@flusys/nestjs-auth 6.4.0 → 7.0.0-beta.1

package/cjs/services/user.service.js

@@ -130,10 +130,13 @@ let UserService = class UserService extends _classes.ApiService {
         await this.repository.update(id, {
             emailVerified: true
         });
-        await this.clearCacheForId([
-            {
-                id
-            }
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
         ]);
     }
     async verifyPhone(id) {
@@ -141,10 +144,13 @@ let UserService = class UserService extends _classes.ApiService {
         await this.repository.update(id, {
             phoneVerified: true
         });
-        await this.clearCacheForId([
-            {
-                id
-            }
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
         ]);
     }
     async updateStatus(id, isActive, user) {
@@ -174,10 +180,13 @@ let UserService = class UserService extends _classes.ApiService {
                 isActive
             });
         }
-        await this.clearCacheForId([
-            {
-                id
-            }
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
         ]);
     }
     async convertSingleDtoToEntity(dto, user) {
@@ -401,8 +410,11 @@ let UserService = class UserService extends _classes.ApiService {
                 }
             }
             await queryRunner.commitTransaction();
-            await this.clearCacheForId([
-                savedUser
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    savedUser
+                ])
             ]);
             return this.convertEntityToResponseDto(savedUser, false);
         } catch (error) {
@@ -471,8 +483,11 @@ let UserService = class UserService extends _classes.ApiService {
         try {
             await this.userEnricher.updateProfileSection(userId, sectionId, data, queryRunner);
             await queryRunner.commitTransaction();
-            await this.clearCacheForId([
-                userEntity
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    userEntity
+                ])
             ]);
         } catch (error) {
             await queryRunner.rollbackTransaction();
@@ -541,8 +556,11 @@ let UserService = class UserService extends _classes.ApiService {
                 await this.userEnricher.updateProfileExtras(userId, extras, queryRunner);
             }
             await queryRunner.commitTransaction();
-            await this.clearCacheForId([
-                findUser
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    findUser
+                ])
             ]);
             return findUser.id;
         } catch (error) {

package/cjs/services/user.service.spec.js

@@ -124,6 +124,13 @@ describe('UserService', ()=>{
         };
         service = new _userservice.UserService({}, mockUtilsService, mockDataSourceProvider, mockAuthConfig, mockUserEnricher);
     });
+    /**
+   * Every write path has to drop both the list cache and the row's own cache, or a
+   * stale user keeps being served from `get-all`.
+   */ function expectCacheCleared(id) {
+        expect(mockUtilsService.clearCache).toHaveBeenCalledWith('appuser', expect.anything());
+        expect(mockUtilsService.clearCache).toHaveBeenCalledWith('appuser', expect.anything(), id);
+    }
     describe('ensureDataSourceRepository', ()=>{
         it('does not load the permission repository when the company feature is disabled', async ()=>{
             await service.ensureDataSourceRepository();
@@ -142,13 +149,14 @@ describe('UserService', ()=>{
             expect(userRepo.update).toHaveBeenCalledWith('user-1', {
                 emailVerified: true
             });
-            expect(mockUtilsService.clearCache).toHaveBeenCalled();
+            expectCacheCleared('user-1');
         });
         it('marks the phone as verified and clears the cache', async ()=>{
             await service.verifyPhone('user-1');
             expect(userRepo.update).toHaveBeenCalledWith('user-1', {
                 phoneVerified: true
             });
+            expectCacheCleared('user-1');
         });
     });
     describe('updateStatus', ()=>{
@@ -157,6 +165,7 @@ describe('UserService', ()=>{
             expect(userRepo.update).toHaveBeenCalledWith('user-1', {
                 isActive: false
             });
+            expectCacheCleared('user-1');
         });
         it('throws NotFoundException when the company permission is missing', async ()=>{
             companyFeatureEnabled = true;
@@ -179,6 +188,7 @@ describe('UserService', ()=>{
                 isActive: false
             }));
             expect(userRepo.update).not.toHaveBeenCalled();
+            expectCacheCleared('user-1');
         });
     });
     describe('convertSingleDtoToEntity', ()=>{
@@ -389,6 +399,7 @@ describe('UserService', ()=>{
             expect(result).toEqual(expect.objectContaining({
                 id: 'user-1'
             }));
+            expectCacheCleared(savedUser.id);
         });
         it('rolls back the transaction if permission assignment fails', async ()=>{
             companyFeatureEnabled = true;
@@ -577,6 +588,7 @@ describe('UserService', ()=>{
                 foo: 'bar'
             }, queryRunner);
             expect(queryRunner.commitTransaction).toHaveBeenCalled();
+            expectCacheCleared('user-1');
         });
         it('rolls back the transaction when the enricher throws', async ()=>{
             userRepo.findOne.mockResolvedValue(buildAppUser());
@@ -670,6 +682,7 @@ describe('UserService', ()=>{
             expect(queryRunner.manager.save).toHaveBeenCalled();
             expect(queryRunner.commitTransaction).toHaveBeenCalled();
             expect(result).toBe('user-1');
+            expectCacheCleared('user-1');
         });
         it('does not require the current password when an admin updates another user profile', async ()=>{
             service.dataSource = mockDataSource;
@@ -686,6 +699,7 @@ describe('UserService', ()=>{
             }));
             expect(queryRunner.manager.save).toHaveBeenCalled();
             expect(queryRunner.commitTransaction).toHaveBeenCalled();
+            expectCacheCleared('other-user');
         });
         it('rolls back the transaction when save fails', async ()=>{
             service.dataSource = mockDataSource;

