@flusys/nestjs-auth 7.1.0 → 8.0.0

package/fesm/controllers/authentication.controller.js

@@ -1,417 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { buildFrontendUrl } from '@flusys/nestjs-shared';
-import { CurrentUser } from '@flusys/nestjs-shared/decorators';
-import { MessageResponseDto } from '@flusys/nestjs-shared/dtos';
-import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
-import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
-import { Body, Controller, HttpCode, HttpStatus, Inject, Optional, Post, Req, UnauthorizedException, UseGuards, UseInterceptors } from '@nestjs/common';
-import { ApiBearerAuth, ApiBody, ApiHeader, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
-import { SkipThrottle, Throttle } from '@nestjs/throttler';
-import { Request } from 'express';
-import { AUTH_MESSAGES, DEFAULT_COOKIE_NAME, EMAIL_VERIFICATION_MESSAGES } from '../config';
-import { ChangePasswordDto, LoginDto, RefreshTokenDto, RegistrationDto } from '../dtos/authentication.dto';
-import { ClearToken } from '../interceptors/clear-token.interceptor';
-import { SetToken } from '../interceptors/set-token.interceptor';
-import { AuthConfigService } from '../services/auth-config.service';
-import { AuthenticationService } from '../services/authentication.service';
-export class AuthenticationController {
-    async login(loginDto) {
-        const result = await this.authService.login(loginDto.email, loginDto.password);
-        if ('requiresEmailVerification' in result) {
-            return {
-                success: true,
-                message: 'Email verification required',
-                messageKey: AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED,
-                data: result
-            };
-        }
-        if ('requiresSelection' in result) {
-            return {
-                success: true,
-                message: 'Company selection required',
-                messageKey: AUTH_MESSAGES.LOGIN_REQUIRES_SELECTION,
-                data: result
-            };
-        }
-        return {
-            success: true,
-            message: 'Login successful',
-            messageKey: AUTH_MESSAGES.LOGIN_SUCCESS,
-            data: result
-        };
-    }
-    /** Register new user. If company feature enabled, can join/create company. */ async register(req, registrationDto) {
-        const verifyUrlBase = buildFrontendUrl(req, '/auth/verify-email');
-        const result = await this.authService.register(registrationDto, verifyUrlBase);
-        return {
-            success: true,
-            message: result.requiresEmailVerification ? 'Verification email sent' : 'Registration successful',
-            messageKey: result.requiresEmailVerification ? EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT : AUTH_MESSAGES.REGISTER_SUCCESS,
-            data: result
-        };
-    }
-    /**
-   * Refresh access token.
-   * - **Browser**: Prefers HTTP-only cookie, falls back to body if cookie missing.
-   * - **API/Mobile**: Must send `refreshToken` in request body. Set header `x-client-type: mobile` or `x-client-type: api`.
