Merge pull request #1858 from rocket-admin/backend_company_id_in_jwt

Artuomka · web-flow · commit 5cb9ed040a85 · 2026-07-07T15:10:19.000+03:00
feat(auth): include companyId in JWT payload and update related interfaces and tests
diff --git a/backend/src/authorization/auth-with-api.middleware.ts b/backend/src/authorization/auth-with-api.middleware.ts
@@ -91,6 +91,7 @@ export class AuthWithApiMiddleware implements NestMiddleware {
 			const payload = {
 				sub: userId,
 				email: data.email,
+				companyId: data.companyId ?? null,
 				exp: data.exp,
 				iat: data.iat,
 			};
diff --git a/backend/src/authorization/auth.middleware.ts b/backend/src/authorization/auth.middleware.ts
@@ -79,6 +79,7 @@ export class AuthMiddleware implements NestMiddleware {
 			const payload = {
 				sub: userId,
 				email: data.email,
+				companyId: data.companyId ?? null,
 				exp: data.exp,
 				iat: data.iat,
 			};
diff --git a/backend/src/authorization/cognito-decoded.interface.ts b/backend/src/authorization/cognito-decoded.interface.ts
@@ -13,6 +13,8 @@ export interface ICognitoDecodedData {
 	exp: number;
 	iat: number;
 	email: string;
+	/** Id of the user's company; null for tokens issued before the claim was added. */
+	companyId: string | null;
 }
 
 /**
diff --git a/backend/src/authorization/non-scoped-auth.middleware.ts b/backend/src/authorization/non-scoped-auth.middleware.ts
@@ -58,6 +58,7 @@ export class NonScopedAuthMiddleware implements NestMiddleware {
 			const payload = {
 				sub: userId,
 				email: data.email,
+				companyId: data.companyId ?? null,
 				exp: data.exp,
 				iat: data.iat,
 			};
diff --git a/backend/src/authorization/public-or-auth.middleware.ts b/backend/src/authorization/public-or-auth.middleware.ts
@@ -96,6 +96,7 @@ export class PublicOrAuthMiddleware implements NestMiddleware {
 		const payload = {
 			sub: userId,
 			email: data.email,
+			companyId: data.companyId ?? null,
 			exp: data.exp,
 			iat: data.iat,
 		};
diff --git a/backend/src/entities/company-info/use-cases/verify-invite-user-in-company.use.case.ts b/backend/src/entities/company-info/use-cases/verify-invite-user-in-company.use.case.ts
@@ -65,7 +65,7 @@ export class VerifyInviteUserInCompanyAndConnectionGroupUseCase
 			foundUser.isActive = true;
 			foundUser.role = role;
 			await this._dbContext.userRepository.saveUserEntity(foundUser);
-			return generateGwtToken(foundUser, get2FaScope(foundUser, foundInvitation.company));
+			return generateGwtToken(foundUser, get2FaScope(foundUser, foundInvitation.company), foundInvitation.company?.id);
 		}
 		const newUser = await this._dbContext.userRepository.saveRegisteringUser({
 			email: invitedUserEmail,
@@ -97,6 +97,6 @@ export class VerifyInviteUserInCompanyAndConnectionGroupUseCase
 		}
 		await this._dbContext.invitationInCompanyRepository.remove(foundInvitation);
 		await this.saasCompanyGatewayService.recountUsersInCompanyRequest(companyId);
-		return generateGwtToken(newUser, get2FaScope(newUser, foundInvitation.company));
+		return generateGwtToken(newUser, get2FaScope(newUser, foundInvitation.company), foundInvitation.company?.id);
 	}
 }
diff --git a/backend/src/entities/user/use-cases/change-usual-password-use.case.ts b/backend/src/entities/user/use-cases/change-usual-password-use.case.ts
@@ -36,6 +36,6 @@ export class ChangeUsualPasswordUseCase
 		user.password = await Encryptor.hashUserPassword(userData.newPassword);
 		const updatedUser = await this._dbContext.userRepository.saveUserEntity(user);
 		const foundUserCompany = await this._dbContext.companyInfoRepository.findCompanyInfoByUserId(updatedUser.id);
-		return generateGwtToken(updatedUser, get2FaScope(updatedUser, foundUserCompany));
+		return generateGwtToken(updatedUser, get2FaScope(updatedUser, foundUserCompany), foundUserCompany?.id);
 	}
 }
diff --git a/backend/src/entities/user/use-cases/otp-login-use.case.ts b/backend/src/entities/user/use-cases/otp-login-use.case.ts
@@ -52,7 +52,7 @@ export class OtpLoginUseCase extends AbstractUseCase<VerifyOtpDS, IToken> implem
 		await this.recordSignInAudit(foundUser.email, userId, SignInStatusEnum.SUCCESS, ipAddress, userAgent);
 
