@scryan7371/sdr-security 0.1.2 → 0.1.3

package/dist/app/client.d.ts

@@ -9,8 +9,6 @@ export declare const createSecurityClient: (options: SecurityClientOptions) => {
     register: (payload: {
         email: string;
         password: string;
-        firstName?: string;
-        lastName?: string;
     }) => Promise<RegisterResponse>;
     login: (payload: {
         email: string;

package/dist/app/client.test.js

@@ -26,8 +26,6 @@ const makeFetch = (responses) => {
         await client.register({
             email: "user@example.com",
             password: "Secret123",
-            firstName: "A",
-            lastName: "B",
         });
         (0, vitest_1.expect)(fetchImpl).toHaveBeenCalledWith("https://api.example.com/security/auth/register", vitest_1.expect.objectContaining({
             method: "POST",

package/dist/nest/contracts.d.ts

@@ -1,8 +1,6 @@
 export type SecurityWorkflowUser = {
     id: string;
     email: string;
-    firstName: string | null;
-    lastName: string | null;
 };
 export type SecurityWorkflowNotifier = {
     sendEmailVerification?: (params: {
@@ -19,6 +17,5 @@ export type SecurityWorkflowNotifier = {
     }) => Promise<void>;
     sendUserAccountApproved: (params: {
         email: string;
-        firstName: string | null;
     }) => Promise<void>;
 };

package/dist/nest/dto/auth.dto.d.ts

@@ -1,8 +1,6 @@
 export declare class RegisterDto {
     email: string;
     password: string;
-    firstName?: string | null;
-    lastName?: string | null;
 }
 export declare class LoginDto {
     email: string;

package/dist/nest/dto/auth.dto.js

@@ -14,8 +14,6 @@ const swagger_1 = require("@nestjs/swagger");
 class RegisterDto {
     email;
     password;
-    firstName;
-    lastName;
 }
 exports.RegisterDto = RegisterDto;
 __decorate([
@@ -26,14 +24,6 @@ __decorate([
     (0, swagger_1.ApiProperty)({ example: "StrongPass1" }),
     __metadata("design:type", String)
 ], RegisterDto.prototype, "password", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ required: false, nullable: true, example: "John" }),
-    __metadata("design:type", Object)
-], RegisterDto.prototype, "firstName", void 0);
-__decorate([
-    (0, swagger_1.ApiProperty)({ required: false, nullable: true, example: "Doe" }),
-    __metadata("design:type", Object)
-], RegisterDto.prototype, "lastName", void 0);
 class LoginDto {
     email;
     password;

package/dist/nest/entities/app-user.entity.d.ts

@@ -1,11 +1,4 @@
 export declare class AppUserEntity {
     id: string;
     email: string;
-    passwordHash: string;
-    firstName: string | null;
-    lastName: string | null;
-    emailVerifiedAt: Date | null;
-    emailVerificationToken: string | null;
-    adminApprovedAt: Date | null;
-    isActive: boolean;
 }

