@flusys/nestjs-auth 7.1.0 → 8.0.0

package/fesm/services/authentication.service.spec.js

@@ -1,975 +0,0 @@
-import { BadRequestException, ForbiddenException, NotFoundException, UnauthorizedException } from '@nestjs/common';
-import * as bcrypt from 'bcrypt';
-import { createMockRepository } from '@test-utils/mocks/repository.mock';
-import { EventBusRegistry } from '@flusys/nestjs-shared/classes';
-import { AuthenticationService } from './authentication.service';
-import { AppUser } from '../entities/app-user.entity';
-import { Company } from '../entities/company.entity';
-import { CompanyBranch } from '../entities/company-branch.entity';
-import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
-jest.mock('bcrypt', ()=>({
-        hash: jest.fn().mockResolvedValue('hashed-password'),
-        compare: jest.fn().mockResolvedValue(true)
-    }));
-function buildUser(overrides = {}) {
-    return {
-        id: 'user-1',
-        email: 'user@example.com',
-        name: 'Test User',
-        phone: null,
-        password: 'hashed',
-        isActive: true,
-        emailVerified: true,
-        phoneVerified: false,
-        profilePictureId: null,
-        lastLoginAt: null,
-        additionalFields: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        deletedAt: null,
-        createdById: null,
-        updatedById: null,
-        deletedById: null,
-        ...overrides
-    };
-}
-function buildCompany(overrides = {}) {
-    return {
-        id: 'company-1',
-        name: 'Acme Corp',
-        slug: 'acme-corp',
-        logoId: null,
-        isActive: true,
-        readOnly: false,
-        address: null,
-        phone: null,
-        email: null,
-        website: null,
-        serial: null,
-        settings: null,
-        additionalFields: null,
-        branches: [],
-        ...overrides
-    };
-}
-function buildBranch(overrides = {}) {
-    return {
-        id: 'branch-1',
-        name: 'Main Branch',
-        slug: 'main-branch',
-        companyId: 'company-1',
-        logoId: null,
-        isActive: true,
-        readOnly: false,
-        address: null,
-        phone: null,
-        email: null,
-        serial: null,
-        additionalFields: null,
-        parentId: null,
-        parent: null,
-        children: [],
-        ...overrides
-    };
-}
-describe('AuthenticationService', ()=>{
-    let userRepo;
-    let companyRepo;
-    let branchRepo;
-    let permissionRepo;
-    let mockJwtService;
-    let mockAuthConfig;
-    let mockCacheManager;
-    let mockDataSourceProvider;
-    let mockSessionService;
-    let mockAuthEmailService;
-    let mockUserEnricher;
-    let companyFeatureEnabled;
-    let emailVerificationEnabled;
-    let signUpEnabled;
-    function buildService(overrides = {}) {
-        return new AuthenticationService(mockJwtService, mockAuthConfig, 'cacheManager' in overrides ? overrides.cacheManager : mockCacheManager, 'dataSourceProvider' in overrides ? overrides.dataSourceProvider : mockDataSourceProvider, 'sessionService' in overrides ? overrides.sessionService : mockSessionService, 'authEmailService' in overrides ? overrides.authEmailService : mockAuthEmailService, 'userEnricher' in overrides ? overrides.userEnricher : mockUserEnricher, 'notificationAdapter' in overrides ? overrides.notificationAdapter : undefined);
-    }
-    beforeEach(()=>{
-        jest.clearAllMocks();
-        bcrypt.compare.mockResolvedValue(true);
-        bcrypt.hash.mockResolvedValue('hashed-password');
-        userRepo = createMockRepository();
-        companyRepo = createMockRepository();
-        branchRepo = createMockRepository();
-        permissionRepo = createMockRepository();
-        Object.assign(branchRepo.createQueryBuilder(), {
-            leftJoinAndSelect: jest.fn().mockReturnThis()
-        });
-        companyFeatureEnabled = false;
-        emailVerificationEnabled = false;
-        signUpEnabled = true;
-        mockJwtService = {
-            sign: jest.fn().mockReturnValue('signed-token'),
-            verify: jest.fn()
-        };
-        mockAuthConfig = {
-            isCompanyFeatureEnabled: jest.fn().mockImplementation(()=>companyFeatureEnabled),
-            isEmailVerificationEnabled: jest.fn().mockImplementation(()=>emailVerificationEnabled),
-            isSignUpEnabled: jest.fn().mockImplementation(()=>signUpEnabled),
-            getJwtSecret: jest.fn().mockReturnValue('jwt-secret'),
-            getJwtExpiration: jest.fn().mockReturnValue('1h'),
-            getRefreshTokenSecret: jest.fn().mockReturnValue('refresh-secret'),
-            getRefreshTokenExpiration: jest.fn().mockReturnValue('7d')
-        };
-        mockCacheManager = {
-            get: jest.fn(),
-            set: jest.fn(),
-            del: jest.fn()
-        };
-        mockDataSourceProvider = {
-            isCompanyFeatureEnabled: jest.fn().mockImplementation(()=>companyFeatureEnabled),
-            isEmailVerificationEnabled: jest.fn().mockImplementation(()=>emailVerificationEnabled),
-            isSignUpEnabled: jest.fn().mockImplementation(()=>signUpEnabled),