-   */ async refreshToken(req, refreshTokenDto) {
-        const cookieName = this.authConfig?.getRefreshTokenCookieName() ?? DEFAULT_COOKIE_NAME;
-        // Always check cookie first, then body - handles Browser, SSR, and Mobile/API
-        const refreshToken = req.cookies?.[cookieName] || refreshTokenDto.refreshToken;
-        if (!refreshToken) {
-            throw new UnauthorizedException({
-                message: 'Refresh token is required',
-                messageKey: AUTH_MESSAGES.TOKEN_REQUIRED
-            });
-        }
-        const data = await this.authService.refreshToken(refreshToken);
-        return {
-            success: true,
-            message: 'Token refreshed successfully',
-            messageKey: AUTH_MESSAGES.REFRESH_SUCCESS,
-            data
-        };
-    }
-    /** Get current user info. Returns user, company, and branch data (no tokens). */ async getCurrentUser(user) {
-        const data = await this.authService.getUserInfo(user.id, user.companyId, user.branchId);
-        return {
-            success: true,
-            message: 'User info retrieved successfully',
-            messageKey: AUTH_MESSAGES.ME_SUCCESS,
-            data
-        };
-    }
-    /** Logout - Clears refresh token cookie for browsers */ async logout(userId) {
-        await this.authService.logout(userId);
-        return {
-            success: true,
-            message: 'Logged out successfully',
-            messageKey: AUTH_MESSAGES.LOGOUT_SUCCESS
-        };
-    }
-    async changePassword(userId, dto) {
-        await this.authService.changePassword(userId, dto.currentPassword, dto.newPassword);
-        return {
-            success: true,
-            message: 'Password changed successfully',
-            messageKey: AUTH_MESSAGES.PASSWORD_CHANGE_SUCCESS
-        };
-    }
-    constructor(authService, authConfig){
-        _define_property(this, "authService", void 0);
-        _define_property(this, "authConfig", void 0);
-        this.authService = authService;
-        this.authConfig = authConfig;
-    }
-}
-_ts_decorate([
-    Post('login'),
-    HttpCode(HttpStatus.OK),
-    Throttle({
-        default: {
-            limit: 5,
-            ttl: 60000
-        }
-    }),
-    UseInterceptors(SetToken),
-    ApiOperation({
-        summary: 'User login'
-    }),
-    ApiBody({
-        type: LoginDto
-    }),
-    ApiResponse({
-        status: 200,
-        description: 'Login successful, requires company selection, or requires email verification',
-        content: {
-            'application/json': {
-                examples: {
-                    loginSuccess: {
-                        summary: 'Login Success',
-                        value: {
-                            success: true,
-                            message: 'Login successful',
-                            messageKey: 'auth.login.success',
-                            data: {
-                                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
-                                user: {
-                                    id: '550e8400-e29b-41d4-a716-446655440000',
-                                    email: 'john@example.com',
-                                    name: 'John Doe'
-                                }
-                            }
-                        }
-                    },
-                    loginSuccessWithCompany: {
-                        summary: 'Login Success (with company/branch)',
-                        value: {
-                            success: true,
-                            message: 'Login successful',
-                            messageKey: 'auth.login.success',
-                            data: {
-                                accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
-                                user: {
-                                    id: '550e8400-e29b-41d4-a716-446655440000',
-                                    email: 'john@example.com',
-                                    name: 'John Doe'
-                                },
-                                company: {
-                                    id: 'company-id',
-                                    name: 'Acme Corp'
-                                },
-                                branch: {
-                                    id: 'branch-id',
-                                    name: 'Main Branch'
-                                }
-                            }
-                        }
-                    },
-                    companySelection: {
-                        summary: 'Company Selection Required',
-                        value: {
-                            success: true,
-                            message: 'Company selection required',
-                            messageKey: 'auth.login.requires.selection',
-                            data: {
-                                requiresSelection: true,
-                                sessionId: 'sess_abc123def456',
-                                expiresAt: '2024-12-18T15:30:00.000Z',
-                                user: {
-                                    id: '550e8400-e29b-41d4-a716-446655440000',
-                                    email: 'john@example.com'
-                                },
-                                companies: [
-                                    {
-                                        id: 'company-id',
-                                        name: 'Acme Corp',
-                                        slug: 'acme-corp',
-                                        branches: [
-                                            {
-                                                id: 'branch-id',
-                                                name: 'Main Branch',
-                                                slug: 'main-branch'
-                                            }
-                                        ]
-                                    }
-                                ]
-                            }
-                        }
-                    },
-                    emailVerification: {
-                        summary: 'Email Verification Required',
-                        value: {
-                            success: true,
-                            message: 'Email verification required',
-                            messageKey: 'auth.login.email.not.verified',
-                            data: {
-                                requiresEmailVerification: true,
-                                email: 'john@example.com'
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }),
-    _ts_param(0, Body()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof LoginDto === "undefined" ? Object : LoginDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "login", null);
-_ts_decorate([
-    Post('register'),
-    HttpCode(HttpStatus.CREATED),
-    Throttle({
-        default: {
-            limit: 3,
-            ttl: 60000
-        }
-    }),
-    UseInterceptors(SetToken),
-    ApiOperation({
-        summary: 'Register new user'
-    }),
-    ApiBody({
-        type: RegistrationDto
-    }),
-    ApiResponse({
-        status: 201,
-        description: 'Registration successful or email verification required'
-    }),
-    _ts_param(0, Req()),
-    _ts_param(1, Body()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof Request === "undefined" ? Object : Request,
-        typeof RegistrationDto === "undefined" ? Object : RegistrationDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "register", null);
-_ts_decorate([
-    Post('refresh'),
-    HttpCode(HttpStatus.OK),
-    Throttle({
-        default: {
-            limit: 30,
-            ttl: 60000
-        }
-    }),
-    ApiOperation({
-        summary: 'Refresh access token',
-        description: `
-**Browser clients**: Refresh token is read from HTTP-only cookie (automatically set on login/register).
