@flusys/nestjs-auth 9.1.1 → 9.2.0

package/fesm/360.js

@@ -621,6 +621,12 @@ class JwtStrategy extends (0,passport_.PassportStrategy)(Strategy, 'jwt') {
         }), this.authConfig = authConfig, this.moduleRef = moduleRef;
     }
     async validate(_req, payload) {
+        if (payload.type !== 'access') {
+            throw new common_.UnauthorizedException({
+                message: 'Invalid access token',
+                messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
+            });
+        }
         const userRepo = await this.resolveUserRepository();
         await this.checkTokenRevocation(payload);
         const user = await userRepo.findOne({
@@ -664,12 +670,12 @@ class JwtStrategy extends (0,passport_.PassportStrategy)(Strategy, 'jwt') {
         });
     }
     async checkTokenRevocation(payload) {
-        if (!payload.iat) return;
+        if (!payload.iat && typeof payload.iatMs !== 'number') return;
         try {
             const authService = await this.moduleRef.resolve(authentication_service/* .AuthenticationService */.k, undefined, {
                 strict: false
             });
-            if (authService && await authService.isTokenRevoked(payload.id, payload.iat)) {
+            if (authService && await authService.isTokenRevoked(payload.id, payload.iat, payload.iatMs)) {
                 throw new common_.UnauthorizedException({
                     message: 'Token has been revoked',
                     messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_REVOKED */.mK.TOKEN_REVOKED

package/fesm/370.js

@@ -174,6 +174,7 @@ _ts_decorate([
         description: 'Additional fields for profile extension (handled by USER_ENRICHER)'
     }),
     (0,class_validator__rspack_import_1.IsOptional)(),
+    (0,class_validator__rspack_import_1.IsObject)(),
     _ts_metadata("design:type", typeof Record === "undefined" ? Object : Record)
 ], RegistrationDto.prototype, "additionalFields", void 0);
 class RefreshTokenDto {

package/fesm/helpers/index.js

@@ -88,16 +88,18 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-334(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+5634(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
-  Vg: () => (/* reexport */ generateAccessToken),
-  e: () => (/* reexport */ generateTokens),
+  Vg: () => (/* reexport */ token_helper/* .generateAccessToken */.Vg),
+  e: () => (/* reexport */ token_helper/* .generateTokens */.e),
+  PV: () => (/* reexport */ token_helper/* .getSessionsRevokedAtMs */.PV),
+  lL: () => (/* reexport */ token_helper/* .isIssuedBeforeRevocation */.lL),
   vR: () => (/* reexport */ branch_ancestry_helper/* .loadCompanyBranchNodes */.v),
   xu: () => (/* reexport */ branch_ancestry_helper/* .loadDisplayParentIds */.x),
-  om: () => (/* reexport */ parseExpiryToMs),
-  XP: () => (/* reexport */ revokeUserSessions),
+  om: () => (/* reexport */ token_helper/* .parseExpiryToMs */.om),
+  XP: () => (/* reexport */ token_helper/* .revokeUserSessions */.XP),
   QH: () => (/* reexport */ toBranchInfo),
   $C: () => (/* reexport */ toCompanyInfo),
   FV: () => (/* reexport */ toUserInfo)
@@ -132,14 +134,23 @@ function toBranchInfo(branch) {
 
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/branch-ancestry.helper.ts
 var branch_ancestry_helper = __webpack_require__(7526);
-// EXTERNAL MODULE: ./projects/nestjs-auth/src/config/auth.constants.ts
-var auth_constants = __webpack_require__(5588);
-;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/token.helper.ts
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/token.helper.ts
+var token_helper = __webpack_require__(1379);
+;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/index.ts
+
+
+
+
 
-function generateAccessToken(jwtService, authConfig, payload) {
+},
+1379(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _config_auth_constants_js__rspack_import_0 = __webpack_require__(5588);
+
+function generateAccessToken(jwtService, authConfig, payload, issuedAtMs = Date.now()) {
     return jwtService.sign({
         ...payload,
-        type: 'access'
+        type: 'access',
+        iatMs: issuedAtMs
     }, {
         secret: authConfig.getJwtSecret(),
         expiresIn: authConfig.getJwtExpiration(),
@@ -147,10 +158,12 @@ function generateAccessToken(jwtService, authConfig, payload) {
     });
 }
 function generateTokens(jwtService, authConfig, payload) {
-    const accessToken = generateAccessToken(jwtService, authConfig, payload);
+    const issuedAtMs = Date.now();
+    const accessToken = generateAccessToken(jwtService, authConfig, payload, issuedAtMs);
     const refreshToken = jwtService.sign({
         ...payload,
-        type: 'refresh'
+        type: 'refresh',
+        iatMs: issuedAtMs
     }, {
         secret: authConfig.getRefreshTokenSecret(),
         expiresIn: authConfig.getRefreshTokenExpiration(),
@@ -179,15 +192,41 @@ function parseExpiryToMs(expiry) {
             return 7 * 24 * 60 * 60 * 1000;
     }
 }
+// Markers written before millisecond precision hold epoch seconds
+const LEGACY_SECONDS_LIMIT = 1e11;
+function revocationKey(userId) {
+    return `${_config_auth_constants_js__rspack_import_0/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`;
+}
+/**
+ * When the user's sessions were last revoked, in epoch ms. Read past the in-process cache layer:
+ * the marker changes in place, and another instance's L1 copy would hold an older value.
+ */ async function getSessionsRevokedAtMs(cache, userId) {
+    const revokedAt = await cache.get(revocationKey(userId), {
+        skipMemory: true
+    });
+    if (!revokedAt) return undefined;
+    return revokedAt < LEGACY_SECONDS_LIMIT ? revokedAt * 1000 : revokedAt;
+}
+/** True when a token or session issued at `issuedAtMs` predates the user's last revocation */ async function isIssuedBeforeRevocation(cache, userId, issuedAtMs) {
+    const revokedAtMs = await getSessionsRevokedAtMs(cache, userId);
+    return revokedAtMs !== undefined && issuedAtMs < revokedAtMs;
+}
 /** Rejects every token the user holds that was issued before now: checked on refresh and, by JwtStrategy, on every request. */ async function revokeUserSessions(cache, authConfig, userId) {
-    const revokedAt = Math.floor(Date.now() / 1000);
-    await cache.set(`${auth_constants/* .TOKEN_REVOKED_PREFIX */.EV}:${userId}`, revokedAt, parseExpiryToMs(authConfig.getRefreshTokenExpiration()));
+    // Never move the marker back (an instance whose clock lags would otherwise un-revoke tokens)
+    const revokedAtMs = Math.max(Date.now(), await getSessionsRevokedAtMs(cache, userId) ?? 0);
+    await cache.set(revocationKey(userId), revokedAtMs, parseExpiryToMs(authConfig.getRefreshTokenExpiration()), {
+        skipMemory: true
+    });
 }
 
