@flusys/nestjs-auth 6.4.1 → 7.0.0

package/config/index.d.ts

@@ -1,2 +1,3 @@
 export * from './auth.constants';
+export * from './event-actions';
 export * from './message-keys';

package/config/message-keys.d.ts

@@ -62,6 +62,12 @@ export declare const USER_MESSAGES: {
     readonly STATUS_UPDATE_SUCCESS: "user.status.update.success";
     readonly LOOKUP_SUCCESS: "user.lookup.success";
 };
+export declare const COMPANY_MESSAGES: {
+    readonly READONLY_DELETE_FORBIDDEN: "company.readonly.delete.forbidden";
+};
+export declare const BRANCH_MESSAGES: {
+    readonly READONLY_DELETE_FORBIDDEN: "branch.readonly.delete.forbidden";
+};
 export declare const USER_PERMISSION_MESSAGES: {
     readonly COMPANY_LIST_SUCCESS: "user.permission.company.list.success";
     readonly BRANCH_LIST_SUCCESS: "user.permission.branch.list.success";

package/fesm/config/event-actions.js

@@ -0,0 +1,24 @@
+/**
+ * Domain event actions published by the auth module, alongside the CRUD
+ * lifecycle actions every ApiService emits.
+ */ export const AUTH_EVENT_ACTIONS = {
+    LOGGED_IN: 'logged-in',
+    LOGGED_OUT: 'logged-out',
+    TOKEN_REFRESHED: 'token-refreshed',
+    COMPANY_SWITCHED: 'company-switched',
+    REGISTERED: 'registered',
+    PASSWORD_CHANGED: 'password-changed',
+    PASSWORD_RESET_REQUESTED: 'password-reset-requested',
+    PASSWORD_RESET: 'password-reset',
+    EMAIL_VERIFIED: 'email-verified',
+    PERMISSION_GRANTED: 'permission-granted',
+    PERMISSION_REVOKED: 'permission-revoked'
+};
+/** Every entity the auth module publishes under, ApiService backed or not */ export const AUTH_EVENT_ENTITIES = {
+    USER: 'appuser',
+    COMPANY: 'company',
+    COMPANY_BRANCH: 'company_branch',
+    SESSION: 'session',
+    USER_PERMISSION: 'user_company_permission'
+};
+export const AUTH_EVENT_MODULE = 'auth';

package/fesm/config/index.js

@@ -1,2 +1,3 @@
 export * from './auth.constants';
+export * from './event-actions';
 export * from './message-keys';

package/fesm/config/message-keys.js

@@ -63,6 +63,12 @@ export const USER_MESSAGES = {
     STATUS_UPDATE_SUCCESS: 'user.status.update.success',
     LOOKUP_SUCCESS: 'user.lookup.success'
 };
+export const COMPANY_MESSAGES = {
+    READONLY_DELETE_FORBIDDEN: 'company.readonly.delete.forbidden'
+};
+export const BRANCH_MESSAGES = {
+    READONLY_DELETE_FORBIDDEN: 'branch.readonly.delete.forbidden'
+};
 export const USER_PERMISSION_MESSAGES = {
     COMPANY_LIST_SUCCESS: 'user.permission.company.list.success',
     BRANCH_LIST_SUCCESS: 'user.permission.branch.list.success',

package/fesm/modules/auth.module.js

@@ -4,7 +4,7 @@ function _ts_decorate(decorators, target, key, desc) {
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-import { CacheModule, UtilsModule } from '@flusys/nestjs-shared/modules';
+import { CacheModule, UtilsModule, createModuleEventsProvider } from '@flusys/nestjs-shared/modules';
 import { Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
@@ -93,7 +93,8 @@ export class AuthModule {
             AuthenticationService,
             SetToken,
             ClearToken,
-            UserService
+            UserService,
+            createModuleEventsProvider('auth', AUTH_MODULE_OPTIONS)
         ];
         if (flags.enableEmailVerification) {
             providers.push(AuthEmailService);

