feat: implement role-based login validation to restrict user/agent portal access

src/auth/auth.service.ts

@@ -168,6 +168,20 @@ export class AuthService {
       throw new UnauthorizedException('Invalid email or password');
     }
 
+    // Role-based login validation (only when loginRole is provided from web/mobile tabs)
+    if (dto.loginRole) {
+      if (dto.loginRole === 'USER' && user.role === UserRole.AGENT) {
+        throw new UnauthorizedException(
+          'This email is registered as an Agent. Please use the Agent tab to sign in.',
+        );
+      }
+      if (dto.loginRole === 'AGENT' && user.role === UserRole.USER) {
+        throw new UnauthorizedException(
+          'This email is registered as a User. Please use the User tab to sign in.',
+        );
+      }
+    }
+
     // Check if 2FA is enabled
     if (user.twoFactorEnabled) {
       // Generate temporary token for 2FA verification

src/auth/dto/login.dto.ts

@@ -1,4 +1,4 @@
-import { IsEmail, IsString, MinLength } from 'class-validator';
+import { IsEmail, IsOptional, IsString, MinLength } from 'class-validator';
 import { ApiProperty } from '@nestjs/swagger';
 
 export class LoginDto {
@@ -16,4 +16,13 @@ export class LoginDto {
   @IsString()
   @MinLength(1, { message: 'Password is required' })
   password: string;
+
+  @ApiProperty({
+    required: false,
+    enum: ['USER', 'AGENT'],
+    description: 'Which login tab the user selected (User or Agent)',
+  })
+  @IsOptional()
+  @IsString()
+  loginRole?: string;
 }