@flusys/nestjs-auth 7.1.0 → 8.0.0-beta.1

package/cjs/controllers/authentication.controller.js

@@ -1,427 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "AuthenticationController", {
-    enumerable: true,
-    get: function() {
-        return AuthenticationController;
-    }
-});
-const _nestjsshared = require("@flusys/nestjs-shared");
-const _decorators = require("@flusys/nestjs-shared/decorators");
-const _dtos = require("@flusys/nestjs-shared/dtos");
-const _guards = require("@flusys/nestjs-shared/guards");
-const _interfaces = require("@flusys/nestjs-shared/interfaces");
-const _common = require("@nestjs/common");
-const _swagger = require("@nestjs/swagger");
-const _throttler = require("@nestjs/throttler");
-const _express = require("express");
-const _config = require("../config");
-const _authenticationdto = require("../dtos/authentication.dto");
-const _cleartokeninterceptor = require("../interceptors/clear-token.interceptor");
-const _settokeninterceptor = require("../interceptors/set-token.interceptor");
-const _authconfigservice = require("../services/auth-config.service");
-const _authenticationservice = require("../services/authentication.service");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-let AuthenticationController = class AuthenticationController {
-    async login(loginDto) {
-        const result = await this.authService.login(loginDto.email, loginDto.password);
-        if ('requiresEmailVerification' in result) {
-            return {
-                success: true,
-                message: 'Email verification required',
-                messageKey: _config.AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED,
-                data: result
-            };
-        }
-        if ('requiresSelection' in result) {
-            return {
-                success: true,
-                message: 'Company selection required',
-                messageKey: _config.AUTH_MESSAGES.LOGIN_REQUIRES_SELECTION,
-                data: result
-            };
-        }
-        return {
-            success: true,
-            message: 'Login successful',
-            messageKey: _config.AUTH_MESSAGES.LOGIN_SUCCESS,
-            data: result
-        };
-    }
-    /** Register new user. If company feature enabled, can join/create company. */ async register(req, registrationDto) {
-        const verifyUrlBase = (0, _nestjsshared.buildFrontendUrl)(req, '/auth/verify-email');
-        const result = await this.authService.register(registrationDto, verifyUrlBase);
-        return {
-            success: true,
-            message: result.requiresEmailVerification ? 'Verification email sent' : 'Registration successful',
-            messageKey: result.requiresEmailVerification ? _config.EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT : _config.AUTH_MESSAGES.REGISTER_SUCCESS,
-            data: result
-        };
-    }
-    /**
-   * Refresh access token.
-   * - **Browser**: Prefers HTTP-only cookie, falls back to body if cookie missing.
-   * - **API/Mobile**: Must send `refreshToken` in request body. Set header `x-client-type: mobile` or `x-client-type: api`.
-   */ async refreshToken(req, refreshTokenDto) {
-        const cookieName = this.authConfig?.getRefreshTokenCookieName() ?? _config.DEFAULT_COOKIE_NAME;
-        // Always check cookie first, then body - handles Browser, SSR, and Mobile/API
-        const refreshToken = req.cookies?.[cookieName] || refreshTokenDto.refreshToken;
-        if (!refreshToken) {
-            throw new _common.UnauthorizedException({
-                message: 'Refresh token is required',
-                messageKey: _config.AUTH_MESSAGES.TOKEN_REQUIRED
-            });
-        }
-        const data = await this.authService.refreshToken(refreshToken);
-        return {
-            success: true,
-            message: 'Token refreshed successfully',
-            messageKey: _config.AUTH_MESSAGES.REFRESH_SUCCESS,
-            data
-        };
-    }
-    /** Get current user info. Returns user, company, and branch data (no tokens). */ async getCurrentUser(user) {
-        const data = await this.authService.getUserInfo(user.id, user.companyId, user.branchId);
-        return {
-            success: true,
-            message: 'User info retrieved successfully',
-            messageKey: _config.AUTH_MESSAGES.ME_SUCCESS,
-            data
-        };
-    }
-    /** Logout - Clears refresh token cookie for browsers */ async logout(userId) {
-        await this.authService.logout(userId);
-        return {
-            success: true,
-            message: 'Logged out successfully',
-            messageKey: _config.AUTH_MESSAGES.LOGOUT_SUCCESS
-        };
-    }
-    async changePassword(userId, dto) {
-        await this.authService.changePassword(userId, dto.currentPassword, dto.newPassword);
-        return {
-            success: true,
-            message: 'Password changed successfully',
-            messageKey: _config.AUTH_MESSAGES.PASSWORD_CHANGE_SUCCESS
-        };
-    }
-    constructor(authService, authConfig){
-        _define_property(this, "authService", void 0);
-        _define_property(this, "authConfig", void 0);
-        this.authService = authService;
-        this.authConfig = authConfig;
-    }
-};
-_ts_decorate([
-    (0, _common.Post)('login'),
-    (0, _common.HttpCode)(_common.HttpStatus.OK),
-    (0, _throttler.Throttle)({
-        default: {
-            limit: 5,
-            ttl: 60000
-        }
-    }),
-    (0, _common.UseInterceptors)(_settokeninterceptor.SetToken),
-    (0, _swagger.ApiOperation)({
-        summary: 'User login'
-    }),
-    (0, _swagger.ApiBody)({
-        type: _authenticationdto.LoginDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        description: 'Login successful, requires company selection, or requires email verification',
