@flusys/nestjs-auth 9.1.0-rc.1 → 9.1.1

package/fesm/24.js

@@ -168,7 +168,9 @@ const COMPANY_MESSAGES = {
     READONLY_DELETE_FORBIDDEN: 'company.readonly.delete.forbidden'
 };
 const BRANCH_MESSAGES = {
-    READONLY_DELETE_FORBIDDEN: 'branch.readonly.delete.forbidden'
+    READONLY_DELETE_FORBIDDEN: 'branch.readonly.delete.forbidden',
+    INVALID_PARENT: 'branch.invalid.parent',
+    CIRCULAR_PARENT: 'branch.circular.parent'
 };
 const USER_PERMISSION_MESSAGES = {
     COMPANY_LIST_SUCCESS: 'user.permission.company.list.success',
@@ -196,7 +198,78 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-2295(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+7526(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_0 = __webpack_require__(9216);
+/* import */ var class_validator__rspack_import_1 = __webpack_require__(5421);
+/* import */ var typeorm__rspack_import_2 = __webpack_require__(7158);
+
+
+
+/** Every branch of the companies the given branches belong to - a parent never leaves its company. */ async function loadCompanyBranchNodes(repo, branchIds, withDeleted = false) {
+    if (!branchIds.length) return [];
+    const seeds = await repo.find({
+        where: {
+            id: (0,typeorm__rspack_import_2.In)([
+                ...branchIds
+            ])
+        },
+        select: [
+            'id',
+            'companyId'
+        ],
+        withDeleted
+    });
+    const companyIds = [
+        ...new Set(seeds.map((b)=>b.companyId))
+    ];
+    if (!companyIds.length) return [];
+    return repo.find({
+        where: {
+            companyId: (0,typeorm__rspack_import_2.In)(companyIds)
+        },
+        select: [
+            'id',
+            'parentId'
+        ],
+        withDeleted
+    });
+}
+/**
+ * For each listed branch, its nearest ancestor that is listed too, or null when none is - the tree parent
+ * inside a list of granted branches. The branches in between are skipped and never sent to the client.
+ */ async function loadDisplayParentIds(repo, branchIds) {
+    const ids = (0,_flusys_nestjs_shared_utils__rspack_import_0.normalizeBranchIds)(branchIds).filter((id)=>(0,class_validator__rspack_import_1.isUUID)(id));
+    const listed = new Set(ids);
+    const nodes = await loadCompanyBranchNodes(repo, ids);
+    return new Map(ids.map((id)=>[
+            id,
+            (0,_flusys_nestjs_shared_utils__rspack_import_0.collectBranchAncestorIds)(nodes, id).find((a)=>listed.has(a)) ?? null
+        ]));
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  v: () => (loadCompanyBranchNodes),
+  x: () => (loadDisplayParentIds)
+});
+
+
+},
+334(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  Vg: () => (/* reexport */ generateAccessToken),
+  e: () => (/* reexport */ generateTokens),
+  vR: () => (/* reexport */ branch_ancestry_helper/* .loadCompanyBranchNodes */.v),
+  xu: () => (/* reexport */ branch_ancestry_helper/* .loadDisplayParentIds */.x),
+  om: () => (/* reexport */ parseExpiryToMs),
+  XP: () => (/* reexport */ revokeUserSessions),
+  QH: () => (/* reexport */ toBranchInfo),
+  $C: () => (/* reexport */ toCompanyInfo),
+  FV: () => (/* reexport */ toUserInfo)
+});
+
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/auth-response.mapper.ts
 function toUserInfo(user) {
     return {
         id: user.id,
@@ -223,15 +296,12 @@ function toBranchInfo(branch) {
     };
 }
 
-__webpack_require__.d(__webpack_exports__, {
-  $C: () => (toCompanyInfo),
-  FV: () => (toUserInfo),
-  QH: () => (toBranchInfo)
-});
-
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/branch-ancestry.helper.ts
+var branch_ancestry_helper = __webpack_require__(7526);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/config/auth.constants.ts
+var auth_constants = __webpack_require__(5588);
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/token.helper.ts
 
-},
-1379(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 function generateAccessToken(jwtService, authConfig, payload) {
     return jwtService.sign({
         ...payload,
@@ -275,12 +345,15 @@ function parseExpiryToMs(expiry) {
             return 7 * 24 * 60 * 60 * 1000;
     }
 }
+/** Rejects every token the user holds that was issued before now: checked on refresh and, by JwtStrategy, on every request. */ async function revokeUserSessions(cache, authConfig, userId) {
+    const revokedAt = Math.floor(Date.now() / 1000);
+    await cache.set(`${auth_constants/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`, revokedAt, parseExpiryToMs(authConfig.getRefreshTokenExpiration()));
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/index.ts
+
+
 
-__webpack_require__.d(__webpack_exports__, {
-  Vg: () => (generateAccessToken),
-  e: () => (generateTokens),
-  om: () => (parseExpiryToMs)
-});
 
 
 },
@@ -437,7 +510,7 @@ function readAvatarUrl(profile) {
     if (typeof data !== 'object' || data === null) return null;
     return readString(data, 'url');
 }
-let FacebookSocialProvider = class FacebookSocialProvider {
+let facebook_social_provider_FacebookSocialProvider = class FacebookSocialProvider {
     provider = social_provider_type_enum/* .SocialProviderTypeEnum.FACEBOOK */.u.FACEBOOK;
     defaultScopes = [
         'email',
@@ -471,7 +544,7 @@ let FacebookSocialProvider = class FacebookSocialProvider {
         };
     }
 };
-const facebookSocialProvider = new FacebookSocialProvider();
+const facebookSocialProvider = new facebook_social_provider_FacebookSocialProvider();
 
 ;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/google.social-provider.ts
 
@@ -479,7 +552,7 @@ const facebookSocialProvider = new FacebookSocialProvider();
 const google_social_provider_AUTHORIZE_URL = 'https://accounts.google.com/o/oauth2/v2/auth';
 const google_social_provider_TOKEN_URL = 'https://oauth2.googleapis.com/token';
 const USERINFO_URL = 'https://openidconnect.googleapis.com/v1/userinfo';
-let GoogleSocialProvider = class GoogleSocialProvider {
+let google_social_provider_GoogleSocialProvider = class GoogleSocialProvider {
     provider = social_provider_type_enum/* .SocialProviderTypeEnum.GOOGLE */.u.GOOGLE;
     defaultScopes = [
         'openid',
@@ -516,7 +589,7 @@ let GoogleSocialProvider = class GoogleSocialProvider {
         };
     }
 };
-const googleSocialProvider = new GoogleSocialProvider();
+const googleSocialProvider = new google_social_provider_GoogleSocialProvider();
 
 ;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/linkedin.social-provider.ts
 
@@ -524,7 +597,7 @@ const googleSocialProvider = new GoogleSocialProvider();
 const linkedin_social_provider_AUTHORIZE_URL = 'https://www.linkedin.com/oauth/v2/authorization';
 const linkedin_social_provider_TOKEN_URL = 'https://www.linkedin.com/oauth/v2/accessToken';
 const linkedin_social_provider_USERINFO_URL = 'https://api.linkedin.com/v2/userinfo';
-let LinkedInSocialProvider = class LinkedInSocialProvider {
+let linkedin_social_provider_LinkedInSocialProvider = class LinkedInSocialProvider {
     provider = social_provider_type_enum/* .SocialProviderTypeEnum.LINKEDIN */.u.LINKEDIN;
     defaultScopes = [
         'openid',
