@flusys/nestjs-auth 6.0.1 → 6.1.0

package/cjs/services/branch.service.js

@@ -9,10 +9,13 @@ Object.defineProperty(exports, "BranchService", {
     }
 });
 const _classes = require("@flusys/nestjs-shared/classes");
+const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _modules = require("@flusys/nestjs-shared/modules");
 const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
+const _typeorm = require("typeorm");
 const _companybranchentity = require("../entities/company-branch.entity");
+const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
 const _authconfigservice = require("./auth-config.service");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 function _define_property(obj, key, value) {
@@ -43,6 +46,27 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let BranchService = class BranchService extends _classes.ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const branchIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        await queryRunner.manager.getRepository(_usercompanypermissionentity.UserCompanyPermission).delete({
+            targetId: (0, _typeorm.In)(branchIds)
+        });
+        if (!this.permissionSyncAdapter?.onBranchDeleted) {
+            return;
+        }
+        const rows = await queryRunner.manager.getRepository(_companybranchentity.CompanyBranch).find({
+            where: {
+                id: (0, _typeorm.In)(branchIds)
+            },
+            select: [
+                'id',
+                'companyId'
+            ]
+        });
+        await Promise.all(rows.map((row)=>this.permissionSyncAdapter.onBranchDeleted(row.id, row.companyId)));
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -84,8 +108,8 @@ let BranchService = class BranchService extends _classes.ApiService {
         }
         return result;
     }
-    constructor(cacheManager, utilsService, dataSourceProvider, authConfig){
-        super('company_branch', cacheManager, utilsService, BranchService.name, true, 'auth', _companybranchentity.CompanyBranch, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "authConfig", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig;
+    constructor(cacheManager, utilsService, dataSourceProvider, authConfig, permissionSyncAdapter){
+        super('company_branch', cacheManager, utilsService, BranchService.name, true, 'auth', _companybranchentity.CompanyBranch, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "authConfig", void 0), _define_property(this, "permissionSyncAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.authConfig = authConfig, this.permissionSyncAdapter = permissionSyncAdapter;
     }
 };
 BranchService = _ts_decorate([
@@ -96,11 +120,14 @@ BranchService = _ts_decorate([
     _ts_param(1, (0, _common.Inject)(_modules.UtilsService)),
     _ts_param(2, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
     _ts_param(3, (0, _common.Inject)(_authconfigservice.AuthConfigService)),
+    _ts_param(4, (0, _common.Optional)()),
+    _ts_param(4, (0, _common.Inject)(_interfaces.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
         typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
-        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService
+        typeof _authconfigservice.AuthConfigService === "undefined" ? Object : _authconfigservice.AuthConfigService,
+        typeof _interfaces.IPermissionSyncAdapter === "undefined" ? Object : _interfaces.IPermissionSyncAdapter
     ])
 ], BranchService);

package/cjs/services/branch.service.spec.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _branchservice = require("./branch.service");
+const _companybranchentity = require("../entities/company-branch.entity");
+const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
+describe('BranchService', ()=>{
+    let service;
+    let mockRepo;
+    let mockAuthConfig;
+    let mockPermissionSyncAdapter;
+    let mockQueryRunner;
+    beforeEach(()=>{
+        mockRepo = (0, _repositorymock.createMockRepository)();
+        Object.assign(mockRepo.createQueryBuilder(), {
+            leftJoinAndSelect: jest.fn().mockReturnThis(),
+            addOrderBy: jest.fn().mockReturnThis()
+        });
+        const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
+        mockAuthConfig = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
+        };
+        mockPermissionSyncAdapter = {
+            onBranchDeleted: jest.fn()
+        };
+        service = new _branchservice.BranchService({}, {}, mockDataSourceProvider, mockAuthConfig, mockPermissionSyncAdapter);
+        const permissionRepo = (0, _repositorymock.createMockRepository)();
+        const branchRepo = (0, _repositorymock.createMockRepository)();
+        branchRepo.find.mockResolvedValue([]);
+        mockQueryRunner = {
+            manager: {
+                getRepository: jest.fn().mockImplementation((entity)=>{
+                    if (entity === _usercompanypermissionentity.UserCompanyPermission) return permissionRepo;
+                    if (entity === _companybranchentity.CompanyBranch) return branchRepo;
+                    throw new Error('Unexpected entity');
+                })
+            }
+        };
+    });
+    describe('beforeDeleteOperation', ()=>{
