@flusys/nestjs-auth 6.0.2 → 6.1.1

package/fesm/services/auth-datasource.provider.spec.js

@@ -0,0 +1,157 @@
+import { MultiTenantDataSourceService } from '@flusys/nestjs-shared';
+import { AuthDataSourceProvider } from './auth-datasource.provider';
+function buildOptions(overrides = {}) {
+    return {
+        global: false,
+        includeController: true,
+        bootstrapAppConfig: {
+            databaseMode: 'single',
+            enableCompanyFeature: false,
+            enableEmailVerification: true
+        },
+        ...overrides
+    };
+}
+describe('AuthDataSourceProvider', ()=>{
+    afterEach(()=>{
+        jest.restoreAllMocks();
+    });
+    describe('isCompanyFeatureEnabled', ()=>{
+        it('returns false by default when bootstrap config disables it', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions());
+            expect(provider.isCompanyFeatureEnabled()).toBe(false);
+        });
+        it('returns true when bootstrap config enables it', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: true
+                }
+            }));
+            expect(provider.isCompanyFeatureEnabled()).toBe(true);
+        });
+        it('prefers the tenant override over bootstrap config', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'multi-tenant',
+                    enableCompanyFeature: false
+                }
+            }));
+            expect(provider.isCompanyFeatureEnabled({
+                enableCompanyFeature: true
+            })).toBe(true);
+        });
+        it('defaults to false when no bootstrap config and no tenant override is present', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: undefined
+            }));
+            expect(provider.isCompanyFeatureEnabled()).toBe(false);
+        });
+    });
+    describe('isEmailVerificationEnabled', ()=>{
+        it('returns true by default (feature defaults to enabled)', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: undefined
+            }));
+            expect(provider.isEmailVerificationEnabled()).toBe(true);
+        });
+        it('returns false when bootstrap config disables it', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: false,
+                    enableEmailVerification: false
+                }
+            }));
+            expect(provider.isEmailVerificationEnabled()).toBe(false);
+        });
+        it('prefers the tenant override over bootstrap config', ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'multi-tenant',
+                    enableCompanyFeature: true,
+                    enableEmailVerification: true
+                }
+            }));
+            expect(provider.isEmailVerificationEnabled({
+                enableEmailVerification: false
+            })).toBe(false);
+        });
+    });
+    describe('getAuthEntities', ()=>{
+        it('returns only base entities when company feature and email verification are disabled', async ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: false,
+                    enableEmailVerification: false
+                }
+            }));
+            const entities = await provider.getAuthEntities();
+            const names = entities.map((e)=>e.name);
+            expect(names).toEqual(expect.arrayContaining([
+                'AppUser',
+                'UserToken'
+            ]));
+            expect(names).not.toContain('Company');
+            expect(names).not.toContain('PendingRegistration');
+        });
+        it('includes company entities when company feature is enabled', async ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: true,
+                    enableEmailVerification: false
+                }
+            }));
+            const entities = await provider.getAuthEntities();
+            const names = entities.map((e)=>e.name);
+            expect(names).toEqual(expect.arrayContaining([
+                'AppUser',
+                'UserToken',
+                'Company',
+                'CompanyBranch',
+                'UserCompanyPermission'
+            ]));
+        });
+        it('includes pending registration entity when email verification is enabled', async ()=>{
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: false,
+                    enableEmailVerification: true
+                }
+            }));
+            const entities = await provider.getAuthEntities();
+            const names = entities.map((e)=>e.name);
+            expect(names).toContain('PendingRegistration');
+        });
+    });
+    describe('createDataSourceFromConfig', ()=>{
+        it('forwards the config and resolved auth entities to the parent implementation', async ()=>{
+            const fakeDataSource = {
+                isInitialized: true
+            };