package/config/event-actions.d.ts

@@ -0,0 +1,21 @@
+export declare const AUTH_EVENT_ACTIONS: {
+    readonly LOGGED_IN: "logged-in";
+    readonly LOGGED_OUT: "logged-out";
+    readonly TOKEN_REFRESHED: "token-refreshed";
+    readonly COMPANY_SWITCHED: "company-switched";
+    readonly REGISTERED: "registered";
+    readonly PASSWORD_CHANGED: "password-changed";
+    readonly PASSWORD_RESET_REQUESTED: "password-reset-requested";
+    readonly PASSWORD_RESET: "password-reset";
+    readonly EMAIL_VERIFIED: "email-verified";
+    readonly PERMISSION_GRANTED: "permission-granted";
+    readonly PERMISSION_REVOKED: "permission-revoked";
+};
+export declare const AUTH_EVENT_ENTITIES: {
+    readonly USER: "appuser";
+    readonly COMPANY: "company";
+    readonly COMPANY_BRANCH: "company_branch";
+    readonly SESSION: "session";
+    readonly USER_PERMISSION: "user_company_permission";
+};
+export declare const AUTH_EVENT_MODULE = "auth";

package/config/index.d.ts

@@ -1,2 +1,3 @@
 export * from './auth.constants';
+export * from './event-actions';
 export * from './message-keys';

package/config/message-keys.d.ts

@@ -62,6 +62,12 @@ export declare const USER_MESSAGES: {
     readonly STATUS_UPDATE_SUCCESS: "user.status.update.success";
     readonly LOOKUP_SUCCESS: "user.lookup.success";
 };
+export declare const COMPANY_MESSAGES: {
+    readonly READONLY_DELETE_FORBIDDEN: "company.readonly.delete.forbidden";
+};
+export declare const BRANCH_MESSAGES: {
+    readonly READONLY_DELETE_FORBIDDEN: "branch.readonly.delete.forbidden";
+};
 export declare const USER_PERMISSION_MESSAGES: {
     readonly COMPANY_LIST_SUCCESS: "user.permission.company.list.success";
     readonly BRANCH_LIST_SUCCESS: "user.permission.branch.list.success";

package/fesm/config/event-actions.js

@@ -0,0 +1,24 @@
+/**
+ * Domain event actions published by the auth module, alongside the CRUD
+ * lifecycle actions every ApiService emits.
+ */ export const AUTH_EVENT_ACTIONS = {
+    LOGGED_IN: 'logged-in',
+    LOGGED_OUT: 'logged-out',
+    TOKEN_REFRESHED: 'token-refreshed',
+    COMPANY_SWITCHED: 'company-switched',
+    REGISTERED: 'registered',
+    PASSWORD_CHANGED: 'password-changed',
+    PASSWORD_RESET_REQUESTED: 'password-reset-requested',
+    PASSWORD_RESET: 'password-reset',
+    EMAIL_VERIFIED: 'email-verified',
+    PERMISSION_GRANTED: 'permission-granted',
+    PERMISSION_REVOKED: 'permission-revoked'
+};
+/** Every entity the auth module publishes under, ApiService backed or not */ export const AUTH_EVENT_ENTITIES = {
+    USER: 'appuser',
+    COMPANY: 'company',
+    COMPANY_BRANCH: 'company_branch',
+    SESSION: 'session',
+    USER_PERMISSION: 'user_company_permission'
+};
+export const AUTH_EVENT_MODULE = 'auth';

package/fesm/config/index.js

@@ -1,2 +1,3 @@
 export * from './auth.constants';
+export * from './event-actions';
 export * from './message-keys';

