@flusys/nestjs-auth 6.4.0 → 7.0.0-beta.1

package/fesm/services/branch.service.spec.js

@@ -10,6 +10,7 @@ describe('BranchService', ()=>{
     let mockQueryRunner;
     beforeEach(()=>{
         mockRepo = createMockRepository();
+        mockRepo.find.mockResolvedValue([]);
         Object.assign(mockRepo.createQueryBuilder(), {
             leftJoinAndSelect: jest.fn().mockReturnThis(),
             addOrderBy: jest.fn().mockReturnThis()
@@ -78,6 +79,20 @@ describe('BranchService', ()=>{
             }, null, mockQueryRunner);
             expect(mockPermissionSyncAdapter.onBranchDeleted).toHaveBeenCalledWith('branch-1', 'company-1');
         });
+        it('rejects deleting a readonly branch', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                {
+                    id: 'branch-1',
+                    name: 'Default Branch',
+                    readOnly: true
+                }
+            ]);
+            const permissionRepo = mockQueryRunner.manager.getRepository(UserCompanyPermission);
+            await expect(service.beforeDeleteOperation({
+                id: 'branch-1'
+            }, null, mockQueryRunner)).rejects.toThrow('Cannot delete readonly branch');
+            expect(permissionRepo.delete).not.toHaveBeenCalled();
+        });
     });
     describe('getSelectQuery', ()=>{
         it('applies the default selected fields when none are provided', async ()=>{

package/fesm/services/company.service.js

@@ -28,8 +28,9 @@ function _ts_param(paramIndex, decorator) {
 import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { Inject, Injectable, Optional, Scope } from '@nestjs/common';
-import { In } from 'typeorm';
+import { ForbiddenException, Inject, Injectable, Optional, Scope } from '@nestjs/common';
+import { In, IsNull } from 'typeorm';
+import { COMPANY_MESSAGES } from '../config';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
@@ -39,6 +40,24 @@ export class CompanyService extends ApiService {
         const companyIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
+        await this.ensureDataSourceRepository();
+        const readonlyCompanies = await this.repository.find({
+            where: {
+                id: In(companyIds),
+                readOnly: true,
+                deletedAt: IsNull()
+            }
+        });
+        if (readonlyCompanies.length > 0) {
+            const names = readonlyCompanies.map((c)=>c.name).join(', ');
+            throw new ForbiddenException({
+                message: `Cannot delete readonly company(ies): ${names}`,
+                messageKey: COMPANY_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         const branchRows = await queryRunner.manager.getRepository(CompanyBranch).find({
             where: {
                 companyId: In(companyIds)
@@ -69,6 +88,7 @@ export class CompanyService extends ApiService {
                 'email',
                 'phone',
                 'isActive',
+                'readOnly',
                 'createdAt'
             ];
         }

package/fesm/services/company.service.spec.js

@@ -11,6 +11,7 @@ describe('CompanyService', ()=>{
     let permissionRepo;
     beforeEach(()=>{
         mockRepo = createMockRepository();
+        mockRepo.find.mockResolvedValue([]);
         const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
         mockPermissionSyncAdapter = {
             onCompanyDeleted: jest.fn()
@@ -75,6 +76,19 @@ describe('CompanyService', ()=>{
             expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-1');
             expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-2');
         });
+        it('rejects deleting a readonly company', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                {
+                    id: 'company-1',
+                    name: 'Default Company',
+                    readOnly: true
+                }
+            ]);
+            await expect(service.beforeDeleteOperation({
+                id: 'company-1'
+            }, null, mockQueryRunner)).rejects.toThrow('Cannot delete readonly company');
+            expect(branchRepo.find).not.toHaveBeenCalled();
+        });
     });
     describe('getSelectQuery', ()=>{
         it('applies the default selected fields when none are provided', async ()=>{