+            const parentSpy = jest.spyOn(MultiTenantDataSourceService.prototype, 'createDataSourceFromConfig').mockResolvedValue(fakeDataSource);
+            const provider = new AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: true,
+                    enableEmailVerification: true
+                }
+            }));
+            const config = {
+                type: 'postgres',
+                host: 'localhost'
+            };
+            const result = await provider.createDataSourceFromConfig(config);
+            expect(result).toBe(fakeDataSource);
+            expect(parentSpy).toHaveBeenCalledWith(config, expect.any(Array));
+            const forwardedEntityNames = parentSpy.mock.calls[0][1].map((e)=>e.name);
+            expect(forwardedEntityNames).toEqual(expect.arrayContaining([
+                'AppUser',
+                'Company'
+            ]));
+        });
+    });
+});

package/fesm/services/auth-email.service.spec.js

@@ -0,0 +1,359 @@
+import { BadRequestException, InternalServerErrorException } from '@nestjs/common';
+import * as bcrypt from 'bcrypt';
+import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
+import { AuthEmailService } from './auth-email.service';
+import { AppUser } from '../entities/app-user.entity';
+import { PendingRegistration } from '../entities/pending-registration.entity';
+import { TokenType, UserToken } from '../entities/user-token.entity';
+jest.mock('bcrypt', ()=>({
+        hash: jest.fn().mockResolvedValue('hashed-password')
+    }));
+function buildUser(overrides = {}) {
+    return {
+        id: 'user-1',
+        email: 'user@example.com',
+        isActive: true,
+        emailVerified: false,
+        password: 'hashed',
+        ...overrides
+    };
+}
+function buildUserToken(overrides = {}) {
+    return {
+        id: 'token-1',
+        userId: 'user-1',
+        type: TokenType.PASSWORD_RESET,
+        token: 'hashed-token',
+        expiresAt: new Date(Date.now() + 60_000),
+        usedAt: null,
+        createdAt: new Date(),
+        ...overrides
+    };
+}
+describe('AuthEmailService', ()=>{
+    let service;
+    let userRepo;
+    let pendingRepo;
+    let tokenRepo;
+    let mockEmailProvider;
+    beforeEach(()=>{
+        userRepo = createMockRepository();
+        pendingRepo = createMockRepository();
+        tokenRepo = createMockRepository();
+        const dataSourceProvider = {
+            getRepository: jest.fn().mockImplementation(async (entity)=>{
+                if (entity === AppUser) return userRepo;
+                if (entity === PendingRegistration) return pendingRepo;
+                if (entity === UserToken) return tokenRepo;
+                throw new Error(`Unexpected entity requested: ${String(entity)}`);
+            }),
+            getDataSource: jest.fn()
+        };
+        mockEmailProvider = {
+            sendPasswordResetEmail: jest.fn().mockResolvedValue(undefined),
+            sendVerificationEmail: jest.fn().mockResolvedValue(undefined)
+        };
+        service = new AuthEmailService(dataSourceProvider, mockEmailProvider);
+    });
+    afterEach(()=>jest.clearAllMocks());
+    describe('isEmailEnabled', ()=>{
+        it('returns true when an email provider is configured', ()=>{
+            expect(service.isEmailEnabled()).toBe(true);
+        });
+        it('returns false when no email provider is configured', ()=>{
+            const noEmailService = new AuthEmailService(createMockDataSourceProvider(userRepo), undefined);
+            expect(noEmailService.isEmailEnabled()).toBe(false);
+        });
+    });
+    describe('hasPendingRegistration', ()=>{
+        it('returns false when email is disabled without querying', async ()=>{
+            const noEmailService = new AuthEmailService(createMockDataSourceProvider(pendingRepo), undefined);
+            const result = await noEmailService.hasPendingRegistration('user@example.com');
+            expect(result).toBe(false);
+        });
+        it('returns true when a non-expired pending registration exists', async ()=>{
+            pendingRepo.findOne.mockResolvedValue({
+                expiresAt: new Date(Date.now() + 60_000)
+            });
+            const result = await service.hasPendingRegistration('user@example.com');
+            expect(result).toBe(true);
+        });
+        it('returns false when the pending registration has expired', async ()=>{
+            pendingRepo.findOne.mockResolvedValue({
+                expiresAt: new Date(Date.now() - 60_000)
+            });
+            const result = await service.hasPendingRegistration('user@example.com');
+            expect(result).toBe(false);
+        });
+        it('returns false when no pending registration exists', async ()=>{
