@flusys/nestjs-auth 5.0.1 → 5.0.4

package/README.md

@@ -228,20 +228,19 @@ When `AUTH_EMAIL_PROVIDER` is not provided, registration still works but emails
 
 Extend user list and profile responses without creating circular imports. All methods are optional — implement only what you need.
 
-| Method | When called | Purpose |
-| --- | --- | --- |
-| `enrichListQuery` | User list query build | Add extra joins/selects to the query |
-| `enrichListItems` | After user list fetch | Attach computed data to list items |
-| `getProfileExtras` | `POST /users/get/:id` | Add roles, actions, sections to profile |
-| `updateProfileExtras` | Profile update (in tx) | Persist extra profile fields |
-| `validateProfileExtras` | Before profile update | Validate extra fields |
-| `getProfileSections` | Profile form init | Return multi-step section definitions |
-| `getProfileSectionData` | Section fetch | Return section-specific data |
-| `updateProfileSection` | Section save (in tx) | Persist section data |
-| `handleSectionFileUpload` | File upload (in tx) | Handle file attach to section |
-| `handleSectionFileDelete` | File delete (in tx) | Handle file removal from section |
-| `calculateProfileCompletion` | Profile fetch | Return 0–100 completion score |
-| `onUserCreated` | Registration (in tx) | Hook after user row created; throw to rollback |
+| Method                       | When called            | Purpose                                        |
+| ---------------------------- | ---------------------- | ---------------------------------------------- |
+| `enrichListItems`            | After user list fetch  | Attach computed data to list items             |
+| `getProfileExtras`           | `POST /users/get/:id`  | Add roles, actions, sections to profile        |
+| `updateProfileExtras`        | Profile update (in tx) | Persist extra profile fields                   |
+| `validateProfileExtras`      | Before profile update  | Validate extra fields                          |
+| `getProfileSections`         | Profile form init      | Return multi-step section definitions          |
+| `getProfileSectionData`      | Section fetch          | Return section-specific data                   |
+| `updateProfileSection`       | Section save (in tx)   | Persist section data                           |
+| `handleSectionFileUpload`    | File upload (in tx)    | Handle file attach to section                  |
+| `handleSectionFileDelete`    | File delete (in tx)    | Handle file removal from section               |
+| `calculateProfileCompletion` | Profile fetch          | Return 0–100 completion score                  |
+| `onUserCreated`              | Registration (in tx)   | Hook after user row created; throw to rollback |
 
 ```typescript
 import { USER_ENRICHER, IUserEnricher, IProfileExtras } from '@flusys/nestjs-auth';

package/cjs/controllers/user-permission.controller.js

@@ -9,9 +9,9 @@ Object.defineProperty(exports, "UserPermissionController", {
     }
 });
 const _nestjsshared = require("@flusys/nestjs-shared");
-const _config = require("../config");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
+const _config = require("../config");
 const _userpermissiondto = require("../dtos/user-permission.dto");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
 const _userpermissionservice = require("../services/user-permission.service");
@@ -214,7 +214,7 @@ UserPermissionController = _ts_decorate([
     (0, _swagger.ApiTags)('User Permissions'),
     (0, _swagger.ApiBearerAuth)(),
     (0, _common.Controller)('administration/permissions'),
-    (0, _common.UseGuards)(_nestjsshared.JwtAuthGuard),
+    (0, _common.UseGuards)(_nestjsshared.JwtAuthGuard, _nestjsshared.PermissionGuard),
     _ts_param(0, (0, _common.Inject)(_userpermissionservice.UserPermissionService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/cjs/controllers/user.controller.js

@@ -9,12 +9,12 @@ Object.defineProperty(exports, "UserController", {
     }
 });
 const _classes = require("@flusys/nestjs-shared/classes");
-const _config = require("../config");
 const _decorators = require("@flusys/nestjs-shared/decorators");
 const _guards = require("@flusys/nestjs-shared/guards");
 const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
+const _config = require("../config");
 const _userdto = require("../dtos/user.dto");
 const _userservice = require("../services/user.service");
 function _define_property(obj, key, value) {
@@ -176,7 +176,7 @@ let UserController = class UserController extends (0, _classes.createApiControll
 };
 _ts_decorate([
     (0, _common.Post)(':id/profile-extras'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
+    (0, _common.UseGuards)(_guards.JwtAuthGuard, _guards.PermissionGuard),
     (0, _swagger.ApiBearerAuth)(),
     (0, _decorators.RequirePermission)(_classes.USER_PERMISSIONS.READ),
     (0, _swagger.ApiOperation)({
@@ -198,7 +198,7 @@ _ts_decorate([
