@flusys/nestjs-auth 6.0.0 → 6.0.2

package/cjs/entities/company-branch.entity.js

@@ -139,10 +139,9 @@ _ts_decorate([
 _ts_decorate([
     (0, _typeorm.Column)({
         name: 'company_id',
-        type: 'uuid',
-        nullable: true
+        type: 'uuid'
     }),
-    _ts_metadata("design:type", Object)
+    _ts_metadata("design:type", String)
 ], CompanyBranch.prototype, "companyId", void 0);
 _ts_decorate([
     (0, _typeorm.ManyToOne)(()=>_companyentity.Company, (company)=>company.branches, {

package/cjs/services/authentication.service.js

@@ -591,7 +591,10 @@ let AuthenticationService = class AuthenticationService {
     async refreshToken(refreshToken) {
         try {
             const payload = this.jwtService.verify(refreshToken, {
-                secret: this.authConfig.getRefreshTokenSecret()
+                secret: this.authConfig.getRefreshTokenSecret(),
+                algorithms: [
+                    'HS256'
+                ]
             });
             if (await this.isTokenRevoked(payload.id, payload.iat)) {
                 throw new _common.UnauthorizedException({
@@ -943,14 +946,16 @@ let AuthenticationService = class AuthenticationService {
             type: 'access'
         }, {
             secret: this.authConfig.getJwtSecret(),
-            expiresIn: this.authConfig.getJwtExpiration()
+            expiresIn: this.authConfig.getJwtExpiration(),
+            algorithm: 'HS256'
         });
         const refreshToken = this.jwtService.sign({
             ...payload,
             type: 'refresh'
         }, {
             secret: this.authConfig.getRefreshTokenSecret(),
-            expiresIn: this.authConfig.getRefreshTokenExpiration()
+            expiresIn: this.authConfig.getRefreshTokenExpiration(),
+            algorithm: 'HS256'
         });
         return {
             accessToken,

package/cjs/services/branch.service.js

@@ -9,10 +9,13 @@ Object.defineProperty(exports, "BranchService", {
     }
 });
 const _classes = require("@flusys/nestjs-shared/classes");
+const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _modules = require("@flusys/nestjs-shared/modules");
 const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
+const _typeorm = require("typeorm");
 const _companybranchentity = require("../entities/company-branch.entity");
+const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
 const _authconfigservice = require("./auth-config.service");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 function _define_property(obj, key, value) {
@@ -43,6 +46,27 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let BranchService = class BranchService extends _classes.ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const branchIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        await queryRunner.manager.getRepository(_usercompanypermissionentity.UserCompanyPermission).delete({
+            targetId: (0, _typeorm.In)(branchIds)
+        });
+        if (!this.permissionSyncAdapter?.onBranchDeleted) {
+            return;
+        }
+        const rows = await queryRunner.manager.getRepository(_companybranchentity.CompanyBranch).find({
+            where: {
+                id: (0, _typeorm.In)(branchIds)
+            },
+            select: [
+                'id',
+                'companyId'
+            ]
+        });
+        await Promise.all(rows.map((row)=>this.permissionSyncAdapter.onBranchDeleted(row.id, row.companyId)));
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -84,8 +108,8 @@ let BranchService = class BranchService extends _classes.ApiService {
         }
         return result;
     }
-    constructor(cacheManager, utilsService, dataSourceProvider, authConfig){
-        super('company_branch', cacheManager, utilsService, BranchService.name, true, 'auth', _companybranchentity.CompanyBranch, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "authConfig", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig;
+    constructor(cacheManager, utilsService, dataSourceProvider, authConfig, permissionSyncAdapter){
+        super('company_branch', cacheManager, utilsService, BranchService.name, true, 'auth', _companybranchentity.CompanyBranch, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "permissionSyncAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.permissionSyncAdapter = permissionSyncAdapter;
     }
 };
 BranchService = _ts_decorate([
@@ -96,11 +120,14 @@ BranchService = _ts_decorate([
     _ts_param(1, (0, _common.Inject)(_modules.UtilsService)),
     _ts_param(2, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
     _ts_param(3, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
+    _ts_param(4, (0, _common.Optional)()),
+    _ts_param(4, (0, _common.Inject)(_interfaces.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
         typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
-        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService
+        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
+        typeof _interfaces.IPermissionSyncAdapter === "undefined" ? Object : _interfaces.IPermissionSyncAdapter
     ])
 ], BranchService);

