@flusys/nestjs-auth 9.1.0 → 9.1.1

package/README.md

@@ -49,6 +49,8 @@ AuthModule.forRoot({
 });
 ```
 
+Browser logins get the refresh token as an HttpOnly cookie lasting `refreshTokenExpiration`. Sending `rememberMe: false` in the body of `POST /auth/login` or `POST /auth/select` makes it a session cookie instead (dropped when the browser closes).
+
 #### Mode 2: Multi-Tenant
 
 In multi-tenant mode you provide:
@@ -333,6 +335,22 @@ then works. Signing **in** is never affected by either — only account creation
 A cache instance is required: `AuthModule` imports `CacheModule`, so this is
 satisfied by default.
 
+## 6. Branch Hierarchy
+
+Branches nest through `parentId`. A parent must be in the same company and cannot create a cycle, and deleting a branch also deletes every branch under it. `BranchService` exposes the hierarchy, each lookup taking two queries whatever the depth:
+
+- `getDescendantIds(branchIds, { includeSelf?, maxDepth? })` - every branch under the given one(s), level by level
+- `getAncestorIds(branchId, { includeSelf?, maxDepth? })` - the parent chain, nearest parent first
+- `isWithinBranch(branchId, ancestorId)`
+
+Only existing, not soft-deleted branches are returned (with `includeSelf` too); empty or non-UUID ids match nothing and never reach the database.
+
+With the company feature on, the module also provides and exports `BRANCH_HIERARCHY_RESOLVER` (`BranchHierarchyResolverAdapter`), which adds `getGrantedBranchIds(userId, companyId?)`, `getGrantedDescendantIds(userId, branchIds, options?)` and `hasBranchAccess(userId, branchId)`. Branch grants are explicit: each checkbox in the permission dialog grants exactly that branch, and a grant on a parent never reaches a child that is not granted itself (Parent and Level 2 granted, Level 1 not: picking Parent scopes to Parent + Level 2, never Level 1). Granted branches are exactly what company select offers. `auth.module.scope.spec.ts` keeps both resolvers singletons. Login, company select and switch offer and accept only granted branches. The login selection response, `get-my-company-branches` (empty for an inactive company, like company select) and `administration/permissions/get-user-branch` carry each branch's `parentId`, `serial` and `displayParentId` - the nearest ancestor that is also in the list (granted), or null (`loadDisplayParentIds`). Clients nest by it, so a granted branch under an ungranted parent sits under its nearest granted ancestor, and the ids of ungranted branches in between are never sent; `get-user-branch` filters to the `companyId` sent, or to the caller's current company when it is omitted or empty. See the nestjs-shared README (Branch Hierarchy) for the helpers and an example.
+
+## 7. Deactivating a User
+
+With the company feature off, `UserService.updateStatus` sets `AppUser.isActive`, which blocks login, token refresh and every request. With it on, it deactivates the user in the admin's current company only, by setting `isActive` on that company grant (`UserCompanyPermission`, `permissionType: company`). Login, company select, select/switch, token refresh, `get-my-companies` / `get-my-company-branches` and `COMPANY_ACCESS_RESOLVER` all skip an inactive company grant, and deactivating (in either mode) also ends every session of the user at once, the same way logout does (`revokeUserSessions`, checked on refresh and by `JwtStrategy` on every request). The user can log straight back in to the companies they are still active in. A user with company grants never gets a company-less login (such a token is not filtered by company): login is refused when they are deactivated in every company (`auth.login.account.deactivated`) or none of their companies is active (`auth.company.not.found`), and a company-less refresh token is not renewed once the user has company grants. Branch grants carry no status of their own.