package/fesm/services/user-permission.service.js

@@ -26,9 +26,10 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
+import { publishDomainEvent } from '@flusys/nestjs-shared/classes';
 import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { ConflictException, Inject, Injectable, NotFoundException, Optional, Scope } from '@nestjs/common';
-import { USER_PERMISSION_MESSAGES } from '../config';
+import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, USER_PERMISSION_MESSAGES } from '../config';
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class UserPermissionService {
@@ -92,6 +93,7 @@ export class UserPermissionService {
             }
             throw error;
         }
+        await this.publishPermissionEvent(AUTH_EVENT_ACTIONS.PERMISSION_GRANTED, userId, targetId, type);
     }
     async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
@@ -124,6 +126,24 @@ export class UserPermissionService {
         } else {
             if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
         }
+        await this.publishPermissionEvent(AUTH_EVENT_ACTIONS.PERMISSION_REVOKED, userId, targetId, type, companyId);
+    }
+    async publishPermissionEvent(action, userId, targetId, type, companyId) {
+        await publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity: AUTH_EVENT_ENTITIES.USER_PERMISSION,
+            action,
+            ids: [
+                targetId
+            ],
+            metadata: {
+                targetUserId: userId,
+                permissionType: type,
+                ...companyId ? {
+                    companyId
+                } : {}
+            }
+        });
     }
     async revokeBranchPermissionsForCompany(repository, userId, companyId) {
         const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {

package/fesm/services/user-permission.service.spec.js

@@ -1,4 +1,5 @@
 import { ConflictException, NotFoundException } from '@nestjs/common';
+import { EventBusRegistry } from '@flusys/nestjs-shared/classes';
 import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
 import { UserPermissionService } from './user-permission.service';
 import { PermissionType } from '../entities/user-company-permission.entity';
@@ -195,4 +196,55 @@ describe('UserPermissionService', ()=>{
             });
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            EventBusRegistry.reset();
+            EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            EventBusRegistry.configureModule('auth', {
+                enabled: true
+            });
+        });
+        afterEach(()=>{
+            EventBusRegistry.reset();
+        });
+        it('publishes permission-granted after a new assignment', async ()=>{
+            mockRepo.findOne.mockResolvedValue(null);
+            mockRepo.create.mockReturnValue(buildPermission());
+            mockRepo.save.mockResolvedValue(buildPermission());
+            await service.assignPermission('user-1', 'company-1', PermissionType.COMPANY);
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.user_company_permission.permission-granted',
+                payload: expect.objectContaining({
+                    ids: [
+                        'company-1'
+                    ],
+                    metadata: expect.objectContaining({
+                        targetUserId: 'user-1',
+                        permissionType: PermissionType.COMPANY
+                    })
+                })
+            }));
+        });
+        it('does not publish when the assignment is rejected as a duplicate', async ()=>{
+            mockRepo.findOne.mockResolvedValue(buildPermission());
+            await expect(service.assignPermission('user-1', 'company-1', PermissionType.COMPANY)).rejects.toThrow(ConflictException);
+            expect(publish).not.toHaveBeenCalled();
+        });
+        it('does not publish when the auth module has events disabled', async ()=>{
+            EventBusRegistry.configureModule('auth', {
+                enabled: false
+            });
+            mockRepo.findOne.mockResolvedValue(null);
+            mockRepo.create.mockReturnValue(buildPermission());
+            mockRepo.save.mockResolvedValue(buildPermission());
+            await service.assignPermission('user-1', 'company-1', PermissionType.COMPANY);
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/fesm/services/user.service.js