 ], UserController.prototype, "getProfileWithExtras", null);
 _ts_decorate([
     (0, _common.Post)(':id/verify-email'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
+    (0, _common.UseGuards)(_guards.JwtAuthGuard, _guards.PermissionGuard),
     (0, _swagger.ApiBearerAuth)(),
     (0, _decorators.RequirePermission)(_classes.USER_PERMISSIONS.UPDATE),
     (0, _swagger.ApiOperation)({
@@ -217,7 +217,7 @@ _ts_decorate([
 ], UserController.prototype, "verifyEmail", null);
 _ts_decorate([
     (0, _common.Post)(':id/verify-phone'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
+    (0, _common.UseGuards)(_guards.JwtAuthGuard, _guards.PermissionGuard),
     (0, _swagger.ApiBearerAuth)(),
     (0, _decorators.RequirePermission)(_classes.USER_PERMISSIONS.UPDATE),
     (0, _swagger.ApiOperation)({
@@ -236,7 +236,7 @@ _ts_decorate([
 ], UserController.prototype, "verifyPhone", null);
 _ts_decorate([
     (0, _common.Post)(':id/status'),
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
+    (0, _common.UseGuards)(_guards.JwtAuthGuard, _guards.PermissionGuard),
     (0, _swagger.ApiBearerAuth)(),
     (0, _decorators.RequirePermission)(_classes.USER_PERMISSIONS.UPDATE),
     (0, _swagger.ApiOperation)({
@@ -301,7 +301,6 @@ _ts_decorate([
     (0, _common.Post)(':id/profile-section/:sectionId'),
     (0, _common.UseGuards)(_guards.JwtAuthGuard),
     (0, _swagger.ApiBearerAuth)(),
-    (0, _decorators.RequirePermission)(_classes.USER_PERMISSIONS.READ),
     (0, _swagger.ApiOperation)({
         summary: 'Get profile section data',
         description: 'Returns data for a specific profile section.'
@@ -329,7 +328,6 @@ _ts_decorate([
     (0, _common.Post)(':id/profile-section/:sectionId/update'),
     (0, _common.UseGuards)(_guards.JwtAuthGuard),
     (0, _swagger.ApiBearerAuth)(),
-    (0, _decorators.RequirePermission)(_classes.USER_PERMISSIONS.UPDATE),
     (0, _swagger.ApiOperation)({
         summary: 'Update profile section',
         description: 'Updates a specific profile section data.'
@@ -359,7 +357,6 @@ _ts_decorate([
     (0, _common.Post)(':id/profile-completion'),
     (0, _common.UseGuards)(_guards.JwtAuthGuard),
     (0, _swagger.ApiBearerAuth)(),
-    (0, _decorators.RequirePermission)(_classes.USER_PERMISSIONS.READ),
     (0, _swagger.ApiOperation)({
         summary: 'Get profile completion percentage',
         description: 'Returns overall profile completion percentage.'

package/cjs/entities/{user.entity.js → app-user.entity.js}

@@ -2,10 +2,10 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-Object.defineProperty(exports, "User", {
+Object.defineProperty(exports, "AppUser", {
     enumerable: true,
     get: function() {
-        return User;
+        return AppUser;
     }
 });
 const _nestjsshared = require("@flusys/nestjs-shared");
@@ -16,10 +16,10 @@ function _ts_decorate(decorators, target, key, desc) {
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-let User = class User extends _nestjsshared.UserRoot {
+let AppUser = class AppUser extends _nestjsshared.UserRoot {
 };
-User = _ts_decorate([
+AppUser = _ts_decorate([
     (0, _typeorm.Entity)({
-        name: 'user'
+        name: 'app_user'
     })
-], User);
+], AppUser);

package/cjs/entities/index.js

@@ -19,11 +19,11 @@ _export(exports, {
         return getEntitiesByConfig;
     }
 });
+const _appuserentity = _export_star(require("./app-user.entity"), exports);
 const _companybranchentity = _export_star(require("./company-branch.entity"), exports);
 const _companyentity = _export_star(require("./company.entity"), exports);
 const _pendingregistrationentity = _export_star(require("./pending-registration.entity"), exports);
 const _usercompanypermissionentity = require("./user-company-permission.entity");
-const _userentity = _export_star(require("./user.entity"), exports);
 const _usertokenentity = _export_star(require("./user-token.entity"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {
@@ -39,7 +39,7 @@ function _export_star(from, to) {
     return from;
 }
 const BaseEntities = [
-    _userentity.User,
+    _appuserentity.AppUser,
     _usertokenentity.UserToken
 ];
 const EmailEntities = [

package/cjs/entities/user-company-permission.entity.js

@@ -18,9 +18,9 @@ _export(exports, {
 });
 const _typeorm = require("typeorm");
 const _enums = require("../enums");
+const _appuserentity = require("./app-user.entity");
 const _companybranchentity = require("./company-branch.entity");
 const _companyentity = require("./company.entity");
-const _userentity = require("./user.entity");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -69,13 +69,13 @@ _ts_decorate([
     _ts_metadata("design:type", String)
 ], UserCompanyPermission.prototype, "userId", void 0);
 _ts_decorate([
-    (0, _typeorm.ManyToOne)(()=>_userentity.User, {
+    (0, _typeorm.ManyToOne)(()=>_appuserentity.AppUser, {
         onDelete: 'CASCADE'
     }),