-            getRepository: jest.fn().mockImplementation(async (entity)=>{
-                if (entity === AppUser) return userRepo;
-                if (entity === Company) return companyRepo;
-                if (entity === CompanyBranch) return branchRepo;
-                if (entity === UserCompanyPermission) return permissionRepo;
-                throw new Error(`Unexpected entity: ${String(entity)}`);
-            }),
-            getDataSource: jest.fn()
-        };
-        mockSessionService = {
-            createSession: jest.fn().mockResolvedValue('session-1'),
-            consumeSession: jest.fn()
-        };
-        mockAuthEmailService = {
-            isEmailEnabled: jest.fn().mockReturnValue(true),
-            hasPendingRegistration: jest.fn().mockResolvedValue(false),
-            createPendingRegistration: jest.fn()
-        };
-        mockUserEnricher = {
-            onUserCreated: jest.fn()
-        };
-    });
-    describe('login', ()=>{
-        it('throws UnauthorizedException for a non-existent user (invalid credentials)', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.login('missing@example.com', 'password')).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws UnauthorizedException when the password does not match', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            bcrypt.compare.mockResolvedValue(false);
-            const service = buildService();
-            await expect(service.login('user@example.com', 'wrong-password')).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws ForbiddenException when the account is deactivated', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser({
-                isActive: false
-            }));
-            userRepo.save.mockResolvedValue(buildUser({
-                isActive: false
-            }));
-            const service = buildService();
-            await expect(service.login('user@example.com', 'password')).rejects.toThrow(ForbiddenException);
-        });
-        it('returns requiresEmailVerification when a pending registration exists for the email', async ()=>{
-            emailVerificationEnabled = true;
-            mockAuthEmailService.hasPendingRegistration.mockResolvedValue(true);
-            const service = buildService();
-            const result = await service.login('pending@example.com', 'password');
-            expect(result).toEqual(expect.objectContaining({
-                requiresEmailVerification: true,
-                email: 'pending@example.com'
-            }));
-            expect(userRepo.findOne).not.toHaveBeenCalled();
-        });
-        it('returns requiresEmailVerification when the user has not verified their email', async ()=>{
-            emailVerificationEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser({
-                emailVerified: false
-            }));
-            userRepo.save.mockResolvedValue(buildUser({
-                emailVerified: false
-            }));
-            const service = buildService();
-            const result = await service.login('user@example.com', 'password');
-            expect(result).toEqual(expect.objectContaining({
-                requiresEmailVerification: true
-            }));
-        });
-        it('logs in successfully without the company feature enabled', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            userRepo.save.mockResolvedValue(buildUser());
-            const service = buildService();
-            const result = await service.login('user@example.com', 'password');
-            expect(result).toEqual(expect.objectContaining({
-                accessToken: 'signed-token',
-                refreshToken: 'signed-token',
-                user: expect.objectContaining({
-                    id: 'user-1'
-                })
-            }));
-            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
-                lastLoginAt: expect.any(Date)
-            }));
-        });
-        it('auto-logs in with company/branch when the user has exactly one of each', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            userRepo.save.mockResolvedValue(buildUser());
-            permissionRepo.find.mockImplementation(async ({ where })=>{
-                if (where.permissionType === PermissionType.COMPANY) {
-                    return [
-                        {
-                            targetId: 'company-1'
-                        }
-                    ];
-                }
-                return [
-                    {
-                        targetId: 'branch-1'
-                    }
-                ];
-            });
-            companyRepo.createQueryBuilder().getMany.mockResolvedValue([
-                buildCompany()
-            ]);
-            branchRepo.createQueryBuilder().getMany.mockResolvedValue([
-                buildBranch()
-            ]);
-            const service = buildService();
-            const result = await service.login('user@example.com', 'password');
-            expect(result).toEqual(expect.objectContaining({
-                company: expect.objectContaining({
-                    id: 'company-1'
-                }),