+        it('deletes user permissions targeting the deleted branch ids', async ()=>{
+            await service.beforeDeleteOperation({
+                id: [
+                    'branch-1',
+                    'branch-2'
+                ]
+            }, null, mockQueryRunner);
+            const permissionRepo = mockQueryRunner.manager.getRepository(_usercompanypermissionentity.UserCompanyPermission);
+            expect(permissionRepo.delete).toHaveBeenCalledWith({
+                targetId: expect.anything()
+            });
+        });
+        it('handles a single (non-array) branch id', async ()=>{
+            await service.beforeDeleteOperation({
+                id: 'branch-1'
+            }, null, mockQueryRunner);
+            const permissionRepo = mockQueryRunner.manager.getRepository(_usercompanypermissionentity.UserCompanyPermission);
+            expect(permissionRepo.delete).toHaveBeenCalled();
+        });
+        it('does nothing further when no permission sync adapter is configured', async ()=>{
+            service = new _branchservice.BranchService({}, {}, (0, _repositorymock.createMockDataSourceProvider)(mockRepo), mockAuthConfig, undefined);
+            await expect(service.beforeDeleteOperation({
+                id: [
+                    'branch-1'
+                ]
+            }, null, mockQueryRunner)).resolves.toBeUndefined();
+        });
+        it('notifies the permission sync adapter for each deleted branch', async ()=>{
+            const branchRepo = mockQueryRunner.manager.getRepository(_companybranchentity.CompanyBranch);
+            branchRepo.find.mockResolvedValue([
+                {
+                    id: 'branch-1',
+                    companyId: 'company-1'
+                }
+            ]);
+            await service.beforeDeleteOperation({
+                id: [
+                    'branch-1'
+                ]
+            }, null, mockQueryRunner);
+            expect(mockPermissionSyncAdapter.onBranchDeleted).toHaveBeenCalledWith('branch-1', 'company-1');
+        });
+    });
+    describe('getSelectQuery', ()=>{
+        it('applies the default selected fields when none are provided', async ()=>{
+            const qb = mockRepo.createQueryBuilder();
+            const { isRaw } = await service.getSelectQuery(qb, null);
+            expect(qb.select).toHaveBeenCalledWith(expect.arrayContaining([
+                'company_branch.id',
+                'company_branch.name',
+                'company_branch.slug'
+            ]));
+            expect(isRaw).toBe(false);
+        });
+        it('honors an explicit select list', async ()=>{
+            const qb = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(qb, null, [
+                'id',
+                'name'
+            ]);
+            expect(qb.select).toHaveBeenCalledWith([
+                'company_branch.id',
+                'company_branch.name'
+            ]);
+        });
+    });
+    describe('getGlobalSearchQuery', ()=>{
+        it('adds a LIKE search clause across name/slug/email', async ()=>{
+            const qb = mockRepo.createQueryBuilder();
+            await service.getGlobalSearchQuery(qb, 'acme');
+            expect(qb.andWhere).toHaveBeenCalledWith(expect.stringContaining('company_branch.name LIKE'), {
+                search: '%acme%'
+            });
+        });
+    });
+    describe('getExtraManipulateQuery', ()=>{
+        it('applies a company filter when company feature is enabled and no explicit companyId filter is present', async ()=>{
+            mockAuthConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            const qb = mockRepo.createQueryBuilder();
+            await service.getExtraManipulateQuery(qb, {
+                filter: {}
+            }, {
+                id: 'user-1',
+                companyId: 'company-1'
+            });
+            expect(qb.andWhere).toHaveBeenCalledWith('company_branch.company_id = :companyId', {
+                companyId: 'company-1'
+            });
+        });
+        it('does not apply a company filter when companyId is explicitly provided in the filter', async ()=>{
+            mockAuthConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            const qb = mockRepo.createQueryBuilder();
+            await service.getExtraManipulateQuery(qb, {
+                filter: {
+                    companyId: 'explicit-company'
+                }
+            }, {
+                id: 'user-1',
+                companyId: 'company-1'
+            });
+            expect(qb.andWhere).not.toHaveBeenCalledWith('company_branch.company_id = :companyId', expect.anything());
+        });
+        it('does not apply a company filter when the company feature is disabled', async ()=>{
+            mockAuthConfig.isCompanyFeatureEnabled.mockReturnValue(false);
+            const qb = mockRepo.createQueryBuilder();
+            await service.getExtraManipulateQuery(qb, {
+                filter: {}
+            }, null);
+            expect(qb.andWhere).not.toHaveBeenCalledWith('company_branch.company_id = :companyId', expect.anything());
+        });
+    });
+});