+
 ## License
 
 MIT © FLUSYS

package/config/message-keys.d.ts

@@ -88,6 +88,8 @@ export declare const COMPANY_MESSAGES: {
 };
 export declare const BRANCH_MESSAGES: {
     readonly READONLY_DELETE_FORBIDDEN: "branch.readonly.delete.forbidden";
+    readonly INVALID_PARENT: "branch.invalid.parent";
+    readonly CIRCULAR_PARENT: "branch.circular.parent";
 };
 export declare const USER_PERMISSION_MESSAGES: {
     readonly COMPANY_LIST_SUCCESS: "user.permission.company.list.success";

package/controllers/company-selection.controller.d.ts

@@ -6,16 +6,18 @@ export declare class CompanySelectionController {
     constructor(authService: AuthenticationService);
     select(dto: SelectDto): Promise<SingleResponseDto<LoginResponseDto>>;
     switchCompany(userId: string, dto: SwitchCompanyDto): Promise<SingleResponseDto<LoginResponseDto>>;
-    getUserCompanies(userId: string): Promise<{
+    getMyCompanies(userId: string): Promise<{
         success: boolean;
         message: string;
         messageKey: "auth.company.list.success";
         data: import("../index.js").Company[];
     }>;
-    getUserBranches(userId: string, companyId: string): Promise<{
+    getMyCompanyBranches(userId: string, companyId: string): Promise<{
         success: boolean;
         message: string;
         messageKey: "auth.branch.list.success";
-        data: import("../index.js").CompanyBranch[];
+        data: (import("../index.js").CompanyBranch & {
+            displayParentId: string | null;
+        })[];
     }>;
 }

package/controllers/user-permission.controller.d.ts

@@ -4,20 +4,20 @@ import { UserPermissionService } from '../services/user-permission.service.js';
 export declare class UserPermissionController {
     private readonly permissionService;
     constructor(permissionService: UserPermissionService);
-    assignUserCompany(dto: AssignUserCompanyDto, user: ILoggedUserInfo): Promise<{
+    assignUserCompany(dto: AssignUserCompanyDto): Promise<{
         success: boolean;
         message: string;
         messageKey: string;
         messageVariables: Record<string, number>;
     }>;
     getUserCompanies(userId: string): Promise<UserCompaniesResponseDto>;
-    assignUserBranch(dto: AssignUserBranchDto, user: ILoggedUserInfo): Promise<{
+    assignUserBranch(dto: AssignUserBranchDto): Promise<{
         success: boolean;
         message: string;
         messageKey: string;
         messageVariables: Record<string, number>;
     }>;
-    getUserBranches(userId: string, companyId?: string): Promise<UserBranchesResponseDto>;
+    getUserBranches(userId: string, user: ILoggedUserInfo, companyId?: string): Promise<UserBranchesResponseDto>;
     getCompanyUsers(dto: GetCompanyUsersDto): Promise<CompanyPermittedUsersResponseDto>;
     getBranchUsers(dto: GetBranchUsersDto): Promise<BranchPermittedUsersResponseDto>;
     private processBatchPermissions;

package/dtos/authentication.dto.d.ts

@@ -1,6 +1,7 @@
 export declare class LoginDto {
     email: string;
     password: string;
+    rememberMe?: boolean;
 }
 export declare class RegistrationDto {
     name: string;
@@ -25,6 +26,7 @@ export declare class SelectDto {
     sessionId: string;
     companyId: string;
     branchId: string;
+    rememberMe?: boolean;
 }
 export declare class SwitchCompanyDto {
     companyId: string;
@@ -53,6 +55,9 @@ export declare class BranchSelectionInfoDto {
     name: string;
     slug: string;
     logoId?: string | null;
+    parentId?: string | null;
+    serial?: number | null;
+    displayParentId?: string | null;
 }
 export declare class CompanyWithBranchesDto {
     id: string;

package/dtos/user-permission.dto.d.ts

@@ -30,6 +30,9 @@ export declare class UserBranchPermissionDto {
     branchName: string;
     branchSlug: string;
     companyId: string;
+    parentId?: string | null;
+    serial?: number | null;
+    displayParentId?: string | null;
 }
 export declare class UserCompaniesResponseDto {
     success: boolean;

package/fesm/118.js

@@ -1086,6 +1086,9 @@ _ts_decorate([
     branchName;
     branchSlug;
     companyId;
+    parentId;
+    serial;
+    displayParentId;
 }
 _ts_decorate([
     (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
@@ -1129,6 +1132,33 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", String)
 ], UserBranchPermissionDto.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Parent branch ID (null for a root branch)',
+        example: null,
+        nullable: true,
+        type: String
+    }),