 		const foundUserCompany = await this._dbContext.companyInfoRepository.findCompanyInfoByUserId(foundUser.id);
-		return generateGwtToken(foundUser, get2FaScope(foundUser, foundUserCompany));
+		return generateGwtToken(foundUser, get2FaScope(foundUser, foundUserCompany), foundUserCompany?.id);
 	}
 
 	private async recordSignInAudit(
diff --git a/backend/src/entities/user/use-cases/usual-login-use.case.ts b/backend/src/entities/user/use-cases/usual-login-use.case.ts
@@ -122,7 +122,7 @@ export class UsualLoginUseCase extends AbstractUseCase<UsualLoginDs, IToken> imp
 		await this.recordSignInAudit(email, user.id, SignInStatusEnum.SUCCESS, ipAddress, userAgent);
 
 		const foundUserCompany = await this._dbContext.companyInfoRepository.findCompanyInfoByUserId(user.id);
-		return generateGwtToken(user, get2FaScope(user, foundUserCompany));
+		return generateGwtToken(user, get2FaScope(user, foundUserCompany), foundUserCompany?.id);
 	}
 
 	private async recordSignInAudit(
diff --git a/backend/src/entities/user/use-cases/verify-reset-user-password.use.case.ts b/backend/src/entities/user/use-cases/verify-reset-user-password.use.case.ts
@@ -53,7 +53,7 @@ export class VerifyResetUserPasswordUseCase
 		return {
 			id: foundUser.id,
 			email: foundUser.email,
-			token: generateGwtToken(foundUser, get2FaScope(foundUser, foundUserCompany)),
+			token: generateGwtToken(foundUser, get2FaScope(foundUser, foundUserCompany), foundUserCompany?.id),
 			name: foundUser.name,
 			externalRegistrationProvider: foundUser.externalRegistrationProvider,
 		};
diff --git a/backend/src/entities/user/utils/generate-gwt-token.ts b/backend/src/entities/user/utils/generate-gwt-token.ts
@@ -4,7 +4,7 @@ import { appConfig } from '../../../shared/config/app-config.js';
 import { JwtScopesEnum } from '../enums/jwt-scopes.enum.js';
 import { UserEntity } from '../user.entity.js';
 
-export function generateGwtToken(user: UserEntity, scope: Array<JwtScopesEnum>): IToken {
+export function generateGwtToken(user: UserEntity, scope: Array<JwtScopesEnum>, companyId?: string | null): IToken {
 	const today = new Date();
 	const exp = new Date(today);
 	exp.setTime(today.getTime() + 60 * 60 * 1000 * 24 * 7);
@@ -16,6 +16,7 @@ export function generateGwtToken(user: UserEntity, scope: Array<JwtScopesEnum>):
 		{
 			id: user.id,
 			email: user.email,
+			companyId: companyId ?? user.company?.id ?? undefined,
 			exp: Math.floor(exp.getTime() / 1000),
 			scope: scope && scope.length ? scope : undefined,
 		},
diff --git a/backend/src/microservices/agents-microservice/data-structures/agents-responses.ds.ts b/backend/src/microservices/agents-microservice/data-structures/agents-responses.ds.ts
@@ -7,6 +7,9 @@ export class ValidatedUserTokenRO {
 	@ApiPropertyOptional()
 	email: string | null;
 