-                branch: expect.objectContaining({
-                    id: 'branch-1'
-                })
-            }));
-        });
-        it('returns a company selection response when the user has multiple companies', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            userRepo.save.mockResolvedValue(buildUser());
-            permissionRepo.find.mockImplementation(async ({ where })=>{
-                if (where.permissionType === PermissionType.COMPANY) {
-                    return [
-                        {
-                            targetId: 'company-1'
-                        },
-                        {
-                            targetId: 'company-2'
-                        }
-                    ];
-                }
-                return [];
-            });
-            companyRepo.createQueryBuilder().getMany.mockResolvedValue([
-                buildCompany(),
-                buildCompany({
-                    id: 'company-2'
-                })
-            ]);
-            const service = buildService();
-            const result = await service.login('user@example.com', 'password');
-            expect(result).toEqual(expect.objectContaining({
-                requiresSelection: true,
-                sessionId: 'session-1'
-            }));
-            expect(mockSessionService.createSession).toHaveBeenCalledWith('user-1');
-        });
-        it('falls back to a plain login response when company feature is enabled but the user has no company', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            userRepo.save.mockResolvedValue(buildUser());
-            permissionRepo.find.mockResolvedValue([]);
-            const service = buildService();
-            const result = await service.login('user@example.com', 'password');
-            expect(result).toEqual(expect.objectContaining({
-                accessToken: 'signed-token'
-            }));
-            expect(result.company).toBeUndefined();
-        });
-    });
-    describe('register', ()=>{
-        it('throws BadRequestException when the email exists and company feature is disabled', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            const service = buildService();
-            await expect(service.register({
-                email: 'user@example.com',
-                name: 'Test',
-                password: 'Password1!'
-            })).rejects.toThrow(BadRequestException);
-        });
-        it('throws BadRequestException when the email belongs to a permanently deleted account', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser({
-                deletedAt: new Date()
-            }));
-            const service = buildService();
-            await expect(service.register({
-                email: 'user@example.com',
-                name: 'Test',
-                password: 'Password1!'
-            })).rejects.toThrow(BadRequestException);
-            expect(userRepo.findOne).toHaveBeenCalledWith(expect.objectContaining({
-                withDeleted: true
-            }));
-        });
-        it('routes existing users to company registration when the company feature is enabled', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyRepo.findOne.mockResolvedValue(null);
-            companyRepo.createQueryBuilder().getMany.mockResolvedValue([]);
-            companyRepo.create.mockReturnValue(buildCompany());
-            companyRepo.save.mockResolvedValue(buildCompany());
-            branchRepo.create.mockReturnValue(buildBranch());
-            branchRepo.save.mockResolvedValue(buildBranch());
-            permissionRepo.save.mockResolvedValue({});
-            const service = buildService();
-            const result = await service.register({
-                email: 'user@example.com',
-                name: 'Test',
-                password: 'Password1!',
-                newCompanyName: 'New Co'
-            });
-            expect(result).toEqual(expect.objectContaining({
-                accessToken: expect.any(String)
-            }));
-        });
-        it('throws BadRequestException for a new user when sign-up is disabled', async ()=>{
-            signUpEnabled = false;
-            userRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.register({
-                email: 'new@example.com',
-                name: 'New User',
-                password: 'Password1!'
-            })).rejects.toThrow(BadRequestException);
-        });
-        it('sends a verification email and returns requiresEmailVerification when email verification is enabled', async ()=>{
-            emailVerificationEnabled = true;
-            userRepo.findOne.mockResolvedValue(null);
-            mockAuthEmailService.createPendingRegistration.mockResolvedValue({
-                success: true,
-                message: 'sent',
-                messageKey: 'email.verification.sent'
-            });
-            const service = buildService();
-            const result = await service.register({
-                email: 'new@example.com',
-                name: 'New User',
-                password: 'Password1!'