package/fesm/config/message-keys.js

@@ -63,6 +63,12 @@ export const USER_MESSAGES = {
     STATUS_UPDATE_SUCCESS: 'user.status.update.success',
     LOOKUP_SUCCESS: 'user.lookup.success'
 };
+export const COMPANY_MESSAGES = {
+    READONLY_DELETE_FORBIDDEN: 'company.readonly.delete.forbidden'
+};
+export const BRANCH_MESSAGES = {
+    READONLY_DELETE_FORBIDDEN: 'branch.readonly.delete.forbidden'
+};
 export const USER_PERMISSION_MESSAGES = {
     COMPANY_LIST_SUCCESS: 'user.permission.company.list.success',
     BRANCH_LIST_SUCCESS: 'user.permission.branch.list.success',

package/fesm/modules/auth.module.js

@@ -4,7 +4,7 @@ function _ts_decorate(decorators, target, key, desc) {
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-import { CacheModule, UtilsModule } from '@flusys/nestjs-shared/modules';
+import { CacheModule, UtilsModule, createModuleEventsProvider } from '@flusys/nestjs-shared/modules';
 import { Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
@@ -93,7 +93,8 @@ export class AuthModule {
             AuthenticationService,
             SetToken,
             ClearToken,
-            UserService
+            UserService,
+            createModuleEventsProvider('auth', AUTH_MODULE_OPTIONS)
         ];
         if (flags.enableEmailVerification) {
             providers.push(AuthEmailService);

package/fesm/services/auth-email.service.js

@@ -26,11 +26,12 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
+import { publishDomainEvent } from '@flusys/nestjs-shared/classes';
 import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
 import { BadRequestException, Inject, Injectable, InternalServerErrorException, Optional, Scope } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import * as crypto from 'crypto';
-import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, USER_MESSAGES } from '../config';
+import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, USER_MESSAGES } from '../config';
 import { AppUser } from '../entities/app-user.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { TokenType, UserToken } from '../entities/user-token.entity';
@@ -191,6 +192,9 @@ export class AuthEmailService {
                 }
             });
         }
+        await this.publishUserEvent(AUTH_EVENT_ACTIONS.PASSWORD_RESET_REQUESTED, user.id, {
+            email: user.email
+        });
         return {
             success: true,
             message: 'If the email exists, a password reset link has been sent.',
@@ -232,6 +236,9 @@ export class AuthEmailService {
         // Mark token as used
         userToken.usedAt = new Date();
         await tokenRepository.save(userToken);
+        await this.publishUserEvent(AUTH_EVENT_ACTIONS.PASSWORD_RESET, user.id, {
+            email: user.email
+        });
         return {
             success: true,
             message: 'Password has been reset successfully.',
@@ -315,12 +322,26 @@ export class AuthEmailService {
         // Mark token as used
         userToken.usedAt = new Date();
         await tokenRepository.save(userToken);
+        await this.publishUserEvent(AUTH_EVENT_ACTIONS.EMAIL_VERIFIED, user.id, {
+            email: user.email
+        });
         return {
             type: 'verified',
             message: 'Email has been verified successfully.',
             messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS
         };
     }
+    async publishUserEvent(action, userId, metadata) {
+        await publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity: AUTH_EVENT_ENTITIES.USER,
+            action,
+            ids: [
+                userId
+            ],
+            metadata
+        });
+    }
     async resendVerificationEmail(email, verifyUrlBase) {
         this.assertEmailEnabled();
         const pendingRepository = await this.getRepository(PendingRegistration);

package/fesm/services/auth-email.service.spec.js

@@ -1,6 +1,7 @@
 import { BadRequestException, InternalServerErrorException } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
+import { EventBusRegistry } from '@flusys/nestjs-shared/classes';
 import { AuthEmailService } from './auth-email.service';
 import { AppUser } from '../entities/app-user.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
@@ -356,4 +357,55 @@ describe('AuthEmailService', ()=>{
             })).rejects.toThrow(InternalServerErrorException);
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            EventBusRegistry.reset();
+            EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            EventBusRegistry.configureModule('auth', {
+                enabled: true
+            });
+        });
+        afterEach(()=>{
+            EventBusRegistry.reset();
+        });
+        it('publishes auth.appuser.password-reset-requested once the reset email is sent', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(buildUserToken());
+            await service.forgotPassword('user@example.com', 'https://app.test/reset');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-reset-requested'
+            }));
+        });
+        it('publishes nothing for an unknown email so enumeration stays impossible', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await service.forgotPassword('missing@example.com', 'https://app.test/reset');
+            expect(publish).not.toHaveBeenCalled();
+        });
+        it('publishes auth.appuser.password-reset when the token is consumed', async ()=>{
+            const token = buildUserToken();
+            tokenRepo.findOne.mockResolvedValue(token);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(token);
+            await service.resetPassword('raw-token', 'NewPassword1!');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-reset'
+            }));
+        });
+        it('does not publish when the auth module has events disabled', async ()=>{
+            EventBusRegistry.configureModule('auth', {
+                enabled: false
+            });
+            userRepo.findOne.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(buildUserToken());
+            await service.forgotPassword('user@example.com', 'https://app.test/reset');
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/fesm/services/authentication.service.js

