@flusys/nestjs-auth 7.0.2 → 7.1.0

package/cjs/providers/google.social-provider.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "googleSocialProvider", {
+    enumerable: true,
+    get: function() {
+        return googleSocialProvider;
+    }
+});
+const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
+const _oauthhttputil = require("./oauth-http.util");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+const AUTHORIZE_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
+const TOKEN_URL = 'https://oauth2.googleapis.com/token';
+const USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo';
+let GoogleSocialProvider = class GoogleSocialProvider {
+    buildAuthorizationUrl(credentials, state) {
+        const query = (0, _oauthhttputil.buildQuery)({
+            client_id: credentials.clientId,
+            redirect_uri: credentials.redirectUri,
+            response_type: 'code',
+            scope: (0, _oauthhttputil.resolveScopes)(credentials, this.defaultScopes),
+            state,
+            access_type: 'online',
+            prompt: 'select_account'
+        });
+        return `${AUTHORIZE_URL}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await (0, _oauthhttputil.postForm)(this.provider, TOKEN_URL, {
+            code,
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            redirect_uri: credentials.redirectUri,
+            grant_type: 'authorization_code'
+        });
+        const profile = await (0, _oauthhttputil.getJson)(this.provider, USERINFO_URL, (0, _oauthhttputil.readAccessToken)(this.provider, token));
+        return {
+            providerUserId: (0, _oauthhttputil.readString)(profile, 'sub') ?? '',
+            email: (0, _oauthhttputil.readString)(profile, 'email'),
+            emailVerified: profile['email_verified'] === true,
+            name: (0, _oauthhttputil.readString)(profile, 'name'),
+            avatarUrl: (0, _oauthhttputil.readString)(profile, 'picture')
+        };
+    }
+    constructor(){
+        _define_property(this, "provider", _socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE);
+        _define_property(this, "defaultScopes", [
+            'openid',
+            'email',
+            'profile'
+        ]);
+    }
+};
+const googleSocialProvider = new GoogleSocialProvider();

package/cjs/providers/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+_export_star(require("./social-provider.registry"), exports);
+function _export_star(from, to) {
+    Object.keys(from).forEach(function(k) {
+        if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {
+            Object.defineProperty(to, k, {
+                enumerable: true,
+                get: function() {
+                    return from[k];
+                }
+            });
+        }
+    });
+    return from;
+}

package/cjs/providers/linkedin.social-provider.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "linkedInSocialProvider", {
+    enumerable: true,
+    get: function() {
+        return linkedInSocialProvider;
+    }
+});
+const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
+const _oauthhttputil = require("./oauth-http.util");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+const AUTHORIZE_URL = 'https://www.linkedin.com/oauth/v2/authorization';
+const TOKEN_URL = 'https://www.linkedin.com/oauth/v2/accessToken';
+const USERINFO_URL = 'https://api.linkedin.com/v2/userinfo';
+let LinkedInSocialProvider = class LinkedInSocialProvider {
+    buildAuthorizationUrl(credentials, state) {
+        const query = (0, _oauthhttputil.buildQuery)({
+            response_type: 'code',
+            client_id: credentials.clientId,
+            redirect_uri: credentials.redirectUri,
+            scope: (0, _oauthhttputil.resolveScopes)(credentials, this.defaultScopes),
+            state
+        });
+        return `${AUTHORIZE_URL}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await (0, _oauthhttputil.postForm)(this.provider, TOKEN_URL, {
+            grant_type: 'authorization_code',
+            code,
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            redirect_uri: credentials.redirectUri
+        });
+        const profile = await (0, _oauthhttputil.getJson)(this.provider, USERINFO_URL, (0, _oauthhttputil.readAccessToken)(this.provider, token));
+        return {
+            providerUserId: (0, _oauthhttputil.readString)(profile, 'sub') ?? '',
+            email: (0, _oauthhttputil.readString)(profile, 'email'),
+            emailVerified: profile['email_verified'] === true,
+            name: (0, _oauthhttputil.readString)(profile, 'name'),
+            avatarUrl: (0, _oauthhttputil.readString)(profile, 'picture')
+        };
+    }
+    constructor(){
+        _define_property(this, "provider", _socialprovidertypeenum.SocialProviderTypeEnum.LINKEDIN);
+        _define_property(this, "defaultScopes", [
+            'openid',
+            'profile',
+            'email'
+        ]);
+    }
+};
+const linkedInSocialProvider = new LinkedInSocialProvider();