package/cjs/services/company-selection-session.service.spec.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _companyselectionsessionservice = require("./company-selection-session.service");
+describe('CompanySelectionSessionService', ()=>{
+    let service;
+    let mockCacheManager;
+    beforeEach(()=>{
+        mockCacheManager = {
+            set: jest.fn(),
+            get: jest.fn(),
+            del: jest.fn()
+        };
+        service = new _companyselectionsessionservice.CompanySelectionSessionService(mockCacheManager);
+    });
+    describe('createSession', ()=>{
+        it('stores a session in the cache and returns a session id', async ()=>{
+            const sessionId = await service.createSession('user-1');
+            expect(typeof sessionId).toBe('string');
+            expect(sessionId.length).toBeGreaterThan(0);
+            expect(mockCacheManager.set).toHaveBeenCalledWith(`auth:session:${sessionId}`, expect.objectContaining({
+                sessionId,
+                userId: 'user-1'
+            }), 5 * 60 * 1000);
+        });
+        it('generates unique session ids on successive calls', async ()=>{
+            const first = await service.createSession('user-1');
+            const second = await service.createSession('user-1');
+            expect(first).not.toBe(second);
+        });
+    });
+    describe('getSession', ()=>{
+        it('returns null when no session is cached', async ()=>{
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const result = await service.getSession('missing-session');
+            expect(result).toBeNull();
+        });
+        it('returns the session when present and not expired', async ()=>{
+            const session = {
+                sessionId: 'sess-1',
+                userId: 'user-1',
+                createdAt: new Date(),
+                expiresAt: new Date(Date.now() + 60_000)
+            };
+            mockCacheManager.get.mockResolvedValue(session);
+            const result = await service.getSession('sess-1');
+            expect(result).toEqual(session);
+            expect(mockCacheManager.get).toHaveBeenCalledWith('auth:session:sess-1');
+        });
+        it('deletes and returns null when the cached session has expired', async ()=>{
+            const session = {
+                sessionId: 'sess-1',
+                userId: 'user-1',
+                createdAt: new Date(Date.now() - 10 * 60_000),
+                expiresAt: new Date(Date.now() - 60_000)
+            };
+            mockCacheManager.get.mockResolvedValue(session);
+            const result = await service.getSession('sess-1');
+            expect(result).toBeNull();
+            expect(mockCacheManager.del).toHaveBeenCalledWith('auth:session:sess-1');
+        });
+    });
+    describe('consumeSession', ()=>{
+        it('returns and deletes the session when present', async ()=>{
+            const session = {
+                sessionId: 'sess-1',
+                userId: 'user-1',
+                createdAt: new Date(),
+                expiresAt: new Date(Date.now() + 60_000)
+            };
+            mockCacheManager.get.mockResolvedValue(session);
+            const result = await service.consumeSession('sess-1');
+            expect(result).toEqual(session);
+            expect(mockCacheManager.del).toHaveBeenCalledWith('auth:session:sess-1');
+        });
+        it('returns null and does not delete when session is missing', async ()=>{
+            mockCacheManager.get.mockResolvedValue(undefined);
+            const result = await service.consumeSession('missing');
+            expect(result).toBeNull();
+            expect(mockCacheManager.del).not.toHaveBeenCalled();
+        });
+    });
+    describe('deleteSession', ()=>{
+        it('deletes the session by key', async ()=>{
+            await service.deleteSession('sess-1');
+            expect(mockCacheManager.del).toHaveBeenCalledWith('auth:session:sess-1');
+        });
+    });
+});

package/cjs/services/company.service.js

@@ -9,9 +9,13 @@ Object.defineProperty(exports, "CompanyService", {
     }
 });
 const _classes = require("@flusys/nestjs-shared/classes");
+const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _modules = require("@flusys/nestjs-shared/modules");
 const _common = require("@nestjs/common");
+const _typeorm = require("typeorm");
+const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
+const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
 const _authdatasourceprovider = require("./auth-datasource.provider");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -41,6 +45,30 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let CompanyService = class CompanyService extends _classes.ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const companyIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        const branchRows = await queryRunner.manager.getRepository(_companybranchentity.CompanyBranch).find({
+            where: {
+                companyId: (0, _typeorm.In)(companyIds)
+            },
+            select: [
+                'id'
+            ]
+        });
+        const targetIds = [
+            ...companyIds,
+            ...branchRows.map((row)=>row.id)
+        ];
+        await queryRunner.manager.getRepository(_usercompanypermissionentity.UserCompanyPermission).delete({
