ecrs-auth-core 1.0.110 → 1.0.113

package/dist/auth-customer.controller.js

@@ -28,8 +28,11 @@ let AuthCustomerController = class AuthCustomerController {
         const clientIp = this.getClientIp(request);
         const userAgent = request.get("user-agent") || "Unknown";
         const additionalData = this.extractClientData(request, userAgent);
-        console.log(`📍 Customer Emplyee login attempt from IP: ${clientIp}, User-Agent: ${userAgent}`);
-        const user = await this.authCustomerService.validateUser(body.email, body.password, clientIp);
+        const host = request.get("host") || "";
+        const hostParts = host.split(".");
+        const subdomain = hostParts.length > 2 ? hostParts[0] : null;
+        console.log(`📍 Customer Emplyee login attempt from IP: ${clientIp}, User-Agent: ${userAgent}, subdomain: ${subdomain ?? "none"}`);
+        const user = await this.authCustomerService.validateUser(body.email, body.password, clientIp, subdomain ?? undefined);
         if (!user) {
             await this.authCustomerService
                 .saveLastLogin({ email: body.email }, clientIp, "failed", "Invalid credentials or IP not allowed", additionalData)

package/dist/auth-customer.service.d.ts

@@ -12,7 +12,7 @@ export declare class AuthCustomerService {
     private readonly employeeWorkProfileRepo;
     private uploadPhotoDir;
     constructor(jwtService: JwtService, options: AuthCustomerCoreOptions);
-    validateUser(email: string, password: string, clientIp?: string): Promise<UserCustomer>;
+    validateUser(email: string, password: string, clientIp?: string, subdomain?: string): Promise<UserCustomer>;
     hasModuleAccess(userId: number, moduleId: number): Promise<boolean>;
     saveLastLogin(user: UserCustomer, clientIp: string, loginStatus?: "success" | "failed" | "blocked", failureReason?: string, additionalData?: {
         browser?: string;
@@ -63,5 +63,6 @@ export declare class AuthCustomerService {
         access_token: string;
     }>;
     findUserById(id: number): Promise<UserCustomer | null>;
+    getCustomerIdBySubdomain(subdomain: string): Promise<number | null>;
     findEcrsEmployeeInCustomer(ecrsEmployeeId: number): Promise<UserCustomer | null>;
 }

package/dist/auth-customer.service.js

@@ -64,7 +64,7 @@ let AuthCustomerService = class AuthCustomerService {
         this.loginDetailsRepo = repositories.loginDetailsRepo || null;
         this.employeeWorkProfileRepo = repositories.employeeWorkProfileRepo || null;
     }
-    async validateUser(email, password, clientIp) {
+    async validateUser(email, password, clientIp, subdomain) {
         if (!email || !password || password.length > 72 || email.length > 254) {
             throw new common_1.UnauthorizedException("Invalid credentials");
         }
@@ -82,8 +82,14 @@ let AuthCustomerService = class AuthCustomerService {
         if (!user || !isValid) {
             throw new common_1.UnauthorizedException("Invalid credentials");
         }
-        if (clientIp && this.userLastLoginRepo) {
-            // IP restriction check can be added here if needed
+        if (subdomain) {
+            const rows = await this.userRepo.query(`SELECT customer_id FROM public.tbl_super_customer_ets_setup_details WHERE subdomain = $1 LIMIT 1`, [subdomain]);
+            const customerId = rows[0]?.customer_id;
+            if (!customerId || customerId !== user.parentId) {
+                console.log(`❌ Domain not match: subdomain="${subdomain}" → customer_id=${customerId ?? "not found"}, user.parentId=${user.parentId}`);
+                throw new common_1.UnauthorizedException("Invalid domain");
+            }
+            console.log(`✅ Domain match: subdomain="${subdomain}" → customer_id=${customerId} matches user.parentId=${user.parentId}`);
         }
         return user;
     }
@@ -318,6 +324,10 @@ let AuthCustomerService = class AuthCustomerService {
     async findUserById(id) {
         return this.userRepo.findOne({ where: { id } });
     }
+    async getCustomerIdBySubdomain(subdomain) {
+        const rows = await this.userRepo.query(`SELECT customer_id FROM public.tbl_super_customer_ets_setup_details WHERE subdomain = $1 LIMIT 1`, [subdomain]);
+        return rows[0]?.customer_id ?? null;
+    }
     // In auth-customer.service.ts — add this new method
     async findEcrsEmployeeInCustomer(ecrsEmployeeId) {
         return this.userRepo.findOne({

