updates oauth with new access list for kyb

Changelog.md

@@ -1,9 +1,13 @@
 # Changelog
 
 ## [Unreleased]
+## [3.15.0] - 2026-07-16
+### Added
+- Added new access for `/oauth` api for access kyb apis by thirdparty customer.
+- Added `businessId` as optional query parameter in `/oauth` api.
 ## [3.14.0] - 2026-07-14
 ### Changed
-- Added a way to trac credit issuer.
+- Added a way to trak credit issuer.
 
 ## [3.13.1] - 2026-07-06
 ### Changed

src/app-auth/services/app-auth.service.ts

@@ -32,7 +32,7 @@ import { UserRole } from 'src/user/schema/user.schema';
 import { WebPageConfigRepository } from 'src/webpage-config/repositories/webpage-config.repository';
 import { InjectModel } from '@nestjs/mongoose';
 import { CustomerOnboarding } from 'src/customer-onboarding/schemas/customer-onboarding.schema';
-import { Model } from 'mongoose';
+import { Model, Types } from 'mongoose';
 import {
   DNS_RESOLVER_URL,
   evaluateAccessPolicy,
@@ -760,8 +760,12 @@ export class AppAuthService {
     appSecreatKey: string,
     expiresin = 4,
     grantType,
+    businessId?: string,
   ): Promise<{ access_token; expiresIn; tokenType }> {
     Logger.log('generateAccessToken() method: starts....', 'AppAuthService');
+    if (businessId && !Types.ObjectId.isValid(businessId)) {
+      throw new BadRequestException(['Invalid business ID']);
+    }
     const apikeyIndex = appSecreatKey.split('.')[0];
     const appDetail = await this.appRepository.findOne({
       apiKeyPrefix: apikeyIndex,
@@ -815,6 +819,7 @@ export class AppAuthService {
         grantType: grantType || sessionJson.grantType,
         subdomain: sessionJson.subdomain,
         sessionId: redisKey,
+        ...(businessId && { businessId }),
       };
       return this.getAccessToken(jwtPayload, expiresin);
     }
@@ -886,6 +891,7 @@ export class AppAuthService {
       grantType: grant_type,
       subdomain: appDetail.subdomain,
       sessionId: redisKey,
+      ...(businessId && { businessId }),
     };
     await this.storeDataInRedis(grant_type, appDetail, accessList, redisKey);
     return this.getAccessToken(jwtPayload, expiresin);

src/app-oauth/app-oauth.controller.ts

@@ -81,19 +81,22 @@ export class AppOauthController {
     required: false,
     enum: GRANT_TYPES,
   })
+  @ApiQuery({ name: 'businessId', required: false, type: String })
   @UsePipes(ValidationPipe)
   generateAccessToken(
     @Headers('X-Api-Secret-Key') apiSectretKey: string,
     @AppSecretHeader() appSecreatKey,
     @Headers('ExpiresIn') oauthexpiresin: string,
     @OauthTokenExpiryHeader() expiresin,
     @Query('grant_type') grantType,
+    @Query('businessId') businessId?: string,
   ): Promise<{ access_token; expiresIn; tokenType }> {
     Logger.log('generateAccessToken() method: starts', 'AppOAuthController');
     return this.appAuthService.generateAccessToken(
       appSecreatKey,
       expiresin,
       grantType,
+      businessId
     );
   }
 

src/config/access-matrix.ts

@@ -79,7 +79,19 @@ export const CAVACH_KYB_ACCESS_MATRIX = {
     SERVICES.CAVACH_API.ACCESS_TYPES.DELETE_DOCUMENT,
     SERVICES.CAVACH_API.ACCESS_TYPES.READ_WIDGET_CONFIG,
   ],
-  [TokenModule.APP_AUTH]: [],
+  [TokenModule.APP_AUTH]: [
+    SERVICES.CAVACH_API.ACCESS_TYPES.READ_COMPANY,
+    SERVICES.CAVACH_API.ACCESS_TYPES.WRITE_COMPANY,
+    SERVICES.CAVACH_API.ACCESS_TYPES.UPDATE_COMPANY,
+    SERVICES.CAVACH_API.ACCESS_TYPES.WRITE_COMPANY_EXECUTIVES,
+    SERVICES.CAVACH_API.ACCESS_TYPES.READ_COMPANY_EXECUTIVES,
+    SERVICES.CAVACH_API.ACCESS_TYPES.UPDATE_COMPANY_EXECUTIVES,
+    SERVICES.CAVACH_API.ACCESS_TYPES.DELETE_COMPANY_EXECUTIVES,
+    SERVICES.CAVACH_API.ACCESS_TYPES.WRITE_DOCUMENT,
+    SERVICES.CAVACH_API.ACCESS_TYPES.READ_DOCUMENT,
+    SERVICES.CAVACH_API.ACCESS_TYPES.DELETE_DOCUMENT,
+    SERVICES.CAVACH_API.ACCESS_TYPES.READ_COMPLIANCE,
+  ],
   [TokenModule.SUPER_ADMIN]: [
     SERVICES.CAVACH_API.ACCESS_TYPES.WRITE_COMPLIANCE,
     SERVICES.CAVACH_API.ACCESS_TYPES.UPDATE_COMPANY_STATUS,