@flusys/nestjs-auth 5.0.1 → 5.0.4

package/fesm/controllers/user-permission.controller.js

@@ -25,10 +25,10 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { JwtAuthGuard, RequirePermission, USER_PERMISSIONS } from '@flusys/nestjs-shared';
-import { USER_PERMISSION_MESSAGES } from '../config';
+import { JwtAuthGuard, PermissionGuard, RequirePermission, USER_PERMISSIONS } from '@flusys/nestjs-shared';
 import { Body, Controller, Inject, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
+import { USER_PERMISSION_MESSAGES } from '../config';
 import { AssignUserBranchDto, AssignUserCompanyDto, UserBranchesResponseDto, UserCompaniesResponseDto } from '../dtos/user-permission.dto';
 import { PermissionType } from '../entities/user-company-permission.entity';
 import { UserPermissionService } from '../services/user-permission.service';
@@ -204,7 +204,7 @@ UserPermissionController = _ts_decorate([
     ApiTags('User Permissions'),
     ApiBearerAuth(),
     Controller('administration/permissions'),
-    UseGuards(JwtAuthGuard),
+    UseGuards(JwtAuthGuard, PermissionGuard),
     _ts_param(0, Inject(UserPermissionService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [

package/fesm/controllers/user.controller.js

@@ -26,12 +26,12 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { createApiController, USER_PERMISSIONS } from '@flusys/nestjs-shared/classes';
-import { USER_MESSAGES } from '../config';
 import { CurrentUser, RequirePermission } from '@flusys/nestjs-shared/decorators';
-import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
+import { JwtAuthGuard, PermissionGuard } from '@flusys/nestjs-shared/guards';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { Body, Controller, Inject, Param, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiParam, ApiTags } from '@nestjs/swagger';
+import { USER_MESSAGES } from '../config';
 import { CreateUserDto, UpdateUserDto, UserResponseDto } from '../dtos/user.dto';
 import { UserService } from '../services/user.service';
 export class UserController extends createApiController(CreateUserDto, UpdateUserDto, UserResponseDto, {
@@ -166,7 +166,7 @@ export class UserController extends createApiController(CreateUserDto, UpdateUse
 }
 _ts_decorate([
     Post(':id/profile-extras'),
-    UseGuards(JwtAuthGuard),
+    UseGuards(JwtAuthGuard, PermissionGuard),
     ApiBearerAuth(),
     RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
@@ -188,7 +188,7 @@ _ts_decorate([
 ], UserController.prototype, "getProfileWithExtras", null);
 _ts_decorate([
     Post(':id/verify-email'),
-    UseGuards(JwtAuthGuard),
+    UseGuards(JwtAuthGuard, PermissionGuard),
     ApiBearerAuth(),
     RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
@@ -207,7 +207,7 @@ _ts_decorate([
 ], UserController.prototype, "verifyEmail", null);
 _ts_decorate([
     Post(':id/verify-phone'),
-    UseGuards(JwtAuthGuard),
+    UseGuards(JwtAuthGuard, PermissionGuard),
     ApiBearerAuth(),
     RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
@@ -226,7 +226,7 @@ _ts_decorate([
 ], UserController.prototype, "verifyPhone", null);
 _ts_decorate([
     Post(':id/status'),
-    UseGuards(JwtAuthGuard),
+    UseGuards(JwtAuthGuard, PermissionGuard),
     ApiBearerAuth(),
     RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
@@ -291,7 +291,6 @@ _ts_decorate([
     Post(':id/profile-section/:sectionId'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
-    RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
         summary: 'Get profile section data',
         description: 'Returns data for a specific profile section.'
@@ -319,7 +318,6 @@ _ts_decorate([
     Post(':id/profile-section/:sectionId/update'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
-    RequirePermission(USER_PERMISSIONS.UPDATE),
     ApiOperation({
         summary: 'Update profile section',
         description: 'Updates a specific profile section data.'
@@ -349,7 +347,6 @@ _ts_decorate([
     Post(':id/profile-completion'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
-    RequirePermission(USER_PERMISSIONS.READ),
     ApiOperation({
         summary: 'Get profile completion percentage',
         description: 'Returns overall profile completion percentage.'

