fix: comprehensive code quality improvements across all packages

Security:
- Fix RolesGuard to use singular user.role instead of user.roles
- Read emailVerified/isActive from JWT payload instead of hardcoding true
- Extract userId from JWT via @currentuser decorator in OTP controller
- Add path traversal prevention in template service
- Remove dead oldRecord code in audit middleware
- Document auth guard requirements on unguarded controllers

Data integrity & BullMQ:
- Add job cleanup options (removeOnComplete/removeOnFail) to prevent Redis leak
- Fix duplicate notification record for in-app channel
- Add retry/backoff (3 attempts, exponential 5s) to all queues
- Close queue connections on module shutdown
- Only mark status='failed' on final retry attempt
- Add optional model scoping to soft-delete middleware

Feature flag parity:
- Add runtime feature guards for forRootAsync controllers (auth, storage,
  audit-log, notifications) that return 404 when features are disabled

Constants & type safety:
- Export PRISMA_SERVICE constant, replace 30+ string literals across packages
- Add ROLES, VERIFICATION_TOKEN_TYPES, AUTH_PROVIDERS constants (auth)
- Add NOTIFICATION_STATUSES, NOTIFICATION_CHANNELS constants (notifications)
- Add @isin() DTO validation for role, platform, and channel fields
- Change StorageService.validateFile to throw BadRequestException
- Replace Promise<any> with concrete types in OrganizationService

Code reuse:
- Extract BaseCodeOtpProvider with shared verify/hash/generate logic
- Extract BaseNotificationProcessor with processWithStatusTracking()
- Extract buildRedisConnection() helper in notification module
- Extract validateAndConsumeToken() and toAuthenticatedUser() in auth service
- Standardize OTP event emission to async with error handling
- Deduplicate rate limiting (guard delegates to OtpService.checkRateLimit)

Efficiency:
- Parallelize getEnabledMethods queries with Promise.all
- Fix double getEnabledMethods call in auth login
- Make template service use async file reads (fs.promises)
- Add bounded template cache (max 100 entries, FIFO eviction)
- Add pagination limits to unbounded queries (findAll, findByEntity, sessions)
- Add select clauses to register/getProfile/org-member queries
- Fix double useFactory in auth module forRootAsync

Cleanup:
- Remove dead ChangePasswordDto and empty SetupTotpDto
- Rename HttpExceptionFilter to AllExceptionsFilter (with backward-compat alias)
- Import event interfaces from shared file instead of re-declaring

Author: JonatanSalas

apps/demo/test/app.e2e-spec.ts

@@ -1,12 +1,10 @@
 import { AuditLogController } from './audit-log.controller';
 import { AuditLogService } from './audit-log.service';
-import { AuditLogModuleOptions } from './interfaces';
 import { AuditLogQueryDto } from './dto/audit-log-query.dto';
 
 describe('AuditLogController', () => {
   let controller: AuditLogController;
   let mockAuditLogService: jest.Mocked<Pick<AuditLogService, 'findAll' | 'findById' | 'findByEntity'>>;
-  let mockOptions: AuditLogModuleOptions;
 
   beforeEach(() => {
     mockAuditLogService = {
@@ -21,14 +19,8 @@ describe('AuditLogController', () => {
       findByEntity: jest.fn().mockResolvedValue([]),
     };
 
-    mockOptions = {
-      features: { registerController: true },
-      adminRoles: ['ADMIN'],
-    };
-
     controller = new AuditLogController(
       mockAuditLogService as any,
-      mockOptions,
     );
   });
 
@@ -53,7 +45,7 @@ describe('AuditLogController', () => {
         action: undefined,
         startDate: undefined,
         endDate: undefined,
-        page: 0,
+        page: 1,
         limit: 10,
       });
     });
@@ -80,7 +72,7 @@ describe('AuditLogController', () => {
         action: 'UPDATE',
         startDate: new Date(startDate),
         endDate: new Date(endDate),
-        page: 2,
+        page: 3,
         limit: 10,
       });
     });
@@ -99,7 +91,7 @@ describe('AuditLogController', () => {
         action: 'CREATE',
         startDate: undefined,
         endDate: undefined,
-        page: 1,
+        page: 2,
         limit: 10,
       });
     });

packages/nestjs-audit-log/src/audit-log.controller.spec.ts

@@ -3,7 +3,7 @@ import {
   Get,
   Param,
   Query,
-  Inject,
+  UseGuards,
 } from '@nestjs/common';
 import {
   ApiTags,
@@ -13,17 +13,17 @@ import {
   ApiParam,
 } from '@nestjs/swagger';
 import { AuditLogService } from './audit-log.service';
-import { AUDIT_LOG_MODULE_OPTIONS, AuditLogModuleOptions } from './interfaces';
+import { AuditLogFeatureGuard } from './guards/feature-enabled.guard';
 import { AuditLogQueryDto } from './dto/audit-log-query.dto';
 