@@ -26,7 +26,7 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
-import { HybridCache } from '@flusys/nestjs-shared/classes';
+import { HybridCache, publishDomainEvent } from '@flusys/nestjs-shared/classes';
 import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
 import { NotificationType } from '@flusys/nestjs-shared/enums';
 import { INotificationAdapter, NOTIFICATION_ADAPTER } from '@flusys/nestjs-shared/interfaces';
@@ -34,7 +34,7 @@ import { generateUniqueSlug } from '@flusys/nestjs-shared/utils';
 import { BadRequestException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import * as bcrypt from 'bcrypt';
-import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, TOKEN_REVOKED_PREFIX, USER_ENRICHER, USER_MESSAGES } from '../config';
+import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, TOKEN_REVOKED_PREFIX, USER_ENRICHER, USER_MESSAGES } from '../config';
 import { RegistrationDto } from '../dtos/authentication.dto';
 import { AppUser } from '../entities/app-user.entity';
 import { CompanyBranch } from '../entities/company-branch.entity';
@@ -528,7 +528,12 @@ export class AuthenticationService {
                 messageKey: AUTH_MESSAGES.BRANCH_NOT_FOUND
             });
         }
-        return this.generateLoginResponseWithCompany(user, company, branch);
+        const response = this.generateLoginResponseWithCompany(user, company, branch);
+        this.publishSessionEvent(AUTH_EVENT_ACTIONS.COMPANY_SWITCHED, user, {
+            companyId: company.id,
+            branchId: branch.id
+        });
+        return response;
     }
     async refreshToken(refreshToken) {
         try {
@@ -622,7 +627,7 @@ export class AuthenticationService {
                     }
                 }
             }
-            return generateTokens(this.jwtService, this.authConfig, {
+            const tokens = generateTokens(this.jwtService, this.authConfig, {
                 id: user.id,
                 email: user.email,
                 type: 'access',
@@ -634,6 +639,11 @@ export class AuthenticationService {
                     branchId: payload.branchId
                 }
             });
+            this.publishSessionEvent(AUTH_EVENT_ACTIONS.TOKEN_REFRESHED, user, {
+                companyId: payload.companyId ?? null,
+                branchId: payload.branchId ?? null
+            });
+            return tokens;
         } catch  {
             throw new UnauthorizedException({
                 message: 'Invalid or expired refresh token',
@@ -660,6 +670,7 @@ export class AuthenticationService {
         }
         user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
+        this.publishUserEvent(AUTH_EVENT_ACTIONS.PASSWORD_CHANGED, user);
     }
     async logout(userId) {
         if (!this.cacheManager) {
@@ -673,6 +684,17 @@ export class AuthenticationService {
         const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
         const ttlMs = parseExpiryToMs(refreshTokenExpiry);
         await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+        await publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity: AUTH_EVENT_ENTITIES.SESSION,
+            action: AUTH_EVENT_ACTIONS.LOGGED_OUT,
+            ids: [
+                userId
+            ],
+            user: {
+                id: userId
+            }
+        });
     }
     async isTokenRevoked(userId, tokenIssuedAt) {
         if (!this.cacheManager || !tokenIssuedAt) {
@@ -846,6 +868,7 @@ export class AuthenticationService {
             type: 'access'
         });
         this.sendLoginNotification(user.id);
+        this.publishSessionEvent(AUTH_EVENT_ACTIONS.LOGGED_IN, user);
         return {
             accessToken,
             refreshToken,
@@ -861,6 +884,10 @@ export class AuthenticationService {
             branchId: branch?.id
         });
         this.sendLoginNotification(user.id, company.id);
+        this.publishSessionEvent(AUTH_EVENT_ACTIONS.LOGGED_IN, user, {
+            companyId: company.id,
+            branchId: branch?.id ?? null
+        });
         return {
             accessToken,
             refreshToken,
@@ -907,16 +934,47 @@ export class AuthenticationService {
         };
     }
     generateRegistrationResponse(user) {
-        return {
+        const response = {
             ...this.generateLoginResponse(user),
             requiresEmailVerification: false
         };
+        this.publishUserEvent(AUTH_EVENT_ACTIONS.REGISTERED, user);
+        return response;
     }
     generateRegistrationResponseWithCompany(user, company, branch) {
-        return {
+        const response = {
             ...this.generateLoginResponseWithCompany(user, company, branch),
             requiresEmailVerification: false
         };
+        this.publishUserEvent(AUTH_EVENT_ACTIONS.REGISTERED, user, {
+            companyId: company.id,
+            branchId: branch?.id ?? null
+        });
+        return response;
+    }
+    publishSessionEvent(action, user, metadata = {}) {
+        this.publishAuthEvent(AUTH_EVENT_ENTITIES.SESSION, action, user, metadata);
+    }
+    publishUserEvent(action, user, metadata = {}) {
+        this.publishAuthEvent(AUTH_EVENT_ENTITIES.USER, action, user, metadata);
+    }
+    /** Never awaited - a login must not wait on, or fail because of, the event bus */ publishAuthEvent(entity, action, user, metadata) {
+        void publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity,
+            action,
+            ids: [
+                user.id
+            ],
+            metadata: {
+                email: user.email,
+                ...metadata
+            },
+            user: {
+                id: user.id,
+                email: user.email
+            }
+        });
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher, notificationAdapter){

