@flusys/nestjs-auth 6.4.1 → 7.0.0

package/cjs/config/event-actions.js

@@ -0,0 +1,45 @@
+/**
+ * Domain event actions published by the auth module, alongside the CRUD
+ * lifecycle actions every ApiService emits.
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get AUTH_EVENT_ACTIONS () {
+        return AUTH_EVENT_ACTIONS;
+    },
+    get AUTH_EVENT_ENTITIES () {
+        return AUTH_EVENT_ENTITIES;
+    },
+    get AUTH_EVENT_MODULE () {
+        return AUTH_EVENT_MODULE;
+    }
+});
+const AUTH_EVENT_ACTIONS = {
+    LOGGED_IN: 'logged-in',
+    LOGGED_OUT: 'logged-out',
+    TOKEN_REFRESHED: 'token-refreshed',
+    COMPANY_SWITCHED: 'company-switched',
+    REGISTERED: 'registered',
+    PASSWORD_CHANGED: 'password-changed',
+    PASSWORD_RESET_REQUESTED: 'password-reset-requested',
+    PASSWORD_RESET: 'password-reset',
+    EMAIL_VERIFIED: 'email-verified',
+    PERMISSION_GRANTED: 'permission-granted',
+    PERMISSION_REVOKED: 'permission-revoked'
+};
+const AUTH_EVENT_ENTITIES = {
+    USER: 'appuser',
+    COMPANY: 'company',
+    COMPANY_BRANCH: 'company_branch',
+    SESSION: 'session',
+    USER_PERMISSION: 'user_company_permission'
+};
+const AUTH_EVENT_MODULE = 'auth';

package/cjs/config/index.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", {
     value: true
 });
 _export_star(require("./auth.constants"), exports);
+_export_star(require("./event-actions"), exports);
 _export_star(require("./message-keys"), exports);
 function _export_star(from, to) {
     Object.keys(from).forEach(function(k) {

package/cjs/config/message-keys.js

@@ -13,6 +13,12 @@ _export(exports, {
     get AUTH_MESSAGES () {
         return AUTH_MESSAGES;
     },
+    get BRANCH_MESSAGES () {
+        return BRANCH_MESSAGES;
+    },
+    get COMPANY_MESSAGES () {
+        return COMPANY_MESSAGES;
+    },
     get EMAIL_VERIFICATION_MESSAGES () {
         return EMAIL_VERIFICATION_MESSAGES;
     },
@@ -87,6 +93,12 @@ const USER_MESSAGES = {
     STATUS_UPDATE_SUCCESS: 'user.status.update.success',
     LOOKUP_SUCCESS: 'user.lookup.success'
 };
+const COMPANY_MESSAGES = {
+    READONLY_DELETE_FORBIDDEN: 'company.readonly.delete.forbidden'
+};
+const BRANCH_MESSAGES = {
+    READONLY_DELETE_FORBIDDEN: 'branch.readonly.delete.forbidden'
+};
 const USER_PERMISSION_MESSAGES = {
     COMPANY_LIST_SUCCESS: 'user.permission.company.list.success',
     BRANCH_LIST_SUCCESS: 'user.permission.branch.list.success',

package/cjs/modules/auth.module.js

@@ -103,7 +103,8 @@ let AuthModule = class AuthModule {
             _services.AuthenticationService,
             _settokeninterceptor.SetToken,
             _cleartokeninterceptor.ClearToken,
-            _services.UserService
+            _services.UserService,
+            (0, _modules.createModuleEventsProvider)('auth', _authconstants.AUTH_MODULE_OPTIONS)
         ];
         if (flags.enableEmailVerification) {
             providers.push(_services.AuthEmailService);

