@flusys/nestjs-auth 7.1.0 → 8.0.0

package/cjs/services/authentication.service.js

@@ -1,1203 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "AuthenticationService", {
-    enumerable: true,
-    get: function() {
-        return AuthenticationService;
-    }
-});
-const _nestjsshared = require("@flusys/nestjs-shared");
-const _classes = require("@flusys/nestjs-shared/classes");
-const _constants = require("@flusys/nestjs-shared/constants");
-const _enums = require("@flusys/nestjs-shared/enums");
-const _interfaces = require("@flusys/nestjs-shared/interfaces");
-const _utils = require("@flusys/nestjs-shared/utils");
-const _common = require("@nestjs/common");
-const _jwt = require("@nestjs/jwt");
-const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
-const _config = require("../config");
-const _authenticationdto = require("../dtos/authentication.dto");
-const _appuserentity = require("../entities/app-user.entity");
-const _companybranchentity = require("../entities/company-branch.entity");
-const _companyentity = require("../entities/company.entity");
-const _pendingregistrationentity = require("../entities/pending-registration.entity");
-const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-const _enums1 = require("../enums");
-const _helpers = require("../helpers");
-const _userenricherinterface = require("../interfaces/user-enricher.interface");
-const _authconfigservice = require("./auth-config.service");
-const _authdatasourceprovider = require("./auth-datasource.provider");
-const _authemailservice = require("./auth-email.service");
-const _companyselectionsessionservice = require("./company-selection-session.service");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _getRequireWildcardCache(nodeInterop) {
-    if (typeof WeakMap !== "function") return null;
-    var cacheBabelInterop = new WeakMap();
-    var cacheNodeInterop = new WeakMap();
-    return (_getRequireWildcardCache = function(nodeInterop) {
-        return nodeInterop ? cacheNodeInterop : cacheBabelInterop;
-    })(nodeInterop);
-}
-function _interop_require_wildcard(obj, nodeInterop) {
-    if (!nodeInterop && obj && obj.__esModule) {
-        return obj;
-    }
-    if (obj === null || typeof obj !== "object" && typeof obj !== "function") {
-        return {
-            default: obj
-        };
-    }
-    var cache = _getRequireWildcardCache(nodeInterop);
-    if (cache && cache.has(obj)) {
-        return cache.get(obj);
-    }
-    var newObj = {
-        __proto__: null
-    };
-    var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor;
-    for(var key in obj){
-        if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) {
-            var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null;
-            if (desc && (desc.get || desc.set)) {
-                Object.defineProperty(newObj, key, desc);
-            } else {
-                newObj[key] = obj[key];
-            }
-        }
-    }
-    newObj.default = obj;
-    if (cache) {
-        cache.set(obj, newObj);
-    }
-    return newObj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-let AuthenticationService = class AuthenticationService {
-    isCompanyFeatureEnabled() {
-        return this.dataSourceProvider?.isCompanyFeatureEnabled() ?? this.authConfig.isCompanyFeatureEnabled();
-    }
-    isEmailVerificationEnabled() {
-        const featureEnabled = this.dataSourceProvider?.isEmailVerificationEnabled() ?? this.authConfig.isEmailVerificationEnabled();
-        const providerAvailable = this.authEmailService?.isEmailEnabled() ?? false;
-        return featureEnabled && providerAvailable;
-    }
-    isSignUpEnabled() {
-        return this.dataSourceProvider?.isSignUpEnabled() ?? this.authConfig.isSignUpEnabled();
-    }
-    async getUserRepository() {
-        if (!this.dataSourceProvider) {
-            throw new _common.InternalServerErrorException({
-                message: 'User repository not available',
-                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'AppUser'
-                }
-            });
-        }
-        return this.dataSourceProvider.getRepository(_appuserentity.AppUser);
-    }
-    async getCompanyScopedRepository(entity) {
-        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
-        return this.dataSourceProvider.getRepository(entity);
-    }
-    async login(email, password) {
-        if (this.isEmailVerificationEnabled() && await this.authEmailService.hasPendingRegistration(email)) {
-            return {
-                requiresEmailVerification: true,
-                email,
-                message: 'Please verify your email address to complete registration.',
-                messageKey: _config.EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT
-            };
-        }
-        const user = await this.validateUser(email, password);
-        this.ensureUserActive(user);
-        if (this.isEmailVerificationEnabled() && !user.emailVerified) {
-            return {
-                requiresEmailVerification: true,
-                email: user.email,
-                message: 'Please verify your email address before logging in.',
-                messageKey: _config.AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED
-            };
-        }
-        return this.issueLoginForUser(user);
-    }
-    async issueLoginForUser(user) {
-        this.ensureUserActive(user);
-        if (!this.isCompanyFeatureEnabled()) {
-            return this.generateLoginResponse(user);
-        }
-        return await this.handleCompanyBasedLogin(user);
-    }
-    ensureUserActive(user) {
-        if (!user.isActive) {
-            throw new _common.ForbiddenException({
-                message: 'User account is deactivated',
-                messageKey: _config.AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED
-            });
-        }
-    }
-    async handleCompanyBasedLogin(user) {