package/fesm/services/auth-email.service.js

@@ -26,11 +26,12 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
+import { publishDomainEvent } from '@flusys/nestjs-shared/classes';
 import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
 import { BadRequestException, Inject, Injectable, InternalServerErrorException, Optional, Scope } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import * as crypto from 'crypto';
-import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, USER_MESSAGES } from '../config';
+import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, USER_MESSAGES } from '../config';
 import { AppUser } from '../entities/app-user.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
 import { TokenType, UserToken } from '../entities/user-token.entity';
@@ -191,6 +192,9 @@ export class AuthEmailService {
                 }
             });
         }
+        await this.publishUserEvent(AUTH_EVENT_ACTIONS.PASSWORD_RESET_REQUESTED, user.id, {
+            email: user.email
+        });
         return {
             success: true,
             message: 'If the email exists, a password reset link has been sent.',
@@ -232,6 +236,9 @@ export class AuthEmailService {
         // Mark token as used
         userToken.usedAt = new Date();
         await tokenRepository.save(userToken);
+        await this.publishUserEvent(AUTH_EVENT_ACTIONS.PASSWORD_RESET, user.id, {
+            email: user.email
+        });
         return {
             success: true,
             message: 'Password has been reset successfully.',
@@ -315,12 +322,26 @@ export class AuthEmailService {
         // Mark token as used
         userToken.usedAt = new Date();
         await tokenRepository.save(userToken);
+        await this.publishUserEvent(AUTH_EVENT_ACTIONS.EMAIL_VERIFIED, user.id, {
+            email: user.email
+        });
         return {
             type: 'verified',
             message: 'Email has been verified successfully.',
             messageKey: EMAIL_VERIFICATION_MESSAGES.VERIFICATION_SUCCESS
         };
     }
+    async publishUserEvent(action, userId, metadata) {
+        await publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity: AUTH_EVENT_ENTITIES.USER,
+            action,
+            ids: [
+                userId
+            ],
+            metadata
+        });
+    }
     async resendVerificationEmail(email, verifyUrlBase) {
         this.assertEmailEnabled();
         const pendingRepository = await this.getRepository(PendingRegistration);

package/fesm/services/auth-email.service.spec.js

@@ -1,6 +1,7 @@
 import { BadRequestException, InternalServerErrorException } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
+import { EventBusRegistry } from '@flusys/nestjs-shared/classes';
 import { AuthEmailService } from './auth-email.service';
 import { AppUser } from '../entities/app-user.entity';
 import { PendingRegistration } from '../entities/pending-registration.entity';
@@ -356,4 +357,55 @@ describe('AuthEmailService', ()=>{
             })).rejects.toThrow(InternalServerErrorException);
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            EventBusRegistry.reset();
+            EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            EventBusRegistry.configureModule('auth', {
+                enabled: true
+            });
+        });
+        afterEach(()=>{
+            EventBusRegistry.reset();
+        });
+        it('publishes auth.appuser.password-reset-requested once the reset email is sent', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(buildUserToken());
+            await service.forgotPassword('user@example.com', 'https://app.test/reset');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-reset-requested'
+            }));
+        });
+        it('publishes nothing for an unknown email so enumeration stays impossible', async ()=>{
+            userRepo.findOne.mockResolvedValue(null);
+            await service.forgotPassword('missing@example.com', 'https://app.test/reset');
+            expect(publish).not.toHaveBeenCalled();
+        });
+        it('publishes auth.appuser.password-reset when the token is consumed', async ()=>{
+            const token = buildUserToken();
+            tokenRepo.findOne.mockResolvedValue(token);
+            userRepo.findOne.mockResolvedValue(buildUser());
+            userRepo.save.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(token);
+            await service.resetPassword('raw-token', 'NewPassword1!');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-reset'
+            }));
+        });
+        it('does not publish when the auth module has events disabled', async ()=>{
+            EventBusRegistry.configureModule('auth', {
+                enabled: false
+            });
+            userRepo.findOne.mockResolvedValue(buildUser());
+            tokenRepo.save.mockResolvedValue(buildUserToken());
+            await service.forgotPassword('user@example.com', 'https://app.test/reset');
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/fesm/services/authentication.service.js