-Falls back to request body if cookie is not available.
-
-**API/Mobile clients**: Must send \`refreshToken\` in request body.
-Set header \`x-client-type: mobile\` or \`x-client-type: api\` to identify as non-browser client.
-
-**Client detection**: Uses \`x-client-type\` header first, then falls back to User-Agent detection.
-    `
-    }),
-    ApiHeader({
-        name: 'x-client-type',
-        required: false,
-        description: 'Client type: "browser"/"web" for cookie-based auth, "mobile"/"api" for body-based auth',
-        example: 'mobile'
-    }),
-    ApiBody({
-        type: RefreshTokenDto,
-        description: 'Required for API/Mobile clients. Browser clients prefer HTTP-only cookie with body fallback.'
-    }),
-    ApiResponse({
-        status: 200,
-        description: 'Token refreshed successfully',
-        schema: {
-            example: {
-                success: true,
-                message: 'Token refreshed successfully',
-                messageKey: 'auth.refresh.success',
-                data: {
-                    accessToken: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'
-                }
-            }
-        }
-    }),
-    ApiResponse({
-        status: 401,
-        description: 'Invalid or missing refresh token'
-    }),
-    _ts_param(0, Req()),
-    _ts_param(1, Body()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof Request === "undefined" ? Object : Request,
-        typeof RefreshTokenDto === "undefined" ? Object : RefreshTokenDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "refreshToken", null);
-_ts_decorate([
-    UseGuards(JwtAuthGuard),
-    Post('me'),
-    SkipThrottle(),
-    ApiBearerAuth(),
-    ApiOperation({
-        summary: 'Get current user info'
-    }),
-    ApiResponse({
-        status: 200,
-        description: 'Current user info retrieved successfully'
-    }),
-    _ts_param(0, CurrentUser()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "getCurrentUser", null);
-_ts_decorate([
-    UseGuards(JwtAuthGuard),
-    Post('logout'),
-    HttpCode(HttpStatus.OK),
-    SkipThrottle(),
-    UseInterceptors(ClearToken),
-    ApiBearerAuth(),
-    ApiOperation({
-        summary: 'Logout user'
-    }),
-    ApiResponse({
-        status: 200,
-        type: MessageResponseDto
-    }),
-    _ts_param(0, CurrentUser('id')),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "logout", null);
-_ts_decorate([
-    UseGuards(JwtAuthGuard),
-    Post('change-password'),
-    HttpCode(HttpStatus.OK),
-    Throttle({
-        default: {
-            limit: 5,
-            ttl: 60000
-        }
-    }),
-    ApiBearerAuth(),
-    ApiOperation({
-        summary: 'Change password'
-    }),
-    ApiBody({
-        type: ChangePasswordDto
-    }),
-    ApiResponse({
-        status: 200,
-        type: MessageResponseDto
-    }),
-    _ts_param(0, CurrentUser('id')),
-    _ts_param(1, Body()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        typeof ChangePasswordDto === "undefined" ? Object : ChangePasswordDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationController.prototype, "changePassword", null);
-AuthenticationController = _ts_decorate([
-    ApiTags('Authentication'),
-    Controller('auth'),
-    _ts_param(0, Inject(AuthenticationService)),
-    _ts_param(1, Optional()),
-    _ts_param(1, Inject(AuthConfigService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AuthenticationService === "undefined" ? Object : AuthenticationService,
-        typeof AuthConfigService === "undefined" ? Object : AuthConfigService
-    ])
-], AuthenticationController);

package/fesm/controllers/authentication.controller.spec.js

@@ -1,215 +0,0 @@
-import { UnauthorizedException } from '@nestjs/common';
-import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