+/** Requires a global authentication guard (e.g., JwtAuthGuard). Guard enforcement is the consumer's responsibility. */
 @ApiTags('Audit Logs')
 @ApiBearerAuth()
+@UseGuards(AuditLogFeatureGuard)
 @Controller('audit-logs')
 export class AuditLogController {
   constructor(
     private readonly auditLogService: AuditLogService,
-    @Inject(AUDIT_LOG_MODULE_OPTIONS)
-    private readonly options: AuditLogModuleOptions,
   ) {}
 
   @Get()

packages/nestjs-audit-log/src/audit-log.controller.ts

@@ -1,4 +1,5 @@
 import { Test, TestingModule } from '@nestjs/testing';
+import { PRISMA_SERVICE, createMockPrismaService } from '@bbv/nestjs-prisma';
 import { AuditLogService } from './audit-log.service';
 import { AUDIT_LOG_MODULE_OPTIONS, AuditLogModuleOptions } from './interfaces';
 
@@ -8,15 +9,12 @@ describe('AuditLogService', () => {
   let mockOptions: AuditLogModuleOptions;
 
   beforeEach(async () => {
-    mockPrisma = {
-      auditLog: {
-        create: jest.fn().mockResolvedValue({ id: 'log-1' }),
-        findMany: jest.fn().mockResolvedValue([]),
-        findUnique: jest.fn().mockResolvedValue(null),
-        count: jest.fn().mockResolvedValue(0),
-        deleteMany: jest.fn().mockResolvedValue({ count: 0 }),
-      },
-    };
+    mockPrisma = createMockPrismaService();
+    mockPrisma.auditLog.create.mockResolvedValue({ id: 'log-1' });
+    mockPrisma.auditLog.findMany.mockResolvedValue([]);
+    mockPrisma.auditLog.findUnique.mockResolvedValue(null);
+    mockPrisma.auditLog.count.mockResolvedValue(0);
+    mockPrisma.auditLog.deleteMany.mockResolvedValue({ count: 0 });
 
     mockOptions = {
       features: {
@@ -31,7 +29,7 @@ describe('AuditLogService', () => {
     const module: TestingModule = await Test.createTestingModule({
       providers: [
         AuditLogService,
-        { provide: 'PRISMA_SERVICE', useValue: mockPrisma },
+        { provide: PRISMA_SERVICE, useValue: mockPrisma },
         { provide: AUDIT_LOG_MODULE_OPTIONS, useValue: mockOptions },
       ],
     }).compile();
@@ -225,6 +223,7 @@ describe('AuditLogService', () => {
       expect(mockPrisma.auditLog.findMany).toHaveBeenCalledWith({
         where: { entity: 'Claim', entityId: 'c-1' },
         orderBy: { createdAt: 'desc' },
+        take: 50,
       });
     });
 

packages/nestjs-audit-log/src/audit-log.service.spec.ts

@@ -1,4 +1,5 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
+import { PRISMA_SERVICE } from '@bbv/nestjs-prisma';
 import {
   AuditLogEntry,
   AuditLogModuleOptions,
@@ -11,7 +12,7 @@ export class AuditLogService {
   private readonly logger = new Logger(AuditLogService.name);
 
   constructor(
-    @Inject('PRISMA_SERVICE') private readonly prisma: any,
+    @Inject(PRISMA_SERVICE) private readonly prisma: any,
     @Inject(AUDIT_LOG_MODULE_OPTIONS)
     private readonly options: AuditLogModuleOptions,
   ) {}
@@ -108,6 +109,7 @@ export class AuditLogService {
     return this.prisma.auditLog.findMany({
       where: { entity, entityId },
       orderBy: { createdAt: 'desc' },
+      take: 50,
     });
   }
 

packages/nestjs-audit-log/src/audit-log.service.ts

@@ -0,0 +1,34 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Inject,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { AUDIT_LOG_MODULE_OPTIONS, AuditLogModuleOptions } from '../interfaces';
+
+/**
+ * Guard that checks if the `registerController` feature is enabled in the
+ * resolved audit-log module options.  When used with `forRootAsync`, the
+ * controller is always registered (NestJS limitation), so this guard provides
+ * runtime parity with the `forRoot` path which conditionally registers the
+ * controller at declaration time.
+ *
+ * If the feature is disabled the guard throws a `NotFoundException` so the
+ * route behaves as if it does not exist.
+ */
+@Injectable()
+export class AuditLogFeatureGuard implements CanActivate {
+  constructor(
+    @Inject(AUDIT_LOG_MODULE_OPTIONS)
+    private readonly options: AuditLogModuleOptions,
+  ) {}
+
+  canActivate(_context: ExecutionContext): boolean {
+    if (!this.options.features?.registerController) {
+      throw new NotFoundException();
+    }
+
+    return true;
+  }
+}