@@ -26,7 +26,7 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
-import { HybridCache } from '@flusys/nestjs-shared/classes';
+import { HybridCache, publishDomainEvent } from '@flusys/nestjs-shared/classes';
 import { SYSTEM_MESSAGES } from '@flusys/nestjs-shared/constants';
 import { NotificationType } from '@flusys/nestjs-shared/enums';
 import { INotificationAdapter, NOTIFICATION_ADAPTER } from '@flusys/nestjs-shared/interfaces';
@@ -34,7 +34,7 @@ import { generateUniqueSlug } from '@flusys/nestjs-shared/utils';
 import { BadRequestException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, Optional, Scope, UnauthorizedException } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import * as bcrypt from 'bcrypt';
-import { AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, TOKEN_REVOKED_PREFIX, USER_ENRICHER, USER_MESSAGES } from '../config';
+import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, AUTH_MESSAGES, BCRYPT_SALT_ROUNDS, EMAIL_VERIFICATION_MESSAGES, TOKEN_REVOKED_PREFIX, USER_ENRICHER, USER_MESSAGES } from '../config';
 import { RegistrationDto } from '../dtos/authentication.dto';
 import { AppUser } from '../entities/app-user.entity';
 import { CompanyBranch } from '../entities/company-branch.entity';
@@ -528,7 +528,12 @@ export class AuthenticationService {
                 messageKey: AUTH_MESSAGES.BRANCH_NOT_FOUND
             });
         }
-        return this.generateLoginResponseWithCompany(user, company, branch);
+        const response = this.generateLoginResponseWithCompany(user, company, branch);
+        this.publishSessionEvent(AUTH_EVENT_ACTIONS.COMPANY_SWITCHED, user, {
+            companyId: company.id,
+            branchId: branch.id
+        });
+        return response;
     }
     async refreshToken(refreshToken) {
         try {
@@ -622,7 +627,7 @@ export class AuthenticationService {
                     }
                 }
             }
-            return generateTokens(this.jwtService, this.authConfig, {
+            const tokens = generateTokens(this.jwtService, this.authConfig, {
                 id: user.id,
                 email: user.email,
                 type: 'access',
@@ -634,6 +639,11 @@ export class AuthenticationService {
                     branchId: payload.branchId
                 }
             });
+            this.publishSessionEvent(AUTH_EVENT_ACTIONS.TOKEN_REFRESHED, user, {
+                companyId: payload.companyId ?? null,
+                branchId: payload.branchId ?? null
+            });
+            return tokens;
         } catch  {
             throw new UnauthorizedException({
                 message: 'Invalid or expired refresh token',
@@ -660,6 +670,7 @@ export class AuthenticationService {
         }
         user.password = await bcrypt.hash(newPassword, BCRYPT_SALT_ROUNDS);
         await userRepository.save(user);
+        this.publishUserEvent(AUTH_EVENT_ACTIONS.PASSWORD_CHANGED, user);
     }
     async logout(userId) {
         if (!this.cacheManager) {
@@ -673,6 +684,17 @@ export class AuthenticationService {
         const refreshTokenExpiry = this.authConfig.getRefreshTokenExpiration();
         const ttlMs = parseExpiryToMs(refreshTokenExpiry);
         await this.cacheManager.set(cacheKey, revokedAt, ttlMs);
+        await publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity: AUTH_EVENT_ENTITIES.SESSION,
+            action: AUTH_EVENT_ACTIONS.LOGGED_OUT,
+            ids: [
+                userId
+            ],
+            user: {
+                id: userId
+            }
+        });
     }
     async isTokenRevoked(userId, tokenIssuedAt) {
         if (!this.cacheManager || !tokenIssuedAt) {
@@ -846,6 +868,7 @@ export class AuthenticationService {
             type: 'access'
         });
         this.sendLoginNotification(user.id);
+        this.publishSessionEvent(AUTH_EVENT_ACTIONS.LOGGED_IN, user);
         return {
             accessToken,
             refreshToken,
@@ -861,6 +884,10 @@ export class AuthenticationService {
             branchId: branch?.id
         });
         this.sendLoginNotification(user.id, company.id);
+        this.publishSessionEvent(AUTH_EVENT_ACTIONS.LOGGED_IN, user, {
+            companyId: company.id,
+            branchId: branch?.id ?? null
+        });
         return {
             accessToken,
             refreshToken,
@@ -907,16 +934,47 @@ export class AuthenticationService {
         };
     }
     generateRegistrationResponse(user) {
-        return {
+        const response = {
             ...this.generateLoginResponse(user),
             requiresEmailVerification: false
         };
+        this.publishUserEvent(AUTH_EVENT_ACTIONS.REGISTERED, user);
+        return response;
     }
     generateRegistrationResponseWithCompany(user, company, branch) {
-        return {
+        const response = {
             ...this.generateLoginResponseWithCompany(user, company, branch),
             requiresEmailVerification: false
         };
+        this.publishUserEvent(AUTH_EVENT_ACTIONS.REGISTERED, user, {
+            companyId: company.id,
+            branchId: branch?.id ?? null
+        });
+        return response;
+    }
+    publishSessionEvent(action, user, metadata = {}) {
+        this.publishAuthEvent(AUTH_EVENT_ENTITIES.SESSION, action, user, metadata);
+    }
+    publishUserEvent(action, user, metadata = {}) {
+        this.publishAuthEvent(AUTH_EVENT_ENTITIES.USER, action, user, metadata);
+    }
+    /** Never awaited - a login must not wait on, or fail because of, the event bus */ publishAuthEvent(entity, action, user, metadata) {
+        void publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity,
+            action,
+            ids: [
+                user.id
+            ],
+            metadata: {
+                email: user.email,
+                ...metadata
+            },
+            user: {
+                id: user.id,
+                email: user.email
+            }
+        });
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(jwtService, authConfig, cacheManager, dataSourceProvider, sessionService, authEmailService, userEnricher, notificationAdapter){

