@flusys/nestjs-auth 9.1.1 → 9.2.0

package/fesm/24.js

@@ -254,16 +254,39 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-334(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+37(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_0 = __webpack_require__(1236);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_1 = __webpack_require__(9216);
+
+
+const utils = new _flusys_nestjs_shared_modules__rspack_import_0.UtilsService();
+/**
+ * Bumps the cache stamp of every entity a service wrote outside its own ApiService (repository,
+ * query runner, cascade), so every service caching those entities re-reads them. Call after commit.
+ */ async function invalidateEntityCaches(cache, dataSourceProvider, entityNames) {
+    if (!cache) return;
+    const tenantId = (0,_flusys_nestjs_shared_utils__rspack_import_1.cacheTenantId)(dataSourceProvider);
+    await Promise.all(entityNames.map((name)=>utils.clearCache(name, cache, tenantId)));
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  i: () => (invalidateEntityCaches)
+});
+
+
+},
+5634(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
-  Vg: () => (/* reexport */ generateAccessToken),
-  e: () => (/* reexport */ generateTokens),
+  Vg: () => (/* reexport */ token_helper/* .generateAccessToken */.Vg),
+  e: () => (/* reexport */ token_helper/* .generateTokens */.e),
+  PV: () => (/* reexport */ token_helper/* .getSessionsRevokedAtMs */.PV),
+  lL: () => (/* reexport */ token_helper/* .isIssuedBeforeRevocation */.lL),
   vR: () => (/* reexport */ branch_ancestry_helper/* .loadCompanyBranchNodes */.v),
   xu: () => (/* reexport */ branch_ancestry_helper/* .loadDisplayParentIds */.x),
-  om: () => (/* reexport */ parseExpiryToMs),
-  XP: () => (/* reexport */ revokeUserSessions),
+  om: () => (/* reexport */ token_helper/* .parseExpiryToMs */.om),
+  XP: () => (/* reexport */ token_helper/* .revokeUserSessions */.XP),
   QH: () => (/* reexport */ toBranchInfo),
   $C: () => (/* reexport */ toCompanyInfo),
   FV: () => (/* reexport */ toUserInfo)
@@ -298,14 +321,23 @@ function toBranchInfo(branch) {
 
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/branch-ancestry.helper.ts
 var branch_ancestry_helper = __webpack_require__(7526);
-// EXTERNAL MODULE: ./projects/nestjs-auth/src/config/auth.constants.ts
-var auth_constants = __webpack_require__(5588);
-;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/token.helper.ts
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/token.helper.ts
+var token_helper = __webpack_require__(1379);
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/index.ts
+
+
+
+
 
-function generateAccessToken(jwtService, authConfig, payload) {
+},
+1379(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _config_auth_constants_js__rspack_import_0 = __webpack_require__(5588);
+
+function generateAccessToken(jwtService, authConfig, payload, issuedAtMs = Date.now()) {
     return jwtService.sign({
         ...payload,
-        type: 'access'
+        type: 'access',
+        iatMs: issuedAtMs
     }, {
         secret: authConfig.getJwtSecret(),
         expiresIn: authConfig.getJwtExpiration(),
@@ -313,10 +345,12 @@ function generateAccessToken(jwtService, authConfig, payload) {
     });
 }
 function generateTokens(jwtService, authConfig, payload) {
-    const accessToken = generateAccessToken(jwtService, authConfig, payload);
+    const issuedAtMs = Date.now();
+    const accessToken = generateAccessToken(jwtService, authConfig, payload, issuedAtMs);
     const refreshToken = jwtService.sign({
         ...payload,
-        type: 'refresh'
+        type: 'refresh',
+        iatMs: issuedAtMs
     }, {
         secret: authConfig.getRefreshTokenSecret(),
         expiresIn: authConfig.getRefreshTokenExpiration(),
@@ -345,15 +379,41 @@ function parseExpiryToMs(expiry) {
             return 7 * 24 * 60 * 60 * 1000;
     }
 }
+// Markers written before millisecond precision hold epoch seconds
+const LEGACY_SECONDS_LIMIT = 1e11;
+function revocationKey(userId) {
+    return `${_config_auth_constants_js__rspack_import_0/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`;
+}
+/**
+ * When the user's sessions were last revoked, in epoch ms. Read past the in-process cache layer:
+ * the marker changes in place, and another instance's L1 copy would hold an older value.
+ */ async function getSessionsRevokedAtMs(cache, userId) {
+    const revokedAt = await cache.get(revocationKey(userId), {
+        skipMemory: true
+    });
+    if (!revokedAt) return undefined;
+    return revokedAt < LEGACY_SECONDS_LIMIT ? revokedAt * 1000 : revokedAt;
+}
+/** True when a token or session issued at `issuedAtMs` predates the user's last revocation */ async function isIssuedBeforeRevocation(cache, userId, issuedAtMs) {
+    const revokedAtMs = await getSessionsRevokedAtMs(cache, userId);
+    return revokedAtMs !== undefined && issuedAtMs < revokedAtMs;
+}
 /** Rejects every token the user holds that was issued before now: checked on refresh and, by JwtStrategy, on every request. */ async function revokeUserSessions(cache, authConfig, userId) {
-    const revokedAt = Math.floor(Date.now() / 1000);
-    await cache.set(`${auth_constants/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`, revokedAt, parseExpiryToMs(authConfig.getRefreshTokenExpiration()));
+    // Never move the marker back (an instance whose clock lags would otherwise un-revoke tokens)
+    const revokedAtMs = Math.max(Date.now(), await getSessionsRevokedAtMs(cache, userId) ?? 0);
+    await cache.set(revocationKey(userId), revokedAtMs, parseExpiryToMs(authConfig.getRefreshTokenExpiration()), {
+        skipMemory: true
+    });
 }
 
-;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/index.ts
-
-
-
+__webpack_require__.d(__webpack_exports__, {
+  PV: () => (getSessionsRevokedAtMs),
+  Vg: () => (generateAccessToken),
+  XP: () => (revokeUserSessions),
+  e: () => (generateTokens),
+  lL: () => (isIssuedBeforeRevocation),
+  om: () => (parseExpiryToMs)
+});
 
 
 },
@@ -639,6 +699,10 @@ const linkedInSocialProvider = new linkedin_social_provider_LinkedInSocialProvid
 
 const GRAPH_ME_URL = 'https://graph.microsoft.com/v1.0/me';
 const DEFAULT_TENANT = 'common';
+const MULTI_TENANT_AUTHORITIES = new Set([
+    'common',
+    'organizations'
+]);
 function resolveTenant(credentials) {
     const tenantId = credentials.extraConfig?.['tenantId'];
     return typeof tenantId === 'string' && tenantId ? tenantId : DEFAULT_TENANT;
@@ -675,13 +739,14 @@ let microsoft_social_provider_MicrosoftSocialProvider = class MicrosoftSocialPro
             scope: resolveScopes(credentials, this.defaultScopes)
         });
         const profile = await getJson(this.provider, GRAPH_ME_URL, readAccessToken(this.provider, token));
-        // `mail` is Microsoft's confirmed mailbox claim; `userPrincipalName` is a sign-in
-        // identifier that is not guaranteed to be a verified, owned mailbox address.
-        const verifiedEmail = readString(profile, 'mail');
+        // Any Entra tenant admin can set `mail` to an address they do not own, so it only counts as
+        // verified when sign-in is pinned to one tenant (or to personal accounts), never common/organizations.