-import { AuthenticationController } from './authentication.controller';
-describe('AuthenticationController', ()=>{
-    let controller;
-    let mockAuthService;
-    let mockAuthConfig;
-    beforeEach(()=>{
-        mockAuthService = {
-            login: jest.fn(),
-            register: jest.fn(),
-            refreshToken: jest.fn(),
-            getUserInfo: jest.fn(),
-            logout: jest.fn(),
-            changePassword: jest.fn()
-        };
-        mockAuthConfig = {
-            getRefreshTokenCookieName: jest.fn().mockReturnValue('fsn_refresh_token')
-        };
-        controller = new AuthenticationController(mockAuthService, mockAuthConfig);
-    });
-    describe('login', ()=>{
-        it('wraps a standard login response', async ()=>{
-            mockAuthService.login.mockResolvedValue({
-                accessToken: 'a',
-                refreshToken: 'r',
-                user: {
-                    id: 'u1',
-                    email: 'u@example.com'
-                }
-            });
-            const result = await controller.login({
-                email: 'u@example.com',
-                password: 'pw'
-            });
-            expect(result).toEqual(expect.objectContaining({
-                success: true,
-                data: expect.objectContaining({
-                    accessToken: 'a'
-                })
-            }));
-            expect(mockAuthService.login).toHaveBeenCalledWith('u@example.com', 'pw');
-        });
-        it('wraps a company-selection-required response', async ()=>{
-            mockAuthService.login.mockResolvedValue({
-                requiresSelection: true,
-                sessionId: 'sess-1'
-            });
-            const result = await controller.login({
-                email: 'u@example.com',
-                password: 'pw'
-            });
-            expect(result.message).toBe('Company selection required');
-            expect(result.data).toEqual(expect.objectContaining({
-                requiresSelection: true
-            }));
-        });
-        it('wraps an email-verification-required response', async ()=>{
-            mockAuthService.login.mockResolvedValue({
-                requiresEmailVerification: true,
-                email: 'u@example.com'
-            });
-            const result = await controller.login({
-                email: 'u@example.com',
-                password: 'pw'
-            });
-            expect(result.message).toBe('Email verification required');
-            expect(result.data).toEqual(expect.objectContaining({
-                requiresEmailVerification: true
-            }));
-        });
-        it('propagates errors thrown by the service', async ()=>{
-            mockAuthService.login.mockRejectedValue(new UnauthorizedException('bad creds'));
-            await expect(controller.login({
-                email: 'u@example.com',
-                password: 'wrong'
-            })).rejects.toThrow(UnauthorizedException);
-        });
-    });
-    describe('register', ()=>{
-        it('reports success message when registration completes without verification', async ()=>{
-            mockAuthService.register.mockResolvedValue({
-                accessToken: 'a',
-                user: {
-                    id: 'u1'
-                },
-                requiresEmailVerification: false
-            });
-            const req = {
-                headers: {},
-                get: jest.fn((h)=>h === 'host' ? 'app.example.com' : undefined),
-                protocol: 'https'
-            };
-            const result = await controller.register(req, {
-                name: 'New',
-                email: 'new@example.com',
-                password: 'Password1!'