+            pendingRepo.findOne.mockResolvedValue(null);
+            const result = await service.hasPendingRegistration('user@example.com');
+            expect(result).toBe(false);
+        });
+    });
+    describe('createPendingRegistration', ()=>{
+        it('throws BadRequestException when email service is not configured', async ()=>{
+            const noEmailService = new AuthEmailService(createMockDataSourceProvider(userRepo), undefined);
+            await expect(noEmailService.createPendingRegistration({
+                email: 'new@example.com',
+                password: 'Password1!',
+                verifyUrlBase: 'https://app.test/verify'
+            })).rejects.toThrow(BadRequestException);
+        });
+        it('throws BadRequestException when the user already exists', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            await expect(service.createPendingRegistration({
+                email: 'user@example.com',
+                password: 'Password1!',
+                verifyUrlBase: 'https://app.test/verify'
+            })).rejects.toThrow(BadRequestException);
+        });
+        it('creates a pending registration, hashes the password, and sends verification email', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            pendingRepo.create.mockImplementation((data)=>data);
+            pendingRepo.save.mockResolvedValue({});
+            const result = await service.createPendingRegistration({
+                email: 'new@example.com',
+                name: 'New User',
+                password: 'Password1!',
+                verifyUrlBase: 'https://app.test/verify'
+            });
+            expect(pendingRepo.delete).toHaveBeenCalledWith({
+                email: 'new@example.com'
+            });
+            expect(bcrypt.hash).toHaveBeenCalledWith('Password1!', 12);
+            expect(pendingRepo.save).toHaveBeenCalled();
+            expect(mockEmailProvider.sendVerificationEmail).toHaveBeenCalledWith('new@example.com', expect.any(String), expect.stringContaining('https://app.test/verify?token='));
+            expect(result.success).toBe(true);
+        });
+        it('wraps a failed verification email send in BadRequestException', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            pendingRepo.create.mockImplementation((data)=>data);
+            pendingRepo.save.mockResolvedValue({});
+            mockEmailProvider.sendVerificationEmail.mockRejectedValue(new Error('smtp down'));
+            await expect(service.createPendingRegistration({
+                email: 'new@example.com',
+                password: 'Password1!',
+                verifyUrlBase: 'https://app.test/verify'
+            })).rejects.toThrow(BadRequestException);
+        });
+    });
+    describe('forgotPassword', ()=>{
+        it('returns a generic success message when the user does not exist (prevents enumeration)', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            const result = await service.forgotPassword('missing@example.com', 'https://app.test/reset');
+            expect(result.success).toBe(true);
+            expect(tokenRepo.save).not.toHaveBeenCalled();
+        });
+        it('returns a generic success message when the user is inactive (prevents enumeration)', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser({
+                isActive: false
+            }));
+            const result = await service.forgotPassword('user@example.com', 'https://app.test/reset');
+            expect(result.success).toBe(true);
+            expect(tokenRepo.save).not.toHaveBeenCalled();
+        });
+        it('invalidates existing tokens and creates a new hashed reset token for an active user', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            tokenRepo.create.mockImplementation((data)=>data);
+            tokenRepo.save.mockResolvedValue({});
+            const result = await service.forgotPassword('user@example.com', 'https://app.test/reset');
+            expect(tokenRepo.delete).toHaveBeenCalledWith({
+                userId: 'user-1',
+                type: TokenType.PASSWORD_RESET
+            });
+            expect(tokenRepo.save).toHaveBeenCalled();
+            expect(mockEmailProvider.sendPasswordResetEmail).toHaveBeenCalledWith('user@example.com', expect.any(String), expect.stringContaining('https://app.test/reset?token='));
+            expect(result.success).toBe(true);
+        });
+        it('wraps a failed password-reset email send in BadRequestException', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            tokenRepo.create.mockImplementation((data)=>data);
+            tokenRepo.save.mockResolvedValue({});
+            mockEmailProvider.sendPasswordResetEmail.mockRejectedValue(new Error('smtp down'));