packages/nestjs-audit-log/src/guards/feature-enabled.guard.ts

@@ -1,6 +1,7 @@
 export { AuditLogModule } from './audit-log.module';
 export { AuditLogService } from './audit-log.service';
 export { AuditLogController } from './audit-log.controller';
+export { AuditLogFeatureGuard } from './guards/feature-enabled.guard';
 export { AuditLogQueryDto } from './dto/audit-log-query.dto';
 export {
   Audited,

packages/nestjs-audit-log/src/index.ts

@@ -100,6 +100,16 @@ export function createAuditMiddleware(
   };
 }
 
+/**
+ * Handles UPDATE audit logging.
+ *
+ * TODO: Change tracking (old vs new values) requires a reference to the Prisma client
+ * instance to fetch the record before the update. The Prisma middleware `params` object
+ * does not expose the client, so `old` values are not available. Currently, only the
+ * new values from the update data are logged. To enable full change tracking, the
+ * consuming application would need to pass the Prisma client into the audit middleware
+ * factory, or use Prisma's `$extends` client extension API instead of middleware.
+ */
 async function handleUpdate(
   params: any,
   next: (params: any) => Promise<any>,
@@ -108,20 +118,6 @@ async function handleUpdate(
   context: AuditContext | undefined,
   excludeFields: Set<string>,
 ): Promise<any> {
-  let oldRecord: Record<string, unknown> | undefined;
-
-  try {
-    const prisma = params.__internalParams?.prisma ?? params.dataPath?.[0];
-
-    if (params.args?.where) {
-      oldRecord = await (params as any).__internalParams?.transaction
-        ? undefined
-        : undefined;
-    }
-  } catch {
-    // If we cannot fetch old record, continue without it
-  }
-
   const result = await next(params);
 
   const changes: Record<string, { old: unknown; new: unknown }> = {};
@@ -134,7 +130,7 @@ async function handleUpdate(
 
     if (newValue !== undefined) {
       changes[key] = {
-        old: oldRecord?.[key] ?? null,
+        old: null,
         new: newValue,
       };
     }

packages/nestjs-audit-log/src/middleware/prisma-audit.middleware.ts

@@ -65,7 +65,6 @@ export class AuthModule {
         ...(asyncOptions.imports ?? []),
         PassportModule.register({ defaultStrategy: 'jwt' }),
         JwtModule.registerAsync({
-          imports: asyncOptions.imports,
           useFactory: async (...args: any[]) => {
             const options = await asyncOptions.useFactory(...args);
             return {
@@ -76,6 +75,7 @@ export class AuthModule {
             };
           },
           inject: asyncOptions.inject ?? [],
+          imports: asyncOptions.imports ?? [],
         }),
       ],
       controllers: [AuthController, OrganizationController],

packages/nestjs-auth/src/auth.module.ts

@@ -4,6 +4,7 @@ import { EventEmitter2 } from '@nestjs/event-emitter';
 import { Test, TestingModule } from '@nestjs/testing';
 import * as bcrypt from 'bcryptjs';
 
+import { PRISMA_SERVICE } from '@bbv/nestjs-prisma';
 import { AuthService } from './auth.service';
 import { AUTH_MODULE_OPTIONS, AuthModuleOptions } from './interfaces';
 import { AUTH_EVENTS } from './events';
@@ -54,7 +55,7 @@ describe('AuthService - Event Emission', () => {
       providers: [
         AuthService,
         { provide: AUTH_MODULE_OPTIONS, useValue: defaultOptions },
-        { provide: 'PRISMA_SERVICE', useValue: mockPrismaService },
+        { provide: PRISMA_SERVICE, useValue: mockPrismaService },
         { provide: JwtService, useValue: mockJwtService },
         { provide: EventEmitter2, useValue: mockEventEmitter },
       ],
@@ -111,7 +112,7 @@ describe('AuthService - Event Emission', () => {
               features: { ...defaultOptions.features, emailVerification: false },
             },
           },
-          { provide: 'PRISMA_SERVICE', useValue: mockPrismaService },
+          { provide: PRISMA_SERVICE, useValue: mockPrismaService },
           { provide: JwtService, useValue: mockJwtService },
           { provide: EventEmitter2, useValue: mockEventEmitter },
         ],
@@ -223,7 +224,7 @@ describe('AuthService - Event Emission', () => {
         providers: [
           AuthService,
           { provide: AUTH_MODULE_OPTIONS, useValue: defaultOptions },
-          { provide: 'PRISMA_SERVICE', useValue: mockPrismaService },
+          { provide: PRISMA_SERVICE, useValue: mockPrismaService },
           { provide: JwtService, useValue: mockJwtService },
         ],
       }).compile();