+    _ts_metadata("design:type", Object)
+], UserBranchPermissionDto.prototype, "parentId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Sort order among sibling branches',
+        example: 1,
+        nullable: true,
+        type: Number
+    }),
+    _ts_metadata("design:type", Object)
+], UserBranchPermissionDto.prototype, "serial", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Tree parent within this list: the nearest ancestor that is also listed (granted), null when none is - ungranted branches in between are skipped',
+        example: '550e8400-e29b-41d4-a716-446655440003',
+        nullable: true,
+        type: String
+    }),
+    _ts_metadata("design:type", Object)
+], UserBranchPermissionDto.prototype, "displayParentId", void 0);
 /**
  * User companies response
  */ class UserCompaniesResponseDto {

package/fesm/120.js

@@ -517,7 +517,7 @@ class CompanySelectionController {
             data
         };
     }
-    async getUserCompanies(userId) {
+    async getMyCompanies(userId) {
         const companies = await this.authService.getUserCompanies(userId);
         return {
             success: true,
@@ -526,7 +526,7 @@ class CompanySelectionController {
             data: companies
         };
     }
-    async getUserBranches(userId, companyId) {
+    async getMyCompanyBranches(userId, companyId) {
         const branches = await this.authService.getUserBranches(userId, companyId);
         return {
             success: true,
@@ -586,7 +586,7 @@ company_selection_controller_ts_decorate([
 ], CompanySelectionController.prototype, "switchCompany", null);
 company_selection_controller_ts_decorate([
     (0,common_.UseGuards)(guards_.JwtAuthGuard),
-    (0,common_.Post)('get-companies'),
+    (0,common_.Post)('get-my-companies'),
     (0,common_.HttpCode)(common_.HttpStatus.OK),
     (0,swagger_.ApiBearerAuth)(),
     (0,swagger_.ApiOperation)({
@@ -603,10 +603,10 @@ company_selection_controller_ts_decorate([
         String
     ]),
     company_selection_controller_ts_metadata("design:returntype", Promise)
-], CompanySelectionController.prototype, "getUserCompanies", null);
+], CompanySelectionController.prototype, "getMyCompanies", null);
 company_selection_controller_ts_decorate([
     (0,common_.UseGuards)(guards_.JwtAuthGuard),
-    (0,common_.Post)('get-company-branches'),
+    (0,common_.Post)('get-my-company-branches'),
     (0,common_.HttpCode)(common_.HttpStatus.OK),
     (0,swagger_.ApiBearerAuth)(),
     (0,swagger_.ApiOperation)({
@@ -637,7 +637,7 @@ company_selection_controller_ts_decorate([
         String
     ]),
     company_selection_controller_ts_metadata("design:returntype", Promise)
-], CompanySelectionController.prototype, "getUserBranches", null);
+], CompanySelectionController.prototype, "getMyCompanyBranches", null);
 CompanySelectionController = company_selection_controller_ts_decorate([
     (0,swagger_.ApiTags)('Company Selection'),
     (0,common_.Controller)('auth'),
@@ -1815,8 +1815,8 @@ class UserPermissionController {
     constructor(permissionService){
         this.permissionService = permissionService;
     }
-    async assignUserCompany(dto, user) {
-        return this.processBatchPermissions(dto.userId, dto.items, user_company_permission_entity/* .PermissionType.COMPANY */.e.COMPANY, user);
+    async assignUserCompany(dto) {
+        return this.processBatchPermissions(dto.userId, dto.items, user_company_permission_entity/* .PermissionType.COMPANY */.e.COMPANY);
     }
     async getUserCompanies(userId) {
         const permissions = await this.permissionService.findUserCompanies(userId);
@@ -1833,11 +1833,12 @@ class UserPermissionController {
                 }))
         };
     }
-    async assignUserBranch(dto, user) {
-        return this.processBatchPermissions(dto.userId, dto.items, user_company_permission_entity/* .PermissionType.BRANCH */.e.BRANCH, user);
+    async assignUserBranch(dto) {
+        return this.processBatchPermissions(dto.userId, dto.items, user_company_permission_entity/* .PermissionType.BRANCH */.e.BRANCH);
     }
-    async getUserBranches(userId, companyId) {
-        const permissions = await this.permissionService.findUserBranches(userId, companyId);
+    async getUserBranches(userId, user, companyId) {
+        const permissions = await this.permissionService.findUserBranches(userId, companyId || user.companyId);
+        const displayParentIds = await this.permissionService.findDisplayParentIds(permissions.map((p)=>p.targetId));
         return {
