@flusys/nestjs-auth 8.0.1 → 8.0.3

package/fesm/120.js

@@ -1865,7 +1865,6 @@ class UserPermissionController {
     /** Process batch permission assignments/revocations */ async processBatchPermissions(userId, items, type, user) {
         let added = 0, removed = 0;
         for (const item of items){
-            await this.permissionService.validateTenantScope(type, item.targetId, user);
             if (item.isAdd) {
                 await this.permissionService.assignPermission(userId, item.targetId, type);
                 added++;

package/fesm/24.js

@@ -3414,12 +3414,11 @@ __webpack_require__.d(__webpack_exports__, {
 /* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(6937);
 /* import */ var _flusys_nestjs_shared_interfaces__rspack_import_2 = __webpack_require__(5103);
 /* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
-/* import */ var _config_index_js__rspack_import_8 = __webpack_require__(5363);
-/* import */ var _config_index_js__rspack_import_9 = __webpack_require__(7987);
-/* import */ var _entities_company_branch_entity_js__rspack_import_4 = __webpack_require__(1923);
-/* import */ var _entities_user_company_permission_entity_js__rspack_import_5 = __webpack_require__(2377);
-/* import */ var _auth_config_service_js__rspack_import_6 = __webpack_require__(6514);
-/* import */ var _auth_datasource_provider_js__rspack_import_7 = __webpack_require__(2732);
+/* import */ var _config_index_js__rspack_import_7 = __webpack_require__(5363);
+/* import */ var _config_index_js__rspack_import_8 = __webpack_require__(7987);
+/* import */ var _entities_user_company_permission_entity_js__rspack_import_4 = __webpack_require__(2377);
+/* import */ var _auth_config_service_js__rspack_import_5 = __webpack_require__(6514);
+/* import */ var _auth_datasource_provider_js__rspack_import_6 = __webpack_require__(2732);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -3451,7 +3450,6 @@ function _ts_param(paramIndex, decorator) {
 
 
 
