@flusys/nestjs-auth 7.1.0 → 8.0.0

package/fesm/services/authentication.service.js

@@ -1,1152 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { LogAction } from '@flusys/nestjs-shared';
-import { HybridCache, publishDomainEvent } from '@flusys/nestjs-shared/classes';
-import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
-import { NotificationType } from '@flusys/nestjs-shared/enums';
-import { INotificationAdapter, NOTIFICATION_ADAPTER } from '@flusys/nestjs-shared/interfaces';
-import { generateUniqueSlug } from '@flusys/nestjs-shared/utils';
-import { BadRequestException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
-import { JwtService } from '@nestjs/jwt';
-import * as bcrypt from 'bcrypt';
-import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, TOKEN_REVOKED_PREFIX, USER_ENRICHER, USER_MESSAGES } from '../config';
-import { RegistrationDto } from '../dtos/authentication.dto';
-import { AppUser } from '../entities/app-user.entity';
-import { CompanyBranch } from '../entities/company-branch.entity';
-import { Company } from '../entities/company.entity';
-import { PendingRegistration } from '../entities/pending-registration.entity';
-import { UserCompanyPermission } from '../entities/user-company-permission.entity';
-import { PermissionType } from '../enums';
-import { generateTokens, parseExpiryToMs, toBranchInfo, toCompanyInfo, toUserInfo } from '../helpers';
-import { IUserEnricher } from '../interfaces/user-enricher.interface';
-import { AuthConfigService } from './auth-config.service';
-import { AuthDataSourceProvider } from './auth-datasource.provider';
-import { AuthEmailService } from './auth-email.service';
-import { CompanySelectionSessionService } from './company-selection-session.service';
-export class AuthenticationService {
-    isCompanyFeatureEnabled() {
-        return this.dataSourceProvider?.isCompanyFeatureEnabled() ?? this.authConfig.isCompanyFeatureEnabled();
-    }
-    isEmailVerificationEnabled() {
-        const featureEnabled = this.dataSourceProvider?.isEmailVerificationEnabled() ?? this.authConfig.isEmailVerificationEnabled();
-        const providerAvailable = this.authEmailService?.isEmailEnabled() ?? false;
-        return featureEnabled && providerAvailable;
-    }
-    isSignUpEnabled() {
-        return this.dataSourceProvider?.isSignUpEnabled() ?? this.authConfig.isSignUpEnabled();
-    }
-    async getUserRepository() {
-        if (!this.dataSourceProvider) {
-            throw new InternalServerErrorException({
-                message: 'User repository not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'AppUser'
-                }
-            });
-        }
-        return this.dataSourceProvider.getRepository(AppUser);
-    }
-    async getCompanyScopedRepository(entity) {
-        if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
-        return this.dataSourceProvider.getRepository(entity);
-    }
-    async login(email, password) {
-        if (this.isEmailVerificationEnabled() && await this.authEmailService.hasPendingRegistration(email)) {
-            return {
-                requiresEmailVerification: true,
-                email,
-                message: 'Please verify your email address to complete registration.',
-                messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT
-            };
-        }
-        const user = await this.validateUser(email, password);
-        this.ensureUserActive(user);
-        if (this.isEmailVerificationEnabled() && !user.emailVerified) {
-            return {
-                requiresEmailVerification: true,
-                email: user.email,
-                message: 'Please verify your email address before logging in.',
-                messageKey: AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED
-            };
-        }
-        return this.issueLoginForUser(user);
-    }
-    async issueLoginForUser(user) {
-        this.ensureUserActive(user);
-        if (!this.isCompanyFeatureEnabled()) {
-            return this.generateLoginResponse(user);
-        }
-        return await this.handleCompanyBasedLogin(user);
-    }
-    ensureUserActive(user) {
-        if (!user.isActive) {
-            throw new ForbiddenException({
-                message: 'User account is deactivated',
-                messageKey: AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED
-            });
-        }
-    }
-    async handleCompanyBasedLogin(user) {
-        const permissionRepository = await this.getCompanyScopedRepository(UserCompanyPermission);
-        const branchRepository = await this.getCompanyScopedRepository(CompanyBranch);
-        if (!permissionRepository || !branchRepository) {
-            return this.generateLoginResponse(user);
-        }
-        const companyPermissions = await permissionRepository.find({
-            where: {
-                userId: user.id,
-                permissionType: PermissionType.COMPANY
-            }
-        });
-        const companyRepository = await this.getCompanyScopedRepository(Company);
-        if (!companyRepository) {
-            return this.generateLoginResponse(user);
-        }
-        const companyIds = companyPermissions.map((p)=>p.targetId);
-        const companies = companyIds.length > 0 ? await companyRepository.createQueryBuilder('c').where('c.id IN (:...ids)', {
-            ids: companyIds
-        }).andWhere('c.is_active = :active', {
-            active: true
-        }).getMany() : [];