package/cjs/providers/microsoft.social-provider.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "microsoftSocialProvider", {
+    enumerable: true,
+    get: function() {
+        return microsoftSocialProvider;
+    }
+});
+const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
+const _oauthhttputil = require("./oauth-http.util");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+const GRAPH_ME_URL = 'https://graph.microsoft.com/v1.0/me';
+const DEFAULT_TENANT = 'common';
+function resolveTenant(credentials) {
+    const tenantId = credentials.extraConfig?.['tenantId'];
+    return typeof tenantId === 'string' && tenantId ? tenantId : DEFAULT_TENANT;
+}
+function endpoint(credentials, action) {
+    return `https://login.microsoftonline.com/${resolveTenant(credentials)}/oauth2/v2.0/${action}`;
+}
+let MicrosoftSocialProvider = class MicrosoftSocialProvider {
+    buildAuthorizationUrl(credentials, state) {
+        const query = (0, _oauthhttputil.buildQuery)({
+            client_id: credentials.clientId,
+            response_type: 'code',
+            redirect_uri: credentials.redirectUri,
+            response_mode: 'query',
+            scope: (0, _oauthhttputil.resolveScopes)(credentials, this.defaultScopes),
+            state
+        });
+        return `${endpoint(credentials, 'authorize')}?${query}`;
+    }
+    async fetchProfile(credentials, code) {
+        const token = await (0, _oauthhttputil.postForm)(this.provider, endpoint(credentials, 'token'), {
+            client_id: credentials.clientId,
+            client_secret: credentials.clientSecret,
+            code,
+            redirect_uri: credentials.redirectUri,
+            grant_type: 'authorization_code',
+            scope: (0, _oauthhttputil.resolveScopes)(credentials, this.defaultScopes)
+        });
+        const profile = await (0, _oauthhttputil.getJson)(this.provider, GRAPH_ME_URL, (0, _oauthhttputil.readAccessToken)(this.provider, token));
+        // `mail` is Microsoft's confirmed mailbox claim; `userPrincipalName` is a sign-in
+        // identifier that is not guaranteed to be a verified, owned mailbox address.
+        const verifiedEmail = (0, _oauthhttputil.readString)(profile, 'mail');
+        return {
+            providerUserId: (0, _oauthhttputil.readString)(profile, 'id') ?? '',
+            email: verifiedEmail ?? (0, _oauthhttputil.readString)(profile, 'userPrincipalName'),
+            emailVerified: !!verifiedEmail,
+            name: (0, _oauthhttputil.readString)(profile, 'displayName'),
+            avatarUrl: null
+        };
+    }
+    constructor(){
+        _define_property(this, "provider", _socialprovidertypeenum.SocialProviderTypeEnum.MICROSOFT);
+        _define_property(this, "defaultScopes", [
+            'openid',
+            'profile',
+            'email',
+            'User.Read'
+        ]);
+    }
+};
+const microsoftSocialProvider = new MicrosoftSocialProvider();