package/dist/nest/entities/app-user.entity.js

@@ -14,13 +14,6 @@ const typeorm_1 = require("typeorm");
 let AppUserEntity = class AppUserEntity {
     id;
     email;
-    passwordHash;
-    firstName;
-    lastName;
-    emailVerifiedAt;
-    emailVerificationToken;
-    adminApprovedAt;
-    isActive;
 };
 exports.AppUserEntity = AppUserEntity;
 __decorate([
@@ -31,34 +24,6 @@ __decorate([
     (0, typeorm_1.Column)({ type: "varchar" }),
     __metadata("design:type", String)
 ], AppUserEntity.prototype, "email", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: "varchar", name: "password_hash" }),
-    __metadata("design:type", String)
-], AppUserEntity.prototype, "passwordHash", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: "varchar", name: "first_name", nullable: true }),
-    __metadata("design:type", Object)
-], AppUserEntity.prototype, "firstName", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: "varchar", name: "last_name", nullable: true }),
-    __metadata("design:type", Object)
-], AppUserEntity.prototype, "lastName", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: "timestamptz", name: "email_verified_at", nullable: true }),
-    __metadata("design:type", Object)
-], AppUserEntity.prototype, "emailVerifiedAt", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: "varchar", name: "email_verification_token", nullable: true }),
-    __metadata("design:type", Object)
-], AppUserEntity.prototype, "emailVerificationToken", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: "timestamptz", name: "admin_approved_at", nullable: true }),
-    __metadata("design:type", Object)
-], AppUserEntity.prototype, "adminApprovedAt", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: "boolean", name: "is_active", default: true }),
-    __metadata("design:type", Boolean)
-], AppUserEntity.prototype, "isActive", void 0);
 exports.AppUserEntity = AppUserEntity = __decorate([
     (0, typeorm_1.Entity)({ name: "app_user" })
 ], AppUserEntity);

package/dist/nest/entities/security-user.entity.d.ts

@@ -0,0 +1,9 @@
+export declare class SecurityUserEntity {
+    userId: string;
+    passwordHash: string;
+    emailVerifiedAt: Date | null;
+    emailVerificationToken: string | null;
+    adminApprovedAt: Date | null;
+    isActive: boolean;
+    createdAt: Date;
+}

package/dist/nest/entities/security-user.entity.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityUserEntity = void 0;
+const typeorm_1 = require("typeorm");
+let SecurityUserEntity = class SecurityUserEntity {
+    userId;
+    passwordHash;
+    emailVerifiedAt;
+    emailVerificationToken;
+    adminApprovedAt;
+    isActive;
+    createdAt;
+};
+exports.SecurityUserEntity = SecurityUserEntity;
+__decorate([
+    (0, typeorm_1.PrimaryColumn)({ type: "varchar", name: "user_id" }),
+    __metadata("design:type", String)
+], SecurityUserEntity.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "varchar", name: "password_hash" }),
+    __metadata("design:type", String)
+], SecurityUserEntity.prototype, "passwordHash", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "timestamptz", name: "email_verified_at", nullable: true }),
+    __metadata("design:type", Object)
+], SecurityUserEntity.prototype, "emailVerifiedAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "varchar", name: "email_verification_token", nullable: true }),
+    __metadata("design:type", Object)
+], SecurityUserEntity.prototype, "emailVerificationToken", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "timestamptz", name: "admin_approved_at", nullable: true }),
+    __metadata("design:type", Object)
+], SecurityUserEntity.prototype, "adminApprovedAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: "boolean", name: "is_active", default: true }),
+    __metadata("design:type", Boolean)
+], SecurityUserEntity.prototype, "isActive", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: "created_at" }),
+    __metadata("design:type", Date)
+], SecurityUserEntity.prototype, "createdAt", void 0);
+exports.SecurityUserEntity = SecurityUserEntity = __decorate([
+    (0, typeorm_1.Entity)({ name: "security_user" })
+], SecurityUserEntity);

package/dist/nest/index.d.ts

@@ -15,4 +15,5 @@ export * from "./entities/app-user.entity";
 export * from "./entities/refresh-token.entity";
 export * from "./entities/password-reset-token.entity";
 export * from "./entities/security-role.entity";
+export * from "./entities/security-user.entity";
 export * from "./entities/security-user-role.entity";

package/dist/nest/index.js

@@ -31,4 +31,5 @@ __exportStar(require("./entities/app-user.entity"), exports);
 __exportStar(require("./entities/refresh-token.entity"), exports);
 __exportStar(require("./entities/password-reset-token.entity"), exports);
 __exportStar(require("./entities/security-role.entity"), exports);
+__exportStar(require("./entities/security-user.entity"), exports);
 __exportStar(require("./entities/security-user-role.entity"), exports);