     (0, _typeorm.JoinColumn)({
         name: 'user_id'
     }),
-    _ts_metadata("design:type", typeof _userentity.User === "undefined" ? Object : _userentity.User)
+    _ts_metadata("design:type", typeof _appuserentity.AppUser === "undefined" ? Object : _appuserentity.AppUser)
 ], UserCompanyPermission.prototype, "user", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({

package/cjs/services/auth-config.service.js

@@ -55,6 +55,9 @@ let AuthConfigService = class AuthConfigService {
     isEmailVerificationEnabled() {
         return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
+    isPermissionModeFound() {
+        return this.options.bootstrapAppConfig?.permissionMode !== undefined;
+    }
     // JWT Configuration
     getJwtSecret() {
         if (!this.config.jwtSecret) {

package/cjs/services/auth-email.service.js

@@ -14,9 +14,9 @@ const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _crypto = /*#__PURE__*/ _interop_require_wildcard(require("crypto"));
 const _config = require("../config");
+const _appuserentity = require("../entities/app-user.entity");
 const _pendingregistrationentity = require("../entities/pending-registration.entity");
 const _usertokenentity = require("../entities/user-token.entity");
-const _userentity = require("../entities/user.entity");
 const _interfaces = require("../interfaces");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 function _define_property(obj, key, value) {
@@ -153,7 +153,7 @@ let AuthEmailService = class AuthEmailService {
     }
     async createPendingRegistration(data) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
         // Check if user already exists
         const existingUser = await userRepository.findOne({
@@ -198,7 +198,7 @@ let AuthEmailService = class AuthEmailService {
     }
     async forgotPassword(email, resetUrlBase) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         const user = await userRepository.findOne({
             where: {
@@ -249,7 +249,7 @@ let AuthEmailService = class AuthEmailService {
         };
     }
     async resetPassword(token, newPassword) {
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
@@ -291,7 +291,7 @@ let AuthEmailService = class AuthEmailService {
     }
     async verifyEmail(token) {
         const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
@@ -375,7 +375,7 @@ let AuthEmailService = class AuthEmailService {
     async resendVerificationEmail(email, verifyUrlBase) {
         this.assertEmailEnabled();
         const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);
-        const userRepository = await this.getRepository(_userentity.User);
+        const userRepository = await this.getRepository(_appuserentity.AppUser);
         const tokenRepository = await this.getRepository(_usertokenentity.UserToken);
         // Check pending registration first
         const pending = await pendingRepository.findOne({

package/cjs/services/authentication.service.js

@@ -19,11 +19,11 @@ const _jwt = require("@nestjs/jwt");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _config = require("../config");
 const _authenticationdto = require("../dtos/authentication.dto");
+const _appuserentity = require("../entities/app-user.entity");
 const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
 const _pendingregistrationentity = require("../entities/pending-registration.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-const _userentity = require("../entities/user.entity");
 const _enums1 = require("../enums");
 const _userenricherinterface = require("../interfaces/user-enricher.interface");
 const _authconfigservice = require("./auth-config.service");
@@ -113,11 +113,11 @@ let AuthenticationService = class AuthenticationService {
                 message: 'User repository not available',
                 messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
                 messageVariables: {
-                    entity: 'User'
+                    entity: 'AppUser'
                 }
             });
         }
-        return this.dataSourceProvider.getRepository(_userentity.User);
+        return this.dataSourceProvider.getRepository(_appuserentity.AppUser);
     }
     async getPermissionRepository() {
         if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
@@ -299,7 +299,7 @@ let AuthenticationService = class AuthenticationService {
         await queryRunner.startTransaction();
         try {
             const hashedPassword = await _bcrypt.hash(dto.password, _config.BCRYPT_SALT_ROUNDS);
-            const user = queryRunner.manager.create(_userentity.User, {
+            const user = queryRunner.manager.create(_appuserentity.AppUser, {
                 name: dto.name,
                 email: dto.email,
                 phone: dto.phone,
@@ -308,7 +308,7 @@ let AuthenticationService = class AuthenticationService {
                 emailVerified: false,
                 phoneVerified: false
