@flusys/nestjs-auth 6.0.1 → 6.1.0

package/fesm/services/authentication.service.spec.js

@@ -0,0 +1,859 @@
+import { BadRequestException, ForbiddenException, NotFoundException, UnauthorizedException } from '@nestjs/common';
+import * as bcrypt from 'bcrypt';
+import { createMockRepository } from '@test-utils/mocks/repository.mock';
+import { AuthenticationService } from './authentication.service';
+import { AppUser } from '../entities/app-user.entity';
+import { Company } from '../entities/company.entity';
+import { CompanyBranch } from '../entities/company-branch.entity';
+import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
+jest.mock('bcrypt', ()=>({
+        hash: jest.fn().mockResolvedValue('hashed-password'),
+        compare: jest.fn().mockResolvedValue(true)
+    }));
+function buildUser(overrides = {}) {
+    return {
+        id: 'user-1',
+        email: 'user@example.com',
+        name: 'Test User',
+        phone: null,
+        password: 'hashed',
+        isActive: true,
+        emailVerified: true,
+        phoneVerified: false,
+        profilePictureId: null,
+        lastLoginAt: null,
+        additionalFields: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+function buildCompany(overrides = {}) {
+    return {
+        id: 'company-1',
+        name: 'Acme Corp',
+        slug: 'acme-corp',
+        logoId: null,
+        isActive: true,
+        readOnly: false,
+        address: null,
+        phone: null,
+        email: null,
+        website: null,
+        serial: null,
+        settings: null,
+        additionalFields: null,
+        branches: [],
+        ...overrides
+    };
+}
+function buildBranch(overrides = {}) {
+    return {
+        id: 'branch-1',
+        name: 'Main Branch',
+        slug: 'main-branch',
+        companyId: 'company-1',
+        logoId: null,
+        isActive: true,
+        readOnly: false,
+        address: null,
+        phone: null,
+        email: null,
+        serial: null,
+        additionalFields: null,
+        parentId: null,
+        parent: null,
+        children: [],
+        ...overrides
+    };
+}
+describe('AuthenticationService', ()=>{
+    let userRepo;
+    let companyRepo;
+    let branchRepo;
+    let permissionRepo;
+    let mockJwtService;
+    let mockAuthConfig;
+    let mockCacheManager;
+    let mockDataSourceProvider;
+    let mockSessionService;
+    let mockAuthEmailService;
+    let mockUserEnricher;
+    let companyFeatureEnabled;
+    let emailVerificationEnabled;
+    function buildService(overrides = {}) {
+        return new AuthenticationService(mockJwtService, mockAuthConfig, 'cacheManager' in overrides ? overrides.cacheManager : mockCacheManager, 'dataSourceProvider' in overrides ? overrides.dataSourceProvider : mockDataSourceProvider, 'sessionService' in overrides ? overrides.sessionService : mockSessionService, 'authEmailService' in overrides ? overrides.authEmailService : mockAuthEmailService, 'userEnricher' in overrides ? overrides.userEnricher : mockUserEnricher, 'notificationAdapter' in overrides ? overrides.notificationAdapter : undefined);
+    }
+    beforeEach(()=>{
+        jest.clearAllMocks();
+        bcrypt.compare.mockResolvedValue(true);
+        bcrypt.hash.mockResolvedValue('hashed-password');
+        userRepo = createMockRepository();
+        companyRepo = createMockRepository();
+        branchRepo = createMockRepository();
+        permissionRepo = createMockRepository();
+        Object.assign(branchRepo.createQueryBuilder(), {
+            leftJoinAndSelect: jest.fn().mockReturnThis()
+        });
+        companyFeatureEnabled = false;
+        emailVerificationEnabled = false;
+        mockJwtService = {
+            sign: jest.fn().mockReturnValue('signed-token'),
+            verify: jest.fn()
+        };
+        mockAuthConfig = {
+            isCompanyFeatureEnabled: jest.fn().mockImplementation(()=>companyFeatureEnabled),
+            isEmailVerificationEnabled: jest.fn().mockImplementation(()=>emailVerificationEnabled),
+            getJwtSecret: jest.fn().mockReturnValue('jwt-secret'),
+            getJwtExpiration: jest.fn().mockReturnValue('1h'),
+            getRefreshTokenSecret: jest.fn().mockReturnValue('refresh-secret'),
+            getRefreshTokenExpiration: jest.fn().mockReturnValue('7d')
+        };
+        mockCacheManager = {
+            get: jest.fn(),
+            set: jest.fn(),
+            del: jest.fn()
+        };
+        mockDataSourceProvider = {
+            isCompanyFeatureEnabled: jest.fn().mockImplementation(()=>companyFeatureEnabled),
+            isEmailVerificationEnabled: jest.fn().mockImplementation(()=>emailVerificationEnabled),
+            getRepository: jest.fn().mockImplementation(async (entity)=>{
+                if (entity === AppUser) return userRepo;
+                if (entity === Company) return companyRepo;
+                if (entity === CompanyBranch) return branchRepo;
