@flusys/nestjs-auth 7.0.2 → 8.0.0-beta.1

package/cjs/services/company.service.spec.js

@@ -1,127 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _repositorymock = require("@test-utils/mocks/repository.mock");
-const _companyservice = require("./company.service");
-const _companybranchentity = require("../entities/company-branch.entity");
-const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-describe('CompanyService', ()=>{
-    let service;
-    let mockRepo;
-    let mockPermissionSyncAdapter;
-    let mockQueryRunner;
-    let branchRepo;
-    let permissionRepo;
-    beforeEach(()=>{
-        mockRepo = (0, _repositorymock.createMockRepository)();
-        mockRepo.find.mockResolvedValue([]);
-        const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
-        mockPermissionSyncAdapter = {
-            onCompanyDeleted: jest.fn()
-        };
-        service = new _companyservice.CompanyService({}, {}, mockDataSourceProvider, mockPermissionSyncAdapter);
-        branchRepo = (0, _repositorymock.createMockRepository)();
-        branchRepo.find.mockResolvedValue([]);
-        permissionRepo = (0, _repositorymock.createMockRepository)();
-        mockQueryRunner = {
-            manager: {
-                getRepository: jest.fn().mockImplementation((entity)=>{
-                    if (entity === _companybranchentity.CompanyBranch) return branchRepo;
-                    if (entity === _usercompanypermissionentity.UserCompanyPermission) return permissionRepo;
-                    throw new Error('Unexpected entity');
-                })
-            }
-        };
-    });
-    describe('beforeDeleteOperation', ()=>{
-        it('deletes permissions for the companies and their branches', async ()=>{
-            branchRepo.find.mockResolvedValue([
-                {
-                    id: 'branch-1'
-                }
-            ]);
-            await service.beforeDeleteOperation({
-                id: [
-                    'company-1'
-                ]
-            }, null, mockQueryRunner);
-            const deleteArg = permissionRepo.delete.mock.calls[0][0];
-            expect(deleteArg.targetId._value).toEqual(expect.arrayContaining([
-                'company-1',
-                'branch-1'
-            ]));
-        });
-        it('handles a single (non-array) company id', async ()=>{
-            await service.beforeDeleteOperation({
-                id: 'company-1'
-            }, null, mockQueryRunner);
-            expect(branchRepo.find).toHaveBeenCalledWith(expect.objectContaining({
-                where: {
-                    companyId: expect.anything()
-                }
-            }));
-        });
-        it('does nothing further when no permission sync adapter is configured', async ()=>{
-            service = new _companyservice.CompanyService({}, {}, (0, _repositorymock.createMockDataSourceProvider)(mockRepo), undefined);
-            await expect(service.beforeDeleteOperation({
-                id: [
-                    'company-1'
-                ]
-            }, null, mockQueryRunner)).resolves.toBeUndefined();
-        });
-        it('notifies the permission sync adapter for each deleted company', async ()=>{
-            await service.beforeDeleteOperation({
-                id: [
-                    'company-1',
-                    'company-2'
-                ]
-            }, null, mockQueryRunner);
-            expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-1');
-            expect(mockPermissionSyncAdapter.onCompanyDeleted).toHaveBeenCalledWith('company-2');
-        });
-        it('rejects deleting a readonly company', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                {
-                    id: 'company-1',
-                    name: 'Default Company',
-                    readOnly: true
-                }
-            ]);
-            await expect(service.beforeDeleteOperation({
-                id: 'company-1'
-            }, null, mockQueryRunner)).rejects.toThrow('Cannot delete readonly company');
-            expect(branchRepo.find).not.toHaveBeenCalled();
-        });
-    });
-    describe('getSelectQuery', ()=>{
-        it('applies the default selected fields when none are provided', async ()=>{
-            const qb = mockRepo.createQueryBuilder();
-            const { isRaw } = await service.getSelectQuery(qb, null);
-            expect(qb.select).toHaveBeenCalledWith(expect.arrayContaining([
-                'company.id',
-                'company.name',
-                'company.slug'
-            ]));
-            expect(isRaw).toBe(false);
-        });