-        if (companies.length === 0) {
-            return this.generateLoginResponse(user);
-        }
-        const branchPermissions = await permissionRepository.find({
-            where: {
-                userId: user.id,
-                permissionType: PermissionType.BRANCH
-            }
-        });
-        const branchIds = branchPermissions.map((p)=>p.targetId);
-        const branches = branchIds.length > 0 ? await branchRepository.createQueryBuilder('b').leftJoinAndSelect('b.company', 'company').where('b.id IN (:...ids)', {
-            ids: branchIds
-        }).andWhere('b.is_active = :active', {
-            active: true
-        }).getMany() : [];
-        if (companies.length === 1 && branches.length === 1) {
-            return this.generateLoginResponseWithCompany(user, companies[0], branches[0]);
-        }
-        return await this.generateCompanySelectionResponse(user, companies, branches);
-    }
-    async register(dto, verifyUrlBase) {
-        const userRepository = await this.getUserRepository();
-        const existingUser = await userRepository.findOne({
-            where: {
-                email: dto.email
-            },
-            withDeleted: true
-        });
-        if (existingUser?.deletedAt) {
-            throw new BadRequestException({
-                message: 'This account has been permanently deleted. Please contact your system administrator.',
-                messageKey: AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED
-            });
-        }
-        if (existingUser && this.isCompanyFeatureEnabled()) {
-            return await this.handleExistingUserCompanyRegistration(existingUser, dto);
-        }
-        if (existingUser) {
-            throw new BadRequestException({
-                message: 'Registration failed due to email exists. Please try again or contact support.',
-                messageKey: AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
-            });
-        }
-        if (!this.isSignUpEnabled()) {
-            throw new BadRequestException({
-                message: 'New account registration is currently disabled.',
-                messageKey: AUTH_MESSAGES.REGISTER_SIGNUP_DISABLED
-            });
-        }
-        if (this.isEmailVerificationEnabled() && verifyUrlBase) {
-            const companyData = this.isCompanyFeatureEnabled() ? {
-                companySlug: dto.companySlug,
-                branchSlug: dto.branchSlug,
-                newCompanyName: dto.newCompanyName,
-                newCompanyPhone: dto.newCompanyPhone,
-                newCompanyAddress: dto.newCompanyAddress
-            } : undefined;
-            const result = await this.authEmailService.createPendingRegistration({
-                email: dto.email,
-                name: dto.name,
-                phone: dto.phone,
-                password: dto.password,
-                companyData,
-                additionalFields: dto.additionalFields,
-                verifyUrlBase
-            });
-            return {
-                requiresEmailVerification: true,
-                message: result.message,
-                messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT
-            };
-        }
-        return await this.createUserDirectly(dto);
-    }
-    async handleExistingUserCompanyRegistration(existingUser, dto) {
-        if (!dto.companySlug && !dto.newCompanyName) {
-            throw new BadRequestException({
-                message: 'Email already registered. Please login or provide a company to join/create.',
-                messageKey: AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
-            });
-        }
-        const permissionRepository = await this.getCompanyScopedRepository(UserCompanyPermission);
-        const companyRepository = await this.getCompanyScopedRepository(Company);
-        if (!permissionRepository || !companyRepository) {
-            throw new BadRequestException({
-                message: 'Company feature repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Company feature'
-                }
-            });
-        }
-        if (dto.companySlug) {
-            const company = await companyRepository.findOne({
-                where: {
-                    slug: dto.companySlug,
-                    isActive: true
-                }
-            });
-            if (company) {
-                const existingPermission = await permissionRepository.findOne({
-                    where: {
-                        userId: existingUser.id,
-                        permissionType: PermissionType.COMPANY,
-                        targetId: company.id
-                    }
-                });
-                if (existingPermission) {
-                    throw new BadRequestException({
-                        message: 'You are already assigned to this company. Please login.',
-                        messageKey: AUTH_MESSAGES.REGISTER_COMPANY_ALREADY_ASSIGNED
-                    });
-                }
-            }
-        }
-        return await this.processCompanyRegistration(existingUser, dto, true);
-    }
-    async createUserDirectly(dto) {
-        if (!this.dataSourceProvider) {
-            throw new BadRequestException({
-                message: 'Data source not available',
-                messageKey: SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
-            });
-        }
-        const dataSource = await this.dataSourceProvider.getDataSource();