@@ -559,7 +632,7 @@ let LinkedInSocialProvider = class LinkedInSocialProvider {
         };
     }
 };
-const linkedInSocialProvider = new LinkedInSocialProvider();
+const linkedInSocialProvider = new linkedin_social_provider_LinkedInSocialProvider();
 
 ;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/microsoft.social-provider.ts
 
@@ -573,7 +646,7 @@ function resolveTenant(credentials) {
 function endpoint(credentials, action) {
     return `https://login.microsoftonline.com/${resolveTenant(credentials)}/oauth2/v2.0/${action}`;
 }
-let MicrosoftSocialProvider = class MicrosoftSocialProvider {
+let microsoft_social_provider_MicrosoftSocialProvider = class MicrosoftSocialProvider {
     provider = social_provider_type_enum/* .SocialProviderTypeEnum.MICROSOFT */.u.MICROSOFT;
     defaultScopes = [
         'openid',
@@ -614,7 +687,7 @@ let MicrosoftSocialProvider = class MicrosoftSocialProvider {
         };
     }
 };
-const microsoftSocialProvider = new MicrosoftSocialProvider();
+const microsoftSocialProvider = new microsoft_social_provider_MicrosoftSocialProvider();
 
 ;// CONCATENATED MODULE: ./projects/nestjs-auth/src/providers/social-provider.registry.ts
 
@@ -1393,10 +1466,8 @@ var pending_registration_entity = __webpack_require__(9388);
 var user_company_permission_entity = __webpack_require__(2377);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/enums/user-org-permission-type.enum.ts
 var user_org_permission_type_enum = __webpack_require__(5081);
-// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/token.helper.ts
-var token_helper = __webpack_require__(1379);
-// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/auth-response.mapper.ts
-var auth_response_mapper = __webpack_require__(2295);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/index.ts + 2 modules
+var helpers = __webpack_require__(334);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/services/auth-config.service.ts + 1 modules
 var auth_config_service = __webpack_require__(6514);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/services/auth-datasource.provider.ts
@@ -1540,12 +1611,20 @@ class AuthenticationService {
         if (!permissionRepository || !branchRepository) {
             return this.generateLoginResponse(user);
         }
-        const companyPermissions = await permissionRepository.find({
+        const companyGrants = await permissionRepository.find({
             where: {
                 userId: user.id,
                 permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY
             }
         });
+        const companyPermissions = companyGrants.filter((grant)=>grant.isActive);
+        // A user with company grants never gets a company-less login: such a token is not filtered by company
+        if (companyGrants.length && !companyPermissions.length) {
+            throw new common_.ForbiddenException({
+                message: 'User account is deactivated',
+                messageKey: message_keys/* .AUTH_MESSAGES.LOGIN_ACCOUNT_DEACTIVATED */.mK.LOGIN_ACCOUNT_DEACTIVATED
+            });
+        }
         const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
         if (!companyRepository) {
             return this.generateLoginResponse(user);
@@ -1557,6 +1636,12 @@ class AuthenticationService {
             active: true
         }).getMany() : [];
         if (companies.length === 0) {
+            if (companyGrants.length) {
+                throw new common_.ForbiddenException({
+                    message: 'Company not found or inactive',
+                    messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NOT_FOUND */.mK.COMPANY_NOT_FOUND
+                });
+            }
             return this.generateLoginResponse(user);
         }
         const branchPermissions = await permissionRepository.find({
@@ -1568,13 +1653,16 @@ class AuthenticationService {
         const branchIds = branchPermissions.map((p)=>p.targetId);
         const branches = branchIds.length > 0 ? await branchRepository.createQueryBuilder('b').leftJoinAndSelect('b.company', 'company').where('b.id IN (:...ids)', {
             ids: branchIds
+        }).andWhere('b.company_id IN (:...companyIds)', {
+            companyIds: companies.map((c)=>c.id)
         }).andWhere('b.is_active = :active', {
             active: true
         }).getMany() : [];
         if (companies.length === 1 && branches.length === 1) {
             return this.generateLoginResponseWithCompany(user, companies[0], branches[0]);
         }
-        return await this.generateCompanySelectionResponse(user, companies, branches);
+        const displayParentIds = await (0,helpers/* .loadDisplayParentIds */.xu)(branchRepository, branches.map((b)=>b.id));
+        return await this.generateCompanySelectionResponse(user, companies, branches, displayParentIds);
     }
     async register(dto, verifyUrlBase) {
         const userRepository = await this.getUserRepository();
@@ -1933,7 +2021,8 @@ class AuthenticationService {
             where: {
                 userId,
                 permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
-                targetId: companyId
+                targetId: companyId,
+                isActive: true
             }
         });
         if (!hasCompanyAccess) {
@@ -2035,7 +2124,8 @@ class AuthenticationService {
                         where: {
                             userId: user.id,
                             permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
-                            targetId: payload.companyId
+                            targetId: payload.companyId,
+                            isActive: true
                         }
                     });
                     if (!hasCompanyAccess) {
@@ -2078,8 +2168,23 @@ class AuthenticationService {
                         }
                     }
                 }
+            } else {
+                // A company-less session is only for users without company grants (it is not filtered by company)
+                const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
+                const companyGrants = await permissionRepository?.count({
+                    where: {
+                        userId: user.id,
+                        permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY
+                    }
+                });
+                if (companyGrants) {
+                    throw new common_.UnauthorizedException({
+                        message: 'Invalid refresh token',
+                        messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
+                    });
+                }
             }
-            const accessToken = (0,token_helper/* .generateAccessToken */.Vg)(this.jwtService, this.authConfig, {
+            const accessToken = (0,helpers/* .generateAccessToken */.Vg)(this.jwtService, this.authConfig, {
                 id: user.id,
                 email: user.email,
                 type: 'access',
@@ -2133,11 +2238,7 @@ class AuthenticationService {
                 messageKey: message_keys/* .AUTH_MESSAGES.LOGOUT_SERVICE_UNAVAILABLE */.mK.LOGOUT_SERVICE_UNAVAILABLE