-            });
-            expect(result.message).toBe('Registration successful');
-            expect(result.success).toBe(true);
-        });
-        it('reports verification-sent message when email verification is required', async ()=>{
-            mockAuthService.register.mockResolvedValue({
-                requiresEmailVerification: true,
-                user: {
-                    id: 'u1'
-                }
-            });
-            const req = {
-                headers: {},
-                get: jest.fn((h)=>h === 'host' ? 'app.example.com' : undefined),
-                protocol: 'https'
-            };
-            const result = await controller.register(req, {
-                name: 'New',
-                email: 'new@example.com',
-                password: 'Password1!'
-            });
-            expect(result.message).toBe('Verification email sent');
-        });
-    });
-    describe('refreshToken', ()=>{
-        it('reads the refresh token from the cookie first', async ()=>{
-            mockAuthService.refreshToken.mockResolvedValue({
-                accessToken: 'new-token'
-            });
-            const req = {
-                cookies: {
-                    fsn_refresh_token: 'cookie-token'
-                }
-            };
-            await controller.refreshToken(req, {
-                refreshToken: 'body-token'
-            });
-            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('cookie-token');
-        });
-        it('falls back to the request body when no cookie is present', async ()=>{
-            mockAuthService.refreshToken.mockResolvedValue({
-                accessToken: 'new-token'
-            });
-            const req = {
-                cookies: {}
-            };
-            await controller.refreshToken(req, {
-                refreshToken: 'body-token'
-            });
-            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('body-token');
-        });
-        it('throws UnauthorizedException when no refresh token is available', async ()=>{
-            const req = {
-                cookies: {}
-            };
-            await expect(controller.refreshToken(req, {})).rejects.toThrow(UnauthorizedException);
-            expect(mockAuthService.refreshToken).not.toHaveBeenCalled();
-        });
-        it('uses the default cookie name when authConfig is unavailable', async ()=>{
-            controller = new AuthenticationController(mockAuthService, undefined);
-            mockAuthService.refreshToken.mockResolvedValue({
-                accessToken: 'new-token'
-            });
-            const req = {
-                cookies: {
-                    fsn_refresh_token: 'cookie-token'
-                }
-            };
-            await controller.refreshToken(req, {});
-            expect(mockAuthService.refreshToken).toHaveBeenCalledWith('cookie-token');
-        });
-    });
-    describe('getCurrentUser', ()=>{
-        it('delegates to authService.getUserInfo with the current user context', async ()=>{
-            mockAuthService.getUserInfo.mockResolvedValue({
-                user: {
-                    id: 'u1'
-                }
-            });
-            const user = buildMockUser();
-            const result = await controller.getCurrentUser(user);
-            expect(mockAuthService.getUserInfo).toHaveBeenCalledWith(user.id, user.companyId, user.branchId);
-            expect(result.data).toEqual({
-                user: {
-                    id: 'u1'
-                }
-            });
-        });
-    });
-    describe('logout', ()=>{
-        it('delegates to authService.logout and returns a success message', async ()=>{
-            const result = await controller.logout('user-1');
-            expect(mockAuthService.logout).toHaveBeenCalledWith('user-1');
-            expect(result).toEqual(expect.objectContaining({
-                success: true
-            }));
-        });
-    });
-    describe('changePassword', ()=>{
-        it('delegates to authService.changePassword', async ()=>{
-            const result = await controller.changePassword('user-1', {
-                currentPassword: 'old',
-                newPassword: 'New1!aaaa'
-            });
-            expect(mockAuthService.changePassword).toHaveBeenCalledWith('user-1', 'old', 'New1!aaaa');
-            expect(result).toEqual(expect.objectContaining({
-                success: true
-            }));
-        });
-        it('propagates errors from an invalid current password', async ()=>{
-            mockAuthService.changePassword.mockRejectedValue(new UnauthorizedException());
-            await expect(controller.changePassword('user-1', {
-                currentPassword: 'wrong',
-                newPassword: 'New1!aaaa'
-            })).rejects.toThrow(UnauthorizedException);
-        });
-    });
-});