+        const mail = readString(profile, 'mail');
+        const trustsMail = !MULTI_TENANT_AUTHORITIES.has(resolveTenant(credentials).toLowerCase());
         return {
             providerUserId: readString(profile, 'id') ?? '',
-            email: verifiedEmail ?? readString(profile, 'userPrincipalName'),
-            emailVerified: !!verifiedEmail,
+            email: mail ?? readString(profile, 'userPrincipalName'),
+            emailVerified: !!mail && trustsMail,
             name: readString(profile, 'displayName'),
             avatarUrl: null
         };
@@ -925,13 +990,17 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _flusys_nestjs_shared_utils__rspack_import_3 = __webpack_require__(9216);
 /* import */ var _nestjs_common__rspack_import_4 = __webpack_require__(6157);
 /* import */ var bcrypt__rspack_import_5 = __webpack_require__(7176);
-/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(5363);
-/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(7987);
-/* import */ var _entities_app_user_entity_js__rspack_import_6 = __webpack_require__(4758);
-/* import */ var _entities_pending_registration_entity_js__rspack_import_7 = __webpack_require__(9388);
-/* import */ var _entities_user_token_entity_js__rspack_import_8 = __webpack_require__(9696);
-/* import */ var _interfaces_index_js__rspack_import_13 = __webpack_require__(9125);
-/* import */ var _auth_datasource_provider_js__rspack_import_9 = __webpack_require__(2732);
+/* import */ var typeorm__rspack_import_6 = __webpack_require__(7158);
+/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_15 = __webpack_require__(7987);
+/* import */ var _entities_app_user_entity_js__rspack_import_7 = __webpack_require__(4758);
+/* import */ var _entities_pending_registration_entity_js__rspack_import_8 = __webpack_require__(9388);
+/* import */ var _entities_user_token_entity_js__rspack_import_9 = __webpack_require__(9696);
+/* import */ var _helpers_cache_invalidation_helper_js__rspack_import_10 = __webpack_require__(37);
+/* import */ var _helpers_token_helper_js__rspack_import_16 = __webpack_require__(1379);
+/* import */ var _interfaces_index_js__rspack_import_17 = __webpack_require__(9125);
+/* import */ var _auth_config_service_js__rspack_import_11 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_12 = __webpack_require__(2732);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -967,14 +1036,23 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
+
+
 class AuthEmailService {
     dataSourceProvider;
     emailProvider;
+    cacheManager;
+    authConfig;
     PASSWORD_RESET_EXPIRY = 60 * 60 * 1000;
     EMAIL_VERIFICATION_EXPIRY = 24 * 60 * 60 * 1000;
-    constructor(dataSourceProvider, emailProvider){
+    logger = (0,_flusys_nestjs_shared_classes__rspack_import_1.createModuleLogger)('auth');
+    constructor(dataSourceProvider, emailProvider, cacheManager, authConfig){
         this.dataSourceProvider = dataSourceProvider;
         this.emailProvider = emailProvider;
+        this.cacheManager = cacheManager;
+        this.authConfig = authConfig;
     }
     isEmailEnabled() {
         return !!this.emailProvider;
@@ -1001,7 +1079,7 @@ class AuthEmailService {
         if (!this.emailProvider) {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Email service is not configured',
-                messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.EMAIL_NOT_CONFIGURED */.mK.EMAIL_NOT_CONFIGURED
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.EMAIL_NOT_CONFIGURED */.mK.EMAIL_NOT_CONFIGURED
             });
         }
     }
@@ -1011,7 +1089,7 @@ class AuthEmailService {
         } catch  {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Failed to send verification email. Please try again.',
-                messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.EMAIL_SEND_FAILED */.mK.EMAIL_SEND_FAILED
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.EMAIL_SEND_FAILED */.mK.EMAIL_SEND_FAILED
             });
         }
     }
@@ -1029,20 +1107,21 @@ class AuthEmailService {
             });
         }
     }
-    async hasPendingRegistration(email) {
+    async hasPendingRegistration(email, password) {
         if (!this.isEmailEnabled()) return false;
-        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_7/* .PendingRegistration */.N);
+        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_8/* .PendingRegistration */.N);
         const pending = await pendingRepository.findOne({
             where: {
                 email
             }
         });
-        return !!pending && !(0,_flusys_nestjs_shared_utils__rspack_import_3.isExpired)(pending.expiresAt);
+        if (!pending || (0,_flusys_nestjs_shared_utils__rspack_import_3.isExpired)(pending.expiresAt)) return false;
+        return password === undefined || await bcrypt__rspack_import_5.compare(password, pending.passwordHash);
     }
     async createPendingRegistration(data) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
-        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_7/* .PendingRegistration */.N);
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_7/* .AppUser */.$);
+        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_8/* .PendingRegistration */.N);
         // Check if user already exists
         const existingUser = await userRepository.findOne({
             where: {
@@ -1052,7 +1131,7 @@ class AuthEmailService {
         if (existingUser) {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Registration failed. Please try again or contact support.',
-                messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.REGISTER_FAILED */.mK.REGISTER_FAILED
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.REGISTER_FAILED */.mK.REGISTER_FAILED
             });
         }
         // Delete any existing pending registration for this email
@@ -1081,13 +1160,13 @@ class AuthEmailService {
         return {
             success: true,
             message: 'Please check your email to verify your registration.',
-            messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT */.sv.VERIFICATION_SENT
+            messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SENT */.sv.VERIFICATION_SENT
         };
     }
     async forgotPassword(email, resetUrlBase) {
         this.assertEmailEnabled();
-        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
-        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_8/* .UserToken */.L);
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_7/* .AppUser */.$);
+        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_9/* .UserToken */.L);
         const user = await userRepository.findOne({
             where: {
                 email
@@ -1098,20 +1177,20 @@ class AuthEmailService {
             return {
                 success: true,
                 message: 'If the email exists, a password reset link has been sent.',
-                messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_EMAIL_SENT */.mK.PASSWORD_RESET_EMAIL_SENT
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_RESET_EMAIL_SENT */.mK.PASSWORD_RESET_EMAIL_SENT
             };
         }
         // Invalidate existing password reset tokens for this user
         await tokenRepository.delete({
             userId: user.id,
-            type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET
+            type: _entities_user_token_entity_js__rspack_import_9/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET
         });
         // Create new token with hashed storage
         const token = this.generateToken();
         const tokenHash = this.hashToken(token);
         const userToken = tokenRepository.create({
             userId: user.id,
-            type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET,
+            type: _entities_user_token_entity_js__rspack_import_9/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET,
             token: tokenHash,
             expiresAt: new Date(Date.now() + this.PASSWORD_RESET_EXPIRY)
         });
@@ -1120,43 +1199,36 @@ class AuthEmailService {
         const resetUrl = `${resetUrlBase}?token=${token}`;
         try {
             await this.emailProvider.sendPasswordResetEmail(email, token, resetUrl);
-        } catch  {
-            throw new _nestjs_common__rspack_import_4.BadRequestException({
-                message: 'Failed to process request. Please try again later.',
-                messageKey: _flusys_nestjs_shared_constants__rspack_import_2.SYSTEM_MESSAGES.INTERNAL_ERROR,
-                messageVariables: {
-                    provider: 'EmailProvider',
-                    error: 'Send email failed'
-                }
-            });
+        } catch (error) {
+            this.logger.error(`Password reset email could not be sent: ${error instanceof Error ? error.message : String(error)}`);
         }
-        await this.publishUserEvent(_config_index_js__rspack_import_12/* .AUTH_EVENT_ACTIONS.PASSWORD_RESET_REQUESTED */.o.PASSWORD_RESET_REQUESTED, user.id, {
+        await this.publishUserEvent(_config_index_js__rspack_import_15/* .AUTH_EVENT_ACTIONS.PASSWORD_RESET_REQUESTED */.o.PASSWORD_RESET_REQUESTED, user.id, {
             email: user.email
         });
         return {
             success: true,
             message: 'If the email exists, a password reset link has been sent.',
-            messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_EMAIL_SENT */.mK.PASSWORD_RESET_EMAIL_SENT
+            messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_RESET_EMAIL_SENT */.mK.PASSWORD_RESET_EMAIL_SENT
         };
     }
     async resetPassword(token, newPassword) {
-        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
-        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_8/* .UserToken */.L);
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_7/* .AppUser */.$);
+        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_9/* .UserToken */.L);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
         const userToken = await tokenRepository.findOne({
             where: {
                 token: tokenHash,
-                type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET
+                type: _entities_user_token_entity_js__rspack_import_9/* .TokenType.PASSWORD_RESET */.k.PASSWORD_RESET
             }
         });