-        const permissionRepository = await this.getCompanyScopedRepository(_usercompanypermissionentity.UserCompanyPermission);
-        const branchRepository = await this.getCompanyScopedRepository(_companybranchentity.CompanyBranch);
-        if (!permissionRepository || !branchRepository) {
-            return this.generateLoginResponse(user);
-        }
-        const companyPermissions = await permissionRepository.find({
-            where: {
-                userId: user.id,
-                permissionType: _enums1.PermissionType.COMPANY
-            }
-        });
-        const companyRepository = await this.getCompanyScopedRepository(_companyentity.Company);
-        if (!companyRepository) {
-            return this.generateLoginResponse(user);
-        }
-        const companyIds = companyPermissions.map((p)=>p.targetId);
-        const companies = companyIds.length > 0 ? await companyRepository.createQueryBuilder('c').where('c.id IN (:...ids)', {
-            ids: companyIds
-        }).andWhere('c.is_active = :active', {
-            active: true
-        }).getMany() : [];
-        if (companies.length === 0) {
-            return this.generateLoginResponse(user);
-        }
-        const branchPermissions = await permissionRepository.find({
-            where: {
-                userId: user.id,
-                permissionType: _enums1.PermissionType.BRANCH
-            }
-        });
-        const branchIds = branchPermissions.map((p)=>p.targetId);
-        const branches = branchIds.length > 0 ? await branchRepository.createQueryBuilder('b').leftJoinAndSelect('b.company', 'company').where('b.id IN (:...ids)', {
-            ids: branchIds
-        }).andWhere('b.is_active = :active', {
-            active: true
-        }).getMany() : [];
-        if (companies.length === 1 && branches.length === 1) {
-            return this.generateLoginResponseWithCompany(user, companies[0], branches[0]);
-        }
-        return await this.generateCompanySelectionResponse(user, companies, branches);
-    }
-    async register(dto, verifyUrlBase) {
-        const userRepository = await this.getUserRepository();
-        const existingUser = await userRepository.findOne({
-            where: {
-                email: dto.email
-            },
-            withDeleted: true
-        });
-        if (existingUser?.deletedAt) {
-            throw new _common.BadRequestException({
-                message: 'This account has been permanently deleted. Please contact your system administrator.',
-                messageKey: _config.AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED
-            });
-        }
-        if (existingUser && this.isCompanyFeatureEnabled()) {
-            return await this.handleExistingUserCompanyRegistration(existingUser, dto);
-        }
-        if (existingUser) {
-            throw new _common.BadRequestException({
-                message: 'Registration failed due to email exists. Please try again or contact support.',
-                messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
-            });
-        }
-        if (!this.isSignUpEnabled()) {
-            throw new _common.BadRequestException({
-                message: 'New account registration is currently disabled.',
-                messageKey: _config.AUTH_MESSAGES.REGISTER_SIGNUP_DISABLED
-            });
-        }
-        if (this.isEmailVerificationEnabled() && verifyUrlBase) {
-            const companyData = this.isCompanyFeatureEnabled() ? {
-                companySlug: dto.companySlug,
-                branchSlug: dto.branchSlug,
-                newCompanyName: dto.newCompanyName,
-                newCompanyPhone: dto.newCompanyPhone,
-                newCompanyAddress: dto.newCompanyAddress
-            } : undefined;
-            const result = await this.authEmailService.createPendingRegistration({
-                email: dto.email,
-                name: dto.name,
-                phone: dto.phone,
-                password: dto.password,
-                companyData,
-                additionalFields: dto.additionalFields,
-                verifyUrlBase
-            });
-            return {
-                requiresEmailVerification: true,
-                message: result.message,
-                messageKey: _config.EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT
-            };
-        }
-        return await this.createUserDirectly(dto);
-    }
-    async handleExistingUserCompanyRegistration(existingUser, dto) {
-        if (!dto.companySlug && !dto.newCompanyName) {
-            throw new _common.BadRequestException({
-                message: 'Email already registered. Please login or provide a company to join/create.',
-                messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
-            });
-        }
-        const permissionRepository = await this.getCompanyScopedRepository(_usercompanypermissionentity.UserCompanyPermission);
-        const companyRepository = await this.getCompanyScopedRepository(_companyentity.Company);
-        if (!permissionRepository || !companyRepository) {
-            throw new _common.BadRequestException({
-                message: 'Company feature repositories not available',
-                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Company feature'
-                }
-            });
-        }
-        if (dto.companySlug) {
-            const company = await companyRepository.findOne({
-                where: {
-                    slug: dto.companySlug,
-                    isActive: true
-                }
-            });
-            if (company) {
-                const existingPermission = await permissionRepository.findOne({
-                    where: {
-                        userId: existingUser.id,
-                        permissionType: _enums1.PermissionType.COMPANY,
-                        targetId: company.id
-                    }
-                });
-                if (existingPermission) {