package/fesm/services/authentication.service.spec.js

@@ -1,6 +1,7 @@
 import { BadRequestException, ForbiddenException, NotFoundException, UnauthorizedException } from '@nestjs/common';
 import * as bcrypt from 'bcrypt';
 import { createMockRepository } from '@test-utils/mocks/repository.mock';
+import { EventBusRegistry } from '@flusys/nestjs-shared/classes';
 import { AuthenticationService } from './authentication.service';
 import { AppUser } from '../entities/app-user.entity';
 import { Company } from '../entities/company.entity';
@@ -856,4 +857,61 @@ describe('AuthenticationService', ()=>{
             }));
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            EventBusRegistry.reset();
+            EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            EventBusRegistry.configureModule('auth', {
+                enabled: true
+            });
+        });
+        afterEach(()=>{
+            EventBusRegistry.reset();
+        });
+        it('publishes auth.session.logged-in when a session is issued', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            bcrypt.compare.mockResolvedValue(true);
+            const service = buildService();
+            await service.login('user@example.com', 'password');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.session.logged-in',
+                action: 'logged-in',
+                payload: expect.objectContaining({
+                    ids: [
+                        'user-1'
+                    ]
+                })
+            }));
+        });
+        it('publishes auth.session.logged-out on logout', async ()=>{
+            const service = buildService();
+            await service.logout('user-1');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.session.logged-out'
+            }));
+        });
+        it('publishes auth.appuser.password-changed after a successful password change', async ()=>{
+            userRepo.findOne.mockResolvedValue(buildUser());
+            bcrypt.compare.mockResolvedValue(true);
+            const service = buildService();
+            await service.changePassword('user-1', 'old', 'new');
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'auth.appuser.password-changed'
+            }));
+        });
+        it('does not publish when the auth module has events disabled', async ()=>{
+            EventBusRegistry.configureModule('auth', {
+                enabled: false
+            });
+            const service = buildService();
+            await service.logout('user-1');
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/fesm/services/branch.service.js