             });
-            await queryRunner.manager.save(_userentity.User, user);
+            await queryRunner.manager.save(_appuserentity.AppUser, user);
             if (this.userEnricher?.onUserCreated) {
                 await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
             }
@@ -342,7 +342,7 @@ let AuthenticationService = class AuthenticationService {
         await queryRunner.connect();
         await queryRunner.startTransaction();
         try {
-            const existingUser = await queryRunner.manager.findOne(_userentity.User, {
+            const existingUser = await queryRunner.manager.findOne(_appuserentity.AppUser, {
                 where: {
                     email: pending.email
                 }
@@ -353,7 +353,7 @@ let AuthenticationService = class AuthenticationService {
                     messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
                 });
             }
-            const user = queryRunner.manager.create(_userentity.User, {
+            const user = queryRunner.manager.create(_appuserentity.AppUser, {
                 name: pending.name,
                 email: pending.email,
                 phone: pending.phone,
@@ -362,7 +362,7 @@ let AuthenticationService = class AuthenticationService {
                 emailVerified: true,
                 phoneVerified: false
             });
-            await queryRunner.manager.save(_userentity.User, user);
+            await queryRunner.manager.save(_appuserentity.AppUser, user);
             if (this.userEnricher?.onUserCreated) {
                 await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
             }

package/cjs/services/user.service.js

@@ -17,8 +17,8 @@ const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _config = require("../config");
 const _userdto = require("../dtos/user.dto");
+const _appuserentity = require("../entities/app-user.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-const _userentity = require("../entities/user.entity");
 const _enums = require("../enums");
 const _userenricherinterface = require("../interfaces/user-enricher.interface");
 const _authconfigservice = require("./auth-config.service");
@@ -93,7 +93,7 @@ function _ts_param(paramIndex, decorator) {
 }
 let UserService = class UserService extends _classes.RequestScopedApiService {
     resolveEntity() {
-        return _userentity.User;
+        return _appuserentity.AppUser;
     }
     getDataSourceProvider() {
         return this.dataSourceProvider;
@@ -200,24 +200,24 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
         return this.convertEntityToDto(entity);
     }
     convertRawToResponseDto(raw) {
-        const isActive = raw.user_companyIsActive !== undefined ? Boolean(raw.user_companyIsActive) : raw.user_is_active;
+        const isActive = raw.appuser_companyIsActive !== undefined ? Boolean(raw.appuser_companyIsActive) : raw.appuser_is_active;
         return {
-            id: raw.user_id,
-            name: raw.user_name,
-            phone: raw.user_phone,
-            email: raw.user_email,
-            profilePictureId: raw.user_profile_picture_id,
+            id: raw.appuser_id,
+            name: raw.appuser_name,
+            phone: raw.appuser_phone,
+            email: raw.appuser_email,
+            profilePictureId: raw.appuser_profile_picture_id,
             isActive,
-            emailVerified: raw.user_email_verified,
-            phoneVerified: raw.user_phone_verified,
-            lastLoginAt: raw.user_last_login_at,
-            additionalFields: raw.user_additional_fields,
-            createdAt: raw.user_created_at,
-            updatedAt: raw.user_updated_at,
-            deletedAt: raw.user_deleted_at,
-            createdById: raw.user_created_by_id,
-            updatedById: raw.user_updated_by_id,
-            deletedById: raw.user_deleted_by_id
+            emailVerified: raw.appuser_email_verified,
+            phoneVerified: raw.appuser_phone_verified,
+            lastLoginAt: raw.appuser_last_login_at,
+            additionalFields: raw.appuser_additional_fields,
+            createdAt: raw.appuser_created_at,
+            updatedAt: raw.appuser_updated_at,
+            deletedAt: raw.appuser_deleted_at,
+            createdById: raw.appuser_created_by_id,
+            updatedById: raw.appuser_updated_by_id,
+            deletedById: raw.appuser_deleted_by_id
         };
     }
     convertEntityToDto(entity) {
@@ -243,8 +243,22 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
     convertEntityListToResponseListDto(entities, isRaw) {
         return entities.map((entity)=>this.convertEntityToResponseDto(entity, isRaw));
     }
+    async getFilterQuery(query, filter, _user) {
+        for (const [key, value] of Object.entries(filter)){
+            if (key === 'actionCode' || key === 'isActive') {
+                continue; // real continue