package/cjs/providers/oauth-http.util.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get buildQuery () {
+        return buildQuery;
+    },
+    get getJson () {
+        return getJson;
+    },
+    get postForm () {
+        return postForm;
+    },
+    get readAccessToken () {
+        return readAccessToken;
+    },
+    get readString () {
+        return readString;
+    },
+    get resolveScopes () {
+        return resolveScopes;
+    }
+});
+const _common = require("@nestjs/common");
+const _messagekeys = require("../config/message-keys");
+const OAUTH_HTTP_TIMEOUT_MS = 10_000;
+function failExchange(provider, detail) {
+    throw new _common.UnauthorizedException({
+        message: `Social sign-in with ${provider} failed: ${detail}`,
+        messageKey: _messagekeys.SOCIAL_AUTH_MESSAGES.EXCHANGE_FAILED,
+        messageVariables: {
+            provider
+        }
+    });
+}
+async function fetchWithTimeout(provider, url, init) {
+    try {
+        return await fetch(url, {
+            ...init,
+            signal: AbortSignal.timeout(OAUTH_HTTP_TIMEOUT_MS)
+        });
+    } catch (error) {
+        if (error instanceof Error && error.name === 'TimeoutError') {
+            failExchange(provider, 'request timed out');
+        }
+        throw error;
+    }
+}
+async function readJson(provider, response) {
+    const body = await response.text();
+    if (!response.ok) {
+        failExchange(provider, `${response.status} ${body.slice(0, 200)}`);
+    }
+    try {
+        return JSON.parse(body);
+    } catch  {
+        return failExchange(provider, 'response was not JSON');
+    }
+}
+async function postForm(provider, url, form) {
+    const response = await fetchWithTimeout(provider, url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+            Accept: 'application/json'
+        },
+        body: new URLSearchParams(form).toString()
+    });
+    return readJson(provider, response);
+}
+async function getJson(provider, url, accessToken) {
+    const response = await fetchWithTimeout(provider, url, {
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            Accept: 'application/json'
+        }
+    });
+    return readJson(provider, response);
+}
+function readAccessToken(provider, token) {
+    const accessToken = token['access_token'];
+    if (typeof accessToken !== 'string' || !accessToken) {
+        failExchange(provider, 'no access token returned');
+    }
+    return accessToken;
+}
+function readString(source, key) {
+    const value = source[key];
+    return typeof value === 'string' && value ? value : null;
+}
+function buildQuery(params) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params)){
+        if (value) query.append(key, value);
+    }
+    return query.toString();
+}
+function resolveScopes(credentials, defaults, separator = ' ') {
+    return (credentials.scopes?.length ? credentials.scopes : defaults).join(separator);
+}

package/cjs/providers/social-provider.registry.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "getSocialProvider", {
+    enumerable: true,
+    get: function() {
+        return getSocialProvider;
+    }
+});
+const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
+const _facebooksocialprovider = require("./facebook.social-provider");
+const _googlesocialprovider = require("./google.social-provider");
+const _linkedinsocialprovider = require("./linkedin.social-provider");
+const _microsoftsocialprovider = require("./microsoft.social-provider");
+const PROVIDERS = {
+    [_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE]: _googlesocialprovider.googleSocialProvider,
+    [_socialprovidertypeenum.SocialProviderTypeEnum.FACEBOOK]: _facebooksocialprovider.facebookSocialProvider,
+    [_socialprovidertypeenum.SocialProviderTypeEnum.LINKEDIN]: _linkedinsocialprovider.linkedInSocialProvider,
+    [_socialprovidertypeenum.SocialProviderTypeEnum.MICROSOFT]: _microsoftsocialprovider.microsoftSocialProvider
+};
+function getSocialProvider(provider) {
+    return PROVIDERS[provider];
+}