-                    throw new _common.BadRequestException({
-                        message: 'You are already assigned to this company. Please login.',
-                        messageKey: _config.AUTH_MESSAGES.REGISTER_COMPANY_ALREADY_ASSIGNED
-                    });
-                }
-            }
-        }
-        return await this.processCompanyRegistration(existingUser, dto, true);
-    }
-    async createUserDirectly(dto) {
-        if (!this.dataSourceProvider) {
-            throw new _common.BadRequestException({
-                message: 'Data source not available',
-                messageKey: _constants.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
-            });
-        }
-        const dataSource = await this.dataSourceProvider.getDataSource();
-        const queryRunner = dataSource.createQueryRunner();
-        await queryRunner.connect();
-        await queryRunner.startTransaction();
-        try {
-            const hashedPassword = await _bcrypt.hash(dto.password, _config.BCRYPT_SALT_ROUNDS);
-            const user = queryRunner.manager.create(_appuserentity.AppUser, {
-                name: dto.name,
-                email: dto.email,
-                phone: dto.phone,
-                password: hashedPassword,
-                isActive: true,
-                emailVerified: false,
-                phoneVerified: false
-            });
-            await queryRunner.manager.save(_appuserentity.AppUser, user);
-            if (this.userEnricher?.onUserCreated) {
-                await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
-            }
-            await queryRunner.commitTransaction();
-            if (!this.isCompanyFeatureEnabled()) {
-                return this.generateRegistrationResponse(user);
-            }
-            return await this.processCompanyRegistration(user, dto);
-        } catch (error) {
-            await queryRunner.rollbackTransaction();
-            if (error instanceof _common.BadRequestException) {
-                throw error;
-            }
-            throw new _common.BadRequestException({
-                message: 'Registration failed. Please try again.',
-                messageKey: _config.AUTH_MESSAGES.REGISTER_FAILED
-            });
-        } finally{
-            await queryRunner.release();
-        }
-    }
-    async createUserFromPendingRegistration(pending) {
-        if (!this.dataSourceProvider) {
-            throw new _common.BadRequestException({
-                message: 'Data source not available',
-                messageKey: _constants.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
-            });
-        }
-        const dataSource = await this.dataSourceProvider.getDataSource();
-        const queryRunner = dataSource.createQueryRunner();
-        await queryRunner.connect();
-        await queryRunner.startTransaction();
-        try {
-            const existingUser = await queryRunner.manager.findOne(_appuserentity.AppUser, {
-                where: {
-                    email: pending.email
-                },
-                withDeleted: true
-            });
-            if (existingUser?.deletedAt) {
-                throw new _common.BadRequestException({
-                    message: 'This account has been permanently deleted. Please contact your system administrator.',
-                    messageKey: _config.AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED
-                });
-            }
-            if (existingUser) {
-                throw new _common.BadRequestException({
-                    message: 'This email has already been registered.',
-                    messageKey: _config.AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
-                });
-            }
-            const user = queryRunner.manager.create(_appuserentity.AppUser, {
-                name: pending.name,
-                email: pending.email,
-                phone: pending.phone,
-                password: pending.passwordHash,
-                isActive: true,
-                emailVerified: true,
-                phoneVerified: false
-            });
-            await queryRunner.manager.save(_appuserentity.AppUser, user);
-            if (this.userEnricher?.onUserCreated) {
-                await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
-            }
-            await queryRunner.commitTransaction();
-            if (this.isCompanyFeatureEnabled() && pending.companyData) {
-                return await this.processCompanyRegistration(user, pending.companyData);
-            }
-            return this.generateRegistrationResponse(user);
-        } catch (error) {
-            await queryRunner.rollbackTransaction();
-            if (error instanceof _common.BadRequestException) {
-                throw error;
-            }
-            throw new _common.BadRequestException({
-                message: 'Registration failed. Please try again.',
-                messageKey: _config.AUTH_MESSAGES.REGISTER_FAILED
-            });
-        } finally{
-            await queryRunner.release();
-        }
-    }
-    async processCompanyRegistration(user, data, throwOnUnavailable = false) {
-        const companyRepository = await this.getCompanyScopedRepository(_companyentity.Company);
-        const branchRepository = await this.getCompanyScopedRepository(_companybranchentity.CompanyBranch);
-        const permissionRepository = await this.getCompanyScopedRepository(_usercompanypermissionentity.UserCompanyPermission);
-        if (!companyRepository || !branchRepository || !permissionRepository) {
-            if (throwOnUnavailable) throw new _common.BadRequestException({
-                message: 'Company feature repositories not available',
-                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Company feature'
-                }
-            });
-            return this.generateRegistrationResponse(user);