         if (!userToken) {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Invalid or expired reset token',
-                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID */.sv.VERIFICATION_TOKEN_INVALID
+                messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID */.sv.VERIFICATION_TOKEN_INVALID
             });
         }
-        this.validateTokenNotExpiredOrUsed(userToken, 'Reset token has expired. Please request a new one.', _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_TOKEN_EXPIRED */.mK.PASSWORD_RESET_TOKEN_EXPIRED, 'This reset token has already been used.', _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_TOKEN_USED */.mK.PASSWORD_RESET_TOKEN_USED);
+        this.validateTokenNotExpiredOrUsed(userToken, 'Reset token has expired. Please request a new one.', _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_RESET_TOKEN_EXPIRED */.mK.PASSWORD_RESET_TOKEN_EXPIRED, 'This reset token has already been used.', _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_RESET_TOKEN_USED */.mK.PASSWORD_RESET_TOKEN_USED);
         const user = await userRepository.findOne({
             where: {
                 id: userToken.userId
@@ -1165,28 +1237,42 @@ class AuthEmailService {
         if (!user) {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'User not found',
-                messageKey: _config_index_js__rspack_import_10/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_13/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+            });
+        }
+        const claimed = await tokenRepository.update({
+            id: userToken.id,
+            usedAt: (0,typeorm__rspack_import_6.IsNull)()
+        }, {
+            usedAt: new Date()
+        });
+        if (claimed?.affected === 0) {
+            throw new _nestjs_common__rspack_import_4.BadRequestException({
+                message: 'This reset token has already been used.',
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_RESET_TOKEN_USED */.mK.PASSWORD_RESET_TOKEN_USED
             });
         }
-        // Update password
         user.password = await bcrypt__rspack_import_5.hash(newPassword, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
         await userRepository.save(user);
-        // Mark token as used
-        userToken.usedAt = new Date();
-        await tokenRepository.save(userToken);
-        await this.publishUserEvent(_config_index_js__rspack_import_12/* .AUTH_EVENT_ACTIONS.PASSWORD_RESET */.o.PASSWORD_RESET, user.id, {
+        await (0,_helpers_cache_invalidation_helper_js__rspack_import_10/* .invalidateEntityCaches */.i)(this.cacheManager, this.dataSourceProvider, [
+            _config_index_js__rspack_import_15/* .AUTH_EVENT_ENTITIES.USER */.g.USER
+        ]);
+        if (this.cacheManager && this.authConfig) {
+            await (0,_helpers_token_helper_js__rspack_import_16/* .revokeUserSessions */.XP)(this.cacheManager, this.authConfig, user.id);
+        }
+        await this.publishUserEvent(_config_index_js__rspack_import_15/* .AUTH_EVENT_ACTIONS.PASSWORD_RESET */.o.PASSWORD_RESET, user.id, {
             email: user.email
         });
         return {
             success: true,
             message: 'Password has been reset successfully.',
-            messageKey: _config_index_js__rspack_import_10/* .AUTH_MESSAGES.PASSWORD_RESET_SUCCESS */.mK.PASSWORD_RESET_SUCCESS
+            messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_RESET_SUCCESS */.mK.PASSWORD_RESET_SUCCESS
         };
     }
     async verifyEmail(token) {
-        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_7/* .PendingRegistration */.N);
-        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
-        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_8/* .UserToken */.L);
+        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_8/* .PendingRegistration */.N);
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_7/* .AppUser */.$);
+        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_9/* .UserToken */.L);
         // Hash the incoming token to compare with stored hash
         const tokenHash = this.hashToken(token);
         // Check for pending registration first
@@ -1202,13 +1288,18 @@ class AuthEmailService {
                 });
                 throw new _nestjs_common__rspack_import_4.BadRequestException({
                     message: 'Verification token has expired. Please register again.',
-                    messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_EXPIRED */.sv.VERIFICATION_TOKEN_EXPIRED
+                    messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_EXPIRED */.sv.VERIFICATION_TOKEN_EXPIRED
                 });
             }
-            // Delete pending registration (will be consumed by caller to create user)
-            await pendingRepository.delete({
+            const consumed = await pendingRepository.delete({
                 id: pending.id
             });
+            if (consumed?.affected === 0) {
+                throw new _nestjs_common__rspack_import_4.BadRequestException({
+                    message: 'Invalid or expired verification token',
+                    messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID */.sv.VERIFICATION_TOKEN_INVALID
+                });
+            }
             return {
                 type: 'pending',
                 pending
@@ -1218,13 +1309,13 @@ class AuthEmailService {
         const userToken = await tokenRepository.findOne({
             where: {
                 token: tokenHash,
-                type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION
+                type: _entities_user_token_entity_js__rspack_import_9/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION
             }
         });
         if (!userToken) {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Invalid or expired verification token',
-                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID */.sv.VERIFICATION_TOKEN_INVALID
+                messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_INVALID */.sv.VERIFICATION_TOKEN_INVALID
             });
         }
         if ((0,_flusys_nestjs_shared_utils__rspack_import_3.isExpired)(userToken.expiresAt)) {
@@ -1233,14 +1324,14 @@ class AuthEmailService {
             });
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Verification token has expired. Please request a new one.',
-                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_EXPIRED */.sv.VERIFICATION_TOKEN_EXPIRED
+                messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_TOKEN_EXPIRED */.sv.VERIFICATION_TOKEN_EXPIRED
             });
         }
         if (userToken.usedAt) {
             return {
                 type: 'verified',
                 message: 'Email has already been verified.',
-                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS */.sv.VERIFICATION_SUCCESS
+                messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS */.sv.VERIFICATION_SUCCESS
             };
         }
         const user = await userRepository.findOne({
@@ -1251,28 +1342,31 @@ class AuthEmailService {
         if (!user) {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'User not found',
-                messageKey: _config_index_js__rspack_import_10/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_13/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
             });
         }
         // Mark email as verified
         user.emailVerified = true;
         await userRepository.save(user);
+        await (0,_helpers_cache_invalidation_helper_js__rspack_import_10/* .invalidateEntityCaches */.i)(this.cacheManager, this.dataSourceProvider, [
+            _config_index_js__rspack_import_15/* .AUTH_EVENT_ENTITIES.USER */.g.USER
+        ]);
         // Mark token as used
         userToken.usedAt = new Date();
         await tokenRepository.save(userToken);
-        await this.publishUserEvent(_config_index_js__rspack_import_12/* .AUTH_EVENT_ACTIONS.EMAIL_VERIFIED */.o.EMAIL_VERIFIED, user.id, {
+        await this.publishUserEvent(_config_index_js__rspack_import_15/* .AUTH_EVENT_ACTIONS.EMAIL_VERIFIED */.o.EMAIL_VERIFIED, user.id, {
             email: user.email
         });
         return {
             type: 'verified',
             message: 'Email has been verified successfully.',
-            messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS */.sv.VERIFICATION_SUCCESS
+            messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS */.sv.VERIFICATION_SUCCESS
         };
     }
     async publishUserEvent(action, userId, metadata) {
         await (0,_flusys_nestjs_shared_classes__rspack_import_1.publishDomainEvent)({
             module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
-            entity: _config_index_js__rspack_import_12/* .AUTH_EVENT_ENTITIES.USER */.g.USER,
+            entity: _config_index_js__rspack_import_15/* .AUTH_EVENT_ENTITIES.USER */.g.USER,
             action,
             ids: [
                 userId
@@ -1282,9 +1376,9 @@ class AuthEmailService {
     }
     async resendVerificationEmail(email, verifyUrlBase) {
         this.assertEmailEnabled();
-        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_7/* .PendingRegistration */.N);
-        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_6/* .AppUser */.$);
-        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_8/* .UserToken */.L);
+        const pendingRepository = await this.getRepository(_entities_pending_registration_entity_js__rspack_import_8/* .PendingRegistration */.N);
+        const userRepository = await this.getRepository(_entities_app_user_entity_js__rspack_import_7/* .AppUser */.$);
+        const tokenRepository = await this.getRepository(_entities_user_token_entity_js__rspack_import_9/* .UserToken */.L);
         // Check pending registration first
         const pending = await pendingRepository.findOne({
             where: {
@@ -1301,7 +1395,7 @@ class AuthEmailService {
             return {
                 success: true,
                 message: 'If the email requires verification, a link has been sent.',
-                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
+                messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
             };
         }
         // Check existing user
@@ -1314,18 +1408,18 @@ class AuthEmailService {