             });
         }
-        const revokedAt = Math.floor(Date.now() / 1000);
-        const cacheKey = `${auth_constants/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`;
-        const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
-        const ttlMs = (0,token_helper/* .parseExpiryToMs */.om)(refreshTokenExpiry);
-        await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+        await (0,helpers/* .revokeUserSessions */.XP)(this.cacheManager, this.authConfig, userId);
         await (0,classes_.publishDomainEvent)({
             module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
             entity: event_actions/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION,
@@ -2177,7 +2278,8 @@ class AuthenticationService {
         const permissions = await permissionRepository.find({
             where: {
                 userId,
-                permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY
+                permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
+                isActive: true
             }
         });
         const companyIds = permissions.map((p)=>p.targetId);
@@ -2190,6 +2292,7 @@ class AuthenticationService {
     }
     async getUserBranches(userId, companyId) {
         this.ensureCompanyFeatureEnabled();
+        if (!companyId) return [];
         const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
         const branchRepository = await this.getCompanyScopedRepository(company_branch_entity/* .CompanyBranch */.A);
         if (!permissionRepository || !branchRepository) {
@@ -2205,7 +2308,8 @@ class AuthenticationService {
             where: {
                 userId,
                 permissionType: user_org_permission_type_enum/* .PermissionType.COMPANY */.e.COMPANY,
-                targetId: companyId
+                targetId: companyId,
+                isActive: true
             }
         });
         if (!companyPermission) {
@@ -2222,13 +2326,19 @@ class AuthenticationService {
         });
         const branchIds = branchPermissions.map((p)=>p.targetId);
         if (branchIds.length === 0) return [];
-        return branchRepository.createQueryBuilder('b').where('b.id IN (:...ids)', {
+        const branches = await branchRepository.createQueryBuilder('b').innerJoin('b.company', 'c', 'c.is_active = :companyActive', {
+            companyActive: true
+        }).where('b.id IN (:...ids)', {
             ids: branchIds
         }).andWhere('b.company_id = :companyId', {
             companyId
         }).andWhere('b.is_active = :active', {
             active: true
         }).orderBy('b.serial', 'ASC').addOrderBy('b.name', 'ASC').getMany();
+        const displayParentIds = await (0,helpers/* .loadDisplayParentIds */.xu)(branchRepository, branches.map((b)=>b.id));
+        return branches.map((branch)=>Object.assign(branch, {
+                displayParentId: displayParentIds.get(branch.id) ?? null
+            }));
     }
     async getCompanyById(companyId) {
         const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
@@ -2264,7 +2374,7 @@ class AuthenticationService {
             messageKey: message_keys/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
         });
         const response = {
-            user: (0,auth_response_mapper/* .toUserInfo */.FV)(user)
+            user: (0,helpers/* .toUserInfo */.FV)(user)
         };
         if (this.isCompanyFeatureEnabled()) {
             if (!companyId) {
@@ -2278,14 +2388,14 @@ class AuthenticationService {
                 message: 'Company not found.',
                 messageKey: message_keys/* .AUTH_MESSAGES.COMPANY_NOT_FOUND */.mK.COMPANY_NOT_FOUND
             });
-            response.company = (0,auth_response_mapper/* .toCompanyInfo */.$C)(company);
+            response.company = (0,helpers/* .toCompanyInfo */.$C)(company);
             if (branchId) {
                 const branch = await this.getBranchById(branchId);
                 if (!branch) throw new common_.UnauthorizedException({
                     message: 'Branch not found.',
                     messageKey: message_keys/* .AUTH_MESSAGES.BRANCH_NOT_FOUND */.mK.BRANCH_NOT_FOUND
                 });
-                response.branch = (0,auth_response_mapper/* .toBranchInfo */.QH)(branch);
+                response.branch = (0,helpers/* .toBranchInfo */.QH)(branch);
             }
         }
         return response;
@@ -2316,7 +2426,7 @@ class AuthenticationService {
         return user;
     }
     generateLoginResponse(user) {
-        const { accessToken, refreshToken } = (0,token_helper/* .generateTokens */.e)(this.jwtService, this.authConfig, {
+        const { accessToken, refreshToken } = (0,helpers/* .generateTokens */.e)(this.jwtService, this.authConfig, {
             id: user.id,
             email: user.email,
             type: 'access'
@@ -2326,11 +2436,11 @@ class AuthenticationService {
         return {
             accessToken,
             refreshToken,
-            user: (0,auth_response_mapper/* .toUserInfo */.FV)(user)
+            user: (0,helpers/* .toUserInfo */.FV)(user)
         };
     }
     generateLoginResponseWithCompany(user, company, branch) {
-        const { accessToken, refreshToken } = (0,token_helper/* .generateTokens */.e)(this.jwtService, this.authConfig, {
+        const { accessToken, refreshToken } = (0,helpers/* .generateTokens */.e)(this.jwtService, this.authConfig, {
             id: user.id,
             email: user.email,
             type: 'access',
@@ -2345,9 +2455,9 @@ class AuthenticationService {
         return {
             accessToken,
             refreshToken,
-            user: (0,auth_response_mapper/* .toUserInfo */.FV)(user),
-            company: (0,auth_response_mapper/* .toCompanyInfo */.$C)(company),
-            branch: branch ? (0,auth_response_mapper/* .toBranchInfo */.QH)(branch) : undefined
+            user: (0,helpers/* .toUserInfo */.FV)(user),
+            company: (0,helpers/* .toCompanyInfo */.$C)(company),
+            branch: branch ? (0,helpers/* .toBranchInfo */.QH)(branch) : undefined
         };
     }
     sendLoginNotification(userId, companyId) {
@@ -2363,7 +2473,7 @@ class AuthenticationService {
         // Silent failure - notification is non-critical
         });
     }
-    async generateCompanySelectionResponse(user, companies, branches) {
+    async generateCompanySelectionResponse(user, companies, branches, displayParentIds) {
         if (!this.sessionService) {
             throw new common_.BadRequestException({
                 message: 'Session service not available',
@@ -2372,10 +2482,13 @@ class AuthenticationService {
         }
         const sessionId = await this.sessionService.createSession(user.id);
         const companiesWithBranches = companies.map((company)=>({
-                ...(0,auth_response_mapper/* .toCompanyInfo */.$C)(company),
+                ...(0,helpers/* .toCompanyInfo */.$C)(company),
                 isActive: company.isActive,
                 branches: branches.filter((b)=>b.companyId === company.id).map((b)=>({