-        const queryRunner = dataSource.createQueryRunner();
-        await queryRunner.connect();
-        await queryRunner.startTransaction();
-        try {
-            const hashedPassword = await bcrypt.hash(dto.password, BCRYPT_SALT_ROUNDS);
-            const user = queryRunner.manager.create(AppUser, {
-                name: dto.name,
-                email: dto.email,
-                phone: dto.phone,
-                password: hashedPassword,
-                isActive: true,
-                emailVerified: false,
-                phoneVerified: false
-            });
-            await queryRunner.manager.save(AppUser, user);
-            if (this.userEnricher?.onUserCreated) {
-                await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
-            }
-            await queryRunner.commitTransaction();
-            if (!this.isCompanyFeatureEnabled()) {
-                return this.generateRegistrationResponse(user);
-            }
-            return await this.processCompanyRegistration(user, dto);
-        } catch (error) {
-            await queryRunner.rollbackTransaction();
-            if (error instanceof BadRequestException) {
-                throw error;
-            }
-            throw new BadRequestException({
-                message: 'Registration failed. Please try again.',
-                messageKey: AUTH_MESSAGES.REGISTER_FAILED
-            });
-        } finally{
-            await queryRunner.release();
-        }
-    }
-    async createUserFromPendingRegistration(pending) {
-        if (!this.dataSourceProvider) {
-            throw new BadRequestException({
-                message: 'Data source not available',
-                messageKey: SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
-            });
-        }
-        const dataSource = await this.dataSourceProvider.getDataSource();
-        const queryRunner = dataSource.createQueryRunner();
-        await queryRunner.connect();
-        await queryRunner.startTransaction();
-        try {
-            const existingUser = await queryRunner.manager.findOne(AppUser, {
-                where: {
-                    email: pending.email
-                },
-                withDeleted: true
-            });
-            if (existingUser?.deletedAt) {
-                throw new BadRequestException({
-                    message: 'This account has been permanently deleted. Please contact your system administrator.',
-                    messageKey: AUTH_MESSAGES.REGISTER_ACCOUNT_DELETED
-                });
-            }
-            if (existingUser) {
-                throw new BadRequestException({
-                    message: 'This email has already been registered.',
-                    messageKey: AUTH_MESSAGES.REGISTER_EMAIL_EXISTS
-                });
-            }
-            const user = queryRunner.manager.create(AppUser, {
-                name: pending.name,
-                email: pending.email,
-                phone: pending.phone,
-                password: pending.passwordHash,
-                isActive: true,
-                emailVerified: true,
-                phoneVerified: false
-            });
-            await queryRunner.manager.save(AppUser, user);
-            if (this.userEnricher?.onUserCreated) {
-                await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
-            }
-            await queryRunner.commitTransaction();
-            if (this.isCompanyFeatureEnabled() && pending.companyData) {
-                return await this.processCompanyRegistration(user, pending.companyData);
-            }
-            return this.generateRegistrationResponse(user);
-        } catch (error) {
-            await queryRunner.rollbackTransaction();
-            if (error instanceof BadRequestException) {
-                throw error;
-            }
-            throw new BadRequestException({
-                message: 'Registration failed. Please try again.',
-                messageKey: AUTH_MESSAGES.REGISTER_FAILED
-            });
-        } finally{
-            await queryRunner.release();
-        }
-    }
-    async processCompanyRegistration(user, data, throwOnUnavailable = false) {
-        const companyRepository = await this.getCompanyScopedRepository(Company);
-        const branchRepository = await this.getCompanyScopedRepository(CompanyBranch);
-        const permissionRepository = await this.getCompanyScopedRepository(UserCompanyPermission);
-        if (!companyRepository || !branchRepository || !permissionRepository) {
-            if (throwOnUnavailable) throw new BadRequestException({
-                message: 'Company feature repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Company feature'
-                }
-            });
-            return this.generateRegistrationResponse(user);
-        }
-        const { company, branch } = await this.findOrCreateCompanyAndBranch(data, companyRepository, branchRepository);
-        if (company) {
-            await this.assignUserPermissions(user.id, company.id, branch?.id, permissionRepository);
-            return this.generateRegistrationResponseWithCompany(user, company, branch ?? undefined);
-        }
-        return this.generateRegistrationResponse(user);
-    }
-    async findOrCreateCompanyAndBranch(data, companyRepo, branchRepo) {
-        if (data.companySlug) {
-            const company = await companyRepo.findOne({
-                where: {
-                    slug: data.companySlug,