package/fesm/entities/{user.entity.js → app-user.entity.js}

@@ -6,10 +6,10 @@ function _ts_decorate(decorators, target, key, desc) {
 }
 import { UserRoot } from '@flusys/nestjs-shared';
 import { Entity } from 'typeorm';
-export class User extends UserRoot {
+export class AppUser extends UserRoot {
 }
-User = _ts_decorate([
+AppUser = _ts_decorate([
     Entity({
-        name: 'user'
+        name: 'app_user'
     })
-], User);
+], AppUser);

package/fesm/entities/index.js

@@ -1,17 +1,17 @@
+export * from './app-user.entity';
 export * from './company-branch.entity';
 export * from './company.entity';
 export * from './pending-registration.entity';
 export { PermissionType, UserCompanyPermission } from './user-company-permission.entity';
-export * from './user.entity';
 export * from './user-token.entity';
+import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
 import { PendingRegistration } from './pending-registration.entity';
 import { UserCompanyPermission } from './user-company-permission.entity';
-import { User } from './user.entity';
 import { UserToken } from './user-token.entity';
 const BaseEntities = [
-    User,
+    AppUser,
     UserToken
 ];
 const EmailEntities = [

package/fesm/entities/user-company-permission.entity.js

@@ -22,9 +22,9 @@ function _ts_metadata(k, v) {
 }
 import { Column, CreateDateColumn, Entity, Index, JoinColumn, ManyToOne, PrimaryGeneratedColumn, UpdateDateColumn } from 'typeorm';
 import { PermissionType } from '../enums';
+import { AppUser } from './app-user.entity';
 import { CompanyBranch } from './company-branch.entity';
 import { Company } from './company.entity';
-import { User } from './user.entity';
 export { PermissionType };
 export class UserCompanyPermission {
     constructor(){
@@ -52,13 +52,13 @@ _ts_decorate([
     _ts_metadata("design:type", String)
 ], UserCompanyPermission.prototype, "userId", void 0);
 _ts_decorate([
-    ManyToOne(()=>User, {
+    ManyToOne(()=>AppUser, {
         onDelete: 'CASCADE'
     }),
     JoinColumn({
         name: 'user_id'
     }),
-    _ts_metadata("design:type", typeof User === "undefined" ? Object : User)
+    _ts_metadata("design:type", typeof AppUser === "undefined" ? Object : AppUser)
 ], UserCompanyPermission.prototype, "user", void 0);
 _ts_decorate([
     Column({

package/fesm/services/auth-config.service.js

@@ -45,6 +45,9 @@ export class AuthConfigService {
     isEmailVerificationEnabled() {
         return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
+    isPermissionModeFound() {
+        return this.options.bootstrapAppConfig?.permissionMode !== undefined;
+    }
     // JWT Configuration
     getJwtSecret() {
         if (!this.config.jwtSecret) {

package/fesm/services/auth-email.service.js

@@ -31,9 +31,9 @@ import { BadRequestException, Inject, Injectable, InternalServerErrorException,
 import * as bcrypt from 'bcrypt';
 import * as crypto from 'crypto';
 import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, USER_MESSAGES } from '../config';
+import { AppUser } from '../entities/app-user.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { TokenType, UserToken } from '../entities/user-token.entity';
-import { User } from '../entities/user.entity';
 import { AUTH_EMAIL_PROVIDER, IAuthEmailProvider } from '../interfaces';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class AuthEmailService {
@@ -102,7 +102,7 @@ export class AuthEmailService {
     }
     async createPendingRegistration(data) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const pendingRepository = await this.getRepository(PendingRegistration);
         // Check if user already exists
         const existingUser = await userRepository.findOne({
@@ -147,7 +147,7 @@ export class AuthEmailService {
     }
     async forgotPassword(email, resetUrlBase) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const tokenRepository = await this.getRepository(UserToken);
         const user = await userRepository.findOne({
             where: {
@@ -198,7 +198,7 @@ export class AuthEmailService {
         };
     }
     async resetPassword(token, newPassword) {
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const tokenRepository = await this.getRepository(UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
@@ -240,7 +240,7 @@ export class AuthEmailService {
     }
     async verifyEmail(token) {
         const pendingRepository = await this.getRepository(PendingRegistration);
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const tokenRepository = await this.getRepository(UserToken);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
@@ -324,7 +324,7 @@ export class AuthEmailService {
     async resendVerificationEmail(email, verifyUrlBase) {
         this.assertEmailEnabled();
         const pendingRepository = await this.getRepository(PendingRegistration);
-        const userRepository = await this.getRepository(User);
+        const userRepository = await this.getRepository(AppUser);
         const tokenRepository = await this.getRepository(UserToken);
         // Check pending registration first
         const pending = await pendingRepository.findOne({

