@flusys/nestjs-auth 6.0.2 → 6.1.0

package/fesm/strategies/jwt.strategy.spec.js

@@ -0,0 +1,162 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { createMockRepository } from '@test-utils/mocks/repository.mock';
+import { JwtStrategy } from './jwt.strategy';
+import { AuthDataSourceProvider } from '../services/auth-datasource.provider';
+import { AuthenticationService } from '../services/authentication.service';
+describe('JwtStrategy', ()=>{
+    let strategy;
+    let userRepo;
+    let mockAuthConfig;
+    let mockModuleRef;
+    let mockDataSourceProvider;
+    let mockAuthService;
+    beforeEach(()=>{
+        userRepo = createMockRepository();
+        mockAuthConfig = {
+            getJwtSecret: jest.fn().mockReturnValue('jwt-secret')
+        };
+        mockDataSourceProvider = {
+            getRepository: jest.fn().mockResolvedValue(userRepo)
+        };
+        mockAuthService = {
+            isTokenRevoked: jest.fn().mockResolvedValue(false)
+        };
+        mockModuleRef = {
+            resolve: jest.fn().mockImplementation(async (token)=>{
+                if (token === AuthDataSourceProvider) return mockDataSourceProvider;
+                if (token === AuthenticationService) return mockAuthService;
+                return null;
+            })
+        };
+        strategy = new JwtStrategy(mockAuthConfig, mockModuleRef);
+    });
+    describe('validate', ()=>{
+        const req = {};
+        it('returns basic user info for a payload without company context', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            const result = await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            });
+            expect(result).toEqual({
+                id: 'user-1',
+                email: 'user@example.com'
+            });
+        });
+        it('includes companyId and branchId when present in the payload', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            const result = await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            });
+            expect(result).toEqual({
+                id: 'user-1',
+                email: 'user@example.com',
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            });
+        });
+        it('omits branchId when only companyId is present', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            const result = await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                companyId: 'company-1'
+            });
+            expect(result).toEqual({
+                id: 'user-1',
+                email: 'user@example.com',
+                companyId: 'company-1'
+            });
+        });
+        it('throws UnauthorizedException when the user is not found or inactive', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await expect(strategy.validate(req, {
+                id: 'missing-user',
+                email: 'x@example.com',
+                type: 'access'
+            })).rejects.toThrow(UnauthorizedException);
+        });
+        it('throws UnauthorizedException when the token has been revoked', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            mockAuthService.isTokenRevoked.mockResolvedValue(true);
+            await expect(strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                iat: 1000
+            })).rejects.toThrow(UnauthorizedException);
+        });
+        it('skips revocation check when the payload has no iat', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            });
+            expect(mockAuthService.isTokenRevoked).not.toHaveBeenCalled();
+        });
+        it('throws UnauthorizedException when the data source provider cannot be resolved', async ()=>{
+            mockModuleRef.resolve.mockImplementation(async (token)=>{
+                if (token === AuthDataSourceProvider) return null;
+                return mockAuthService;
+            });
+            await expect(strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            })).rejects.toThrow(UnauthorizedException);
+        });
+        it('propagates an UnauthorizedException raised while resolving the data source provider', async ()=>{
+            mockModuleRef.resolve.mockImplementation(async (token)=>{
+                if (token === AuthDataSourceProvider) throw new Error('resolution failed');
+                return mockAuthService;
+            });
+            await expect(strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access'
+            })).rejects.toThrow(UnauthorizedException);
+        });
+        it('does not fail validation when the authentication service cannot be resolved for revocation checks', async ()=>{
+            userRepo.findOne.mockResolvedValue({
+                id: 'user-1',
+                isActive: true
+            });
+            mockModuleRef.resolve.mockImplementation(async (token)=>{
+                if (token === AuthDataSourceProvider) return mockDataSourceProvider;
+                return null;
+            });
+            const result = await strategy.validate(req, {
+                id: 'user-1',
+                email: 'user@example.com',
+                type: 'access',
+                iat: 1000
+            });
+            expect(result).toEqual({
+                id: 'user-1',
+                email: 'user@example.com'
+            });
+        });
+    });
+});