package/cjs/services/company.service.js

@@ -9,9 +9,13 @@ Object.defineProperty(exports, "CompanyService", {
     }
 });
 const _classes = require("@flusys/nestjs-shared/classes");
+const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _modules = require("@flusys/nestjs-shared/modules");
 const _common = require("@nestjs/common");
+const _typeorm = require("typeorm");
+const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
+const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -41,6 +45,30 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let CompanyService = class CompanyService extends _classes.ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const companyIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        const branchRows = await queryRunner.manager.getRepository(_companybranchentity.CompanyBranch).find({
+            where: {
+                companyId: (0, _typeorm.In)(companyIds)
+            },
+            select: [
+                'id'
+            ]
+        });
+        const targetIds = [
+            ...companyIds,
+            ...branchRows.map((row)=>row.id)
+        ];
+        await queryRunner.manager.getRepository(_usercompanypermissionentity.UserCompanyPermission).delete({
+            targetId: (0, _typeorm.In)(targetIds)
+        });
+        if (!this.permissionSyncAdapter?.onCompanyDeleted) {
+            return;
+        }
+        await Promise.all(companyIds.map((companyId)=>this.permissionSyncAdapter.onCompanyDeleted(companyId)));
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -69,8 +97,8 @@ let CompanyService = class CompanyService extends _classes.ApiService {
             isRaw: false
         };
     }
-    constructor(cacheManager, utilsService, dataSourceProvider){
-        super('company', cacheManager, utilsService, CompanyService.name, true, 'auth', _companyentity.Company, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService;
+    constructor(cacheManager, utilsService, dataSourceProvider, permissionSyncAdapter){
+        super('company', cacheManager, utilsService, CompanyService.name, true, 'auth', _companyentity.Company, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "permissionSyncAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.permissionSyncAdapter = permissionSyncAdapter;
     }
 };
 CompanyService = _ts_decorate([
@@ -80,10 +108,13 @@ CompanyService = _ts_decorate([
     _ts_param(0, (0, _common.Inject)('CACHE_INSTANCE')),
     _ts_param(1, (0, _common.Inject)(_modules.UtilsService)),
     _ts_param(2, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
+    _ts_param(3, (0, _common.Optional)()),
+    _ts_param(3, (0, _common.Inject)(_interfaces.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
-        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider
+        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
+        typeof _interfaces.IPermissionSyncAdapter === "undefined" ? Object : _interfaces.IPermissionSyncAdapter
     ])
 ], CompanyService);