package/cjs/providers/social-provider.registry.spec.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _common = require("@nestjs/common");
+const _socialprovidertypeenum = require("../enums/social-provider-type.enum");
+const _socialproviderregistry = require("./social-provider.registry");
+const CREDENTIALS = {
+    clientId: 'client-id',
+    clientSecret: 'client-secret',
+    redirectUri: 'http://localhost:2001/auth/social/callback'
+};
+function mockFetchSequence(...responses) {
+    const fetchMock = jest.fn();
+    for (const response of responses){
+        fetchMock.mockResolvedValueOnce({
+            ok: response.ok ?? true,
+            status: response.status ?? 200,
+            text: async ()=>JSON.stringify(response.body)
+        });
+    }
+    globalThis.fetch = fetchMock;
+    return fetchMock;
+}
+describe('social providers', ()=>{
+    afterEach(()=>jest.restoreAllMocks());
+    describe('buildAuthorizationUrl', ()=>{
+        it.each(Object.values(_socialprovidertypeenum.SocialProviderTypeEnum))('carries the client id, redirect URI and state for %s', (provider)=>{
+            const url = new URL((0, _socialproviderregistry.getSocialProvider)(provider).buildAuthorizationUrl(CREDENTIALS, 'state-token'));
+            expect(url.searchParams.get('client_id')).toBe('client-id');
+            expect(url.searchParams.get('redirect_uri')).toBe(CREDENTIALS.redirectUri);
+            expect(url.searchParams.get('state')).toBe('state-token');
+            expect(url.searchParams.get('scope')).toBeTruthy();
+        });
+        it('uses the configured scopes over the provider defaults', ()=>{
+            const url = new URL((0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE).buildAuthorizationUrl({
+                ...CREDENTIALS,
+                scopes: [
+                    'openid',
+                    'email'
+                ]
+            }, 'state-token'));
+            expect(url.searchParams.get('scope')).toBe('openid email');
+        });
+        it('targets the common Microsoft directory unless a tenant is configured', ()=>{
+            const provider = (0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.MICROSOFT);
+            expect(provider.buildAuthorizationUrl(CREDENTIALS, 'state-token')).toContain('login.microsoftonline.com/common/');
+            expect(provider.buildAuthorizationUrl({
+                ...CREDENTIALS,
+                extraConfig: {
+                    tenantId: 'contoso'
+                }
+            }, 'state-token')).toContain('login.microsoftonline.com/contoso/');
+        });
+    });
+    describe('fetchProfile', ()=>{
+        it('normalises a Google OpenID profile', async ()=>{
+            mockFetchSequence({
+                body: {
+                    access_token: 'token'
+                }
+            }, {
+                body: {
+                    sub: 'google-1',
+                    email: 'user@example.com',
+                    email_verified: true,
+                    name: 'Test User',
+                    picture: 'https://cdn.test/avatar.png'
+                }
+            });
+            const profile = await (0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE).fetchProfile(CREDENTIALS, 'code');
+            expect(profile).toEqual({
+                providerUserId: 'google-1',
+                email: 'user@example.com',
+                emailVerified: true,
+                name: 'Test User',
+                avatarUrl: 'https://cdn.test/avatar.png'
+            });
+        });
+        it('reads the nested avatar Facebook returns', async ()=>{
+            mockFetchSequence({
+                body: {
+                    access_token: 'token'
+                }
+            }, {
+                body: {
+                    id: 'fb-1',
+                    name: 'Test User',
+                    email: 'user@example.com',
+                    picture: {
+                        data: {
+                            url: 'https://cdn.test/fb.png'
+                        }
+                    }
+                }
+            });
+            const profile = await (0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.FACEBOOK).fetchProfile(CREDENTIALS, 'code');
+            expect(profile.avatarUrl).toBe('https://cdn.test/fb.png');
+            expect(profile.emailVerified).toBe(true);
+        });
+        it('falls back to the Microsoft principal name when no mailbox is set', async ()=>{
+            mockFetchSequence({
+                body: {
+                    access_token: 'token'
+                }
+            }, {
+                body: {
+                    id: 'ms-1',
+                    displayName: 'Test User',
+                    userPrincipalName: 'user@contoso.com'
+                }
+            });
+            const profile = await (0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.MICROSOFT).fetchProfile(CREDENTIALS, 'code');
+            expect(profile.email).toBe('user@contoso.com');
+        });
+        it('rejects when the token endpoint fails', async ()=>{
+            mockFetchSequence({
+                ok: false,
+                status: 400,
+                body: {
+                    error: 'invalid_grant'
+                }
+            });
+            await expect((0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.LINKEDIN).fetchProfile(CREDENTIALS, 'code')).rejects.toThrow(_common.UnauthorizedException);
+        });
+        it('rejects when the token response carries no access token', async ()=>{
+            mockFetchSequence({
+                body: {
+                    token_type: 'bearer'
+                }
+            });
+            await expect((0, _socialproviderregistry.getSocialProvider)(_socialprovidertypeenum.SocialProviderTypeEnum.GOOGLE).fetchProfile(CREDENTIALS, 'code')).rejects.toThrow(_common.UnauthorizedException);
+        });
+    });
+});

