Refactor/identity strict layer enforcement

apps/api/package.json

@@ -95,14 +95,15 @@
     },
     "collectCoverageFrom": [
       "**/*.(t|j)s",
-      "!main.ts",
+      "!src/main.ts",
       "!**/*.module.ts",
       "!**/*.abstract.ts",
-      "!test/**",
-      "!db/seed.ts",
-      "!db/truncate.ts",
-      "!db/verify.ts",
-      "!scripts/**"
+      "!src/test/**",
+      "!src/db/seed.ts",
+      "!src/db/truncate.ts",
+      "!src/db/verify.ts",
+      "!src/scripts/**",
+      "!test/**"
     ],
     "coverageDirectory": "./coverage",
     "testEnvironment": "node",

apps/api/src/modules/identity/auth/auth.controller.spec.ts

@@ -1,8 +1,7 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { AuthController } from './auth.controller';
 import { AuthService } from './auth.service';
-import { USER_PROVIDER } from '@nexiom/identity';
-import { TenantsService } from '../tenants/tenants.service';
+import { USER_PROVIDER, TENANT_PROVIDER } from '@nexiom/identity';
 import { InvitationsService } from '../invitations/invitations.service';
 import { Request, Response } from 'express';
 
@@ -36,7 +35,7 @@ describe('AuthController', () => {
     forceVerifyEmail: jest.fn(),
   };
 
-  const mockTenantsService = {
+  const mockTenantProvider = {
     provisionTenantForUser: jest.fn(),
   };
 
@@ -58,8 +57,8 @@ describe('AuthController', () => {
           useValue: mockUserProvider,
         },
         {
-          provide: TenantsService,
-          useValue: mockTenantsService,
+          provide: TENANT_PROVIDER,
+          useValue: mockTenantProvider,
         },
         {
           provide: InvitationsService,
@@ -91,15 +90,15 @@ describe('AuthController', () => {
       };
 
       mockAuthService.getSessionFromHeaders.mockResolvedValue(mockSessionData);
-      mockTenantsService.provisionTenantForUser.mockResolvedValue({
+      mockTenantProvider.provisionTenantForUser.mockResolvedValue({
         id: 'org-123',
         name: 'New Org',
       });
 
       const result = await controller.provisionTenant(mockRequest);
 
       expect(result).toBeDefined();
-      expect(mockTenantsService.provisionTenantForUser).toHaveBeenCalledWith(
+      expect(mockTenantProvider.provisionTenantForUser).toHaveBeenCalledWith(
         'user-123',
       );
     });

apps/api/src/modules/identity/auth/auth.controller.ts

@@ -8,18 +8,24 @@ import {
   UnauthorizedException,
   Inject,
   Logger,
+  BadRequestException,
 } from '@nestjs/common';
 import { AuthService } from './auth.service';
-import { USER_PROVIDER, IUserProvider, Session, User } from '@nexiom/identity';
-import { TenantsService } from '../tenants/tenants.service';
+import {
+  USER_PROVIDER,
+  IUserProvider,
+  Session,
+  User,
+  TENANT_PROVIDER,
+  ITenantProvider,
+} from '@nexiom/identity';
 import { z } from 'zod';
 import { createZodDto } from 'nestjs-zod';
 import { Signup, CompleteInvite } from '../users/users.validation';
 import { Response, Request } from 'express';
 import { toNodeHandler } from 'better-auth/node';
 import { InvitationsService } from '../invitations/invitations.service';
 import { toWebHeaders } from '../../../shared/utils/headers.util';
-import { BadRequestException } from '@nestjs/common';
 
 /**
  * Handles authentication-related operations such as user login.
@@ -39,7 +45,7 @@ export class AuthController {
   constructor(
     private readonly authService: AuthService,
     @Inject(USER_PROVIDER) private readonly userProvider: IUserProvider,
-    private readonly tenantsService: TenantsService,
+    @Inject(TENANT_PROVIDER) private readonly tenantProvider: ITenantProvider,
     private readonly invitationsService: InvitationsService,
   ) {}
 