-        content: {
-            'application/json': {
-                examples: {
-                    loginSuccess: {
-                        summary: 'Login Success',
-                        value: {
-                            success: true,
-                            message: 'Login successful',
-                            messageKey: 'auth.login.success',
-                            data: {
-                                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
-                                user: {
-                                    id: '550e8400-e29b-41d4-a716-446655440000',
-                                    email: 'john@example.com',
-                                    name: 'John Doe'
-                                }
-                            }
-                        }
-                    },
-                    loginSuccessWithCompany: {
-                        summary: 'Login Success (with company/branch)',
-                        value: {
-                            success: true,
-                            message: 'Login successful',
-                            messageKey: 'auth.login.success',
-                            data: {
-                                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
-                                user: {
-                                    id: '550e8400-e29b-41d4-a716-446655440000',
-                                    email: 'john@example.com',
-                                    name: 'John Doe'
-                                },
-                                company: {
-                                    id: 'company-id',
-                                    name: 'Acme Corp'
-                                },
-                                branch: {
-                                    id: 'branch-id',
-                                    name: 'Main Branch'
-                                }
-                            }
-                        }
-                    },
-                    companySelection: {
-                        summary: 'Company Selection Required',
-                        value: {
-                            success: true,
-                            message: 'Company selection required',
-                            messageKey: 'auth.login.requires.selection',
-                            data: {
-                                requiresSelection: true,
-                                sessionId: 'sess_abc123def456',
-                                expiresAt: '2024-12-18T15:30:00.000Z',
-                                user: {
-                                    id: '550e8400-e29b-41d4-a716-446655440000',
-                                    email: 'john@example.com'
-                                },
-                                companies: [
-                                    {
-                                        id: 'company-id',
-                                        name: 'Acme Corp',
-                                        slug: 'acme-corp',
-                                        branches: [
-                                            {
-                                                id: 'branch-id',
-                                                name: 'Main Branch',
-                                                slug: 'main-branch'
-                                            }
-                                        ]
-                                    }
-                                ]
-                            }
-                        }
-                    },
-                    emailVerification: {
-                        summary: 'Email Verification Required',
-                        value: {
-                            success: true,
-                            message: 'Email verification required',
-                            messageKey: 'auth.login.email.not.verified',
-                            data: {
-                                requiresEmailVerification: true,
-                                email: 'john@example.com'
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }),
-    _ts_param(0, (0, _common.Body)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authenticationdto.LoginDto === "undefined" ? Object : _authenticationdto.LoginDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "login", null);
-_ts_decorate([
-    (0, _common.Post)('register'),
-    (0, _common.HttpCode)(_common.HttpStatus.CREATED),
-    (0, _throttler.Throttle)({
-        default: {
-            limit: 3,
-            ttl: 60000
-        }
-    }),
-    (0, _common.UseInterceptors)(_settokeninterceptor.SetToken),
-    (0, _swagger.ApiOperation)({
-        summary: 'Register new user'
-    }),
-    (0, _swagger.ApiBody)({
-        type: _authenticationdto.RegistrationDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 201,
-        description: 'Registration successful or email verification required'
-    }),
-    _ts_param(0, (0, _common.Req)()),
-    _ts_param(1, (0, _common.Body)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _express.Request === "undefined" ? Object : _express.Request,
-        typeof _authenticationdto.RegistrationDto === "undefined" ? Object : _authenticationdto.RegistrationDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "register", null);
-_ts_decorate([
-    (0, _common.Post)('refresh'),
-    (0, _common.HttpCode)(_common.HttpStatus.OK),
-    (0, _throttler.Throttle)({
-        default: {
-            limit: 30,
-            ttl: 60000
-        }
-    }),
-    (0, _swagger.ApiOperation)({
-        summary: 'Refresh access token',
-        description: `
-**Browser clients**: Refresh token is read from HTTP-only cookie (automatically set on login/register).