package/dist/auth.service.js

@@ -82,8 +82,8 @@ let AuthService = class AuthService {
         const normalizedEmail = email.trim().toLowerCase();
         const whereClause = {
             email: (0, typeorm_1.ILike)(normalizedEmail),
-            deletedBy: null,
-            deletedAt: null,
+            deletedBy: (0, typeorm_1.IsNull)(),
+            deletedAt: (0, typeorm_1.IsNull)(),
             status: 1,
         };
         //role-id
@@ -100,7 +100,6 @@ let AuthService = class AuthService {
         else if (moduleId !== undefined && modulearray.includes(moduleId)) {
             whereClause.roleId = (0, typeorm_1.In)([1, 2, 3]);
         }
-        console.log(`🔍 Validating user with email: ${normalizedEmail}, moduleId: ${moduleId}, whereClause:`, whereClause);
         const user = await this.userRepo.findOne({ where: whereClause });
         // Always run bcrypt.compare regardless of whether the user was found.
         // This prevents timing-based user enumeration: both paths take the same time.
@@ -108,13 +107,15 @@ let AuthService = class AuthService {
         // const DUMMY_HASH = '$2b$10$abcdefghijklmnopqrstuuABCDEFGHIJKLMNOPQRSTUVWXYZ012345';
         // const hashToCompare = user?.password ?? DUMMY_HASH;
         // const isValid = await bcrypt.compare(password, hashToCompare);
-        console.log(`🔐 Comparing password for user ${user?.id}`);
-        console.log(`🔐 Comparing password for user ${user?.password}`);
+        // console.log(`🔐 Comparing password for user ${user?.id}`);
+        // console.log(`🔐 Comparing password for user ${user?.password}`);
         const isValid = user
             ? await bcrypt.compare(password, user.password)
             : false;
         // Single generic message — never reveal whether the email exists
         if (!user || !isValid) {
+            console.log(`🔍 Validating user with email: ${normalizedEmail}, moduleId: ${moduleId}, whereClause:`, whereClause);
+            console.log(`🔐 Comparing password for user ${user?.id}`);
             throw new common_1.UnauthorizedException("Invalid credentials");
         }
         if (clientIp && this.ipRestrictionsRepo) {

package/dist/jwt/jwt-customer.strategy.d.ts

@@ -4,13 +4,15 @@ declare const JwtCustomerStrategy_base: new (...args: any[]) => Strategy;
 export declare class JwtCustomerStrategy extends JwtCustomerStrategy_base {
     private readonly authCustomerService;
     constructor(authCustomerService: AuthCustomerService);
-    validate(payload: any): Promise<{
+    validate(req: any, payload: any): Promise<{
         id: number;
         email: string;
         roleId: number;
         moduleId: any;
         is_ecrs_employee: boolean;
         referenceId: number;
+        customerIds: number[];
+        parentId: any;
     }>;
 }
 export {};

package/dist/jwt/jwt-customer.strategy.js

@@ -20,15 +20,55 @@ let JwtCustomerStrategy = class JwtCustomerStrategy extends (0, passport_1.Passp
             jwtFromRequest: passport_jwt_1.ExtractJwt.fromAuthHeaderAsBearerToken(),
             ignoreExpiration: false,
             secretOrKey: process.env.JWT_SECRET || "your-secret-key",
+            passReqToCallback: true,
         });
         this.authCustomerService = authCustomerService;
     }
-    async validate(payload) {
-        // 1. Find user in tbl_users_customer
+    async validate(req, payload) {
+        // 1. Subdomain check against tbl_super_customer_ets_setup_details
+        const host = req.get("host") || "";
+        const hostParts = host.split(".");
+        const subdomain = hostParts.length > 2 ? hostParts[0] : null;
+        if (subdomain) {
+            const customerId = await this.authCustomerService.getCustomerIdBySubdomain(subdomain);
+            if (!customerId) {
+                console.log(`❌ Domain not match: subdomain="${subdomain}" not found in setup details`);
+                throw new common_1.UnauthorizedException("INVALID_DOMAIN");
+            }
+            // Will be compared with user.parentId after user is loaded
+            payload._resolvedCustomerId = customerId;
+            console.log(`🔍 Subdomain "${subdomain}" → customer_id=${customerId}`);
+        }
+        // 2. Find user in tbl_users_customer
         const user = await this.authCustomerService.findUserById(payload.id);
         if (!user) {
             throw new common_1.UnauthorizedException("INVALID_USER");
         }
+        // 3a. Verify resolved customer_id matches user.parentId
+        if (payload._resolvedCustomerId !== undefined) {
+            if (user.roleId === 1) {
+                // Superadmin: skip domain restriction — _resolvedCustomerId is returned as parentId
+                console.log(`✅ Superadmin domain bypass: customer_id=${payload._resolvedCustomerId} accepted for superadmin user=${user.id}`);
+            }
+            else if (payload._resolvedCustomerId !== user.parentId &&
+                user.is_ecrs_employee !== true) {
+                console.log(`❌ Domain not match: customer_id=${payload._resolvedCustomerId} does not match user.parentId=${user.parentId}`);
+                throw new common_1.UnauthorizedException("INVALID_DOMAIN");
+            }
+            else if (user.is_ecrs_employee === true) {
+                const allowedIds = Array.isArray(user.customerIds)
+                    ? user.customerIds
+                    : [];
+                if (!allowedIds.includes(payload._resolvedCustomerId)) {
+                    console.log(`❌ Domain not match for ECRS employee: customer_id=${payload._resolvedCustomerId} not found in user.customerIds=${JSON.stringify(allowedIds)}`);
+                    throw new common_1.UnauthorizedException("INVALID_DOMAIN");
+                }
+                console.log(`✅ Domain match for ECRS employee: customer_id=${payload._resolvedCustomerId} found in user.customerIds=${JSON.stringify(allowedIds)}`);
+            }
+            else {
+                console.log(`✅ Domain match: customer_id=${payload._resolvedCustomerId} matches user.parentId=${user.parentId}`);
+            }
+        }
         // 2. Token version check — catches password change / logout-all
         if (user.token_version !== payload.tokenVersion) {
             console.warn(`⚠️ Token version mismatch for customer ${user.id}. ` +
@@ -68,6 +108,8 @@ let JwtCustomerStrategy = class JwtCustomerStrategy extends (0, passport_1.Passp
             moduleId: payload.moduleId ?? user.moduleId,
             is_ecrs_employee: user.is_ecrs_employee ?? false,
             referenceId: user.referenceId ?? null,
+            customerIds: user.customerIds ?? [],
+            parentId: payload._resolvedCustomerId ?? user.parentId,
         };
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ecrs-auth-core",
-  "version": "1.0.110",
+  "version": "1.0.113",
   "description": "Centralized authentication and authorization module for ECRS apps",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/dist/entities/user-customer-module-access.entity copy.d.ts