-;// CONCATENATED MODULE: ./projects/nestjs-auth/src/helpers/index.ts
-
-
-
+__webpack_require__.d(__webpack_exports__, {
+  PV: () => (getSessionsRevokedAtMs),
+  Vg: () => (generateAccessToken),
+  XP: () => (revokeUserSessions),
+  e: () => (generateTokens),
+  lL: () => (isIssuedBeforeRevocation),
+  om: () => (parseExpiryToMs)
+});
 
 
 },
@@ -215,8 +254,10 @@ import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
 import * as __rspack_chunk_1 from './index.js';
 __webpack_require__.C(__rspack_chunk_1);
-var __webpack_exports__ = __webpack_exec__(334);var __webpack_exports__generateAccessToken = __webpack_exports__.Vg;
+var __webpack_exports__ = __webpack_exec__(5634);var __webpack_exports__generateAccessToken = __webpack_exports__.Vg;
 var __webpack_exports__generateTokens = __webpack_exports__.e;
+var __webpack_exports__getSessionsRevokedAtMs = __webpack_exports__.PV;
+var __webpack_exports__isIssuedBeforeRevocation = __webpack_exports__.lL;
 var __webpack_exports__loadCompanyBranchNodes = __webpack_exports__.vR;
 var __webpack_exports__loadDisplayParentIds = __webpack_exports__.xu;
 var __webpack_exports__parseExpiryToMs = __webpack_exports__.om;
@@ -224,4 +265,4 @@ var __webpack_exports__revokeUserSessions = __webpack_exports__.XP;
 var __webpack_exports__toBranchInfo = __webpack_exports__.QH;
 var __webpack_exports__toCompanyInfo = __webpack_exports__.$C;
 var __webpack_exports__toUserInfo = __webpack_exports__.FV;
-export { __webpack_exports__generateAccessToken as generateAccessToken, __webpack_exports__generateTokens as generateTokens, __webpack_exports__loadCompanyBranchNodes as loadCompanyBranchNodes, __webpack_exports__loadDisplayParentIds as loadDisplayParentIds, __webpack_exports__parseExpiryToMs as parseExpiryToMs, __webpack_exports__revokeUserSessions as revokeUserSessions, __webpack_exports__toBranchInfo as toBranchInfo, __webpack_exports__toCompanyInfo as toCompanyInfo, __webpack_exports__toUserInfo as toUserInfo };
+export { __webpack_exports__generateAccessToken as generateAccessToken, __webpack_exports__generateTokens as generateTokens, __webpack_exports__getSessionsRevokedAtMs as getSessionsRevokedAtMs, __webpack_exports__isIssuedBeforeRevocation as isIssuedBeforeRevocation, __webpack_exports__loadCompanyBranchNodes as loadCompanyBranchNodes, __webpack_exports__loadDisplayParentIds as loadDisplayParentIds, __webpack_exports__parseExpiryToMs as parseExpiryToMs, __webpack_exports__revokeUserSessions as revokeUserSessions, __webpack_exports__toBranchInfo as toBranchInfo, __webpack_exports__toCompanyInfo as toCompanyInfo, __webpack_exports__toUserInfo as toUserInfo };

