✨ feat(admin): introduce super admin models and authentication

- 【db】add `SuperAdmin`, `SuperAdminSession`, `SuperAdminCredential` models
- 【core】create dedicated core services for new super admin entities
- 【auth】implement a separate authentication module for super admins
- 【auth】add jwt strategy, guard, and auth endpoints for super admin
- 【shared】introduce `GetSuperAdmin` decorator and session types

♻️ refactor(auth): restructure modules and user authentication
- 【app】replace generic `AuthModule` with `UserModule` and `SuperAdminModule`
- 【auth】relocate user auth logic into a dedicated `modules/user/auth`
- 【db】move password from `User` model to `UserCredential` for separation
- 【repo】enhance base repository with `upsert` and auto soft-delete filter

✨ feat(query): implement advanced multi-criteria search
- 【query】add `multi_search` capability to base query service
- 【query】support `contains` and `equals` search types
- 【query】implement dynamic relationship detection for accurate filtering

🔧 chore(project): update dependencies and improve tooling
- 【build】update `p-limit` dependency and adapt for esm compatibility
- 【chore】add vscode settings for typescript sdk path
- 【docs】enhance swagger with dynamic branch titles and custom styling

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "typescript.tsdk": "node_modules\\typescript\\lib"
+}

package-lock.json

@@ -28,6 +28,7 @@
         "geoip-lite": "^1.4.10",
         "helmet": "^8.1.0",
         "luxon": "^3.7.2",
+        "p-limit": "^7.2.0",
         "passport": "^0.7.0",
         "passport-jwt": "^4.0.1",
         "passport-local": "^1.0.0",
@@ -7386,6 +7387,35 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/jest-changed-files/node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/jest-circus": {
       "version": "30.2.0",
       "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.2.0.tgz",
@@ -7418,6 +7448,35 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/jest-circus/node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-circus/node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/jest-cli": {
       "version": "30.2.0",
       "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.2.0.tgz",
@@ -7826,6 +7885,22 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/jest-runner/node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/jest-runner/node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -7847,6 +7922,19 @@
         "source-map": "^0.6.0"
       }
     },
+    "node_modules/jest-runner/node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/jest-runtime": {
       "version": "30.2.0",
       "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.2.0.tgz",
@@ -9137,16 +9225,15 @@
       }
     },
     "node_modules/p-limit": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
-      "dev": true,
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-7.2.0.tgz",
+      "integrity": "sha512-ATHLtwoTNDloHRFFxFJdHnG6n2WUeFjaR8XQMFdKIv0xkXjrER8/iG9iu265jOM95zXHAfv9oTkqhrfbIzosrQ==",
       "license": "MIT",
       "dependencies": {
-        "yocto-queue": "^0.1.0"
+        "yocto-queue": "^1.2.1"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=20"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -9168,6 +9255,35 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/p-locate/node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate/node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/p-try": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
@@ -11979,13 +12095,12 @@
       }
     },
     "node_modules/yocto-queue": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
-      "dev": true,
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.2.2.tgz",
+      "integrity": "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ==",
       "license": "MIT",
       "engines": {
-        "node": ">=10"
+        "node": ">=12.20"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"

package.json

@@ -49,6 +49,7 @@
     "geoip-lite": "^1.4.10",
     "helmet": "^8.1.0",
     "luxon": "^3.7.2",
+    "p-limit": "^7.2.0",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",

prisma/schema.prisma

@@ -18,7 +18,6 @@ model User {
   email         String?     @unique
   phone         String?
   code          String? // country code
-  password      String?
   firstName     String?
   lastName      String?
   status        USER_STATUS @default(INVITED)
@@ -70,3 +69,65 @@ model UserCredential {
 
   @@map("user_credentials")
 }
+
+enum SUPER_ADMIN_SESSION_STATUS {
+  CURRENT
+  EXPIRED
+  REVOKED
+}
+
+model SuperAdmin {
+  id           String   @id @default(cuid())
+  email        String   @unique
+  name         String
+  profileImage String?
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+  isDeleted    Boolean  @default(false)
+
+  // Relations
+  sessions    SuperAdminSession[]
+  credentials SuperAdminCredential[]
+
+  @@map("super_admins")
+}
+
+model SuperAdminSession {
+  id           String                     @id @default(cuid())
+  superAdminId String
+  accessToken  String                     @db.Text
+  refreshToken String                     @db.Text
+  ipAddress    String?
+  userAgent    String?                    @db.Text
+  geoIpCountry String?
+  city         String?
+  state        String?
+  latitude     Float?
+  longitude    Float?
+  isFromAdmin  Boolean                    @default(false)
+  status       SUPER_ADMIN_SESSION_STATUS @default(CURRENT)
+  loginAt      DateTime?
+  expiredAt    DateTime?
+  createdAt    DateTime                   @default(now())
+  updatedAt    DateTime                   @updatedAt
+  isDeleted    Boolean                    @default(false)
+
+  // Relations
+  superAdmin SuperAdmin @relation(fields: [superAdminId], references: [id])
+
+  @@map("super_admin_sessions")
+}
+
+model SuperAdminCredential {
+  id           String   @id @default(cuid())
+  superAdminId String
+  password     String
+  createdAt    DateTime @default(now())
+  updatedAt    DateTime @updatedAt
+  isDeleted    Boolean  @default(false)
+
+  // Relations
+  superAdmin SuperAdmin @relation(fields: [superAdminId], references: [id])
+
+  @@map("super_admin_credentials")
+}

src/app.module.ts

@@ -2,12 +2,11 @@ import { Module } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
 import { APP_GUARD } from '@nestjs/core';
 import { ThrottlerModule, ThrottlerGuard } from '@nestjs/throttler';
-import { AuthModule } from './modules/auth/auth.module';
+import { UserModule } from './modules/user/user.module';
+import { SuperAdminModule } from './modules/super-admin/super-admin.module';
 import { PrismaService } from './shared/modules/prisma/prisma.service';
 import { CommonModule } from './shared/modules/common/common.module';
 import { BaseQueryCoreModule } from './core/base-query-core/base-query-core.module';
-import { UserCoreModule } from './core/user-core/user-core.module';
-import { JwtAuthGuard } from './modules/auth/guards/jwt-auth.guard';
 
 @Module({
   imports: [
@@ -18,20 +17,16 @@ import { JwtAuthGuard } from './modules/auth/guards/jwt-auth.guard';
     }),
     ThrottlerModule.forRoot([
       {
-        limit: 10,
+        limit: 1000,
         ttl: 60000, // 60 seconds in milliseconds
       },
     ]),
     CommonModule,
     BaseQueryCoreModule,
-    UserCoreModule,
-    AuthModule,
+    UserModule,
+    SuperAdminModule,
   ],
   providers: [
-    {
-      provide: APP_GUARD,
-      useClass: JwtAuthGuard,
-    },
     {
       provide: APP_GUARD,
       useClass: ThrottlerGuard,

src/core/base-query-core/base-query-core.service.ts

@@ -1,9 +1,13 @@
 import { Injectable } from '@nestjs/common';
 import { BaseQueryCoreDto } from './dto/base-query-core.dto';
 import * as _ from 'lodash';
+import { Prisma } from '@prisma/client';
 
 @Injectable()
 export class BaseQueryCoreService {
+  // Cache for storing relationship metadata to avoid repeated lookups
+  private relationshipCache: Map<string, 'one-to-many' | 'one-to-one'> =
+    new Map();
   generatePrismaQuery(query: BaseQueryCoreDto = {}) {
     const tempQuery: any = { ...query };
     if (typeof tempQuery?.orderBy === 'string') {
@@ -15,6 +19,10 @@ export class BaseQueryCoreService {
     if (typeof tempQuery?.search_column === 'string') {
       tempQuery.search_column = [tempQuery?.search_column];
     }
+    // Add this: Convert multi_search to array if it's a string
+    if (typeof tempQuery?.multi_search === 'string') {
+      tempQuery.multi_search = [tempQuery?.multi_search];
+    }
 
     if (tempQuery?.orderBy?.length > 0) {
       const orderBy = {};
@@ -47,19 +55,32 @@ export class BaseQueryCoreService {
     }
 
     if (tempQuery?.search_column?.length > 0 && tempQuery?.search?.length > 0) {
+      const searchType = tempQuery?.search_type || 'contains';
+      const searchCondition = this.createSearchCondition(
+        tempQuery.search,
+        searchType,
+      );
+
       const formattedSearchQry = this.formatSearchQueryArray(
         tempQuery.search_column.sort(),
-        {
-          contains: tempQuery?.search,
-          // mode: 'insensitive'
-        },
+        searchCondition,
       );
 
       tempQuery['where'] = formattedSearchQry;
     }
 
+    // Handle multi-criteria search
+    if (tempQuery?.multi_search?.length > 0) {
+      const multiSearchConditions = this.formatMultiSearchQueryArray(
+        tempQuery.multi_search,
+      );
+      tempQuery['where'] = { AND: multiSearchConditions };
+    }
+
     delete tempQuery?.search_column;
     delete tempQuery?.search;
+    delete tempQuery?.search_type;
+    delete tempQuery?.multi_search;
 
     return tempQuery;
   }
@@ -80,13 +101,73 @@ export class BaseQueryCoreService {
   }
 
   formatSearchQueryArray(queryArr: any, baseVal: any) {
-    const returnObj = {};
+    const searchConditions: any[] = [];
 
-    queryArr.map((qry, i) => {
-      returnObj[i] = this.formatArray(qry, baseVal);
+    queryArr.forEach((qry: any) => {
+      searchConditions.push(this.formatArray(qry, baseVal));
     });
 