             return {
                 success: true,
                 message: 'If the email requires verification, a link has been sent.',
-                messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
+                messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
             };
         }
         // Invalidate existing tokens and create new one
         await tokenRepository.delete({
             userId: user.id,
-            type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION
+            type: _entities_user_token_entity_js__rspack_import_9/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION
         });
         const token = this.generateToken();
         const userToken = tokenRepository.create({
             userId: user.id,
-            type: _entities_user_token_entity_js__rspack_import_8/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION,
+            type: _entities_user_token_entity_js__rspack_import_9/* .TokenType.EMAIL_VERIFICATION */.k.EMAIL_VERIFICATION,
             token: this.hashToken(token),
             expiresAt: new Date(Date.now() + this.EMAIL_VERIFICATION_EXPIRY)
         });
@@ -1335,7 +1429,7 @@ class AuthEmailService {
         return {
             success: true,
             message: 'If the email requires verification, a link has been sent.',
-            messageKey: _config_index_js__rspack_import_10/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
+            messageKey: _config_index_js__rspack_import_13/* .EMAIL_VERIFICATION_MESSAGES.RESEND_SUCCESS */.sv.RESEND_SUCCESS
         };
     }
 }
@@ -1405,13 +1499,19 @@ AuthEmailService = _ts_decorate([
         scope: _nestjs_common__rspack_import_4.Scope.REQUEST
     }),
     _ts_param(0, (0,_nestjs_common__rspack_import_4.Optional)()),
-    _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)(_auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)(_auth_datasource_provider_js__rspack_import_12/* .AuthDataSourceProvider */.v)),
     _ts_param(1, (0,_nestjs_common__rspack_import_4.Optional)()),
-    _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_interfaces_index_js__rspack_import_13/* .AUTH_EMAIL_PROVIDER */.C)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_interfaces_index_js__rspack_import_17/* .AUTH_EMAIL_PROVIDER */.C)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)('CACHE_INSTANCE')),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_auth_config_service_js__rspack_import_11/* .AuthConfigService */.W)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v,
-        typeof IAuthEmailProvider === "undefined" ? Object : IAuthEmailProvider
+        typeof _auth_datasource_provider_js__rspack_import_12/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_12/* .AuthDataSourceProvider */.v,
+        typeof IAuthEmailProvider === "undefined" ? Object : IAuthEmailProvider,
+        typeof _flusys_nestjs_shared_classes__rspack_import_1.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_1.HybridCache,
+        typeof _auth_config_service_js__rspack_import_11/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_11/* .AuthConfigService */.W
     ])
 ], AuthEmailService);
 
@@ -1466,8 +1566,10 @@ var pending_registration_entity = __webpack_require__(9388);
 var user_company_permission_entity = __webpack_require__(2377);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/enums/user-org-permission-type.enum.ts
 var user_org_permission_type_enum = __webpack_require__(5081);
-// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/index.ts + 2 modules
-var helpers = __webpack_require__(334);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/index.ts + 1 modules
+var helpers = __webpack_require__(5634);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/cache-invalidation.helper.ts
+var cache_invalidation_helper = __webpack_require__(37);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/services/auth-config.service.ts + 1 modules
 var auth_config_service = __webpack_require__(6514);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/services/auth-datasource.provider.ts
@@ -1522,6 +1624,8 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+const TIMING_SAFE_DUMMY_HASH = '$2b$12$1l4HGUUGpuL.DdwxrAHDmeUINEEDQVBT4lPvdSYEQDNm5BFNskVum';
 class AuthenticationService {
     jwtService;
     authConfig;
@@ -1569,8 +1673,11 @@ class AuthenticationService {
         if (!this.isCompanyFeatureEnabled() || !this.dataSourceProvider) return null;
         return this.dataSourceProvider.getRepository(entity);
     }
+    /** This service writes users, companies, branches and grants directly; their cached reads go stale */ async invalidateCaches(...entityNames) {
+        await (0,cache_invalidation_helper/* .invalidateEntityCaches */.i)(this.cacheManager, this.dataSourceProvider, entityNames);
+    }
     async login(email, password) {
-        if (this.isEmailVerificationEnabled() && await this.authEmailService.hasPendingRegistration(email)) {
+        if (this.isEmailVerificationEnabled() && await this.authEmailService.hasPendingRegistration(email, password)) {
             return {
                 requiresEmailVerification: true,
                 email,
@@ -1719,12 +1826,20 @@ class AuthenticationService {
         return await this.createUserDirectly(dto);
     }
     async handleExistingUserCompanyRegistration(existingUser, dto) {
-        if (!dto.companySlug && !dto.newCompanyName) {
+        const ownsAccount = await external_bcrypt_.compare(dto.password, existingUser.password || TIMING_SAFE_DUMMY_HASH);
+        if (!dto.companySlug && !dto.newCompanyName || !ownsAccount || !existingUser.password) {
             throw new common_.BadRequestException({
                 message: 'Email already registered. Please login or provide a company to join/create.',
                 messageKey: message_keys/* .AUTH_MESSAGES.REGISTER_EMAIL_EXISTS */.mK.REGISTER_EMAIL_EXISTS
             });
         }
+        this.ensureUserActive(existingUser);
+        if (this.isEmailVerificationEnabled() && !existingUser.emailVerified) {
+            throw new common_.BadRequestException({
+                message: 'Please verify your email address before joining a company.',
+                messageKey: message_keys/* .AUTH_MESSAGES.LOGIN_EMAIL_NOT_VERIFIED */.mK.LOGIN_EMAIL_NOT_VERIFIED
+            });
+        }
         const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
         const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
         if (!permissionRepository || !companyRepository) {
@@ -1788,6 +1903,7 @@ class AuthenticationService {
                 await this.userEnricher.onUserCreated(user.id, dto.additionalFields ?? null, queryRunner);
             }
             await queryRunner.commitTransaction();
+            await this.invalidateCaches(event_actions/* .AUTH_EVENT_ENTITIES.USER */.g.USER);
             if (!this.isCompanyFeatureEnabled()) {
                 return this.generateRegistrationResponse(user);
             }
@@ -1849,6 +1965,7 @@ class AuthenticationService {
                 await this.userEnricher.onUserCreated(user.id, pending.additionalFields ?? null, queryRunner);
             }
             await queryRunner.commitTransaction();
+            await this.invalidateCaches(event_actions/* .AUTH_EVENT_ENTITIES.USER */.g.USER);
             if (this.isCompanyFeatureEnabled() && pending.companyData) {
                 return await this.processCompanyRegistration(user, pending.companyData);
             }
@@ -1881,8 +1998,12 @@ class AuthenticationService {
             return this.generateRegistrationResponse(user);
         }
         const { company, branch } = await this.findOrCreateCompanyAndBranch(data, companyRepository, branchRepository);
+        if (data.newCompanyName && company) {
+            await this.invalidateCaches(event_actions/* .AUTH_EVENT_ENTITIES.COMPANY */.g.COMPANY, event_actions/* .AUTH_EVENT_ENTITIES.COMPANY_BRANCH */.g.COMPANY_BRANCH);
+        }
         if (company) {
             await this.assignUserPermissions(user.id, company.id, branch?.id, permissionRepository);
+            await this.invalidateCaches(event_actions/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION);
             return this.generateRegistrationResponseWithCompany(user, company, branch ?? undefined);
         }
         return this.generateRegistrationResponse(user);
@@ -1979,8 +2100,9 @@ class AuthenticationService {
                 messageKey: message_keys/* .AUTH_MESSAGES.SESSION_NOT_AVAILABLE */.mK.SESSION_NOT_AVAILABLE
             });
         }
-        const session = await this.sessionService.consumeSession(sessionId);
-        if (!session) {
+        const session = await this.sessionService.consumeSession(sessionId, (0,utils_.cacheTenantId)(this.dataSourceProvider));
+        // A session started before a logout / password reset must not mint tokens after it
+        if (!session || await this.isRevokedSince(session.userId, new Date(session.createdAt).getTime())) {
             throw new common_.UnauthorizedException({
                 message: 'Invalid or expired session',
                 messageKey: message_keys/* .AUTH_MESSAGES.SESSION_INVALID */.mK.SESSION_INVALID
@@ -2005,6 +2127,7 @@ class AuthenticationService {
                 messageKey: message_keys/* .USER_MESSAGES.NOT_FOUND */.ny.NOT_FOUND
             });
         }
+        this.ensureUserActive(user);
         const permissionRepository = await this.getCompanyScopedRepository(user_company_permission_entity/* .UserCompanyPermission */.I);
         const companyRepository = await this.getCompanyScopedRepository(company_entity/* .Company */.C);
         const branchRepository = await this.getCompanyScopedRepository(company_branch_entity/* .CompanyBranch */.A);
@@ -2084,7 +2207,13 @@ class AuthenticationService {
                     'HS256'
                 ]
             });
-            if (await this.isTokenRevoked(payload.id, payload.iat)) {
+            if (payload.type !== 'refresh') {
+                throw new common_.UnauthorizedException({
+                    message: 'Invalid refresh token',
+                    messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
+                });
+            }
+            if (await this.isTokenRevoked(payload.id, payload.iat, payload.iatMs)) {
                 throw new common_.UnauthorizedException({