package/fesm/services/authentication.service.js

@@ -36,11 +36,11 @@ import { JwtService } from '@nestjs/jwt';
 import * as bcrypt from 'bcrypt';
 import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, TOKEN_REVOKED_PREFIX, USER_ENRICHER, USER_MESSAGES } from '../config';
 import { RegistrationDto } from '../dtos/authentication.dto';
+import { AppUser } from '../entities/app-user.entity';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
-import { User } from '../entities/user.entity';
 import { PermissionType } from '../enums';
 import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { AuthConfigService } from './auth-config.service';
@@ -62,11 +62,11 @@ export class AuthenticationService {
                 message: 'User repository not available',
                 messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
                 messageVariables: {
-                    entity: 'User'
+                    entity: 'AppUser'
                 }
             });
         }
-        return this.dataSourceProvider.getRepository(User);
+        return this.dataSourceProvider.getRepository(AppUser);
     }
     async getPermissionRepository() {
         if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
@@ -248,7 +248,7 @@ export class AuthenticationService {
         await queryRunner.startTransaction();
         try {
             const hashedPassword = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
-            const user = queryRunner.manager.create(User, {
+            const user = queryRunner.manager.create(AppUser, {
                 name: dto.name,
                 email: dto.email,
                 phone: dto.phone,
@@ -257,7 +257,7 @@ export class AuthenticationService {
                 emailVerified: false,
                 phoneVerified: false
             });
-            await queryRunner.manager.save(User, user);
+            await queryRunner.manager.save(AppUser, user);
             if (this.userEnricher?.onUserCreated) {
                 await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
             }
@@ -291,7 +291,7 @@ export class AuthenticationService {
         await queryRunner.connect();
         await queryRunner.startTransaction();
         try {
-            const existingUser = await queryRunner.manager.findOne(User, {
+            const existingUser = await queryRunner.manager.findOne(AppUser, {
                 where: {
                     email: pending.email
                 }
@@ -302,7 +302,7 @@ export class AuthenticationService {
                     messageKey: AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
                 });
             }
-            const user = queryRunner.manager.create(User, {
+            const user = queryRunner.manager.create(AppUser, {
                 name: pending.name,
                 email: pending.email,
                 phone: pending.phone,
@@ -311,7 +311,7 @@ export class AuthenticationService {
                 emailVerified: true,
                 phoneVerified: false
             });
-            await queryRunner.manager.save(User, user);
+            await queryRunner.manager.save(AppUser, user);
             if (this.userEnricher?.onUserCreated) {
                 await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
             }

package/fesm/services/branch.service.js

@@ -25,7 +25,7 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { applyCompanyFilter } from '@flusys/nestjs-shared/utils';
 import { Inject, Injectable, Scope } from '@nestjs/common';

package/fesm/services/company.service.js

@@ -25,7 +25,7 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { Inject, Injectable, Scope } from '@nestjs/common';
 import { Company } from '../entities/company.entity';