package/dist/nest/security-auth.controller.d.ts

@@ -10,8 +10,6 @@ export declare class SecurityAuthController {
     register(body: {
         email?: string;
         password?: string;
-        firstName?: string;
-        lastName?: string;
     }): Promise<import("../api").RegisterResponse>;
     login(body: {
         email?: string;

package/dist/nest/security-auth.controller.js

@@ -30,8 +30,6 @@ let SecurityAuthController = class SecurityAuthController {
         return this.authService.register({
             email: body.email,
             password: body.password,
-            firstName: body.firstName ?? null,
-            lastName: body.lastName ?? null,
         });
     }
     async login(body) {

package/dist/nest/security-auth.controller.test.js

@@ -29,15 +29,11 @@ const makeAuthService = () => ({
         const result = await controller.register({
             email: "user@example.com",
             password: "Secret123",
-            firstName: "A",
-            lastName: "B",
         });
         (0, vitest_1.expect)(result).toEqual({ success: true });
         (0, vitest_1.expect)(service.register).toHaveBeenCalledWith({
             email: "user@example.com",
             password: "Secret123",
-            firstName: "A",
-            lastName: "B",
         });
     });
     (0, vitest_1.it)("validates login and refresh payloads", async () => {

package/dist/nest/security-auth.module.js

@@ -14,6 +14,7 @@ const app_user_entity_1 = require("./entities/app-user.entity");
 const password_reset_token_entity_1 = require("./entities/password-reset-token.entity");
 const refresh_token_entity_1 = require("./entities/refresh-token.entity");
 const security_role_entity_1 = require("./entities/security-role.entity");
+const security_user_entity_1 = require("./entities/security-user.entity");
 const security_user_role_entity_1 = require("./entities/security-user-role.entity");
 const security_admin_guard_1 = require("./security-admin.guard");
 const security_auth_controller_1 = require("./security-auth.controller");
@@ -40,6 +41,7 @@ let SecurityAuthModule = SecurityAuthModule_1 = class SecurityAuthModule {
             imports: [
                 typeorm_1.TypeOrmModule.forFeature([
                     app_user_entity_1.AppUserEntity,
+                    security_user_entity_1.SecurityUserEntity,
                     refresh_token_entity_1.RefreshTokenEntity,
                     password_reset_token_entity_1.PasswordResetTokenEntity,
                     security_role_entity_1.SecurityRoleEntity,

package/dist/nest/security-auth.service.d.ts

@@ -5,22 +5,22 @@ import { AppUserEntity } from "./entities/app-user.entity";
 import { PasswordResetTokenEntity } from "./entities/password-reset-token.entity";
 import { RefreshTokenEntity } from "./entities/refresh-token.entity";
 import { SecurityRoleEntity } from "./entities/security-role.entity";
+import { SecurityUserEntity } from "./entities/security-user.entity";
 import { SecurityUserRoleEntity } from "./entities/security-user-role.entity";
 import { SecurityWorkflowNotifier } from "./contracts";
 export declare class SecurityAuthService {
-    private readonly usersRepo;
+    private readonly appUsersRepo;
+    private readonly securityUsersRepo;
     private readonly refreshTokenRepo;
     private readonly passwordResetRepo;
     private readonly rolesRepo;
     private readonly userRolesRepo;
     private readonly options;
     private readonly notifier;
-    constructor(usersRepo: Repository<AppUserEntity>, refreshTokenRepo: Repository<RefreshTokenEntity>, passwordResetRepo: Repository<PasswordResetTokenEntity>, rolesRepo: Repository<SecurityRoleEntity>, userRolesRepo: Repository<SecurityUserRoleEntity>, options: SecurityAuthModuleOptions, notifier: SecurityWorkflowNotifier);
+    constructor(appUsersRepo: Repository<AppUserEntity>, securityUsersRepo: Repository<SecurityUserEntity>, refreshTokenRepo: Repository<RefreshTokenEntity>, passwordResetRepo: Repository<PasswordResetTokenEntity>, rolesRepo: Repository<SecurityRoleEntity>, userRolesRepo: Repository<SecurityUserRoleEntity>, options: SecurityAuthModuleOptions, notifier: SecurityWorkflowNotifier);
     register(params: {
         email: string;
         password: string;
-        firstName?: string | null;
-        lastName?: string | null;
     }): Promise<RegisterResponse>;
     login(params: {
         email: string;
@@ -50,6 +50,7 @@ export declare class SecurityAuthService {
         userId: string;
         roles: string[];
     }>;
+    getUserIdByVerificationToken(token: string): Promise<string | null>;
     private assertCanAuthenticate;
     private issueTokens;
     private createEmailVerificationToken;