package/cjs/services/auth-email.service.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "AuthEmailService", {
     }
 });
 const _nestjsshared = require("@flusys/nestjs-shared");
+const _classes = require("@flusys/nestjs-shared/classes");
 const _constants = require("@flusys/nestjs-shared/constants");
 const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
@@ -242,6 +243,9 @@ let AuthEmailService = class AuthEmailService {
                 }
             });
         }
+        await this.publishUserEvent(_config.AUTH_EVENT_ACTIONS.PASSWORD_RESET_REQUESTED, user.id, {
+            email: user.email
+        });
         return {
             success: true,
             message: 'If the email exists, a password reset link has been sent.',
@@ -283,6 +287,9 @@ let AuthEmailService = class AuthEmailService {
         // Mark token as used
         userToken.usedAt = new Date();
         await tokenRepository.save(userToken);
+        await this.publishUserEvent(_config.AUTH_EVENT_ACTIONS.PASSWORD_RESET, user.id, {
+            email: user.email
+        });
         return {
             success: true,
             message: 'Password has been reset successfully.',
@@ -366,12 +373,26 @@ let AuthEmailService = class AuthEmailService {
         // Mark token as used
         userToken.usedAt = new Date();
         await tokenRepository.save(userToken);
+        await this.publishUserEvent(_config.AUTH_EVENT_ACTIONS.EMAIL_VERIFIED, user.id, {
+            email: user.email
+        });
         return {
             type: 'verified',
             message: 'Email has been verified successfully.',
             messageKey: _config.EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS
         };
     }
+    async publishUserEvent(action, userId, metadata) {
+        await (0, _classes.publishDomainEvent)({
+            module: _config.AUTH_EVENT_MODULE,
+            entity: _config.AUTH_EVENT_ENTITIES.USER,
+            action,
+            ids: [
+                userId
+            ],
+            metadata
+        });
+    }
     async resendVerificationEmail(email, verifyUrlBase) {
         this.assertEmailEnabled();
         const pendingRepository = await this.getRepository(_pendingregistrationentity.PendingRegistration);

package/cjs/services/auth-email.service.spec.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _classes = require("@flusys/nestjs-shared/classes");
 const _authemailservice = require("./auth-email.service");
 const _appuserentity = require("../entities/app-user.entity");
 const _pendingregistrationentity = require("../entities/pending-registration.entity");
@@ -401,4 +402,55 @@ describe('AuthEmailService', ()=>{
             })).rejects.toThrow(_common.InternalServerErrorException);
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            _classes.EventBusRegistry.reset();
+            _classes.EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            _classes.EventBusRegistry.configureModule('auth', {
+                enabled: true
+            });
+        });
+        afterEach(()=>{
+            _classes.EventBusRegistry.reset();
+        });
+        it('publishes auth.appuser.password-reset-requested once the reset email is sent', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(buildUserToken());
+            await service.forgotPassword('user@example.com', 'https://app.test/reset');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-reset-requested'
+            }));
+        });
+        it('publishes nothing for an unknown email so enumeration stays impossible', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await service.forgotPassword('missing@example.com', 'https://app.test/reset');
+            expect(publish).not.toHaveBeenCalled();
+        });
+        it('publishes auth.appuser.password-reset when the token is consumed', async ()=>{
+            const token = buildUserToken();
+            tokenRepo.findOne.mockResolvedValue(token);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(token);
+            await service.resetPassword('raw-token', 'NewPassword1!');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-reset'
+            }));
+        });
+        it('does not publish when the auth module has events disabled', async ()=>{
+            _classes.EventBusRegistry.configureModule('auth', {
+                enabled: false
+            });
+            userRepo.findOne.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(buildUserToken());
+            await service.forgotPassword('user@example.com', 'https://app.test/reset');
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/cjs/services/authentication.service.js