-    return { OR: returnObj };
+    return { OR: searchConditions };
+  }
+
+  formatMultiSearchQueryArray(multiSearchArr: string[]) {
+    // Group conditions by column
+    const columnGroups: { [key: string]: any[] } = {};
+
+    multiSearchArr.forEach((searchString: string) => {
+      const [searchTerm, column, searchType] = searchString.split('|');
+
+      if (searchTerm && column) {
+        const condition = this.createSearchCondition(
+          searchTerm.trim(),
+          (searchType || 'contains').trim() as 'contains' | 'equals',
+        );
+
+        const formattedCondition = this.formatMultiSearchArray(
+          column,
+          condition,
+        );
+
+        // Group by column name
+        if (!columnGroups[column]) {
+          columnGroups[column] = [];
+        }
+        columnGroups[column].push(formattedCondition);
+      }
+    });
+
+    // Convert grouped conditions to final query structure
+    const finalConditions: any[] = [];
+
+    Object.keys(columnGroups).forEach((column) => {
+      const conditions = columnGroups[column];
+
+      if (conditions.length === 1) {
+        // Single condition for this column
+        finalConditions.push(conditions[0]);
+      } else {
+        // Multiple conditions for same column - use OR
+        finalConditions.push({ OR: conditions });
+      }
+    });
+
+    return finalConditions;
+  }
+
+  createSearchCondition(
+    searchValue: string,
+    searchType: 'contains' | 'equals',
+  ) {
+    const condition: any = {};
+
+    if (searchType === 'contains') {
+      condition.contains = searchValue;
+      condition.mode = 'insensitive';
+    } else if (searchType === 'equals') {
+      condition.equals = searchValue;
+    }
+
+    return condition;
   }
 
   formatArray(qry: any, baseVal: any) {
@@ -113,6 +194,102 @@ export class BaseQueryCoreService {
     return returnObj;
   }
 
+  /**
+   * Format array specifically for multi-search functionality
+   * This method handles nested relations and applies dynamic relationship detection
+   */
+  formatMultiSearchArray(qry: any, baseVal: any) {
+    const returnObj = {};
+
+    const qArr = qry.split('.');
+
+    if (qArr.length > 1) {
+      const ky = qArr[0];
+      qArr.shift();
+
+      // Recursively build nested condition
+      const nestedCondition = this.formatMultiSearchArray(
+        qArr.join('.'),
+        baseVal,
+      );
+
+      if (typeof returnObj[ky] === 'undefined') {
+        // Apply dynamic relation wrapping for where conditions
+        returnObj[ky] = this.wrapRelationCondition(ky, nestedCondition);
+      } else {
+        returnObj[ky] = {
+          ...returnObj[ky],
+          ...this.wrapRelationCondition(ky, nestedCondition),
+        };
+      }
+    } else {
+      returnObj[qArr[0]] = baseVal;
+    }
+
+    return returnObj;
+  }
+
+  /**
+   * Wrap relation conditions with proper Prisma syntax
+   * For one-to-many relations, use 'some'
+   * For one-to-one relations, use 'is'
+   * Dynamically detects relationship type from Prisma DMMF
+   */
+  private wrapRelationCondition(relationName: string, condition: any) {
+    const relationType = this.detectRelationType(relationName);
+
+    if (relationType === 'one-to-many') {
+      return { some: condition };
+    } else {
+      return { is: condition };
+    }
+  }
+
+  /**
+   * Dynamically detect if a relation is one-to-many or one-to-one
+   * Uses Prisma's DMMF (Data Model Meta Format) to introspect the schema
+   */
+  private detectRelationType(
+    relationName: string,
+  ): 'one-to-many' | 'one-to-one' {
+    // Check cache first
+    if (this.relationshipCache.has(relationName)) {
+      return this.relationshipCache.get(relationName)!;
+    }
+
+    try {
+      // Access Prisma's DMMF (Data Model Meta Format) for schema introspection
+      const dmmf = Prisma.dmmf;
+
+      // Search through all models to find the relation
+      for (const model of dmmf.datamodel.models) {
+        const field = model.fields.find((f) => f.name === relationName);
+
+        if (field && field.kind === 'object') {
+          // Check if it's a list (array) which indicates one-to-many
+          const relationType = field.isList ? 'one-to-many' : 'one-to-one';
+
+          // Cache the result
+          this.relationshipCache.set(relationName, relationType);
+
+          return relationType;
+        }
+      }
+
+      // Default to one-to-one if not found (safer default for filtering)
+      // This prevents incorrect 'some' usage on non-existent relations
+      this.relationshipCache.set(relationName, 'one-to-one');
+      return 'one-to-one';
+    } catch {
+      // Fallback: If DMMF is not accessible, use one-to-one as safe default
+      console.warn(
+        `Could not detect relation type for "${relationName}". Defaulting to one-to-one.`,
+      );
+      this.relationshipCache.set(relationName, 'one-to-one');
+      return 'one-to-one';
+    }
+  }
+
   getOrderByArray(fieldArr: any, sort) {
     fieldArr.shift();
 

src/core/base-query-core/dto/base-query-core.dto.ts

@@ -43,6 +43,25 @@ export class BaseQueryCoreDto {
   @IsString()
   @IsOptional()
   search?: string;
+
+  @ApiProperty({
+    required: false,
+    enum: ['contains', 'equals'],
+    default: 'contains',
+  })
+  @IsOptional()
+  @IsString()
+  search_type?: 'contains' | 'equals';
+
+  @ApiProperty({
+    required: false,
+    description:
+      'Multi-criteria search with format: searchTerm|column|searchType',
+    type: [String],
+  })
+  @IsOptional()
+  @IsString({ each: true })
+  multi_search?: string[];
 }
 
 export class CoreIncludesDto {

src/core/super-admin-core/dto/super-admin-core.dto.ts

@@ -0,0 +1,10 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { SuperAdmin } from '@prisma/client';
+import { IsArray } from 'class-validator';
+import { CorePaginateDto } from 'src/core/base-query-core/dto/base-query-core.dto';
+
+export class SuperAdminCorePaginateDto extends CorePaginateDto {
+  @ApiProperty({ required: true })
+  @IsArray()
+  list?: SuperAdmin[];
+}

src/core/super-admin-core/super-admin-core.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { PrismaService } from 'src/shared/modules/prisma/prisma.service';
+import { SuperAdminCoreService } from './super-admin-core.service';
+
+@Module({
+  providers: [PrismaService, SuperAdminCoreService],
+  exports: [SuperAdminCoreService, PrismaService],
+})
+export class SuperAdminCoreModule {}

src/core/super-admin-core/super-admin-core.service.ts

@@ -0,0 +1,29 @@
+import { Injectable } from '@nestjs/common';
+import { SuperAdmin, Prisma } from '@prisma/client';
+import { PrismaService } from 'src/shared/modules/prisma/prisma.service';
+import { SuperAdminCorePaginateDto } from './dto/super-admin-core.dto';
+import { PrismaBaseRepository } from 'src/shared/libs/prisma-base.repository';
+import { SuperAdminMessages } from 'src/shared/keys/super-admin.keys';
+
+@Injectable()
+export class SuperAdminCoreService extends PrismaBaseRepository<
+  SuperAdmin,
+  SuperAdminCorePaginateDto,
+  Prisma.SuperAdminCreateArgs,
+  Prisma.SuperAdminUpdateArgs,
+  Prisma.SuperAdminUpdateManyArgs,
+  Prisma.SuperAdminFindUniqueArgs,
+  Prisma.SuperAdminFindFirstArgs,
+  Prisma.SuperAdminFindManyArgs,
+  Prisma.SuperAdminDeleteArgs,
+  Prisma.SuperAdminDeleteManyArgs,
+  Prisma.SuperAdminCountArgs,
+  Prisma.SuperAdminUpsertArgs
+> {
+  constructor(private prismaService: PrismaService) {
+    super(prismaService.prisma.superAdmin, {
+      NOT_FOUND: SuperAdminMessages.NOT_FOUND,
+      DELETED: SuperAdminMessages.DELETED,
+    });
+  }
+}

src/core/super-admin-credential-core/dto/super-admin-credential-core.dto.ts

@@ -0,0 +1,10 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { SuperAdminCredential } from '@prisma/client';
+import { IsArray } from 'class-validator';
+import { CorePaginateDto } from 'src/core/base-query-core/dto/base-query-core.dto';
+
+export class SuperAdminCredentialCorePaginateDto extends CorePaginateDto {
+  @ApiProperty({ required: true })
+  @IsArray()
+  list?: SuperAdminCredential[];
+}

src/core/super-admin-credential-core/super-admin-credential-core.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { PrismaService } from 'src/shared/modules/prisma/prisma.service';
+import { SuperAdminCredentialCoreService } from './super-admin-credential-core.service';
+
+@Module({
+  providers: [PrismaService, SuperAdminCredentialCoreService],
+  exports: [SuperAdminCredentialCoreService, PrismaService],
+})
+export class SuperAdminCredentialCoreModule {}

src/core/super-admin-credential-core/super-admin-credential-core.service.ts

@@ -0,0 +1,29 @@
+import { Injectable } from '@nestjs/common';
+import { SuperAdminCredential, Prisma } from '@prisma/client';
+import { PrismaService } from 'src/shared/modules/prisma/prisma.service';
+import { SuperAdminCredentialCorePaginateDto } from './dto/super-admin-credential-core.dto';
+import { PrismaBaseRepository } from 'src/shared/libs/prisma-base.repository';
+import { SuperAdminCredentialMessages } from 'src/shared/keys/super-admin-credential.keys';
+
+@Injectable()
+export class SuperAdminCredentialCoreService extends PrismaBaseRepository<
+  SuperAdminCredential,
+  SuperAdminCredentialCorePaginateDto,
+  Prisma.SuperAdminCredentialCreateArgs,
+  Prisma.SuperAdminCredentialUpdateArgs,
+  Prisma.SuperAdminCredentialUpdateManyArgs,
+  Prisma.SuperAdminCredentialFindUniqueArgs,
+  Prisma.SuperAdminCredentialFindFirstArgs,
+  Prisma.SuperAdminCredentialFindManyArgs,
+  Prisma.SuperAdminCredentialDeleteArgs,
+  Prisma.SuperAdminCredentialDeleteManyArgs,
+  Prisma.SuperAdminCredentialCountArgs,
+  Prisma.SuperAdminCredentialUpsertArgs
+> {
+  constructor(private prismaService: PrismaService) {
+    super(prismaService.prisma.superAdminCredential, {
+      NOT_FOUND: SuperAdminCredentialMessages.NOT_FOUND,
+      DELETED: SuperAdminCredentialMessages.DELETED,
+    });
+  }
+}