package/dist/nest/security-auth.service.js

@@ -26,21 +26,24 @@ const app_user_entity_1 = require("./entities/app-user.entity");
 const password_reset_token_entity_1 = require("./entities/password-reset-token.entity");
 const refresh_token_entity_1 = require("./entities/refresh-token.entity");
 const security_role_entity_1 = require("./entities/security-role.entity");
+const security_user_entity_1 = require("./entities/security-user.entity");
 const security_user_role_entity_1 = require("./entities/security-user-role.entity");
 const tokens_1 = require("./tokens");
 const EMAIL_TOKEN_BYTES = 24;
 const REFRESH_TOKEN_BYTES = 32;
 const PASSWORD_ROUNDS = 12;
 let SecurityAuthService = class SecurityAuthService {
-    usersRepo;
+    appUsersRepo;
+    securityUsersRepo;
     refreshTokenRepo;
     passwordResetRepo;
     rolesRepo;
     userRolesRepo;
     options;
     notifier;
-    constructor(usersRepo, refreshTokenRepo, passwordResetRepo, rolesRepo, userRolesRepo, options, notifier) {
-        this.usersRepo = usersRepo;
+    constructor(appUsersRepo, securityUsersRepo, refreshTokenRepo, passwordResetRepo, rolesRepo, userRolesRepo, options, notifier) {
+        this.appUsersRepo = appUsersRepo;
+        this.securityUsersRepo = securityUsersRepo;
         this.refreshTokenRepo = refreshTokenRepo;
         this.passwordResetRepo = passwordResetRepo;
         this.rolesRepo = rolesRepo;
@@ -50,45 +53,52 @@ let SecurityAuthService = class SecurityAuthService {
     }
     async register(params) {
         const email = (0, validation_1.sanitizeEmail)(params.email);
-        const existing = await this.usersRepo.findOne({ where: { email } });
+        const existing = await this.appUsersRepo.findOne({ where: { email } });
         if (existing) {
             throw new common_1.BadRequestException("Email already in use");
         }
-        const user = await this.usersRepo.save(this.usersRepo.create({
+        const appUser = await this.appUsersRepo.save(this.appUsersRepo.create({
             email,
+        }));
+        const securityUser = await this.securityUsersRepo.save(this.securityUsersRepo.create({
+            userId: appUser.id,
             passwordHash: await (0, bcryptjs_1.hash)(params.password, PASSWORD_ROUNDS),
-            firstName: params.firstName ?? null,
-            lastName: params.lastName ?? null,
             emailVerifiedAt: null,
             emailVerificationToken: null,
             adminApprovedAt: null,
             isActive: true,
         }));
-        const verificationToken = await this.createEmailVerificationToken(user.id);
+        const verificationToken = await this.createEmailVerificationToken(appUser.id);
         if (this.notifier.sendEmailVerification) {
             await this.notifier.sendEmailVerification({
-                email: user.email,
+                email: appUser.email,
                 token: verificationToken,
             });
         }
         return {
             success: true,
-            user: await this.toSafeUser(user),
+            user: await this.toSafeUser(appUser, securityUser),
             debugToken: verificationToken,
         };
     }
     async login(params) {
         const email = (0, validation_1.sanitizeEmail)(params.email);
-        const user = await this.usersRepo.findOne({ where: { email } });
-        if (!user) {
+        const appUser = await this.appUsersRepo.findOne({ where: { email } });
+        if (!appUser) {
+            throw new common_1.UnauthorizedException("Invalid credentials");
+        }
+        const securityUser = await this.securityUsersRepo.findOne({