@@ -579,7 +579,12 @@ let AuthenticationService = class AuthenticationService {
                 messageKey: _config.AUTH_MESSAGES.BRANCH_NOT_FOUND
             });
         }
-        return this.generateLoginResponseWithCompany(user, company, branch);
+        const response = this.generateLoginResponseWithCompany(user, company, branch);
+        this.publishSessionEvent(_config.AUTH_EVENT_ACTIONS.COMPANY_SWITCHED, user, {
+            companyId: company.id,
+            branchId: branch.id
+        });
+        return response;
     }
     async refreshToken(refreshToken) {
         try {
@@ -673,7 +678,7 @@ let AuthenticationService = class AuthenticationService {
                     }
                 }
             }
-            return (0, _helpers.generateTokens)(this.jwtService, this.authConfig, {
+            const tokens = (0, _helpers.generateTokens)(this.jwtService, this.authConfig, {
                 id: user.id,
                 email: user.email,
                 type: 'access',
@@ -685,6 +690,11 @@ let AuthenticationService = class AuthenticationService {
                     branchId: payload.branchId
                 }
             });
+            this.publishSessionEvent(_config.AUTH_EVENT_ACTIONS.TOKEN_REFRESHED, user, {
+                companyId: payload.companyId ?? null,
+                branchId: payload.branchId ?? null
+            });
+            return tokens;
         } catch  {
             throw new _common.UnauthorizedException({
                 message: 'Invalid or expired refresh token',
@@ -711,6 +721,7 @@ let AuthenticationService = class AuthenticationService {
         }
         user.password = await _bcrypt.hash(newPassword, _config.BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
+        this.publishUserEvent(_config.AUTH_EVENT_ACTIONS.PASSWORD_CHANGED, user);
     }
     async logout(userId) {
         if (!this.cacheManager) {
@@ -724,6 +735,17 @@ let AuthenticationService = class AuthenticationService {
         const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
         const ttlMs = (0, _helpers.parseExpiryToMs)(refreshTokenExpiry);
         await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+        await (0, _classes.publishDomainEvent)({
+            module: _config.AUTH_EVENT_MODULE,
+            entity: _config.AUTH_EVENT_ENTITIES.SESSION,
+            action: _config.AUTH_EVENT_ACTIONS.LOGGED_OUT,
+            ids: [
+                userId
+            ],
+            user: {
+                id: userId
+            }
+        });
     }
     async isTokenRevoked(userId, tokenIssuedAt) {
         if (!this.cacheManager || !tokenIssuedAt) {
@@ -897,6 +919,7 @@ let AuthenticationService = class AuthenticationService {
             type: 'access'
         });
         this.sendLoginNotification(user.id);
+        this.publishSessionEvent(_config.AUTH_EVENT_ACTIONS.LOGGED_IN, user);
         return {
             accessToken,
             refreshToken,
@@ -912,6 +935,10 @@ let AuthenticationService = class AuthenticationService {
             branchId: branch?.id
         });
         this.sendLoginNotification(user.id, company.id);
+        this.publishSessionEvent(_config.AUTH_EVENT_ACTIONS.LOGGED_IN, user, {
+            companyId: company.id,
+            branchId: branch?.id ?? null
+        });
         return {
             accessToken,
             refreshToken,
@@ -958,16 +985,47 @@ let AuthenticationService = class AuthenticationService {
         };
     }
     generateRegistrationResponse(user) {
-        return {
+        const response = {
             ...this.generateLoginResponse(user),
             requiresEmailVerification: false
         };
+        this.publishUserEvent(_config.AUTH_EVENT_ACTIONS.REGISTERED, user);
+        return response;
     }
     generateRegistrationResponseWithCompany(user, company, branch) {
-        return {
+        const response = {
             ...this.generateLoginResponseWithCompany(user, company, branch),
             requiresEmailVerification: false
         };
+        this.publishUserEvent(_config.AUTH_EVENT_ACTIONS.REGISTERED, user, {
+            companyId: company.id,
+            branchId: branch?.id ?? null
+        });
+        return response;
+    }
+    publishSessionEvent(action, user, metadata = {}) {
+        this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.SESSION, action, user, metadata);
+    }
+    publishUserEvent(action, user, metadata = {}) {
+        this.publishAuthEvent(_config.AUTH_EVENT_ENTITIES.USER, action, user, metadata);
+    }
+    /** Never awaited - a login must not wait on, or fail because of, the event bus */ publishAuthEvent(entity, action, user, metadata) {
+        void (0, _classes.publishDomainEvent)({
+            module: _config.AUTH_EVENT_MODULE,
+            entity,
+            action,
+            ids: [
+                user.id
+            ],
+            metadata: {
+                email: user.email,
+                ...metadata
+            },
+            user: {
+                id: user.id,
+                email: user.email
+            }
+        });
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher, notificationAdapter){