package/fesm/services/user.service.js

@@ -26,7 +26,7 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
-import { HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
+import { createModuleLogger, HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
 import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
@@ -34,15 +34,15 @@ import { BadRequestException, ForbiddenException, Inject, Injectable, NotFoundEx
 import * as bcrypt from 'bcrypt';
 import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, USER_ENRICHER, USER_MESSAGES, USER_PERMISSION_MESSAGES } from '../config';
 import { CreateUserDto } from '../dtos/user.dto';
+import { AppUser } from '../entities/app-user.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
-import { User } from '../entities/user.entity';
 import { PermissionType } from '../enums';
 import { IUserEnricher } from '../interfaces/user-enricher.interface';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class UserService extends RequestScopedApiService {
     resolveEntity() {
-        return User;
+        return AppUser;
     }
     getDataSourceProvider() {
         return this.dataSourceProvider;
@@ -149,24 +149,24 @@ export class UserService extends RequestScopedApiService {
         return this.convertEntityToDto(entity);
     }
     convertRawToResponseDto(raw) {
-        const isActive = raw.user_companyIsActive !== undefined ? Boolean(raw.user_companyIsActive) : raw.user_is_active;
+        const isActive = raw.appuser_companyIsActive !== undefined ? Boolean(raw.appuser_companyIsActive) : raw.appuser_is_active;
         return {
-            id: raw.user_id,
-            name: raw.user_name,
-            phone: raw.user_phone,
-            email: raw.user_email,
-            profilePictureId: raw.user_profile_picture_id,
+            id: raw.appuser_id,
+            name: raw.appuser_name,
+            phone: raw.appuser_phone,
+            email: raw.appuser_email,
+            profilePictureId: raw.appuser_profile_picture_id,
             isActive,
-            emailVerified: raw.user_email_verified,
-            phoneVerified: raw.user_phone_verified,
-            lastLoginAt: raw.user_last_login_at,
-            additionalFields: raw.user_additional_fields,
-            createdAt: raw.user_created_at,
-            updatedAt: raw.user_updated_at,
-            deletedAt: raw.user_deleted_at,
-            createdById: raw.user_created_by_id,
-            updatedById: raw.user_updated_by_id,
-            deletedById: raw.user_deleted_by_id
+            emailVerified: raw.appuser_email_verified,
+            phoneVerified: raw.appuser_phone_verified,
+            lastLoginAt: raw.appuser_last_login_at,
+            additionalFields: raw.appuser_additional_fields,
+            createdAt: raw.appuser_created_at,
+            updatedAt: raw.appuser_updated_at,
+            deletedAt: raw.appuser_deleted_at,
+            createdById: raw.appuser_created_by_id,
+            updatedById: raw.appuser_updated_by_id,
+            deletedById: raw.appuser_deleted_by_id
         };
     }
     convertEntityToDto(entity) {
@@ -192,8 +192,22 @@ export class UserService extends RequestScopedApiService {
     convertEntityListToResponseListDto(entities, isRaw) {
         return entities.map((entity)=>this.convertEntityToResponseDto(entity, isRaw));
     }
+    async getFilterQuery(query, filter, _user) {
+        for (const [key, value] of Object.entries(filter)){
+            if (key === 'actionCode' || key === 'isActive') {
+                continue; // real continue
+            }
+            query.andWhere(`${this.entityName}.${key} = :value`, {
+                value
+            });
+        }
+        return {
+            query,
+            isRaw: false
+        };
+    }
     async getGlobalSearchQuery(query, search, _user) {
-        query.andWhere('("user".name LIKE :search OR "user".email LIKE :search OR "user".phone LIKE :search)', {
+        query.andWhere('(appuser.name LIKE :search OR appuser.email LIKE :search OR appuser.phone LIKE :search)', {
             search: `%${search}%`
         });
         return {
@@ -202,50 +216,99 @@ export class UserService extends RequestScopedApiService {
         };
     }
     async getExtraManipulateQuery(query, filterAndPaginationDto, user) {
-        let result = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
-        if (this.userEnricher?.enrichListQuery) {
-            await this.userEnricher.enrichListQuery(query, user);
-        }
+        const superQuery = await super.getExtraManipulateQuery(query, filterAndPaginationDto, user);
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
-        if (!isCompanyFeatureEnabled) {
-            return result;
-        }
-        if (user?.companyId && this.permissionRepository) {
-            query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
-          WHERE perm.user_id = "user".id
-          AND perm.permission_type = :permissionType
-          AND perm.target_id = :companyId
-          LIMIT 1)`, 'user_companyIsActive');
-            query.setParameter('permissionType', PermissionType.COMPANY);
-            query.setParameter('companyId', user.companyId);
-            if (filterAndPaginationDto.filter?.isActive !== undefined) {
+        const filter = filterAndPaginationDto?.filter;
+        // --- Action code filter (applies regardless of company feature) ---