src/core/super-admin-session-core/dto/super-admin-session-core.dto.ts

@@ -0,0 +1,10 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { SuperAdminSession } from '@prisma/client';
+import { IsArray } from 'class-validator';
+import { CorePaginateDto } from 'src/core/base-query-core/dto/base-query-core.dto';
+
+export class SuperAdminSessionCorePaginateDto extends CorePaginateDto {
+  @ApiProperty({ required: true })
+  @IsArray()
+  list?: SuperAdminSession[];
+}

src/core/super-admin-session-core/super-admin-session-core.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@nestjs/common';
+import { PrismaService } from 'src/shared/modules/prisma/prisma.service';
+import { SuperAdminSessionCoreService } from './super-admin-session-core.service';
+
+@Module({
+  providers: [PrismaService, SuperAdminSessionCoreService],
+  exports: [SuperAdminSessionCoreService, PrismaService],
+})
+export class SuperAdminSessionCoreModule {}

src/core/super-admin-session-core/super-admin-session-core.service.ts

@@ -0,0 +1,29 @@
+import { Injectable } from '@nestjs/common';
+import { SuperAdminSession, Prisma } from '@prisma/client';
+import { PrismaService } from 'src/shared/modules/prisma/prisma.service';
+import { SuperAdminSessionCorePaginateDto } from './dto/super-admin-session-core.dto';
+import { PrismaBaseRepository } from 'src/shared/libs/prisma-base.repository';
+import { SuperAdminSessionMessages } from 'src/shared/keys/super-admin-session.keys';
+
+@Injectable()
+export class SuperAdminSessionCoreService extends PrismaBaseRepository<
+  SuperAdminSession,
+  SuperAdminSessionCorePaginateDto,
+  Prisma.SuperAdminSessionCreateArgs,
+  Prisma.SuperAdminSessionUpdateArgs,
+  Prisma.SuperAdminSessionUpdateManyArgs,
+  Prisma.SuperAdminSessionFindUniqueArgs,
+  Prisma.SuperAdminSessionFindFirstArgs,
+  Prisma.SuperAdminSessionFindManyArgs,
+  Prisma.SuperAdminSessionDeleteArgs,
+  Prisma.SuperAdminSessionDeleteManyArgs,
+  Prisma.SuperAdminSessionCountArgs,
+  Prisma.SuperAdminSessionUpsertArgs
+> {
+  constructor(private prismaService: PrismaService) {
+    super(prismaService.prisma.superAdminSession, {
+      NOT_FOUND: SuperAdminSessionMessages.NOT_FOUND,
+      DELETED: SuperAdminSessionMessages.DELETED,
+    });
+  }
+}

src/core/user-core/user-core.service.ts

@@ -17,7 +17,8 @@ export class UserCoreService extends PrismaBaseRepository<
   Prisma.UserFindManyArgs,
   Prisma.UserDeleteArgs,
   Prisma.UserDeleteManyArgs,
-  Prisma.UserCountArgs
+  Prisma.UserCountArgs,
+  Prisma.UserUpsertArgs
 > {
   constructor(private prismaService: PrismaService) {
     super(prismaService.prisma.user, {

src/core/user-credential-core/user-credential-core.service.ts

@@ -17,7 +17,8 @@ export class UserCredentialCoreService extends PrismaBaseRepository<
   Prisma.UserCredentialFindManyArgs,
   Prisma.UserCredentialDeleteArgs,
   Prisma.UserCredentialDeleteManyArgs,
-  Prisma.UserCredentialCountArgs
+  Prisma.UserCredentialCountArgs,
+  Prisma.UserCredentialUpsertArgs
 > {
   constructor(private prismaService: PrismaService) {
     super(prismaService.prisma.userCredential, {

src/core/user-session-core/user-session-core.service.ts

@@ -17,7 +17,8 @@ export class UserSessionCoreService extends PrismaBaseRepository<
   Prisma.UserSessionFindManyArgs,
   Prisma.UserSessionDeleteArgs,
   Prisma.UserSessionDeleteManyArgs,
-  Prisma.UserSessionCountArgs
+  Prisma.UserSessionCountArgs,
+  Prisma.UserSessionUpsertArgs
 > {
   constructor(private prismaService: PrismaService) {
     super(prismaService.prisma.userSession, {

src/modules/auth/auth.controller.ts

@@ -1,52 +0,0 @@
-import { Controller, Post, Body, Req, Get } from '@nestjs/common';
-import {
-  ApiTags,
-  ApiOperation,
-  ApiResponse,
-  ApiBearerAuth,
-} from '@nestjs/swagger';
-import { AuthService } from './auth.service';
-import { LoginDto } from './dto/login.dto';
-import { RegisterDto } from './dto/register.dto';
-import { RefreshTokenDto } from './dto/refresh-token.dto';
-import { Public } from 'src/shared/decorators/public.decorator';
-import { GetUser } from 'src/shared/decorators/get-user.decorator';
-import type { UserSessionType } from 'src/shared/types/user-session.type';
-
-@ApiTags('Authentication')
-@Controller('auth')
-export class AuthController {
-  constructor(private readonly authService: AuthService) {}
-
-  @Public()
-  @Post('register')
-  @ApiOperation({ summary: 'Register a new user' })
-  @ApiResponse({ status: 201, description: 'User registered successfully' })
-  async register(@Body() registerDto: RegisterDto) {
-    return this.authService.register(registerDto);
-  }
-
-  @Public()
-  @Post('login')
-  @ApiOperation({ summary: 'Login user' })
-  @ApiResponse({ status: 200, description: 'Login successful' })
-  async login(@Body() loginDto: LoginDto, @Req() request: Request) {
-    return this.authService.login(loginDto, request);
-  }
-
-  @Public()
-  @Post('refresh-token')
-  @ApiOperation({ summary: 'Refresh access token' })
-  @ApiResponse({ status: 200, description: 'Token refreshed successfully' })
-  async refreshToken(@Body() refreshTokenDto: RefreshTokenDto) {
-    return this.authService.refreshToken(refreshTokenDto);
-  }
-
-  @ApiBearerAuth()
-  @Get('profile')
-  @ApiOperation({ summary: 'Get user profile' })
-  @ApiResponse({ status: 200, description: 'Profile retrieved successfully' })
-  async getProfile(@GetUser() userSession: UserSessionType) {
-    return { user: userSession.user };
-  }
-}

src/modules/auth/strategies/jwt.strategy.ts

@@ -1,28 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { PassportStrategy } from '@nestjs/passport';
-import { ExtractJwt, Strategy } from 'passport-jwt';
-import { AuthService } from '../auth.service';
-import { jwtAuthConstants } from 'src/shared/keys/auth.keys';
-import { User } from '@prisma/client';
-
-@Injectable()
-export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
-  constructor(private readonly authService: AuthService) {
-    super({
-      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
-      ignoreExpiration: false,
-      secretOrKey: jwtAuthConstants.accessTokenSecret,
-      passReqToCallback: true,
-    });
-  }
-
-  async validate(
-    request: Request & { headers: { authorization: string } },
-    user: User,
-  ) {
-    return this.authService.performJWTStrategy({
-      request,
-      user,
-    });
-  }
-}

src/modules/super-admin/auth/auth.controller.ts

@@ -0,0 +1,55 @@
+import { Controller, Post, Body, Req, UseGuards } from '@nestjs/common';
+import { ApiTags, ApiBearerAuth, ApiOperation } from '@nestjs/swagger';
+import { SuperAdminAuthService } from './auth.service';
+import { SuperAdminRegisterDto } from './dto/register.dto';
+import { SuperAdminLoginDto } from './dto/login.dto';
+import { SuperAdminRefreshTokenDto } from './dto/refresh-token.dto';
+import { Public } from 'src/shared/decorators/public.decorator';
+import { GetSuperAdmin } from 'src/shared/decorators/get-super-admin.decorator';
+import type { SuperAdminSessionType } from 'src/shared/types/super-admin-session.type';
+import { SuperAdminAuthGuard } from './guards/super-admin-auth.guard';
+
+@ApiTags('Super Admin: Authentication')
+@Controller('super-admin/auth')
+@UseGuards(SuperAdminAuthGuard)
+export class SuperAdminAuthController {
+  constructor(private readonly superAdminAuthService: SuperAdminAuthService) {}
+
+  @Public()
+  @Post('register')
+  @ApiOperation({ summary: 'Register a new super admin' })
+  async register(
+    @Body() registerDto: SuperAdminRegisterDto,
+    @Req() request: any,
+  ) {
+    return this.superAdminAuthService.register(registerDto, request);
+  }
+
+  @Public()
+  @Post('login')
+  @ApiOperation({ summary: 'Login super admin' })
+  async login(@Body() loginDto: SuperAdminLoginDto, @Req() request: any) {
+    return this.superAdminAuthService.login(loginDto, request);
+  }
+
+  @ApiBearerAuth()
+  @Post('logout')
+  @ApiOperation({ summary: 'Logout super admin' })
+  async logout(@GetSuperAdmin() sessionData: SuperAdminSessionType) {
+    return this.superAdminAuthService.logout(sessionData);
+  }
+
+  @Public()
+  @Post('refresh-token')
+  @ApiOperation({ summary: 'Refresh access token' })
+  async refreshToken(@Body() refreshTokenDto: SuperAdminRefreshTokenDto) {
+    return this.superAdminAuthService.refreshToken(refreshTokenDto);
+  }
+
+  @ApiBearerAuth()
+  @Post('profile')
+  @ApiOperation({ summary: 'Get super admin profile' })
+  async getProfile(@GetSuperAdmin() sessionData: SuperAdminSessionType) {
+    return { superAdmin: sessionData.superAdmin };
+  }
+}