package/fesm/validators/password.validator.spec.js

@@ -0,0 +1,157 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+import { validate } from 'class-validator';
+import { IsStrongPassword } from './password.validator';
+let DefaultPasswordDto = class DefaultPasswordDto {
+    constructor(){
+        _define_property(this, "password", void 0);
+    }
+};
+_ts_decorate([
+    IsStrongPassword(),
+    _ts_metadata("design:type", String)
+], DefaultPasswordDto.prototype, "password", void 0);
+let CustomPasswordDto = class CustomPasswordDto {
+    constructor(){
+        _define_property(this, "password", void 0);
+    }
+};
+_ts_decorate([
+    IsStrongPassword({
+        minLength: 12,
+        requireSpecialChar: false
+    }),
+    _ts_metadata("design:type", String)
+], CustomPasswordDto.prototype, "password", void 0);
+let NoComplexityPasswordDto = class NoComplexityPasswordDto {
+    constructor(){
+        _define_property(this, "password", void 0);
+    }
+};
+_ts_decorate([
+    IsStrongPassword({
+        requireUppercase: false,
+        requireLowercase: false,
+        requireNumber: false,
+        requireSpecialChar: false,
+        minLength: 4
+    }),
+    _ts_metadata("design:type", String)
+], NoComplexityPasswordDto.prototype, "password", void 0);
+async function validatePassword(dto) {
+    const errors = await validate(dto);
+    return errors.length === 0;
+}
+describe('IsStrongPassword', ()=>{
+    describe('default options', ()=>{
+        it('accepts a password meeting all default complexity rules', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'StrongP@ss1';
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('rejects a password shorter than the minimum length', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'Sh0rt!';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('accepts a password at exactly the minimum length boundary', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'Ab1!Ab1!'; // 8 chars
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('rejects a password longer than the maximum length', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'A1!' + 'a'.repeat(127); // 130 chars total
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('accepts a password at exactly the maximum length boundary', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'A1!' + 'a'.repeat(125); // 128 chars total
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('rejects a password missing an uppercase letter', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'lowercase1!';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects a password missing a lowercase letter', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'UPPERCASE1!';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects a password missing a number', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'NoNumbers!';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects a password missing a special character', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'NoSpecial1';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects a non-string value', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 12345678;
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('rejects an empty string', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = '';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('produces a descriptive default error message', async ()=>{
+            const dto = new DefaultPasswordDto();
+            dto.password = 'bad';
+            const errors = await validate(dto);
+            expect(errors).toHaveLength(1);
+            const message = Object.values(errors[0].constraints ?? {})[0];
+            expect(message).toContain('at least 8 characters');
+            expect(message).toContain('one uppercase letter');
+            expect(message).toContain('one lowercase letter');
+            expect(message).toContain('one number');
+            expect(message).toContain('one special character');
+        });
+    });
+    describe('custom options', ()=>{
+        it('enforces a custom minimum length', async ()=>{
+            const dto = new CustomPasswordDto();
+            dto.password = 'Short1Aa';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+        it('accepts a password without special chars when requireSpecialChar is false', async ()=>{
+            const dto = new CustomPasswordDto();
+            dto.password = 'LongEnoughPassword1';
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('allows fully relaxed complexity requirements', async ()=>{
+            const dto = new NoComplexityPasswordDto();
+            dto.password = 'abcd';
+            expect(await validatePassword(dto)).toBe(true);
+        });
+        it('still enforces minLength when complexity checks are disabled', async ()=>{
+            const dto = new NoComplexityPasswordDto();
+            dto.password = 'abc';
+            expect(await validatePassword(dto)).toBe(false);
+        });
+    });
+});