package/cjs/services/auth-config.service.js

@@ -55,6 +55,9 @@ let AuthConfigService = class AuthConfigService {
     isEmailVerificationEnabled() {
         return this.options.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
+    isSignUpEnabled() {
+        return this.options.bootstrapAppConfig?.enableSignUp ?? true;
+    }
     isPermissionModeFound() {
         return this.options.bootstrapAppConfig?.permissionMode !== undefined;
     }

package/cjs/services/auth-config.service.spec.js

@@ -21,6 +21,7 @@ describe('AuthConfigService', ()=>{
             expect(service.isMultiTenant()).toBe(false);
             expect(service.isCompanyFeatureEnabled()).toBe(false);
             expect(service.isEmailVerificationEnabled()).toBe(true);
+            expect(service.isSignUpEnabled()).toBe(true);
             expect(service.isPermissionModeFound()).toBe(false);
         });
         it('throws when reading the JWT secret without configuration', ()=>{
@@ -53,6 +54,7 @@ describe('AuthConfigService', ()=>{
                     databaseMode: 'multi-tenant',
                     enableCompanyFeature: true,
                     enableEmailVerification: false,
+                    enableSignUp: false,
                     permissionMode: 'RBAC'
                 },
                 config: {
@@ -74,6 +76,7 @@ describe('AuthConfigService', ()=>{
             const service = new _authconfigservice.AuthConfigService(buildOptions());
             expect(service.isCompanyFeatureEnabled()).toBe(true);
             expect(service.isEmailVerificationEnabled()).toBe(false);
+            expect(service.isSignUpEnabled()).toBe(false);
             expect(service.isPermissionModeFound()).toBe(true);
         });
         it('returns configured JWT and refresh token values', ()=>{

package/cjs/services/auth-datasource.provider.js

@@ -99,6 +99,10 @@ let AuthDataSourceProvider = class AuthDataSourceProvider extends _nestjsshared.
         const effectiveTenant = tenant ?? this.getCurrentTenant();
         return effectiveTenant?.enableEmailVerification ?? this.authOptions.bootstrapAppConfig?.enableEmailVerification ?? true;
     }
+    isSignUpEnabled(tenant) {
+        const effectiveTenant = tenant ?? this.getCurrentTenant();
+        return effectiveTenant?.enableSignUp ?? this.authOptions.bootstrapAppConfig?.enableSignUp ?? true;
+    }
     async getAuthEntities() {
         const { getAuthEntitiesByConfig } = await Promise.resolve().then(()=>/*#__PURE__*/ _interop_require_wildcard(require("../entities")));
         return getAuthEntitiesByConfig({

package/cjs/services/auth-datasource.provider.spec.js

@@ -82,6 +82,36 @@ describe('AuthDataSourceProvider', ()=>{
             })).toBe(false);
         });
     });
+    describe('isSignUpEnabled', ()=>{
+        it('returns true by default (sign-up defaults to enabled)', ()=>{
+            const provider = new _authdatasourceprovider.AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: undefined
+            }));
+            expect(provider.isSignUpEnabled()).toBe(true);
+        });
+        it('returns false when bootstrap config disables it', ()=>{
+            const provider = new _authdatasourceprovider.AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'single',
+                    enableCompanyFeature: false,
+                    enableSignUp: false
+                }
+            }));
+            expect(provider.isSignUpEnabled()).toBe(false);
+        });
+        it('prefers the tenant override over bootstrap config', ()=>{
+            const provider = new _authdatasourceprovider.AuthDataSourceProvider(buildOptions({
+                bootstrapAppConfig: {
+                    databaseMode: 'multi-tenant',
+                    enableCompanyFeature: true,
+                    enableSignUp: true
+                }
+            }));
+            expect(provider.isSignUpEnabled({
+                enableSignUp: false
+            })).toBe(false);
+        });
+    });
     describe('getAuthEntities', ()=>{
         it('returns only base entities when company feature and email verification are disabled', async ()=>{
             const provider = new _authdatasourceprovider.AuthDataSourceProvider(buildOptions({