+            }
+            query.andWhere(`${this.entityName}.${key} = :value`, {
+                value
+            });
+        }
+        return {
+            query,
+            isRaw: false
+        };
+    }
     async getGlobalSearchQuery(query, search, _user) {
-        query.andWhere('("user".name LIKE :search OR "user".email LIKE :search OR "user".phone LIKE :search)', {
+        query.andWhere('(appuser.name LIKE :search OR appuser.email LIKE :search OR appuser.phone LIKE :search)', {
             search: `%${search}%`
         });
         return {
@@ -253,50 +267,99 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
         };
     }
     async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
-        let result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
-        if (this.userEnricher?.enrichListQuery) {
-            await this.userEnricher.enrichListQuery(query, user);
-        }
+        const superQuery = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
-        if (!isCompanyFeatureEnabled) {
-            return result;
-        }
-        if (user?.companyId && this.permissionRepository) {
-            query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
-          WHERE perm.user_id = "user".id
-          AND perm.permission_type = :permissionType
-          AND perm.target_id = :companyId
-          LIMIT 1)`, 'user_companyIsActive');
-            query.setParameter('permissionType', _enums.PermissionType.COMPANY);
-            query.setParameter('companyId', user.companyId);
-            if (filterAndPaginationDto.filter?.isActive !== undefined) {
+        const filter = filterAndPaginationDto?.filter;
+        // --- Action code filter (applies regardless of company feature) ---
+        if (filter?.actionCode) {
+            const actionCode = filter.actionCode;
+            const companyId = isCompanyFeatureEnabled ? user?.companyId : undefined;
+            if (isCompanyFeatureEnabled && !companyId) {
+                // Company feature is on but no companyId — no results should match
+                query.andWhere('1 = 0');
+                return {
+                    query,
+                    isRaw: true
+                };
+            }
+            const isPermissionModeFound = this.authConfig.isPermissionModeFound();
+            if (!isPermissionModeFound) {
+                // Optionally log a warning so the caller knows the filter was ignored
+                this.logAdapter.warn(`actionCode filter was requested but permission mode is not set to 'found' — filter ignored`);
+            } else {
                 query.andWhere(`EXISTS (
-            SELECT 1 FROM user_company_permissions perm
-            WHERE perm.user_id = "user".id
-            AND perm.permission_type = :permissionType
-            AND perm.target_id = :companyId
-            AND perm.is_active = :isActiveValue
-          )`, {
-                    permissionType: _enums.PermissionType.COMPANY,
-                    companyId: user.companyId,
-                    isActiveValue: filterAndPaginationDto.filter.isActive
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_role'
+          AND perm.source_id = appuser.id
+          AND perm.target_id IN (
+            SELECT source_id FROM user_iam_permission
+            WHERE permission_type = 'role_action'
+              AND target_id = (SELECT id FROM action WHERE code = :actionCode)
+              ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+          )
+      ) OR EXISTS (
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_action'
+          AND perm.source_id = appuser.id
+          AND perm.target_id = (SELECT id FROM action WHERE code = :actionCode)
+          ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+      )`, {
+                    actionCode,
+                    ...isCompanyFeatureEnabled && {
+                        actionCompanyId: companyId
+                    }
+                });
+            }
+        }
+        // --- Non-company path ---
+        if (!isCompanyFeatureEnabled) {
+            if (filter?.isActive !== undefined) {
+                query.andWhere(`${this.entityName}.isActive = :value`, {
+                    value: filter.isActive
                 });
             }
+            return superQuery;
+        }
+        // --- Company feature path ---
+        if (!user?.companyId || !this.permissionRepository) {
+            return superQuery;
+        }
+        // Add companyIsActive as a selected column
+        query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+      LIMIT 1)`, 'user_companyIsActive');
+        query.setParameter('permissionType', _enums.PermissionType.COMPANY);
+        query.setParameter('companyId', user.companyId);
+        // Filter by isActive within the company if requested
+        if (filter?.isActive !== undefined) {
             query.andWhere(`EXISTS (