+            targetId: (0, _typeorm.In)(targetIds)
+        });
+        if (!this.permissionSyncAdapter?.onCompanyDeleted) {
+            return;
+        }
+        await Promise.all(companyIds.map((companyId)=>this.permissionSyncAdapter.onCompanyDeleted(companyId)));
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -69,8 +97,8 @@ let CompanyService = class CompanyService extends _classes.ApiService {
             isRaw: false
         };
     }
-    constructor(cacheManager, utilsService, dataSourceProvider){
-        super('company', cacheManager, utilsService, CompanyService.name, true, 'auth', _companyentity.Company, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService;
+    constructor(cacheManager, utilsService, dataSourceProvider, permissionSyncAdapter){
+        super('company', cacheManager, utilsService, CompanyService.name, true, 'auth', _companyentity.Company, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "permissionSyncAdapter", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.permissionSyncAdapter = permissionSyncAdapter;
     }
 };
 CompanyService = _ts_decorate([
@@ -80,10 +108,13 @@ CompanyService = _ts_decorate([
     _ts_param(0, (0, _common.Inject)('CACHE_INSTANCE')),
     _ts_param(1, (0, _common.Inject)(_modules.UtilsService)),
     _ts_param(2, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
+    _ts_param(3, (0, _common.Optional)()),
+    _ts_param(3, (0, _common.Inject)(_interfaces.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
-        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider
+        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
+        typeof _interfaces.IPermissionSyncAdapter === "undefined" ? Object : _interfaces.IPermissionSyncAdapter
     ])
 ], CompanyService);

package/cjs/services/company.service.spec.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _companyservice = require("./company.service");
+const _companybranchentity = require("../entities/company-branch.entity");
+const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
+describe('CompanyService', ()=>{
+    let service;
+    let mockRepo;
+    let mockPermissionSyncAdapter;
+    let mockQueryRunner;
+    let branchRepo;
+    let permissionRepo;
+    beforeEach(()=>{
+        mockRepo = (0, _repositorymock.createMockRepository)();
+        const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
+        mockPermissionSyncAdapter = {
+            onCompanyDeleted: jest.fn()
+        };
+        service = new _companyservice.CompanyService({}, {}, mockDataSourceProvider, mockPermissionSyncAdapter);
+        branchRepo = (0, _repositorymock.createMockRepository)();
+        branchRepo.find.mockResolvedValue([]);
+        permissionRepo = (0, _repositorymock.createMockRepository)();
+        mockQueryRunner = {
+            manager: {
+                getRepository: jest.fn().mockImplementation((entity)=>{
+                    if (entity === _companybranchentity.CompanyBranch) return branchRepo;
+                    if (entity === _usercompanypermissionentity.UserCompanyPermission) return permissionRepo;
+                    throw new Error('Unexpected entity');
+                })
+            }
+        };
+    });
+    describe('beforeDeleteOperation', ()=>{
+        it('deletes permissions for the companies and their branches', async ()=>{
+            branchRepo.find.mockResolvedValue([
+                {
+                    id: 'branch-1'
+                }
+            ]);
+            await service.beforeDeleteOperation({
+                id: [
+                    'company-1'
+                ]
+            }, null, mockQueryRunner);
+            const deleteArg = permissionRepo.delete.mock.calls[0][0];
+            expect(deleteArg.targetId._value).toEqual(expect.arrayContaining([
+                'company-1',
+                'branch-1'
+            ]));
+        });
+        it('handles a single (non-array) company id', async ()=>{
+            await service.beforeDeleteOperation({
+                id: 'company-1'
+            }, null, mockQueryRunner);
+            expect(branchRepo.find).toHaveBeenCalledWith(expect.objectContaining({
+                where: {
+                    companyId: expect.anything()
+                }
+            }));
+        });
+        it('does nothing further when no permission sync adapter is configured', async ()=>{
+            service = new _companyservice.CompanyService({}, {}, (0, _repositorymock.createMockDataSourceProvider)(mockRepo), undefined);
+            await expect(service.beforeDeleteOperation({
+                id: [
+                    'company-1'
+                ]
+            }, null, mockQueryRunner)).resolves.toBeUndefined();
+        });
+        it('notifies the permission sync adapter for each deleted company', async ()=>{
+            await service.beforeDeleteOperation({
+                id: [
+                    'company-1',
+                    'company-2'
+                ]
+            }, null, mockQueryRunner);
+            expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-1');
+            expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-2');
+        });
+    });