-        }
-        const { company, branch } = await this.findOrCreateCompanyAndBranch(data, companyRepository, branchRepository);
-        if (company) {
-            await this.assignUserPermissions(user.id, company.id, branch?.id, permissionRepository);
-            return this.generateRegistrationResponseWithCompany(user, company, branch ?? undefined);
-        }
-        return this.generateRegistrationResponse(user);
-    }
-    async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
-        if (data.companySlug) {
-            const company = await companyRepo.findOne({
-                where: {
-                    slug: data.companySlug,
-                    isActive: true
-                }
-            });
-            if (!company) throw new _common.BadRequestException({
-                message: 'Company not found or inactive',
-                messageKey: _config.AUTH_MESSAGES.COMPANY_NOT_FOUND
-            });
-            const branch = data.branchSlug ? await branchRepo.findOne({
-                where: {
-                    slug: data.branchSlug,
-                    companyId: company.id,
-                    isActive: true
-                }
-            }) : await branchRepo.findOne({
-                where: {
-                    companyId: company.id,
-                    isActive: true
-                },
-                order: {
-                    serial: 'ASC',
-                    createdAt: 'ASC'
-                }
-            });
-            if (data.branchSlug && !branch) throw new _common.BadRequestException({
-                message: 'Branch not found or inactive',
-                messageKey: _config.AUTH_MESSAGES.BRANCH_NOT_FOUND
-            });
-            return {
-                company,
-                branch
-            };
-        }
-        if (data.newCompanyName) {
-            const slug = await (0, _utils.generateUniqueSlug)(data.newCompanyName, async (baseSlug)=>{
-                const rows = await companyRepo.createQueryBuilder('c').select('c.slug').where('c.slug = :base OR c.slug LIKE :pattern', {
-                    base: baseSlug,
-                    pattern: `${baseSlug}-%`
-                }).getMany();
-                return rows.map((r)=>r.slug);
-            });
-            const company = companyRepo.create({
-                name: data.newCompanyName,
-                slug,
-                phone: data.newCompanyPhone,
-                address: data.newCompanyAddress,
-                isActive: true
-            });
-            await companyRepo.save(company);
-            const branch = branchRepo.create({
-                name: 'Main Branch',
-                slug: 'main-branch',
-                companyId: company.id,
-                isActive: true
-            });
-            await branchRepo.save(branch);
-            return {
-                company,
-                branch
-            };
-        }
-        return {
-            company: null,
-            branch: null
-        };
-    }
-    async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
-        await permissionRepo.save(permissionRepo.create({
-            userId,
-            permissionType: _enums1.PermissionType.COMPANY,
-            targetId: companyId
-        }));
-        if (branchId) {
-            await permissionRepo.save(permissionRepo.create({
-                userId,
-                permissionType: _enums1.PermissionType.BRANCH,
-                targetId: branchId
-            }));
-        }
-    }
-    async select(sessionId, companyId, branchId) {
-        this.ensureCompanyFeatureEnabled();
-        if (!this.sessionService) {
-            throw new _common.BadRequestException({
-                message: 'Session service not available',
-                messageKey: _config.AUTH_MESSAGES.SESSION_NOT_AVAILABLE
-            });
-        }
-        const session = await this.sessionService.consumeSession(sessionId);
-        if (!session) {
-            throw new _common.UnauthorizedException({
-                message: 'Invalid or expired session',
-                messageKey: _config.AUTH_MESSAGES.SESSION_INVALID
-            });
-        }
-        return await this.validateAndLoginWithCompany(session.userId, companyId, branchId);
-    }
-    async switchCompany(userId, companyId, branchId) {
-        this.ensureCompanyFeatureEnabled();
-        return await this.validateAndLoginWithCompany(userId, companyId, branchId);
-    }
-    async validateAndLoginWithCompany(userId, companyId, branchId) {
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!user) {
-            throw new _common.NotFoundException({
-                message: 'User not found',
-                messageKey: _config.USER_MESSAGES.NOT_FOUND
-            });
-        }
-        const permissionRepository = await this.getCompanyScopedRepository(_usercompanypermissionentity.UserCompanyPermission);
-        const companyRepository = await this.getCompanyScopedRepository(_companyentity.Company);
-        const branchRepository = await this.getCompanyScopedRepository(_companybranchentity.CompanyBranch);
-        if (!permissionRepository || !companyRepository || !branchRepository) {
-            throw new _common.BadRequestException({
-                message: 'Repositories not available',
-                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Some'
-                }
-            });
-        }
-        const hasCompanyAccess = await permissionRepository.findOne({
-            where: {
-                userId,
-                permissionType: _enums1.PermissionType.COMPANY,
-                targetId: companyId
-            }
-        });
-        if (!hasCompanyAccess) {
-            throw new _common.ForbiddenException({
-                message: 'No access to this company',
-                messageKey: _config.AUTH_MESSAGES.COMPANY_NO_ACCESS
-            });
-        }
-        const company = await companyRepository.findOne({