-Falls back to request body if cookie is not available.
-
-**API/Mobile clients**: Must send \`refreshToken\` in request body.
-Set header \`x-client-type: mobile\` or \`x-client-type: api\` to identify as non-browser client.
-
-**Client detection**: Uses \`x-client-type\` header first, then falls back to User-Agent detection.
-    `
-    }),
-    (0, _swagger.ApiHeader)({
-        name: 'x-client-type',
-        required: false,
-        description: 'Client type: "browser"/"web" for cookie-based auth, "mobile"/"api" for body-based auth',
-        example: 'mobile'
-    }),
-    (0, _swagger.ApiBody)({
-        type: _authenticationdto.RefreshTokenDto,
-        description: 'Required for API/Mobile clients. Browser clients prefer HTTP-only cookie with body fallback.'
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        description: 'Token refreshed successfully',
-        schema: {
-            example: {
-                success: true,
-                message: 'Token refreshed successfully',
-                messageKey: 'auth.refresh.success',
-                data: {
-                    accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
-                }
-            }
-        }
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 401,
-        description: 'Invalid or missing refresh token'
-    }),
-    _ts_param(0, (0, _common.Req)()),
-    _ts_param(1, (0, _common.Body)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _express.Request === "undefined" ? Object : _express.Request,
-        typeof _authenticationdto.RefreshTokenDto === "undefined" ? Object : _authenticationdto.RefreshTokenDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "refreshToken", null);
-_ts_decorate([
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
-    (0, _common.Post)('me'),
-    (0, _throttler.SkipThrottle)(),
-    (0, _swagger.ApiBearerAuth)(),
-    (0, _swagger.ApiOperation)({
-        summary: 'Get current user info'
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        description: 'Current user info retrieved successfully'
-    }),
-    _ts_param(0, (0, _decorators.CurrentUser)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _interfaces.ILoggedUserInfo === "undefined" ? Object : _interfaces.ILoggedUserInfo
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "getCurrentUser", null);
-_ts_decorate([
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
-    (0, _common.Post)('logout'),
-    (0, _common.HttpCode)(_common.HttpStatus.OK),
-    (0, _throttler.SkipThrottle)(),
-    (0, _common.UseInterceptors)(_cleartokeninterceptor.ClearToken),
-    (0, _swagger.ApiBearerAuth)(),
-    (0, _swagger.ApiOperation)({
-        summary: 'Logout user'
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        type: _dtos.MessageResponseDto
-    }),
-    _ts_param(0, (0, _decorators.CurrentUser)('id')),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "logout", null);
-_ts_decorate([
-    (0, _common.UseGuards)(_guards.JwtAuthGuard),
-    (0, _common.Post)('change-password'),
-    (0, _common.HttpCode)(_common.HttpStatus.OK),
-    (0, _throttler.Throttle)({
-        default: {
-            limit: 5,
-            ttl: 60000
-        }
-    }),
-    (0, _swagger.ApiBearerAuth)(),
-    (0, _swagger.ApiOperation)({
-        summary: 'Change password'
-    }),
-    (0, _swagger.ApiBody)({
-        type: _authenticationdto.ChangePasswordDto
-    }),
-    (0, _swagger.ApiResponse)({
-        status: 200,
-        type: _dtos.MessageResponseDto
-    }),
-    _ts_param(0, (0, _decorators.CurrentUser)('id')),
-    _ts_param(1, (0, _common.Body)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        typeof _authenticationdto.ChangePasswordDto === "undefined" ? Object : _authenticationdto.ChangePasswordDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "changePassword", null);
-AuthenticationController = _ts_decorate([
-    (0, _swagger.ApiTags)('Authentication'),
-    (0, _common.Controller)('auth'),
-    _ts_param(0, (0, _common.Inject)(_authenticationservice.AuthenticationService)),
-    _ts_param(1, (0, _common.Optional)()),
-    _ts_param(1, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authenticationservice.AuthenticationService === "undefined" ? Object : _authenticationservice.AuthenticationService,