                     message: 'Token has been revoked',
                     messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_REVOKED */.mK.TOKEN_REVOKED
@@ -2229,6 +2358,7 @@ class AuthenticationService {
         }
         user.password = await external_bcrypt_.hash(newPassword, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
         await userRepository.save(user);
+        await this.invalidateCaches(event_actions/* .AUTH_EVENT_ENTITIES.USER */.g.USER);
         this.publishAuthEvent(event_actions/* .AUTH_EVENT_ENTITIES.USER */.g.USER, event_actions/* .AUTH_EVENT_ACTIONS.PASSWORD_CHANGED */.o.PASSWORD_CHANGED, user);
     }
     async logout(userId) {
@@ -2251,16 +2381,14 @@ class AuthenticationService {
             }
         });
     }
-    async isTokenRevoked(userId, tokenIssuedAt) {
-        if (!this.cacheManager || !tokenIssuedAt) {
-            return false;
-        }
-        const cacheKey = `${auth_constants/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`;
-        const revokedAt = await this.cacheManager.get(cacheKey);
-        if (!revokedAt) {
-            return false;
-        }
-        return tokenIssuedAt < revokedAt;
+    /** `tokenIssuedAtMs` is the token's `iatMs`; a token without it is judged by `iat` (seconds), erring towards revoked */ async isTokenRevoked(userId, tokenIssuedAt, tokenIssuedAtMs) {
+        const issuedAtMs = typeof tokenIssuedAtMs === 'number' ? tokenIssuedAtMs : tokenIssuedAt ? tokenIssuedAt * 1000 : undefined;
+        if (issuedAtMs === undefined) return false;
+        return this.isRevokedSince(userId, issuedAtMs);
+    }
+    async isRevokedSince(userId, issuedAtMs) {
+        if (!this.cacheManager) return false;
+        return (0,helpers/* .isIssuedBeforeRevocation */.lL)(this.cacheManager, userId, issuedAtMs);
     }
     async getUserCompanies(userId) {
         this.ensureCompanyFeatureEnabled();
@@ -2415,7 +2543,8 @@ class AuthenticationService {
                 email
             }
         });
-        if (!user || !await external_bcrypt_.compare(password, user.password || '')) {
+        const passwordMatches = await external_bcrypt_.compare(password, user?.password || TIMING_SAFE_DUMMY_HASH);
+        if (!user?.password || !passwordMatches) {
             throw new common_.UnauthorizedException({
                 message: 'Invalid credentials',
                 messageKey: message_keys/* .AUTH_MESSAGES.LOGIN_INVALID_CREDENTIALS */.mK.LOGIN_INVALID_CREDENTIALS
@@ -2423,6 +2552,7 @@ class AuthenticationService {
         }
         user.lastLoginAt = new Date();
         await userRepository.save(user);
+        await this.invalidateCaches(event_actions/* .AUTH_EVENT_ENTITIES.USER */.g.USER);
         return user;
     }
     generateLoginResponse(user) {
@@ -2480,7 +2610,7 @@ class AuthenticationService {
                 messageKey: message_keys/* .AUTH_MESSAGES.SESSION_NOT_AVAILABLE */.mK.SESSION_NOT_AVAILABLE
             });
         }
-        const sessionId = await this.sessionService.createSession(user.id);
+        const sessionId = await this.sessionService.createSession(user.id, (0,utils_.cacheTenantId)(this.dataSourceProvider));
         const companiesWithBranches = companies.map((company)=>({
                 ...(0,helpers/* .toCompanyInfo */.$C)(company),
                 isActive: company.isActive,
@@ -2843,6 +2973,12 @@ class BranchService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiSe
         });
         await Promise.all(rows.map((row)=>this.permissionSyncAdapter.onBranchDeleted(row.id, row.companyId)));
     }
+    // beforeDeleteOperation drops the branches' grants; bump after commit
+    async delete(option, user) {
+        const result = await super.delete(option, user);
+        await this.utilsService.clearCache(_config_index_js__rspack_import_12/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION, this.cacheManager, this.cacheTenant());
+        return result;
+    }
     // Hierarchy - ids that are empty or not UUIDs match no branch (and never reach a uuid column)
     async getDescendantIds(branchIds, options = {}) {
         const ids = (0,_flusys_nestjs_shared_utils__rspack_import_3.normalizeBranchIds)(branchIds).filter((id)=>(0,class_validator__rspack_import_5.isUUID)(id));
@@ -2978,47 +3114,39 @@ class CompanySelectionSessionService {
     constructor(cacheManager){
         this.cacheManager = cacheManager;
     }
-    async createSession(userId) {
+    async createSession(userId, tenantId) {
         const sessionId = (0,crypto__rspack_import_3.randomUUID)();
-        const now = new Date();
-        const expiresAt = new Date(now.getTime() + SESSION_TTL_MS);
+        const now = Date.now();
         const session = {
             sessionId,
             userId,
             createdAt: now,
-            expiresAt
+            expiresAt: now + SESSION_TTL_MS
         };
-        await this.cacheManager.set(this.getKey(sessionId), session, SESSION_TTL_MS);
+        await this.cacheManager.set(this.getKey(sessionId, tenantId), session, SESSION_TTL_MS, {
+            skipMemory: true
+        });
         return sessionId;
     }
-    /**
-   * Get session by ID (does not consume/delete)
-   */ async getSession(sessionId) {
-        const session = await this.cacheManager.get(this.getKey(sessionId));
-        if (!session) return null;
-        // Check if expired (extra safety, cache should handle TTL)
-        if (new Date() > new Date(session.expiresAt)) {
-            await this.deleteSession(sessionId);
-            return null;
-        }
-        return session;
+    /** Reads a session without consuming it */ async getSession(sessionId, tenantId) {
+        const session = await this.cacheManager.get(this.getKey(sessionId, tenantId), {
+            skipMemory: true
+        });
+        return this.unexpired(session);
     }
-    async consumeSession(sessionId) {
-        const session = await this.getSession(sessionId);
-        if (session) {
-            await this.deleteSession(sessionId);
-        }
-        return session;
+    /** Atomic across instances: of two concurrent calls for one session, only one receives it */ async consumeSession(sessionId, tenantId) {
+        const session = await this.cacheManager.take(this.getKey(sessionId, tenantId), SESSION_TTL_MS);
+        return this.unexpired(session);
     }
-    /**
-   * Delete session
-   */ async deleteSession(sessionId) {
-        await this.cacheManager.del(this.getKey(sessionId));
+    async deleteSession(sessionId, tenantId) {
+        await this.cacheManager.del(this.getKey(sessionId, tenantId));
     }
-    /**
-   * Get cache key for session
-   */ getKey(sessionId) {
-        return `${_config_auth_constants_js__rspack_import_4/* .SESSION_CACHE_PREFIX */.Vl}:${sessionId}`;
+    unexpired(session) {
+        if (!session || !(new Date(session.expiresAt).getTime() >= Date.now())) return null;
+        return session;
+    }
+    getKey(sessionId, tenantId) {
+        return tenantId ? `${_config_auth_constants_js__rspack_import_4/* .SESSION_CACHE_PREFIX */.Vl}:${tenantId}:${sessionId}` : `${_config_auth_constants_js__rspack_import_4/* .SESSION_CACHE_PREFIX */.Vl}:${sessionId}`;
     }
 }
 _ts_decorate([
@@ -3028,6 +3156,7 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        String,
         String
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -3039,6 +3168,7 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        String,
         String
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -3152,6 +3282,15 @@ class CompanyService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiS
         }
         await Promise.all(companyIds.map((companyId)=>this.permissionSyncAdapter.onCompanyDeleted(companyId)));
     }
+    // beforeDeleteOperation drops the company's grants (and a purge cascades its branches); bump after commit
+    async delete(option, user) {
+        const result = await super.delete(option, user);
+        await Promise.all([
+            _config_index_js__rspack_import_9/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION,
+            _config_index_js__rspack_import_9/* .AUTH_EVENT_ENTITIES.COMPANY_BRANCH */.g.COMPANY_BRANCH
+        ].map((name)=>this.utilsService.clearCache(name, this.cacheManager, this.cacheTenant())));
+        return result;
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -3286,6 +3425,14 @@ class SocialAuthConfigService extends _flusys_nestjs_shared_classes__rspack_impo
             });
         }
     }
+    // The secret never leaves the service: not to clients, not into the shared cache
+    convertEntityToResponseDto(entity, _isRaw) {
+        const { clientSecret, ...rest } = entity;
+        return {
+            ...rest,
+            hasClientSecret: !!clientSecret
+        };
+    }
     async getExtraManipulateQuery(query, filterDto, user) {
         const result = await super.getExtraManipulateQuery(query, filterDto, user);
         query.orderBy(`${this.entityName}.provider`, 'ASC');
@@ -3320,15 +3467,18 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
 /* import */ var crypto__rspack_import_4 = __webpack_require__(7823);
 /* import */ var typeorm__rspack_import_5 = __webpack_require__(7158);
-/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(5363);
-/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(7987);
-/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(5588);
+/* import */ var _config_index_js__rspack_import_14 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_15 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(5588);
 /* import */ var _entities_app_user_entity_js__rspack_import_6 = __webpack_require__(4758);
 /* import */ var _entities_social_auth_config_entity_js__rspack_import_7 = __webpack_require__(2020);
-/* import */ var _enums_social_provider_type_enum_js__rspack_import_14 = __webpack_require__(5142);
-/* import */ var _providers_social_provider_registry_js__rspack_import_8 = __webpack_require__(6928);
-/* import */ var _auth_datasource_provider_js__rspack_import_9 = __webpack_require__(2732);
-/* import */ var _authentication_service_js__rspack_import_10 = __webpack_require__(4722);
+/* import */ var _enums_social_provider_type_enum_js__rspack_import_17 = __webpack_require__(5142);
+/* import */ var _helpers_cache_invalidation_helper_js__rspack_import_8 = __webpack_require__(37);