+                if (entity === UserCompanyPermission) return permissionRepo;
+                throw new Error(`Unexpected entity: ${String(entity)}`);
+            }),
+            getDataSource: jest.fn()
+        };
+        mockSessionService = {
+            createSession: jest.fn().mockResolvedValue('session-1'),
+            consumeSession: jest.fn()
+        };
+        mockAuthEmailService = {
+            isEmailEnabled: jest.fn().mockReturnValue(true),
+            hasPendingRegistration: jest.fn().mockResolvedValue(false),
+            createPendingRegistration: jest.fn()
+        };
+        mockUserEnricher = {
+            onUserCreated: jest.fn()
+        };
+    });
+    describe('login', ()=>{
+        it('throws UnauthorizedException for a non-existent user (invalid credentials)', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.login('missing@example.com', 'password')).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the password does not match', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            bcrypt.compare.mockResolvedValue(false);
+            const service = buildService();
+            await expect(service.login('user@example.com', 'wrong-password')).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws ForbiddenException when the account is deactivated', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser({
+                isActive: false
+            }));
+            userRepo.save.mockResolvedValue(buildUser({
+                isActive: false
+            }));
+            const service = buildService();
+            await expect(service.login('user@example.com', 'password')).rejects.toThrow(ForbiddenException);
+        });
+        it('returns requiresEmailVerification when a pending registration exists for the email', async ()=>{
+            emailVerificationEnabled = true;
+            mockAuthEmailService.hasPendingRegistration.mockResolvedValue(true);
+            const service = buildService();
+            const result = await service.login('pending@example.com', 'password');
+            expect(result).toEqual(expect.objectContaining({
+                requiresEmailVerification: true,
+                email: 'pending@example.com'
+            }));
+            expect(userRepo.findOne).not.toHaveBeenCalled();
+        });
+        it('returns requiresEmailVerification when the user has not verified their email', async ()=>{
+            emailVerificationEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser({
+                emailVerified: false
+            }));
+            userRepo.save.mockResolvedValue(buildUser({
+                emailVerified: false
+            }));
+            const service = buildService();
+            const result = await service.login('user@example.com', 'password');
+            expect(result).toEqual(expect.objectContaining({
+                requiresEmailVerification: true
+            }));
+        });
+        it('logs in successfully without the company feature enabled', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            const service = buildService();
+            const result = await service.login('user@example.com', 'password');
+            expect(result).toEqual(expect.objectContaining({
+                accessToken: 'signed-token',
+                refreshToken: 'signed-token',
+                user: expect.objectContaining({
+                    id: 'user-1'
+                })
+            }));
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                lastLoginAt: expect.any(Date)
+            }));
+        });
+        it('auto-logs in with company/branch when the user has exactly one of each', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            permissionRepo.find.mockImplementation(async ({ where })=>{
+                if (where.permissionType === PermissionType.COMPANY) {
+                    return [
+                        {
+                            targetId: 'company-1'
+                        }
+                    ];
+                }
+                return [
+                    {
+                        targetId: 'branch-1'
+                    }
+                ];
+            });
+            companyRepo.createQueryBuilder().getMany.mockResolvedValue([
+                buildCompany()
+            ]);
+            branchRepo.createQueryBuilder().getMany.mockResolvedValue([
+                buildBranch()
+            ]);
+            const service = buildService();
+            const result = await service.login('user@example.com', 'password');
+            expect(result).toEqual(expect.objectContaining({
+                company: expect.objectContaining({
+                    id: 'company-1'
+                }),
+                branch: expect.objectContaining({
+                    id: 'branch-1'
+                })
+            }));
+        });
+        it('returns a company selection response when the user has multiple companies', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            permissionRepo.find.mockImplementation(async ({ where })=>{
+                if (where.permissionType === PermissionType.COMPANY) {
+                    return [
+                        {
+                            targetId: 'company-1'
+                        },
+                        {
+                            targetId: 'company-2'
+                        }
+                    ];
+                }
+                return [];
+            });
+            companyRepo.createQueryBuilder().getMany.mockResolvedValue([
+                buildCompany(),
+                buildCompany({
+                    id: 'company-2'
+                })
+            ]);
+            const service = buildService();
+            const result = await service.login('user@example.com', 'password');
+            expect(result).toEqual(expect.objectContaining({
+                requiresSelection: true,
+                sessionId: 'session-1'
+            }));
+            expect(mockSessionService.createSession).toHaveBeenCalledWith('user-1');
+        });
+        it('falls back to a plain login response when company feature is enabled but the user has no company', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            permissionRepo.find.mockResolvedValue([]);
+            const service = buildService();
+            const result = await service.login('user@example.com', 'password');
+            expect(result).toEqual(expect.objectContaining({
+                accessToken: 'signed-token'
+            }));
+            expect(result.company).toBeUndefined();
+        });
+    });
+    describe('register', ()=>{
+        it('throws BadRequestException when the email exists and company feature is disabled', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            const service = buildService();
+            await expect(service.register({
+                email: 'user@example.com',
+                name: 'Test',
+                password: 'Password1!'
+            })).rejects.toThrow(BadRequestException);
+        });
+        it('routes existing users to company registration when the company feature is enabled', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyRepo.findOne.mockResolvedValue(null);
+            companyRepo.createQueryBuilder().getMany.mockResolvedValue([]);
+            companyRepo.create.mockReturnValue(buildCompany());
+            companyRepo.save.mockResolvedValue(buildCompany());
+            branchRepo.create.mockReturnValue(buildBranch());
+            branchRepo.save.mockResolvedValue(buildBranch());
+            permissionRepo.save.mockResolvedValue({});
+            const service = buildService();
+            const result = await service.register({
+                email: 'user@example.com',
+                name: 'Test',
+                password: 'Password1!',
+                newCompanyName: 'New Co'
+            });
+            expect(result).toEqual(expect.objectContaining({
+                accessToken: expect.any(String)
+            }));
+        });
+        it('sends a verification email and returns requiresEmailVerification when email verification is enabled', async ()=>{
+            emailVerificationEnabled = true;
+            userRepo.findOne.mockResolvedValue(null);
+            mockAuthEmailService.createPendingRegistration.mockResolvedValue({
+                success: true,
+                message: 'sent',
+                messageKey: 'email.verification.sent'
+            });
+            const service = buildService();
+            const result = await service.register({
+                email: 'new@example.com',
+                name: 'New User',
+                password: 'Password1!'
+            }, 'https://app.test/verify');
+            expect(result).toEqual(expect.objectContaining({
+                requiresEmailVerification: true
+            }));
+            expect(mockAuthEmailService.createPendingRegistration).toHaveBeenCalled();
+        });
+        it('creates the user directly and hashes the password when email verification is not required', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            const queryRunner = {
+                connect: jest.fn(),
+                startTransaction: jest.fn(),
+                commitTransaction: jest.fn(),
+                rollbackTransaction: jest.fn(),
+                release: jest.fn(),
+                manager: {
+                    create: jest.fn().mockReturnValue(buildUser()),
+                    save: jest.fn().mockResolvedValue(buildUser())
+                }
+            };
+            mockDataSourceProvider.getDataSource.mockResolvedValue({
+                createQueryRunner: ()=>queryRunner
+            });
+            const service = buildService();
+            const result = await service.register({
+                email: 'new@example.com',
+                name: 'New User',
+                password: 'Password1!'
+            });
+            expect(bcrypt.hash).toHaveBeenCalledWith('Password1!', 12);
+            expect(queryRunner.commitTransaction).toHaveBeenCalled();
+            expect(result).toEqual(expect.objectContaining({
+                accessToken: expect.any(String)
+            }));
+        });
+        it('rolls back the transaction and rethrows a BadRequestException on failure', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            const queryRunner = {
+                connect: jest.fn(),
+                startTransaction: jest.fn(),
+                commitTransaction: jest.fn(),
+                rollbackTransaction: jest.fn(),
+                release: jest.fn(),
+                manager: {
+                    create: jest.fn().mockReturnValue(buildUser()),
+                    save: jest.fn().mockRejectedValue(new Error('db error'))
+                }
+            };
+            mockDataSourceProvider.getDataSource.mockResolvedValue({
+                createQueryRunner: ()=>queryRunner
+            });
+            const service = buildService();
+            await expect(service.register({
+                email: 'new@example.com',
+                name: 'New',
+                password: 'Password1!'
+            })).rejects.toThrow(BadRequestException);
+            expect(queryRunner.rollbackTransaction).toHaveBeenCalled();
+            expect(queryRunner.release).toHaveBeenCalled();
+        });
+    });
+    describe('refreshToken', ()=>{
+        it('throws UnauthorizedException when the token is malformed/invalid', async ()=>{
+            mockJwtService.verify.mockImplementation(()=>{
+                throw new Error('invalid signature');
+            });
+            const service = buildService();
+            await expect(service.refreshToken('bad-token')).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the token has been revoked', async ()=>{
+            mockJwtService.verify.mockReturnValue({
+                id: 'user-1',
+                iat: 1000
+            });
+            mockCacheManager.get.mockResolvedValue(2000);
+            const service = buildService();
+            await expect(service.refreshToken('revoked-token')).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the user no longer exists or is inactive', async ()=>{
+            mockJwtService.verify.mockReturnValue({
+                id: 'user-1',
+                iat: 1000
+            });
+            mockCacheManager.get.mockResolvedValue(undefined);
+            userRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.refreshToken('token')).rejects.toThrow(UnauthorizedException);
+        });
+        it('issues a new token pair for a valid non-company refresh token', async ()=>{
+            mockJwtService.verify.mockReturnValue({
+                id: 'user-1',
+                iat: 1000
+            });
+            mockCacheManager.get.mockResolvedValue(undefined);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            const service = buildService();
+            const result = await service.refreshToken('token');
+            expect(result).toEqual({
+                accessToken: 'signed-token',
+                refreshToken: 'signed-token'
+            });
+        });
+        it('throws UnauthorizedException when the company from the payload no longer exists', async ()=>{
+            mockJwtService.verify.mockReturnValue({
+                id: 'user-1',
+                iat: 1000,
+                companyId: 'company-1'
+            });
+            mockCacheManager.get.mockResolvedValue(undefined);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyFeatureEnabled = true;
+            companyRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.refreshToken('token')).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the user no longer has access to the payload company', async ()=>{
+            mockJwtService.verify.mockReturnValue({
+                id: 'user-1',
+                iat: 1000,
+                companyId: 'company-1'
+            });
+            mockCacheManager.get.mockResolvedValue(undefined);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyFeatureEnabled = true;
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            permissionRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.refreshToken('token')).rejects.toThrow(UnauthorizedException);
+        });
+        it('validates branch access when a branchId is present in the payload', async ()=>{
+            mockJwtService.verify.mockReturnValue({
+                id: 'user-1',
+                iat: 1000,
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            });
+            mockCacheManager.get.mockResolvedValue(undefined);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyFeatureEnabled = true;
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            permissionRepo.findOne.mockResolvedValue({});
+            branchRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.refreshToken('token')).rejects.toThrow(UnauthorizedException);
+        });
+        it('issues a new token pair when company and branch access is valid', async ()=>{
+            mockJwtService.verify.mockReturnValue({
+                id: 'user-1',
+                iat: 1000,
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            });
+            mockCacheManager.get.mockResolvedValue(undefined);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyFeatureEnabled = true;
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            permissionRepo.findOne.mockResolvedValue({});
+            branchRepo.findOne.mockResolvedValue(buildBranch());
+            const service = buildService();
+            const result = await service.refreshToken('token');
+            expect(result).toEqual({
+                accessToken: 'signed-token',
+                refreshToken: 'signed-token'
+            });
+        });
+    });
+    describe('changePassword', ()=>{
+        it('throws UnauthorizedException when the user does not exist', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.changePassword('user-1', 'old', 'NewPass1!')).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the current password is incorrect', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            bcrypt.compare.mockResolvedValue(false);
+            const service = buildService();
+            await expect(service.changePassword('user-1', 'wrong', 'NewPass1!')).rejects.toThrow(UnauthorizedException);
+        });
+        it('hashes and saves the new password on success', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            const service = buildService();
+            await service.changePassword('user-1', 'old', 'NewPass1!');
+            expect(bcrypt.hash).toHaveBeenCalledWith('NewPass1!', 12);
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                password: 'hashed-password'
+            }));
+        });
+    });
+    describe('logout', ()=>{
+        it('throws BadRequestException when the cache manager is unavailable', async ()=>{
+            const service = buildService({
+                cacheManager: undefined
+            });
+            await expect(service.logout('user-1')).rejects.toThrow(BadRequestException);
+        });
+        it('records the revocation timestamp in the cache', async ()=>{
+            const service = buildService();
+            await service.logout('user-1');
+            expect(mockCacheManager.set).toHaveBeenCalledWith('auth:revoked:user-1', expect.any(Number), expect.any(Number));
+        });
+    });
+    describe('isTokenRevoked', ()=>{
+        it('returns false when there is no cache manager', async ()=>{
+            const service = buildService({
+                cacheManager: undefined
+            });
+            expect(await service.isTokenRevoked('user-1', 1000)).toBe(false);
+        });
+        it('returns false when tokenIssuedAt is not provided', async ()=>{
+            const service = buildService();
+            expect(await service.isTokenRevoked('user-1')).toBe(false);
+        });
+        it('returns false when nothing has been revoked', async ()=>{
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const service = buildService();
+            expect(await service.isTokenRevoked('user-1', 1000)).toBe(false);
+        });
+        it('returns true when the token was issued before the revocation time', async ()=>{
+            mockCacheManager.get.mockResolvedValue(2000);
+            const service = buildService();
+            expect(await service.isTokenRevoked('user-1', 1000)).toBe(true);
+        });
+        it('returns false when the token was issued after the revocation time', async ()=>{
+            mockCacheManager.get.mockResolvedValue(500);
+            const service = buildService();
+            expect(await service.isTokenRevoked('user-1', 1000)).toBe(false);
+        });
+    });
+    describe('getUserCompanies / getUserBranches', ()=>{
+        it('throws BadRequestException when the company feature is disabled', async ()=>{
+            const service = buildService();
+            await expect(service.getUserCompanies('user-1')).rejects.toThrow(BadRequestException);
+        });
+        it('returns an empty array when the user has no company permissions', async ()=>{
+            companyFeatureEnabled = true;
+            permissionRepo.find.mockResolvedValue([]);
+            const service = buildService();
+            expect(await service.getUserCompanies('user-1')).toEqual([]);
+        });
+        it('returns companies the user has access to', async ()=>{
+            companyFeatureEnabled = true;
+            permissionRepo.find.mockResolvedValue([
+                {
+                    targetId: 'company-1'
+                }
+            ]);
+            companyRepo.createQueryBuilder().getMany.mockResolvedValue([
+                buildCompany()
+            ]);
+            const service = buildService();
+            const result = await service.getUserCompanies('user-1');
+            expect(result).toEqual([
+                buildCompany()
+            ]);
+        });
+        it('throws UnauthorizedException from getUserBranches when the user lacks company access', async ()=>{
+            companyFeatureEnabled = true;
+            permissionRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.getUserBranches('user-1', 'company-1')).rejects.toThrow(UnauthorizedException);
+        });
+        it('returns branches the user has access to within the company', async ()=>{
+            companyFeatureEnabled = true;
+            permissionRepo.findOne.mockResolvedValue({});
+            permissionRepo.find.mockResolvedValue([
+                {
+                    targetId: 'branch-1'
+                }
+            ]);
+            branchRepo.createQueryBuilder().getMany.mockResolvedValue([
+                buildBranch()
+            ]);
+            const service = buildService();
+            const result = await service.getUserBranches('user-1', 'company-1');
+            expect(result).toEqual([
+                buildBranch()
+            ]);
+        });
+    });
+    describe('getCompanyById / getBranchById', ()=>{
+        it('getCompanyById returns null when the company feature is disabled (scoped repo unavailable)', async ()=>{
+            companyFeatureEnabled = false;
+            const service = buildService();
+            expect(await service.getCompanyById('company-1')).toBeNull();
+            expect(companyRepo.findOne).not.toHaveBeenCalled();
+        });
+        it('getCompanyById returns the company by id when found', async ()=>{
+            companyFeatureEnabled = true;
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            const service = buildService();
+            const result = await service.getCompanyById('company-1');
+            expect(companyRepo.findOne).toHaveBeenCalledWith({
+                where: {
+                    id: 'company-1'
+                }
+            });
+            expect(result).toEqual(buildCompany());
+        });
+        it('getCompanyById returns null when no company matches', async ()=>{
+            companyFeatureEnabled = true;
+            companyRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            expect(await service.getCompanyById('missing')).toBeNull();
+        });
+        it('getBranchById returns null when the company feature is disabled (scoped repo unavailable)', async ()=>{
+            companyFeatureEnabled = false;
+            const service = buildService();
+            expect(await service.getBranchById('branch-1')).toBeNull();
+            expect(branchRepo.findOne).not.toHaveBeenCalled();
+        });
+        it('getBranchById returns the branch by id when found', async ()=>{
+            companyFeatureEnabled = true;
+            branchRepo.findOne.mockResolvedValue(buildBranch());
+            const service = buildService();
+            const result = await service.getBranchById('branch-1');
+            expect(branchRepo.findOne).toHaveBeenCalledWith({
+                where: {
+                    id: 'branch-1'
+                }
+            });
+            expect(result).toEqual(buildBranch());
+        });
+    });
+    describe('select', ()=>{
+        it('throws BadRequestException when the company feature is disabled', async ()=>{
+            const service = buildService();
+            await expect(service.select('session-1', 'company-1', 'branch-1')).rejects.toThrow(BadRequestException);
+        });
+        it('throws UnauthorizedException when the session is invalid or expired', async ()=>{
+            companyFeatureEnabled = true;
+            mockSessionService.consumeSession.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.select('bad-session', 'company-1', 'branch-1')).rejects.toThrow(UnauthorizedException);
+        });
+        it('logs in with the selected company/branch when the session is valid', async ()=>{
+            companyFeatureEnabled = true;
+            mockSessionService.consumeSession.mockResolvedValue({
+                sessionId: 'session-1',
+                userId: 'user-1',
+                createdAt: new Date(),
+                expiresAt: new Date()
+            });
+            userRepo.findOne.mockResolvedValue(buildUser());
+            permissionRepo.findOne.mockResolvedValue({});
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            branchRepo.findOne.mockResolvedValue(buildBranch());
+            const service = buildService();
+            const result = await service.select('session-1', 'company-1', 'branch-1');
+            expect(result).toEqual(expect.objectContaining({
+                accessToken: 'signed-token'
+            }));
+        });
+    });
+    describe('switchCompany / validateAndLoginWithCompany', ()=>{
+        it('throws NotFoundException when the user does not exist', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(NotFoundException);
+        });
+        it('throws ForbiddenException when the user has no access to the company', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            permissionRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(ForbiddenException);
+        });
+        it('throws NotFoundException when the company is inactive or missing', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            permissionRepo.findOne.mockResolvedValueOnce({}).mockResolvedValueOnce(null);
+            companyRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(NotFoundException);
+        });
+        it('throws ForbiddenException when the user has no access to the branch', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            permissionRepo.findOne.mockResolvedValueOnce({}).mockResolvedValueOnce(null);
+            const service = buildService();
+            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(ForbiddenException);
+        });
+        it('throws NotFoundException when the branch is inactive or missing', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            permissionRepo.findOne.mockResolvedValue({});
+            branchRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(NotFoundException);
+        });
+        it('returns a new login response when switching succeeds', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            permissionRepo.findOne.mockResolvedValue({});