package/cjs/services/authentication.service.spec.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 const _common = require("@nestjs/common");
 const _bcrypt = /*#__PURE__*/ _interop_require_wildcard(require("bcrypt"));
 const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _classes = require("@flusys/nestjs-shared/classes");
 const _authenticationservice = require("./authentication.service");
 const _appuserentity = require("../entities/app-user.entity");
 const _companyentity = require("../entities/company.entity");
@@ -901,4 +902,61 @@ describe('AuthenticationService', ()=>{
             }));
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            _classes.EventBusRegistry.reset();
+            _classes.EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            _classes.EventBusRegistry.configureModule('auth', {
+                enabled: true
+            });
+        });
+        afterEach(()=>{
+            _classes.EventBusRegistry.reset();
+        });
+        it('publishes auth.session.logged-in when a session is issued', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            _bcrypt.compare.mockResolvedValue(true);
+            const service = buildService();
+            await service.login('user@example.com', 'password');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.session.logged-in',
+                action: 'logged-in',
+                payload: expect.objectContaining({
+                    ids: [
+                        'user-1'
+                    ]
+                })
+            }));
+        });
+        it('publishes auth.session.logged-out on logout', async ()=>{
+            const service = buildService();
+            await service.logout('user-1');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.session.logged-out'
+            }));
+        });
+        it('publishes auth.appuser.password-changed after a successful password change', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            _bcrypt.compare.mockResolvedValue(true);
+            const service = buildService();
+            await service.changePassword('user-1', 'old', 'new');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-changed'
+            }));
+        });
+        it('does not publish when the auth module has events disabled', async ()=>{
+            _classes.EventBusRegistry.configureModule('auth', {
+                enabled: false
+            });
+            const service = buildService();
+            await service.logout('user-1');
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/cjs/services/branch.service.js

@@ -14,6 +14,7 @@ const _modules = require("@flusys/nestjs-shared/modules");
 const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
 const _typeorm = require("typeorm");
+const _config = require("../config");
 const _companybranchentity = require("../entities/company-branch.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
 const _authconfigservice = require("./auth-config.service");
@@ -50,6 +51,24 @@ let BranchService = class BranchService extends _classes.ApiService {
         const branchIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
+        await this.ensureDataSourceRepository();
+        const readonlyBranches = await this.repository.find({
+            where: {
+                id: (0, _typeorm.In)(branchIds),
+                readOnly: true,
+                deletedAt: (0, _typeorm.IsNull)()
+            }
+        });
+        if (readonlyBranches.length > 0) {
+            const names = readonlyBranches.map((b)=>b.name).join(', ');
+            throw new _common.ForbiddenException({
+                message: `Cannot delete readonly branch(es): ${names}`,
+                messageKey: _config.BRANCH_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         await queryRunner.manager.getRepository(_usercompanypermissionentity.UserCompanyPermission).delete({
             targetId: (0, _typeorm.In)(branchIds)
         });
@@ -77,6 +96,7 @@ let BranchService = class BranchService extends _classes.ApiService {
                 'email',
                 'phone',
                 'isActive',
+                'readOnly',
                 'createdAt'
             ];
         }