@@ -1,13 +0,0 @@
-export declare class UserCustomerModuleAccess {
-    id: number;
-    customer_user_id: number;
-    moduleId: number;
-    accessLevel: string;
-    status: number;
-    permissions: string[];
-    createdAt: Date;
-    updatedAt: Date;
-    createdBy: number;
-    updatedBy?: number;
-    isDeleted: number;
-}

package/dist/entities/user-customer-module-access.entity copy.js

@@ -1,76 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserCustomerModuleAccess = void 0;
-// src/entities/user-module-access.entity.ts
-const typeorm_1 = require("typeorm");
-let UserCustomerModuleAccess = class UserCustomerModuleAccess {
-};
-exports.UserCustomerModuleAccess = UserCustomerModuleAccess;
-__decorate([
-    (0, typeorm_1.PrimaryGeneratedColumn)(),
-    __metadata("design:type", Number)
-], UserCustomerModuleAccess.prototype, "id", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ name: "customer_user_id" }),
-    __metadata("design:type", Number)
-], UserCustomerModuleAccess.prototype, "customer_user_id", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ name: "module_id" }),
-    __metadata("design:type", Number)
-], UserCustomerModuleAccess.prototype, "moduleId", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ name: "access_level", default: "view" }),
-    __metadata("design:type", String)
-], UserCustomerModuleAccess.prototype, "accessLevel", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: "smallint", default: 1 }),
-    __metadata("design:type", Number)
-], UserCustomerModuleAccess.prototype, "status", void 0);
-__decorate([
-    (0, typeorm_1.Column)({
-        name: "permissions",
-        type: "json",
-        nullable: true,
-    }),
-    __metadata("design:type", Array)
-], UserCustomerModuleAccess.prototype, "permissions", void 0);
-__decorate([
-    (0, typeorm_1.Column)({
-        name: "created_at",
-        type: "timestamp",
-        default: () => "CURRENT_TIMESTAMP",
-    }),
-    __metadata("design:type", Date)
-], UserCustomerModuleAccess.prototype, "createdAt", void 0);
-__decorate([
-    (0, typeorm_1.Column)({
-        name: "updated_at",
-        type: "timestamp",
-        default: () => "CURRENT_TIMESTAMP",
-    }),
-    __metadata("design:type", Date)
-], UserCustomerModuleAccess.prototype, "updatedAt", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ name: "created_by" }),
-    __metadata("design:type", Number)
-], UserCustomerModuleAccess.prototype, "createdBy", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ name: "updated_by", nullable: true }),
-    __metadata("design:type", Number)
-], UserCustomerModuleAccess.prototype, "updatedBy", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ name: "is_deleted", type: "smallint", default: 0 }),
-    __metadata("design:type", Number)
-], UserCustomerModuleAccess.prototype, "isDeleted", void 0);
-exports.UserCustomerModuleAccess = UserCustomerModuleAccess = __decorate([
-    (0, typeorm_1.Entity)({ name: "tbl_c_users_customer_module_access_new" })
-], UserCustomerModuleAccess);