@@ -79,10 +79,13 @@ export class UserService extends ApiService {
         await this.repository.update(id, {
             emailVerified: true
         });
-        await this.clearCacheForId([
-            {
-                id
-            }
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
         ]);
     }
     async verifyPhone(id) {
@@ -90,10 +93,13 @@ export class UserService extends ApiService {
         await this.repository.update(id, {
             phoneVerified: true
         });
-        await this.clearCacheForId([
-            {
-                id
-            }
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
         ]);
     }
     async updateStatus(id, isActive, user) {
@@ -123,10 +129,13 @@ export class UserService extends ApiService {
                 isActive
             });
         }
-        await this.clearCacheForId([
-            {
-                id
-            }
+        await Promise.all([
+            this.clearCacheForAll(),
+            this.clearCacheForId([
+                {
+                    id
+                }
+            ])
         ]);
     }
     async convertSingleDtoToEntity(dto, user) {
@@ -350,8 +359,11 @@ export class UserService extends ApiService {
                 }
             }
             await queryRunner.commitTransaction();
-            await this.clearCacheForId([
-                savedUser
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    savedUser
+                ])
             ]);
             return this.convertEntityToResponseDto(savedUser, false);
         } catch (error) {
@@ -420,8 +432,11 @@ export class UserService extends ApiService {
         try {
             await this.userEnricher.updateProfileSection(userId, sectionId, data, queryRunner);
             await queryRunner.commitTransaction();
-            await this.clearCacheForId([
-                userEntity
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    userEntity
+                ])
             ]);
         } catch (error) {
             await queryRunner.rollbackTransaction();
@@ -490,8 +505,11 @@ export class UserService extends ApiService {
                 await this.userEnricher.updateProfileExtras(userId, extras, queryRunner);
             }
             await queryRunner.commitTransaction();
-            await this.clearCacheForId([
-                findUser
+            await Promise.all([
+                this.clearCacheForAll(),
+                this.clearCacheForId([
+                    findUser
+                ])
             ]);
             return findUser.id;
         } catch (error) {

package/fesm/services/user.service.spec.js

@@ -79,6 +79,13 @@ describe('UserService', ()=>{
         };
         service = new UserService({}, mockUtilsService, mockDataSourceProvider, mockAuthConfig, mockUserEnricher);
     });
+    /**
+   * Every write path has to drop both the list cache and the row's own cache, or a
+   * stale user keeps being served from `get-all`.
+   */ function expectCacheCleared(id) {
+        expect(mockUtilsService.clearCache).toHaveBeenCalledWith('appuser', expect.anything());
+        expect(mockUtilsService.clearCache).toHaveBeenCalledWith('appuser', expect.anything(), id);
+    }
     describe('ensureDataSourceRepository', ()=>{
         it('does not load the permission repository when the company feature is disabled', async ()=>{
             await service.ensureDataSourceRepository();
@@ -97,13 +104,14 @@ describe('UserService', ()=>{
             expect(userRepo.update).toHaveBeenCalledWith('user-1', {
                 emailVerified: true
             });
-            expect(mockUtilsService.clearCache).toHaveBeenCalled();
+            expectCacheCleared('user-1');
         });
         it('marks the phone as verified and clears the cache', async ()=>{
             await service.verifyPhone('user-1');
             expect(userRepo.update).toHaveBeenCalledWith('user-1', {
                 phoneVerified: true
             });
+            expectCacheCleared('user-1');
         });
     });
     describe('updateStatus', ()=>{
@@ -112,6 +120,7 @@ describe('UserService', ()=>{
             expect(userRepo.update).toHaveBeenCalledWith('user-1', {
                 isActive: false
             });
+            expectCacheCleared('user-1');
         });
         it('throws NotFoundException when the company permission is missing', async ()=>{
             companyFeatureEnabled = true;
@@ -134,6 +143,7 @@ describe('UserService', ()=>{
                 isActive: false
             }));
             expect(userRepo.update).not.toHaveBeenCalled();
+            expectCacheCleared('user-1');
         });
     });
     describe('convertSingleDtoToEntity', ()=>{
@@ -344,6 +354,7 @@ describe('UserService', ()=>{
             expect(result).toEqual(expect.objectContaining({
                 id: 'user-1'
             }));
+            expectCacheCleared(savedUser.id);
         });
         it('rolls back the transaction if permission assignment fails', async ()=>{
             companyFeatureEnabled = true;
@@ -532,6 +543,7 @@ describe('UserService', ()=>{
                 foo: 'bar'
             }, queryRunner);
             expect(queryRunner.commitTransaction).toHaveBeenCalled();
+            expectCacheCleared('user-1');
         });
         it('rolls back the transaction when the enricher throws', async ()=>{
             userRepo.findOne.mockResolvedValue(buildAppUser());
@@ -625,6 +637,7 @@ describe('UserService', ()=>{
             expect(queryRunner.manager.save).toHaveBeenCalled();
             expect(queryRunner.commitTransaction).toHaveBeenCalled();
             expect(result).toBe('user-1');
+            expectCacheCleared('user-1');
         });
         it('does not require the current password when an admin updates another user profile', async ()=>{
             service.dataSource = mockDataSource;
@@ -641,6 +654,7 @@ describe('UserService', ()=>{
             }));
             expect(queryRunner.manager.save).toHaveBeenCalled();
             expect(queryRunner.commitTransaction).toHaveBeenCalled();
+            expectCacheCleared('other-user');
         });
         it('rolls back the transaction when save fails', async ()=>{
             service.dataSource = mockDataSource;