package/fesm/index.js

@@ -707,7 +707,9 @@ __webpack_require__.d(__webpack_exports__, {
   Vg: () => (/* reexport */ helpers/* .generateAccessToken */.Vg),
   e: () => (/* reexport */ helpers/* .generateTokens */.e),
   QB: () => (/* reexport */ entities.getAuthEntitiesByConfig),
+  PV: () => (/* reexport */ helpers/* .getSessionsRevokedAtMs */.PV),
   V8: () => (/* reexport */ social_provider_registry/* .getSocialProvider */.V),
+  lL: () => (/* reexport */ helpers/* .isIssuedBeforeRevocation */.lL),
   vR: () => (/* reexport */ helpers/* .loadCompanyBranchNodes */.vR),
   xu: () => (/* reexport */ helpers/* .loadDisplayParentIds */.xu),
   om: () => (/* reexport */ helpers/* .parseExpiryToMs */.om),
@@ -729,8 +731,8 @@ var dtos = __webpack_require__(9029);
 var entities = __webpack_require__(5180);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/enums/index.ts
 var enums = __webpack_require__(8351);
-// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/index.ts + 2 modules
-var helpers = __webpack_require__(334);
+// EXTERNAL MODULE: ./projects/nestjs-auth/src/helpers/index.ts + 1 modules
+var helpers = __webpack_require__(5634);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/interceptors/index.ts
 var interceptors = __webpack_require__(1867);
 // EXTERNAL MODULE: ./projects/nestjs-auth/src/interfaces/index.ts
@@ -923,7 +925,9 @@ var __webpack_exports__authSwaggerConfig = __webpack_exports__.aL;
 var __webpack_exports__generateAccessToken = __webpack_exports__.Vg;
 var __webpack_exports__generateTokens = __webpack_exports__.e;
 var __webpack_exports__getAuthEntitiesByConfig = __webpack_exports__.QB;
+var __webpack_exports__getSessionsRevokedAtMs = __webpack_exports__.PV;
 var __webpack_exports__getSocialProvider = __webpack_exports__.V8;
+var __webpack_exports__isIssuedBeforeRevocation = __webpack_exports__.lL;
 var __webpack_exports__loadCompanyBranchNodes = __webpack_exports__.vR;
 var __webpack_exports__loadDisplayParentIds = __webpack_exports__.xu;
 var __webpack_exports__parseExpiryToMs = __webpack_exports__.om;
@@ -931,4 +935,4 @@ var __webpack_exports__revokeUserSessions = __webpack_exports__.XP;
 var __webpack_exports__toBranchInfo = __webpack_exports__.QH;
 var __webpack_exports__toCompanyInfo = __webpack_exports__.$C;
 var __webpack_exports__toUserInfo = __webpack_exports__.FV;
-export { __webpack_exports__AUTH_EMAIL_PROVIDER as AUTH_EMAIL_PROVIDER, __webpack_exports__AUTH_EVENT_ACTIONS as AUTH_EVENT_ACTIONS, __webpack_exports__AUTH_EVENT_ENTITIES as AUTH_EVENT_ENTITIES, __webpack_exports__AUTH_EVENT_MODULE as AUTH_EVENT_MODULE, __webpack_exports__AUTH_MESSAGES as AUTH_MESSAGES, __webpack_exports__AUTH_MODULE_OPTIONS as AUTH_MODULE_OPTIONS, __webpack_exports__AppUser as AppUser, __webpack_exports__AssignUserBranchDto as AssignUserBranchDto, __webpack_exports__AssignUserCompanyDto as AssignUserCompanyDto, __webpack_exports__AuthConfigService as AuthConfigService, __webpack_exports__AuthDataSourceProvider as AuthDataSourceProvider, __webpack_exports__AuthEmailService as AuthEmailService, __webpack_exports__AuthModule as AuthModule, __webpack_exports__AuthenticationController as AuthenticationController, __webpack_exports__AuthenticationService as AuthenticationService, __webpack_exports__BCRYPT_SALT_ROUNDS as BCRYPT_SALT_ROUNDS, __webpack_exports__BRANCH_MESSAGES as BRANCH_MESSAGES, __webpack_exports__BranchController as BranchController, __webpack_exports__BranchHierarchyResolverAdapter as BranchHierarchyResolverAdapter, __webpack_exports__BranchInfoDto as BranchInfoDto, __webpack_exports__BranchPermittedUserDto as BranchPermittedUserDto, __webpack_exports__BranchPermittedUsersResponseDto as BranchPermittedUsersResponseDto, __webpack_exports__BranchSelectionInfoDto as BranchSelectionInfoDto, __webpack_exports__BranchService as BranchService, __webpack_exports__COMPANY_MESSAGES as COMPANY_MESSAGES, __webpack_exports__ChangePasswordDto as ChangePasswordDto, __webpack_exports__ClearToken as ClearToken, __webpack_exports__Company as Company, __webpack_exports__CompanyAccessResolverAdapter as CompanyAccessResolverAdapter, __webpack_exports__CompanyBranch as CompanyBranch, __webpack_exports__CompanyBranchResponseDto as CompanyBranchResponseDto, __webpack_exports__CompanyController as CompanyController, __webpack_exports__CompanyInfoDto as CompanyInfoDto, __webpack_exports__CompanyPermittedUserDto as CompanyPermittedUserDto, __webpack_exports__CompanyPermittedUsersResponseDto as CompanyPermittedUsersResponseDto, __webpack_exports__CompanyResponseDto as CompanyResponseDto, __webpack_exports__CompanySelectionController as CompanySelectionController, __webpack_exports__CompanySelectionResponseDto as CompanySelectionResponseDto, __webpack_exports__CompanySelectionSessionService as CompanySelectionSessionService, __webpack_exports__CompanyService as CompanyService, __webpack_exports__CompanyWithBranchesDto as CompanyWithBranchesDto, __webpack_exports__CreateCompanyBranchDto as CreateCompanyBranchDto, __webpack_exports__CreateCompanyDto as CreateCompanyDto, __webpack_exports__CreateSocialAuthConfigDto as CreateSocialAuthConfigDto, __webpack_exports__CreateUserDto as CreateUserDto, __webpack_exports__DEFAULT_COOKIE_NAME as DEFAULT_COOKIE_NAME, __webpack_exports__EMAIL_VERIFICATION_MESSAGES as EMAIL_VERIFICATION_MESSAGES, __webpack_exports__EmailVerificationController as EmailVerificationController, __webpack_exports__ForgotPasswordDto as ForgotPasswordDto, __webpack_exports__GetBranchUsersDto as GetBranchUsersDto, __webpack_exports__GetCompanyUsersDto as GetCompanyUsersDto, __webpack_exports__JwtStrategy as JwtStrategy, __webpack_exports__LoginDto as LoginDto, __webpack_exports__LoginResponseDto as LoginResponseDto, __webpack_exports__LoginResponseRequiresEmailVerificationDto as