-
 class UserPermissionService {
     dataSourceProvider;
     authConfig;
@@ -3464,37 +3462,10 @@ class UserPermissionService {
     }
     /**
    * Ensures the acting user is only granting/revoking access within their own tenant.
-   * Without this, any user holding USER_PERMISSIONS.UPDATE could assign/revoke access
    * for a company or branch outside their own company.
-   */ async validateTenantScope(type, targetId, user) {
-        if (!this.authConfig.isCompanyFeatureEnabled() || !user.companyId) {
-            return;
-        }
-        if (type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY) {
-            if (targetId !== user.companyId) {
-                throw new _nestjs_common__rspack_import_3.ForbiddenException({
-                    message: 'You do not have access to this company',
-                    messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.COMPANY_NO_ACCESS */.jz.COMPANY_NO_ACCESS
-                });
-            }
-            return;
-        }
-        const branchRepository = await this.dataSourceProvider.getRepository(_entities_company_branch_entity_js__rspack_import_4/* .CompanyBranch */.A);
-        const branch = await branchRepository.findOne({
-            where: {
-                id: targetId
-            }
-        });
-        if (!branch || branch.companyId !== user.companyId) {
-            throw new _nestjs_common__rspack_import_3.ForbiddenException({
-                message: 'You do not have access to this branch',
-                messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.BRANCH_NO_ACCESS */.jz.BRANCH_NO_ACCESS
-            });
-        }
-    }
-    async getRepository() {
+   */ async getRepository() {
         if (!this._repository) {
-            this._repository = await this.dataSourceProvider.getRepository(_entities_user_company_permission_entity_js__rspack_import_5/* .UserCompanyPermission */.I);
+            this._repository = await this.dataSourceProvider.getRepository(_entities_user_company_permission_entity_js__rspack_import_4/* .UserCompanyPermission */.I);
         }
         return this._repository;
     }
@@ -3507,7 +3478,7 @@ class UserPermissionService {
                 permissionType: type
             },
             relations: [
-                type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch'
+                type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch'
             ],
             order: {
                 createdAt: 'DESC'
@@ -3516,7 +3487,7 @@ class UserPermissionService {
     }
     /** Assign permission to user */ async assignPermission(userId, targetId, type) {
         const repository = await this.getRepository();
-        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
+        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
         const existing = await repository.findOne({
             where: {
                 userId,
@@ -3527,7 +3498,7 @@ class UserPermissionService {
         if (existing) {
             throw new _nestjs_common__rspack_import_3.ConflictException({
                 message: `User already assigned to this ${typeName}`,
-                messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
+                messageKey: _config_index_js__rspack_import_7/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
                 messageVariables: {
                     type: typeName
                 }
@@ -3544,7 +3515,7 @@ class UserPermissionService {
             if (err?.code === 'ER_DUP_ENTRY' || String(err?.message).includes('Duplicate entry')) {
                 throw new _nestjs_common__rspack_import_3.ConflictException({
                     message: `User already assigned to this ${typeName}. Please refresh and try again.`,
-                    messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
+                    messageKey: _config_index_js__rspack_import_7/* .USER_PERMISSION_MESSAGES.ALREADY_ASSIGNED */.jz.ALREADY_ASSIGNED,
                     messageVariables: {
                         type: typeName
                     }
@@ -3552,11 +3523,11 @@ class UserPermissionService {
             }
             throw error;
         }
-        await this.publishPermissionEvent(_config_index_js__rspack_import_9/* .AUTH_EVENT_ACTIONS.PERMISSION_GRANTED */.o.PERMISSION_GRANTED, userId, targetId, type);
+        await this.publishPermissionEvent(_config_index_js__rspack_import_8/* .AUTH_EVENT_ACTIONS.PERMISSION_GRANTED */.o.PERMISSION_GRANTED, userId, targetId, type);
     }
     async revokePermission(userId, targetId, type) {
         const repository = await this.getRepository();
-        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
+        const typeName = type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY ? 'company' : 'branch';
         const permission = await repository.findOne({
             where: {
                 userId,
@@ -3564,33 +3535,33 @@ class UserPermissionService {
                 permissionType: type
             },
             relations: [
-                type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH ? 'branch' : 'company'
+                type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.BRANCH */.e.BRANCH ? 'branch' : 'company'
             ]
         });
         if (!permission) {
             throw new _nestjs_common__rspack_import_3.NotFoundException({
                 message: `${typeName.charAt(0).toUpperCase() + typeName.slice(1)} permission not found`,
-                messageKey: _config_index_js__rspack_import_8/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
+                messageKey: _config_index_js__rspack_import_7/* .USER_PERMISSION_MESSAGES.PERMISSION_NOT_FOUND */.jz.PERMISSION_NOT_FOUND,
                 messageVariables: {
                     type: typeName.charAt(0).toUpperCase() + typeName.slice(1)
                 }
             });
         }
-        const companyId = type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY ? targetId : permission.branch?.companyId;
+        const companyId = type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY ? targetId : permission.branch?.companyId;
         await repository.remove(permission);
-        if (type === _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY) {
+        if (type === _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY) {
             const revokedBranchIds = await this.revokeBranchPermissionsForCompany(repository, userId, targetId);
             await this.permissionSyncAdapter?.onUserCompanyAccessRevoked?.(userId, targetId);
             await Promise.all(revokedBranchIds.map((branchId)=>this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, branchId, targetId)));
         } else {
             if (companyId) await this.permissionSyncAdapter?.onUserBranchAccessRevoked?.(userId, targetId, companyId);
         }
-        await this.publishPermissionEvent(_config_index_js__rspack_import_9/* .AUTH_EVENT_ACTIONS.PERMISSION_REVOKED */.o.PERMISSION_REVOKED, userId, targetId, type, companyId);