package/helpers/auth-response.mapper.d.ts

@@ -0,0 +1,22 @@
+import { AppUser } from '../entities/app-user.entity';
+import { CompanyBranch } from '../entities/company-branch.entity';
+import { Company } from '../entities/company.entity';
+export declare function toUserInfo(user: AppUser): {
+    id: string;
+    email: string;
+    name: string | undefined;
+    phone: string | null;
+    profilePictureId: string | null;
+};
+export declare function toCompanyInfo(company: Company): {
+    id: string;
+    name: string;
+    slug: string;
+    logoId: string | null;
+};
+export declare function toBranchInfo(branch: CompanyBranch): {
+    id: string;
+    name: string;
+    slug: string;
+    logoId: string | null;
+};

package/helpers/index.d.ts

@@ -0,0 +1,2 @@
+export * from './auth-response.mapper';
+export * from './token.helper';

package/helpers/token.helper.d.ts

@@ -0,0 +1,8 @@
+import { JwtService } from '@nestjs/jwt';
+import { TokenPayload, TokenPayloadWithCompany } from '../interfaces/authentication.interface';
+import { AuthConfigService } from '../services/auth-config.service';
+export declare function generateTokens(jwtService: JwtService, authConfig: AuthConfigService, payload: TokenPayload | TokenPayloadWithCompany): {
+    accessToken: string;
+    refreshToken: string;
+};
+export declare function parseExpiryToMs(expiry: string): number;

package/index.d.ts

@@ -4,6 +4,7 @@ export * from './docs';
 export * from './dtos';
 export * from './entities';
 export * from './enums';
+export * from './helpers';
 export * from './interceptors';
 export * from './interfaces';
 export * from './modules';

package/interfaces/authentication.interface.d.ts

@@ -62,3 +62,10 @@ export interface LoginResponseRequiresEmailVerification {
     message: string;
     messageKey: string;
 }
+export interface CompanyRegistrationData {
+    companySlug?: string;
+    branchSlug?: string;
+    newCompanyName?: string;
+    newCompanyPhone?: string;
+    newCompanyAddress?: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "6.0.2",
+  "version": "6.1.0",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -52,6 +52,11 @@
       "import": "./fesm/enums/index.js",
       "require": "./cjs/enums/index.js"
     },
+    "./helpers": {
+      "types": "./helpers/index.d.ts",
+      "import": "./fesm/helpers/index.js",
+      "require": "./cjs/helpers/index.js"
+    },
     "./interceptors": {
       "types": "./interceptors/index.d.ts",
       "import": "./fesm/interceptors/index.js",
@@ -93,7 +98,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.0.2",
-    "@flusys/nestjs-shared": "6.0.2"
+    "@flusys/nestjs-core": "6.1.0",
+    "@flusys/nestjs-shared": "6.1.0"
   }
 }

package/services/authentication.service.d.ts

@@ -24,9 +24,7 @@ export declare class AuthenticationService {
     private isCompanyFeatureEnabled;
     private isEmailVerificationEnabled;
     private getUserRepository;
-    private getPermissionRepository;
-    private getCompanyRepository;
-    private getBranchRepository;
+    private getCompanyScopedRepository;
     login(email: string, password: string): Promise<LoginResponse | LoginResponseRequiresSelection | LoginResponseRequiresEmailVerification>;
     private handleCompanyBasedLogin;
     register(dto: RegistrationDto, verifyUrlBase?: string): Promise<RegistrationResponse | {
@@ -50,7 +48,6 @@ export declare class AuthenticationService {
     changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
     logout(userId: string): Promise<void>;
     isTokenRevoked(userId: string, tokenIssuedAt?: number): Promise<boolean>;
-    private parseExpiryToMs;
     getUserCompanies(userId: string): Promise<Company[]>;
     getUserBranches(userId: string, companyId: string): Promise<CompanyBranch[]>;
     getCompanyById(companyId: string): Promise<Company | null>;
@@ -58,10 +55,6 @@ export declare class AuthenticationService {
     getUserInfo(userId: string, companyId?: string, branchId?: string): Promise<MeResponse>;
     private ensureCompanyFeatureEnabled;
     private validateUser;
-    private toUserInfo;
-    private toCompanyInfo;
-    private toBranchInfo;
-    private generateTokens;
     private generateLoginResponse;
     private generateLoginResponseWithCompany;
     private sendLoginNotification;