LoginResponseRequiresEmailVerificationDto, __webpack_exports__MAX_COOKIE_BYTES as MAX_COOKIE_BYTES, __webpack_exports__MeResponseDto as MeResponseDto, __webpack_exports__PendingRegistration as PendingRegistration, __webpack_exports__PermissionItemDto as PermissionItemDto, __webpack_exports__PermissionType as PermissionType, __webpack_exports__RefreshTokenDto as RefreshTokenDto, __webpack_exports__RegistrationDto as RegistrationDto, __webpack_exports__RegistrationResponseDto as RegistrationResponseDto, __webpack_exports__ResendVerificationDto as ResendVerificationDto, __webpack_exports__ResetPasswordDto as ResetPasswordDto, __webpack_exports__SESSION_CACHE_PREFIX as SESSION_CACHE_PREFIX, __webpack_exports__SOCIAL_AUTH_CONFIG_MESSAGES as SOCIAL_AUTH_CONFIG_MESSAGES, __webpack_exports__SOCIAL_AUTH_MESSAGES as SOCIAL_AUTH_MESSAGES, __webpack_exports__SOCIAL_STATE_PREFIX as SOCIAL_STATE_PREFIX, __webpack_exports__SOCIAL_STATE_TTL_MS as SOCIAL_STATE_TTL_MS, __webpack_exports__SelectDto as SelectDto, __webpack_exports__SetToken as SetToken, __webpack_exports__SocialAuthConfig as SocialAuthConfig, __webpack_exports__SocialAuthConfigController as SocialAuthConfigController, __webpack_exports__SocialAuthConfigResponseDto as SocialAuthConfigResponseDto, __webpack_exports__SocialAuthConfigService as SocialAuthConfigService, __webpack_exports__SocialAuthController as SocialAuthController, __webpack_exports__SocialAuthService as SocialAuthService, __webpack_exports__SocialAuthorizeDto as SocialAuthorizeDto, __webpack_exports__SocialAuthorizeResponseDto as SocialAuthorizeResponseDto, __webpack_exports__SocialCallbackDto as SocialCallbackDto, __webpack_exports__SocialProviderInfoDto as SocialProviderInfoDto, __webpack_exports__SocialProviderTypeEnum as SocialProviderTypeEnum, __webpack_exports__SocialProvidersDto as SocialProvidersDto, __webpack_exports__SwitchCompanyDto as SwitchCompanyDto, __webpack_exports__TOKEN_REVOKED_PREFIX as TOKEN_REVOKED_PREFIX, __webpack_exports__TokenType as TokenType, __webpack_exports__USER_ENRICHER as USER_ENRICHER, __webpack_exports__USER_MESSAGES as USER_MESSAGES, __webpack_exports__USER_PERMISSION_MESSAGES as USER_PERMISSION_MESSAGES, __webpack_exports__UpdateCompanyBranchDto as UpdateCompanyBranchDto, __webpack_exports__UpdateCompanyDto as UpdateCompanyDto, __webpack_exports__UpdateSocialAuthConfigDto as UpdateSocialAuthConfigDto, __webpack_exports__UpdateUserDto as UpdateUserDto, __webpack_exports__UserBranchPermissionDto as UserBranchPermissionDto, __webpack_exports__UserBranchesResponseDto as UserBranchesResponseDto, __webpack_exports__UserCompaniesResponseDto as UserCompaniesResponseDto, __webpack_exports__UserCompanyPermission as UserCompanyPermission, __webpack_exports__UserCompanyPermissionDto as UserCompanyPermissionDto, __webpack_exports__UserController as UserController, __webpack_exports__UserInfoDto as UserInfoDto, __webpack_exports__UserLookupResponseDto as UserLookupResponseDto, __webpack_exports__UserPermissionController as UserPermissionController, __webpack_exports__UserPermissionService as UserPermissionService, __webpack_exports__UserResponseDto as UserResponseDto, __webpack_exports__UserService as UserService, __webpack_exports__UserToken as UserToken, __webpack_exports__VerifyEmailDto as VerifyEmailDto, __webpack_exports__authSwaggerConfig as authSwaggerConfig, __webpack_exports__generateAccessToken as generateAccessToken, __webpack_exports__generateTokens as generateTokens, __webpack_exports__getAuthEntitiesByConfig as getAuthEntitiesByConfig, __webpack_exports__getSocialProvider as getSocialProvider, __webpack_exports__loadCompanyBranchNodes as loadCompanyBranchNodes, __webpack_exports__loadDisplayParentIds as loadDisplayParentIds, __webpack_exports__parseExpiryToMs as parseExpiryToMs, __webpack_exports__revokeUserSessions as revokeUserSessions, __webpack_exports__toBranchInfo as toBranchInfo, __webpack_exports__toCompanyInfo as toCompanyInfo, __webpack_exports__toUserInfo as toUserInfo };
+export { __webpack_exports__AUTH_EMAIL_PROVIDER as AUTH_EMAIL_PROVIDER, __webpack_exports__AUTH_EVENT_ACTIONS as AUTH_EVENT_ACTIONS, __webpack_exports__AUTH_EVENT_ENTITIES as AUTH_EVENT_ENTITIES, __webpack_exports__AUTH_EVENT_MODULE as AUTH_EVENT_MODULE, __webpack_exports__AUTH_MESSAGES as AUTH_MESSAGES, __webpack_exports__AUTH_MODULE_OPTIONS as AUTH_MODULE_OPTIONS, __webpack_exports__AppUser as AppUser, __webpack_exports__AssignUserBranchDto as AssignUserBranchDto, __webpack_exports__AssignUserCompanyDto as AssignUserCompanyDto, __webpack_exports__AuthConfigService as AuthConfigService, __webpack_exports__AuthDataSourceProvider as AuthDataSourceProvider, __webpack_exports__AuthEmailService as AuthEmailService, __webpack_exports__AuthModule as AuthModule, __webpack_exports__AuthenticationController as AuthenticationController, __webpack_exports__AuthenticationService as AuthenticationService, __webpack_exports__BCRYPT_SALT_ROUNDS as BCRYPT_SALT_ROUNDS, __webpack_exports__BRANCH_MESSAGES as BRANCH_MESSAGES, __webpack_exports__BranchController as BranchController, __webpack_exports__BranchHierarchyResolverAdapter as BranchHierarchyResolverAdapter, __webpack_exports__BranchInfoDto as BranchInfoDto, __webpack_exports__BranchPermittedUserDto as BranchPermittedUserDto, __webpack_exports__BranchPermittedUsersResponseDto as BranchPermittedUsersResponseDto, __webpack_exports__BranchSelectionInfoDto as BranchSelectionInfoDto, __webpack_exports__BranchService as BranchService, __webpack_exports__COMPANY_MESSAGES as COMPANY_MESSAGES, __webpack_exports__ChangePasswordDto as ChangePasswordDto, __webpack_exports__ClearToken as ClearToken, __webpack_exports__Company as Company, __webpack_exports__CompanyAccessResolverAdapter as CompanyAccessResolverAdapter, __webpack_exports__CompanyBranch