+        await this.publishPermissionEvent(_config_index_js__rspack_import_8/* .AUTH_EVENT_ACTIONS.PERMISSION_REVOKED */.o.PERMISSION_REVOKED, userId, targetId, type, companyId);
     }
     async publishPermissionEvent(action, userId, targetId, type, companyId) {
         await (0,_flusys_nestjs_shared_classes__rspack_import_1.publishDomainEvent)({
             module: (/* inlined export .AUTH_EVENT_MODULE */"auth"),
-            entity: _config_index_js__rspack_import_9/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION,
+            entity: _config_index_js__rspack_import_8/* .AUTH_EVENT_ENTITIES.USER_PERMISSION */.g.USER_PERMISSION,
             action,
             ids: [
                 targetId
@@ -3608,7 +3579,7 @@ class UserPermissionService {
         const branchPermissions = await repository.createQueryBuilder('permission').innerJoin('permission.branch', 'branch').where('permission.userId = :userId', {
             userId
         }).andWhere('permission.permissionType = :type', {
-            type: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
+            type: _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.BRANCH */.e.BRANCH
         }).andWhere('branch.companyId = :companyId', {
             companyId
         }).getMany();
@@ -3619,13 +3590,13 @@ class UserPermissionService {
         return branchPermissions.map((permission)=>permission.targetId);
     }
     // Convenience Methods
-    findUserCompanies = (userId)=>this.findUserPermissions(userId, _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY);
+    findUserCompanies = (userId)=>this.findUserPermissions(userId, _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY);
     /** Find user branch permissions with optional company filter */ async findUserBranches(userId, companyId) {
         const repository = await this.getRepository();
         const queryBuilder = repository.createQueryBuilder('permission').leftJoinAndSelect('permission.branch', 'branch').where('permission.userId = :userId', {
             userId
         }).andWhere('permission.permissionType = :type', {
-            type: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
+            type: _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.BRANCH */.e.BRANCH
         }).orderBy('permission.createdAt', 'DESC');
         if (companyId) {
             queryBuilder.andWhere('branch.companyId = :companyId', {
@@ -3640,7 +3611,7 @@ class UserPermissionService {
         return repository.find({
             where: {
                 targetId: companyId,
-                permissionType: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.COMPANY */.e.COMPANY
+                permissionType: _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.COMPANY */.e.COMPANY
             },
             relations: [
                 'user'
@@ -3655,7 +3626,7 @@ class UserPermissionService {
         return repository.find({
             where: {
                 targetId: branchId,
-                permissionType: _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType.BRANCH */.e.BRANCH
+                permissionType: _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType.BRANCH */.e.BRANCH
             },
             relations: [
                 'user'
@@ -3675,7 +3646,7 @@ _ts_decorate([
     _ts_metadata("design:paramtypes", [
         String,
         String,
-        typeof _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e
+        typeof _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType */.e
     ]),
     _ts_metadata("design:returntype", Promise)
 ], UserPermissionService.prototype, "assignPermission", null);
@@ -3688,7 +3659,7 @@ _ts_decorate([
     _ts_metadata("design:paramtypes", [
         String,
         String,
-        typeof _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_5/* .PermissionType */.e
+        typeof _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType */.e === "undefined" ? Object : _entities_user_company_permission_entity_js__rspack_import_4/* .PermissionType */.e
     ]),
     _ts_metadata("design:returntype", Promise)
 ], UserPermissionService.prototype, "revokePermission", null);
@@ -3696,14 +3667,14 @@ UserPermissionService = _ts_decorate([
     (0,_nestjs_common__rspack_import_3.Injectable)({
         scope: _nestjs_common__rspack_import_3.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_7/* .AuthDataSourceProvider */.v)),
-    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_config_service_js__rspack_import_6/* .AuthConfigService */.W)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)(_auth_datasource_provider_js__rspack_import_6/* .AuthDataSourceProvider */.v)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_auth_config_service_js__rspack_import_5/* .AuthConfigService */.W)),
     _ts_param(2, (0,_nestjs_common__rspack_import_3.Optional)()),
     _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.PERMISSION_SYNC_ADAPTER)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _auth_datasource_provider_js__rspack_import_7/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_7/* .AuthDataSourceProvider */.v,
-        typeof _auth_config_service_js__rspack_import_6/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_6/* .AuthConfigService */.W,
+        typeof _auth_datasource_provider_js__rspack_import_6/* .AuthDataSourceProvider */.v === "undefined" ? Object : _auth_datasource_provider_js__rspack_import_6/* .AuthDataSourceProvider */.v,
+        typeof _auth_config_service_js__rspack_import_5/* .AuthConfigService */.W === "undefined" ? Object : _auth_config_service_js__rspack_import_5/* .AuthConfigService */.W,
         typeof IPermissionSyncAdapter === "undefined" ? Object : IPermissionSyncAdapter
     ])
 ], UserPermissionService);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-auth",
-  "version": "8.0.1",
+  "version": "8.0.3",
   "description": "Authentication and authorization infrastructure for NestJS applications",
   "type": "module",
   "main": "./fesm/index.js",
@@ -91,7 +91,7 @@
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "8.0.1",
-    "@flusys/nestjs-shared": "8.0.1"
+    "@flusys/nestjs-core": "8.0.3",
+    "@flusys/nestjs-shared": "8.0.3"
   }
 }

package/services/user-permission.service.d.ts

@@ -1,4 +1,3 @@
-import { type ILoggedUserInfo } from '@flusys/nestjs-shared';
 import { type IPermissionSyncAdapter } from '@flusys/nestjs-shared/interfaces';
 import { PermissionType, UserCompanyPermission } from '../entities/user-company-permission.entity.js';
 import { AuthConfigService } from './auth-config.service.js';
@@ -9,7 +8,6 @@ export declare class UserPermissionService {
     private readonly permissionSyncAdapter?;
     private _repository;
     constructor(dataSourceProvider: AuthDataSourceProvider, authConfig: AuthConfigService, permissionSyncAdapter?: IPermissionSyncAdapter | undefined);
-    validateTenantScope(type: PermissionType, targetId: string, user: ILoggedUserInfo): Promise<void>;
     private getRepository;
     findUserPermissions(userId: string, type: PermissionType): Promise<UserCompanyPermission[]>;
     assignPermission(userId: string, targetId: string, type: PermissionType): Promise<void>;