src/modules/super-admin/auth/auth.module.ts

@@ -0,0 +1,29 @@
+import { Module } from '@nestjs/common';
+import { JwtModule } from '@nestjs/jwt';
+import { PassportModule } from '@nestjs/passport';
+import { SuperAdminAuthController } from './auth.controller';
+import { SuperAdminAuthService } from './auth.service';
+import { SuperAdminJwtStrategy } from './strategies/super-admin-jwt.strategy';
+import { SuperAdminCoreModule } from 'src/core/super-admin-core/super-admin-core.module';
+import { SuperAdminCredentialCoreModule } from 'src/core/super-admin-credential-core/super-admin-credential-core.module';
+import { SuperAdminSessionCoreModule } from 'src/core/super-admin-session-core/super-admin-session-core.module';
+import { CommonModule } from 'src/shared/modules/common/common.module';
+import { jwtAuthConstants } from 'src/shared/keys/auth.keys';
+
+@Module({
+  imports: [
+    PassportModule,
+    JwtModule.register({
+      secret: jwtAuthConstants.accessTokenSecret,
+      signOptions: { expiresIn: jwtAuthConstants.accessTokenExpiresIn },
+    }),
+    SuperAdminCoreModule,
+    SuperAdminCredentialCoreModule,
+    SuperAdminSessionCoreModule,
+    CommonModule,
+  ],
+  controllers: [SuperAdminAuthController],
+  providers: [SuperAdminAuthService, SuperAdminJwtStrategy],
+  exports: [SuperAdminAuthService],
+})
+export class SuperAdminAuthModule {}

src/modules/super-admin/auth/auth.service.ts

@@ -0,0 +1,310 @@
+import {
+  Injectable,
+  UnauthorizedException,
+  ConflictException,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { SuperAdmin, SUPER_ADMIN_SESSION_STATUS } from '@prisma/client';
+import { SuperAdminCoreService } from 'src/core/super-admin-core/super-admin-core.service';
+import { SuperAdminCredentialCoreService } from 'src/core/super-admin-credential-core/super-admin-credential-core.service';
+import { SuperAdminSessionCoreService } from 'src/core/super-admin-session-core/super-admin-session-core.service';
+import { CommonService } from 'src/shared/modules/common/common.service';
+import { SuperAdminRegisterDto } from './dto/register.dto';
+import { SuperAdminLoginDto } from './dto/login.dto';
+import { SuperAdminRefreshTokenDto } from './dto/refresh-token.dto';
+import { SuperAdminSessionType } from 'src/shared/types/super-admin-session.type';
+import {
+  accessTokenSignSettings,
+  refreshTokenSignSettings,
+  refreshTokenVerifySettings,
+  TOKEN_TYPE,
+  TOKEN_USER_TYPE,
+  AuthMessages,
+} from 'src/shared/keys/auth.keys';
+
+@Injectable()
+export class SuperAdminAuthService {
+  constructor(
+    private readonly jwtService: JwtService,
+    private readonly superAdminCoreService: SuperAdminCoreService,
+    private readonly superAdminCredentialCoreService: SuperAdminCredentialCoreService,
+    private readonly superAdminSessionCoreService: SuperAdminSessionCoreService,
+    private readonly commonService: CommonService,
+  ) {}
+
+  async register(
+    registerDto: SuperAdminRegisterDto,
+    request: any,
+  ): Promise<{
+    superAdmin: SuperAdmin;
+    accessToken: string;
+    refreshToken: string;
+  }> {
+    const { email, password, name, profileImage } = registerDto;
+
+    // Check if super admin already exists
+    const existingSuperAdmin = await this.superAdminCoreService
+      .findFirst({
+        where: { email, isDeleted: false },
+      })
+      .catch(() => null);
+
+    if (existingSuperAdmin) {
+      throw new ConflictException('Super admin with this email already exists');
+    }
+
+    // Create super admin
+    const superAdmin = await this.superAdminCoreService.create({
+      data: {
+        email,
+        name,
+        profileImage,
+      },
+    });
+
+    // Hash and store password
+    const hashedPassword = await this.commonService.hashPassword(password);
+    await this.superAdminCredentialCoreService.create({
+      data: {
+        superAdminId: superAdmin.id,
+        password: hashedPassword,
+      },
+    });
+
+    // Generate tokens
+    const { accessToken, refreshToken } = await this.getNewToken(superAdmin);
+
+    // Get client info
+    const clientInfo = this.commonService.getClientInfo(request);
+
+    // Create session
+    await this.superAdminSessionCoreService.create({
+      data: {
+        superAdminId: superAdmin.id,
+        accessToken,
+        refreshToken,
+        ipAddress: clientInfo.ipAddress,
+        userAgent: clientInfo.userAgent,
+        geoIpCountry: clientInfo.geoLocation?.country || '',
+        city: clientInfo.geoLocation?.city || '',
+        state: clientInfo.geoLocation?.region || '',
+        latitude: clientInfo.geoLocation?.ll?.[0] || null,
+        longitude: clientInfo.geoLocation?.ll?.[1] || null,
+        isFromAdmin: true,
+        status: SUPER_ADMIN_SESSION_STATUS.CURRENT,
+        loginAt: new Date(),
+      },
+    });
+
+    return {
+      superAdmin,
+      accessToken,
+      refreshToken,
+    };
+  }
+
+  async login(
+    loginDto: SuperAdminLoginDto,
+    request: any,
+  ): Promise<{
+    superAdmin: SuperAdmin;
+    accessToken: string;
+    refreshToken: string;
+  }> {
+    const { email, password } = loginDto;
+
+    // Find super admin
+    const superAdmin = await this.superAdminCoreService
+      .findFirst({
+        where: { email, isDeleted: false },
+      })
+      .catch(() => null);
+
+    if (!superAdmin) {
+      throw new UnauthorizedException('Invalid credentials');
+    }
+
+    // Get super admin credential
+    const credential = await this.superAdminCredentialCoreService
+      .findFirst({
+        where: { superAdminId: superAdmin.id, isDeleted: false },
+      })
+      .catch(() => null);
+
+    if (!credential) {
+      throw new UnauthorizedException('Invalid credentials');
+    }
+
+    // Verify password
+    const isPasswordValid = await this.commonService.comparePassword(
+      password,
+      credential.password,
+    );
+
+    if (!isPasswordValid) {
+      throw new UnauthorizedException('Invalid credentials');
+    }
+
+    // Generate tokens
+    const { accessToken, refreshToken } = await this.getNewToken(superAdmin);
+
+    // Get client info
+    const clientInfo = this.commonService.getClientInfo(request);
+
+    // Create session
+    await this.superAdminSessionCoreService.create({
+      data: {
+        superAdminId: superAdmin.id,
+        accessToken,
+        refreshToken,
+        ipAddress: clientInfo.ipAddress,
+        userAgent: clientInfo.userAgent,
+        geoIpCountry: clientInfo.geoLocation?.country || '',
+        city: clientInfo.geoLocation?.city || '',
+        state: clientInfo.geoLocation?.region || '',
+        latitude: clientInfo.geoLocation?.ll?.[0] || null,
+        longitude: clientInfo.geoLocation?.ll?.[1] || null,
+        isFromAdmin: true,
+        status: SUPER_ADMIN_SESSION_STATUS.CURRENT,
+        loginAt: new Date(),
+      },
+    });
+
+    return {
+      superAdmin,
+      accessToken,
+      refreshToken,
+    };
+  }
+
+  async logout(
+    sessionData: SuperAdminSessionType,
+  ): Promise<{ message: string }> {
+    const { session } = sessionData;
+
+    // Update session to expired
+    await this.superAdminSessionCoreService.update({
+      where: { id: session.id },
+      data: {
+        status: SUPER_ADMIN_SESSION_STATUS.EXPIRED,
+        expiredAt: new Date(),
+      },
+    });
+
+    return { message: AuthMessages.LOGOUT_SUCCESS };
+  }
+
+  async refreshToken(refreshTokenDto: SuperAdminRefreshTokenDto): Promise<{
+    accessToken: string;
+    refreshToken: string;
+  }> {
+    const { refreshToken } = refreshTokenDto;
+
+    let validateRefreshToken: any = null;
+
+    try {
+      validateRefreshToken = await this.jwtService.verifyAsync(
+        refreshToken,
+        refreshTokenVerifySettings,
+      );
+    } catch {
+      throw new UnauthorizedException('Invalid refresh token');
+    }
+
+    // Verify user type
+    if (validateRefreshToken.userType !== TOKEN_USER_TYPE.SUPER_ADMIN) {
+      throw new UnauthorizedException('Invalid token type');
+    }
+
+    const superAdmin = await this.superAdminCoreService.findUnique({
+      where: { id: validateRefreshToken.id, isDeleted: false },
+    });
+
+    if (!superAdmin) {
+      throw new UnauthorizedException('Super admin not found');
+    }
+
+    // Generate new tokens
+    const newTokens = await this.getNewToken(superAdmin);
+
+    // Update session with new tokens
+    await this.superAdminSessionCoreService.updateMany({
+      where: {
+        superAdminId: superAdmin.id,
+        refreshToken,
+        status: SUPER_ADMIN_SESSION_STATUS.CURRENT,
+      },
+      data: {
+        accessToken: newTokens.accessToken,
+        refreshToken: newTokens.refreshToken,
+      },
+    });
+
+    return newTokens;
+  }
+
+  private async getNewToken(superAdmin: SuperAdmin): Promise<{
+    accessToken: string;
+    refreshToken: string;
+  }> {
+    const payload = {
+      id: superAdmin.id,
+      email: superAdmin.email,
+      userType: TOKEN_USER_TYPE.SUPER_ADMIN,
+    };
+
+    const accessToken = await this.jwtService.signAsync(
+      { ...payload, type: TOKEN_TYPE.ACCESS },
+      accessTokenSignSettings,
+    );
+
+    const refreshToken = await this.jwtService.signAsync(
+      { ...payload, type: TOKEN_TYPE.REFRESH },
+      refreshTokenSignSettings,
+    );
+
+    return { accessToken, refreshToken };
+  }
+
+  async performJWTStrategy({
+    request,
+    superAdmin,
+  }: {
+    request: Request & { headers: { authorization: string } };
+    superAdmin: SuperAdmin;
+  }): Promise<SuperAdminSessionType> {
+    const accessToken = request.headers.authorization?.replace('Bearer ', '');
+
+    if (!accessToken) {
+      throw new UnauthorizedException('Invalid token');
+    }
+
+    // Get full super admin object
+    const fullSuperAdmin = await this.superAdminCoreService.findUnique({
+      where: { id: superAdmin.id, isDeleted: false },
+    });
+
+    if (!fullSuperAdmin) {
+      throw new UnauthorizedException('Super admin not found');
+    }
+
+    // Find active session
+    const session = await this.superAdminSessionCoreService.findFirst({
+      where: {
+        superAdminId: superAdmin.id,
+        accessToken,
+        status: SUPER_ADMIN_SESSION_STATUS.CURRENT,
+        isDeleted: false,
+      },
+    });
+
+    if (!session) {
+      throw new UnauthorizedException('Session not found or expired');
+    }
+
+    return {
+      superAdmin: fullSuperAdmin,
+      session,
+    };
+  }
+}