-        it('honors an explicit select list', async ()=>{
-            const qb = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(qb, null, [
-                'id'
-            ]);
-            expect(qb.select).toHaveBeenCalledWith([
-                'company.id'
-            ]);
-        });
-    });
-    describe('getGlobalSearchQuery', ()=>{
-        it('adds a LIKE search clause across name/slug/email', async ()=>{
-            const qb = mockRepo.createQueryBuilder();
-            await service.getGlobalSearchQuery(qb, 'acme');
-            expect(qb.andWhere).toHaveBeenCalledWith(expect.stringContaining('company.name LIKE'), {
-                search: '%acme%'
-            });
-        });
-    });
-});

package/cjs/services/index.js

@@ -1,26 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-_export_star(require("./authentication.service"), exports);
-_export_star(require("./auth-email.service"), exports);
-_export_star(require("./company-selection-session.service"), exports);
-_export_star(require("./user.service"), exports);
-_export_star(require("./company.service"), exports);
-_export_star(require("./branch.service"), exports);
-_export_star(require("./user-permission.service"), exports);
-_export_star(require("./auth-config.service"), exports);
-_export_star(require("./auth-datasource.provider"), exports);
-function _export_star(from, to) {
-    Object.keys(from).forEach(function(k) {
-        if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {
-            Object.defineProperty(to, k, {
-                enumerable: true,
-                get: function() {
-                    return from[k];
-                }
-            });
-        }
-    });
-    return from;
-}

package/cjs/services/user-permission.service.js

@@ -1,236 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "UserPermissionService", {
-    enumerable: true,
-    get: function() {
-        return UserPermissionService;
-    }
-});
-const _nestjsshared = require("@flusys/nestjs-shared");
-const _classes = require("@flusys/nestjs-shared/classes");
-const _interfaces = require("@flusys/nestjs-shared/interfaces");
-const _common = require("@nestjs/common");
-const _config = require("../config");
-const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-const _authdatasourceprovider = require("./auth-datasource.provider");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-let UserPermissionService = class UserPermissionService {
-    async getRepository() {
-        if (!this._repository) {
-            this._repository = await this.dataSourceProvider.getRepository(_usercompanypermissionentity.UserCompanyPermission);
-        }
-        return this._repository;
-    }
-    // Generic Permission Operations
-    /** Find all permissions of a specific type for a user */ async findUserPermissions(userId, type) {
-        const repository = await this.getRepository();
-        return repository.find({
-            where: {
-                userId,
-                permissionType: type
-            },
-            relations: [
-                type === _usercompanypermissionentity.PermissionType.COMPANY ? 'company' : 'branch'
-            ],
-            order: {
-                createdAt: 'DESC'
-            }
-        });
-    }
-    /** Assign permission to user */ async assignPermission(userId, targetId, type) {
-        const repository = await this.getRepository();
-        const typeName = type === _usercompanypermissionentity.PermissionType.COMPANY ? 'company' : 'branch';
-        const existing = await repository.findOne({
-            where: {
-                userId,
-                targetId,
-                permissionType: type
-            }
-        });
-        if (existing) {
-            throw new _common.ConflictException({
-                message: `User already assigned to this ${typeName}`,
-                messageKey: _config.USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED,
-                messageVariables: {
-                    type: typeName
-                }
-            });
-        }
-        try {
-            await repository.save(repository.create({
-                userId,
-                permissionType: type,
-                targetId
-            }));
-        } catch (error) {
-            const err = error;
-            if (err?.code === 'ER_DUP_ENTRY' || String(err?.message).includes('Duplicate entry')) {
-                throw new _common.ConflictException({
-                    message: `User already assigned to this ${typeName}. Please refresh and try again.`,
-                    messageKey: _config.USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED,