+    describe('getSelectQuery', ()=>{
+        it('applies the default selected fields when none are provided', async ()=>{
+            const qb = mockRepo.createQueryBuilder();
+            const { isRaw } = await service.getSelectQuery(qb, null);
+            expect(qb.select).toHaveBeenCalledWith(expect.arrayContaining([
+                'company.id',
+                'company.name',
+                'company.slug'
+            ]));
+            expect(isRaw).toBe(false);
+        });
+        it('honors an explicit select list', async ()=>{
+            const qb = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(qb, null, [
+                'id'
+            ]);
+            expect(qb.select).toHaveBeenCalledWith([
+                'company.id'
+            ]);
+        });
+    });
+    describe('getGlobalSearchQuery', ()=>{
+        it('adds a LIKE search clause across name/slug/email', async ()=>{
+            const qb = mockRepo.createQueryBuilder();
+            await service.getGlobalSearchQuery(qb, 'acme');
+            expect(qb.andWhere).toHaveBeenCalledWith(expect.stringContaining('company.name LIKE'), {
+                search: '%acme%'
+            });
+        });
+    });
+});

package/cjs/services/user-permission.service.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "UserPermissionService", {
     }
 });
 const _nestjsshared = require("@flusys/nestjs-shared");
+const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _common = require("@nestjs/common");
 const _config = require("../config");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
@@ -102,7 +103,7 @@ let UserPermissionService = class UserPermissionService {
             throw error;
         }
     }
-    /** Revoke permission from user */ async revokePermission(userId, targetId, type) {
+    async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
         const typeName = type === _usercompanypermissionentity.PermissionType.COMPANY ? 'company' : 'branch';
         const permission = await repository.findOne({
@@ -110,7 +111,10 @@ let UserPermissionService = class UserPermissionService {
                 userId,
                 targetId,
                 permissionType: type
-            }
+            },
+            relations: [
+                type === _usercompanypermissionentity.PermissionType.BRANCH ? 'branch' : 'company'
+            ]
         });
         if (!permission) {
             throw new _common.NotFoundException({
@@ -121,7 +125,29 @@ let UserPermissionService = class UserPermissionService {
                 }
             });
         }
+        const companyId = type === _usercompanypermissionentity.PermissionType.COMPANY ? targetId : permission.branch?.companyId;
         await repository.remove(permission);
+        if (type === _usercompanypermissionentity.PermissionType.COMPANY) {
+            const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
+            await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
+            await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
+        } else {
+            if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
+        }
+    }
+    async revokeBranchPermissionsForCompany(repository, userId, companyId) {
+        const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
+            userId
+        }).andWhere('permission.permissionType = :type', {
+            type: _usercompanypermissionentity.PermissionType.BRANCH
+        }).andWhere('branch.companyId = :companyId', {
+            companyId
+        }).getMany();
+        if (branchPermissions.length === 0) {
+            return [];
+        }
+        await repository.remove(branchPermissions);
+        return branchPermissions.map((permission)=>permission.targetId);
     }
     /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
         const repository = await this.getRepository();
@@ -137,12 +163,14 @@ let UserPermissionService = class UserPermissionService {
         }
         return queryBuilder.getMany();
     }
-    constructor(dataSourceProvider){
+    constructor(dataSourceProvider, permissionSyncAdapter){
         _define_property(this, "dataSourceProvider", void 0);
+        _define_property(this, "permissionSyncAdapter", void 0);
         _define_property(this, "_repository", void 0);
         // Convenience Methods
         _define_property(this, "findUserCompanies", void 0);
         this.dataSourceProvider = dataSourceProvider;
+        this.permissionSyncAdapter = permissionSyncAdapter;
         this._repository = null;
         this.findUserCompanies = (userId)=>this.findUserPermissions(userId, _usercompanypermissionentity.PermissionType.COMPANY);
     }
@@ -178,8 +206,11 @@ UserPermissionService = _ts_decorate([
         scope: _common.Scope.REQUEST
     }),
     _ts_param(0, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
+    _ts_param(1, (0, _common.Optional)()),
+    _ts_param(1, (0, _common.Inject)(_interfaces.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider
+        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
+        typeof _interfaces.IPermissionSyncAdapter === "undefined" ? Object : _interfaces.IPermissionSyncAdapter
     ])
 ], UserPermissionService);