From 02a1f153246e9aae632f9992f1aaf27c77f2ae8e Mon Sep 17 00:00:00 2001
From: pradeepkumar <kongupradeep@live.com>
Date: Mon, 13 Apr 2026 20:26:14 +0530
Subject: [PATCH] feat: implement role-based login validation to restrict
 user/agent portal access

---
 src/auth/auth.service.ts  | 14 ++++++++++++++
 src/auth/dto/login.dto.ts | 11 ++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/auth/auth.service.ts b/src/auth/auth.service.ts
index 914e23b..d0384b4 100644
--- a/src/auth/auth.service.ts
+++ b/src/auth/auth.service.ts
@@ -168,6 +168,20 @@ export class AuthService {
       throw new UnauthorizedException('Invalid email or password');
     }
 
+    // Role-based login validation (only when loginRole is provided from web/mobile tabs)
+    if (dto.loginRole) {
+      if (dto.loginRole === 'USER' && user.role === UserRole.AGENT) {
+        throw new UnauthorizedException(
+          'This email is registered as an Agent. Please use the Agent tab to sign in.',
+        );
+      }
+      if (dto.loginRole === 'AGENT' && user.role === UserRole.USER) {
+        throw new UnauthorizedException(
+          'This email is registered as a User. Please use the User tab to sign in.',
+        );
+      }
+    }
+
     // Check if 2FA is enabled
     if (user.twoFactorEnabled) {
       // Generate temporary token for 2FA verification
diff --git a/src/auth/dto/login.dto.ts b/src/auth/dto/login.dto.ts
index 2d23661..f0a2240 100644
--- a/src/auth/dto/login.dto.ts
+++ b/src/auth/dto/login.dto.ts
@@ -1,4 +1,4 @@
-import { IsEmail, IsString, MinLength } from 'class-validator';
+import { IsEmail, IsOptional, IsString, MinLength } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
 
 export class LoginDto {
@@ -16,4 +16,13 @@ export class LoginDto {
   @IsString()
   @MinLength(1, { message: 'Password is required' })
   password: string;
+
+  @ApiProperty({
+    required: false,
+    enum: ['USER', 'AGENT'],
+    description: 'Which login tab the user selected (User or Agent)',
+  })
+  @IsOptional()
+  @IsString()
+  loginRole?: string;
 }