-                    isActive: true
-                }
-            });
-            if (!company) throw new BadRequestException({
-                message: 'Company not found or inactive',
-                messageKey: AUTH_MESSAGES.COMPANY_NOT_FOUND
-            });
-            const branch = data.branchSlug ? await branchRepo.findOne({
-                where: {
-                    slug: data.branchSlug,
-                    companyId: company.id,
-                    isActive: true
-                }
-            }) : await branchRepo.findOne({
-                where: {
-                    companyId: company.id,
-                    isActive: true
-                },
-                order: {
-                    serial: 'ASC',
-                    createdAt: 'ASC'
-                }
-            });
-            if (data.branchSlug && !branch) throw new BadRequestException({
-                message: 'Branch not found or inactive',
-                messageKey: AUTH_MESSAGES.BRANCH_NOT_FOUND
-            });
-            return {
-                company,
-                branch
-            };
-        }
-        if (data.newCompanyName) {
-            const slug = await generateUniqueSlug(data.newCompanyName, async (baseSlug)=>{
-                const rows = await companyRepo.createQueryBuilder('c').select('c.slug').where('c.slug = :base OR c.slug LIKE :pattern', {
-                    base: baseSlug,
-                    pattern: `${baseSlug}-%`
-                }).getMany();
-                return rows.map((r)=>r.slug);
-            });
-            const company = companyRepo.create({
-                name: data.newCompanyName,
-                slug,
-                phone: data.newCompanyPhone,
-                address: data.newCompanyAddress,
-                isActive: true
-            });
-            await companyRepo.save(company);
-            const branch = branchRepo.create({
-                name: 'Main Branch',
-                slug: 'main-branch',
-                companyId: company.id,
-                isActive: true
-            });
-            await branchRepo.save(branch);
-            return {
-                company,
-                branch
-            };
-        }
-        return {
-            company: null,
-            branch: null
-        };
-    }
-    async assignUserPermissions(userId, companyId, branchId, permissionRepo) {
-        await permissionRepo.save(permissionRepo.create({
-            userId,
-            permissionType: PermissionType.COMPANY,
-            targetId: companyId
-        }));
-        if (branchId) {
-            await permissionRepo.save(permissionRepo.create({
-                userId,
-                permissionType: PermissionType.BRANCH,
-                targetId: branchId
-            }));
-        }
-    }
-    async select(sessionId, companyId, branchId) {
-        this.ensureCompanyFeatureEnabled();
-        if (!this.sessionService) {
-            throw new BadRequestException({
-                message: 'Session service not available',
-                messageKey: AUTH_MESSAGES.SESSION_NOT_AVAILABLE
-            });
-        }
-        const session = await this.sessionService.consumeSession(sessionId);
-        if (!session) {
-            throw new UnauthorizedException({
-                message: 'Invalid or expired session',
-                messageKey: AUTH_MESSAGES.SESSION_INVALID
-            });
-        }
-        return await this.validateAndLoginWithCompany(session.userId, companyId, branchId);
-    }
-    async switchCompany(userId, companyId, branchId) {
-        this.ensureCompanyFeatureEnabled();
-        return await this.validateAndLoginWithCompany(userId, companyId, branchId);
-    }
-    async validateAndLoginWithCompany(userId, companyId, branchId) {
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!user) {
-            throw new NotFoundException({
-                message: 'User not found',
-                messageKey: USER_MESSAGES.NOT_FOUND
-            });
-        }
-        const permissionRepository = await this.getCompanyScopedRepository(UserCompanyPermission);
-        const companyRepository = await this.getCompanyScopedRepository(Company);
-        const branchRepository = await this.getCompanyScopedRepository(CompanyBranch);
-        if (!permissionRepository || !companyRepository || !branchRepository) {
-            throw new BadRequestException({
-                message: 'Repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Some'
-                }
-            });
-        }
-        const hasCompanyAccess = await permissionRepository.findOne({
-            where: {
-                userId,
-                permissionType: PermissionType.COMPANY,
-                targetId: companyId
-            }
-        });
-        if (!hasCompanyAccess) {
-            throw new ForbiddenException({
-                message: 'No access to this company',
-                messageKey: AUTH_MESSAGES.COMPANY_NO_ACCESS
-            });
-        }
-        const company = await companyRepository.findOne({
-            where: {
-                id: companyId,
-                isActive: true
-            }
-        });
-        if (!company) {
-            throw new NotFoundException({
-                message: 'Company not found or inactive',
-                messageKey: AUTH_MESSAGES.COMPANY_NOT_FOUND
-            });
-        }
-        const hasBranchAccess = await permissionRepository.findOne({
-            where: {