package/cjs/services/branch.service.spec.js

@@ -14,6 +14,7 @@ describe('BranchService', ()=>{
     let mockQueryRunner;
     beforeEach(()=>{
         mockRepo = (0, _repositorymock.createMockRepository)();
+        mockRepo.find.mockResolvedValue([]);
         Object.assign(mockRepo.createQueryBuilder(), {
             leftJoinAndSelect: jest.fn().mockReturnThis(),
             addOrderBy: jest.fn().mockReturnThis()
@@ -82,6 +83,20 @@ describe('BranchService', ()=>{
             }, null, mockQueryRunner);
             expect(mockPermissionSyncAdapter.onBranchDeleted).toHaveBeenCalledWith('branch-1', 'company-1');
         });
+        it('rejects deleting a readonly branch', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                {
+                    id: 'branch-1',
+                    name: 'Default Branch',
+                    readOnly: true
+                }
+            ]);
+            const permissionRepo = mockQueryRunner.manager.getRepository(_usercompanypermissionentity.UserCompanyPermission);
+            await expect(service.beforeDeleteOperation({
+                id: 'branch-1'
+            }, null, mockQueryRunner)).rejects.toThrow('Cannot delete readonly branch');
+            expect(permissionRepo.delete).not.toHaveBeenCalled();
+        });
     });
     describe('getSelectQuery', ()=>{
         it('applies the default selected fields when none are provided', async ()=>{

package/cjs/services/company.service.js

@@ -13,6 +13,7 @@ const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _modules = require("@flusys/nestjs-shared/modules");
 const _common = require("@nestjs/common");
 const _typeorm = require("typeorm");
+const _config = require("../config");
 const _companybranchentity = require("../entities/company-branch.entity");
 const _companyentity = require("../entities/company.entity");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
@@ -49,6 +50,24 @@ let CompanyService = class CompanyService extends _classes.ApiService {
         const companyIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
+        await this.ensureDataSourceRepository();
+        const readonlyCompanies = await this.repository.find({
+            where: {
+                id: (0, _typeorm.In)(companyIds),
+                readOnly: true,
+                deletedAt: (0, _typeorm.IsNull)()
+            }
+        });
+        if (readonlyCompanies.length > 0) {
+            const names = readonlyCompanies.map((c)=>c.name).join(', ');
+            throw new _common.ForbiddenException({
+                message: `Cannot delete readonly company(ies): ${names}`,
+                messageKey: _config.COMPANY_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         const branchRows = await queryRunner.manager.getRepository(_companybranchentity.CompanyBranch).find({
             where: {
                 companyId: (0, _typeorm.In)(companyIds)
@@ -79,6 +98,7 @@ let CompanyService = class CompanyService extends _classes.ApiService {
                 'email',
                 'phone',
                 'isActive',
+                'readOnly',
                 'createdAt'
             ];
         }

package/cjs/services/company.service.spec.js

@@ -15,6 +15,7 @@ describe('CompanyService', ()=>{
     let permissionRepo;
     beforeEach(()=>{
         mockRepo = (0, _repositorymock.createMockRepository)();
+        mockRepo.find.mockResolvedValue([]);
         const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
         mockPermissionSyncAdapter = {
             onCompanyDeleted: jest.fn()
@@ -79,6 +80,19 @@ describe('CompanyService', ()=>{
             expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-1');
             expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-2');
         });
+        it('rejects deleting a readonly company', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                {
+                    id: 'company-1',
+                    name: 'Default Company',
+                    readOnly: true
+                }
+            ]);
+            await expect(service.beforeDeleteOperation({
+                id: 'company-1'
+            }, null, mockQueryRunner)).rejects.toThrow('Cannot delete readonly company');
+            expect(branchRepo.find).not.toHaveBeenCalled();
+        });
     });
     describe('getSelectQuery', ()=>{
         it('applies the default selected fields when none are provided', async ()=>{