+	@ApiPropertyOptional({ description: "Id of the user's company; null for tokens issued before the claim was added." })
+	companyId: string | null;
+
 	@ApiPropertyOptional()
 	exp: number | null;
 
diff --git a/backend/src/microservices/agents-microservice/use-cases/validate-user-token.use.case.ts b/backend/src/microservices/agents-microservice/use-cases/validate-user-token.use.case.ts
@@ -64,6 +64,7 @@ export class ValidateUserTokenUseCase
 			return {
 				sub: userId,
 				email: data.email ?? null,
+				companyId: data.companyId ?? null,
 				exp: data.exp ?? null,
 				iat: data.iat ?? null,
 			};
diff --git a/backend/test/ava-tests/non-saas-tests/non-saas-agents-microservice-validate-user-token-e2e.test.ts b/backend/test/ava-tests/non-saas-tests/non-saas-agents-microservice-validate-user-token-e2e.test.ts
@@ -0,0 +1,133 @@
+/* eslint-disable @typescript-eslint/no-unused-vars */
+import { faker } from '@faker-js/faker';
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import test from 'ava';
+import { ValidationError } from 'class-validator';
+import cookieParser from 'cookie-parser';
+import jwt from 'jsonwebtoken';
+import request from 'supertest';
+import { ApplicationModule } from '../../../src/app.module.js';
+import { WinstonLogger } from '../../../src/entities/logging/winston-logger.js';
+import { AllExceptionsFilter } from '../../../src/exceptions/all-exceptions.filter.js';
+import { ValidationException } from '../../../src/exceptions/custom-exceptions/validation-exception.js';
+import { Cacher } from '../../../src/helpers/cache/cacher.js';
+import { appConfig } from '../../../src/shared/config/app-config.js';
+import { DatabaseModule } from '../../../src/shared/database/database.module.js';
+import { DatabaseService } from '../../../src/shared/database/database.service.js';
+import {
+	createInitialTestUser,
+	registerUserAndReturnUserInfo,
+} from '../../utils/register-user-and-return-user-info.js';
+import { setSaasEnvVariable } from '../../utils/set-saas-env-variable.js';
+import { TestUtils } from '../../utils/test.utils.js';
+
+let app: INestApplication;
+let _testUtils: TestUtils;
+let currentTest;
+
+// Microservice JWT (request_id claim) for the internal agents controller.
+function microserviceAuthHeader(): string {
+	const secret = appConfig.auth.microserviceJwtSecret as string;
+	return `Bearer ${jwt.sign({ request_id: faker.string.uuid() }, secret, { expiresIn: '1h' })}`;
+}
+
+test.before(async () => {
+	setSaasEnvVariable();
+	const moduleFixture = await Test.createTestingModule({
+		imports: [ApplicationModule, DatabaseModule],
+		providers: [DatabaseService, TestUtils],
+	}).compile();
+	app = moduleFixture.createNestApplication();
+	_testUtils = moduleFixture.get<TestUtils>(TestUtils);
+
+	app.use(cookieParser());
+	app.useGlobalFilters(new AllExceptionsFilter(app.get(WinstonLogger)));
+	app.useGlobalPipes(
+		new ValidationPipe({
+			exceptionFactory(validationErrors: ValidationError[] = []) {
+				return new ValidationException(validationErrors);
+			},
+		}),
+	);
+	await app.init();
+	await createInitialTestUser(app);
+	app.getHttpServer().listen(0);
+});
+
+test.after(async () => {
+	try {
+		await Cacher.clearAllCache();
+		await app.close();
+	} catch (e) {
+		console.error('After tests error ' + e);
+	}
+});
+
+async function loginAndReturnCookieToken(): Promise<{ cookieToken: string; userId: string }> {
+	const { email, password } = await registerUserAndReturnUserInfo(app);
+	const loginUserResult = await request(app.getHttpServer())
+		.post('/user/login/')
+		.send({ email, password })
+		.set('Content-Type', 'application/json')
+		.set('Accept', 'application/json');
+	const cookieToken = loginUserResult.headers['set-cookie'][0].split(';')[0].replace('rocketadmin_cookie=', '');
+	const decoded = jwt.decode(cookieToken) as jwt.JwtPayload;
+	return { cookieToken, userId: decoded.id };
+}
+
+function validateUserTokenRequest(token: string, withAuth = true): request.Test {
+	const req = request(app.getHttpServer())
+		.post('/internal/agents/auth/validate-user-token')
+		.send({ token })
+		.set('Content-Type', 'application/json')
+		.set('Accept', 'application/json');
+	return withAuth ? req.set('Authorization', microserviceAuthHeader()) : req;
+}
+
+currentTest = 'POST /internal/agents/auth/validate-user-token (internal, microservice JWT)';
+
+test.serial(`${currentTest} returns the token claims including the companyId of the user's company`, async (t) => {
+	const { cookieToken, userId } = await loginAndReturnCookieToken();
+
+	const foundCompanyInfo = await request(app.getHttpServer())
+		.get('/company/my')
+		.set('Cookie', `rocketadmin_cookie=${cookieToken}`)
+		.set('Content-Type', 'application/json')
+		.set('Accept', 'application/json');
+	t.is(foundCompanyInfo.status, 200);
+	const foundCompanyInfoRO = JSON.parse(foundCompanyInfo.text);
+
+	const response = await validateUserTokenRequest(cookieToken);
+	t.is(response.status, 201);
+	const ro = JSON.parse(response.text);
+	t.is(ro.sub, userId);
+	t.truthy(ro.companyId);
+	t.is(ro.companyId, foundCompanyInfoRO.id);
+});
+
+test.serial(`${currentTest} returns companyId null for a legacy token issued without the claim`, async (t) => {
+	const { userId } = await loginAndReturnCookieToken();
+
+	const legacyToken = jwt.sign(
+		{
+			id: userId,
+			email: 'legacy@example.com',
+			exp: Math.floor(Date.now() / 1000) + 3600,
+		},
+		appConfig.auth.jwtSecret as string,
+	);
+
+	const response = await validateUserTokenRequest(legacyToken);
+	t.is(response.status, 201);
+	const ro = JSON.parse(response.text);
+	t.is(ro.sub, userId);
+	t.is(ro.companyId, null);
+});
+
+test.serial(`${currentTest} rejects calls without the microservice JWT (401)`, async (t) => {
+	const { cookieToken } = await loginAndReturnCookieToken();
+
+	const response = await validateUserTokenRequest(cookieToken, false);
+	t.is(response.status, 401);
+});
diff --git a/backend/test/ava-tests/non-saas-tests/non-saas-user-e2e.test.ts b/backend/test/ava-tests/non-saas-tests/non-saas-user-e2e.test.ts
@@ -5,6 +5,7 @@ import { Test } from '@nestjs/testing';
 import test from 'ava';
 import { ValidationError } from 'class-validator';
 import cookieParser from 'cookie-parser';
+import jwt from 'jsonwebtoken';
 import request from 'supertest';
 import { ApplicationModule } from '../../../src/app.module.js';
 import { WinstonLogger } from '../../../src/entities/logging/winston-logger.js';
@@ -117,6 +118,32 @@ test.serial(`${currentTest} should return expiration token when user login`, asy
 	t.pass();
 });
 