@@ -83,7 +89,7 @@ export class AuthController {
       throw new UnauthorizedException('No Session Found');
     }
 
-    return this.tenantsService.provisionTenantForUser(sessionData.user.id);
+    return this.tenantProvider.provisionTenantForUser(sessionData.user.id);
   }
 
   /**

apps/api/src/modules/identity/auth/auth.service.spec.ts

@@ -1,7 +1,6 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { AuthService } from './auth.service';
-import { AUTH_PROVIDER } from '@nexiom/identity';
-import { TenantsService } from '../tenants/tenants.service';
+import { AUTH_PROVIDER, TENANT_PROVIDER } from '@nexiom/identity';
 
 describe('AuthService', () => {
   let service: AuthService;
@@ -15,7 +14,7 @@ describe('AuthService', () => {
     getHandler: jest.fn(),
   };
 
-  const mockTenantsService = {
+  const mockTenantProvider = {
     findAllForUser: jest.fn(),
   };
 
@@ -28,8 +27,8 @@ describe('AuthService', () => {
           useValue: mockAuthProvider,
         },
         {
-          provide: TenantsService,
-          useValue: mockTenantsService,
+          provide: TENANT_PROVIDER,
+          useValue: mockTenantProvider,
         },
       ],
     }).compile();
@@ -89,12 +88,12 @@ describe('AuthService', () => {
       ];
 
       mockAuthProvider.validateSession.mockResolvedValue(mockSession);
-      mockTenantsService.findAllForUser.mockResolvedValue(mockTenants);
+      mockTenantProvider.findAllForUser.mockResolvedValue(mockTenants);
 
       const result = await service.getEnrichedSession(token);
 
       expect(mockAuthProvider.validateSession).toHaveBeenCalledWith(token);
-      expect(mockTenantsService.findAllForUser).toHaveBeenCalledWith('u1');
+      expect(mockTenantProvider.findAllForUser).toHaveBeenCalledWith('u1');
 
       // Should pick 'org-new' because it is newer
       expect(result?.user.organizationId).toBe('org-new');
@@ -105,7 +104,7 @@ describe('AuthService', () => {
     it('should return enriched session without organizationId if no tenant', async () => {
       const token = 'valid-token';
       const mockSession = { session: { id: 's1' }, user: { id: 'u1' } };
-      mockTenantsService.findAllForUser.mockResolvedValue([]);
+      mockTenantProvider.findAllForUser.mockResolvedValue([]);
 
       mockAuthProvider.validateSession.mockResolvedValue(mockSession);
 
@@ -153,7 +152,7 @@ describe('AuthService', () => {
         providers: [
           AuthService,
           { provide: AUTH_PROVIDER, useValue: providerWithoutSetPassword },
-          { provide: TenantsService, useValue: mockTenantsService },
+          { provide: TENANT_PROVIDER, useValue: mockTenantProvider },
         ],
       }).compile();
       const localService = module.get<AuthService>(AuthService);

apps/api/src/modules/identity/auth/auth.service.ts

@@ -7,14 +7,15 @@ import {
   Session,
   User,
   CreateUserInput,
+  TENANT_PROVIDER,
+  ITenantProvider,
 } from '@nexiom/identity';
-import { TenantsService } from '../tenants/tenants.service';
 
 @Injectable()
 export class AuthService {
   constructor(
     @Inject(AUTH_PROVIDER) private readonly authProvider: IAuthProvider,
-    private readonly tenantsService: TenantsService,
+    @Inject(TENANT_PROVIDER) private readonly tenantProvider: ITenantProvider,
   ) {}
 
   async login(credentials: LoginCredentials): Promise<AuthResult> {
@@ -40,7 +41,7 @@ export class AuthService {
     const { session, user } = validSession;
 
     // Enrichment: Check if user has a tenant
-    const tenants = await this.tenantsService.findAllForUser(user.id);
+    const tenants = await this.tenantProvider.findAllForUser(user.id);
     // Deterministic selection: Sort by creation date (newest first)
     // using slice() to avoid mutating the original array
     const sortedTenants = tenants