package/fesm/services/authentication.service.spec.js

@@ -1,6 +1,7 @@
 import { BadRequestException, ForbiddenException, NotFoundException, UnauthorizedException } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import { createMockRepository } from '@test-utils/mocks/repository.mock';
+import { EventBusRegistry } from '@flusys/nestjs-shared/classes';
 import { AuthenticationService } from './authentication.service';
 import { AppUser } from '../entities/app-user.entity';
 import { Company } from '../entities/company.entity';
@@ -856,4 +857,61 @@ describe('AuthenticationService', ()=>{
             }));
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            EventBusRegistry.reset();
+            EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            EventBusRegistry.configureModule('auth', {
+                enabled: true
+            });
+        });
+        afterEach(()=>{
+            EventBusRegistry.reset();
+        });
+        it('publishes auth.session.logged-in when a session is issued', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            bcrypt.compare.mockResolvedValue(true);
+            const service = buildService();
+            await service.login('user@example.com', 'password');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.session.logged-in',
+                action: 'logged-in',
+                payload: expect.objectContaining({
+                    ids: [
+                        'user-1'
+                    ]
+                })
+            }));
+        });
+        it('publishes auth.session.logged-out on logout', async ()=>{
+            const service = buildService();
+            await service.logout('user-1');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.session.logged-out'
+            }));
+        });
+        it('publishes auth.appuser.password-changed after a successful password change', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            bcrypt.compare.mockResolvedValue(true);
+            const service = buildService();
+            await service.changePassword('user-1', 'old', 'new');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-changed'
+            }));
+        });
+        it('does not publish when the auth module has events disabled', async ()=>{
+            EventBusRegistry.configureModule('auth', {
+                enabled: false
+            });
+            const service = buildService();
+            await service.logout('user-1');
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/fesm/services/branch.service.js

@@ -29,8 +29,9 @@ import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { applyCompanyFilter } from '@flusys/nestjs-shared/utils';
-import { Inject, Injectable, Optional, Scope } from '@nestjs/common';
-import { In } from 'typeorm';
+import { ForbiddenException, Inject, Injectable, Optional, Scope } from '@nestjs/common';
+import { In, IsNull } from 'typeorm';
+import { BRANCH_MESSAGES } from '../config';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthConfigService } from './auth-config.service';
@@ -40,6 +41,24 @@ export class BranchService extends ApiService {
         const branchIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
+        await this.ensureDataSourceRepository();
+        const readonlyBranches = await this.repository.find({
+            where: {
+                id: In(branchIds),
+                readOnly: true,
+                deletedAt: IsNull()
+            }
+        });
+        if (readonlyBranches.length > 0) {
+            const names = readonlyBranches.map((b)=>b.name).join(', ');
+            throw new ForbiddenException({
+                message: `Cannot delete readonly branch(es): ${names}`,
+                messageKey: BRANCH_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         await queryRunner.manager.getRepository(UserCompanyPermission).delete({
             targetId: In(branchIds)
         });
@@ -67,6 +86,7 @@ export class BranchService extends ApiService {
                 'email',
                 'phone',
                 'isActive',
+                'readOnly',
                 'createdAt'
             ];
         }