+            where: { userId: appUser.id },
+        });
+        if (!securityUser) {
             throw new common_1.UnauthorizedException("Invalid credentials");
         }
-        const ok = await (0, bcryptjs_1.compare)(params.password, user.passwordHash);
+        const ok = await (0, bcryptjs_1.compare)(params.password, securityUser.passwordHash);
         if (!ok) {
             throw new common_1.UnauthorizedException("Invalid credentials");
         }
-        this.assertCanAuthenticate(user);
-        return this.issueTokens(user);
+        this.assertCanAuthenticate(securityUser);
+        return this.issueTokens(appUser, securityUser);
     }
     async refresh(refreshToken) {
         const record = await this.findValidRefreshToken(refreshToken);
@@ -96,14 +106,20 @@ let SecurityAuthService = class SecurityAuthService {
             throw new common_1.UnauthorizedException("Invalid refresh token");
         }
         await this.refreshTokenRepo.update({ id: record.id }, { revokedAt: new Date() });
-        const user = await this.usersRepo.findOne({
+        const appUser = await this.appUsersRepo.findOne({
             where: { id: record.userId ?? "" },
         });
-        if (!user) {
+        if (!appUser) {
             throw new common_1.UnauthorizedException("User not found");
         }
-        this.assertCanAuthenticate(user);
-        return this.issueTokens(user);
+        const securityUser = await this.securityUsersRepo.findOne({
+            where: { userId: appUser.id },
+        });
+        if (!securityUser) {
+            throw new common_1.UnauthorizedException("User not found");
+        }
+        this.assertCanAuthenticate(securityUser);
+        return this.issueTokens(appUser, securityUser);
     }
     async logout(refreshToken) {
         if (!refreshToken) {
@@ -116,34 +132,42 @@ let SecurityAuthService = class SecurityAuthService {
         return { success: true };
     }
     async changePassword(params) {
-        const user = await this.usersRepo.findOne({ where: { id: params.userId } });
-        if (!user) {
+        const securityUser = await this.securityUsersRepo.findOne({
+            where: { userId: params.userId },
+        });
+        if (!securityUser) {
             throw new common_1.BadRequestException("User not found");
         }
-        const ok = await (0, bcryptjs_1.compare)(params.currentPassword, user.passwordHash);
+        const ok = await (0, bcryptjs_1.compare)(params.currentPassword, securityUser.passwordHash);
         if (!ok) {
             throw new common_1.UnauthorizedException("Current password is incorrect");
         }
-        await this.usersRepo.update({ id: user.id }, { passwordHash: await (0, bcryptjs_1.hash)(params.newPassword, PASSWORD_ROUNDS) });
+        await this.securityUsersRepo.update({ userId: securityUser.userId }, { passwordHash: await (0, bcryptjs_1.hash)(params.newPassword, PASSWORD_ROUNDS) });
         return { success: true };
     }
     async requestForgotPassword(emailInput) {
         const email = (0, validation_1.sanitizeEmail)(emailInput);
-        const user = await this.usersRepo.findOne({ where: { email } });
-        if (!user) {
+        const appUser = await this.appUsersRepo.findOne({ where: { email } });
+        if (!appUser) {
+            return { success: true };
+        }
+        const securityUser = await this.securityUsersRepo.findOne({
+            where: { userId: appUser.id },
+        });
+        if (!securityUser) {
             return { success: true };
         }
         const token = (0, crypto_1.randomBytes)(EMAIL_TOKEN_BYTES).toString("hex");