+/* import */ var _helpers_token_helper_js__rspack_import_16 = __webpack_require__(1379);
+/* import */ var _providers_social_provider_registry_js__rspack_import_9 = __webpack_require__(6928);
+/* import */ var _auth_config_service_js__rspack_import_10 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_11 = __webpack_require__(2732);
+/* import */ var _authentication_service_js__rspack_import_12 = __webpack_require__(4722);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -3365,14 +3515,19 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
+
 class SocialAuthService {
     authService;
     dataSourceProvider;
     cacheManager;
-    constructor(authService, dataSourceProvider, cacheManager){
+    authConfig;
+    constructor(authService, dataSourceProvider, cacheManager, authConfig){
         this.authService = authService;
         this.dataSourceProvider = dataSourceProvider;
         this.cacheManager = cacheManager;
+        this.authConfig = authConfig;
     }
     async listEnabledProviders(redirectUri) {
         const repository = await this.dataSourceProvider.getRepository(_entities_social_auth_config_entity_js__rspack_import_7/* .SocialAuthConfig */.G);
@@ -3393,21 +3548,23 @@ class SocialAuthService {
         await this.getCache().set(this.stateKey(state), {
             provider,
             redirectUri
-        }, (/* inlined export .SOCIAL_STATE_TTL_MS */600000));
+        }, (/* inlined export .SOCIAL_STATE_TTL_MS */600000), {
+            skipMemory: true
+        });
         return {
             provider,
-            authorizationUrl: (0,_providers_social_provider_registry_js__rspack_import_8/* .getSocialProvider */.V)(provider).buildAuthorizationUrl(this.toCredentials(config, redirectUri), state),
+            authorizationUrl: (0,_providers_social_provider_registry_js__rspack_import_9/* .getSocialProvider */.V)(provider).buildAuthorizationUrl(this.toCredentials(config, redirectUri), state),
             state
         };
     }
     async completeLogin(code, state, redirectUri) {
         const provider = await this.consumeState(state, redirectUri);
         const config = await this.getUsableConfig(provider);
-        const profile = await (0,_providers_social_provider_registry_js__rspack_import_8/* .getSocialProvider */.V)(provider).fetchProfile(this.toCredentials(config, redirectUri), code);
+        const profile = await (0,_providers_social_provider_registry_js__rspack_import_9/* .getSocialProvider */.V)(provider).fetchProfile(this.toCredentials(config, redirectUri), code);
         if (!profile.providerUserId) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: `${provider} did not return an account identifier`,
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.PROFILE_INCOMPLETE */.OF.PROFILE_INCOMPLETE,
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.PROFILE_INCOMPLETE */.OF.PROFILE_INCOMPLETE,
                 messageVariables: {
                     provider
                 }
@@ -3415,7 +3572,7 @@ class SocialAuthService {
         }
         const user = await this.resolveUser(provider, profile);
         const response = await this.authService.issueLoginForUser(user);
-        this.publishSocialEvent(_config_index_js__rspack_import_13/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION, _config_index_js__rspack_import_13/* .AUTH_EVENT_ACTIONS.SOCIAL_LOGGED_IN */.o.SOCIAL_LOGGED_IN, user, provider);
+        this.publishSocialEvent(_config_index_js__rspack_import_15/* .AUTH_EVENT_ENTITIES.SESSION */.g.SESSION, _config_index_js__rspack_import_15/* .AUTH_EVENT_ACTIONS.SOCIAL_LOGGED_IN */.o.SOCIAL_LOGGED_IN, user, provider);
         return response;
     }
     async resolveUser(provider, profile) {
@@ -3430,27 +3587,33 @@ class SocialAuthService {
         if (existing?.deletedAt) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: 'This account has been permanently deleted. Please contact your system administrator.',
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.ACCOUNT_DELETED */.OF.ACCOUNT_DELETED
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.ACCOUNT_DELETED */.OF.ACCOUNT_DELETED
             });
         }
         if (existing) {
-            // The provider already proved ownership of this email (ensureVerifiedEmail above),
-            // so a social login carries at least as much proof as clicking a verification link.
-            if (!existing.emailVerified) {
-                existing.emailVerified = true;
-                await userRepository.save(existing);
-            }
+            if (!existing.emailVerified) await this.claimUnverifiedAccount(userRepository, existing);
             return existing;
         }
         const user = await this.registerUser(provider, userRepository, profile);
-        this.publishSocialEvent(_config_index_js__rspack_import_13/* .AUTH_EVENT_ENTITIES.USER */.g.USER, _config_index_js__rspack_import_13/* .AUTH_EVENT_ACTIONS.REGISTERED */.o.REGISTERED, user, provider);
+        this.publishSocialEvent(_config_index_js__rspack_import_15/* .AUTH_EVENT_ENTITIES.USER */.g.USER, _config_index_js__rspack_import_15/* .AUTH_EVENT_ACTIONS.REGISTERED */.o.REGISTERED, user, provider);
         return user;
     }
+    async claimUnverifiedAccount(userRepository, user) {
+        user.emailVerified = true;
+        user.password = null;
+        await userRepository.save(user);
+        await (0,_helpers_cache_invalidation_helper_js__rspack_import_8/* .invalidateEntityCaches */.i)(this.cacheManager, this.dataSourceProvider, [
+            _config_index_js__rspack_import_15/* .AUTH_EVENT_ENTITIES.USER */.g.USER
+        ]);
+        if (this.cacheManager && this.authConfig) {
+            await (0,_helpers_token_helper_js__rspack_import_16/* .revokeUserSessions */.XP)(this.cacheManager, this.authConfig, user.id);
+        }
+    }
     ensureVerifiedEmail(provider, profile) {
         if (!profile.email) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: `${provider} did not share an email address`,
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.EMAIL_REQUIRED */.OF.EMAIL_REQUIRED,
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.EMAIL_REQUIRED */.OF.EMAIL_REQUIRED,
                 messageVariables: {
                     provider
                 }
@@ -3459,7 +3622,7 @@ class SocialAuthService {
         if (!profile.emailVerified) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: `${provider} has not verified this email address`,
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.EMAIL_NOT_VERIFIED */.OF.EMAIL_NOT_VERIFIED,
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.EMAIL_NOT_VERIFIED */.OF.EMAIL_NOT_VERIFIED,
                 messageVariables: {
                     provider
                 }
@@ -3470,7 +3633,7 @@ class SocialAuthService {
         if (!this.dataSourceProvider.isSignUpEnabled()) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: `No account is linked to this ${provider} profile`,
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.ACCOUNT_NOT_LINKED */.OF.ACCOUNT_NOT_LINKED,
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.ACCOUNT_NOT_LINKED */.OF.ACCOUNT_NOT_LINKED,
                 messageVariables: {
                     provider
                 }
@@ -3479,19 +3642,23 @@ class SocialAuthService {
         if (this.dataSourceProvider.isCompanyFeatureEnabled()) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: `No account is linked to this ${provider} profile. Please sign up manually and join or create a company first, then social sign-in will work.`,
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.COMPANY_REQUIRED */.OF.COMPANY_REQUIRED,
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.COMPANY_REQUIRED */.OF.COMPANY_REQUIRED,
                 messageVariables: {
                     provider
                 }
             });
         }
-        return userRepository.save(userRepository.create({
+        const user = await userRepository.save(userRepository.create({
             email: profile.email,
             name: profile.name,
             password: null,
             isActive: true,
             emailVerified: true
         }));
+        await (0,_helpers_cache_invalidation_helper_js__rspack_import_8/* .invalidateEntityCaches */.i)(this.cacheManager, this.dataSourceProvider, [
+            _config_index_js__rspack_import_15/* .AUTH_EVENT_ENTITIES.USER */.g.USER
+        ]);
+        return user;
     }
     async getUsableConfig(provider) {
         const repository = await this.dataSourceProvider.getRepository(_entities_social_auth_config_entity_js__rspack_import_7/* .SocialAuthConfig */.G);
@@ -3504,7 +3671,7 @@ class SocialAuthService {
         if (!config?.isEnabled) {
             throw new _nestjs_common__rspack_import_3.BadRequestException({
                 message: `Social sign-in with ${provider} is not enabled`,
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.PROVIDER_DISABLED */.OF.PROVIDER_DISABLED,
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.PROVIDER_DISABLED */.OF.PROVIDER_DISABLED,
                 messageVariables: {
                     provider
                 }
@@ -3513,7 +3680,7 @@ class SocialAuthService {
         if (!config.clientId || !config.clientSecret) {
             throw new _nestjs_common__rspack_import_3.BadRequestException({
                 message: `Social sign-in with ${provider} is missing its client credentials`,
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.PROVIDER_NOT_CONFIGURED */.OF.PROVIDER_NOT_CONFIGURED,
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.PROVIDER_NOT_CONFIGURED */.OF.PROVIDER_NOT_CONFIGURED,
                 messageVariables: {
                     provider
                 }
@@ -3531,25 +3698,24 @@ class SocialAuthService {
         };
     }
     async consumeState(state, redirectUri) {
-        const key = this.stateKey(state);
-        const stored = await this.getCache().get(key);
-        await this.getCache().del(key);
+        // Atomic across instances: a state (and the code that comes with it) is replayable nowhere
+        const stored = await this.getCache().take(this.stateKey(state), (/* inlined export .SOCIAL_STATE_TTL_MS */600000));
         if (!stored) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: 'Social sign-in session is invalid or has expired',
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.STATE_INVALID */.OF.STATE_INVALID