@@ -29,8 +29,9 @@ import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { applyCompanyFilter } from '@flusys/nestjs-shared/utils';
-import { Inject, Injectable, Optional, Scope } from '@nestjs/common';
-import { In } from 'typeorm';
+import { ForbiddenException, Inject, Injectable, Optional, Scope } from '@nestjs/common';
+import { In, IsNull } from 'typeorm';
+import { BRANCH_MESSAGES } from '../config';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthConfigService } from './auth-config.service';
@@ -40,6 +41,24 @@ export class BranchService extends ApiService {
         const branchIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
+        await this.ensureDataSourceRepository();
+        const readonlyBranches = await this.repository.find({
+            where: {
+                id: In(branchIds),
+                readOnly: true,
+                deletedAt: IsNull()
+            }
+        });
+        if (readonlyBranches.length > 0) {
+            const names = readonlyBranches.map((b)=>b.name).join(', ');
+            throw new ForbiddenException({
+                message: `Cannot delete readonly branch(es): ${names}`,
+                messageKey: BRANCH_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         await queryRunner.manager.getRepository(UserCompanyPermission).delete({
             targetId: In(branchIds)
         });
@@ -67,6 +86,7 @@ export class BranchService extends ApiService {
                 'email',
                 'phone',
                 'isActive',
+                'readOnly',
                 'createdAt'
             ];
         }

package/fesm/services/branch.service.spec.js

@@ -10,6 +10,7 @@ describe('BranchService', ()=>{
     let mockQueryRunner;
     beforeEach(()=>{
         mockRepo = createMockRepository();
+        mockRepo.find.mockResolvedValue([]);
         Object.assign(mockRepo.createQueryBuilder(), {
             leftJoinAndSelect: jest.fn().mockReturnThis(),
             addOrderBy: jest.fn().mockReturnThis()
@@ -78,6 +79,20 @@ describe('BranchService', ()=>{
             }, null, mockQueryRunner);
             expect(mockPermissionSyncAdapter.onBranchDeleted).toHaveBeenCalledWith('branch-1', 'company-1');
         });
+        it('rejects deleting a readonly branch', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                {
+                    id: 'branch-1',
+                    name: 'Default Branch',
+                    readOnly: true
+                }
+            ]);
+            const permissionRepo = mockQueryRunner.manager.getRepository(UserCompanyPermission);
+            await expect(service.beforeDeleteOperation({
+                id: 'branch-1'
+            }, null, mockQueryRunner)).rejects.toThrow('Cannot delete readonly branch');
+            expect(permissionRepo.delete).not.toHaveBeenCalled();
+        });
     });
     describe('getSelectQuery', ()=>{
         it('applies the default selected fields when none are provided', async ()=>{