as CompanyBranch, __webpack_exports__CompanyBranchResponseDto as CompanyBranchResponseDto, __webpack_exports__CompanyController as CompanyController, __webpack_exports__CompanyInfoDto as CompanyInfoDto, __webpack_exports__CompanyPermittedUserDto as CompanyPermittedUserDto, __webpack_exports__CompanyPermittedUsersResponseDto as CompanyPermittedUsersResponseDto, __webpack_exports__CompanyResponseDto as CompanyResponseDto, __webpack_exports__CompanySelectionController as CompanySelectionController, __webpack_exports__CompanySelectionResponseDto as CompanySelectionResponseDto, __webpack_exports__CompanySelectionSessionService as CompanySelectionSessionService, __webpack_exports__CompanyService as CompanyService, __webpack_exports__CompanyWithBranchesDto as CompanyWithBranchesDto, __webpack_exports__CreateCompanyBranchDto as CreateCompanyBranchDto, __webpack_exports__CreateCompanyDto as CreateCompanyDto, __webpack_exports__CreateSocialAuthConfigDto as CreateSocialAuthConfigDto, __webpack_exports__CreateUserDto as CreateUserDto, __webpack_exports__DEFAULT_COOKIE_NAME as DEFAULT_COOKIE_NAME, __webpack_exports__EMAIL_VERIFICATION_MESSAGES as EMAIL_VERIFICATION_MESSAGES, __webpack_exports__EmailVerificationController as EmailVerificationController, __webpack_exports__ForgotPasswordDto as ForgotPasswordDto, __webpack_exports__GetBranchUsersDto as GetBranchUsersDto, __webpack_exports__GetCompanyUsersDto as GetCompanyUsersDto, __webpack_exports__JwtStrategy as JwtStrategy, __webpack_exports__LoginDto as LoginDto, __webpack_exports__LoginResponseDto as LoginResponseDto, __webpack_exports__LoginResponseRequiresEmailVerificationDto as LoginResponseRequiresEmailVerificationDto, __webpack_exports__MAX_COOKIE_BYTES as MAX_COOKIE_BYTES, __webpack_exports__MeResponseDto as MeResponseDto, __webpack_exports__PendingRegistration as PendingRegistration, __webpack_exports__PermissionItemDto as PermissionItemDto, __webpack_exports__PermissionType as PermissionType, __webpack_exports__RefreshTokenDto as RefreshTokenDto, __webpack_exports__RegistrationDto as RegistrationDto, __webpack_exports__RegistrationResponseDto as RegistrationResponseDto, __webpack_exports__ResendVerificationDto as ResendVerificationDto, __webpack_exports__ResetPasswordDto as ResetPasswordDto, __webpack_exports__SESSION_CACHE_PREFIX as SESSION_CACHE_PREFIX, __webpack_exports__SOCIAL_AUTH_CONFIG_MESSAGES as SOCIAL_AUTH_CONFIG_MESSAGES, __webpack_exports__SOCIAL_AUTH_MESSAGES as SOCIAL_AUTH_MESSAGES, __webpack_exports__SOCIAL_STATE_PREFIX as SOCIAL_STATE_PREFIX, __webpack_exports__SOCIAL_STATE_TTL_MS as SOCIAL_STATE_TTL_MS, __webpack_exports__SelectDto as SelectDto, __webpack_exports__SetToken as SetToken, __webpack_exports__SocialAuthConfig as SocialAuthConfig, __webpack_exports__SocialAuthConfigController as SocialAuthConfigController, __webpack_exports__SocialAuthConfigResponseDto as SocialAuthConfigResponseDto, __webpack_exports__SocialAuthConfigService as SocialAuthConfigService, __webpack_exports__SocialAuthController as SocialAuthController, __webpack_exports__SocialAuthService as SocialAuthService, __webpack_exports__SocialAuthorizeDto as SocialAuthorizeDto, __webpack_exports__SocialAuthorizeResponseDto as SocialAuthorizeResponseDto, __webpack_exports__SocialCallbackDto as SocialCallbackDto, __webpack_exports__SocialProviderInfoDto as SocialProviderInfoDto, __webpack_exports__SocialProviderTypeEnum as SocialProviderTypeEnum, __webpack_exports__SocialProvidersDto as SocialProvidersDto, __webpack_exports__SwitchCompanyDto as SwitchCompanyDto, __webpack_exports__TOKEN_REVOKED_PREFIX as TOKEN_REVOKED_PREFIX, __webpack_exports__TokenType as TokenType, __webpack_exports__USER_ENRICHER as USER_ENRICHER, __webpack_exports__USER_MESSAGES as USER_MESSAGES, __webpack_exports__USER_PERMISSION_MESSAGES as USER_PERMISSION_MESSAGES, __webpack_exports__UpdateCompanyBranchDto as UpdateCompanyBranchDto, __webpack_exports__UpdateCompanyDto as UpdateCompanyDto, __webpack_exports__UpdateSocialAuthConfigDto as UpdateSocialAuthConfigDto, __webpack_exports__UpdateUserDto as UpdateUserDto, __webpack_exports__UserBranchPermissionDto as UserBranchPermissionDto, __webpack_exports__UserBranchesResponseDto as UserBranchesResponseDto, __webpack_exports__UserCompaniesResponseDto as UserCompaniesResponseDto, __webpack_exports__UserCompanyPermission as UserCompanyPermission, __webpack_exports__UserCompanyPermissionDto as UserCompanyPermissionDto, __webpack_exports__UserController as UserController, __webpack_exports__UserInfoDto as UserInfoDto, __webpack_exports__UserLookupResponseDto as UserLookupResponseDto, __webpack_exports__UserPermissionController as UserPermissionController, __webpack_exports__UserPermissionService as UserPermissionService, __webpack_exports__UserResponseDto as UserResponseDto, __webpack_exports__UserService as UserService, __webpack_exports__UserToken as UserToken, __webpack_exports__VerifyEmailDto as VerifyEmailDto, __webpack_exports__authSwaggerConfig as authSwaggerConfig, __webpack_exports__generateAccessToken as generateAccessToken, __webpack_exports__generateTokens as generateTokens, __webpack_exports__getAuthEntitiesByConfig as getAuthEntitiesByConfig, __webpack_exports__getSessionsRevokedAtMs as getSessionsRevokedAtMs, __webpack_exports__getSocialProvider as getSocialProvider, __webpack_exports__isIssuedBeforeRevocation as isIssuedBeforeRevocation, __webpack_exports__loadCompanyBranchNodes as loadCompanyBranchNodes, __webpack_exports__loadDisplayParentIds as loadDisplayParentIds, __webpack_exports__parseExpiryToMs as parseExpiryToMs, __webpack_exports__revokeUserSessions as revokeUserSessions, __webpack_exports__toBranchInfo as toBranchInfo, __webpack_exports__toCompanyInfo as toCompanyInfo, __webpack_exports__toUserInfo as toUserInfo };