-                userId,
-                permissionType: PermissionType.BRANCH,
-                targetId: branchId
-            }
-        });
-        if (!hasBranchAccess) {
-            throw new ForbiddenException({
-                message: 'No access to this branch',
-                messageKey: AUTH_MESSAGES.BRANCH_NO_ACCESS
-            });
-        }
-        const branch = await branchRepository.findOne({
-            where: {
-                id: branchId,
-                companyId,
-                isActive: true
-            }
-        });
-        if (!branch) {
-            throw new NotFoundException({
-                message: 'Branch not found or inactive',
-                messageKey: AUTH_MESSAGES.BRANCH_NOT_FOUND
-            });
-        }
-        const response = this.generateLoginResponseWithCompany(user, company, branch);
-        this.publishAuthEvent(AUTH_EVENT_ENTITIES.SESSION, AUTH_EVENT_ACTIONS.COMPANY_SWITCHED, user, {
-            companyId: company.id,
-            branchId: branch.id
-        });
-        return response;
-    }
-    async refreshToken(refreshToken) {
-        try {
-            const payload = this.jwtService.verify(refreshToken, {
-                secret: this.authConfig.getRefreshTokenSecret(),
-                algorithms: [
-                    'HS256'
-                ]
-            });
-            if (await this.isTokenRevoked(payload.id, payload.iat)) {
-                throw new UnauthorizedException({
-                    message: 'Token has been revoked',
-                    messageKey: AUTH_MESSAGES.TOKEN_REVOKED
-                });
-            }
-            const userRepository = await this.getUserRepository();
-            const user = await userRepository.findOne({
-                where: {
-                    id: payload.id
-                }
-            });
-            if (!user || !user.isActive) {
-                throw new UnauthorizedException({
-                    message: 'Invalid refresh token',
-                    messageKey: AUTH_MESSAGES.TOKEN_INVALID
-                });
-            }
-            if (payload.companyId) {
-                const companyRepository = await this.getCompanyScopedRepository(Company);
-                const permissionRepository = await this.getCompanyScopedRepository(UserCompanyPermission);
-                if (companyRepository) {
-                    const company = await companyRepository.findOne({
-                        where: {
-                            id: payload.companyId,
-                            isActive: true
-                        }
-                    });
-                    if (!company) {
-                        throw new UnauthorizedException({
-                            message: 'Company not found or inactive',
-                            messageKey: AUTH_MESSAGES.COMPANY_NOT_FOUND
-                        });
-                    }
-                }
-                if (permissionRepository) {
-                    const hasCompanyAccess = await permissionRepository.findOne({
-                        where: {
-                            userId: user.id,
-                            permissionType: PermissionType.COMPANY,
-                            targetId: payload.companyId
-                        }
-                    });
-                    if (!hasCompanyAccess) {
-                        throw new UnauthorizedException({
-                            message: 'No access to this company',
-                            messageKey: AUTH_MESSAGES.COMPANY_NO_ACCESS
-                        });
-                    }
-                }
-                if (payload.branchId) {
-                    const branchRepository = await this.getCompanyScopedRepository(CompanyBranch);
-                    if (branchRepository) {
-                        const branch = await branchRepository.findOne({
-                            where: {
-                                id: payload.branchId,
-                                companyId: payload.companyId,
-                                isActive: true
-                            }
-                        });
-                        if (!branch) {
-                            throw new UnauthorizedException({
-                                message: 'Branch not found or inactive',
-                                messageKey: AUTH_MESSAGES.BRANCH_NOT_FOUND
-                            });
-                        }
-                    }
-                    if (permissionRepository) {
-                        const hasBranchAccess = await permissionRepository.findOne({
-                            where: {
-                                userId: user.id,
-                                permissionType: PermissionType.BRANCH,
-                                targetId: payload.branchId
-                            }
-                        });
-                        if (!hasBranchAccess) {
-                            throw new UnauthorizedException({
-                                message: 'No access to this branch',
-                                messageKey: AUTH_MESSAGES.BRANCH_NO_ACCESS
-                            });
-                        }
-                    }
-                }
-            }
-            const tokens = generateTokens(this.jwtService, this.authConfig, {
-                id: user.id,
-                email: user.email,
-                type: 'access',