-                    messageVariables: {
-                        type: typeName
-                    }
-                });
-            }
-            throw error;
-        }
-        await this.publishPermissionEvent(_config.AUTH_EVENT_ACTIONS.PERMISSION_GRANTED, userId, targetId, type);
-    }
-    async revokePermission(userId, targetId, type) {
-        const repository = await this.getRepository();
-        const typeName = type === _usercompanypermissionentity.PermissionType.COMPANY ? 'company' : 'branch';
-        const permission = await repository.findOne({
-            where: {
-                userId,
-                targetId,
-                permissionType: type
-            },
-            relations: [
-                type === _usercompanypermissionentity.PermissionType.BRANCH ? 'branch' : 'company'
-            ]
-        });
-        if (!permission) {
-            throw new _common.NotFoundException({
-                message: `${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`,
-                messageKey: _config.USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND,
-                messageVariables: {
-                    type: typeName.charAt(0).toUpperCase() + typeName.slice(1)
-                }
-            });
-        }
-        const companyId = type === _usercompanypermissionentity.PermissionType.COMPANY ? targetId : permission.branch?.companyId;
-        await repository.remove(permission);
-        if (type === _usercompanypermissionentity.PermissionType.COMPANY) {
-            const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
-            await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
-            await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
-        } else {
-            if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
-        }
-        await this.publishPermissionEvent(_config.AUTH_EVENT_ACTIONS.PERMISSION_REVOKED, userId, targetId, type, companyId);
-    }
-    async publishPermissionEvent(action, userId, targetId, type, companyId) {
-        await (0, _classes.publishDomainEvent)({
-            module: _config.AUTH_EVENT_MODULE,
-            entity: _config.AUTH_EVENT_ENTITIES.USER_PERMISSION,
-            action,
-            ids: [
-                targetId
-            ],
-            metadata: {
-                targetUserId: userId,
-                permissionType: type,
-                ...companyId ? {
-                    companyId
-                } : {}
-            }
-        });
-    }
-    async revokeBranchPermissionsForCompany(repository, userId, companyId) {
-        const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
-            userId
-        }).andWhere('permission.permissionType = :type', {
-            type: _usercompanypermissionentity.PermissionType.BRANCH
-        }).andWhere('branch.companyId = :companyId', {
-            companyId
-        }).getMany();
-        if (branchPermissions.length === 0) {
-            return [];
-        }
-        await repository.remove(branchPermissions);
-        return branchPermissions.map((permission)=>permission.targetId);
-    }
-    /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
-        const repository = await this.getRepository();
-        const queryBuilder = repository.createQueryBuilder('permission').leftJoinAndSelect('permission.branch', 'branch').where('permission.userId = :userId', {
-            userId
-        }).andWhere('permission.permissionType = :type', {
-            type: _usercompanypermissionentity.PermissionType.BRANCH
-        }).orderBy('permission.createdAt', 'DESC');
-        if (companyId) {
-            queryBuilder.andWhere('branch.companyId = :companyId', {
-                companyId
-            });
-        }
-        return queryBuilder.getMany();
-    }
-    constructor(dataSourceProvider, permissionSyncAdapter){
-        _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "permissionSyncAdapter", void 0);
-        _define_property(this, "_repository", void 0);
-        // Convenience Methods
-        _define_property(this, "findUserCompanies", void 0);
-        this.dataSourceProvider = dataSourceProvider;
-        this.permissionSyncAdapter = permissionSyncAdapter;
-        this._repository = null;
-        this.findUserCompanies = (userId)=>this.findUserPermissions(userId, _usercompanypermissionentity.PermissionType.COMPANY);
-    }
-};
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'user.assignPermission',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        typeof _usercompanypermissionentity.PermissionType === "undefined" ? Object : _usercompanypermissionentity.PermissionType