-          SELECT 1 FROM user_company_permissions perm
-          WHERE perm.user_id = "user".id
+        SELECT 1 FROM user_company_permissions perm
+        WHERE perm.user_id = appuser.id
           AND perm.permission_type = :permissionType
           AND perm.target_id = :companyId
-        )`, {
+          AND perm.is_active = :isActiveValue
+      )`, {
                 permissionType: _enums.PermissionType.COMPANY,
-                companyId: user.companyId
+                companyId: user.companyId,
+                isActiveValue: filter.isActive
             });
-            return {
-                query,
-                isRaw: true
-            };
         }
-        return result;
+        // Always restrict to users belonging to this company
+        query.andWhere(`EXISTS (
+      SELECT 1 FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+    )`, {
+            permissionType: _enums.PermissionType.COMPANY,
+            companyId: user.companyId
+        });
+        return {
+            query,
+            isRaw: true
+        };
     }
     async insert(dto, user) {
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
@@ -496,7 +559,7 @@ let UserService = class UserService extends _classes.RequestScopedApiService {
         }
     }
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig, userEnricher){
-        super('user', null, cacheManager, utilsService, UserService.name, true, 'auth'), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher;
+        super('appuser', null, cacheManager, utilsService, UserService.name, true, 'auth'), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), _define_property(this, "logAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher, this.logAdapter = (0, _classes.createModuleLogger)(this.constructor.name);
     }
 };
 _ts_decorate([

package/cjs/strategies/jwt.strategy.js

@@ -14,7 +14,7 @@ const _core = require("@nestjs/core");
 const _passport = require("@nestjs/passport");
 const _passportjwt = require("passport-jwt");
 const _config = require("../config");
-const _userentity = require("../entities/user.entity");
+const _appuserentity = require("../entities/app-user.entity");
 const _authconfigservice = require("../services/auth-config.service");
 const _authdatasourceprovider = require("../services/auth-datasource.provider");
 const _authenticationservice = require("../services/authentication.service");
@@ -67,7 +67,7 @@ let JwtStrategy = class JwtStrategy extends (0, _passport.PassportStrategy)(_pas
                 strict: false
             });
             if (provider) {
-                return provider.getRepository(_userentity.User);
+                return provider.getRepository(_appuserentity.AppUser);
             }
         } catch  {
             throw new _common.UnauthorizedException({

package/entities/{user.entity.d.ts → app-user.entity.d.ts}

@@ -1,3 +1,3 @@
 import { UserRoot } from '@flusys/nestjs-shared';
-export declare class User extends UserRoot {
+export declare class AppUser extends UserRoot {
 }

package/entities/index.d.ts

@@ -1,20 +1,20 @@
+export * from './app-user.entity';
 export * from './company-branch.entity';
 export * from './company.entity';
 export * from './pending-registration.entity';
 export { PermissionType, UserCompanyPermission } from './user-company-permission.entity';
-export * from './user.entity';
 export * from './user-token.entity';
+import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
 import { PendingRegistration } from './pending-registration.entity';
 import { UserCompanyPermission } from './user-company-permission.entity';
-import { User } from './user.entity';
 import { UserToken } from './user-token.entity';
-declare const BaseEntities: (typeof User | typeof UserToken)[];
+declare const BaseEntities: (typeof AppUser | typeof UserToken)[];
 declare const EmailEntities: (typeof PendingRegistration)[];
 declare const CompanyEntities: (typeof Company | typeof CompanyBranch | typeof UserCompanyPermission)[];
 export interface IAuthEntitiesConfig {
     enableCompanyFeature?: boolean;
     enableEmailVerification?: boolean;
 }
-export declare function getEntitiesByConfig(config: IAuthEntitiesConfig): (typeof BaseEntities[number] | typeof EmailEntities[number] | typeof CompanyEntities[number])[];
+export declare function getEntitiesByConfig(config: IAuthEntitiesConfig): ((typeof BaseEntities)[number] | (typeof EmailEntities)[number] | (typeof CompanyEntities)[number])[];

package/entities/user-company-permission.entity.d.ts

@@ -1,12 +1,12 @@
 import { PermissionType } from '../enums';
+import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
-import { User } from './user.entity';
 export { PermissionType };
 export declare class UserCompanyPermission {
     id: string;
     userId: string;
-    user?: User;
+    user?: AppUser;
     permissionType: string;
     targetId: string;
     isActive: boolean;