-        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService
-    ])
-], AuthenticationController);

package/cjs/controllers/authentication.controller.spec.js

@@ -1,219 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _common = require("@nestjs/common");
-const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
-const _authenticationcontroller = require("./authentication.controller");
-describe('AuthenticationController', ()=>{
-    let controller;
-    let mockAuthService;
-    let mockAuthConfig;
-    beforeEach(()=>{
-        mockAuthService = {
-            login: jest.fn(),
-            register: jest.fn(),
-            refreshToken: jest.fn(),
-            getUserInfo: jest.fn(),
-            logout: jest.fn(),
-            changePassword: jest.fn()
-        };
-        mockAuthConfig = {
-            getRefreshTokenCookieName: jest.fn().mockReturnValue('fsn_refresh_token')
-        };
-        controller = new _authenticationcontroller.AuthenticationController(mockAuthService, mockAuthConfig);
-    });
-    describe('login', ()=>{
-        it('wraps a standard login response', async ()=>{
-            mockAuthService.login.mockResolvedValue({
-                accessToken: 'a',
-                refreshToken: 'r',
-                user: {
-                    id: 'u1',
-                    email: 'u@example.com'
-                }
-            });
-            const result = await controller.login({
-                email: 'u@example.com',
-                password: 'pw'
-            });
-            expect(result).toEqual(expect.objectContaining({
-                success: true,
-                data: expect.objectContaining({
-                    accessToken: 'a'
-                })
-            }));
-            expect(mockAuthService.login).toHaveBeenCalledWith('u@example.com', 'pw');
-        });
-        it('wraps a company-selection-required response', async ()=>{
-            mockAuthService.login.mockResolvedValue({
-                requiresSelection: true,
-                sessionId: 'sess-1'
-            });
-            const result = await controller.login({
-                email: 'u@example.com',
-                password: 'pw'
-            });
-            expect(result.message).toBe('Company selection required');
-            expect(result.data).toEqual(expect.objectContaining({
-                requiresSelection: true
-            }));
-        });
-        it('wraps an email-verification-required response', async ()=>{
-            mockAuthService.login.mockResolvedValue({
-                requiresEmailVerification: true,
-                email: 'u@example.com'
-            });
-            const result = await controller.login({
-                email: 'u@example.com',
-                password: 'pw'
-            });
-            expect(result.message).toBe('Email verification required');
-            expect(result.data).toEqual(expect.objectContaining({
-                requiresEmailVerification: true
-            }));
-        });
-        it('propagates errors thrown by the service', async ()=>{
-            mockAuthService.login.mockRejectedValue(new _common.UnauthorizedException('bad creds'));
-            await expect(controller.login({
-                email: 'u@example.com',
-                password: 'wrong'
-            })).rejects.toThrow(_common.UnauthorizedException);
-        });
-    });
-    describe('register', ()=>{
-        it('reports success message when registration completes without verification', async ()=>{
-            mockAuthService.register.mockResolvedValue({
-                accessToken: 'a',
-                user: {
-                    id: 'u1'
-                },
-                requiresEmailVerification: false
-            });
-            const req = {
-                headers: {},
-                get: jest.fn((h)=>h === 'host' ? 'app.example.com' : undefined),
-                protocol: 'https'
-            };
-            const result = await controller.register(req, {
-                name: 'New',
-                email: 'new@example.com',
-                password: 'Password1!'