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], UserPermissionService.prototype, "assignPermission", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'user.revokePermission',
-        module: 'auth'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        typeof _usercompanypermissionentity.PermissionType === "undefined" ? Object : _usercompanypermissionentity.PermissionType
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], UserPermissionService.prototype, "revokePermission", null);
-UserPermissionService = _ts_decorate([
-    (0, _common.Injectable)({
-        scope: _common.Scope.REQUEST
-    }),
-    _ts_param(0, (0, _common.Inject)(_authdatasourceprovider.AuthDataSourceProvider)),
-    _ts_param(1, (0, _common.Optional)()),
-    _ts_param(1, (0, _common.Inject)(_interfaces.PERMISSION_SYNC_ADAPTER)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _authdatasourceprovider.AuthDataSourceProvider === "undefined" ? Object : _authdatasourceprovider.AuthDataSourceProvider,
-        typeof _interfaces.IPermissionSyncAdapter === "undefined" ? Object : _interfaces.IPermissionSyncAdapter
-    ])
-], UserPermissionService);

package/cjs/services/user-permission.service.spec.js

@@ -1,254 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _common = require("@nestjs/common");
-const _classes = require("@flusys/nestjs-shared/classes");
-const _repositorymock = require("@test-utils/mocks/repository.mock");
-const _userpermissionservice = require("./user-permission.service");
-const _usercompanypermissionentity = require("../entities/user-company-permission.entity");
-function buildPermission(overrides = {}) {
-    return {
-        id: 'perm-uuid-1',
-        userId: 'user-1',
-        permissionType: _usercompanypermissionentity.PermissionType.COMPANY,
-        targetId: 'company-1',
-        isActive: true,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        ...overrides
-    };
-}
-describe('UserPermissionService', ()=>{
-    let service;
-    let mockRepo;
-    let mockPermissionSyncAdapter;
-    beforeEach(()=>{
-        mockRepo = (0, _repositorymock.createMockRepository)();
-        // The shared query builder mock does not include join helpers used by this service.
-        Object.assign(mockRepo.createQueryBuilder(), {
-            innerJoin: jest.fn().mockReturnThis(),
-            leftJoinAndSelect: jest.fn().mockReturnThis()
-        });
-        const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
-        mockPermissionSyncAdapter = {
-            onCompanyDeleted: jest.fn(),
-            onBranchDeleted: jest.fn(),
-            onUserCompanyAccessRevoked: jest.fn(),
-            onUserBranchAccessRevoked: jest.fn()
-        };
-        service = new _userpermissionservice.UserPermissionService(mockDataSourceProvider, mockPermissionSyncAdapter);
-    });
-    describe('findUserPermissions', ()=>{
-        it('finds company permissions with the company relation', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildPermission()
-            ]);
-            const result = await service.findUserPermissions('user-1', _usercompanypermissionentity.PermissionType.COMPANY);
-            expect(result).toHaveLength(1);
-            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
-                where: {
-                    userId: 'user-1',
-                    permissionType: _usercompanypermissionentity.PermissionType.COMPANY
-                },
-                relations: [
-                    'company'
-                ]
-            }));
-        });
-        it('finds branch permissions with the branch relation', async ()=>{
-            mockRepo.find.mockResolvedValue([]);
-            await service.findUserPermissions('user-1', _usercompanypermissionentity.PermissionType.BRANCH);
-            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
-                relations: [
-                    'branch'
-                ]
-            }));
-        });
-    });
-    describe('assignPermission', ()=>{
-        it('creates and saves a new permission when none exists', async ()=>{
-            mockRepo.findOne.mockResolvedValue(null);
-            mockRepo.create.mockReturnValue(buildPermission());
-            mockRepo.save.mockResolvedValue(buildPermission());
-            await service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY);
-            expect(mockRepo.create).toHaveBeenCalledWith({
-                userId: 'user-1',
-                permissionType: _usercompanypermissionentity.PermissionType.COMPANY,
-                targetId: 'company-1'
-            });
-            expect(mockRepo.save).toHaveBeenCalled();
-        });
