interface JwtPayloadDto {
  user_id: string;
  organization_id: string;
  organization: string;        // display_id (tenant)
  organization_type: string;   // FARMER, COLLECTOR, etc.
  roles: string[];
}

import { AuthUser, JwtPayloadDto } from '@app/auth-utilities';

@Get('profile')
async getProfile(@AuthUser() user: JwtPayloadDto) {
  // user.user_id, user.organization_id, user.roles
}

import { Roles } from '@app/auth-utilities';

@Post('admin')
@Roles('ADMIN', 'SUPER_ADMIN')
async adminAction() { }

import { OrganizationTypes } from '../common/guard/organization-type.guard';

@Post('collector-only')
@OrganizationTypes('COLLECTOR')
async collectorAction() { }

import { AuthGuard } from '@nestjs/passport';

@UseGuards(AuthGuard('jwt-token'))
@ApiBearerAuth()
async protectedEndpoint() { }

import { RolesGuard } from '@app/auth-utilities';

@UseGuards(AuthGuard('jwt-token'), RolesGuard)
@Roles('ADMIN')
async adminOnly() { }

import { TenantGuard } from '../common/guard/tenant.guard';

@UseGuards(TenantGuard)
async tenantSpecific() {
  // Validates tenant from subdomain matches token
}

import { OrganizationTypeGuard } from '../common/guard/organization-type.guard';

@UseGuards(OrganizationTypeGuard)
@OrganizationTypes('FARMER', 'COLLECTOR')
async multiTypeAccess() { }

import { Controller, Post, Body, UseGuards, Version, HttpCode } from '@nestjs/common';
import { ApiTags, ApiOperation, ApiResponse, ApiBearerAuth } from '@nestjs/swagger';
import { AuthGuard } from '@nestjs/passport';
import { AuthUser, JwtPayloadDto } from '@app/auth-utilities';
import { MyService } from './my.service';

@ApiTags('MyFeature')
@Controller('my-feature')
export class MyController {
  constructor(private readonly service: MyService) {}

  @Post('public')
  @Version('1')
  @ApiOperation({ summary: 'Public endpoint' })
  async publicEndpoint(@Body() dto: PublicDto) {
    return this.service.publicAction(dto);
  }

  @Post('protected')
  @Version('1')
  @UseGuards(AuthGuard('jwt-token'))
  @ApiBearerAuth()
  @ApiOperation({ summary: 'Protected endpoint' })
  async protectedEndpoint(
    @AuthUser() user: JwtPayloadDto,
    @Body() dto: ProtectedDto
  ) {
    return this.service.protectedAction(user, dto);
  }

  @Post('admin-only')
  @Version('1')
  @UseGuards(AuthGuard('jwt-token'), RolesGuard)
  @ApiBearerAuth()
  @Roles('ADMIN')
  @ApiOperation({ summary: 'Admin only endpoint' })
  async adminEndpoint(@AuthUser() user: JwtPayloadDto) {
    return this.service.adminAction(user);
  }
}

import { hashPassword, verifyPassword } from '@app/auth-utilities';

// Hash password
const hashed = hashPassword('plainPassword');

// Verify password
const isValid = verifyPassword('plainPassword', hashedPassword);

// Generated with user info and roles
const tokenResult = this.tokenService.generateAccessToken(
  userId,
  organizationId,
  organizationDisplayId,
  organizationType,
  userRoles
);
// Returns: { access_token, expires_at }

// Generate
const refreshToken = this.tokenService.generateRefreshToken();
// Returns: { token, expires_at }

// Store
await this.tokenService.storeRefreshToken(token, userId, organizationId);

// Validate
const payload = await this.tokenService.validateRefreshToken(token);

// Revoke
await this.tokenService.revokeRefreshToken(token);

@Injectable()
export class MyService {
  private readonly maxAttempts = 5;
  private readonly lockoutDuration = 15 * 60; // 15 minutes

  async checkRateLimit(identifier: string) {
    const key = `attempts:${identifier}`;
    const attempts = await this.cacheManager.get(key);

    if (attempts >= this.maxAttempts) {
      throw new UnauthorizedException('Too many attempts');
    }

    await this.cacheManager.set(key, attempts + 1, 3600 * 1000);
  }
}

// Get tenant from Fastify request
const tenant = req.raw['tenant'];

// Match against user's organization
if (tenant !== user.organization) {
  throw new ForbiddenException('Invalid tenant');
}