src/modules/super-admin/auth/dto/login.dto.ts

@@ -0,0 +1,15 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsEmail, IsNotEmpty, IsString, MinLength } from 'class-validator';
+
+export class SuperAdminLoginDto {
+  @ApiProperty({ example: 'admin@example.com' })
+  @IsEmail()
+  @IsNotEmpty()
+  email: string;
+
+  @ApiProperty({ example: 'password123' })
+  @IsString()
+  @IsNotEmpty()
+  @MinLength(6)
+  password: string;
+}

src/modules/{auth → super-admin/auth}/dto/refresh-token.dto.ts

@@ -1,12 +1,9 @@
-import { IsString } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
+import { IsNotEmpty, IsString } from 'class-validator';
 
-export class RefreshTokenDto {
-  @ApiProperty()
-  @IsString()
-  accessToken: string;
-
+export class SuperAdminRefreshTokenDto {
   @ApiProperty()
   @IsString()
+  @IsNotEmpty()
   refreshToken: string;
 }

src/modules/{auth/dto/login.dto.ts → super-admin/auth/dto/register.dto.ts}

@@ -1,24 +1,31 @@
-import { IsEmail, IsString, MinLength, IsOptional } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
+import {
+  IsEmail,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  MinLength,
+} from 'class-validator';
 
-export class LoginDto {
-  @ApiProperty({ example: 'user@example.com', required: false })
-  @IsOptional()
+export class SuperAdminRegisterDto {
+  @ApiProperty({ example: 'admin@example.com' })
   @IsEmail()
-  email?: string;
+  @IsNotEmpty()
+  email: string;
 
-  @ApiProperty({ example: '+1234567890', required: false })
-  @IsOptional()
+  @ApiProperty({ example: 'password123' })
   @IsString()
-  phone?: string;
+  @IsNotEmpty()
+  @MinLength(6)
+  password: string;
 
-  @ApiProperty({ example: '+1', required: false })
-  @IsOptional()
+  @ApiProperty({ example: 'Admin Name' })
   @IsString()
-  code?: string;
+  @IsNotEmpty()
+  name: string;
 
-  @ApiProperty({ example: 'password123' })
+  @ApiProperty({ example: 'https://example.com/profile.jpg', required: false })
   @IsString()
-  @MinLength(6)
-  password: string;
+  @IsOptional()
+  profileImage?: string;
 }

src/modules/super-admin/auth/guards/super-admin-auth.guard.ts

@@ -0,0 +1,27 @@
+import { Injectable, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AuthGuard } from '@nestjs/passport';
+import { Observable } from 'rxjs';
+import { IS_PUBLIC_KEY } from 'src/shared/decorators/public.decorator';
+
+@Injectable()
+export class SuperAdminAuthGuard extends AuthGuard('super-admin-jwt') {
+  constructor(private reflector: Reflector) {
+    super();
+  }
+
+  canActivate(
+    context: ExecutionContext,
+  ): boolean | Promise<boolean> | Observable<boolean> {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+
+    if (isPublic) {
+      return true;
+    }
+
+    return super.canActivate(context);
+  }
+}

src/modules/super-admin/auth/strategies/super-admin-jwt.strategy.ts

@@ -0,0 +1,59 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { SuperAdminCoreService } from 'src/core/super-admin-core/super-admin-core.service';
+import { SuperAdminAuthService } from '../auth.service';
+import { Request } from 'express';
+import { jwtAuthConstants, TOKEN_USER_TYPE } from 'src/shared/keys/auth.keys';
+import { SuperAdmin } from '@prisma/client';
+
+@Injectable()
+export class SuperAdminJwtStrategy extends PassportStrategy(
+  Strategy,
+  'super-admin-jwt',
+) {
+  constructor(
+    private readonly superAdminCoreService: SuperAdminCoreService,
+    private readonly superAdminAuthService: SuperAdminAuthService,
+  ) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: jwtAuthConstants.accessTokenSecret,
+      passReqToCallback: true,
+    });
+  }
+
+  async validate(
+    request: Request & { headers: { authorization: string } },
+    payload: {
+      id: string;
+      email: string;
+      userType: TOKEN_USER_TYPE;
+    },
+  ) {
+    // Verify the user type
+    if (payload.userType !== TOKEN_USER_TYPE.SUPER_ADMIN) {
+      throw new UnauthorizedException('Invalid token: Not a super admin token');
+    }
+
+    const superAdmin = await this.superAdminCoreService.findUnique({
+      where: { id: payload.id },
+    });
+
+    if (!superAdmin || superAdmin.isDeleted) {
+      throw new UnauthorizedException('Super admin not found');
+    }
+
+    // Get full session data
+    const sessionData = await this.superAdminAuthService.performJWTStrategy({
+      request: request as any,
+      superAdmin: {
+        id: payload.id,
+        email: payload.email,
+      } as SuperAdmin,
+    });
+
+    return sessionData;
+  }
+}

src/modules/super-admin/super-admin.module.ts

@@ -0,0 +1,8 @@
+import { Module } from '@nestjs/common';
+import { SuperAdminAuthModule } from './auth/auth.module';
+
+@Module({
+  imports: [SuperAdminAuthModule],
+  exports: [SuperAdminAuthModule],
+})
+export class SuperAdminModule {}

src/modules/user/auth/auth.controller.ts

@@ -0,0 +1,52 @@
+import { Controller, Post, Body, Req, UseGuards } from '@nestjs/common';
+import { ApiTags, ApiBearerAuth, ApiOperation } from '@nestjs/swagger';
+import { UserAuthService } from './auth.service';
+import { UserRegisterDto } from './dto/register.dto';
+import { UserLoginDto } from './dto/login.dto';
+import { UserRefreshTokenDto } from './dto/refresh-token.dto';
+import { Public } from 'src/shared/decorators/public.decorator';
+import { GetUser } from 'src/shared/decorators/get-user.decorator';
+import type { UserSessionType } from 'src/shared/types/user-session.type';
+import { UserAuthGuard } from './guards/user-auth.guard';
+
+@ApiTags('User: Authentication')
+@Controller('user/auth')
+@UseGuards(UserAuthGuard)
+export class UserAuthController {
+  constructor(private readonly userAuthService: UserAuthService) {}
+
+  @Public()
+  @Post('register')
+  @ApiOperation({ summary: 'Register a new user' })
+  async register(@Body() registerDto: UserRegisterDto, @Req() request: any) {
+    return this.userAuthService.register(registerDto, request);
+  }
+
+  @Public()
+  @Post('login')
+  @ApiOperation({ summary: 'Login user' })
+  async login(@Body() loginDto: UserLoginDto, @Req() request: any) {
+    return this.userAuthService.login(loginDto, request);
+  }
+
+  @ApiBearerAuth()
+  @Post('logout')
+  @ApiOperation({ summary: 'Logout user' })
+  async logout(@GetUser() sessionData: UserSessionType) {
+    return this.userAuthService.logout(sessionData);
+  }
+
+  @Public()
+  @Post('refresh-token')
+  @ApiOperation({ summary: 'Refresh access token' })
+  async refreshToken(@Body() refreshTokenDto: UserRefreshTokenDto) {
+    return this.userAuthService.refreshToken(refreshTokenDto);
+  }
+
+  @ApiBearerAuth()
+  @Post('profile')
+  @ApiOperation({ summary: 'Get user profile' })
+  async getProfile(@GetUser() sessionData: UserSessionType) {
+    return { user: sessionData.user };
+  }
+}

src/modules/{auth → user/auth}/auth.module.ts

@@ -1,29 +1,29 @@
 import { Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
-import { AuthService } from './auth.service';
-import { AuthController } from './auth.controller';
-import { JwtStrategy } from './strategies/jwt.strategy';
+import { UserAuthController } from './auth.controller';
+import { UserAuthService } from './auth.service';
+import { UserJwtStrategy } from './strategies/user-jwt.strategy';
 import { UserCoreModule } from 'src/core/user-core/user-core.module';
-import { CommonModule } from 'src/shared/modules/common/common.module';
-import { jwtAuthConstants } from 'src/shared/keys/auth.keys';
 import { UserCredentialCoreModule } from 'src/core/user-credential-core/user-credential-core.module';
 import { UserSessionCoreModule } from 'src/core/user-session-core/user-session-core.module';
+import { CommonModule } from 'src/shared/modules/common/common.module';
+import { jwtAuthConstants } from 'src/shared/keys/auth.keys';
 
