fix: remove hardcoded JWT secrets, add auth guards, and implement password reset

[OladipupuHussein7]

Summary

This PR addresses three critical authentication and security issues:

BE-111: Hardcoded fallback JWT secrets in AuthService and JwtStrategy

• Removed all hardcoded fallback secrets from auth.service.ts, jwt.strategy.ts, and auth.module.ts
• App now fails fast at startup with a descriptive error if JWT_SECRET or JWT_REFRESH_SECRET are missing or shorter than 32 characters
• No source file contains a literal fallback secret anymore

BE-112: Twelve controllers have no authentication guard at all

• Added @UseGuards(JwtAuthGuard) to all 12 unguarded controllers:
  • branches, vendors, purchase-orders, transfers, departments, categories, locations, inventory, audits, maintenance, asset-maintenance, licenses, notes-docs
• Every route on these controllers now requires a valid JWT token

BE-113: AuthService.forgotPassword() is a no-op stub; there is no resetPassword endpoint

• forgotPassword() now generates a cryptographically random, single-use, time-limited (1 hour) reset token
• Token is hashed and stored on the User entity with an expiry timestamp
• Added POST /auth/reset-password endpoint that validates and consumes the token
• Reset tokens are automatically invalidated when the user changes their password via updateMe()

Closes #1253
Closes #1254
Closes #1255
Closed #1120

[vercel]

@OladipupuHussein7 is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@OladipupuHussein7 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[yusuftomilola]

Reviewed. Strong security hardening overall:

• Removed hardcoded fallback JWT secrets ('secretKey' / 'refreshSecretKey') from auth.service.ts, auth.module.ts, and jwt.strategy.ts — previously anyone could forge valid tokens using the well-known default if the env var was ever unset. Now main.ts fails fast at boot if JWT_SECRET/JWT_REFRESH_SECRET are missing or under 32 characters, so the app can no longer run with a weak/missing secret.
• Real password-reset flow: random 32-byte token, hashed before storage, 1-hour expiry checked on use, bcrypt for the new password, and the reset token is cleared after use or after a normal password change.
• @UseGuards(JwtAuthGuard) added to branches, categories, departments, inventory, licenses, locations, maintenance, audits, notes-docs, transfers, purchase-orders, and vendors controllers — these were previously reachable with no authentication at all.

Found and fixed one issue before merging: forgotPassword() was returning the raw resetToken directly in the API response in all environments (comment said 'In production, send via email' but nothing gated it) — that's an unauthenticated account-takeover path for anyone who knows a user's email. Pushed a fix gating the token behind NODE_ENV !== 'production', matching the existing Swagger-gating convention in main.ts. Also worth a follow-up (not fixed here, lower severity): forgotPassword currently 404s for unknown emails vs 200 for known ones, which lets an attacker enumerate registered emails — the common fix is to return the same generic response either way.

Approving.