package/cjs/services/user-permission.service.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "UserPermissionService", {
     }
 });
 const _nestjsshared = require("@flusys/nestjs-shared");
+const _classes = require("@flusys/nestjs-shared/classes");
 const _interfaces = require("@flusys/nestjs-shared/interfaces");
 const _common = require("@nestjs/common");
 const _config = require("../config");
@@ -102,6 +103,7 @@ let UserPermissionService = class UserPermissionService {
             }
             throw error;
         }
+        await this.publishPermissionEvent(_config.AUTH_EVENT_ACTIONS.PERMISSION_GRANTED, userId, targetId, type);
     }
     async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
@@ -134,6 +136,24 @@ let UserPermissionService = class UserPermissionService {
         } else {
             if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
         }
+        await this.publishPermissionEvent(_config.AUTH_EVENT_ACTIONS.PERMISSION_REVOKED, userId, targetId, type, companyId);
+    }
+    async publishPermissionEvent(action, userId, targetId, type, companyId) {
+        await (0, _classes.publishDomainEvent)({
+            module: _config.AUTH_EVENT_MODULE,
+            entity: _config.AUTH_EVENT_ENTITIES.USER_PERMISSION,
+            action,
+            ids: [
+                targetId
+            ],
+            metadata: {
+                targetUserId: userId,
+                permissionType: type,
+                ...companyId ? {
+                    companyId
+                } : {}
+            }
+        });
     }
     async revokeBranchPermissionsForCompany(repository, userId, companyId) {
         const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {

package/cjs/services/user-permission.service.spec.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", {
     value: true
 });
 const _common = require("@nestjs/common");
+const _classes = require("@flusys/nestjs-shared/classes");
 const _repositorymock = require("@test-utils/mocks/repository.mock");
 const _userpermissionservice = require("./user-permission.service");
 const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
@@ -199,4 +200,55 @@ describe('UserPermissionService', ()=>{
             });
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            _classes.EventBusRegistry.reset();
+            _classes.EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            _classes.EventBusRegistry.configureModule('auth', {
+                enabled: true
+            });
+        });
+        afterEach(()=>{
+            _classes.EventBusRegistry.reset();
+        });
+        it('publishes permission-granted after a new assignment', async ()=>{
+            mockRepo.findOne.mockResolvedValue(null);
+            mockRepo.create.mockReturnValue(buildPermission());
+            mockRepo.save.mockResolvedValue(buildPermission());
+            await service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY);
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.user_company_permission.permission-granted',
+                payload: expect.objectContaining({
+                    ids: [
+                        'company-1'
+                    ],
+                    metadata: expect.objectContaining({
+                        targetUserId: 'user-1',
+                        permissionType: _usercompanypermissionentity.PermissionType.COMPANY
+                    })
+                })
+            }));
+        });
+        it('does not publish when the assignment is rejected as a duplicate', async ()=>{
+            mockRepo.findOne.mockResolvedValue(buildPermission());
+            await expect(service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY)).rejects.toThrow(_common.ConflictException);
+            expect(publish).not.toHaveBeenCalled();
+        });
+        it('does not publish when the auth module has events disabled', async ()=>{
+            _classes.EventBusRegistry.configureModule('auth', {
+                enabled: false
+            });
+            mockRepo.findOne.mockResolvedValue(null);
+            mockRepo.create.mockReturnValue(buildPermission());
+            mockRepo.save.mockResolvedValue(buildPermission());
+            await service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY);
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/config/event-actions.d.ts

@@ -0,0 +1,21 @@
+export declare const AUTH_EVENT_ACTIONS: {
+    readonly LOGGED_IN: "logged-in";
+    readonly LOGGED_OUT: "logged-out";
+    readonly TOKEN_REFRESHED: "token-refreshed";
+    readonly COMPANY_SWITCHED: "company-switched";
+    readonly REGISTERED: "registered";
+    readonly PASSWORD_CHANGED: "password-changed";
+    readonly PASSWORD_RESET_REQUESTED: "password-reset-requested";
+    readonly PASSWORD_RESET: "password-reset";
+    readonly EMAIL_VERIFIED: "email-verified";
+    readonly PERMISSION_GRANTED: "permission-granted";
+    readonly PERMISSION_REVOKED: "permission-revoked";
+};
+export declare const AUTH_EVENT_ENTITIES: {
+    readonly USER: "appuser";
+    readonly COMPANY: "company";
+    readonly COMPANY_BRANCH: "company_branch";
+    readonly SESSION: "session";
+    readonly USER_PERMISSION: "user_company_permission";
+};
+export declare const AUTH_EVENT_MODULE = "auth";