-        it('throws ConflictException when the permission already exists', async ()=>{
-            mockRepo.findOne.mockResolvedValue(buildPermission());
-            await expect(service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY)).rejects.toThrow(_common.ConflictException);
-            expect(mockRepo.save).not.toHaveBeenCalled();
-        });
-        it('translates a duplicate-entry database error into ConflictException', async ()=>{
-            mockRepo.findOne.mockResolvedValue(null);
-            mockRepo.create.mockReturnValue(buildPermission());
-            mockRepo.save.mockRejectedValue({
-                code: 'ER_DUP_ENTRY',
-                message: 'Duplicate entry'
-            });
-            await expect(service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY)).rejects.toThrow(_common.ConflictException);
-        });
-        it('rethrows unrelated database errors from save', async ()=>{
-            mockRepo.findOne.mockResolvedValue(null);
-            mockRepo.create.mockReturnValue(buildPermission());
-            const dbError = new Error('connection lost');
-            mockRepo.save.mockRejectedValue(dbError);
-            await expect(service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY)).rejects.toThrow('connection lost');
-        });
-    });
-    describe('revokePermission', ()=>{
-        it('throws NotFoundException when the permission does not exist', async ()=>{
-            mockRepo.findOne.mockResolvedValue(null);
-            await expect(service.revokePermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY)).rejects.toThrow(_common.NotFoundException);
-        });
-        it('removes a company permission and cascades revocation to its branches', async ()=>{
-            const companyPermission = buildPermission({
-                permissionType: _usercompanypermissionentity.PermissionType.COMPANY
-            });
-            mockRepo.findOne.mockResolvedValue(companyPermission);
-            mockRepo.remove.mockResolvedValue(companyPermission);
-            const branchPermission = buildPermission({
-                id: 'perm-branch-1',
-                permissionType: _usercompanypermissionentity.PermissionType.BRANCH,
-                targetId: 'branch-1'
-            });
-            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
-                branchPermission
-            ]);
-            await service.revokePermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY);
-            expect(mockRepo.remove).toHaveBeenCalledWith(companyPermission);
-            expect(mockRepo.remove).toHaveBeenCalledWith([
-                branchPermission
-            ]);
-            expect(mockPermissionSyncAdapter.onUserCompanyAccessRevoked).toHaveBeenCalledWith('user-1', 'company-1');
-            expect(mockPermissionSyncAdapter.onUserBranchAccessRevoked).toHaveBeenCalledWith('user-1', 'branch-1', 'company-1');
-        });
-        it('removes a branch permission and notifies the sync adapter with its company id', async ()=>{
-            const branchPermission = buildPermission({
-                permissionType: _usercompanypermissionentity.PermissionType.BRANCH,
-                targetId: 'branch-1',
-                branch: {
-                    companyId: 'company-1'
-                }
-            });
-            mockRepo.findOne.mockResolvedValue(branchPermission);
-            mockRepo.remove.mockResolvedValue(branchPermission);
-            await service.revokePermission('user-1', 'branch-1', _usercompanypermissionentity.PermissionType.BRANCH);
-            expect(mockRepo.remove).toHaveBeenCalledWith(branchPermission);
-            expect(mockPermissionSyncAdapter.onUserBranchAccessRevoked).toHaveBeenCalledWith('user-1', 'branch-1', 'company-1');
-        });
-        it('does not notify the sync adapter for a branch permission with no resolvable company', async ()=>{
-            const branchPermission = buildPermission({
-                permissionType: _usercompanypermissionentity.PermissionType.BRANCH,
-                targetId: 'branch-1',
-                branch: undefined
-            });
-            mockRepo.findOne.mockResolvedValue(branchPermission);
-            mockRepo.remove.mockResolvedValue(branchPermission);
-            await service.revokePermission('user-1', 'branch-1', _usercompanypermissionentity.PermissionType.BRANCH);
-            expect(mockPermissionSyncAdapter.onUserBranchAccessRevoked).not.toHaveBeenCalled();
-        });
-        it('works without a permission sync adapter configured', async ()=>{
-            service = new _userpermissionservice.UserPermissionService((0, _repositorymock.createMockDataSourceProvider)(mockRepo), undefined);