package/fesm/interceptors/index.js

@@ -216,6 +216,7 @@ class ClearToken {
 ClearToken = _ts_decorate([
     (0,_nestjs_common__rspack_import_1.Injectable)(),
     _ts_param(0, (0,_nestjs_common__rspack_import_1.Optional)()),
+    _ts_param(0, (0,_nestjs_common__rspack_import_1.Inject)(_services_auth_config_service_js__rspack_import_3/* .AuthConfigService */.W)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _services_auth_config_service_js__rspack_import_3/* .AuthConfigService */.W === "undefined" ? Object : _services_auth_config_service_js__rspack_import_3/* .AuthConfigService */.W

package/helpers/cache-invalidation.helper.d.ts

@@ -0,0 +1,3 @@
+import { type HybridCache } from '@flusys/nestjs-shared/classes';
+import { cacheTenantId } from '@flusys/nestjs-shared/utils';
+export declare function invalidateEntityCaches(cache: HybridCache | undefined, dataSourceProvider: Parameters<typeof cacheTenantId>[0], entityNames: string[]): Promise<void>;

package/helpers/token.helper.d.ts

@@ -2,10 +2,12 @@ import { type HybridCache } from '@flusys/nestjs-shared/classes';
 import { JwtService } from '@nestjs/jwt';
 import { type TokenPayload, type TokenPayloadWithCompany } from '../interfaces/authentication.interface.js';
 import { AuthConfigService } from '../services/auth-config.service.js';
-export declare function generateAccessToken(jwtService: JwtService, authConfig: AuthConfigService, payload: TokenPayload | TokenPayloadWithCompany): string;
+export declare function generateAccessToken(jwtService: JwtService, authConfig: AuthConfigService, payload: TokenPayload | TokenPayloadWithCompany, issuedAtMs?: number): string;
 export declare function generateTokens(jwtService: JwtService, authConfig: AuthConfigService, payload: TokenPayload | TokenPayloadWithCompany): {
     accessToken: string;
     refreshToken: string;
 };
 export declare function parseExpiryToMs(expiry: string): number;
-export declare function revokeUserSessions(cache: Pick<HybridCache, 'set'>, authConfig: Pick<AuthConfigService, 'getRefreshTokenExpiration'>, userId: string): Promise<void>;
+export declare function getSessionsRevokedAtMs(cache: Pick<HybridCache, 'get'>, userId: string): Promise<number | undefined>;
+export declare function isIssuedBeforeRevocation(cache: Pick<HybridCache, 'get'>, userId: string, issuedAtMs: number): Promise<boolean>;
+export declare function revokeUserSessions(cache: Pick<HybridCache, 'get' | 'set'>, authConfig: Pick<AuthConfigService, 'getRefreshTokenExpiration'>, userId: string): Promise<void>;