-                        ...(0,auth_response_mapper/* .toBranchInfo */.QH)(b),
+                        ...(0,helpers/* .toBranchInfo */.QH)(b),
+                        parentId: b.parentId ?? null,
+                        serial: b.serial ?? null,
+                        displayParentId: displayParentIds.get(b.id) ?? null,
                         isActive: b.isActive
                     }))
             }));
@@ -2383,7 +2496,7 @@ class AuthenticationService {
             requiresSelection: true,
             sessionId,
             expiresAt: new Date(Date.now() + 5 * 60 * 1000),
-            user: (0,auth_response_mapper/* .toUserInfo */.FV)(user),
+            user: (0,helpers/* .toUserInfo */.FV)(user),
             companies: companiesWithBranches
         };
     }
@@ -2564,13 +2677,15 @@ AuthenticationService = _ts_decorate([
 /* import */ var _flusys_nestjs_shared_modules__rspack_import_2 = __webpack_require__(1236);
 /* import */ var _flusys_nestjs_shared_utils__rspack_import_3 = __webpack_require__(9216);
 /* import */ var _nestjs_common__rspack_import_4 = __webpack_require__(6157);
-/* import */ var typeorm__rspack_import_5 = __webpack_require__(7158);
-/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(7987);
-/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(5363);
-/* import */ var _entities_company_branch_entity_js__rspack_import_6 = __webpack_require__(1923);
-/* import */ var _entities_user_company_permission_entity_js__rspack_import_7 = __webpack_require__(2377);
-/* import */ var _auth_config_service_js__rspack_import_8 = __webpack_require__(6514);
-/* import */ var _auth_datasource_provider_js__rspack_import_9 = __webpack_require__(2732);
+/* import */ var class_validator__rspack_import_5 = __webpack_require__(5421);
+/* import */ var typeorm__rspack_import_6 = __webpack_require__(7158);
+/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(5363);
+/* import */ var _entities_company_branch_entity_js__rspack_import_7 = __webpack_require__(1923);
+/* import */ var _helpers_branch_ancestry_helper_js__rspack_import_8 = __webpack_require__(7526);
+/* import */ var _entities_user_company_permission_entity_js__rspack_import_9 = __webpack_require__(2377);
+/* import */ var _auth_config_service_js__rspack_import_10 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_11 = __webpack_require__(2732);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -2605,45 +2720,121 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
 class BranchService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
     cacheManager;
     utilsService;
     authConfig;
     permissionSyncAdapter;
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig, permissionSyncAdapter){
-        super(_config_index_js__rspack_import_10/* .AUTH_EVENT_ENTITIES.COMPANY_BRANCH */.g.COMPANY_BRANCH, cacheManager, utilsService, BranchService.name, true, (/* inlined export .AUTH_EVENT_MODULE */"auth"), dataSourceProvider, _entities_company_branch_entity_js__rspack_import_6/* .CompanyBranch */.A), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.permissionSyncAdapter = permissionSyncAdapter;
+        super(_config_index_js__rspack_import_12/* .AUTH_EVENT_ENTITIES.COMPANY_BRANCH */.g.COMPANY_BRANCH, cacheManager, utilsService, BranchService.name, true, (/* inlined export .AUTH_EVENT_MODULE */"auth"), dataSourceProvider, _entities_company_branch_entity_js__rspack_import_7/* .CompanyBranch */.A), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.permissionSyncAdapter = permissionSyncAdapter;
+    }
+    async beforeInsertOperation(dto, _user, queryRunner) {
+        for (const d of Array.isArray(dto) ? dto : [
+            dto
+        ]){
+            if (d.parentId) await this.validateParent(null, d.parentId, d.companyId, queryRunner);
+        }
+    }
+    async beforeUpdateOperation(dto, _user, queryRunner) {
+        const repo = queryRunner.manager.getRepository(_entities_company_branch_entity_js__rspack_import_7/* .CompanyBranch */.A);
+        for (const d of Array.isArray(dto) ? dto : [
+            dto
+        ]){
+            if (!d.id || d.parentId === undefined && d.companyId === undefined) continue;
+            const existing = await repo.findOne({
+                where: {
+                    id: d.id
+                },
+                select: [
+                    'id',
+                    'companyId',
+                    'parentId'
+                ]
+            });
+            if (!existing) continue;
+            const parentId = d.parentId === undefined ? existing.parentId : d.parentId;
+            if (!parentId) continue;
+            await this.validateParent(d.id, parentId, d.companyId ?? existing.companyId, queryRunner);
+        }
+    }
+    async validateParent(branchId, parentId, companyId, queryRunner) {
+        const repo = queryRunner.manager.getRepository(_entities_company_branch_entity_js__rspack_import_7/* .CompanyBranch */.A);
+        const parent = await repo.findOne({
+            where: {
+                id: parentId,
+                deletedAt: (0,typeorm__rspack_import_6.IsNull)()
+            },
+            select: [
+                'id',
+                'companyId',
+                'parentId'
+            ]
+        });
+        if (!parent || parent.companyId !== companyId) {
+            throw new _nestjs_common__rspack_import_4.BadRequestException({
+                message: 'Parent branch must belong to the same company',
+                messageKey: _config_index_js__rspack_import_13/* .BRANCH_MESSAGES.INVALID_PARENT */.W1.INVALID_PARENT
+            });
+        }
+        if (!branchId) return;
+        const visited = new Set();
+        let current = parent;
+        while(current){
+            if (current.id === branchId || visited.has(current.id)) {
+                throw new _nestjs_common__rspack_import_4.BadRequestException({
+                    message: 'A branch cannot be moved under itself or its descendants',
+                    messageKey: _config_index_js__rspack_import_13/* .BRANCH_MESSAGES.CIRCULAR_PARENT */.W1.CIRCULAR_PARENT
+                });
+            }
+            visited.add(current.id);
+            current = current.parentId ? await repo.findOne({
+                where: {
+                    id: current.parentId
+                },
+                select: [
+                    'id',
+                    'parentId'
+                ]
+            }) : null;
+        }
     }
     async beforeDeleteOperation(dto, user, queryRunner) {
-        const branchIds = Array.isArray(dto.id) ? dto.id : [
+        const requestedIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
+        const branchIds = dto.type === 'restore' ? requestedIds : (0,_flusys_nestjs_shared_utils__rspack_import_3.collectBranchDescendantIds)(await (0,_helpers_branch_ancestry_helper_js__rspack_import_8/* .loadCompanyBranchNodes */.v)(queryRunner.manager.getRepository(_entities_company_branch_entity_js__rspack_import_7/* .CompanyBranch */.A), requestedIds, dto.type === 'permanent'), requestedIds, {