-            }, 'https://app.test/verify');
-            expect(result).toEqual(expect.objectContaining({
-                requiresEmailVerification: true
-            }));
-            expect(mockAuthEmailService.createPendingRegistration).toHaveBeenCalled();
-        });
-        it('creates the user directly and hashes the password when email verification is not required', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            const queryRunner = {
-                connect: jest.fn(),
-                startTransaction: jest.fn(),
-                commitTransaction: jest.fn(),
-                rollbackTransaction: jest.fn(),
-                release: jest.fn(),
-                manager: {
-                    create: jest.fn().mockReturnValue(buildUser()),
-                    save: jest.fn().mockResolvedValue(buildUser())
-                }
-            };
-            mockDataSourceProvider.getDataSource.mockResolvedValue({
-                createQueryRunner: ()=>queryRunner
-            });
-            const service = buildService();
-            const result = await service.register({
-                email: 'new@example.com',
-                name: 'New User',
-                password: 'Password1!'
-            });
-            expect(bcrypt.hash).toHaveBeenCalledWith('Password1!', 12);
-            expect(queryRunner.commitTransaction).toHaveBeenCalled();
-            expect(result).toEqual(expect.objectContaining({
-                accessToken: expect.any(String)
-            }));
-        });
-        it('rolls back the transaction and rethrows a BadRequestException on failure', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            const queryRunner = {
-                connect: jest.fn(),
-                startTransaction: jest.fn(),
-                commitTransaction: jest.fn(),
-                rollbackTransaction: jest.fn(),
-                release: jest.fn(),
-                manager: {
-                    create: jest.fn().mockReturnValue(buildUser()),
-                    save: jest.fn().mockRejectedValue(new Error('db error'))
-                }
-            };
-            mockDataSourceProvider.getDataSource.mockResolvedValue({
-                createQueryRunner: ()=>queryRunner
-            });
-            const service = buildService();
-            await expect(service.register({
-                email: 'new@example.com',
-                name: 'New',
-                password: 'Password1!'
-            })).rejects.toThrow(BadRequestException);
-            expect(queryRunner.rollbackTransaction).toHaveBeenCalled();
-            expect(queryRunner.release).toHaveBeenCalled();
-        });
-    });
-    describe('refreshToken', ()=>{
-        it('throws UnauthorizedException when the token is malformed/invalid', async ()=>{
-            mockJwtService.verify.mockImplementation(()=>{
-                throw new Error('invalid signature');
-            });
-            const service = buildService();
-            await expect(service.refreshToken('bad-token')).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws UnauthorizedException when the token has been revoked', async ()=>{
-            mockJwtService.verify.mockReturnValue({
-                id: 'user-1',
-                iat: 1000
-            });
-            mockCacheManager.get.mockResolvedValue(2000);
-            const service = buildService();
-            await expect(service.refreshToken('revoked-token')).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws UnauthorizedException when the user no longer exists or is inactive', async ()=>{
-            mockJwtService.verify.mockReturnValue({
-                id: 'user-1',
-                iat: 1000
-            });
-            mockCacheManager.get.mockResolvedValue(undefined);
-            userRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.refreshToken('token')).rejects.toThrow(UnauthorizedException);
-        });
-        it('issues a new token pair for a valid non-company refresh token', async ()=>{
-            mockJwtService.verify.mockReturnValue({
-                id: 'user-1',
-                iat: 1000
-            });
-            mockCacheManager.get.mockResolvedValue(undefined);
-            userRepo.findOne.mockResolvedValue(buildUser());
-            const service = buildService();
-            const result = await service.refreshToken('token');
-            expect(result).toEqual({
-                accessToken: 'signed-token',
-                refreshToken: 'signed-token'
-            });
-        });
-        it('throws UnauthorizedException when the company from the payload no longer exists', async ()=>{
-            mockJwtService.verify.mockReturnValue({
-                id: 'user-1',
-                iat: 1000,
-                companyId: 'company-1'
-            });
-            mockCacheManager.get.mockResolvedValue(undefined);
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyFeatureEnabled = true;
-            companyRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.refreshToken('token')).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws UnauthorizedException when the user no longer has access to the payload company', async ()=>{
-            mockJwtService.verify.mockReturnValue({
-                id: 'user-1',
-                iat: 1000,
-                companyId: 'company-1'
-            });
-            mockCacheManager.get.mockResolvedValue(undefined);