package/cjs/services/user-permission.service.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "UserPermissionService", {
     }
 });
 const _nestjsshared = require("@flusys/nestjs-shared");
+const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _common = require("@nestjs/common");
 const _config = require("../config");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
@@ -102,7 +103,7 @@ let UserPermissionService = class UserPermissionService {
             throw error;
         }
     }
-    /** Revoke permission from user */ async revokePermission(userId, targetId, type) {
+    async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
         const typeName = type === _usercompanypermissionentity.PermissionType.COMPANY ? 'company' : 'branch';
         const permission = await repository.findOne({
@@ -110,7 +111,10 @@ let UserPermissionService = class UserPermissionService {
                 userId,
                 targetId,
                 permissionType: type
-            }
+            },
+            relations: [
+                type === _usercompanypermissionentity.PermissionType.BRANCH ? 'branch' : 'company'
+            ]
         });
         if (!permission) {
             throw new _common.NotFoundException({
@@ -121,7 +125,29 @@ let UserPermissionService = class UserPermissionService {
                 }
             });
         }
+        const companyId = type === _usercompanypermissionentity.PermissionType.COMPANY ? targetId : permission.branch?.companyId;
         await repository.remove(permission);
+        if (type === _usercompanypermissionentity.PermissionType.COMPANY) {
+            const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
+            await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
+            await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
+        } else {
+            if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
+        }
+    }
+    async revokeBranchPermissionsForCompany(repository, userId, companyId) {
+        const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
+            userId
+        }).andWhere('permission.permissionType = :type', {
+            type: _usercompanypermissionentity.PermissionType.BRANCH
+        }).andWhere('branch.companyId = :companyId', {
+            companyId
+        }).getMany();
+        if (branchPermissions.length === 0) {
+            return [];
+        }
+        await repository.remove(branchPermissions);
+        return branchPermissions.map((permission)=>permission.targetId);
     }
     /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
         const repository = await this.getRepository();
@@ -137,12 +163,14 @@ let UserPermissionService = class UserPermissionService {
         }
         return queryBuilder.getMany();
     }
-    constructor(dataSourceProvider){
+    constructor(dataSourceProvider, permissionSyncAdapter){
         _define_property(this, "dataSourceProvider", void 0);
+        _define_property(this, "permissionSyncAdapter", void 0);
         _define_property(this, "_repository", void 0);
         // Convenience Methods
         _define_property(this, "findUserCompanies", void 0);
         this.dataSourceProvider = dataSourceProvider;
+        this.permissionSyncAdapter = permissionSyncAdapter;
         this._repository = null;
         this.findUserCompanies = (userId)=>this.findUserPermissions(userId, _usercompanypermissionentity.PermissionType.COMPANY);
     }
@@ -178,8 +206,11 @@ UserPermissionService = _ts_decorate([
         scope: _common.Scope.REQUEST
     }),
     _ts_param(0, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
+    _ts_param(1, (0, _common.Optional)()),
+    _ts_param(1, (0, _common.Inject)(_interfaces.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider
+        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
+        typeof _interfaces.IPermissionSyncAdapter === "undefined" ? Object : _interfaces.IPermissionSyncAdapter
     ])
 ], UserPermissionService);

package/entities/company-branch.entity.d.ts

@@ -14,6 +14,6 @@ export declare class CompanyBranch extends Identity {
     parentId: string | null;
     parent: CompanyBranch | null;
     children: CompanyBranch[];
-    companyId: string | null;
+    companyId: string;
     company: Company;
 }

package/fesm/entities/company-branch.entity.js

@@ -129,10 +129,9 @@ _ts_decorate([
 _ts_decorate([
     Column({
         name: 'company_id',
-        type: 'uuid',
-        nullable: true
+        type: 'uuid'
     }),
-    _ts_metadata("design:type", Object)
+    _ts_metadata("design:type", String)
 ], CompanyBranch.prototype, "companyId", void 0);
 _ts_decorate([
     ManyToOne(()=>Company, (company)=>company.branches, {

package/fesm/services/authentication.service.js

@@ -540,7 +540,10 @@ export class AuthenticationService {
     async refreshToken(refreshToken) {
         try {
             const payload = this.jwtService.verify(refreshToken, {
-                secret: this.authConfig.getRefreshTokenSecret()
+                secret: this.authConfig.getRefreshTokenSecret(),
+                algorithms: [
+                    'HS256'
+                ]
             });
             if (await this.isTokenRevoked(payload.id, payload.iat)) {
                 throw new UnauthorizedException({
@@ -892,14 +895,16 @@ export class AuthenticationService {
             type: 'access'
         }, {
             secret: this.authConfig.getJwtSecret(),
-            expiresIn: this.authConfig.getJwtExpiration()
+            expiresIn: this.authConfig.getJwtExpiration(),
+            algorithm: 'HS256'
         });
         const refreshToken = this.jwtService.sign({
             ...payload,
             type: 'refresh'
         }, {
             secret: this.authConfig.getRefreshTokenSecret(),
-            expiresIn: this.authConfig.getRefreshTokenExpiration()
+            expiresIn: this.authConfig.getRefreshTokenExpiration(),
+            algorithm: 'HS256'
         });
         return {
             accessToken,