-            where: {
-                id: companyId,
-                isActive: true
-            }
-        });
-        if (!company) {
-            throw new _common.NotFoundException({
-                message: 'Company not found or inactive',
-                messageKey: _config.AUTH_MESSAGES.COMPANY_NOT_FOUND
-            });
-        }
-        const hasBranchAccess = await permissionRepository.findOne({
-            where: {
-                userId,
-                permissionType: _enums1.PermissionType.BRANCH,
-                targetId: branchId
-            }
-        });
-        if (!hasBranchAccess) {
-            throw new _common.ForbiddenException({
-                message: 'No access to this branch',
-                messageKey: _config.AUTH_MESSAGES.BRANCH_NO_ACCESS
-            });
-        }
-        const branch = await branchRepository.findOne({
-            where: {
-                id: branchId,
-                companyId,
-                isActive: true
-            }
-        });
-        if (!branch) {
-            throw new _common.NotFoundException({
-                message: 'Branch not found or inactive',
-                messageKey: _config.AUTH_MESSAGES.BRANCH_NOT_FOUND
-            });
-        }
-        const response = this.generateLoginResponseWithCompany(user, company, branch);
-        this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.SESSION, _config.AUTH_EVENT_ACTIONS.COMPANY_SWITCHED, user, {
-            companyId: company.id,
-            branchId: branch.id
-        });
-        return response;
-    }
-    async refreshToken(refreshToken) {
-        try {
-            const payload = this.jwtService.verify(refreshToken, {
-                secret: this.authConfig.getRefreshTokenSecret(),
-                algorithms: [
-                    'HS256'
-                ]
-            });
-            if (await this.isTokenRevoked(payload.id, payload.iat)) {
-                throw new _common.UnauthorizedException({
-                    message: 'Token has been revoked',
-                    messageKey: _config.AUTH_MESSAGES.TOKEN_REVOKED
-                });
-            }
-            const userRepository = await this.getUserRepository();
-            const user = await userRepository.findOne({
-                where: {
-                    id: payload.id
-                }
-            });
-            if (!user || !user.isActive) {
-                throw new _common.UnauthorizedException({
-                    message: 'Invalid refresh token',
-                    messageKey: _config.AUTH_MESSAGES.TOKEN_INVALID
-                });
-            }
-            if (payload.companyId) {
-                const companyRepository = await this.getCompanyScopedRepository(_companyentity.Company);
-                const permissionRepository = await this.getCompanyScopedRepository(_usercompanypermissionentity.UserCompanyPermission);
-                if (companyRepository) {
-                    const company = await companyRepository.findOne({
-                        where: {
-                            id: payload.companyId,
-                            isActive: true
-                        }
-                    });
-                    if (!company) {
-                        throw new _common.UnauthorizedException({
-                            message: 'Company not found or inactive',
-                            messageKey: _config.AUTH_MESSAGES.COMPANY_NOT_FOUND
-                        });
-                    }
-                }
-                if (permissionRepository) {
-                    const hasCompanyAccess = await permissionRepository.findOne({
-                        where: {
-                            userId: user.id,
-                            permissionType: _enums1.PermissionType.COMPANY,
-                            targetId: payload.companyId
-                        }
-                    });
-                    if (!hasCompanyAccess) {
-                        throw new _common.UnauthorizedException({
-                            message: 'No access to this company',
-                            messageKey: _config.AUTH_MESSAGES.COMPANY_NO_ACCESS
-                        });
-                    }
-                }
-                if (payload.branchId) {
-                    const branchRepository = await this.getCompanyScopedRepository(_companybranchentity.CompanyBranch);
-                    if (branchRepository) {
-                        const branch = await branchRepository.findOne({
-                            where: {
-                                id: payload.branchId,
-                                companyId: payload.companyId,
-                                isActive: true
-                            }
-                        });
-                        if (!branch) {
-                            throw new _common.UnauthorizedException({
-                                message: 'Branch not found or inactive',
-                                messageKey: _config.AUTH_MESSAGES.BRANCH_NOT_FOUND
-                            });
-                        }
-                    }
-                    if (permissionRepository) {
-                        const hasBranchAccess = await permissionRepository.findOne({
-                            where: {
-                                userId: user.id,
-                                permissionType: _enums1.PermissionType.BRANCH,
-                                targetId: payload.branchId
-                            }
-                        });
-                        if (!hasBranchAccess) {
-                            throw new _common.UnauthorizedException({
-                                message: 'No access to this branch',
-                                messageKey: _config.AUTH_MESSAGES.BRANCH_NO_ACCESS
-                            });
-                        }
-                    }
