From c09d3723c3052a1fd2f060be26db0ceeab4d56ba Mon Sep 17 00:00:00 2001
From: john kevin asprec <kevina@wincollect.com>
Date: Tue, 16 Jun 2026 22:33:02 +0800
Subject: [PATCH] feat: implement admin authentication services and tenant
 impersonation logic

---
 src/auth/auth.service.ts               | 4 +++-
 src/impersonate/impersonate.service.ts | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/auth/auth.service.ts b/src/auth/auth.service.ts
index accc86f..70881a9 100644
--- a/src/auth/auth.service.ts
+++ b/src/auth/auth.service.ts
@@ -6,6 +6,7 @@ import {
 import { JwtService } from '@nestjs/jwt';
 import { ConfigService } from '@nestjs/config';
 import * as bcrypt from 'bcrypt';
+import { randomUUID } from 'crypto';
 import { AdminPrismaService } from '../prisma/admin-prisma.service';
 
 @Injectable()
@@ -119,6 +120,7 @@ export class AuthService {
       sub: adminId,
       email,
       type: 'super_admin',
+      jti: randomUUID(),
     });
 
     const refreshSecret = this.config.get<string>(
@@ -131,7 +133,7 @@ export class AuthService {
     );
 
     const refreshToken = this.jwt.sign(
-      { sub: adminId, email, type: 'super_admin' },
+      { sub: adminId, email, type: 'super_admin', jti: randomUUID() },
       {
         secret: refreshSecret,
         expiresIn: refreshExpiresIn as any,
diff --git a/src/impersonate/impersonate.service.ts b/src/impersonate/impersonate.service.ts
index 4077922..720ca63 100644
--- a/src/impersonate/impersonate.service.ts
+++ b/src/impersonate/impersonate.service.ts
@@ -15,7 +15,7 @@ export class ImpersonateService {
     private readonly audit: AuditService,
   ) {
     // Use the MAIN API's JWT secret so the token works with the tenant API
-    this.mainJwtSecret = this.config.get<string>('JWT_SECRET', 'dev-jwt-secret-not-for-production');
+    this.mainJwtSecret = this.config.get<string>('MAIN_API_JWT_SECRET', 'your-secret-key');
   }
 
   async startImpersonation(tenantId: string, adminId: string, adminName: string) {