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyFeatureEnabled = true;
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            permissionRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.refreshToken('token')).rejects.toThrow(UnauthorizedException);
-        });
-        it('validates branch access when a branchId is present in the payload', async ()=>{
-            mockJwtService.verify.mockReturnValue({
-                id: 'user-1',
-                iat: 1000,
-                companyId: 'company-1',
-                branchId: 'branch-1'
-            });
-            mockCacheManager.get.mockResolvedValue(undefined);
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyFeatureEnabled = true;
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            permissionRepo.findOne.mockResolvedValue({});
-            branchRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.refreshToken('token')).rejects.toThrow(UnauthorizedException);
-        });
-        it('issues a new token pair when company and branch access is valid', async ()=>{
-            mockJwtService.verify.mockReturnValue({
-                id: 'user-1',
-                iat: 1000,
-                companyId: 'company-1',
-                branchId: 'branch-1'
-            });
-            mockCacheManager.get.mockResolvedValue(undefined);
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyFeatureEnabled = true;
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            permissionRepo.findOne.mockResolvedValue({});
-            branchRepo.findOne.mockResolvedValue(buildBranch());
-            const service = buildService();
-            const result = await service.refreshToken('token');
-            expect(result).toEqual({
-                accessToken: 'signed-token',
-                refreshToken: 'signed-token'
-            });
-        });
-    });
-    describe('changePassword', ()=>{
-        it('throws UnauthorizedException when the user does not exist', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.changePassword('user-1', 'old', 'NewPass1!')).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws UnauthorizedException when the current password is incorrect', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            bcrypt.compare.mockResolvedValue(false);
-            const service = buildService();
-            await expect(service.changePassword('user-1', 'wrong', 'NewPass1!')).rejects.toThrow(UnauthorizedException);
-        });
-        it('hashes and saves the new password on success', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            userRepo.save.mockResolvedValue(buildUser());
-            const service = buildService();
-            await service.changePassword('user-1', 'old', 'NewPass1!');
-            expect(bcrypt.hash).toHaveBeenCalledWith('NewPass1!', 12);
-            expect(userRepo.save).toHaveBeenCalledWith(expect.objectContaining({
-                password: 'hashed-password'
-            }));
-        });
-    });
-    describe('logout', ()=>{
-        it('throws BadRequestException when the cache manager is unavailable', async ()=>{
-            const service = buildService({
-                cacheManager: undefined
-            });
-            await expect(service.logout('user-1')).rejects.toThrow(BadRequestException);
-        });
-        it('records the revocation timestamp in the cache', async ()=>{
-            const service = buildService();
-            await service.logout('user-1');
-            expect(mockCacheManager.set).toHaveBeenCalledWith('auth:revoked:user-1', expect.any(Number), expect.any(Number));
-        });
-    });
-    describe('isTokenRevoked', ()=>{
-        it('returns false when there is no cache manager', async ()=>{
-            const service = buildService({
-                cacheManager: undefined
-            });
-            expect(await service.isTokenRevoked('user-1', 1000)).toBe(false);
-        });
-        it('returns false when tokenIssuedAt is not provided', async ()=>{
-            const service = buildService();
-            expect(await service.isTokenRevoked('user-1')).toBe(false);
-        });
-        it('returns false when nothing has been revoked', async ()=>{
-            mockCacheManager.get.mockResolvedValue(undefined);
-            const service = buildService();
-            expect(await service.isTokenRevoked('user-1', 1000)).toBe(false);
-        });
-        it('returns true when the token was issued before the revocation time', async ()=>{
-            mockCacheManager.get.mockResolvedValue(2000);
-            const service = buildService();
-            expect(await service.isTokenRevoked('user-1', 1000)).toBe(true);
-        });
-        it('returns false when the token was issued after the revocation time', async ()=>{
-            mockCacheManager.get.mockResolvedValue(500);
-            const service = buildService();
-            expect(await service.isTokenRevoked('user-1', 1000)).toBe(false);
-        });
-    });
-    describe('getUserCompanies / getUserBranches', ()=>{
-        it('throws BadRequestException when the company feature is disabled', async ()=>{
-            const service = buildService();
-            await expect(service.getUserCompanies('user-1')).rejects.toThrow(BadRequestException);
-        });
-        it('returns an empty array when the user has no company permissions', async ()=>{
-            companyFeatureEnabled = true;