 @Module({
   imports: [
-    UserCoreModule,
-    UserCredentialCoreModule,
-    UserSessionCoreModule,
-    CommonModule,
     PassportModule,
     JwtModule.register({
       secret: jwtAuthConstants.accessTokenSecret,
       signOptions: { expiresIn: jwtAuthConstants.accessTokenExpiresIn },
     }),
+    UserCoreModule,
+    UserCredentialCoreModule,
+    UserSessionCoreModule,
+    CommonModule,
   ],
-  controllers: [AuthController],
-  providers: [AuthService, JwtStrategy],
-  exports: [AuthService],
+  controllers: [UserAuthController],
+  providers: [UserAuthService, UserJwtStrategy],
+  exports: [UserAuthService],
 })
-export class AuthModule {}
+export class UserAuthModule {}

src/modules/{auth → user/auth}/auth.service.ts

@@ -1,7 +1,6 @@
 import {
   Injectable,
   UnauthorizedException,
-  BadRequestException,
   ConflictException,
 } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
@@ -10,26 +9,23 @@ import { UserCoreService } from 'src/core/user-core/user-core.service';
 import { UserCredentialCoreService } from 'src/core/user-credential-core/user-credential-core.service';
 import { UserSessionCoreService } from 'src/core/user-session-core/user-session-core.service';
 import { CommonService } from 'src/shared/modules/common/common.service';
-import { LoginDto } from './dto/login.dto';
-import { RegisterDto } from './dto/register.dto';
-import { RefreshTokenDto } from './dto/refresh-token.dto';
+import { UserRegisterDto } from './dto/register.dto';
+import { UserLoginDto } from './dto/login.dto';
+import { UserRefreshTokenDto } from './dto/refresh-token.dto';
 import { UserSessionType } from 'src/shared/types/user-session.type';
-import {
-  getUniqueId,
-  generateClientId,
-} from 'src/shared/modules/common/common.helper';
-import { UNIQUE_ID_ENUM, USER_STATUS_ENUM } from 'src/keys';
 import {
   accessTokenSignSettings,
-  accessTokenVerifySettings,
   refreshTokenSignSettings,
   refreshTokenVerifySettings,
   TOKEN_TYPE,
   TOKEN_USER_TYPE,
+  AuthMessages,
 } from 'src/shared/keys/auth.keys';
+import { getUniqueId } from 'src/shared/modules/common/common.helper';
+import { UNIQUE_ID_ENUM, USER_STATUS_ENUM } from 'src/keys';
 
 @Injectable()
-export class AuthService {
+export class UserAuthService {
   constructor(
     private readonly jwtService: JwtService,
     private readonly userCoreService: UserCoreService,
@@ -38,45 +34,44 @@ export class AuthService {
     private readonly commonService: CommonService,
   ) {}
 
-  async register(registerDto: RegisterDto): Promise<{ message: string }> {
-    const { email, phone, code, firstName, lastName, password } = registerDto;
+  async register(
+    registerDto: UserRegisterDto,
+    request: any,
+  ): Promise<{
+    user: User;
+    accessToken: string;
+    refreshToken: string;
+  }> {
+    const { email, password, firstName, lastName, phone, code } = registerDto;
 
     // Check if user already exists
-    if (email) {
-      const existingUser = await this.userCoreService.findByEmail(email);
-      if (existingUser) {
-        throw new ConflictException('User with this email already exists');
-      }
-    }
-
-    if (phone && code) {
-      const existingUser = await this.userCoreService.findByPhone(phone, code);
-      if (existingUser) {
-        throw new ConflictException('User with this phone already exists');
-      }
+    const existingUser = await this.userCoreService
+      .findFirst({
+        where: { email, isDeleted: false },
+      })
+      .catch(() => null);
+
+    if (existingUser) {
+      throw new ConflictException('User with this email already exists');
     }
 
-    // Hash password
-    const hashedPassword = await this.commonService.hashPassword(password);
-
     // Create user
     const user = await this.userCoreService.create({
       data: {
         uniqueId: getUniqueId(UNIQUE_ID_ENUM.User),
         email,
-        phone,
-        code,
         firstName,
         lastName,
+        phone,
+        code,
         status: USER_STATUS_ENUM.ENABLED,
         emailVerified: false,
         phoneVerified: false,
-        createdAt: new Date(),
-        updatedAt: new Date(),
       },
     });
 
-    // Create user credential
+    // Hash and store password
+    const hashedPassword = await this.commonService.hashPassword(password);
     await this.userCredentialCoreService.create({
       data: {
         userId: user.id,
@@ -84,28 +79,59 @@ export class AuthService {
       },
     });
 
-    return { message: 'User registered successfully' };
+    // Generate tokens
+    const { accessToken, refreshToken } = await this.getNewToken(user);
+
+    // Get client info
+    const clientInfo = this.commonService.getClientInfo(request);
+
+    // Create session
+    await this.userSessionCoreService.create({
+      data: {
+        userId: user.id,
+        accessToken,
+        refreshToken,
+        ipAddress: clientInfo.ipAddress,
+        userAgent: clientInfo.userAgent,
+        geoIpCountry: clientInfo.geoLocation?.country || '',
+        loginAt: new Date(),
+      },
+    });
+
+    return {
+      user,
+      accessToken,
+      refreshToken,
+    };
   }
 
-  async login(loginDto: LoginDto, request: Request): Promise<UserSessionType> {
-    const { email, phone, code, password } = loginDto;
+  async login(
+    loginDto: UserLoginDto,
+    request: any,
+  ): Promise<{
+    user: User;
+    accessToken: string;
+    refreshToken: string;
+  }> {
+    const { email, password } = loginDto;
 
     // Find user
-    let user: User | null = null;
-    if (email) {
-      user = await this.userCoreService.findByEmail(email);
-    } else if (phone && code) {
-      user = await this.userCoreService.findByPhone(phone, code);
-    }
+    const user = await this.userCoreService
+      .findFirst({
+        where: { email, isDeleted: false },
+      })
+      .catch(() => null);
 
     if (!user) {
       throw new UnauthorizedException('Invalid credentials');
     }
 
     // Get user credential
-    const credential = await this.userCredentialCoreService.findFirst({
-      where: { userId: user.id, isDeleted: false },
-    });
+    const credential = await this.userCredentialCoreService
+      .findFirst({
+        where: { userId: user.id, isDeleted: false },
+      })
+      .catch(() => null);
 
     if (!credential) {
       throw new UnauthorizedException('Invalid credentials');
@@ -128,15 +154,14 @@ export class AuthService {
     const clientInfo = this.commonService.getClientInfo(request);
 
     // Create session
-    const session = await this.userSessionCoreService.create({
+    await this.userSessionCoreService.create({
       data: {
         userId: user.id,
         accessToken,
         refreshToken,
         ipAddress: clientInfo.ipAddress,
         userAgent: clientInfo.userAgent,
-        geoIpCountry: clientInfo.geoLocation?.country,
-        clientId: generateClientId(),
+        geoIpCountry: clientInfo.geoLocation?.country || '',
         loginAt: new Date(),
       },
     });
@@ -144,77 +169,74 @@ export class AuthService {
     // Update last login
     await this.userCoreService.update({
       where: { id: user.id },
-      data: {
-        lastLogin: new Date(),
-        updatedAt: new Date(),
-      },
+      data: { lastLogin: new Date() },
+    });
+
+    return {
+      user,
+      accessToken,
+      refreshToken,
+    };
+  }
+
+  async logout(sessionData: UserSessionType): Promise<{ message: string }> {
+    const { session } = sessionData;
+
+    // Update session to mark as logged out
+    await this.userSessionCoreService.update({
+      where: { id: session.id },
+      data: { logoutAt: new Date() },
     });
 
-    return { user, session };
+    return { message: AuthMessages.LOGOUT_SUCCESS };
   }
 
-  async refreshToken(refreshTokenDto: RefreshTokenDto): Promise<{
+  async refreshToken(refreshTokenDto: UserRefreshTokenDto): Promise<{
     accessToken: string;
     refreshToken: string;
   }> {
-    const { accessToken, refreshToken } = refreshTokenDto;
+    const { refreshToken } = refreshTokenDto;
 
-    let validateAccessToken: any = null;
     let validateRefreshToken: any = null;
 
     try {
-      validateAccessToken = await this.jwtService.verifyAsync(
-        accessToken,
-        accessTokenVerifySettings,
+      validateRefreshToken = await this.jwtService.verifyAsync(
+        refreshToken,
+        refreshTokenVerifySettings,
       );
-    } catch {}
-
-    if (!validateAccessToken) {
-      try {
-        validateRefreshToken = await this.jwtService.verifyAsync(
-          refreshToken,
-          refreshTokenVerifySettings,
-        );
-      } catch {
-        throw new UnauthorizedException('Invalid refresh token');
-      }
-
-      const user = await this.userCoreService.findUnique({
-        where: { id: validateRefreshToken.id },
-      });
-
-      if (!user) {
-        throw new UnauthorizedException('User not found');
-      }
-
-      const tokens = await this.getNewToken(user);
-      return tokens;
+    } catch {
+      throw new UnauthorizedException('Invalid refresh token');
     }
 
-    throw new BadRequestException('Access token is still valid');
-  }
+    // Verify user type
+    if (validateRefreshToken.userType !== TOKEN_USER_TYPE.USER) {
+      throw new UnauthorizedException('Invalid token type');
+    }
 
-  async performJWTStrategy(params: {
-    request: Request & { headers: { authorization: string } };
-    user: User;
-  }): Promise<UserSessionType> {
-    const { request, user } = params;
+    const user = await this.userCoreService.findUnique({
+      where: { id: validateRefreshToken.id, isDeleted: false },
+    });
+
+    if (!user) {
+      throw new UnauthorizedException('User not found');
+    }
 
-    const token = request.headers.authorization?.replace('Bearer ', '');
+    // Generate new tokens
+    const newTokens = await this.getNewToken(user);
 