+            await expect(service.forgotPassword('user@example.com', 'https://app.test/reset')).rejects.toThrow(BadRequestException);
+        });
+    });
+    describe('resetPassword', ()=>{
+        it('throws BadRequestException when the token is not found', async ()=>{
+            tokenRepo.findOne.mockResolvedValue(null);
+            await expect(service.resetPassword('bad-token', 'NewPassword1!')).rejects.toThrow(BadRequestException);
+        });
+        it('throws BadRequestException when the token has expired', async ()=>{
+            tokenRepo.findOne.mockResolvedValue(buildUserToken({
+                expiresAt: new Date(Date.now() - 60_000)
+            }));
+            await expect(service.resetPassword('token', 'NewPassword1!')).rejects.toThrow(BadRequestException);
+        });
+        it('throws BadRequestException when the token has already been used', async ()=>{
+            tokenRepo.findOne.mockResolvedValue(buildUserToken({
+                usedAt: new Date()
+            }));
+            await expect(service.resetPassword('token', 'NewPassword1!')).rejects.toThrow(BadRequestException);
+        });
+        it('throws BadRequestException when the associated user no longer exists', async ()=>{
+            tokenRepo.findOne.mockResolvedValue(buildUserToken());
+            userRepo.findOne.mockResolvedValue(null);
+            await expect(service.resetPassword('token', 'NewPassword1!')).rejects.toThrow(BadRequestException);
+        });
+        it('hashes the new password, saves the user, and marks the token as used', async ()=>{
+            const token = buildUserToken();
+            tokenRepo.findOne.mockResolvedValue(token);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(token);
+            const result = await service.resetPassword('raw-token', 'NewPassword1!');
+            expect(bcrypt.hash).toHaveBeenCalledWith('NewPassword1!', 12);
+            expect(userRepo.save).toHaveBeenCalled();
+            expect(tokenRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                usedAt: expect.any(Date)
+            }));
+            expect(result.success).toBe(true);
+        });
+    });
+    describe('verifyEmail', ()=>{
+        it('resolves a pending registration and deletes it', async ()=>{
+            const pending = {
+                id: 'pending-1',
+                email: 'new@example.com',
+                expiresAt: new Date(Date.now() + 60_000)
+            };
+            pendingRepo.findOne.mockResolvedValue(pending);
+            const result = await service.verifyEmail('raw-token');
+            expect(result).toEqual({
+                type: 'pending',
+                pending
+            });
+            expect(pendingRepo.delete).toHaveBeenCalledWith({
+                id: 'pending-1'
+            });
+        });
+        it('deletes and throws when the pending registration has expired', async ()=>{
+            const pending = {
+                id: 'pending-1',
+                expiresAt: new Date(Date.now() - 60_000)
+            };
+            pendingRepo.findOne.mockResolvedValue(pending);
+            await expect(service.verifyEmail('raw-token')).rejects.toThrow(BadRequestException);
+            expect(pendingRepo.delete).toHaveBeenCalledWith({
+                id: 'pending-1'
+            });
+        });
+        it('throws BadRequestException when no pending registration or user token is found', async ()=>{
+            pendingRepo.findOne.mockResolvedValue(null);
+            tokenRepo.findOne.mockResolvedValue(null);
+            await expect(service.verifyEmail('raw-token')).rejects.toThrow(BadRequestException);
+        });
+        it('deletes and throws when the user token has expired', async ()=>{
+            pendingRepo.findOne.mockResolvedValue(null);
+            tokenRepo.findOne.mockResolvedValue(buildUserToken({
+                type: TokenType.EMAIL_VERIFICATION,
+                expiresAt: new Date(Date.now() - 60_000)
+            }));
+            await expect(service.verifyEmail('raw-token')).rejects.toThrow(BadRequestException);
+            expect(tokenRepo.delete).toHaveBeenCalled();
+        });
+        it('returns already-verified message when the token has already been used', async ()=>{
+            pendingRepo.findOne.mockResolvedValue(null);
+            tokenRepo.findOne.mockResolvedValue(buildUserToken({
+                type: TokenType.EMAIL_VERIFICATION,
+                usedAt: new Date()
+            }));
+            const result = await service.verifyEmail('raw-token');
+            expect(result).toEqual(expect.objectContaining({
+                type: 'verified',
+                message: 'Email has already been verified.'