package/fesm/services/company.service.js

@@ -28,8 +28,9 @@ function _ts_param(paramIndex, decorator) {
 import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { Inject, Injectable, Optional, Scope } from '@nestjs/common';
-import { In } from 'typeorm';
+import { ForbiddenException, Inject, Injectable, Optional, Scope } from '@nestjs/common';
+import { In, IsNull } from 'typeorm';
+import { COMPANY_MESSAGES } from '../config';
 import { CompanyBranch } from '../entities/company-branch.entity';
 import { Company } from '../entities/company.entity';
 import { UserCompanyPermission } from '../entities/user-company-permission.entity';
@@ -39,6 +40,24 @@ export class CompanyService extends ApiService {
         const companyIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
+        await this.ensureDataSourceRepository();
+        const readonlyCompanies = await this.repository.find({
+            where: {
+                id: In(companyIds),
+                readOnly: true,
+                deletedAt: IsNull()
+            }
+        });
+        if (readonlyCompanies.length > 0) {
+            const names = readonlyCompanies.map((c)=>c.name).join(', ');
+            throw new ForbiddenException({
+                message: `Cannot delete readonly company(ies): ${names}`,
+                messageKey: COMPANY_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         const branchRows = await queryRunner.manager.getRepository(CompanyBranch).find({
             where: {
                 companyId: In(companyIds)
@@ -69,6 +88,7 @@ export class CompanyService extends ApiService {
                 'email',
                 'phone',
                 'isActive',
+                'readOnly',
                 'createdAt'
             ];
         }

package/fesm/services/company.service.spec.js

@@ -11,6 +11,7 @@ describe('CompanyService', ()=>{
     let permissionRepo;
     beforeEach(()=>{
         mockRepo = createMockRepository();
+        mockRepo.find.mockResolvedValue([]);
         const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
         mockPermissionSyncAdapter = {
             onCompanyDeleted: jest.fn()
@@ -75,6 +76,19 @@ describe('CompanyService', ()=>{
             expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-1');
             expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-2');
         });
+        it('rejects deleting a readonly company', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                {
+                    id: 'company-1',
+                    name: 'Default Company',
+                    readOnly: true
+                }
+            ]);
+            await expect(service.beforeDeleteOperation({
+                id: 'company-1'
+            }, null, mockQueryRunner)).rejects.toThrow('Cannot delete readonly company');
+            expect(branchRepo.find).not.toHaveBeenCalled();
+        });
     });
     describe('getSelectQuery', ()=>{
         it('applies the default selected fields when none are provided', async ()=>{

package/fesm/services/user-permission.service.js

@@ -26,9 +26,10 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
+import { publishDomainEvent } from '@flusys/nestjs-shared/classes';
 import { IPermissionSyncAdapter, PERMISSION_SYNC_ADAPTER } from '@flusys/nestjs-shared/interfaces';
 import { ConflictException, Inject, Injectable, NotFoundException, Optional, Scope } from '@nestjs/common';
-import { USER_PERMISSION_MESSAGES } from '../config';
+import { AUTH_EVENT_ACTIONS, AUTH_EVENT_ENTITIES, AUTH_EVENT_MODULE, USER_PERMISSION_MESSAGES } from '../config';
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity';
 import { AuthDataSourceProvider } from './auth-datasource.provider';
 export class UserPermissionService {
@@ -92,6 +93,7 @@ export class UserPermissionService {
             }
             throw error;
         }
+        await this.publishPermissionEvent(AUTH_EVENT_ACTIONS.PERMISSION_GRANTED, userId, targetId, type);
     }
     async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
@@ -124,6 +126,24 @@ export class UserPermissionService {
         } else {
             if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
         }
+        await this.publishPermissionEvent(AUTH_EVENT_ACTIONS.PERMISSION_REVOKED, userId, targetId, type, companyId);
+    }
+    async publishPermissionEvent(action, userId, targetId, type, companyId) {
+        await publishDomainEvent({
+            module: AUTH_EVENT_MODULE,
+            entity: AUTH_EVENT_ENTITIES.USER_PERMISSION,
+            action,
+            ids: [
+                targetId
+            ],
+            metadata: {
+                targetUserId: userId,
+                permissionType: type,
+                ...companyId ? {
+                    companyId
+                } : {}
+            }
+        });
     }
     async revokeBranchPermissionsForCompany(repository, userId, companyId) {
         const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {