@flusys/nestjs-auth 6.0.2 → 6.1.0

package/cjs/strategies/jwt.strategy.js

@@ -41,7 +41,7 @@ function _ts_metadata(k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 function hasCompanyContext(payload) {
-    return 'companyId' in payload && 'branchId' in payload;
+    return 'companyId' in payload && payload.companyId != null;
 }
 let JwtStrategy = class JwtStrategy extends (0, _passport.PassportStrategy)(_passportjwt.Strategy, 'jwt') {
     async validate(_req, payload) {

package/cjs/strategies/jwt.strategy.spec.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _common = require("@nestjs/common");
+const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _jwtstrategy = require("./jwt.strategy");
+const _authdatasourceprovider = require("../services/auth-datasource.provider");
+const _authenticationservice = require("../services/authentication.service");
+describe('JwtStrategy', ()=>{
+    let strategy;
+    let userRepo;
+    let mockAuthConfig;
+    let mockModuleRef;
+    let mockDataSourceProvider;
+    let mockAuthService;
+    beforeEach(()=>{
+        userRepo = (0, _repositorymock.createMockRepository)();
+        mockAuthConfig = {
+            getJwtSecret: jest.fn().mockReturnValue('jwt-secret')
+        };
+        mockDataSourceProvider = {
+            getRepository: jest.fn().mockResolvedValue(userRepo)
+        };
+        mockAuthService = {
+            isTokenRevoked: jest.fn().mockResolvedValue(false)
+        };
+        mockModuleRef = {
+            resolve: jest.fn().mockImplementation(async (token)=>{
+                if (token === _authdatasourceprovider.AuthDataSourceProvider) return mockDataSourceProvider;
+                if (token === _authenticationservice.AuthenticationService) return mockAuthService;
+                return null;
+            })
+        };
+        strategy = new _jwtstrategy.JwtStrategy(mockAuthConfig, mockModuleRef);
+    });
+    describe('validate', ()=>{
+        const req = {};
+        it('returns basic user info for a payload without company context', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            const result = await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            });
+            expect(result).toEqual({
+                id: 'user-1',
+                email: 'user@example.com'
+            });
+        });
+        it('includes companyId and branchId when present in the payload', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            const result = await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            });
+            expect(result).toEqual({
+                id: 'user-1',
+                email: 'user@example.com',
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            });
+        });
+        it('omits branchId when only companyId is present', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            const result = await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                companyId: 'company-1'
+            });
+            expect(result).toEqual({
+                id: 'user-1',
+                email: 'user@example.com',
+                companyId: 'company-1'
+            });
+        });
+        it('throws UnauthorizedException when the user is not found or inactive', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await expect(strategy.validate(req, {
+                id: 'missing-user',
+                email: 'x@example.com',
+                type: 'access'
+            })).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the token has been revoked', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            mockAuthService.isTokenRevoked.mockResolvedValue(true);
+            await expect(strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                iat: 1000
+            })).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('skips revocation check when the payload has no iat', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            });
+            expect(mockAuthService.isTokenRevoked).not.toHaveBeenCalled();
+        });
+        it('throws UnauthorizedException when the data source provider cannot be resolved', async ()=>{
+            mockModuleRef.resolve.mockImplementation(async (token)=>{
+                if (token === _authdatasourceprovider.AuthDataSourceProvider) return null;
+                return mockAuthService;
+            });
+            await expect(strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            })).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('propagates an UnauthorizedException raised while resolving the data source provider', async ()=>{
+            mockModuleRef.resolve.mockImplementation(async (token)=>{
+                if (token === _authdatasourceprovider.AuthDataSourceProvider) throw new Error('resolution failed');
+                return mockAuthService;
+            });
+            await expect(strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            })).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('does not fail validation when the authentication service cannot be resolved for revocation checks', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            mockModuleRef.resolve.mockImplementation(async (token)=>{
+                if (token === _authdatasourceprovider.AuthDataSourceProvider) return mockDataSourceProvider;
+                return null;
+            });
+            const result = await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                iat: 1000
+            });
+            expect(result).toEqual({
+                id: 'user-1',
+                email: 'user@example.com'
+            });
+        });
+    });
+});

package/cjs/validators/password.validator.spec.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _classvalidator = require("class-validator");
+const _passwordvalidator = require("./password.validator");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+let DefaultPasswordDto = class DefaultPasswordDto {
+    constructor(){
+        _define_property(this, "password", void 0);
+    }
+};
+_ts_decorate([
+    (0, _passwordvalidator.IsStrongPassword)(),
+    _ts_metadata("design:type", String)
+], DefaultPasswordDto.prototype, "password", void 0);
+let CustomPasswordDto = class CustomPasswordDto {
+    constructor(){
+        _define_property(this, "password", void 0);
+    }
+};
+_ts_decorate([
+    (0, _passwordvalidator.IsStrongPassword)({
+        minLength: 12,
+        requireSpecialChar: false
+    }),
+    _ts_metadata("design:type", String)
+], CustomPasswordDto.prototype, "password", void 0);
+let NoComplexityPasswordDto = class NoComplexityPasswordDto {
+    constructor(){
+        _define_property(this, "password", void 0);
+    }
+};
+_ts_decorate([
+    (0, _passwordvalidator.IsStrongPassword)({
+        requireUppercase: false,
+        requireLowercase: false,
+        requireNumber: false,
+        requireSpecialChar: false,
+        minLength: 4
+    }),
+    _ts_metadata("design:type", String)
+], NoComplexityPasswordDto.prototype, "password", void 0);
+async function validatePassword(dto) {
+    const errors = await (0, _classvalidator.validate)(dto);
+    return errors.length === 0;
+}
+describe('IsStrongPassword', ()=>{
+    describe('default options', ()=>{
+        it('accepts a password meeting all default complexity rules', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'StrongP@ss1';
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('rejects a password shorter than the minimum length', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'Sh0rt!';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('accepts a password at exactly the minimum length boundary', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'Ab1!Ab1!'; // 8 chars
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('rejects a password longer than the maximum length', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'A1!' + 'a'.repeat(127); // 130 chars total
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('accepts a password at exactly the maximum length boundary', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'A1!' + 'a'.repeat(125); // 128 chars total
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('rejects a password missing an uppercase letter', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'lowercase1!';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects a password missing a lowercase letter', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'UPPERCASE1!';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects a password missing a number', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'NoNumbers!';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects a password missing a special character', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'NoSpecial1';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects a non-string value', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 12345678;
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects an empty string', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = '';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('produces a descriptive default error message', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'bad';
+            const errors = await (0, _classvalidator.validate)(dto);
+            expect(errors).toHaveLength(1);
+            const message = Object.values(errors[0].constraints ?? {})[0];
+            expect(message).toContain('at least 8 characters');
+            expect(message).toContain('one uppercase letter');
+            expect(message).toContain('one lowercase letter');
+            expect(message).toContain('one number');
+            expect(message).toContain('one special character');
+        });
+    });
+    describe('custom options', ()=>{
+        it('enforces a custom minimum length', async ()=>{
+            const dto = new CustomPasswordDto();
+            dto.password = 'Short1Aa';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('accepts a password without special chars when requireSpecialChar is false', async ()=>{
+            const dto = new CustomPasswordDto();
+            dto.password = 'LongEnoughPassword1';
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('allows fully relaxed complexity requirements', async ()=>{
+            const dto = new NoComplexityPasswordDto();
+            dto.password = 'abcd';
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('still enforces minLength when complexity checks are disabled', async ()=>{
+            const dto = new NoComplexityPasswordDto();
+            dto.password = 'abc';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+    });
+});

package/entities/pending-registration.entity.d.ts

@@ -1,3 +1,4 @@
+import { CompanyRegistrationData } from '../interfaces/authentication.interface';
 export declare class PendingRegistration {
     id: string;
     email: string;
@@ -6,13 +7,7 @@ export declare class PendingRegistration {
     passwordHash: string;
     token: string;
     expiresAt: Date;
-    companyData: {
-        companySlug?: string;
-        branchSlug?: string;
-        newCompanyName?: string;
-        newCompanyPhone?: string;
-        newCompanyAddress?: string;
-    } | null;
+    companyData: CompanyRegistrationData | null;
     additionalFields: Record<string, any> | null;
     createdAt: Date;
 }

package/fesm/controllers/authentication.controller.spec.js

@@ -0,0 +1,215 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
+import { AuthenticationController } from './authentication.controller';
+describe('AuthenticationController', ()=>{
+    let controller;
+    let mockAuthService;
+    let mockAuthConfig;
+    beforeEach(()=>{
+        mockAuthService = {
+            login: jest.fn(),
+            register: jest.fn(),
+            refreshToken: jest.fn(),
+            getUserInfo: jest.fn(),
+            logout: jest.fn(),
+            changePassword: jest.fn()
+        };
+        mockAuthConfig = {
+            getRefreshTokenCookieName: jest.fn().mockReturnValue('fsn_refresh_token')
+        };
+        controller = new AuthenticationController(mockAuthService, mockAuthConfig);
+    });
+    describe('login', ()=>{
+        it('wraps a standard login response', async ()=>{
+            mockAuthService.login.mockResolvedValue({
+                accessToken: 'a',
+                refreshToken: 'r',
+                user: {
+                    id: 'u1',
+                    email: 'u@example.com'
+                }
+            });
+            const result = await controller.login({
+                email: 'u@example.com',
+                password: 'pw'
+            });
+            expect(result).toEqual(expect.objectContaining({
+                success: true,
+                data: expect.objectContaining({
+                    accessToken: 'a'
+                })
+            }));
+            expect(mockAuthService.login).toHaveBeenCalledWith('u@example.com', 'pw');
+        });
+        it('wraps a company-selection-required response', async ()=>{
+            mockAuthService.login.mockResolvedValue({
+                requiresSelection: true,
+                sessionId: 'sess-1'
+            });
+            const result = await controller.login({
+                email: 'u@example.com',
+                password: 'pw'
+            });
+            expect(result.message).toBe('Company selection required');
+            expect(result.data).toEqual(expect.objectContaining({
+                requiresSelection: true
+            }));
+        });
+        it('wraps an email-verification-required response', async ()=>{
+            mockAuthService.login.mockResolvedValue({
+                requiresEmailVerification: true,
+                email: 'u@example.com'
+            });
+            const result = await controller.login({
+                email: 'u@example.com',
+                password: 'pw'
+            });
+            expect(result.message).toBe('Email verification required');
+            expect(result.data).toEqual(expect.objectContaining({
+                requiresEmailVerification: true
+            }));
+        });
+        it('propagates errors thrown by the service', async ()=>{
+            mockAuthService.login.mockRejectedValue(new UnauthorizedException('bad creds'));
+            await expect(controller.login({
+                email: 'u@example.com',
+                password: 'wrong'
+            })).rejects.toThrow(UnauthorizedException);
+        });
+    });
+    describe('register', ()=>{
+        it('reports success message when registration completes without verification', async ()=>{
+            mockAuthService.register.mockResolvedValue({
+                accessToken: 'a',
+                user: {
+                    id: 'u1'
+                },
+                requiresEmailVerification: false
+            });
+            const req = {
+                headers: {},
+                get: jest.fn((h)=>h === 'host' ? 'app.example.com' : undefined),
+                protocol: 'https'
+            };
+            const result = await controller.register(req, {
+                name: 'New',
+                email: 'new@example.com',
+                password: 'Password1!'
+            });
+            expect(result.message).toBe('Registration successful');
+            expect(result.success).toBe(true);
+        });