-                }
-            }
-            const tokens = (0, _helpers.generateTokens)(this.jwtService, this.authConfig, {
-                id: user.id,
-                email: user.email,
-                type: 'access',
-                profilePictureId: user.profilePictureId ?? undefined,
-                ...payload.companyId && {
-                    companyId: payload.companyId
-                },
-                ...payload.branchId && {
-                    branchId: payload.branchId
-                }
-            });
-            this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.SESSION, _config.AUTH_EVENT_ACTIONS.TOKEN_REFRESHED, user, {
-                companyId: payload.companyId ?? null,
-                branchId: payload.branchId ?? null
-            });
-            return tokens;
-        } catch  {
-            throw new _common.UnauthorizedException({
-                message: 'Invalid or expired refresh token',
-                messageKey: _config.AUTH_MESSAGES.TOKEN_EXPIRED
-            });
-        }
-    }
-    async changePassword(userId, currentPassword, newPassword) {
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!user) throw new _common.UnauthorizedException({
-            message: 'User not found',
-            messageKey: _config.USER_MESSAGES.NOT_FOUND
-        });
-        if (!await _bcrypt.compare(currentPassword, user.password || '')) {
-            throw new _common.UnauthorizedException({
-                message: 'Current password is incorrect',
-                messageKey: _config.AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT
-            });
-        }
-        user.password = await _bcrypt.hash(newPassword, _config.BCRYPT_SALT_ROUNDS);
-        await userRepository.save(user);
-        this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.USER, _config.AUTH_EVENT_ACTIONS.PASSWORD_CHANGED, user);
-    }
-    async logout(userId) {
-        if (!this.cacheManager) {
-            throw new _common.BadRequestException({
-                message: 'Logout service temporarily unavailable. Please try again later.',
-                messageKey: _config.AUTH_MESSAGES.LOGOUT_SERVICE_UNAVAILABLE
-            });
-        }
-        const revokedAt = Math.floor(Date.now() / 1000);
-        const cacheKey = `${_config.TOKEN_REVOKED_PREFIX}:${userId}`;
-        const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
-        const ttlMs = (0, _helpers.parseExpiryToMs)(refreshTokenExpiry);
-        await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
-        await (0, _classes.publishDomainEvent)({
-            module: _config.AUTH_EVENT_MODULE,
-            entity: _config.AUTH_EVENT_ENTITIES.SESSION,
-            action: _config.AUTH_EVENT_ACTIONS.LOGGED_OUT,
-            ids: [
-                userId
-            ],
-            user: {
-                id: userId
-            }
-        });
-    }
-    async isTokenRevoked(userId, tokenIssuedAt) {
-        if (!this.cacheManager || !tokenIssuedAt) {
-            return false;
-        }
-        const cacheKey = `${_config.TOKEN_REVOKED_PREFIX}:${userId}`;
-        const revokedAt = await this.cacheManager.get(cacheKey);
-        if (!revokedAt) {
-            return false;
-        }
-        return tokenIssuedAt < revokedAt;
-    }
-    async getUserCompanies(userId) {
-        this.ensureCompanyFeatureEnabled();
-        const permissionRepository = await this.getCompanyScopedRepository(_usercompanypermissionentity.UserCompanyPermission);
-        const companyRepository = await this.getCompanyScopedRepository(_companyentity.Company);
-        if (!permissionRepository || !companyRepository) {
-            throw new _common.BadRequestException({
-                message: 'Repositories not available',
-                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Some'
-                }
-            });
-        }
-        const permissions = await permissionRepository.find({
-            where: {
-                userId,
-                permissionType: _enums1.PermissionType.COMPANY
-            }
-        });
-        const companyIds = permissions.map((p)=>p.targetId);
-        if (companyIds.length === 0) return [];
-        return companyRepository.createQueryBuilder('c').where('c.id IN (:...ids)', {
-            ids: companyIds
-        }).andWhere('c.is_active = :active', {
-            active: true
-        }).orderBy('c.name', 'ASC').getMany();
-    }
-    async getUserBranches(userId, companyId) {
-        this.ensureCompanyFeatureEnabled();
-        const permissionRepository = await this.getCompanyScopedRepository(_usercompanypermissionentity.UserCompanyPermission);
-        const branchRepository = await this.getCompanyScopedRepository(_companybranchentity.CompanyBranch);
-        if (!permissionRepository || !branchRepository) {
-            throw new _common.BadRequestException({
-                message: 'Repositories not available',
-                messageKey: _constants.SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Some'
-                }
-            });
-        }
-        const companyPermission = await permissionRepository.findOne({
-            where: {
-                userId,
-                permissionType: _enums1.PermissionType.COMPANY,
-                targetId: companyId
-            }
-        });
-        if (!companyPermission) {
-            throw new _common.UnauthorizedException({
-                message: 'No access to this company',
-                messageKey: _config.AUTH_MESSAGES.COMPANY_NO_ACCESS
-            });
-        }
-        const branchPermissions = await permissionRepository.find({
-            where: {
-                userId,
-                permissionType: _enums1.PermissionType.BRANCH
-            }
-        });
-        const branchIds = branchPermissions.map((p)=>p.targetId);
-        if (branchIds.length === 0) return [];
-        return branchRepository.createQueryBuilder('b').where('b.id IN (:...ids)', {