-            });
-            expect(result.message).toBe('Registration successful');
-            expect(result.success).toBe(true);
-        });
-        it('reports verification-sent message when email verification is required', async ()=>{
-            mockAuthService.register.mockResolvedValue({
-                requiresEmailVerification: true,
-                user: {
-                    id: 'u1'
-                }
-            });
-            const req = {
-                headers: {},
-                get: jest.fn((h)=>h === 'host' ? 'app.example.com' : undefined),
-                protocol: 'https'
-            };
-            const result = await controller.register(req, {
-                name: 'New',
-                email: 'new@example.com',
-                password: 'Password1!'
-            });
-            expect(result.message).toBe('Verification email sent');
-        });
-    });
-    describe('refreshToken', ()=>{
-        it('reads the refresh token from the cookie first', async ()=>{
-            mockAuthService.refreshToken.mockResolvedValue({
-                accessToken: 'new-token'
-            });
-            const req = {
-                cookies: {
-                    fsn_refresh_token: 'cookie-token'
-                }
-            };
-            await controller.refreshToken(req, {
-                refreshToken: 'body-token'
-            });
-            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('cookie-token');
-        });
-        it('falls back to the request body when no cookie is present', async ()=>{
-            mockAuthService.refreshToken.mockResolvedValue({
-                accessToken: 'new-token'
-            });
-            const req = {
-                cookies: {}
-            };
-            await controller.refreshToken(req, {
-                refreshToken: 'body-token'
-            });
-            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('body-token');
-        });
-        it('throws UnauthorizedException when no refresh token is available', async ()=>{
-            const req = {
-                cookies: {}
-            };
-            await expect(controller.refreshToken(req, {})).rejects.toThrow(_common.UnauthorizedException);
-            expect(mockAuthService.refreshToken).not.toHaveBeenCalled();
-        });
-        it('uses the default cookie name when authConfig is unavailable', async ()=>{
-            controller = new _authenticationcontroller.AuthenticationController(mockAuthService, undefined);
-            mockAuthService.refreshToken.mockResolvedValue({
-                accessToken: 'new-token'
-            });
-            const req = {
-                cookies: {
-                    fsn_refresh_token: 'cookie-token'
-                }
-            };
-            await controller.refreshToken(req, {});
-            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('cookie-token');
-        });
-    });
-    describe('getCurrentUser', ()=>{
-        it('delegates to authService.getUserInfo with the current user context', async ()=>{
-            mockAuthService.getUserInfo.mockResolvedValue({
-                user: {
-                    id: 'u1'
-                }
-            });
-            const user = (0, _loggedusermock.buildMockUser)();
-            const result = await controller.getCurrentUser(user);
-            expect(mockAuthService.getUserInfo).toHaveBeenCalledWith(user.id, user.companyId, user.branchId);
-            expect(result.data).toEqual({
-                user: {
-                    id: 'u1'
-                }
-            });
-        });
-    });
-    describe('logout', ()=>{
-        it('delegates to authService.logout and returns a success message', async ()=>{
-            const result = await controller.logout('user-1');
-            expect(mockAuthService.logout).toHaveBeenCalledWith('user-1');
-            expect(result).toEqual(expect.objectContaining({
-                success: true
-            }));
-        });
-    });
-    describe('changePassword', ()=>{
-        it('delegates to authService.changePassword', async ()=>{
-            const result = await controller.changePassword('user-1', {
-                currentPassword: 'old',
-                newPassword: 'New1!aaaa'
-            });
-            expect(mockAuthService.changePassword).toHaveBeenCalledWith('user-1', 'old', 'New1!aaaa');
-            expect(result).toEqual(expect.objectContaining({
-                success: true
-            }));
-        });
-        it('propagates errors from an invalid current password', async ()=>{
-            mockAuthService.changePassword.mockRejectedValue(new _common.UnauthorizedException());
-            await expect(controller.changePassword('user-1', {
-                currentPassword: 'wrong',
-                newPassword: 'New1!aaaa'
-            })).rejects.toThrow(_common.UnauthorizedException);
-        });
-    });
-});