+test.serial(`${currentTest} login token should contain the id of the user's company`, async (t) => {
+	const adminUserRegisterInfo = await registerUserAndReturnUserInfo(app);
+	const { email, password } = adminUserRegisterInfo;
+
+	const loginUserResult = await request(app.getHttpServer())
+		.post('/user/login/')
+		.send({ email, password })
+		.set('Content-Type', 'application/json')
+		.set('Accept', 'application/json');
+	t.is(loginUserResult.status, 201);
+
+	const cookieToken = loginUserResult.headers['set-cookie'][0].split(';')[0].replace('rocketadmin_cookie=', '');
+	const decodedToken = jwt.verify(cookieToken, process.env.JWT_SECRET) as jwt.JwtPayload;
+
+	const foundCompanyInfo = await request(app.getHttpServer())
+		.get('/company/my')
+		.set('Cookie', `rocketadmin_cookie=${cookieToken}`)
+		.set('Content-Type', 'application/json')
+		.set('Accept', 'application/json');
+	t.is(foundCompanyInfo.status, 200);
+	const foundCompanyInfoRO = JSON.parse(foundCompanyInfo.text);
+
+	t.truthy(decodedToken.companyId);
+	t.is(decodedToken.companyId, foundCompanyInfoRO.id);
+});
+
 test.serial(`${currentTest} reject authorization when try to login with wrong password`, async (t) => {
 	const adminUserRegisterInfo = await registerUserAndReturnUserInfo(app);
 	const { email, password } = adminUserRegisterInfo;
diff --git a/backend/test/utils/test.utils.ts b/backend/test/utils/test.utils.ts
@@ -48,6 +48,7 @@ export class TestUtils {
 	verifyJwtToken(token: string): {
 		sub: string;
 		email: string;
+		companyId: string | null;
 		exp: number;
 		iat: number;
 	} {
@@ -57,6 +58,7 @@ export class TestUtils {
 		return {
 			sub: data.id,
 			email: data.email,
+			companyId: data.companyId ?? null,
 			exp: data.exp,
 			iat: data.iat,
 		};