-                profilePictureId: user.profilePictureId ?? undefined,
-                ...payload.companyId && {
-                    companyId: payload.companyId
-                },
-                ...payload.branchId && {
-                    branchId: payload.branchId
-                }
-            });
-            this.publishAuthEvent(AUTH_EVENT_ENTITIES.SESSION, AUTH_EVENT_ACTIONS.TOKEN_REFRESHED, user, {
-                companyId: payload.companyId ?? null,
-                branchId: payload.branchId ?? null
-            });
-            return tokens;
-        } catch  {
-            throw new UnauthorizedException({
-                message: 'Invalid or expired refresh token',
-                messageKey: AUTH_MESSAGES.TOKEN_EXPIRED
-            });
-        }
-    }
-    async changePassword(userId, currentPassword, newPassword) {
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!user) throw new UnauthorizedException({
-            message: 'User not found',
-            messageKey: USER_MESSAGES.NOT_FOUND
-        });
-        if (!await bcrypt.compare(currentPassword, user.password || '')) {
-            throw new UnauthorizedException({
-                message: 'Current password is incorrect',
-                messageKey: AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT
-            });
-        }
-        user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
-        await userRepository.save(user);
-        this.publishAuthEvent(AUTH_EVENT_ENTITIES.USER, AUTH_EVENT_ACTIONS.PASSWORD_CHANGED, user);
-    }
-    async logout(userId) {
-        if (!this.cacheManager) {
-            throw new BadRequestException({
-                message: 'Logout service temporarily unavailable. Please try again later.',
-                messageKey: AUTH_MESSAGES.LOGOUT_SERVICE_UNAVAILABLE
-            });
-        }
-        const revokedAt = Math.floor(Date.now() / 1000);
-        const cacheKey = `${TOKEN_REVOKED_PREFIX}:${userId}`;
-        const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
-        const ttlMs = parseExpiryToMs(refreshTokenExpiry);
-        await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
-        await publishDomainEvent({
-            module: AUTH_EVENT_MODULE,
-            entity: AUTH_EVENT_ENTITIES.SESSION,
-            action: AUTH_EVENT_ACTIONS.LOGGED_OUT,
-            ids: [
-                userId
-            ],
-            user: {
-                id: userId
-            }
-        });
-    }
-    async isTokenRevoked(userId, tokenIssuedAt) {
-        if (!this.cacheManager || !tokenIssuedAt) {
-            return false;
-        }
-        const cacheKey = `${TOKEN_REVOKED_PREFIX}:${userId}`;
-        const revokedAt = await this.cacheManager.get(cacheKey);
-        if (!revokedAt) {
-            return false;
-        }
-        return tokenIssuedAt < revokedAt;
-    }
-    async getUserCompanies(userId) {
-        this.ensureCompanyFeatureEnabled();
-        const permissionRepository = await this.getCompanyScopedRepository(UserCompanyPermission);
-        const companyRepository = await this.getCompanyScopedRepository(Company);
-        if (!permissionRepository || !companyRepository) {
-            throw new BadRequestException({
-                message: 'Repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Some'
-                }
-            });
-        }
-        const permissions = await permissionRepository.find({
-            where: {
-                userId,
-                permissionType: PermissionType.COMPANY
-            }
-        });
-        const companyIds = permissions.map((p)=>p.targetId);
-        if (companyIds.length === 0) return [];
-        return companyRepository.createQueryBuilder('c').where('c.id IN (:...ids)', {
-            ids: companyIds
-        }).andWhere('c.is_active = :active', {
-            active: true
-        }).orderBy('c.name', 'ASC').getMany();
-    }
-    async getUserBranches(userId, companyId) {
-        this.ensureCompanyFeatureEnabled();
-        const permissionRepository = await this.getCompanyScopedRepository(UserCompanyPermission);
-        const branchRepository = await this.getCompanyScopedRepository(CompanyBranch);
-        if (!permissionRepository || !branchRepository) {
-            throw new BadRequestException({
-                message: 'Repositories not available',
-                messageKey: SYSTEM_MESSAGES.REPOSITORY_NOT_AVAILABLE,
-                messageVariables: {
-                    entity: 'Some'
-                }
-            });
-        }
-        const companyPermission = await permissionRepository.findOne({
-            where: {
-                userId,
-                permissionType: PermissionType.COMPANY,
-                targetId: companyId
-            }
-        });
-        if (!companyPermission) {
-            throw new UnauthorizedException({
-                message: 'No access to this company',
-                messageKey: AUTH_MESSAGES.COMPANY_NO_ACCESS
-            });
-        }
-        const branchPermissions = await permissionRepository.find({
-            where: {
-                userId,
-                permissionType: PermissionType.BRANCH
-            }
-        });
-        const branchIds = branchPermissions.map((p)=>p.targetId);
-        if (branchIds.length === 0) return [];
-        return branchRepository.createQueryBuilder('b').where('b.id IN (:...ids)', {
-            ids: branchIds
-        }).andWhere('b.company_id = :companyId', {
-            companyId