+            includeSelf: true
+        });
+        dto.id = branchIds;
         await this.ensureDataSourceRepository();
         const readonlyBranches = await this.repository.find({
             where: {
-                id: (0,typeorm__rspack_import_5.In)(branchIds),
+                id: (0,typeorm__rspack_import_6.In)(branchIds),
                 readOnly: true,
-                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_6.IsNull)()
             }
         });
         if (readonlyBranches.length > 0) {
             const names = readonlyBranches.map((b)=>b.name).join(', ');
             throw new _nestjs_common__rspack_import_4.ForbiddenException({
                 message: `Cannot delete readonly branch(es): ${names}`,
-                messageKey: _config_index_js__rspack_import_11/* .BRANCH_MESSAGES.READONLY_DELETE_FORBIDDEN */.W1.READONLY_DELETE_FORBIDDEN,
+                messageKey: _config_index_js__rspack_import_13/* .BRANCH_MESSAGES.READONLY_DELETE_FORBIDDEN */.W1.READONLY_DELETE_FORBIDDEN,
                 messageVariables: {
                     names
                 }
             });
         }
-        await queryRunner.manager.getRepository(_entities_user_company_permission_entity_js__rspack_import_7/* .UserCompanyPermission */.I).delete({
-            targetId: (0,typeorm__rspack_import_5.In)(branchIds)
+        await queryRunner.manager.getRepository(_entities_user_company_permission_entity_js__rspack_import_9/* .UserCompanyPermission */.I).delete({
+            targetId: (0,typeorm__rspack_import_6.In)(branchIds)
         });
         if (!this.permissionSyncAdapter?.onBranchDeleted) {
             return;
         }
-        const rows = await queryRunner.manager.getRepository(_entities_company_branch_entity_js__rspack_import_6/* .CompanyBranch */.A).find({
+        const rows = await queryRunner.manager.getRepository(_entities_company_branch_entity_js__rspack_import_7/* .CompanyBranch */.A).find({
             where: {
-                id: (0,typeorm__rspack_import_5.In)(branchIds)
+                id: (0,typeorm__rspack_import_6.In)(branchIds)
             },
             select: [
                 'id',
@@ -2652,6 +2843,30 @@ class BranchService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiSe
         });
         await Promise.all(rows.map((row)=>this.permissionSyncAdapter.onBranchDeleted(row.id, row.companyId)));
     }
+    // Hierarchy - ids that are empty or not UUIDs match no branch (and never reach a uuid column)
+    async getDescendantIds(branchIds, options = {}) {
+        const ids = (0,_flusys_nestjs_shared_utils__rspack_import_3.normalizeBranchIds)(branchIds).filter((id)=>(0,class_validator__rspack_import_5.isUUID)(id));
+        if (!ids.length) return [];
+        await this.ensureDataSourceRepository();
+        const nodes = await (0,_helpers_branch_ancestry_helper_js__rspack_import_8/* .loadCompanyBranchNodes */.v)(this.repository, ids);
+        const known = new Set(nodes.map((b)=>b.id));
+        return (0,_flusys_nestjs_shared_utils__rspack_import_3.collectBranchDescendantIds)(nodes, ids.filter((id)=>known.has(id)), options);
+    }
+    async getAncestorIds(branchId, options = {}) {
+        if (!branchId || !(0,class_validator__rspack_import_5.isUUID)(branchId)) return [];
+        await this.ensureDataSourceRepository();
+        const nodes = await (0,_helpers_branch_ancestry_helper_js__rspack_import_8/* .loadCompanyBranchNodes */.v)(this.repository, [
+            branchId
+        ]);
+        if (!nodes.some((b)=>b.id === branchId)) return [];
+        return (0,_flusys_nestjs_shared_utils__rspack_import_3.collectBranchAncestorIds)(nodes, branchId, options);
+    }
+    async isWithinBranch(branchId, ancestorId) {
+        if (!ancestorId) return false;
+        return (await this.getAncestorIds(branchId, {
+            includeSelf: true
+        })).includes(ancestorId);
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -2661,6 +2876,8 @@ class BranchService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiSe
                 'slug',
                 'email',
                 'phone',
+                'parentId',
+                'serial',
                 'isActive',
                 'readOnly',
                 'createdAt'
@@ -2701,16 +2918,16 @@ BranchService = _ts_decorate([
     }),
     _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)('CACHE_INSTANCE')),
     _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_2.UtilsService)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_auth_config_service_js__rspack_import_8/* .AuthConfigService */.W)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_auth_config_service_js__rspack_import_10/* .AuthConfigService */.W)),
     _ts_param(4, (0,_nestjs_common__rspack_import_4.Optional)()),
     _ts_param(4, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_1.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
         typeof _flusys_nestjs_shared_modules__rspack_import_2.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_2.UtilsService,
-        typeof _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v,
-        typeof _auth_config_service_js__rspack_import_8/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_8/* .AuthConfigService */.W,
+        typeof _auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v,
+        typeof _auth_config_service_js__rspack_import_10/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_10/* .AuthConfigService */.W,
         typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
     ])
 ], BranchService);
@@ -3420,11 +3637,13 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
 /* import */ var _flusys_nestjs_shared_interfaces__rspack_import_2 = __webpack_require__(5103);
 /* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
-/* import */ var _config_index_js__rspack_import_7 = __webpack_require__(5363);
-/* import */ var _config_index_js__rspack_import_8 = __webpack_require__(7987);
-/* import */ var _entities_user_company_permission_entity_js__rspack_import_4 = __webpack_require__(2377);
-/* import */ var _auth_config_service_js__rspack_import_5 = __webpack_require__(6514);
-/* import */ var _auth_datasource_provider_js__rspack_import_6 = __webpack_require__(2732);
+/* import */ var _config_index_js__rspack_import_9 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(7987);
+/* import */ var _entities_company_branch_entity_js__rspack_import_4 = __webpack_require__(1923);
+/* import */ var _entities_user_company_permission_entity_js__rspack_import_5 = __webpack_require__(2377);
+/* import */ var _helpers_branch_ancestry_helper_js__rspack_import_6 = __webpack_require__(7526);
+/* import */ var _auth_config_service_js__rspack_import_7 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_8 = __webpack_require__(2732);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -3456,6 +3675,8 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
 class UserPermissionService {
     dataSourceProvider;
     authConfig;
@@ -3471,7 +3692,7 @@ class UserPermissionService {
    * for a company or branch outside their own company.