package/interfaces/authentication.interface.d.ts

@@ -8,6 +8,7 @@ export interface TokenPayload {
     profilePictureId?: string;
     tenantId?: string;
     iat?: number;
+    iatMs?: number;
     exp?: number;
 }
 export interface TokenPayloadWithCompany extends TokenPayload {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "9.1.1",
+  "version": "9.2.0",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "type": "module",
   "main": "./fesm/index.js",
@@ -92,7 +92,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "9.1.1",
-    "@flusys/nestjs-shared": "9.1.1"
+    "@flusys/nestjs-core": "9.2.0",
+    "@flusys/nestjs-shared": "9.2.0"
   }
 }

package/services/auth-email.service.d.ts

@@ -1,12 +1,17 @@
+import { HybridCache } from '@flusys/nestjs-shared/classes';
 import { PendingRegistration } from '../entities/pending-registration.entity.js';
 import { type IAuthEmailProvider } from '../interfaces/index.js';
+import { AuthConfigService } from './auth-config.service.js';
 import { AuthDataSourceProvider } from './auth-datasource.provider.js';
 export declare class AuthEmailService {
     private readonly dataSourceProvider?;
     private readonly emailProvider?;
+    private readonly cacheManager?;
+    private readonly authConfig?;
     private readonly PASSWORD_RESET_EXPIRY;
     private readonly EMAIL_VERIFICATION_EXPIRY;
-    constructor(dataSourceProvider?: AuthDataSourceProvider | undefined, emailProvider?: IAuthEmailProvider | undefined);
+    private readonly logger;
+    constructor(dataSourceProvider?: AuthDataSourceProvider | undefined, emailProvider?: IAuthEmailProvider | undefined, cacheManager?: HybridCache | undefined, authConfig?: AuthConfigService | undefined);
     isEmailEnabled(): boolean;
     private getRepository;
     private generateToken;
@@ -14,7 +19,7 @@ export declare class AuthEmailService {
     private assertEmailEnabled;
     private sendVerificationEmailSafe;
     private validateTokenNotExpiredOrUsed;
-    hasPendingRegistration(email: string): Promise<boolean>;
+    hasPendingRegistration(email: string, password?: string): Promise<boolean>;
     createPendingRegistration(data: {
         email: string;
         name?: string;

package/services/authentication.service.d.ts

@@ -27,6 +27,7 @@ export declare class AuthenticationService {
     private isSignUpEnabled;
     private getUserRepository;
     private getCompanyScopedRepository;
+    private invalidateCaches;
     login(email: string, password: string): Promise<LoginResponse | LoginResponseRequiresSelection | LoginResponseRequiresEmailVerification>;
     issueLoginForUser(user: AppUser): Promise<LoginResponse | LoginResponseRequiresSelection>;
     private ensureUserActive;
@@ -50,7 +51,8 @@ export declare class AuthenticationService {
     }>;
     changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
     logout(userId: string): Promise<void>;
-    isTokenRevoked(userId: string, tokenIssuedAt?: number): Promise<boolean>;
+    isTokenRevoked(userId: string, tokenIssuedAt?: number, tokenIssuedAtMs?: number): Promise<boolean>;
+    private isRevokedSince;
     getUserCompanies(userId: string): Promise<Company[]>;
     getUserBranches(userId: string, companyId: string): Promise<Array<CompanyBranch & {
         displayParentId: string | null;

package/services/branch.service.d.ts

@@ -19,6 +19,7 @@ export declare class BranchService extends ApiService<CreateCompanyBranchDto, Up
     protected beforeUpdateOperation(dto: UpdateCompanyBranchDto | UpdateCompanyBranchDto[], _user: ILoggedUserInfo | null, queryRunner: QueryRunner): Promise<void>;
     private validateParent;
     protected beforeDeleteOperation(dto: DeleteDto, user: ILoggedUserInfo | null, queryRunner: QueryRunner): Promise<void>;
+    delete(option: DeleteDto, user: ILoggedUserInfo | null): Promise<null>;
     getDescendantIds(branchIds: string | string[], options?: IBranchHierarchyOptions): Promise<string[]>;
     getAncestorIds(branchId: string, options?: IBranchHierarchyOptions): Promise<string[]>;
     isWithinBranch(branchId: string, ancestorId: string): Promise<boolean>;

package/services/company-selection-session.service.d.ts

@@ -2,16 +2,17 @@ import { HybridCache } from '@flusys/nestjs-shared/classes';
 interface StoredSession {
     sessionId: string;
     userId: string;
-    createdAt: Date;
-    expiresAt: Date;
+    createdAt: number;
+    expiresAt: number;
 }
 export declare class CompanySelectionSessionService {
     protected cacheManager: HybridCache;
     constructor(cacheManager: HybridCache);
-    createSession(userId: string): Promise<string>;
-    getSession(sessionId: string): Promise<StoredSession | null>;
-    consumeSession(sessionId: string): Promise<StoredSession | null>;
-    deleteSession(sessionId: string): Promise<void>;
+    createSession(userId: string, tenantId?: string): Promise<string>;
+    getSession(sessionId: string, tenantId?: string): Promise<StoredSession | null>;
+    consumeSession(sessionId: string, tenantId?: string): Promise<StoredSession | null>;
+    deleteSession(sessionId: string, tenantId?: string): Promise<void>;
+    private unexpired;
     private getKey;
 }
 export {};