package/cjs/services/authentication.service.js

@@ -108,6 +108,9 @@ let AuthenticationService = class AuthenticationService {
         const providerAvailable = this.authEmailService?.isEmailEnabled() ?? false;
         return featureEnabled && providerAvailable;
     }
+    isSignUpEnabled() {
+        return this.dataSourceProvider?.isSignUpEnabled() ?? this.authConfig.isSignUpEnabled();
+    }
     async getUserRepository() {
         if (!this.dataSourceProvider) {
             throw new _common.InternalServerErrorException({
@@ -134,12 +137,7 @@ let AuthenticationService = class AuthenticationService {
             };
         }
         const user = await this.validateUser(email, password);
-        if (!user.isActive) {
-            throw new _common.ForbiddenException({
-                message: 'User account is deactivated',
-                messageKey: _config.AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED
-            });
-        }
+        this.ensureUserActive(user);
         if (this.isEmailVerificationEnabled() && !user.emailVerified) {
             return {
                 requiresEmailVerification: true,
@@ -148,11 +146,23 @@ let AuthenticationService = class AuthenticationService {
                 messageKey: _config.AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED
             };
         }
+        return this.issueLoginForUser(user);
+    }
+    async issueLoginForUser(user) {
+        this.ensureUserActive(user);
         if (!this.isCompanyFeatureEnabled()) {
             return this.generateLoginResponse(user);
         }
         return await this.handleCompanyBasedLogin(user);
     }
+    ensureUserActive(user) {
+        if (!user.isActive) {
+            throw new _common.ForbiddenException({
+                message: 'User account is deactivated',
+                messageKey: _config.AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED
+            });
+        }
+    }
     async handleCompanyBasedLogin(user) {
         const permissionRepository = await this.getCompanyScopedRepository(_usercompanypermissionentity.UserCompanyPermission);
         const branchRepository = await this.getCompanyScopedRepository(_companybranchentity.CompanyBranch);
@@ -200,8 +210,15 @@ let AuthenticationService = class AuthenticationService {
         const existingUser = await userRepository.findOne({
             where: {
                 email: dto.email
-            }
+            },
+            withDeleted: true
         });
+        if (existingUser?.deletedAt) {
+            throw new _common.BadRequestException({
+                message: 'This account has been permanently deleted. Please contact your system administrator.',
+                messageKey: _config.AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED
+            });
+        }
         if (existingUser && this.isCompanyFeatureEnabled()) {
             return await this.handleExistingUserCompanyRegistration(existingUser, dto);
         }
@@ -211,6 +228,12 @@ let AuthenticationService = class AuthenticationService {
                 messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
             });
         }
+        if (!this.isSignUpEnabled()) {
+            throw new _common.BadRequestException({
+                message: 'New account registration is currently disabled.',
+                messageKey: _config.AUTH_MESSAGES.REGISTER_SIGNUP_DISABLED
+            });
+        }
         if (this.isEmailVerificationEnabled() && verifyUrlBase) {
             const companyData = this.isCompanyFeatureEnabled() ? {
                 companySlug: dto.companySlug,
@@ -338,8 +361,15 @@ let AuthenticationService = class AuthenticationService {
             const existingUser = await queryRunner.manager.findOne(_appuserentity.AppUser, {
                 where: {
                     email: pending.email
-                }
+                },
+                withDeleted: true
             });
+            if (existingUser?.deletedAt) {
+                throw new _common.BadRequestException({
+                    message: 'This account has been permanently deleted. Please contact your system administrator.',
+                    messageKey: _config.AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED
+                });
+            }
             if (existingUser) {
                 throw new _common.BadRequestException({
                     message: 'This email has already been registered.',