    */ async getRepository() {
         if (!this._repository) {
-            this._repository = await this.dataSourceProvider.getRepository(_entities_user_company_permission_entity_js__rspack_import_4/* .UserCompanyPermission */.I);
+            this._repository = await this.dataSourceProvider.getRepository(_entities_user_company_permission_entity_js__rspack_import_5/* .UserCompanyPermission */.I);
         }
         return this._repository;
     }
@@ -3484,7 +3705,7 @@ class UserPermissionService {
                 permissionType: type
             },
             relations: [
-                type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch'
+                type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch'
             ],
             order: {
                 createdAt: 'DESC'
@@ -3493,7 +3714,7 @@ class UserPermissionService {
     }
     /** Assign permission to user */ async assignPermission(userId, targetId, type) {
         const repository = await this.getRepository();
-        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
+        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
         const existing = await repository.findOne({
             where: {
                 userId,
@@ -3504,7 +3725,7 @@ class UserPermissionService {
         if (existing) {
             throw new _nestjs_common__rspack_import_3.ConflictException({
                 message: `User already assigned to this ${typeName}`,
-                messageKey: _config_index_js__rspack_import_7/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
+                messageKey: _config_index_js__rspack_import_9/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
                 messageVariables: {
                     type: typeName
                 }
@@ -3521,7 +3742,7 @@ class UserPermissionService {
             if (err?.code === 'ER_DUP_ENTRY' || String(err?.message).includes('Duplicate entry')) {
                 throw new _nestjs_common__rspack_import_3.ConflictException({
                     message: `User already assigned to this ${typeName}. Please refresh and try again.`,
-                    messageKey: _config_index_js__rspack_import_7/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
+                    messageKey: _config_index_js__rspack_import_9/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
                     messageVariables: {
                         type: typeName
                     }
@@ -3529,11 +3750,11 @@ class UserPermissionService {
             }
             throw error;
         }
-        await this.publishPermissionEvent(_config_index_js__rspack_import_8/* .AUTH_EVENT_ACTIONS.PERMISSION_GRANTED */.o.PERMISSION_GRANTED, userId, targetId, type);
+        await this.publishPermissionEvent(_config_index_js__rspack_import_10/* .AUTH_EVENT_ACTIONS.PERMISSION_GRANTED */.o.PERMISSION_GRANTED, userId, targetId, type);
     }
     async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
-        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
+        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
         const permission = await repository.findOne({
             where: {
                 userId,
@@ -3541,33 +3762,33 @@ class UserPermissionService {
                 permissionType: type
             },
             relations: [
-                type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.BRANCH */.e.BRANCH ? 'branch' : 'company'
+                type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH ? 'branch' : 'company'
             ]
         });
         if (!permission) {
             throw new _nestjs_common__rspack_import_3.NotFoundException({
                 message: `${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`,
-                messageKey: _config_index_js__rspack_import_7/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
+                messageKey: _config_index_js__rspack_import_9/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
                 messageVariables: {
                     type: typeName.charAt(0).toUpperCase() + typeName.slice(1)
                 }
             });
         }
-        const companyId = type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY ? targetId : permission.branch?.companyId;
+        const companyId = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? targetId : permission.branch?.companyId;
         await repository.remove(permission);
-        if (type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY) {
+        if (type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY) {
             const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
             await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
             await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
         } else {
             if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
         }
-        await this.publishPermissionEvent(_config_index_js__rspack_import_8/* .AUTH_EVENT_ACTIONS.PERMISSION_REVOKED */.o.PERMISSION_REVOKED, userId, targetId, type, companyId);
+        await this.publishPermissionEvent(_config_index_js__rspack_import_10/* .AUTH_EVENT_ACTIONS.PERMISSION_REVOKED */.o.PERMISSION_REVOKED, userId, targetId, type, companyId);
     }
     async publishPermissionEvent(action, userId, targetId, type, companyId) {
         await (0,_flusys_nestjs_shared_classes__rspack_import_1.publishDomainEvent)({
             module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
-            entity: _config_index_js__rspack_import_8/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION,
+            entity: _config_index_js__rspack_import_10/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION,
             action,
             ids: [
                 targetId
@@ -3585,7 +3806,7 @@ class UserPermissionService {
         const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
             userId
         }).andWhere('permission.permissionType = :type', {
-            type: _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.BRANCH */.e.BRANCH
+            type: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
         }).andWhere('branch.companyId = :companyId', {
             companyId
         }).getMany();
@@ -3596,13 +3817,13 @@ class UserPermissionService {
         return branchPermissions.map((permission)=>permission.targetId);
     }
     // Convenience Methods
-    findUserCompanies = (userId)=>this.findUserPermissions(userId, _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY);
+    findUserCompanies = (userId)=>this.findUserPermissions(userId, _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY);
     /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
         const repository = await this.getRepository();
         const queryBuilder = repository.createQueryBuilder('permission').leftJoinAndSelect('permission.branch', 'branch').where('permission.userId = :userId', {
             userId
         }).andWhere('permission.permissionType = :type', {
-            type: _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.BRANCH */.e.BRANCH
+            type: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
         }).orderBy('permission.createdAt', 'DESC');
         if (companyId) {
             queryBuilder.andWhere('branch.companyId = :companyId', {
@@ -3611,13 +3832,16 @@ class UserPermissionService {
         }
         return queryBuilder.getMany();
     }
+    async findDisplayParentIds(branchIds) {
+        return (0,_helpers_branch_ancestry_helper_js__rspack_import_6/* .loadDisplayParentIds */.x)(await this.dataSourceProvider.getRepository(_entities_company_branch_entity_js__rspack_import_4/* .CompanyBranch */.A), branchIds);
+    }
     // Reverse Lookups (target -> users)
     /** Find all users permitted for a given company */ async findUsersForCompany(companyId) {
         const repository = await this.getRepository();
         return repository.find({
             where: {
                 targetId: companyId,
-                permissionType: _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY
+                permissionType: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY
             },
             relations: [
                 'user'