         const expiresAt = new Date(Date.now() +
             (this.options.passwordResetTokenExpiresInMinutes ?? 30) * 60_000);
         await this.passwordResetRepo.save(this.passwordResetRepo.create({
-            userId: user.id,
+            userId: appUser.id,
             token,
             expiresAt,
             usedAt: null,
         }));
         if (this.notifier.sendPasswordReset) {
-            await this.notifier.sendPasswordReset({ email: user.email, token });
+            await this.notifier.sendPasswordReset({ email: appUser.email, token });
         }
         return { success: true };
     }
@@ -152,23 +176,29 @@ let SecurityAuthService = class SecurityAuthService {
         if (!reset || reset.usedAt || reset.expiresAt.getTime() <= Date.now()) {
             throw new common_1.BadRequestException("Invalid password reset token");
         }
-        await this.usersRepo.update({ id: reset.userId }, { passwordHash: await (0, bcryptjs_1.hash)(newPassword, PASSWORD_ROUNDS) });
+        await this.securityUsersRepo.update({ userId: reset.userId }, { passwordHash: await (0, bcryptjs_1.hash)(newPassword, PASSWORD_ROUNDS) });
         await this.passwordResetRepo.update({ id: reset.id }, { usedAt: new Date() });
         return { success: true };
     }
     async verifyEmailByToken(token) {
-        const user = await this.usersRepo.findOne({
+        const user = await this.securityUsersRepo.findOne({
             where: { emailVerificationToken: token },
         });
         if (!user) {
             throw new common_1.BadRequestException("Invalid verification token");
         }
-        await this.usersRepo.update({ id: user.id }, { emailVerifiedAt: new Date(), emailVerificationToken: null });
+        await this.securityUsersRepo.update({ userId: user.userId }, { emailVerifiedAt: new Date(), emailVerificationToken: null });
         return { success: true };
     }
     async getMyRoles(userId) {
         return { userId, roles: await this.getUserRoleKeys(userId) };
     }
+    async getUserIdByVerificationToken(token) {
+        const user = await this.securityUsersRepo.findOne({
+            where: { emailVerificationToken: token },
+        });
+        return user?.userId ?? null;
+    }
     assertCanAuthenticate(user) {
         if (!user.isActive) {
             throw new common_1.UnauthorizedException("Account is inactive");
@@ -181,17 +211,17 @@ let SecurityAuthService = class SecurityAuthService {
             throw new common_1.UnauthorizedException("Admin approval required");
         }
     }
-    async issueTokens(user) {
-        const roles = await this.getUserRoleKeys(user.id);
+    async issueTokens(appUser, securityUser) {
+        const roles = await this.getUserRoleKeys(appUser.id);
         const accessTokenExpiresIn = this.options.accessTokenExpiresIn ?? "15m";
-        const accessToken = (0, jsonwebtoken_1.sign)({ sub: user.id, email: user.email, roles }, this.options.jwtSecret, { expiresIn: accessTokenExpiresIn });
+        const accessToken = (0, jsonwebtoken_1.sign)({ sub: appUser.id, email: appUser.email, roles }, this.options.jwtSecret, { expiresIn: accessTokenExpiresIn });
         const refreshToken = (0, crypto_1.randomBytes)(REFRESH_TOKEN_BYTES).toString("hex");
         const refreshTokenHash = await (0, bcryptjs_1.hash)(refreshToken, PASSWORD_ROUNDS);
         const refreshTokenExpiresAt = new Date(Date.now() +
             (this.options.refreshTokenExpiresInDays ?? 30) * 24 * 60 * 60 * 1000);
         await this.refreshTokenRepo.save(this.refreshTokenRepo.create({
             id: (0, crypto_1.randomUUID)(),
-            userId: user.id,