package/fesm/services/branch.service.js

@@ -25,14 +25,38 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { HybridCache, ApiService } from '@flusys/nestjs-shared/classes';
+import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { applyCompanyFilter } from '@flusys/nestjs-shared/utils';
-import { Inject, Injectable, Scope } from '@nestjs/common';
+import { Inject, Injectable, Optional, Scope } from '@nestjs/common';
+import { In } from 'typeorm';
 import { CompanyBranch } from '../entities/company-branch.entity';
+import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthConfigService } from './auth-config.service';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class BranchService extends ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const branchIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        await queryRunner.manager.getRepository(UserCompanyPermission).delete({
+            targetId: In(branchIds)
+        });
+        if (!this.permissionSyncAdapter?.onBranchDeleted) {
+            return;
+        }
+        const rows = await queryRunner.manager.getRepository(CompanyBranch).find({
+            where: {
+                id: In(branchIds)
+            },
+            select: [
+                'id',
+                'companyId'
+            ]
+        });
+        await Promise.all(rows.map((row)=>this.permissionSyncAdapter.onBranchDeleted(row.id, row.companyId)));
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -74,8 +98,8 @@ export class BranchService extends ApiService {
         }
         return result;
     }
-    constructor(cacheManager, utilsService, dataSourceProvider, authConfig){
-        super('company_branch', cacheManager, utilsService, BranchService.name, true, 'auth', CompanyBranch, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "authConfig", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig;
+    constructor(cacheManager, utilsService, dataSourceProvider, authConfig, permissionSyncAdapter){
+        super('company_branch', cacheManager, utilsService, BranchService.name, true, 'auth', CompanyBranch, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "permissionSyncAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.permissionSyncAdapter = permissionSyncAdapter;
     }
 }
 BranchService = _ts_decorate([
@@ -86,11 +110,14 @@ BranchService = _ts_decorate([
     _ts_param(1, Inject(UtilsService)),
     _ts_param(2, Inject(AuthDataSourceProvider)),
     _ts_param(3, Inject(AuthConfigService)),
+    _ts_param(4, Optional()),
+    _ts_param(4, Inject(PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof UtilsService === "undefined" ? Object : UtilsService,
         typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
-        typeof AuthConfigService === "undefined" ? Object : AuthConfigService
+        typeof AuthConfigService === "undefined" ? Object : AuthConfigService,
+        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
     ])
 ], BranchService);

package/fesm/services/company.service.js

@@ -25,12 +25,40 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { HybridCache, ApiService } from '@flusys/nestjs-shared/classes';
+import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { Inject, Injectable, Scope } from '@nestjs/common';
+import { Inject, Injectable, Optional, Scope } from '@nestjs/common';
+import { In } from 'typeorm';
+import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
+import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class CompanyService extends ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const companyIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        const branchRows = await queryRunner.manager.getRepository(CompanyBranch).find({
+            where: {
+                companyId: In(companyIds)
+            },
+            select: [
+                'id'
+            ]
+        });
+        const targetIds = [
+            ...companyIds,
+            ...branchRows.map((row)=>row.id)
+        ];
+        await queryRunner.manager.getRepository(UserCompanyPermission).delete({
+            targetId: In(targetIds)
+        });
+        if (!this.permissionSyncAdapter?.onCompanyDeleted) {
+            return;
+        }
+        await Promise.all(companyIds.map((companyId)=>this.permissionSyncAdapter.onCompanyDeleted(companyId)));
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -59,8 +87,8 @@ export class CompanyService extends ApiService {
             isRaw: false
         };
     }
-    constructor(cacheManager, utilsService, dataSourceProvider){
-        super('company', cacheManager, utilsService, CompanyService.name, true, 'auth', Company, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService;
+    constructor(cacheManager, utilsService, dataSourceProvider, permissionSyncAdapter){
+        super('company', cacheManager, utilsService, CompanyService.name, true, 'auth', Company, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "permissionSyncAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.permissionSyncAdapter = permissionSyncAdapter;
     }
 }
 CompanyService = _ts_decorate([
@@ -70,10 +98,13 @@ CompanyService = _ts_decorate([
     _ts_param(0, Inject('CACHE_INSTANCE')),
     _ts_param(1, Inject(UtilsService)),
     _ts_param(2, Inject(AuthDataSourceProvider)),
+    _ts_param(3, Optional()),
+    _ts_param(3, Inject(PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof UtilsService === "undefined" ? Object : UtilsService,
-        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider
+        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
+        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
     ])
 ], CompanyService);