             success: true,
             message: 'User branches retrieved successfully',
@@ -1848,7 +1849,10 @@ class UserPermissionController {
                     branchId: p.branch?.id || p.targetId,
                     branchName: p.branch?.name || '',
                     branchSlug: p.branch?.slug || '',
-                    companyId: p.branch?.companyId || ''
+                    companyId: p.branch?.companyId || '',
+                    parentId: p.branch?.parentId ?? null,
+                    serial: p.branch?.serial ?? null,
+                    displayParentId: displayParentIds.get(p.targetId) ?? null
                 }))
         };
     }
@@ -1880,7 +1884,7 @@ class UserPermissionController {
                 }))
         };
     }
-    /** Process batch permission assignments/revocations */ async processBatchPermissions(userId, items, type, user) {
+    /** Process batch permission assignments/revocations */ async processBatchPermissions(userId, items, type) {
         let added = 0, removed = 0;
         for (const item of items){
             if (item.isAdd) {
@@ -1916,11 +1920,9 @@ user_permission_controller_ts_decorate([
         type: user_permission_dto/* .AssignUserCompanyDto */.DU
     }),
     user_permission_controller_ts_param(0, (0,common_.Body)()),
-    user_permission_controller_ts_param(1, (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.CurrentUser)()),
     user_permission_controller_ts_metadata("design:type", Function),
     user_permission_controller_ts_metadata("design:paramtypes", [
-        typeof user_permission_dto/* .AssignUserCompanyDto */.DU === "undefined" ? Object : user_permission_dto/* .AssignUserCompanyDto */.DU,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+        typeof user_permission_dto/* .AssignUserCompanyDto */.DU === "undefined" ? Object : user_permission_dto/* .AssignUserCompanyDto */.DU
     ]),
     user_permission_controller_ts_metadata("design:returntype", Promise)
 ], UserPermissionController.prototype, "assignUserCompany", null);
@@ -1967,11 +1969,9 @@ user_permission_controller_ts_decorate([
         type: user_permission_dto/* .AssignUserBranchDto */.qW
     }),
     user_permission_controller_ts_param(0, (0,common_.Body)()),
-    user_permission_controller_ts_param(1, (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.CurrentUser)()),
     user_permission_controller_ts_metadata("design:type", Function),
     user_permission_controller_ts_metadata("design:paramtypes", [
-        typeof user_permission_dto/* .AssignUserBranchDto */.qW === "undefined" ? Object : user_permission_dto/* .AssignUserBranchDto */.qW,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
+        typeof user_permission_dto/* .AssignUserBranchDto */.qW === "undefined" ? Object : user_permission_dto/* .AssignUserBranchDto */.qW
     ]),
     user_permission_controller_ts_metadata("design:returntype", Promise)
 ], UserPermissionController.prototype, "assignUserBranch", null);
@@ -1989,7 +1989,7 @@ user_permission_controller_ts_decorate([
                 },
                 companyId: {
                     type: 'string',
-                    description: 'Optional company ID to filter branches'
+                    description: 'Company ID to filter branches (defaults to the current company)'
                 }
             },
             required: [
@@ -2002,10 +2002,12 @@ user_permission_controller_ts_decorate([
         type: user_permission_dto/* .UserBranchesResponseDto */.wc
     }),
     user_permission_controller_ts_param(0, (0,common_.Body)('userId')),
-    user_permission_controller_ts_param(1, (0,common_.Body)('companyId')),
+    user_permission_controller_ts_param(1, (0,__rspack_external__flusys_nestjs_shared_decorators_c129b601.CurrentUser)()),
+    user_permission_controller_ts_param(2, (0,common_.Body)('companyId')),
     user_permission_controller_ts_metadata("design:type", Function),
     user_permission_controller_ts_metadata("design:paramtypes", [
         String,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo,
         String
     ]),
     user_permission_controller_ts_metadata("design:returntype", Promise)
@@ -2249,7 +2251,9 @@ class SetToken {
         res.cookie(this.cookieName, tokenValue, {
             httpOnly: true,
             path: '/',
-            maxAge: this.maxAgeMs,
+            ...req.body?.rememberMe !== false && {
+                maxAge: this.maxAgeMs
+            },
             ...(0,utils_.buildCookieOptions)(req)
         });
     }