-            permissionRepo.find.mockResolvedValue([]);
-            const service = buildService();
-            expect(await service.getUserCompanies('user-1')).toEqual([]);
-        });
-        it('returns companies the user has access to', async ()=>{
-            companyFeatureEnabled = true;
-            permissionRepo.find.mockResolvedValue([
-                {
-                    targetId: 'company-1'
-                }
-            ]);
-            companyRepo.createQueryBuilder().getMany.mockResolvedValue([
-                buildCompany()
-            ]);
-            const service = buildService();
-            const result = await service.getUserCompanies('user-1');
-            expect(result).toEqual([
-                buildCompany()
-            ]);
-        });
-        it('throws UnauthorizedException from getUserBranches when the user lacks company access', async ()=>{
-            companyFeatureEnabled = true;
-            permissionRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.getUserBranches('user-1', 'company-1')).rejects.toThrow(UnauthorizedException);
-        });
-        it('returns branches the user has access to within the company', async ()=>{
-            companyFeatureEnabled = true;
-            permissionRepo.findOne.mockResolvedValue({});
-            permissionRepo.find.mockResolvedValue([
-                {
-                    targetId: 'branch-1'
-                }
-            ]);
-            branchRepo.createQueryBuilder().getMany.mockResolvedValue([
-                buildBranch()
-            ]);
-            const service = buildService();
-            const result = await service.getUserBranches('user-1', 'company-1');
-            expect(result).toEqual([
-                buildBranch()
-            ]);
-        });
-    });
-    describe('getCompanyById / getBranchById', ()=>{
-        it('getCompanyById returns null when the company feature is disabled (scoped repo unavailable)', async ()=>{
-            companyFeatureEnabled = false;
-            const service = buildService();
-            expect(await service.getCompanyById('company-1')).toBeNull();
-            expect(companyRepo.findOne).not.toHaveBeenCalled();
-        });
-        it('getCompanyById returns the company by id when found', async ()=>{
-            companyFeatureEnabled = true;
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            const service = buildService();
-            const result = await service.getCompanyById('company-1');
-            expect(companyRepo.findOne).toHaveBeenCalledWith({
-                where: {
-                    id: 'company-1'
-                }
-            });
-            expect(result).toEqual(buildCompany());
-        });
-        it('getCompanyById returns null when no company matches', async ()=>{
-            companyFeatureEnabled = true;
-            companyRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            expect(await service.getCompanyById('missing')).toBeNull();
-        });
-        it('getBranchById returns null when the company feature is disabled (scoped repo unavailable)', async ()=>{
-            companyFeatureEnabled = false;
-            const service = buildService();
-            expect(await service.getBranchById('branch-1')).toBeNull();
-            expect(branchRepo.findOne).not.toHaveBeenCalled();
-        });
-        it('getBranchById returns the branch by id when found', async ()=>{
-            companyFeatureEnabled = true;
-            branchRepo.findOne.mockResolvedValue(buildBranch());
-            const service = buildService();
-            const result = await service.getBranchById('branch-1');
-            expect(branchRepo.findOne).toHaveBeenCalledWith({
-                where: {
-                    id: 'branch-1'
-                }
-            });
-            expect(result).toEqual(buildBranch());
-        });
-    });
-    describe('select', ()=>{
-        it('throws BadRequestException when the company feature is disabled', async ()=>{
-            const service = buildService();
-            await expect(service.select('session-1', 'company-1', 'branch-1')).rejects.toThrow(BadRequestException);
-        });
-        it('throws UnauthorizedException when the session is invalid or expired', async ()=>{
-            companyFeatureEnabled = true;
-            mockSessionService.consumeSession.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.select('bad-session', 'company-1', 'branch-1')).rejects.toThrow(UnauthorizedException);
-        });
-        it('logs in with the selected company/branch when the session is valid', async ()=>{
-            companyFeatureEnabled = true;
-            mockSessionService.consumeSession.mockResolvedValue({
-                sessionId: 'session-1',
-                userId: 'user-1',
-                createdAt: new Date(),
-                expiresAt: new Date()
-            });
-            userRepo.findOne.mockResolvedValue(buildUser());
-            permissionRepo.findOne.mockResolvedValue({});
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            branchRepo.findOne.mockResolvedValue(buildBranch());
-            const service = buildService();
-            const result = await service.select('session-1', 'company-1', 'branch-1');
-            expect(result).toEqual(expect.objectContaining({
-                accessToken: 'signed-token'
-            }));
-        });
-    });