-            const companyPermission = buildPermission({
-                permissionType: _usercompanypermissionentity.PermissionType.COMPANY
-            });
-            mockRepo.findOne.mockResolvedValue(companyPermission);
-            mockRepo.remove.mockResolvedValue(companyPermission);
-            mockRepo.createQueryBuilder().getMany.mockResolvedValue([]);
-            await expect(service.revokePermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY)).resolves.toBeUndefined();
-        });
-    });
-    describe('findUserCompanies', ()=>{
-        it('delegates to findUserPermissions with COMPANY type', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildPermission()
-            ]);
-            const result = await service.findUserCompanies('user-1');
-            expect(result).toHaveLength(1);
-            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
-                where: {
-                    userId: 'user-1',
-                    permissionType: _usercompanypermissionentity.PermissionType.COMPANY
-                }
-            }));
-        });
-    });
-    describe('findUserBranches', ()=>{
-        it('queries branch permissions for a user without a company filter', async ()=>{
-            mockRepo.createQueryBuilder().getMany.mockResolvedValue([]);
-            await service.findUserBranches('user-1');
-            const qb = mockRepo.createQueryBuilder();
-            expect(qb.where).toHaveBeenCalledWith('permission.userId = :userId', {
-                userId: 'user-1'
-            });
-            expect(qb.andWhere).toHaveBeenCalledWith('permission.permissionType = :type', {
-                type: _usercompanypermissionentity.PermissionType.BRANCH
-            });
-        });
-        it('applies an additional company filter when companyId is provided', async ()=>{
-            mockRepo.createQueryBuilder().getMany.mockResolvedValue([]);
-            await service.findUserBranches('user-1', 'company-1');
-            const qb = mockRepo.createQueryBuilder();
-            expect(qb.andWhere).toHaveBeenCalledWith('branch.companyId = :companyId', {
-                companyId: 'company-1'
-            });
-        });
-    });
-    describe('domain events', ()=>{
-        let publish;
-        beforeEach(()=>{
-            publish = jest.fn().mockResolvedValue(undefined);
-            _classes.EventBusRegistry.reset();
-            _classes.EventBusRegistry.setBus({
-                publish,
-                subscribe: jest.fn(),
-                close: jest.fn()
-            });
-            _classes.EventBusRegistry.configureModule('auth', {
-                enabled: true
-            });
-        });
-        afterEach(()=>{
-            _classes.EventBusRegistry.reset();
-        });
-        it('publishes permission-granted after a new assignment', async ()=>{
-            mockRepo.findOne.mockResolvedValue(null);
-            mockRepo.create.mockReturnValue(buildPermission());
-            mockRepo.save.mockResolvedValue(buildPermission());
-            await service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY);
-            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
-                name: 'auth.user_company_permission.permission-granted',
-                payload: expect.objectContaining({
-                    ids: [
-                        'company-1'
-                    ],
-                    metadata: expect.objectContaining({
-                        targetUserId: 'user-1',
-                        permissionType: _usercompanypermissionentity.PermissionType.COMPANY
-                    })
-                })
-            }));
-        });
-        it('does not publish when the assignment is rejected as a duplicate', async ()=>{
-            mockRepo.findOne.mockResolvedValue(buildPermission());
-            await expect(service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY)).rejects.toThrow(_common.ConflictException);
-            expect(publish).not.toHaveBeenCalled();
-        });
-        it('does not publish when the auth module has events disabled', async ()=>{
-            _classes.EventBusRegistry.configureModule('auth', {
-                enabled: false
-            });
-            mockRepo.findOne.mockResolvedValue(null);
-            mockRepo.create.mockReturnValue(buildPermission());
-            mockRepo.save.mockResolvedValue(buildPermission());
-            await service.assignPermission('user-1', 'company-1', _usercompanypermissionentity.PermissionType.COMPANY);
-            expect(publish).not.toHaveBeenCalled();
-        });
-    });
-});