@@ -3632,7 +3856,7 @@ class UserPermissionService {
         return repository.find({
             where: {
                 targetId: branchId,
-                permissionType: _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.BRANCH */.e.BRANCH
+                permissionType: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
             },
             relations: [
                 'user'
@@ -3652,7 +3876,7 @@ _ts_decorate([
     _ts_metadata("design:paramtypes", [
         String,
         String,
-        typeof _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType */.e
+        typeof _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e
     ]),
     _ts_metadata("design:returntype", Promise)
 ], UserPermissionService.prototype, "assignPermission", null);
@@ -3665,7 +3889,7 @@ _ts_decorate([
     _ts_metadata("design:paramtypes", [
         String,
         String,
-        typeof _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType */.e
+        typeof _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e
     ]),
     _ts_metadata("design:returntype", Promise)
 ], UserPermissionService.prototype, "revokePermission", null);
@@ -3673,14 +3897,14 @@ UserPermissionService = _ts_decorate([
     (0,_nestjs_common__rspack_import_3.Injectable)({
         scope: _nestjs_common__rspack_import_3.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_6/* .AuthDataSourceProvider */.v)),
-    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_config_service_js__rspack_import_5/* .AuthConfigService */.W)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_config_service_js__rspack_import_7/* .AuthConfigService */.W)),
     _ts_param(2, (0,_nestjs_common__rspack_import_3.Optional)()),
     _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _auth_datasource_provider_js__rspack_import_6/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_6/* .AuthDataSourceProvider */.v,
-        typeof _auth_config_service_js__rspack_import_5/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_5/* .AuthConfigService */.W,
+        typeof _auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v,
+        typeof _auth_config_service_js__rspack_import_7/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_7/* .AuthConfigService */.W,
         typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
     ])
 ], UserPermissionService);
@@ -3698,15 +3922,16 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _flusys_nestjs_shared_modules__rspack_import_3 = __webpack_require__(1236);
 /* import */ var _nestjs_common__rspack_import_4 = __webpack_require__(6157);
 /* import */ var bcrypt__rspack_import_5 = __webpack_require__(7176);
-/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(7987);
-/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(5363);
-/* import */ var _config_index_js__rspack_import_14 = __webpack_require__(5588);
-/* import */ var _dtos_user_dto_js__rspack_import_6 = __webpack_require__(7265);
-/* import */ var _entities_app_user_entity_js__rspack_import_7 = __webpack_require__(4758);
-/* import */ var _entities_user_company_permission_entity_js__rspack_import_8 = __webpack_require__(2377);
-/* import */ var _enums_index_js__rspack_import_13 = __webpack_require__(5081);
-/* import */ var _auth_config_service_js__rspack_import_9 = __webpack_require__(6514);
-/* import */ var _auth_datasource_provider_js__rspack_import_10 = __webpack_require__(2732);
+/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_15 = __webpack_require__(5588);
+/* import */ var _helpers_index_js__rspack_import_6 = __webpack_require__(334);
+/* import */ var _dtos_user_dto_js__rspack_import_7 = __webpack_require__(7265);
+/* import */ var _entities_app_user_entity_js__rspack_import_8 = __webpack_require__(4758);
+/* import */ var _entities_user_company_permission_entity_js__rspack_import_9 = __webpack_require__(2377);
+/* import */ var _enums_index_js__rspack_import_14 = __webpack_require__(5081);
+/* import */ var _auth_config_service_js__rspack_import_10 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_11 = __webpack_require__(2732);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -3743,6 +3968,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiService {
     cacheManager;
     utilsService;
@@ -3752,14 +3978,14 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
     dataSource;
     logAdapter = (0,_flusys_nestjs_shared_classes__rspack_import_1.createModuleLogger)('auth');
     constructor(cacheManager, utilsService, dataSourceProvider, authConfig, userEnricher){
-        super(_config_index_js__rspack_import_11/* .AUTH_EVENT_ENTITIES.USER */.g.USER, cacheManager, utilsService, UserService.name, true, (/* inlined export .AUTH_EVENT_MODULE */"auth"), dataSourceProvider, _entities_app_user_entity_js__rspack_import_7/* .AppUser */.$), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.userEnricher = userEnricher;
+        super(_config_index_js__rspack_import_12/* .AUTH_EVENT_ENTITIES.USER */.g.USER, cacheManager, utilsService, UserService.name, true, (/* inlined export .AUTH_EVENT_MODULE */"auth"), dataSourceProvider, _entities_app_user_entity_js__rspack_import_8/* .AppUser */.$), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.userEnricher = userEnricher;
     }
     async ensureDataSourceRepository() {
         await super.ensureDataSourceRepository();
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
         if (isCompanyFeatureEnabled && !this.permissionRepository) {
             [this.permissionRepository] = await this.resolveRepositories([
-                _entities_user_company_permission_entity_js__rspack_import_8/* .UserCompanyPermission */.I
+                _entities_user_company_permission_entity_js__rspack_import_9/* .UserCompanyPermission */.I
             ]);
         }
         if (!this.dataSource) {
@@ -3770,7 +3996,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
         if (userId !== user.id) {
             throw new _nestjs_common__rspack_import_4.ForbiddenException({
                 message: "Cannot access another user's profile",
-                messageKey: _config_index_js__rspack_import_12/* .AUTH_MESSAGES.PROFILE_ACCESS_DENIED */.mK.PROFILE_ACCESS_DENIED
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PROFILE_ACCESS_DENIED */.mK.PROFILE_ACCESS_DENIED
             });
         }
         await this.ensureDataSourceRepository();
@@ -3782,7 +4008,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
         if (!userEntity) {
             throw new _nestjs_common__rspack_import_4.NotFoundException({
                 message: 'User not found',
-                messageKey: _config_index_js__rspack_import_12/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_13/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
             });
         }
         return userEntity;
@@ -3822,14 +4048,14 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
             const permission = await this.permissionRepository.findOne({
                 where: {
                     userId: id,
-                    permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+                    permissionType: _enums_index_js__rspack_import_14/* .PermissionType.COMPANY */.e.COMPANY,
                     targetId: user.companyId
                 }
             });
             if (!permission) {
                 throw new _nestjs_common__rspack_import_4.NotFoundException({
                     message: 'User company permission not found',
-                    messageKey: _config_index_js__rspack_import_12/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
+                    messageKey: _config_index_js__rspack_import_13/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
                     messageVariables: {
                         type: 'User company'
                     }
@@ -3842,6 +4068,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
                 isActive
             });
         }
+        if (!isActive) await (0,_helpers_index_js__rspack_import_6/* .revokeUserSessions */.XP)(this.cacheManager, this.authConfig, id);
         await Promise.all([
             this.clearCacheForAll(),
             this.clearCacheForId([
@@ -3993,7 +4220,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