+        it('reports verification-sent message when email verification is required', async ()=>{
+            mockAuthService.register.mockResolvedValue({
+                requiresEmailVerification: true,
+                user: {
+                    id: 'u1'
+                }
+            });
+            const req = {
+                headers: {},
+                get: jest.fn((h)=>h === 'host' ? 'app.example.com' : undefined),
+                protocol: 'https'
+            };
+            const result = await controller.register(req, {
+                name: 'New',
+                email: 'new@example.com',
+                password: 'Password1!'
+            });
+            expect(result.message).toBe('Verification email sent');
+        });
+    });
+    describe('refreshToken', ()=>{
+        it('reads the refresh token from the cookie first', async ()=>{
+            mockAuthService.refreshToken.mockResolvedValue({
+                accessToken: 'new-token'
+            });
+            const req = {
+                cookies: {
+                    fsn_refresh_token: 'cookie-token'
+                }
+            };
+            await controller.refreshToken(req, {
+                refreshToken: 'body-token'
+            });
+            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('cookie-token');
+        });
+        it('falls back to the request body when no cookie is present', async ()=>{
+            mockAuthService.refreshToken.mockResolvedValue({
+                accessToken: 'new-token'
+            });
+            const req = {
+                cookies: {}
+            };
+            await controller.refreshToken(req, {
+                refreshToken: 'body-token'
+            });
+            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('body-token');
+        });
+        it('throws UnauthorizedException when no refresh token is available', async ()=>{
+            const req = {
+                cookies: {}
+            };
+            await expect(controller.refreshToken(req, {})).rejects.toThrow(UnauthorizedException);
+            expect(mockAuthService.refreshToken).not.toHaveBeenCalled();
+        });
+        it('uses the default cookie name when authConfig is unavailable', async ()=>{
+            controller = new AuthenticationController(mockAuthService, undefined);
+            mockAuthService.refreshToken.mockResolvedValue({
+                accessToken: 'new-token'
+            });
+            const req = {
+                cookies: {
+                    fsn_refresh_token: 'cookie-token'
+                }
+            };
+            await controller.refreshToken(req, {});
+            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('cookie-token');
+        });
+    });
+    describe('getCurrentUser', ()=>{
+        it('delegates to authService.getUserInfo with the current user context', async ()=>{
+            mockAuthService.getUserInfo.mockResolvedValue({
+                user: {
+                    id: 'u1'
+                }
+            });
+            const user = buildMockUser();
+            const result = await controller.getCurrentUser(user);
+            expect(mockAuthService.getUserInfo).toHaveBeenCalledWith(user.id, user.companyId, user.branchId);
+            expect(result.data).toEqual({
+                user: {
+                    id: 'u1'
+                }
+            });
+        });
+    });
+    describe('logout', ()=>{
+        it('delegates to authService.logout and returns a success message', async ()=>{
+            const result = await controller.logout('user-1');
+            expect(mockAuthService.logout).toHaveBeenCalledWith('user-1');
+            expect(result).toEqual(expect.objectContaining({
+                success: true
+            }));
+        });
+    });
+    describe('changePassword', ()=>{
+        it('delegates to authService.changePassword', async ()=>{
+            const result = await controller.changePassword('user-1', {
+                currentPassword: 'old',
+                newPassword: 'New1!aaaa'
+            });
+            expect(mockAuthService.changePassword).toHaveBeenCalledWith('user-1', 'old', 'New1!aaaa');
+            expect(result).toEqual(expect.objectContaining({
+                success: true
+            }));
+        });
+        it('propagates errors from an invalid current password', async ()=>{
+            mockAuthService.changePassword.mockRejectedValue(new UnauthorizedException());
+            await expect(controller.changePassword('user-1', {
+                currentPassword: 'wrong',
+                newPassword: 'New1!aaaa'
+            })).rejects.toThrow(UnauthorizedException);
+        });
+    });
+});