Original file line number	Diff line number	Diff line change
`@@ -13,6 +13,8 @@ export interface ICognitoDecodedData {`
`13`	`13`	`exp: number;`
`14`	`14`	`iat: number;`
`15`	`15`	`email: string;`
	`16`	`+ /** Id of the user's company; null for tokens issued before the claim was added. */`
	`17`	`+ companyId: string \| null;`
`16`	`18`	`}`
`17`	`19`
`18`	`20`	`/**`
Original file line number	Diff line number	Diff line change
`@@ -65,7 +65,7 @@ export class VerifyInviteUserInCompanyAndConnectionGroupUseCase`
`65`	`65`	`foundUser.isActive = true;`
`66`	`66`	`foundUser.role = role;`
`67`	`67`	`await this._dbContext.userRepository.saveUserEntity(foundUser);`
`68`		`- return generateGwtToken(foundUser, get2FaScope(foundUser, foundInvitation.company));`
	`68`	`+ return generateGwtToken(foundUser, get2FaScope(foundUser, foundInvitation.company), foundInvitation.company?.id);`
`69`	`69`	`}`
`70`	`70`	`const newUser = await this._dbContext.userRepository.saveRegisteringUser({`
`71`	`71`	`email: invitedUserEmail,`
`@@ -97,6 +97,6 @@ export class VerifyInviteUserInCompanyAndConnectionGroupUseCase`
`97`	`97`	`}`
`98`	`98`	`await this._dbContext.invitationInCompanyRepository.remove(foundInvitation);`
`99`	`99`	`await this.saasCompanyGatewayService.recountUsersInCompanyRequest(companyId);`
`100`		`- return generateGwtToken(newUser, get2FaScope(newUser, foundInvitation.company));`
	`100`	`+ return generateGwtToken(newUser, get2FaScope(newUser, foundInvitation.company), foundInvitation.company?.id);`
`101`	`101`	`}`
`102`	`102`	`}`
Original file line number	Diff line number	Diff line change
`@@ -36,6 +36,6 @@ export class ChangeUsualPasswordUseCase`
`36`	`36`	`user.password = await Encryptor.hashUserPassword(userData.newPassword);`
`37`	`37`	`const updatedUser = await this._dbContext.userRepository.saveUserEntity(user);`
`38`	`38`	`const foundUserCompany = await this._dbContext.companyInfoRepository.findCompanyInfoByUserId(updatedUser.id);`
`39`		`- return generateGwtToken(updatedUser, get2FaScope(updatedUser, foundUserCompany));`
	`39`	`+ return generateGwtToken(updatedUser, get2FaScope(updatedUser, foundUserCompany), foundUserCompany?.id);`
`40`	`40`	`}`
`41`	`41`	`}`
Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ export class OtpLoginUseCase extends AbstractUseCase<VerifyOtpDS, IToken> implem`
`52`	`52`	`await this.recordSignInAudit(foundUser.email, userId, SignInStatusEnum.SUCCESS, ipAddress, userAgent);`
`53`	`53`
`54`	`54`	`const foundUserCompany = await this._dbContext.companyInfoRepository.findCompanyInfoByUserId(foundUser.id);`
`55`		`- return generateGwtToken(foundUser, get2FaScope(foundUser, foundUserCompany));`
	`55`	`+ return generateGwtToken(foundUser, get2FaScope(foundUser, foundUserCompany), foundUserCompany?.id);`
`56`	`56`	`}`
`57`	`57`
`58`	`58`	`private async recordSignInAudit(`
Original file line number	Diff line number	Diff line change
`@@ -122,7 +122,7 @@ export class UsualLoginUseCase extends AbstractUseCase<UsualLoginDs, IToken> imp`
`122`	`122`	`await this.recordSignInAudit(email, user.id, SignInStatusEnum.SUCCESS, ipAddress, userAgent);`
`123`	`123`
`124`	`124`	`const foundUserCompany = await this._dbContext.companyInfoRepository.findCompanyInfoByUserId(user.id);`
`125`		`- return generateGwtToken(user, get2FaScope(user, foundUserCompany));`
	`125`	`+ return generateGwtToken(user, get2FaScope(user, foundUserCompany), foundUserCompany?.id);`
`126`	`126`	`}`
`127`	`127`
`128`	`128`	`private async recordSignInAudit(`