package/interfaces/auth-module-options.interface.d.ts

@@ -1,4 +1,5 @@
 import { IBootstrapAppConfig, IDataSourceServiceOptions, IDynamicModuleConfig, IModuleOptionsFactory } from '@flusys/nestjs-core';
+import { IModuleEventsConfig } from '@flusys/nestjs-shared/interfaces';
 import { ModuleMetadata, Provider, Type } from '@nestjs/common';
 export interface IAuthModuleConfig extends IDataSourceServiceOptions {
     jwtSecret?: string;
@@ -6,6 +7,7 @@ export interface IAuthModuleConfig extends IDataSourceServiceOptions {
     refreshTokenSecret?: string;
     refreshTokenExpiration?: string;
     refreshTokenCookieName?: string;
+    events?: IModuleEventsConfig;
 }
 export interface AuthModuleOptions extends IDynamicModuleConfig {
     bootstrapAppConfig?: IBootstrapAppConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "6.4.0",
+  "version": "7.0.0-beta.1",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -98,7 +98,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.4.0",
-    "@flusys/nestjs-shared": "6.4.0"
+    "@flusys/nestjs-core": "7.0.0-beta.1",
+    "@flusys/nestjs-shared": "7.0.0-beta.1"
   }
 }

package/services/auth-email.service.d.ts

@@ -46,6 +46,7 @@ export declare class AuthEmailService {
         message: string;
         messageKey: string;
     }>;
+    private publishUserEvent;
     resendVerificationEmail(email: string, verifyUrlBase: string): Promise<{
         success: boolean;
         message: string;

package/services/authentication.service.d.ts

@@ -61,4 +61,7 @@ export declare class AuthenticationService {
     private generateCompanySelectionResponse;
     private generateRegistrationResponse;
     private generateRegistrationResponseWithCompany;
+    private publishSessionEvent;
+    private publishUserEvent;
+    private publishAuthEvent;
 }

package/services/user-permission.service.d.ts

@@ -10,6 +10,7 @@ export declare class UserPermissionService {
     findUserPermissions(userId: string, type: PermissionType): Promise<UserCompanyPermission[]>;
     assignPermission(userId: string, targetId: string, type: PermissionType): Promise<void>;
     revokePermission(userId: string, targetId: string, type: PermissionType): Promise<void>;
+    private publishPermissionEvent;
     private revokeBranchPermissionsForCompany;
     findUserCompanies: (userId: string) => Promise<UserCompanyPermission[]>;
     findUserBranches(userId: string, companyId?: string): Promise<UserCompanyPermission[]>;