+            userId: appUser.id,
             tokenHash: refreshTokenHash,
             expiresAt: refreshTokenExpiresAt,
             revokedAt: null,
@@ -201,12 +231,12 @@ let SecurityAuthService = class SecurityAuthService {
             accessTokenExpiresIn,
             refreshToken,
             refreshTokenExpiresAt,
-            user: await this.toSafeUser(user),
+            user: await this.toSafeUser(appUser, securityUser),
         };
     }
     async createEmailVerificationToken(userId) {
         const token = (0, crypto_1.randomBytes)(EMAIL_TOKEN_BYTES).toString("hex");
-        await this.usersRepo.update({ id: userId }, { emailVerificationToken: token });
+        await this.securityUsersRepo.update({ userId }, { emailVerificationToken: token });
         return token;
     }
     async findValidRefreshToken(token, onlyUnexpired = true) {
@@ -236,18 +266,16 @@ let SecurityAuthService = class SecurityAuthService {
         const roles = await this.rolesRepo.find({ where: { id: (0, typeorm_2.In)(roleIds) } });
         return roles.map((role) => (0, roles_1.normalizeRoleName)(role.roleKey)).sort();
     }
-    async toSafeUser(user) {
+    async toSafeUser(appUser, securityUser) {
         return {
-            id: user.id,
-            email: user.email,
-            firstName: user.firstName,
-            lastName: user.lastName,
+            id: appUser.id,
+            email: appUser.email,
             phone: null,
-            roles: await this.getUserRoleKeys(user.id),
-            emailVerifiedAt: user.emailVerifiedAt,
+            roles: await this.getUserRoleKeys(appUser.id),
+            emailVerifiedAt: securityUser.emailVerifiedAt,
             phoneVerifiedAt: null,
-            adminApprovedAt: user.adminApprovedAt,
-            isActive: user.isActive,
+            adminApprovedAt: securityUser.adminApprovedAt,
+            isActive: securityUser.isActive,
         };
     }
 };
@@ -255,15 +283,17 @@ exports.SecurityAuthService = SecurityAuthService;
 exports.SecurityAuthService = SecurityAuthService = __decorate([
     (0, common_1.Injectable)(),
     __param(0, (0, typeorm_1.InjectRepository)(app_user_entity_1.AppUserEntity)),
-    __param(1, (0, typeorm_1.InjectRepository)(refresh_token_entity_1.RefreshTokenEntity)),
-    __param(2, (0, typeorm_1.InjectRepository)(password_reset_token_entity_1.PasswordResetTokenEntity)),
-    __param(3, (0, typeorm_1.InjectRepository)(security_role_entity_1.SecurityRoleEntity)),
-    __param(4, (0, typeorm_1.InjectRepository)(security_user_role_entity_1.SecurityUserRoleEntity)),
-    __param(5, (0, common_1.Inject)(security_auth_constants_1.SECURITY_AUTH_OPTIONS)),
-    __param(6, (0, common_1.Inject)(tokens_1.SECURITY_WORKFLOW_NOTIFIER)),
+    __param(1, (0, typeorm_1.InjectRepository)(security_user_entity_1.SecurityUserEntity)),
+    __param(2, (0, typeorm_1.InjectRepository)(refresh_token_entity_1.RefreshTokenEntity)),
+    __param(3, (0, typeorm_1.InjectRepository)(password_reset_token_entity_1.PasswordResetTokenEntity)),
+    __param(4, (0, typeorm_1.InjectRepository)(security_role_entity_1.SecurityRoleEntity)),
+    __param(5, (0, typeorm_1.InjectRepository)(security_user_role_entity_1.SecurityUserRoleEntity)),
+    __param(6, (0, common_1.Inject)(security_auth_constants_1.SECURITY_AUTH_OPTIONS)),
+    __param(7, (0, common_1.Inject)(tokens_1.SECURITY_WORKFLOW_NOTIFIER)),
     __metadata("design:paramtypes", [typeorm_2.Repository,
         typeorm_2.Repository,
         typeorm_2.Repository,
         typeorm_2.Repository,
+        typeorm_2.Repository,
         typeorm_2.Repository, Object, Object])
 ], SecurityAuthService);