+            branchRepo.findOne.mockResolvedValue(buildBranch());
+            const service = buildService();
+            const result = await service.switchCompany('user-1', 'company-1', 'branch-1');
+            expect(result).toEqual(expect.objectContaining({
+                accessToken: 'signed-token',
+                company: expect.objectContaining({
+                    id: 'company-1'
+                }),
+                branch: expect.objectContaining({
+                    id: 'branch-1'
+                })
+            }));
+        });
+    });
+    describe('getUserInfo', ()=>{
+        it('throws UnauthorizedException when the user does not exist', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.getUserInfo('user-1')).rejects.toThrow(UnauthorizedException);
+        });
+        it('returns only user info when the company feature is disabled', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            const service = buildService();
+            const result = await service.getUserInfo('user-1');
+            expect(result).toEqual({
+                user: expect.objectContaining({
+                    id: 'user-1'
+                })
+            });
+        });
+        it('throws UnauthorizedException when the company feature is enabled but no companyId is given', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            const service = buildService();
+            await expect(service.getUserInfo('user-1')).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the company cannot be found', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.getUserInfo('user-1', 'company-1')).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the branch cannot be found', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            branchRepo.findOne.mockResolvedValue(null);
+            const service = buildService();
+            await expect(service.getUserInfo('user-1', 'company-1', 'branch-1')).rejects.toThrow(UnauthorizedException);
+        });
+        it('returns user, company, and branch info when everything resolves', async ()=>{
+            companyFeatureEnabled = true;
+            userRepo.findOne.mockResolvedValue(buildUser());
+            companyRepo.findOne.mockResolvedValue(buildCompany());
+            branchRepo.findOne.mockResolvedValue(buildBranch());
+            const service = buildService();
+            const result = await service.getUserInfo('user-1', 'company-1', 'branch-1');
+            expect(result).toEqual({
+                user: expect.objectContaining({
+                    id: 'user-1'
+                }),
+                company: expect.objectContaining({
+                    id: 'company-1'
+                }),
+                branch: expect.objectContaining({
+                    id: 'branch-1'
+                })
+            });
+        });
+    });
+    describe('createUserFromPendingRegistration', ()=>{
+        it('throws BadRequestException when the email is already registered', async ()=>{
+            const queryRunner = {
+                connect: jest.fn(),
+                startTransaction: jest.fn(),
+                commitTransaction: jest.fn(),
+                rollbackTransaction: jest.fn(),
+                release: jest.fn(),
+                manager: {
+                    findOne: jest.fn().mockResolvedValue(buildUser()),
+                    create: jest.fn(),
+                    save: jest.fn()
+                }
+            };
+            mockDataSourceProvider.getDataSource.mockResolvedValue({
+                createQueryRunner: ()=>queryRunner
+            });
+            const service = buildService();
+            await expect(service.createUserFromPendingRegistration({
+                email: 'user@example.com',
+                name: 'Test',
+                passwordHash: 'hash'
+            })).rejects.toThrow(BadRequestException);
+            expect(queryRunner.rollbackTransaction).toHaveBeenCalled();
+        });
+        it('creates the user with the email marked as verified', async ()=>{
+            const queryRunner = {
+                connect: jest.fn(),
+                startTransaction: jest.fn(),
+                commitTransaction: jest.fn(),
+                rollbackTransaction: jest.fn(),
+                release: jest.fn(),
+                manager: {
+                    findOne: jest.fn().mockResolvedValue(null),
+                    create: jest.fn().mockReturnValue(buildUser({
+                        emailVerified: true
+                    })),
+                    save: jest.fn().mockResolvedValue(buildUser({
+                        emailVerified: true
+                    }))
+                }
+            };
+            mockDataSourceProvider.getDataSource.mockResolvedValue({
+                createQueryRunner: ()=>queryRunner
+            });
+            const service = buildService();
+            const result = await service.createUserFromPendingRegistration({
+                email: 'new@example.com',
+                name: 'New User',
+                passwordHash: 'hash'
+            });
+            expect(queryRunner.manager.create).toHaveBeenCalledWith(AppUser, expect.objectContaining({
+                emailVerified: true
+            }));
+            expect(result).toEqual(expect.objectContaining({
+                accessToken: expect.any(String)
+            }));
+        });
+    });
+});