-        }).andWhere('b.is_active = :active', {
-            active: true
-        }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
-    }
-    async getCompanyById(companyId) {
-        const companyRepository = await this.getCompanyScopedRepository(Company);
-        if (!companyRepository) {
-            return null;
-        }
-        return companyRepository.findOne({
-            where: {
-                id: companyId
-            }
-        });
-    }
-    async getBranchById(branchId) {
-        const branchRepository = await this.getCompanyScopedRepository(CompanyBranch);
-        if (!branchRepository) {
-            return null;
-        }
-        return branchRepository.findOne({
-            where: {
-                id: branchId
-            }
-        });
-    }
-    async getUserInfo(userId, companyId, branchId) {
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                id: userId
-            }
-        });
-        if (!user) throw new UnauthorizedException({
-            message: 'User not found',
-            messageKey: USER_MESSAGES.NOT_FOUND
-        });
-        const response = {
-            user: toUserInfo(user)
-        };
-        if (this.isCompanyFeatureEnabled()) {
-            if (!companyId) {
-                throw new UnauthorizedException({
-                    message: 'Company feature is enabled but user has no company assigned.',
-                    messageKey: AUTH_MESSAGES.COMPANY_REQUIRED
-                });
-            }
-            const company = await this.getCompanyById(companyId);
-            if (!company) throw new UnauthorizedException({
-                message: 'Company not found.',
-                messageKey: AUTH_MESSAGES.COMPANY_NOT_FOUND
-            });
-            response.company = toCompanyInfo(company);
-            if (branchId) {
-                const branch = await this.getBranchById(branchId);
-                if (!branch) throw new UnauthorizedException({
-                    message: 'Branch not found.',
-                    messageKey: AUTH_MESSAGES.BRANCH_NOT_FOUND
-                });
-                response.branch = toBranchInfo(branch);
-            }
-        }
-        return response;
-    }
-    ensureCompanyFeatureEnabled() {
-        if (!this.isCompanyFeatureEnabled()) {
-            throw new BadRequestException({
-                message: 'Company feature is not enabled',
-                messageKey: AUTH_MESSAGES.COMPANY_FEATURE_NOT_ENABLED
-            });
-        }
-    }
-    async validateUser(email, password) {
-        const userRepository = await this.getUserRepository();
-        const user = await userRepository.findOne({
-            where: {
-                email
-            }
-        });
-        if (!user || !await bcrypt.compare(password, user.password || '')) {
-            throw new UnauthorizedException({
-                message: 'Invalid credentials',
-                messageKey: AUTH_MESSAGES.LOGIN_INVALID_CREDENTIALS
-            });
-        }
-        user.lastLoginAt = new Date();
-        await userRepository.save(user);
-        return user;
-    }
-    generateLoginResponse(user) {
-        const { accessToken, refreshToken } = generateTokens(this.jwtService, this.authConfig, {
-            id: user.id,
-            email: user.email,
-            type: 'access'
-        });
-        this.sendLoginNotification(user.id);
-        this.publishAuthEvent(AUTH_EVENT_ENTITIES.SESSION, AUTH_EVENT_ACTIONS.LOGGED_IN, user);
-        return {
-            accessToken,
-            refreshToken,
-            user: toUserInfo(user)
-        };
-    }
-    generateLoginResponseWithCompany(user, company, branch) {
-        const { accessToken, refreshToken } = generateTokens(this.jwtService, this.authConfig, {
-            id: user.id,
-            email: user.email,
-            type: 'access',
-            companyId: company.id,
-            branchId: branch?.id
-        });
-        this.sendLoginNotification(user.id, company.id);
-        this.publishAuthEvent(AUTH_EVENT_ENTITIES.SESSION, AUTH_EVENT_ACTIONS.LOGGED_IN, user, {
-            companyId: company.id,
-            branchId: branch?.id ?? null
-        });
-        return {
-            accessToken,
-            refreshToken,
-            user: toUserInfo(user),
-            company: toCompanyInfo(company),
-            branch: branch ? toBranchInfo(branch) : undefined
-        };
-    }
-    sendLoginNotification(userId, companyId) {
-        if (!this.notificationAdapter) return;
-        this.notificationAdapter.send({
-            userId,
-            title: 'Login successful',
-            message: 'You have successfully logged in to your account.',
-            type: NotificationType.INFO,
-            companyId,
-            realtime: false
-        }).catch(()=>{
-        // Silent failure - notification is non-critical
-        });
-    }
-    async generateCompanySelectionResponse(user, companies, branches) {
-        if (!this.sessionService) {
-            throw new BadRequestException({
-                message: 'Session service not available',
-                messageKey: AUTH_MESSAGES.SESSION_NOT_AVAILABLE
-            });
-        }
-        const sessionId = await this.sessionService.createSession(user.id);
-        const companiesWithBranches = companies.map((company)=>({
-                ...toCompanyInfo(company),
-                isActive: company.isActive,