package/fesm/services/user-permission.service.js

@@ -26,7 +26,8 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
-import { ConflictException, Inject, Injectable, NotFoundException, Scope } from '@nestjs/common';
+import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
+import { ConflictException, Inject, Injectable, NotFoundException, Optional, Scope } from '@nestjs/common';
 import { USER_PERMISSION_MESSAGES } from '../config';
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
@@ -92,7 +93,7 @@ export class UserPermissionService {
             throw error;
         }
     }
-    /** Revoke permission from user */ async revokePermission(userId, targetId, type) {
+    async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
         const typeName = type === PermissionType.COMPANY ? 'company' : 'branch';
         const permission = await repository.findOne({
@@ -100,7 +101,10 @@ export class UserPermissionService {
                 userId,
                 targetId,
                 permissionType: type
-            }
+            },
+            relations: [
+                type === PermissionType.BRANCH ? 'branch' : 'company'
+            ]
         });
         if (!permission) {
             throw new NotFoundException({
@@ -111,7 +115,29 @@ export class UserPermissionService {
                 }
             });
         }
+        const companyId = type === PermissionType.COMPANY ? targetId : permission.branch?.companyId;
         await repository.remove(permission);
+        if (type === PermissionType.COMPANY) {
+            const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
+            await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
+            await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
+        } else {
+            if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
+        }
+    }
+    async revokeBranchPermissionsForCompany(repository, userId, companyId) {
+        const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
+            userId
+        }).andWhere('permission.permissionType = :type', {
+            type: PermissionType.BRANCH
+        }).andWhere('branch.companyId = :companyId', {
+            companyId
+        }).getMany();
+        if (branchPermissions.length === 0) {
+            return [];
+        }
+        await repository.remove(branchPermissions);
+        return branchPermissions.map((permission)=>permission.targetId);
     }
     /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
         const repository = await this.getRepository();
@@ -127,12 +153,14 @@ export class UserPermissionService {
         }
         return queryBuilder.getMany();
     }
-    constructor(dataSourceProvider){
+    constructor(dataSourceProvider, permissionSyncAdapter){
         _define_property(this, "dataSourceProvider", void 0);
+        _define_property(this, "permissionSyncAdapter", void 0);
         _define_property(this, "_repository", void 0);
         // Convenience Methods
         _define_property(this, "findUserCompanies", void 0);
         this.dataSourceProvider = dataSourceProvider;
+        this.permissionSyncAdapter = permissionSyncAdapter;
         this._repository = null;
         this.findUserCompanies = (userId)=>this.findUserPermissions(userId, PermissionType.COMPANY);
     }
@@ -168,8 +196,11 @@ UserPermissionService = _ts_decorate([
         scope: Scope.REQUEST
     }),
     _ts_param(0, Inject(AuthDataSourceProvider)),
+    _ts_param(1, Optional()),
+    _ts_param(1, Inject(PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider
+        typeof AuthDataSourceProvider === "undefined" ? Object : AuthDataSourceProvider,
+        typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
     ])
 ], UserPermissionService);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "6.0.0",
+  "version": "6.0.2",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -93,7 +93,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.0.0",
-    "@flusys/nestjs-shared": "6.0.0"
+    "@flusys/nestjs-core": "6.0.2",
+    "@flusys/nestjs-shared": "6.0.2"
   }
 }