-    describe('switchCompany / validateAndLoginWithCompany', ()=>{
-        it('throws NotFoundException when the user does not exist', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(NotFoundException);
-        });
-        it('throws ForbiddenException when the user has no access to the company', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            permissionRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(ForbiddenException);
-        });
-        it('throws NotFoundException when the company is inactive or missing', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            permissionRepo.findOne.mockResolvedValueOnce({}).mockResolvedValueOnce(null);
-            companyRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(NotFoundException);
-        });
-        it('throws ForbiddenException when the user has no access to the branch', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            permissionRepo.findOne.mockResolvedValueOnce({}).mockResolvedValueOnce(null);
-            const service = buildService();
-            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(ForbiddenException);
-        });
-        it('throws NotFoundException when the branch is inactive or missing', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            permissionRepo.findOne.mockResolvedValue({});
-            branchRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.switchCompany('user-1', 'company-1', 'branch-1')).rejects.toThrow(NotFoundException);
-        });
-        it('returns a new login response when switching succeeds', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            permissionRepo.findOne.mockResolvedValue({});
-            branchRepo.findOne.mockResolvedValue(buildBranch());
-            const service = buildService();
-            const result = await service.switchCompany('user-1', 'company-1', 'branch-1');
-            expect(result).toEqual(expect.objectContaining({
-                accessToken: 'signed-token',
-                company: expect.objectContaining({
-                    id: 'company-1'
-                }),
-                branch: expect.objectContaining({
-                    id: 'branch-1'
-                })
-            }));
-        });
-    });
-    describe('getUserInfo', ()=>{
-        it('throws UnauthorizedException when the user does not exist', async ()=>{
-            userRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.getUserInfo('user-1')).rejects.toThrow(UnauthorizedException);
-        });
-        it('returns only user info when the company feature is disabled', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            const service = buildService();
-            const result = await service.getUserInfo('user-1');
-            expect(result).toEqual({
-                user: expect.objectContaining({
-                    id: 'user-1'
-                })
-            });
-        });
-        it('throws UnauthorizedException when the company feature is enabled but no companyId is given', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            const service = buildService();
-            await expect(service.getUserInfo('user-1')).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws UnauthorizedException when the company cannot be found', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.getUserInfo('user-1', 'company-1')).rejects.toThrow(UnauthorizedException);
-        });
-        it('throws UnauthorizedException when the branch cannot be found', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            branchRepo.findOne.mockResolvedValue(null);
-            const service = buildService();
-            await expect(service.getUserInfo('user-1', 'company-1', 'branch-1')).rejects.toThrow(UnauthorizedException);
-        });
-        it('returns user, company, and branch info when everything resolves', async ()=>{
-            companyFeatureEnabled = true;
-            userRepo.findOne.mockResolvedValue(buildUser());
-            companyRepo.findOne.mockResolvedValue(buildCompany());
-            branchRepo.findOne.mockResolvedValue(buildBranch());
-            const service = buildService();
-            const result = await service.getUserInfo('user-1', 'company-1', 'branch-1');
-            expect(result).toEqual({
-                user: expect.objectContaining({
-                    id: 'user-1'
-                }),
-                company: expect.objectContaining({
-                    id: 'company-1'
-                }),
-                branch: expect.objectContaining({
-                    id: 'branch-1'
-                })
-            });
-        });
-    });
-    describe('createUserFromPendingRegistration', ()=>{
-        it('throws BadRequestException when the email is already registered', async ()=>{
-            const queryRunner = {
-                connect: jest.fn(),
-                startTransaction: jest.fn(),
-                commitTransaction: jest.fn(),
-                rollbackTransaction: jest.fn(),
-                release: jest.fn(),
-                manager: {
-                    findOne: jest.fn().mockResolvedValue(buildUser()),
-                    create: jest.fn(),
-                    save: jest.fn()
-                }
-            };
-            mockDataSourceProvider.getDataSource.mockResolvedValue({
-                createQueryRunner: ()=>queryRunner
-            });
-            const service = buildService();