         AND perm.permission_type = :permissionType
         AND perm.target_id = :companyId
       LIMIT 1)`, 'appuser_companyIsActive');
-        query.setParameter('permissionType', _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY);
+        query.setParameter('permissionType', _enums_index_js__rspack_import_14/* .PermissionType.COMPANY */.e.COMPANY);
         query.setParameter('companyId', user.companyId);
         // Filter by isActive within the company if requested
         if (filter?.isActive !== undefined) {
@@ -4004,7 +4231,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
           AND perm.target_id = :companyId
           AND perm.is_active = :isActiveValue
       )`, {
-                permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+                permissionType: _enums_index_js__rspack_import_14/* .PermissionType.COMPANY */.e.COMPANY,
                 companyId: user.companyId,
                 isActiveValue: filter.isActive
             });
@@ -4016,7 +4243,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
         AND perm.permission_type = :permissionType
         AND perm.target_id = :companyId
     )`, {
-            permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+            permissionType: _enums_index_js__rspack_import_14/* .PermissionType.COMPANY */.e.COMPANY,
             companyId: user.companyId
         });
         return {
@@ -4038,14 +4265,14 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
             const existingPermission = await queryRunner.manager.findOne(this.permissionRepository.target, {
                 where: {
                     userId: savedUser.id,
-                    permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+                    permissionType: _enums_index_js__rspack_import_14/* .PermissionType.COMPANY */.e.COMPANY,
                     targetId: user.companyId
                 }
             });
             if (!existingPermission) {
                 const permission = queryRunner.manager.create(this.permissionRepository.target, {
                     userId: savedUser.id,
-                    permissionType: _enums_index_js__rspack_import_13/* .PermissionType.COMPANY */.e.COMPANY,
+                    permissionType: _enums_index_js__rspack_import_14/* .PermissionType.COMPANY */.e.COMPANY,
                     targetId: user.companyId,
                     isActive: dto.isActive ?? true
                 });
@@ -4055,14 +4282,14 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
                 const existingBranchPermission = await queryRunner.manager.findOne(this.permissionRepository.target, {
                     where: {
                         userId: savedUser.id,
-                        permissionType: _enums_index_js__rspack_import_13/* .PermissionType.BRANCH */.e.BRANCH,
+                        permissionType: _enums_index_js__rspack_import_14/* .PermissionType.BRANCH */.e.BRANCH,
                         targetId: user.branchId
                     }
                 });
                 if (!existingBranchPermission) {
                     const branchPermission = queryRunner.manager.create(this.permissionRepository.target, {
                         userId: savedUser.id,
-                        permissionType: _enums_index_js__rspack_import_13/* .PermissionType.BRANCH */.e.BRANCH,
+                        permissionType: _enums_index_js__rspack_import_14/* .PermissionType.BRANCH */.e.BRANCH,
                         targetId: user.branchId,
                         isActive: dto.isActive ?? true
                     });
@@ -4134,7 +4361,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
         if (!this.userEnricher?.updateProfileSection) {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Profile sections not supported',
-                messageKey: _config_index_js__rspack_import_12/* .AUTH_MESSAGES.PROFILE_SECTIONS_NOT_SUPPORTED */.mK.PROFILE_SECTIONS_NOT_SUPPORTED
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PROFILE_SECTIONS_NOT_SUPPORTED */.mK.PROFILE_SECTIONS_NOT_SUPPORTED
             });
         }
         const queryRunner = this.dataSource.createQueryRunner();
@@ -4187,7 +4414,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
             if (!findUser) {
                 throw new _nestjs_common__rspack_import_4.NotFoundException({
                     message: 'User not found',
-                    messageKey: _config_index_js__rspack_import_12/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+                    messageKey: _config_index_js__rspack_import_13/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
                 });
             }
             if (dto.password) {
@@ -4196,14 +4423,14 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
                     if (!dto.oldPassword) {
                         throw new _nestjs_common__rspack_import_4.BadRequestException({
                             message: 'Current password is required to change your password',
-                            messageKey: _config_index_js__rspack_import_12/* .AUTH_MESSAGES.PASSWORD_CHANGE_CURRENT_REQUIRED */.mK.PASSWORD_CHANGE_CURRENT_REQUIRED
+                            messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_CHANGE_CURRENT_REQUIRED */.mK.PASSWORD_CHANGE_CURRENT_REQUIRED
                         });
                     }
                     const isPasswordValid = await bcrypt__rspack_import_5.compare(dto.oldPassword, findUser.password);
                     if (!isPasswordValid) {
                         throw new _nestjs_common__rspack_import_4.BadRequestException({
                             message: 'Current password is incorrect',
-                            messageKey: _config_index_js__rspack_import_12/* .AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT */.mK.PASSWORD_CHANGE_INVALID_CURRENT
+                            messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT */.mK.PASSWORD_CHANGE_INVALID_CURRENT
                         });
                     }
                 }
@@ -4274,7 +4501,7 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _dtos_user_dto_js__rspack_import_6/* .CreateUserDto */.TG === "undefined" ? Object : _dtos_user_dto_js__rspack_import_6/* .CreateUserDto */.TG,
+        typeof _dtos_user_dto_js__rspack_import_7/* .CreateUserDto */.TG === "undefined" ? Object : _dtos_user_dto_js__rspack_import_7/* .CreateUserDto */.TG,
         Object
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -4313,16 +4540,16 @@ UserService = _ts_decorate([
     }),
     _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)('CACHE_INSTANCE')),
     _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_3.UtilsService)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_auth_datasource_provider_js__rspack_import_10/* .AuthDataSourceProvider */.v)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_auth_config_service_js__rspack_import_9/* .AuthConfigService */.W)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_auth_config_service_js__rspack_import_10/* .AuthConfigService */.W)),
     _ts_param(4, (0,_nestjs_common__rspack_import_4.Optional)()),
-    _ts_param(4, (0,_nestjs_common__rspack_import_4.Inject)(_config_index_js__rspack_import_14/* .USER_ENRICHER */.jt)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Inject)(_config_index_js__rspack_import_15/* .USER_ENRICHER */.jt)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_1.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_1.HybridCache,
         typeof _flusys_nestjs_shared_modules__rspack_import_3.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_3.UtilsService,
-        typeof _auth_datasource_provider_js__rspack_import_10/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_10/* .AuthDataSourceProvider */.v,
-        typeof _auth_config_service_js__rspack_import_9/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_9/* .AuthConfigService */.W,
+        typeof _auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v,
+        typeof _auth_config_service_js__rspack_import_10/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_10/* .AuthConfigService */.W,
         typeof IUserEnricher === "undefined" ? Object : IUserEnricher
     ])
 ], UserService);