package/services/branch.service.d.ts

@@ -1,8 +1,8 @@
-import { HybridCache, ApiService } from '@flusys/nestjs-shared/classes';
-import { FilterAndPaginationDto } from '@flusys/nestjs-shared/dtos';
-import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
+import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { DeleteDto, FilterAndPaginationDto } from '@flusys/nestjs-shared/dtos';
+import { ILoggedUserInfo, IPermissionSyncAdapter } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { SelectQueryBuilder } from 'typeorm';
+import { QueryRunner, SelectQueryBuilder } from 'typeorm';
 import { CreateCompanyBranchDto, UpdateCompanyBranchDto } from '../dtos/company-branch.dto';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { ICompanyBranch } from '../interfaces/company-branch.interface';
@@ -12,7 +12,9 @@ export declare class BranchService extends ApiService<CreateCompanyBranchDto, Up
     protected cacheManager: HybridCache;
     protected utilsService: UtilsService;
     private readonly authConfig;
-    constructor(cacheManager: HybridCache, utilsService: UtilsService, dataSourceProvider: AuthDataSourceProvider, authConfig: AuthConfigService);
+    private readonly permissionSyncAdapter?;
+    constructor(cacheManager: HybridCache, utilsService: UtilsService, dataSourceProvider: AuthDataSourceProvider, authConfig: AuthConfigService, permissionSyncAdapter?: IPermissionSyncAdapter | undefined);
+    protected beforeDeleteOperation(dto: DeleteDto, user: ILoggedUserInfo | null, queryRunner: QueryRunner): Promise<void>;
     getSelectQuery(query: SelectQueryBuilder<CompanyBranch>, _user: ILoggedUserInfo | null, select?: string[]): Promise<{
         query: SelectQueryBuilder<CompanyBranch>;
         isRaw: boolean;

package/services/company.service.d.ts

@@ -1,7 +1,8 @@
-import { HybridCache, ApiService } from '@flusys/nestjs-shared/classes';
-import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
+import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { DeleteDto } from '@flusys/nestjs-shared/dtos';
+import { ILoggedUserInfo, IPermissionSyncAdapter } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { SelectQueryBuilder } from 'typeorm';
+import { QueryRunner, SelectQueryBuilder } from 'typeorm';
 import { CreateCompanyDto, UpdateCompanyDto } from '../dtos/company.dto';
 import { Company } from '../entities/company.entity';
 import { ICompany } from '../interfaces/company.interface';
@@ -9,7 +10,9 @@ import { AuthDataSourceProvider } from './auth-datasource.provider';
 export declare class CompanyService extends ApiService<CreateCompanyDto, UpdateCompanyDto, ICompany, Company> {
     protected cacheManager: HybridCache;
     protected utilsService: UtilsService;
-    constructor(cacheManager: HybridCache, utilsService: UtilsService, dataSourceProvider: AuthDataSourceProvider);
+    private readonly permissionSyncAdapter?;
+    constructor(cacheManager: HybridCache, utilsService: UtilsService, dataSourceProvider: AuthDataSourceProvider, permissionSyncAdapter?: IPermissionSyncAdapter | undefined);
+    protected beforeDeleteOperation(dto: DeleteDto, user: ILoggedUserInfo | null, queryRunner: QueryRunner): Promise<void>;
     getSelectQuery(query: SelectQueryBuilder<Company>, _user: ILoggedUserInfo | null, select?: string[]): Promise<{
         query: SelectQueryBuilder<Company>;
         isRaw: boolean;

package/services/user-permission.service.d.ts

@@ -1,13 +1,16 @@
+import { IPermissionSyncAdapter } from '@flusys/nestjs-shared/interfaces';
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export declare class UserPermissionService {
     private readonly dataSourceProvider;
+    private readonly permissionSyncAdapter?;
     private _repository;
-    constructor(dataSourceProvider: AuthDataSourceProvider);
+    constructor(dataSourceProvider: AuthDataSourceProvider, permissionSyncAdapter?: IPermissionSyncAdapter | undefined);
     private getRepository;
     findUserPermissions(userId: string, type: PermissionType): Promise<UserCompanyPermission[]>;
     assignPermission(userId: string, targetId: string, type: PermissionType): Promise<void>;
     revokePermission(userId: string, targetId: string, type: PermissionType): Promise<void>;
+    private revokeBranchPermissionsForCompany;
     findUserCompanies: (userId: string) => Promise<UserCompanyPermission[]>;
     findUserBranches(userId: string, companyId?: string): Promise<UserCompanyPermission[]>;
 }