+            }));
+        });
+        it('throws BadRequestException when the user for the token no longer exists', async ()=>{
+            pendingRepo.findOne.mockResolvedValue(null);
+            tokenRepo.findOne.mockResolvedValue(buildUserToken({
+                type: TokenType.EMAIL_VERIFICATION
+            }));
+            userRepo.findOne.mockResolvedValue(null);
+            await expect(service.verifyEmail('raw-token')).rejects.toThrow(BadRequestException);
+        });
+        it('marks the user email verified and the token used on success', async ()=>{
+            const token = buildUserToken({
+                type: TokenType.EMAIL_VERIFICATION
+            });
+            pendingRepo.findOne.mockResolvedValue(null);
+            tokenRepo.findOne.mockResolvedValue(token);
+            userRepo.findOne.mockResolvedValue(buildUser({
+                emailVerified: false
+            }));
+            userRepo.save.mockResolvedValue({});
+            tokenRepo.save.mockResolvedValue({});
+            const result = await service.verifyEmail('raw-token');
+            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                emailVerified: true
+            }));
+            expect(tokenRepo.save).toHaveBeenCalledWith(expect.objectContaining({
+                usedAt: expect.any(Date)
+            }));
+            expect(result).toEqual(expect.objectContaining({
+                type: 'verified'
+            }));
+        });
+    });
+    describe('resendVerificationEmail', ()=>{
+        it('throws BadRequestException when email service is not configured', async ()=>{
+            const noEmailService = new AuthEmailService(createMockDataSourceProvider(pendingRepo), undefined);
+            await expect(noEmailService.resendVerificationEmail('user@example.com', 'https://app.test/verify')).rejects.toThrow(BadRequestException);
+        });
+        it('resends verification for a pending registration', async ()=>{
+            const pending = {
+                email: 'new@example.com',
+                token: 'old-hash',
+                expiresAt: new Date()
+            };
+            pendingRepo.findOne.mockResolvedValue(pending);
+            pendingRepo.save.mockResolvedValue(pending);
+            const result = await service.resendVerificationEmail('new@example.com', 'https://app.test/verify');
+            expect(pendingRepo.save).toHaveBeenCalled();
+            expect(mockEmailProvider.sendVerificationEmail).toHaveBeenCalled();
+            expect(result.success).toBe(true);
+        });
+        it('returns generic success without sending when the user does not exist (prevents enumeration)', async ()=>{
+            pendingRepo.findOne.mockResolvedValue(null);
+            userRepo.findOne.mockResolvedValue(null);
+            const result = await service.resendVerificationEmail('missing@example.com', 'https://app.test/verify');
+            expect(result.success).toBe(true);
+            expect(mockEmailProvider.sendVerificationEmail).not.toHaveBeenCalled();
+        });
+        it('returns generic success without sending when the user is already verified', async ()=>{
+            pendingRepo.findOne.mockResolvedValue(null);
+            userRepo.findOne.mockResolvedValue(buildUser({
+                emailVerified: true
+            }));
+            const result = await service.resendVerificationEmail('user@example.com', 'https://app.test/verify');
+            expect(result.success).toBe(true);
+            expect(mockEmailProvider.sendVerificationEmail).not.toHaveBeenCalled();
+        });
+        it('invalidates old tokens and sends a new verification token for an unverified user', async ()=>{
+            pendingRepo.findOne.mockResolvedValue(null);
+            userRepo.findOne.mockResolvedValue(buildUser({
+                emailVerified: false
+            }));
+            tokenRepo.create.mockImplementation((data)=>data);
+            tokenRepo.save.mockResolvedValue({});
+            const result = await service.resendVerificationEmail('user@example.com', 'https://app.test/verify');
+            expect(tokenRepo.delete).toHaveBeenCalledWith({
+                userId: 'user-1',
+                type: TokenType.EMAIL_VERIFICATION
+            });
+            expect(mockEmailProvider.sendVerificationEmail).toHaveBeenCalled();
+            expect(result.success).toBe(true);
+        });
+    });
+    describe('getRepository failure path', ()=>{
+        it('throws InternalServerErrorException when the data source provider is unavailable', async ()=>{
+            const noDataSourceService = new AuthEmailService(undefined, mockEmailProvider);
+            await expect(noDataSourceService.createPendingRegistration({
+                email: 'new@example.com',
+                password: 'Password1!',
+                verifyUrlBase: 'https://app.test/verify'
+            })).rejects.toThrow(InternalServerErrorException);
+        });
+    });
+});