-    const session = await this.userSessionCoreService.findFirst({
+    // Update session with new tokens
+    await this.userSessionCoreService.updateMany({
       where: {
         userId: user.id,
-        accessToken: token,
-        isDeleted: false,
+        refreshToken,
+      },
+      data: {
+        accessToken: newTokens.accessToken,
+        refreshToken: newTokens.refreshToken,
       },
     });
 
-    if (!session) {
-      throw new UnauthorizedException('Invalid session');
-    }
-
-    return { user, session };
+    return newTokens;
   }
 
   private async getNewToken(user: User): Promise<{
@@ -224,26 +246,60 @@ export class AuthService {
     const payload = {
       id: user.id,
       email: user.email,
-      type: TOKEN_TYPE.ACCESS,
-      userType: TOKEN_USER_TYPE.USER,
-    };
-
-    const refreshPayload = {
-      id: user.id,
-      type: TOKEN_TYPE.REFRESH,
       userType: TOKEN_USER_TYPE.USER,
     };
 
     const accessToken = await this.jwtService.signAsync(
-      payload,
+      { ...payload, type: TOKEN_TYPE.ACCESS },
       accessTokenSignSettings,
     );
 
     const refreshToken = await this.jwtService.signAsync(
-      refreshPayload,
+      { ...payload, type: TOKEN_TYPE.REFRESH },
       refreshTokenSignSettings,
     );
 
     return { accessToken, refreshToken };
   }
+
+  async performJWTStrategy({
+    request,
+    user,
+  }: {
+    request: Request & { headers: { authorization: string } };
+    user: User;
+  }): Promise<UserSessionType> {
+    const accessToken = request.headers.authorization?.replace('Bearer ', '');
+
+    if (!accessToken) {
+      throw new UnauthorizedException('Invalid token');
+    }
+
+    // Get full user object
+    const fullUser = await this.userCoreService.findUnique({
+      where: { id: user.id, isDeleted: false },
+    });
+
+    if (!fullUser) {
+      throw new UnauthorizedException('User not found');
+    }
+
+    // Find active session
+    const session = await this.userSessionCoreService.findFirst({
+      where: {
+        userId: user.id,
+        accessToken,
+        isDeleted: false,
+      },
+    });
+
+    if (!session) {
+      throw new UnauthorizedException('Session not found');
+    }
+
+    return {
+      user: fullUser,
+      session,
+    };
+  }
 }

src/modules/user/auth/dto/login.dto.ts

@@ -0,0 +1,15 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsEmail, IsNotEmpty, IsString, MinLength } from 'class-validator';
+
+export class UserLoginDto {
+  @ApiProperty({ example: 'user@example.com' })
+  @IsEmail()
+  @IsNotEmpty()
+  email: string;
+
+  @ApiProperty({ example: 'password123' })
+  @IsString()
+  @IsNotEmpty()
+  @MinLength(6)
+  password: string;
+}

src/modules/user/auth/dto/refresh-token.dto.ts

@@ -0,0 +1,9 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+export class UserRefreshTokenDto {
+  @ApiProperty()
+  @IsString()
+  @IsNotEmpty()
+  refreshToken: string;
+}

src/modules/{auth → user/auth}/dto/register.dto.ts

@@ -1,34 +1,41 @@
-import { IsEmail, IsString, MinLength, IsOptional } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
+import {
+  IsEmail,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  MinLength,
+} from 'class-validator';
 
-export class RegisterDto {
-  @ApiProperty({ example: 'user@example.com', required: false })
-  @IsOptional()
+export class UserRegisterDto {
+  @ApiProperty({ example: 'user@example.com' })
   @IsEmail()
-  email?: string;
+  @IsNotEmpty()
+  email: string;
 
-  @ApiProperty({ example: '+1234567890', required: false })
-  @IsOptional()
+  @ApiProperty({ example: 'password123' })
   @IsString()
-  phone?: string;
+  @IsNotEmpty()
+  @MinLength(6)
+  password: string;
 
-  @ApiProperty({ example: '+1', required: false })
-  @IsOptional()
+  @ApiProperty({ example: 'John', required: false })
   @IsString()
-  code?: string;
+  @IsOptional()
+  firstName?: string;
 
-  @ApiProperty({ example: 'John' })
+  @ApiProperty({ example: 'Doe', required: false })
   @IsString()
-  @MinLength(2)
-  firstName: string;
+  @IsOptional()
+  lastName?: string;
 
-  @ApiProperty({ example: 'Doe' })
+  @ApiProperty({ example: '+1234567890', required: false })
   @IsString()
-  @MinLength(2)
-  lastName: string;
+  @IsOptional()
+  phone?: string;
 
-  @ApiProperty({ example: 'password123' })
+  @ApiProperty({ example: '+1', required: false })
   @IsString()
-  @MinLength(6)
-  password: string;
+  @IsOptional()
+  code?: string;
 }

src/modules/{auth/guards/jwt-auth.guard.ts → user/auth/guards/user-auth.guard.ts}

@@ -1,15 +1,18 @@
-import { ExecutionContext, Injectable } from '@nestjs/common';
+import { Injectable, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { AuthGuard } from '@nestjs/passport';
+import { Observable } from 'rxjs';
 import { IS_PUBLIC_KEY } from 'src/shared/decorators/public.decorator';
 
 @Injectable()
-export class JwtAuthGuard extends AuthGuard('jwt') {
-  constructor(private readonly reflector: Reflector) {
+export class UserAuthGuard extends AuthGuard('user-jwt') {
+  constructor(private reflector: Reflector) {
     super();
   }
 
-  canActivate(context: ExecutionContext) {
+  canActivate(
+    context: ExecutionContext,
+  ): boolean | Promise<boolean> | Observable<boolean> {
     const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
       context.getHandler(),
       context.getClass(),

src/modules/user/auth/strategies/user-jwt.strategy.ts

@@ -0,0 +1,56 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { UserCoreService } from 'src/core/user-core/user-core.service';
+import { UserAuthService } from '../auth.service';
+import { Request } from 'express';
+import { jwtAuthConstants, TOKEN_USER_TYPE } from 'src/shared/keys/auth.keys';
+import { User } from '@prisma/client';
+
+@Injectable()
+export class UserJwtStrategy extends PassportStrategy(Strategy, 'user-jwt') {
+  constructor(
+    private readonly userCoreService: UserCoreService,
+    private readonly userAuthService: UserAuthService,
+  ) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: jwtAuthConstants.accessTokenSecret,
+      passReqToCallback: true,
+    });
+  }
+
+  async validate(
+    request: Request & { headers: { authorization: string } },
+    payload: {
+      id: string;
+      email: string;
+      userType: TOKEN_USER_TYPE;
+    },
+  ) {
+    // Verify the user type
+    if (payload.userType !== TOKEN_USER_TYPE.USER) {
+      throw new UnauthorizedException('Invalid token: Not a user token');
+    }
+
+    const user = await this.userCoreService.findUnique({
+      where: { id: payload.id },
+    });
+
+    if (!user || user.isDeleted) {
+      throw new UnauthorizedException('User not found');
+    }
+
+    // Get full session data
+    const sessionData = await this.userAuthService.performJWTStrategy({
+      request: request as any,
+      user: {
+        id: payload.id,
+        email: payload.email,
+      } as User,
+    });
+
+    return sessionData;
+  }
+}

src/modules/user/user.module.ts

@@ -0,0 +1,8 @@
+import { Module } from '@nestjs/common';
+import { UserAuthModule } from './auth/auth.module';
+
+@Module({
+  imports: [UserAuthModule],
+  exports: [UserAuthModule],
+})
+export class UserModule {}

src/shared/decorators/get-session.decorator.ts

@@ -0,0 +1,8 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+
+export const GetSession = createParamDecorator(
+  (data: unknown, ctx: ExecutionContext) => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+  },
+);

src/shared/decorators/get-super-admin.decorator.ts

@@ -0,0 +1,9 @@
+import { createParamDecorator, ExecutionContext } from '@nestjs/common';
+import { SuperAdminSessionType } from '../types/super-admin-session.type';
+
+export const GetSuperAdmin = createParamDecorator(
+  (data: any, ctx: ExecutionContext): SuperAdminSessionType => {
+    const request = ctx.switchToHttp().getRequest();
+    return request.user;
+  },
+);

src/shared/keys/auth.keys.ts

@@ -1,4 +1,5 @@
-import { JwtSignOptions, JwtVerifyOptions } from '@nestjs/jwt';
+import { JwtVerifyOptions } from '@nestjs/jwt';
+import type { StringValue } from 'ms';
 
 export enum TOKEN_TYPE {
   REFRESH = 'REFRESH',
@@ -7,22 +8,25 @@ export enum TOKEN_TYPE {
 
 export enum TOKEN_USER_TYPE {
   USER = 'USER',
+  SUPER_ADMIN = 'SUPER_ADMIN',
 }
 
 export const jwtAuthConstants = {
   accessTokenSecret: process.env.JWT_ACCESS_SECRET || 'default-access-secret',
   refreshTokenSecret:
     process.env.JWT_REFRESH_SECRET || 'default-refresh-secret',
-  accessTokenExpiresIn: process.env.JWT_ACCESS_EXPIRES_IN || '24h',
-  refreshTokenExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || '7d',
+  accessTokenExpiresIn: (process.env.JWT_ACCESS_EXPIRES_IN ||
+    '24h') as StringValue,
+  refreshTokenExpiresIn: (process.env.JWT_REFRESH_EXPIRES_IN ||
+    '7d') as StringValue,
 };
 
-export const refreshTokenSignSettings: JwtSignOptions = {
+export const refreshTokenSignSettings = {
   secret: jwtAuthConstants.refreshTokenSecret,
   expiresIn: jwtAuthConstants.refreshTokenExpiresIn,
 };
 