-                branches: branches.filter((b)=>b.companyId === company.id).map((b)=>({
-                        ...toBranchInfo(b),
-                        isActive: b.isActive
-                    }))
-            }));
-        return {
-            requiresSelection: true,
-            sessionId,
-            expiresAt: new Date(Date.now() + 5 * 60 * 1000),
-            user: toUserInfo(user),
-            companies: companiesWithBranches
-        };
-    }
-    generateRegistrationResponse(user) {
-        const response = {
-            ...this.generateLoginResponse(user),
-            requiresEmailVerification: false
-        };
-        this.publishAuthEvent(AUTH_EVENT_ENTITIES.USER, AUTH_EVENT_ACTIONS.REGISTERED, user);
-        return response;
-    }
-    generateRegistrationResponseWithCompany(user, company, branch) {
-        const response = {
-            ...this.generateLoginResponseWithCompany(user, company, branch),
-            requiresEmailVerification: false
-        };
-        this.publishAuthEvent(AUTH_EVENT_ENTITIES.USER, AUTH_EVENT_ACTIONS.REGISTERED, user, {
-            companyId: company.id,
-            branchId: branch?.id ?? null
-        });
-        return response;
-    }
-    /** Never awaited - a login must not wait on, or fail because of, the event bus */ publishAuthEvent(entity, action, user, metadata = {}) {
-        void publishDomainEvent({
-            module: AUTH_EVENT_MODULE,
-            entity,
-            action,
-            ids: [
-                user.id
-            ],
-            metadata: {
-                email: user.email,
-                ...metadata
-            },
-            user: {
-                id: user.id,
-                email: user.email
-            }
-        });
-    }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher, notificationAdapter){
-        _define_property(this, "jwtService", void 0);
-        _define_property(this, "authConfig", void 0);
-        _define_property(this, "cacheManager", void 0);
-        _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "sessionService", void 0);
-        _define_property(this, "authEmailService", void 0);
-        _define_property(this, "userEnricher", void 0);
-        _define_property(this, "notificationAdapter", void 0);
-        this.jwtService = jwtService;
-        this.authConfig = authConfig;
-        this.cacheManager = cacheManager;
-        this.dataSourceProvider = dataSourceProvider;
-        this.sessionService = sessionService;
-        this.authEmailService = authEmailService;
-        this.userEnricher = userEnricher;
-        this.notificationAdapter = notificationAdapter;
-    }
-}
-_ts_decorate([
-    LogAction({
-        action: 'auth.login',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "login", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.register',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof RegistrationDto === "undefined" ? Object : RegistrationDto,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "register", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.createUser',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof RegistrationDto === "undefined" ? Object : RegistrationDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "createUserDirectly", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.createUserFromPending',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof PendingRegistration === "undefined" ? Object : PendingRegistration
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "createUserFromPendingRegistration", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.companySwitch',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "validateAndLoginWithCompany", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.refreshToken',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "refreshToken", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.changePassword',
-        module: 'auth',
-        includeParams: false
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "changePassword", null);
-_ts_decorate([
-    LogAction({
-        action: 'auth.logout',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], AuthenticationService.prototype, "logout", null);
-AuthenticationService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Inject(JwtService)),
-    _ts_param(1, Inject(AuthConfigService)),
-    _ts_param(2, Optional()),
-    _ts_param(2, Inject('CACHE_INSTANCE')),
-    _ts_param(3, Optional()),
-    _ts_param(3, Inject(AuthDataSourceProvider)),
-    _ts_param(4, Optional()),
-    _ts_param(4, Inject(CompanySelectionSessionService)),
-    _ts_param(5, Optional()),
-    _ts_param(5, Inject(AuthEmailService)),
-    _ts_param(6, Optional()),
-    _ts_param(6, Inject(USER_ENRICHER)),
-    _ts_param(7, Optional()),
-    _ts_param(7, Inject(NOTIFICATION_ADAPTER)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof JwtService === "undefined" ? Object : JwtService,
-        typeof AuthConfigService === "undefined" ? Object : AuthConfigService,
-        typeof HybridCache === "undefined" ? Object : HybridCache,
-        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
-        typeof CompanySelectionSessionService === "undefined" ? Object : CompanySelectionSessionService,
-        typeof AuthEmailService === "undefined" ? Object : AuthEmailService,
-        typeof IUserEnricher === "undefined" ? Object : IUserEnricher,
-        typeof INotificationAdapter === "undefined" ? Object : INotificationAdapter
-    ])
-], AuthenticationService);