-            ids: branchIds
-        }).andWhere('b.company_id = :companyId', {
-            companyId
-        }).andWhere('b.is_active = :active', {
-            active: true
-        }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
-    }
-    async getCompanyById(companyId) {
-        const companyRepository = await this.getCompanyScopedRepository(_companyentity.Company);
-        if (!companyRepository) {
-            return null;
-        }
-        return companyRepository.findOne({
-            where: {
-                id: companyId
-            }
-        });
-    }
-    async getBranchById(branchId) {
-        const branchRepository = await this.getCompanyScopedRepository(_companybranchentity.CompanyBranch);
-        if (!branchRepository) {
-            return null;
-        }
-        return branchRepository.findOne({
-            where: {
-                id: branchId
-            }
-        });
-    }
-    async getUserInfo(userId, companyId, branchId) {
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!user) throw new _common.UnauthorizedException({
-            message: 'User not found',
-            messageKey: _config.USER_MESSAGES.NOT_FOUND
-        });
-        const response = {
-            user: (0, _helpers.toUserInfo)(user)
-        };
-        if (this.isCompanyFeatureEnabled()) {
-            if (!companyId) {
-                throw new _common.UnauthorizedException({
-                    message: 'Company feature is enabled but user has no company assigned.',
-                    messageKey: _config.AUTH_MESSAGES.COMPANY_REQUIRED
-                });
-            }
-            const company = await this.getCompanyById(companyId);
-            if (!company) throw new _common.UnauthorizedException({
-                message: 'Company not found.',
-                messageKey: _config.AUTH_MESSAGES.COMPANY_NOT_FOUND
-            });
-            response.company = (0, _helpers.toCompanyInfo)(company);
-            if (branchId) {
-                const branch = await this.getBranchById(branchId);
-                if (!branch) throw new _common.UnauthorizedException({
-                    message: 'Branch not found.',
-                    messageKey: _config.AUTH_MESSAGES.BRANCH_NOT_FOUND
-                });
-                response.branch = (0, _helpers.toBranchInfo)(branch);
-            }
-        }
-        return response;
-    }
-    ensureCompanyFeatureEnabled() {
-        if (!this.isCompanyFeatureEnabled()) {
-            throw new _common.BadRequestException({
-                message: 'Company feature is not enabled',
-                messageKey: _config.AUTH_MESSAGES.COMPANY_FEATURE_NOT_ENABLED
-            });
-        }
-    }
-    async validateUser(email, password) {
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                email
-            }
-        });
-        if (!user || !await _bcrypt.compare(password, user.password || '')) {
-            throw new _common.UnauthorizedException({
-                message: 'Invalid credentials',
-                messageKey: _config.AUTH_MESSAGES.LOGIN_INVALID_CREDENTIALS
-            });
-        }
-        user.lastLoginAt = new Date();
-        await userRepository.save(user);
-        return user;
-    }
-    generateLoginResponse(user) {
-        const { accessToken, refreshToken } = (0, _helpers.generateTokens)(this.jwtService, this.authConfig, {
-            id: user.id,
-            email: user.email,
-            type: 'access'
-        });
-        this.sendLoginNotification(user.id);
-        this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.SESSION, _config.AUTH_EVENT_ACTIONS.LOGGED_IN, user);
-        return {
-            accessToken,
-            refreshToken,
-            user: (0, _helpers.toUserInfo)(user)
-        };
-    }
-    generateLoginResponseWithCompany(user, company, branch) {
-        const { accessToken, refreshToken } = (0, _helpers.generateTokens)(this.jwtService, this.authConfig, {
-            id: user.id,
-            email: user.email,
-            type: 'access',
-            companyId: company.id,
-            branchId: branch?.id
-        });
-        this.sendLoginNotification(user.id, company.id);
-        this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.SESSION, _config.AUTH_EVENT_ACTIONS.LOGGED_IN, user, {
-            companyId: company.id,
-            branchId: branch?.id ?? null
-        });
-        return {
-            accessToken,
-            refreshToken,
-            user: (0, _helpers.toUserInfo)(user),
-            company: (0, _helpers.toCompanyInfo)(company),
-            branch: branch ? (0, _helpers.toBranchInfo)(branch) : undefined
-        };
-    }
-    sendLoginNotification(userId, companyId) {
-        if (!this.notificationAdapter) return;
-        this.notificationAdapter.send({
-            userId,
-            title: 'Login successful',
-            message: 'You have successfully logged in to your account.',
-            type: _enums.NotificationType.INFO,
-            companyId,
-            realtime: false
-        }).catch(()=>{
-        // Silent failure - notification is non-critical
-        });
-    }
-    async generateCompanySelectionResponse(user, companies, branches) {
-        if (!this.sessionService) {
-            throw new _common.BadRequestException({
-                message: 'Session service not available',
-                messageKey: _config.AUTH_MESSAGES.SESSION_NOT_AVAILABLE
-            });
-        }
-        const sessionId = await this.sessionService.createSession(user.id);
-        const companiesWithBranches = companies.map((company)=>({
-                ...(0, _helpers.toCompanyInfo)(company),
-                isActive: company.isActive,
-                branches: branches.filter((b)=>b.companyId === company.id).map((b)=>({
-                        ...(0, _helpers.toBranchInfo)(b),
-                        isActive: b.isActive