-export const accessTokenSignSettings: JwtSignOptions = {
+export const accessTokenSignSettings = {
   secret: jwtAuthConstants.accessTokenSecret,
   expiresIn: jwtAuthConstants.accessTokenExpiresIn,
 };

src/shared/keys/super-admin-credential.keys.ts

@@ -0,0 +1,4 @@
+export const SuperAdminCredentialMessages = {
+  NOT_FOUND: 'Super Admin Credential not found',
+  DELETED: 'Super Admin Credential deleted successfully',
+};

src/shared/keys/super-admin-session.keys.ts

@@ -0,0 +1,4 @@
+export const SuperAdminSessionMessages = {
+  NOT_FOUND: 'Super Admin Session not found',
+  DELETED: 'Super Admin Session deleted successfully',
+};

src/shared/keys/super-admin.keys.ts

@@ -0,0 +1,4 @@
+export const SuperAdminMessages = {
+  NOT_FOUND: 'Super Admin not found',
+  DELETED: 'Super Admin deleted successfully',
+};

src/shared/libs/include-filter.helper.ts

@@ -0,0 +1,62 @@
+/**
+ * Security helper to filter includes based on whitelisted relations
+ * Prevents users from accessing sensitive data through unauthorized relation includes
+ */
+
+/**
+ * Filters the include array to only allow whitelisted relations
+ * Silently ignores unauthorized includes without throwing errors
+ *
+ * @param includes - Array of include strings from query parameter (or single string)
+ * @param whitelist - Array of allowed relation names
+ * @returns Filtered array containing only whitelisted includes
+ */
+export function filterAllowedIncludes(
+  includes: string[] | string | undefined,
+  whitelist: string[],
+): string[] {
+  if (!includes) {
+    return [];
+  }
+
+  // Normalize to array (handle single string case)
+  const includesArray = Array.isArray(includes) ? includes : [includes];
+
+  if (includesArray.length === 0) {
+    return [];
+  }
+
+  // Filter includes to only allow whitelisted relations
+  return includesArray.filter((include) => whitelist.includes(include));
+}
+
+/**
+ * Creates a safe query DTO with only whitelisted includes
+ * Preserves all other query parameters (skip, take, orderBy, search, etc.)
+ *
+ * @param query - Original query DTO from request (BaseQueryCoreDto or CoreIncludesDto)
+ * @param whitelist - Array of allowed relation names
+ * @returns New query DTO with filtered includes and all other params preserved
+ */
+export function createSafeIncludesDto(query: any, whitelist: string[]): any {
+  if (!query) {
+    return {};
+  }
+
+  const filteredIncludes = filterAllowedIncludes(query?.include, whitelist);
+
+  // Create a new object with all properties except include
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  const { include, ...otherParams } = query;
+
+  // Only add include if there are filtered includes
+  if (filteredIncludes.length > 0) {
+    return {
+      ...otherParams,
+      include: filteredIncludes,
+    };
+  }
+
+  // Return without include field if no filtered includes
+  return otherParams;
+}

src/shared/libs/prisma-base.repository.ts

@@ -28,6 +28,11 @@ export abstract class PrismaBaseRepository<
   DeleteArgs extends { where: Record<string, any> },
   DeleteManyArgs extends { where?: Record<string, any> },
   CountArgs extends { where?: Record<string, any> },
+  UpsertArgs extends {
+    where: Record<string, any>;
+    create: Record<string, any>;
+    update: Record<string, any>;
+  },
 > {
   constructor(
     private readonly repo: any,
@@ -169,6 +174,14 @@ export abstract class PrismaBaseRepository<
     query: CoreIncludesDto,
   ): Promise<ModelEntity> {
     const updatedQuery = this.baseQueryCoreService.generatePrismaQuery(query);
+
+    // Automatically add isDeleted: false filter to related entities
+    if (updatedQuery.include) {
+      updatedQuery.include = this.addDeletedFilterToIncludes(
+        updatedQuery.include,
+      );
+    }
+
     const returnData = await safePrismaCall(() =>
       this.repo.findUnique({ ...params, ...updatedQuery }),
     ).catch(() => {
@@ -180,11 +193,69 @@ export abstract class PrismaBaseRepository<
     return returnData;
   }
 
+  /**
+   * Helper method to automatically add isDeleted: false filter to related entities
+   */
+  private addDeletedFilterToIncludes(include: any): any {
+    if (!include) return include;
+
+    const result = { ...include };
+
+    // List of relations that have isDeleted field
+    const relationsWithDeletedField = [
+      'sessions',
+      'credentials',
+      'user',
+      'superAdmin',
+    ];
+
+    for (const key in result) {
+      if (result.hasOwnProperty(key)) {
+        if (relationsWithDeletedField.includes(key)) {
+          // Add isDeleted: false filter for this relation
+          if (result[key] === true) {
+            result[key] = {
+              where: {
+                isDeleted: false,
+              },
+            };
+          } else if (typeof result[key] === 'object' && result[key] !== null) {
+            // If it's already an object, merge the where condition
+            if (!result[key].where) {
+              result[key].where = {};
+            }
+            result[key].where.isDeleted = false;
+
+            // Recursively apply to nested includes
+            if (result[key].include) {
+              result[key].include = this.addDeletedFilterToIncludes(
+                result[key].include,
+              );
+            }
+          }
+        } else if (typeof result[key] === 'object' && result[key] !== null) {
+          // Recursively apply to nested includes
+          result[key] = this.addDeletedFilterToIncludes(result[key]);
+        }
+      }
+    }
+
+    return result;
+  }
+
   async findFirstIncludes(
     params: FindFirstArgs,
     query: CoreIncludesDto,
   ): Promise<ModelEntity> {
     const updatedQuery = this.baseQueryCoreService.generatePrismaQuery(query);
+
+    // Automatically add isDeleted: false filter to related entities
+    if (updatedQuery.include) {
+      updatedQuery.include = this.addDeletedFilterToIncludes(
+        updatedQuery.include,
+      );
+    }
+
     const returnData = await safePrismaCall(() =>
       this.repo.findFirst({ ...params, ...updatedQuery }),
     ).catch(() => {
@@ -195,4 +266,18 @@ export abstract class PrismaBaseRepository<
     }
     return returnData;
   }
+
+  async findManyIncludes(
+    params: FindManyArgs,
+    query: CoreIncludesDto,
+  ): Promise<ModelEntity[]> {
+    const updatedQuery = this.baseQueryCoreService.generatePrismaQuery(query);
+    return safePrismaCall(() =>
+      this.repo.findMany({ ...params, ...updatedQuery }),
+    );
+  }
+
+  async upsert(params: UpsertArgs): Promise<ModelEntity> {
+    return safePrismaCall(() => this.repo.upsert(params));
+  }
 }

src/shared/modules/prisma/safe-prisma-call.ts

@@ -1,18 +1,25 @@
 import * as os from 'os';
-const pLimit = require('p-limit');
 
 // Auto-scale concurrency limit: e.g., 10 Prisma queries per CPU core
 const cpuCores = os.cpus().length;
-const prismaConcurrencyLimit = pLimit(cpuCores * 10);
+const concurrencyLimit = cpuCores * 10;
 
-console.log(
-  `[safePrismaCall] Limiting Prisma concurrency to ${
-    cpuCores * 10
-  } (based on ${cpuCores} CPU cores)`,
-);
+// Dynamic import for ESM-only p-limit package
+let prismaConcurrencyLimit: <T>(fn: () => Promise<T>) => Promise<T>;
+
+// Initialize p-limit with dynamic import
+const initPLimit = (async () => {
+  const pLimit = (await import('p-limit')).default;
+  prismaConcurrencyLimit = pLimit(concurrencyLimit);
+  console.log(
+    `[safePrismaCall] Limiting Prisma concurrency to ${concurrencyLimit} (based on ${cpuCores} CPU cores)`,
+  );
+})();
 
 export async function safePrismaCall<T = any>(
   fn: () => Promise<T>,
 ): Promise<T> {
+  // Ensure p-limit is initialized before first use
+  await initPLimit;
   return prismaConcurrencyLimit(fn);
 }

src/shared/types/super-admin-session.type.ts

@@ -0,0 +1,6 @@
+import { SuperAdmin, SuperAdminSession } from '@prisma/client';
+
+export type SuperAdminSessionType = {
+  superAdmin: SuperAdmin;
+  session: SuperAdminSession;
+};

src/swagger-setup.ts

@@ -1,38 +1,42 @@
 import { INestApplication } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
+import { execSync } from 'child_process';
 const basicAuth = require('express-basic-auth');
 
+const getBranchName = (): string => {
+  try {
+    return execSync('git rev-parse --abbrev-ref HEAD', {
+      encoding: 'utf8',
+      cwd: process.cwd(),
+    }).trim();
+  } catch (error: any) {
+    console.warn('Could not get git branch name:', error.message);
+    return 'unknown';
+  }
+};
+
 export const setupSwagger = (app: INestApplication) => {
-  const configService = app.get(ConfigService);
-  const swaggerPassword = configService.get('SWAGGER_PASSWORD');
+  const swaggerPassword = app.get(ConfigService).get('SWAGGER_PASSWORD');
 
-  if (swaggerPassword) {
-    app.use(
-      ['/api'],
-      basicAuth({
-        challenge: true,
-        users: { admin: swaggerPassword },
-      }),
-    );
-  }
+  app.use(
+    ['/api'],
+    basicAuth({
+      challenge: true,
+      users: { admin: swaggerPassword },
+    }),
+  );
 
   const config = new DocumentBuilder()
-    .setTitle('API Documentation')
-    .setDescription('The API description')
-    .setVersion('1.0')
-    .addBearerAuth({
-      type: 'http',
-      scheme: 'bearer',
-      bearerFormat: 'JWT',
-      name: 'JWT',
-      description: 'Enter JWT token',
-      in: 'header',
-    })
+    .addBearerAuth()
+    .setTitle(`StreamFlix API: ${getBranchName()}`)
+    .setDescription('The StreamFlix API documentation')
+    .setVersion('1.0.0')
     .build();
 
   const document = SwaggerModule.createDocument(app, config);
   SwaggerModule.setup('api', app, document, {
+    customCss: '.swagger-ui { background: #E6F3FF; }',
     swaggerOptions: {
       persistAuthorization: true,
     },