+        if (filter?.actionCode) {
+            const actionCode = filter.actionCode;
+            const companyId = isCompanyFeatureEnabled ? user?.companyId : undefined;
+            if (isCompanyFeatureEnabled && !companyId) {
+                // Company feature is on but no companyId — no results should match
+                query.andWhere('1 = 0');
+                return {
+                    query,
+                    isRaw: true
+                };
+            }
+            const isPermissionModeFound = this.authConfig.isPermissionModeFound();
+            if (!isPermissionModeFound) {
+                // Optionally log a warning so the caller knows the filter was ignored
+                this.logAdapter.warn(`actionCode filter was requested but permission mode is not set to 'found' — filter ignored`);
+            } else {
                 query.andWhere(`EXISTS (
-            SELECT 1 FROM user_company_permissions perm
-            WHERE perm.user_id = "user".id
-            AND perm.permission_type = :permissionType
-            AND perm.target_id = :companyId
-            AND perm.is_active = :isActiveValue
-          )`, {
-                    permissionType: PermissionType.COMPANY,
-                    companyId: user.companyId,
-                    isActiveValue: filterAndPaginationDto.filter.isActive
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_role'
+          AND perm.source_id = appuser.id
+          AND perm.target_id IN (
+            SELECT source_id FROM user_iam_permission
+            WHERE permission_type = 'role_action'
+              AND target_id = (SELECT id FROM action WHERE code = :actionCode)
+              ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+          )
+      ) OR EXISTS (
+        SELECT 1 FROM user_iam_permission perm
+        WHERE perm.permission_type = 'user_action'
+          AND perm.source_id = appuser.id
+          AND perm.target_id = (SELECT id FROM action WHERE code = :actionCode)
+          ${isCompanyFeatureEnabled ? 'AND company_id = :actionCompanyId' : ''}
+      )`, {
+                    actionCode,
+                    ...isCompanyFeatureEnabled && {
+                        actionCompanyId: companyId
+                    }
+                });
+            }
+        }
+        // --- Non-company path ---
+        if (!isCompanyFeatureEnabled) {
+            if (filter?.isActive !== undefined) {
+                query.andWhere(`${this.entityName}.isActive = :value`, {
+                    value: filter.isActive
                 });
             }
+            return superQuery;
+        }
+        // --- Company feature path ---
+        if (!user?.companyId || !this.permissionRepository) {
+            return superQuery;
+        }
+        // Add companyIsActive as a selected column
+        query.addSelect(`(SELECT perm.is_active FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+      LIMIT 1)`, 'user_companyIsActive');
+        query.setParameter('permissionType', PermissionType.COMPANY);
+        query.setParameter('companyId', user.companyId);
+        // Filter by isActive within the company if requested
+        if (filter?.isActive !== undefined) {
             query.andWhere(`EXISTS (
-          SELECT 1 FROM user_company_permissions perm
-          WHERE perm.user_id = "user".id
+        SELECT 1 FROM user_company_permissions perm
+        WHERE perm.user_id = appuser.id
           AND perm.permission_type = :permissionType
           AND perm.target_id = :companyId
-        )`, {
+          AND perm.is_active = :isActiveValue
+      )`, {
                 permissionType: PermissionType.COMPANY,
-                companyId: user.companyId
+                companyId: user.companyId,
+                isActiveValue: filter.isActive
             });
-            return {
-                query,
-                isRaw: true
-            };
         }
-        return result;
+        // Always restrict to users belonging to this company
+        query.andWhere(`EXISTS (
+      SELECT 1 FROM user_company_permissions perm
+      WHERE perm.user_id = appuser.id
+        AND perm.permission_type = :permissionType
+        AND perm.target_id = :companyId
+    )`, {
+            permissionType: PermissionType.COMPANY,
+            companyId: user.companyId
+        });
+        return {
+            query,
+            isRaw: true
+        };
     }
     async insert(dto, user) {
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
@@ -445,7 +508,7 @@ export class UserService extends RequestScopedApiService {
         }
     }
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig, userEnricher){
-        super('user', null, cacheManager, utilsService, UserService.name, true, 'auth'), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher;
+        super('appuser', null, cacheManager, utilsService, UserService.name, true, 'auth'), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "userEnricher", void 0), _define_property(this, "permissionRepository", void 0), _define_property(this, "dataSource", void 0), _define_property(this, "logAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.dataSourceProvider = dataSourceProvider, this.authConfig = authConfig, this.userEnricher = userEnricher, this.logAdapter = createModuleLogger(this.constructor.name);
     }
 }
 _ts_decorate([