-            await expect(service.createUserFromPendingRegistration({
-                email: 'user@example.com',
-                name: 'Test',
-                passwordHash: 'hash'
-            })).rejects.toThrow(BadRequestException);
-            expect(queryRunner.rollbackTransaction).toHaveBeenCalled();
-        });
-        it('throws BadRequestException when the email belongs to a permanently deleted account', async ()=>{
-            const queryRunner = {
-                connect: jest.fn(),
-                startTransaction: jest.fn(),
-                commitTransaction: jest.fn(),
-                rollbackTransaction: jest.fn(),
-                release: jest.fn(),
-                manager: {
-                    findOne: jest.fn().mockResolvedValue(buildUser({
-                        deletedAt: new Date()
-                    })),
-                    create: jest.fn(),
-                    save: jest.fn()
-                }
-            };
-            mockDataSourceProvider.getDataSource.mockResolvedValue({
-                createQueryRunner: ()=>queryRunner
-            });
-            const service = buildService();
-            await expect(service.createUserFromPendingRegistration({
-                email: 'user@example.com',
-                name: 'Test',
-                passwordHash: 'hash'
-            })).rejects.toThrow(BadRequestException);
-            expect(queryRunner.manager.findOne).toHaveBeenCalledWith(AppUser, expect.objectContaining({
-                withDeleted: true
-            }));
-            expect(queryRunner.manager.create).not.toHaveBeenCalled();
-            expect(queryRunner.rollbackTransaction).toHaveBeenCalled();
-        });
-        it('creates the user with the email marked as verified', async ()=>{
-            const queryRunner = {
-                connect: jest.fn(),
-                startTransaction: jest.fn(),
-                commitTransaction: jest.fn(),
-                rollbackTransaction: jest.fn(),
-                release: jest.fn(),
-                manager: {
-                    findOne: jest.fn().mockResolvedValue(null),
-                    create: jest.fn().mockReturnValue(buildUser({
-                        emailVerified: true
-                    })),
-                    save: jest.fn().mockResolvedValue(buildUser({
-                        emailVerified: true
-                    }))
-                }
-            };
-            mockDataSourceProvider.getDataSource.mockResolvedValue({
-                createQueryRunner: ()=>queryRunner
-            });
-            const service = buildService();
-            const result = await service.createUserFromPendingRegistration({
-                email: 'new@example.com',
-                name: 'New User',
-                passwordHash: 'hash'
-            });
-            expect(queryRunner.manager.create).toHaveBeenCalledWith(AppUser, expect.objectContaining({
-                emailVerified: true
-            }));
-            expect(result).toEqual(expect.objectContaining({
-                accessToken: expect.any(String)
-            }));
-        });
-    });
-    describe('domain events', ()=>{
-        let publish;
-        beforeEach(()=>{
-            publish = jest.fn().mockResolvedValue(undefined);
-            EventBusRegistry.reset();
-            EventBusRegistry.setBus({
-                publish,
-                subscribe: jest.fn(),
-                close: jest.fn()
-            });
-            EventBusRegistry.configureModule('auth', {
-                enabled: true
-            });
-        });
-        afterEach(()=>{
-            EventBusRegistry.reset();
-        });
-        it('publishes auth.session.logged-in when a session is issued', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            bcrypt.compare.mockResolvedValue(true);
-            const service = buildService();
-            await service.login('user@example.com', 'password');
-            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
-                name: 'auth.session.logged-in',
-                action: 'logged-in',
-                payload: expect.objectContaining({
-                    ids: [
-                        'user-1'
-                    ]
-                })
-            }));
-        });
-        it('publishes auth.session.logged-out on logout', async ()=>{
-            const service = buildService();
-            await service.logout('user-1');
-            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
-                name: 'auth.session.logged-out'
-            }));
-        });
-        it('publishes auth.appuser.password-changed after a successful password change', async ()=>{
-            userRepo.findOne.mockResolvedValue(buildUser());
-            bcrypt.compare.mockResolvedValue(true);
-            const service = buildService();
-            await service.changePassword('user-1', 'old', 'new');
-            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
-                name: 'auth.appuser.password-changed'
-            }));
-        });
-        it('does not publish when the auth module has events disabled', async ()=>{
-            EventBusRegistry.configureModule('auth', {
-                enabled: false
-            });
-            const service = buildService();
-            await service.logout('user-1');
-            expect(publish).not.toHaveBeenCalled();
-        });
-    });
-});