-                    }))
-            }));
-        return {
-            requiresSelection: true,
-            sessionId,
-            expiresAt: new Date(Date.now() + 5 * 60 * 1000),
-            user: (0, _helpers.toUserInfo)(user),
-            companies: companiesWithBranches
-        };
-    }
-    generateRegistrationResponse(user) {
-        const response = {
-            ...this.generateLoginResponse(user),
-            requiresEmailVerification: false
-        };
-        this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.USER, _config.AUTH_EVENT_ACTIONS.REGISTERED, user);
-        return response;
-    }
-    generateRegistrationResponseWithCompany(user, company, branch) {
-        const response = {
-            ...this.generateLoginResponseWithCompany(user, company, branch),
-            requiresEmailVerification: false
-        };
-        this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.USER, _config.AUTH_EVENT_ACTIONS.REGISTERED, user, {
-            companyId: company.id,
-            branchId: branch?.id ?? null
-        });
-        return response;
-    }
-    /** Never awaited - a login must not wait on, or fail because of, the event bus */ publishAuthEvent(entity, action, user, metadata = {}) {
-        void (0, _classes.publishDomainEvent)({
-            module: _config.AUTH_EVENT_MODULE,
-            entity,
-            action,
-            ids: [
-                user.id
-            ],
-            metadata: {
-                email: user.email,
-                ...metadata
-            },
-            user: {
-                id: user.id,
-                email: user.email
-            }
-        });
-    }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher, notificationAdapter){
-        _define_property(this, "jwtService", void 0);
-        _define_property(this, "authConfig", void 0);
-        _define_property(this, "cacheManager", void 0);
-        _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "sessionService", void 0);
-        _define_property(this, "authEmailService", void 0);
-        _define_property(this, "userEnricher", void 0);
-        _define_property(this, "notificationAdapter", void 0);
-        this.jwtService = jwtService;
-        this.authConfig = authConfig;
-        this.cacheManager = cacheManager;
-        this.dataSourceProvider = dataSourceProvider;
-        this.sessionService = sessionService;
-        this.authEmailService = authEmailService;
-        this.userEnricher = userEnricher;
-        this.notificationAdapter = notificationAdapter;
-    }
-};
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.login',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "login", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.register',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authenticationdto.RegistrationDto === "undefined" ? Object : _authenticationdto.RegistrationDto,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "register", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.createUser',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authenticationdto.RegistrationDto === "undefined" ? Object : _authenticationdto.RegistrationDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "createUserDirectly", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.createUserFromPending',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _pendingregistrationentity.PendingRegistration === "undefined" ? Object : _pendingregistrationentity.PendingRegistration
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "createUserFromPendingRegistration", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.companySwitch',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "validateAndLoginWithCompany", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.refreshToken',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "refreshToken", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.changePassword',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "changePassword", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'auth.logout',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "logout", null);
-AuthenticationService = _ts_decorate([
-    (0, _common.Injectable)({
-        scope: _common.Scope.REQUEST
-    }),
-    _ts_param(0, (0, _common.Inject)(_jwt.JwtService)),
-    _ts_param(1, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
-    _ts_param(2, (0, _common.Optional)()),
-    _ts_param(2, (0, _common.Inject)('CACHE_INSTANCE')),
-    _ts_param(3, (0, _common.Optional)()),
-    _ts_param(3, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
-    _ts_param(4, (0, _common.Optional)()),
-    _ts_param(4, (0, _common.Inject)(_companyselectionsessionservice.CompanySelectionSessionService)),
-    _ts_param(5, (0, _common.Optional)()),
-    _ts_param(5, (0, _common.Inject)(_authemailservice.AuthEmailService)),
-    _ts_param(6, (0, _common.Optional)()),
-    _ts_param(6, (0, _common.Inject)(_config.USER_ENRICHER)),
-    _ts_param(7, (0, _common.Optional)()),
-    _ts_param(7, (0, _common.Inject)(_interfaces.NOTIFICATION_ADAPTER)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _jwt.JwtService === "undefined" ? Object : _jwt.JwtService,
-        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
-        typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
-        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
-        typeof _companyselectionsessionservice.CompanySelectionSessionService === "undefined" ? Object : _companyselectionsessionservice.CompanySelectionSessionService,
-        typeof _authemailservice.AuthEmailService === "undefined" ? Object : _authemailservice.AuthEmailService,
-        typeof _userenricherinterface.IUserEnricher === "undefined" ? Object : _userenricherinterface.IUserEnricher,
-        typeof _interfaces.INotificationAdapter === "undefined" ? Object : _interfaces.INotificationAdapter
-    ])
-], AuthenticationService);