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.STATE_INVALID */.OF.STATE_INVALID
             });
         }
         if (stored.redirectUri !== redirectUri) {
             throw new _nestjs_common__rspack_import_3.UnauthorizedException({
                 message: 'Redirect URI does not match the one the sign-in started with',
-                messageKey: _config_index_js__rspack_import_12/* .SOCIAL_AUTH_MESSAGES.REDIRECT_URI_MISMATCH */.OF.REDIRECT_URI_MISMATCH
+                messageKey: _config_index_js__rspack_import_14/* .SOCIAL_AUTH_MESSAGES.REDIRECT_URI_MISMATCH */.OF.REDIRECT_URI_MISMATCH
             });
         }
         return stored.provider;
     }
     stateKey(state) {
-        return `${_config_index_js__rspack_import_11/* .SOCIAL_STATE_PREFIX */.PR}:${state}`;
+        return `${_config_index_js__rspack_import_13/* .SOCIAL_STATE_PREFIX */.PR}:${state}`;
     }
     getCache() {
         if (!this.cacheManager) {
@@ -3591,7 +3757,7 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _enums_social_provider_type_enum_js__rspack_import_14/* .SocialProviderTypeEnum */.u === "undefined" ? Object : _enums_social_provider_type_enum_js__rspack_import_14/* .SocialProviderTypeEnum */.u,
+        typeof _enums_social_provider_type_enum_js__rspack_import_17/* .SocialProviderTypeEnum */.u === "undefined" ? Object : _enums_social_provider_type_enum_js__rspack_import_17/* .SocialProviderTypeEnum */.u,
         String
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -3614,15 +3780,18 @@ SocialAuthService = _ts_decorate([
     (0,_nestjs_common__rspack_import_3.Injectable)({
         scope: _nestjs_common__rspack_import_3.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_authentication_service_js__rspack_import_10/* .AuthenticationService */.k)),
-    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_authentication_service_js__rspack_import_12/* .AuthenticationService */.k)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v)),
     _ts_param(2, (0,_nestjs_common__rspack_import_3.Optional)()),
     _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
+    _ts_param(3, (0,_nestjs_common__rspack_import_3.Optional)()),
+    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_auth_config_service_js__rspack_import_10/* .AuthConfigService */.W)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _authentication_service_js__rspack_import_10/* .AuthenticationService */.k === "undefined" ? Object : _authentication_service_js__rspack_import_10/* .AuthenticationService */.k,
-        typeof _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_9/* .AuthDataSourceProvider */.v,
-        typeof _flusys_nestjs_shared_classes__rspack_import_1.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_1.HybridCache
+        typeof _authentication_service_js__rspack_import_12/* .AuthenticationService */.k === "undefined" ? Object : _authentication_service_js__rspack_import_12/* .AuthenticationService */.k,
+        typeof _auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_11/* .AuthDataSourceProvider */.v,
+        typeof _flusys_nestjs_shared_classes__rspack_import_1.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_1.HybridCache,
+        typeof _auth_config_service_js__rspack_import_10/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_10/* .AuthConfigService */.W
     ])
 ], SocialAuthService);
 
@@ -3637,12 +3806,12 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
 /* import */ var _flusys_nestjs_shared_interfaces__rspack_import_2 = __webpack_require__(5103);
 /* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
-/* import */ var _config_index_js__rspack_import_9 = __webpack_require__(5363);
-/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_9 = __webpack_require__(7987);
+/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(5363);
 /* import */ var _entities_company_branch_entity_js__rspack_import_4 = __webpack_require__(1923);
 /* import */ var _entities_user_company_permission_entity_js__rspack_import_5 = __webpack_require__(2377);
 /* import */ var _helpers_branch_ancestry_helper_js__rspack_import_6 = __webpack_require__(7526);
-/* import */ var _auth_config_service_js__rspack_import_7 = __webpack_require__(6514);
+/* import */ var _helpers_cache_invalidation_helper_js__rspack_import_7 = __webpack_require__(37);
 /* import */ var _auth_datasource_provider_js__rspack_import_8 = __webpack_require__(2732);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3677,20 +3846,28 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+const UNIQUE_VIOLATION_CODES = new Set([
+    'ER_DUP_ENTRY',
+    '23505',
+    'SQLITE_CONSTRAINT'
+]);
 class UserPermissionService {
     dataSourceProvider;
-    authConfig;
     permissionSyncAdapter;
+    cacheManager;
     _repository = null;
-    constructor(dataSourceProvider, authConfig, permissionSyncAdapter){
+    constructor(dataSourceProvider, permissionSyncAdapter, cacheManager){
         this.dataSourceProvider = dataSourceProvider;
-        this.authConfig = authConfig;
         this.permissionSyncAdapter = permissionSyncAdapter;
+        this.cacheManager = cacheManager;
     }
-    /**
-   * Ensures the acting user is only granting/revoking access within their own tenant.
-   * for a company or branch outside their own company.
-   */ async getRepository() {
+    // The user list caches each user's grant; it depends on this stamp
+    async invalidateGrantCache() {
+        await (0,_helpers_cache_invalidation_helper_js__rspack_import_7/* .invalidateEntityCaches */.i)(this.cacheManager, this.dataSourceProvider, [
+            _config_index_js__rspack_import_9/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION
+        ]);
+    }
+    async getRepository() {
         if (!this._repository) {
             this._repository = await this.dataSourceProvider.getRepository(_entities_user_company_permission_entity_js__rspack_import_5/* .UserCompanyPermission */.I);
         }
@@ -3725,7 +3902,7 @@ class UserPermissionService {
         if (existing) {
             throw new _nestjs_common__rspack_import_3.ConflictException({
                 message: `User already assigned to this ${typeName}`,
-                messageKey: _config_index_js__rspack_import_9/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
+                messageKey: _config_index_js__rspack_import_10/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
                 messageVariables: {
                     type: typeName
                 }
@@ -3739,10 +3916,10 @@ class UserPermissionService {
             }));
         } catch (error) {
             const err = error;
-            if (err?.code === 'ER_DUP_ENTRY' || String(err?.message).includes('Duplicate entry')) {
+            if (UNIQUE_VIOLATION_CODES.has(String(err?.code)) || String(err?.message).includes('Duplicate entry')) {
                 throw new _nestjs_common__rspack_import_3.ConflictException({
                     message: `User already assigned to this ${typeName}. Please refresh and try again.`,
-                    messageKey: _config_index_js__rspack_import_9/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
+                    messageKey: _config_index_js__rspack_import_10/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
                     messageVariables: {
                         type: typeName
                     }
@@ -3750,7 +3927,8 @@ class UserPermissionService {
             }
             throw error;
         }
-        await this.publishPermissionEvent(_config_index_js__rspack_import_10/* .AUTH_EVENT_ACTIONS.PERMISSION_GRANTED */.o.PERMISSION_GRANTED, userId, targetId, type);
+        await this.invalidateGrantCache();
+        await this.publishPermissionEvent(_config_index_js__rspack_import_9/* .AUTH_EVENT_ACTIONS.PERMISSION_GRANTED */.o.PERMISSION_GRANTED, userId, targetId, type);
     }
     async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
@@ -3768,7 +3946,7 @@ class UserPermissionService {
         if (!permission) {
             throw new _nestjs_common__rspack_import_3.NotFoundException({
                 message: `${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`,
-                messageKey: _config_index_js__rspack_import_9/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
+                messageKey: _config_index_js__rspack_import_10/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
                 messageVariables: {
                     type: typeName.charAt(0).toUpperCase() + typeName.slice(1)
                 }
@@ -3783,12 +3961,13 @@ class UserPermissionService {
         } else {
             if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
         }
-        await this.publishPermissionEvent(_config_index_js__rspack_import_10/* .AUTH_EVENT_ACTIONS.PERMISSION_REVOKED */.o.PERMISSION_REVOKED, userId, targetId, type, companyId);
+        await this.invalidateGrantCache();
+        await this.publishPermissionEvent(_config_index_js__rspack_import_9/* .AUTH_EVENT_ACTIONS.PERMISSION_REVOKED */.o.PERMISSION_REVOKED, userId, targetId, type, companyId);
     }
     async publishPermissionEvent(action, userId, targetId, type, companyId) {
         await (0,_flusys_nestjs_shared_classes__rspack_import_1.publishDomainEvent)({
             module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
-            entity: _config_index_js__rspack_import_10/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION,
+            entity: _config_index_js__rspack_import_9/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION,
             action,
             ids: [
                 targetId
@@ -3898,14 +4077,15 @@ UserPermissionService = _ts_decorate([
         scope: _nestjs_common__rspack_import_3.Scope.REQUEST
     }),
     _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v)),
-    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_config_service_js__rspack_import_7/* .AuthConfigService */.W)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Optional)()),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.PERMISSION_SYNC_ADAPTER)),
     _ts_param(2, (0,_nestjs_common__rspack_import_3.Optional)()),
-    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.PERMISSION_SYNC_ADAPTER)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_8/* .AuthDataSourceProvider */.v,
-        typeof _auth_config_service_js__rspack_import_7/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_7/* .AuthConfigService */.W,
