuilder } from 'typeorm';
 import { CreateUserDto, UpdateUserDto } from '../dtos/user.dto';
-import { User } from '../entities/user.entity';
+import { AppUser } from '../entities/app-user.entity';
 import { IEnrichedUser, IProfileExtras, IProfileSection, IProfileSectionData, IUserEnricher } from '../interfaces/user-enricher.interface';
 import { IUser } from '../interfaces/user.interface';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
-export declare class UserService extends RequestScopedApiService<CreateUserDto, UpdateUserDto, IUser, User, Repository<User>> {
+export declare class UserService extends RequestScopedApiService<CreateUserDto, UpdateUserDto, IUser, AppUser, Repository<AppUser>> {
     protected cacheManager: HybridCache;
     protected utilsService: UtilsService;
     private readonly dataSourceProvider;
@@ -17,25 +17,30 @@ export declare class UserService extends RequestScopedApiService<CreateUserDto,
     private readonly userEnricher?;
     private permissionRepository?;
     private dataSource?;
+    private readonly logAdapter;
     constructor(cacheManager: HybridCache, utilsService: UtilsService, dataSourceProvider: AuthDataSourceProvider, authConfig: AuthConfigService, userEnricher?: IUserEnricher);
-    protected resolveEntity(): EntityTarget<User>;
+    protected resolveEntity(): EntityTarget<AppUser>;
     protected getDataSourceProvider(): AuthDataSourceProvider;
     protected ensureRepositoryInitialized(): Promise<void>;
     private getUserForProfile;
     verifyEmail(id: string): Promise<void>;
     verifyPhone(id: string): Promise<void>;
     updateStatus(id: string, isActive: boolean, user?: ILoggedUserInfo | null): Promise<void>;
-    protected convertSingleDtoToEntity(dto: CreateUserDto | UpdateUserDto, user: ILoggedUserInfo | null): Promise<User>;
-    protected convertEntityToResponseDto(entity: User, isRaw: boolean): IUser;
+    protected convertSingleDtoToEntity(dto: CreateUserDto | UpdateUserDto, user: ILoggedUserInfo | null): Promise<AppUser>;
+    protected convertEntityToResponseDto(entity: AppUser, isRaw: boolean): IUser;
     private convertRawToResponseDto;
     private convertEntityToDto;
-    protected convertEntityListToResponseListDto(entities: User[], isRaw: boolean): IUser[];
-    protected getGlobalSearchQuery(query: SelectQueryBuilder<User>, search: string, _user: ILoggedUserInfo | null): Promise<{
-        query: SelectQueryBuilder<User>;
+    protected convertEntityListToResponseListDto(entities: AppUser[], isRaw: boolean): IUser[];
+    protected getFilterQuery(query: SelectQueryBuilder<AppUser>, filter: Record<string, unknown>, _user: ILoggedUserInfo | null): Promise<{
+        query: SelectQueryBuilder<AppUser>;
         isRaw: boolean;
     }>;
-    protected getExtraManipulateQuery(query: SelectQueryBuilder<User>, filterAndPaginationDto: FilterAndPaginationDto, user: ILoggedUserInfo | null): Promise<{
-        query: SelectQueryBuilder<User>;
+    protected getGlobalSearchQuery(query: SelectQueryBuilder<AppUser>, search: string, _user: ILoggedUserInfo | null): Promise<{
+        query: SelectQueryBuilder<AppUser>;
+        isRaw: boolean;
+    }>;
+    protected getExtraManipulateQuery(query: SelectQueryBuilder<AppUser>, filterAndPaginationDto: FilterAndPaginationDto, user: ILoggedUserInfo | null): Promise<{
+        query: SelectQueryBuilder<AppUser>;
         isRaw: boolean;
     }>;
     insert(dto: CreateUserDto, user: ILoggedUserInfo | null): Promise<IUser>;