package/services/company.service.d.ts

@@ -13,6 +13,7 @@ export declare class CompanyService extends ApiService<CreateCompanyDto, UpdateC
     private readonly permissionSyncAdapter?;
     constructor(cacheManager: HybridCache, utilsService: UtilsService, dataSourceProvider: AuthDataSourceProvider, permissionSyncAdapter?: IPermissionSyncAdapter | undefined);
     protected beforeDeleteOperation(dto: DeleteDto, user: ILoggedUserInfo | null, queryRunner: QueryRunner): Promise<void>;
+    delete(option: DeleteDto, user: ILoggedUserInfo | null): Promise<null>;
     getSelectQuery(query: SelectQueryBuilder<Company>, _user: ILoggedUserInfo | null, select?: string[]): Promise<{
         query: SelectQueryBuilder<Company>;
         isRaw: boolean;

package/services/social-auth-config.service.d.ts

@@ -14,6 +14,7 @@ export declare class SocialAuthConfigService extends ApiService<CreateSocialAuth
     protected beforeInsertOperation(dto: CreateSocialAuthConfigDto | CreateSocialAuthConfigDto[], _user: ILoggedUserInfo | null, _queryRunner: QueryRunner): Promise<void>;
     protected beforeUpdateOperation(dto: UpdateSocialAuthConfigDto | UpdateSocialAuthConfigDto[], _user: ILoggedUserInfo | null, _queryRunner: QueryRunner): Promise<void>;
     private ensureProviderUnclaimed;
+    protected convertEntityToResponseDto(entity: SocialAuthConfig, _isRaw: boolean): ISocialAuthConfig;
     protected getExtraManipulateQuery(query: SelectQueryBuilder<SocialAuthConfig>, filterDto: FilterAndPaginationDto, user: ILoggedUserInfo | null): Promise<{
         query: SelectQueryBuilder<SocialAuthConfig>;
         isRaw: boolean;

package/services/social-auth.service.d.ts

@@ -2,17 +2,20 @@ import { HybridCache } from '@flusys/nestjs-shared/classes';
 import { SocialProviderTypeEnum } from '../enums/social-provider-type.enum.js';
 import { type LoginResponse, type LoginResponseRequiresSelection } from '../interfaces/authentication.interface.js';
 import { type ISocialAuthorization, type ISocialProviderInfo } from '../interfaces/social-auth.interface.js';
+import { AuthConfigService } from './auth-config.service.js';
 import { AuthDataSourceProvider } from './auth-datasource.provider.js';
 import { AuthenticationService } from './authentication.service.js';
 export declare class SocialAuthService {
     private readonly authService;
     private readonly dataSourceProvider;
     private readonly cacheManager?;
-    constructor(authService: AuthenticationService, dataSourceProvider: AuthDataSourceProvider, cacheManager?: HybridCache | undefined);
+    private readonly authConfig?;
+    constructor(authService: AuthenticationService, dataSourceProvider: AuthDataSourceProvider, cacheManager?: HybridCache | undefined, authConfig?: AuthConfigService | undefined);
     listEnabledProviders(redirectUri: string): Promise<ISocialProviderInfo[]>;
     createAuthorization(provider: SocialProviderTypeEnum, redirectUri: string): Promise<ISocialAuthorization>;
     completeLogin(code: string, state: string, redirectUri: string): Promise<LoginResponse | LoginResponseRequiresSelection>;
     private resolveUser;
+    private claimUnverifiedAccount;
     private ensureVerifiedEmail;
     private registerUser;
     private getUsableConfig;

package/services/user-permission.service.d.ts

@@ -1,13 +1,14 @@
+import { type HybridCache } from '@flusys/nestjs-shared/classes';
 import { type IPermissionSyncAdapter } from '@flusys/nestjs-shared/interfaces';
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity.js';
-import { AuthConfigService } from './auth-config.service.js';
 import { AuthDataSourceProvider } from './auth-datasource.provider.js';
 export declare class UserPermissionService {
     private readonly dataSourceProvider;
-    private readonly authConfig;
     private readonly permissionSyncAdapter?;
+    private readonly cacheManager?;
     private _repository;
-    constructor(dataSourceProvider: AuthDataSourceProvider, authConfig: AuthConfigService, permissionSyncAdapter?: IPermissionSyncAdapter | undefined);
+    constructor(dataSourceProvider: AuthDataSourceProvider, permissionSyncAdapter?: IPermissionSyncAdapter | undefined, cacheManager?: HybridCache | undefined);
+    private invalidateGrantCache;
     private getRepository;
     findUserPermissions(userId: string, type: PermissionType): Promise<UserCompanyPermission[]>;
     assignPermission(userId: string, targetId: string, type: PermissionType): Promise<void>;

package/services/user.service.d.ts

@@ -19,6 +19,8 @@ export declare class UserService extends ApiService<CreateUserDto, UpdateUserDto
     private readonly logAdapter;
     constructor(cacheManager: HybridCache, utilsService: UtilsService, dataSourceProvider: AuthDataSourceProvider, authConfig: AuthConfigService, userEnricher?: IUserEnricher | undefined);
     protected ensureDataSourceRepository(): Promise<void>;
+    protected cacheDependencies(): string[];
+    private invalidateUserAndGrants;
     private getUserForProfile;
     verifyEmail(id: string): Promise<void>;
     verifyPhone(id: string): Promise<void>;
@@ -49,6 +51,7 @@ export declare class UserService extends ApiService<CreateUserDto, UpdateUserDto
         data: Array<IUser>;
         total: number;
     }>;
+    protected bypassListCache(filterAndPaginationDto: FilterAndPaginationDto): boolean;
     getEnrichedList(users: IUser[], user: ILoggedUserInfo | null): Promise<IEnrichedUser[]>;
     getProfileSections(): Promise<IProfileSection[]>;
     getProfileSectionData(userId: string, sectionId: string, user: ILoggedUserInfo): Promise<IProfileSectionData | null>;