package/fesm/strategies/jwt.strategy.js

@@ -26,7 +26,7 @@ import { ModuleRef } from '@nestjs/core';
 import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
 import { AUTH_MESSAGES, USER_MESSAGES } from '../config';
-import { User } from '../entities/user.entity';
+import { AppUser } from '../entities/app-user.entity';
 import { AuthConfigService } from '../services/auth-config.service';
 import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
 import { AuthenticationService } from '../services/authentication.service';
@@ -57,7 +57,7 @@ export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
                 strict: false
             });
             if (provider) {
-                return provider.getRepository(User);
+                return provider.getRepository(AppUser);
             }
         } catch  {
             throw new UnauthorizedException({

package/interfaces/user-enricher.interface.d.ts

@@ -1,6 +1,5 @@
 import { ILoggedUserInfo, IPermissionLogic } from '@flusys/nestjs-shared/interfaces';
-import { QueryRunner, SelectQueryBuilder } from 'typeorm';
-import { User } from '../entities/user.entity';
+import { QueryRunner } from 'typeorm';
 import { IUser } from './user.interface';
 export interface IProfileSection {
     id: string;
@@ -43,9 +42,6 @@ export interface IProfileAction {
 }
 export type IEnrichedUser = IUser & IProfileExtras;
 export interface IUserEnricher {
-    enrichListQuery?(query: SelectQueryBuilder<User>, user: ILoggedUserInfo | null): Promise<{
-        extraFields: string[];
-    }>;
     enrichListItems?(users: IUser[], user: ILoggedUserInfo | null): Promise<IEnrichedUser[]>;
     getProfileExtras?(userId: string, user: ILoggedUserInfo): Promise<IProfileExtras>;
     updateProfileExtras?(userId: string, extras: Record<string, any>, queryRunner: QueryRunner): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "5.0.1",
+  "version": "5.0.4",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -93,7 +93,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "5.0.1",
-    "@flusys/nestjs-shared": "5.0.1"
+    "@flusys/nestjs-core": "5.0.4",
+    "@flusys/nestjs-shared": "5.0.4"
   }
 }

package/services/auth-config.service.d.ts

@@ -9,6 +9,7 @@ export declare class AuthConfigService implements IModuleConfigService {
     isMultiTenant(): boolean;
     isCompanyFeatureEnabled(): boolean;
     isEmailVerificationEnabled(): boolean;
+    isPermissionModeFound(): boolean;
     getJwtSecret(): string;
     getJwtExpiration(): string;
     getRefreshTokenSecret(): string;

package/services/branch.service.d.ts

@@ -1,14 +1,14 @@
-import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { HybridCache, RequestScopedApiService } from '@flusys/nestjs-shared/classes';
 import { FilterAndPaginationDto } from '@flusys/nestjs-shared/dtos';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { EntityTarget, Repository, SelectQueryBuilder } from 'typeorm';
+import { EntityTarget, SelectQueryBuilder } from 'typeorm';
 import { CreateCompanyBranchDto, UpdateCompanyBranchDto } from '../dtos/company-branch.dto';
-import { ICompanyBranch } from '../interfaces/company-branch.interface';
 import { CompanyBranch } from '../entities/company-branch.entity';
+import { ICompanyBranch } from '../interfaces/company-branch.interface';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
-export declare class BranchService extends RequestScopedApiService<CreateCompanyBranchDto, UpdateCompanyBranchDto, ICompanyBranch, CompanyBranch, Repository<CompanyBranch>> {
+export declare class BranchService extends RequestScopedApiService<CreateCompanyBranchDto, UpdateCompanyBranchDto, ICompanyBranch, CompanyBranch> {
     protected cacheManager: HybridCache;
     protected utilsService: UtilsService;
     private readonly dataSourceProvider;