-        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
+        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter,
+        typeof HybridCache === "undefined" ? Object : HybridCache
     ])
 ], UserPermissionService);
 
@@ -3925,7 +4105,7 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _config_index_js__rspack_import_12 = __webpack_require__(7987);
 /* import */ var _config_index_js__rspack_import_13 = __webpack_require__(5363);
 /* import */ var _config_index_js__rspack_import_15 = __webpack_require__(5588);
-/* import */ var _helpers_index_js__rspack_import_6 = __webpack_require__(334);
+/* import */ var _helpers_index_js__rspack_import_6 = __webpack_require__(5634);
 /* import */ var _dtos_user_dto_js__rspack_import_7 = __webpack_require__(7265);
 /* import */ var _entities_app_user_entity_js__rspack_import_8 = __webpack_require__(4758);
 /* import */ var _entities_user_company_permission_entity_js__rspack_import_9 = __webpack_require__(2377);
@@ -3992,6 +4172,19 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
             this.dataSource = await this.getDataSourceProvider().getDataSource();
         }
     }
+    // The company-scoped list reads each user's grant (companyIsActive, membership)
+    cacheDependencies() {
+        return [
+            this.entityName,
+            _config_index_js__rspack_import_12/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION
+        ];
+    }
+    async invalidateUserAndGrants() {
+        await Promise.all([
+            this.invalidateCache(),
+            this.utilsService.clearCache(_config_index_js__rspack_import_12/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION, this.cacheManager, this.cacheTenant())
+        ]);
+    }
     async getUserForProfile(userId, user) {
         if (userId !== user.id) {
             throw new _nestjs_common__rspack_import_4.ForbiddenException({
@@ -4018,32 +4211,24 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
         await this.repository.update(id, {
             emailVerified: true
         });
-        await Promise.all([
-            this.clearCacheForAll(),
-            this.clearCacheForId([
-                {
-                    id
-                }
-            ])
-        ]);
+        await this.invalidateCache();
     }
     async verifyPhone(id) {
         await this.ensureDataSourceRepository();
         await this.repository.update(id, {
             phoneVerified: true
         });
-        await Promise.all([
-            this.clearCacheForAll(),
-            this.clearCacheForId([
-                {
-                    id
-                }
-            ])
-        ]);
+        await this.invalidateCache();
     }
     async updateStatus(id, isActive, user) {
         await this.ensureDataSourceRepository();
         const isCompanyFeatureEnabled = this.authConfig.isCompanyFeatureEnabled();
+        if (isCompanyFeatureEnabled && user && !user.companyId) {
+            throw new _nestjs_common__rspack_import_4.ForbiddenException({
+                message: 'Select a company before changing a user status',
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.COMPANY_REQUIRED */.mK.COMPANY_REQUIRED
+            });
+        }
         if (isCompanyFeatureEnabled && user?.companyId && this.permissionRepository) {
             const permission = await this.permissionRepository.findOne({
                 where: {
@@ -4069,14 +4254,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
             });
         }
         if (!isActive) await (0,_helpers_index_js__rspack_import_6/* .revokeUserSessions */.XP)(this.cacheManager, this.authConfig, id);
-        await Promise.all([
-            this.clearCacheForAll(),
-            this.clearCacheForId([
-                {
-                    id
-                }
-            ])
-        ]);
+        await this.invalidateUserAndGrants();
     }
     async convertSingleDtoToEntity(dto, user) {
         const entity = await super.convertSingleDtoToEntity(dto, user);
@@ -4211,6 +4389,10 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
             return superQuery;
         }
         // --- Company feature path ---
+        if (user && !user.companyId) {
+            query.andWhere('1 = 0');
+            return superQuery;
+        }
         if (!user?.companyId || !this.permissionRepository) {
             return superQuery;
         }
@@ -4297,12 +4479,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
                 }
             }
             await queryRunner.commitTransaction();
-            await Promise.all([
-                this.clearCacheForAll(),
-                this.clearCacheForId([
-                    savedUser
-                ])
-            ]);
+            await this.invalidateUserAndGrants();
             return this.convertEntityToResponseDto(savedUser, false);
         } catch (error) {
             await queryRunner.rollbackTransaction();
@@ -4331,6 +4508,10 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
             total: result.total
         };
     }
+    // The actionCode filter reads IAM grants, whose writes never move this cache's stamps
+    bypassListCache(filterAndPaginationDto) {
+        return !!filterAndPaginationDto?.filter?.actionCode;
+    }
     async getEnrichedList(users, user) {
         if (this.userEnricher?.enrichListItems) {
             return this.userEnricher.enrichListItems(users, user);
@@ -4370,12 +4551,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
         try {
             await this.userEnricher.updateProfileSection(userId, sectionId, data, queryRunner);
             await queryRunner.commitTransaction();
-            await Promise.all([
-                this.clearCacheForAll(),
-                this.clearCacheForId([
-                    userEntity
-                ])
-            ]);
+            await this.invalidateCache();
         } catch (error) {
             await queryRunner.rollbackTransaction();
             throw error;
@@ -4391,6 +4567,12 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
         return 100;
     }
     async profile(dto, user) {
+        if (dto.id && dto.id !== user.id) {
+            throw new _nestjs_common__rspack_import_4.ForbiddenException({
+                message: "Cannot access another user's profile",
+                messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PROFILE_ACCESS_DENIED */.mK.PROFILE_ACCESS_DENIED
+            });
+        }
         await this.ensureDataSourceRepository();
         if (!this.dataSource) {
             throw new _nestjs_common__rspack_import_4.BadRequestException({
@@ -4398,7 +4580,7 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
                 messageKey: _flusys_nestjs_shared_constants__rspack_import_2.SYSTEM_MESSAGES.DATASOURCE_NOT_AVAILABLE
             });
         }
-        const userId = dto.id ?? user.id;
+        const userId = user.id;
         if (dto.extras && this.userEnricher?.validateProfileExtras) {
             await this.userEnricher.validateProfileExtras(userId, dto.extras, user);
         }
@@ -4418,37 +4600,29 @@ class UserService extends _flusys_nestjs_shared_classes__rspack_import_1.ApiServ
                 });
             }
             if (dto.password) {
-                const isOwnProfile = !dto.id || dto.id === user.id;
-                if (isOwnProfile) {
-                    if (!dto.oldPassword) {
-                        throw new _nestjs_common__rspack_import_4.BadRequestException({
-                            message: 'Current password is required to change your password',
-                            messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_CHANGE_CURRENT_REQUIRED */.mK.PASSWORD_CHANGE_CURRENT_REQUIRED
-                        });
-                    }
-                    const isPasswordValid = await bcrypt__rspack_import_5.compare(dto.oldPassword, findUser.password);
-                    if (!isPasswordValid) {
-                        throw new _nestjs_common__rspack_import_4.BadRequestException({
-                            message: 'Current password is incorrect',
-                            messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT */.mK.PASSWORD_CHANGE_INVALID_CURRENT
-                        });
-                    }
+                if (!dto.oldPassword) {
+                    throw new _nestjs_common__rspack_import_4.BadRequestException({
+                        message: 'Current password is required to change your password',
+                        messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_CHANGE_CURRENT_REQUIRED */.mK.PASSWORD_CHANGE_CURRENT_REQUIRED
+                    });
+                }
+                if (!findUser.password || !await bcrypt__rspack_import_5.compare(dto.oldPassword, findUser.password)) {
+                    throw new _nestjs_common__rspack_import_4.BadRequestException({
+                        message: 'Current password is incorrect',
+                        messageKey: _config_index_js__rspack_import_13/* .AUTH_MESSAGES.PASSWORD_CHANGE_INVALID_CURRENT */.mK.PASSWORD_CHANGE_INVALID_CURRENT
+                    });
                 }
                 findUser.password = await bcrypt__rspack_import_5.hash(dto.password, (/* inlined export .BCRYPT_SALT_ROUNDS */12));
             }
-            const { password, oldPassword, extras, emailVerified, phoneVerified, isActive, ...restDto } = dto;
+            const { id, password, oldPassword, extras, emailVerified, phoneVerified, isActive, ...restDto } = dto;
+            if (restDto.email && restDto.email !== findUser.email) findUser.emailVerified = false;
             Object.assign(findUser, restDto);
             await queryRunner.manager.save(this.repository.target, findUser);
             if (extras && this.userEnricher?.updateProfileExtras) {
                 await this.userEnricher.updateProfileExtras(userId, extras, queryRunner);
             }
             await queryRunner.commitTransaction();
-            await Promise.all([
-                this.clearCacheForAll(),
-                this.clearCacheForId([
-                    findUser
-                ])
-            ]);
+            await this.invalidateCache();
             return findUser.id;
         } catch (error) {
             await queryRunner.rollbackTransaction();