@flusys/nestjs-form-builder 1.1.0-beta → 1.1.0

package/cjs/services/form.service.js

@@ -10,6 +10,7 @@ Object.defineProperty(exports, "FormService", {
 });
 const _classes = require("@flusys/nestjs-shared/classes");
 const _modules = require("@flusys/nestjs-shared/modules");
+const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
 const _typeorm = require("typeorm");
 const _formbuilderconfigservice = require("./form-builder-config.service");
@@ -45,17 +46,11 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let FormService = class FormService extends _classes.RequestScopedApiService {
-    /**
-   * Resolve entity class for this service
-   * @returns Form or FormWithCompany based on configuration
-   */ resolveEntity() {
+    resolveEntity() {
         const enableCompanyFeature = this.formBuilderConfig.isCompanyFeatureEnabled();
         return enableCompanyFeature ? _entities.FormWithCompany : _entities.Form;
     }
-    /**
-   * Get DataSource provider for this service
-   * @returns FormBuilderDataSourceProvider instance
-   */ getDataSourceProvider() {
+    getDataSourceProvider() {
         return this.dataSourceProvider;
     }
     // Entity Conversion
@@ -94,7 +89,7 @@ let FormService = class FormService extends _classes.RequestScopedApiService {
                     form.companyId = dto.companyId;
                 }
                 // If companyId is not in form at all, set from user
-                if (!('companyId' in form) || form.companyId === undefined) {
+                if (form.companyId === undefined) {
                     form.companyId = user?.companyId ?? null;
                 }
             } else {
@@ -132,22 +127,18 @@ let FormService = class FormService extends _classes.RequestScopedApiService {
             isRaw: false
         };
     }
-    /**
-   * Override: Extra query manipulation - Auto-filter by user's company
-   */ async getExtraManipulateQuery(query, filterDto, user) {
+    async getExtraManipulateQuery(query, filterDto, user) {
         const result = await super.getExtraManipulateQuery(query, filterDto, user);
-        // If company feature enabled and user has companyId, filter by user's company
-        const enableCompanyFeature = this.formBuilderConfig.isCompanyFeatureEnabled();
-        if (enableCompanyFeature && user?.companyId) {
-            query.andWhere('form.companyId = :companyId', {
-                companyId: user.companyId
-            });
-        }
+        // Apply company filter using shared utility
+        (0, _utils.applyCompanyFilter)(query, {
+            isCompanyFeatureEnabled: this.formBuilderConfig.isCompanyFeatureEnabled(),
+            entityAlias: 'form'
+        }, user);
         return result;
     }
-    /**
-   * Override: Convert entity to response DTO
-   */ convertEntityToResponseDto(entity, _isRaw) {
+    convertEntityToResponseDto(entity, _isRaw) {
+        // Type guard for company-enabled entity
+        const entityWithCompany = entity;
         return {
             id: entity.id,
             name: entity.name,
@@ -158,7 +149,7 @@ let FormService = class FormService extends _classes.RequestScopedApiService {
             accessType: entity.accessType,
             actionGroups: entity.actionGroups,
             isActive: entity.isActive,
-            companyId: ('companyId' in entity ? entity.companyId : null) ?? null,
+            companyId: entityWithCompany.companyId ?? null,
             metadata: entity.metadata,
             createdAt: entity.createdAt,
             updatedAt: entity.updatedAt,
@@ -168,33 +159,37 @@ let FormService = class FormService extends _classes.RequestScopedApiService {
             deletedById: entity.deletedById
         };
     }
-    // Public Form Access
-    /**
-   * Get form for public submission (no auth)
-   */ async getPublicForm(formId) {
+    toPublicForm(form) {
+        return {
+            id: form.id,
+            name: form.name,
+            description: form.description,
+            schema: form.schema,
+            schemaVersion: form.schemaVersion
+        };
+    }
+    async findPublicActiveForm(where) {
         await this.ensureRepositoryInitialized();
-        const form = await this.repository.findOne({
+        return this.repository.findOne({
             where: {
-                id: formId,
+                ...where,
                 accessType: _formaccesstypeenum.FormAccessType.PUBLIC,
                 isActive: true,
                 deletedAt: (0, _typeorm.IsNull)()
             }
         });
+    }
+    // Public Form Access
+    async getPublicForm(formId) {
+        const form = await this.findPublicActiveForm({
+            id: formId
+        });
         if (!form) {
             throw new _common.NotFoundException('Form not found or not available for public access');
         }
-        return {
-            id: form.id,
-            name: form.name,
-            description: form.description,
-            schema: form.schema,
-            schemaVersion: form.schemaVersion
-        };
+        return this.toPublicForm(form);
     }
-    /**
-   * Get form for submission with access validation
-   */ async getFormForSubmission(formId, user) {
+    async getFormForSubmission(formId, user) {
         await this.ensureRepositoryInitialized();
         const form = await this.repository.findOne({
             where: {
@@ -207,27 +202,19 @@ let FormService = class FormService extends _classes.RequestScopedApiService {
             throw new _common.NotFoundException('Form not found or inactive');
         }
         // Access validation based on accessType
-        switch(form.accessType){
-            case _formaccesstypeenum.FormAccessType.PUBLIC:
-                return form; // Anyone can access
-            case _formaccesstypeenum.FormAccessType.AUTHENTICATED:
-                if (!user) {
-                    throw new _common.UnauthorizedException('Authentication required to submit this form');
-                }
-                return form;
-            case _formaccesstypeenum.FormAccessType.ACTION_GROUP:
-                if (!user) {
-                    throw new _common.UnauthorizedException('Authentication required to submit this form');
-                }
-                // Permission check is handled by the controller/guard
-                return form;
-            default:
-                throw new _common.BadRequestException('Invalid access type');
+        if (form.accessType === _formaccesstypeenum.FormAccessType.PUBLIC) {
+            return form; // Anyone can access
+        }
+        // All non-public forms require authentication
+        if (!user) {
+            throw new _common.UnauthorizedException('Authentication required to submit this form');
+        }
+        if (form.accessType === _formaccesstypeenum.FormAccessType.AUTHENTICATED || form.accessType === _formaccesstypeenum.FormAccessType.ACTION_GROUP) {
+            return form; // Permission check for ACTION_GROUP is handled by the controller/guard
         }
+        throw new _common.BadRequestException('Invalid access type');
     }
-    /**
-   * Get form by slug
-   */ async getBySlug(slug) {
+    async getBySlug(slug) {
         await this.ensureRepositoryInitialized();
         const form = await this.repository.findOne({
             where: {
@@ -238,9 +225,15 @@ let FormService = class FormService extends _classes.RequestScopedApiService {
         return form ? this.convertEntityToResponseDto(form, false) : null;
     }
     /**
-   * Get form access info (public endpoint)
-   * Returns basic form info including access requirements
-   */ async getFormAccessInfo(formId) {
+   * Get public form by slug (no authentication required)
+   * Returns null if form doesn't exist, is not public, or is inactive
+   */ async getPublicFormBySlug(slug) {
+        const form = await this.findPublicActiveForm({
+            slug
+        });
+        return form ? this.toPublicForm(form) : null;
+    }
+    async getFormAccessInfo(formId) {
         await this.ensureRepositoryInitialized();
         const form = await this.repository.findOne({
             where: {
@@ -268,10 +261,7 @@ let FormService = class FormService extends _classes.RequestScopedApiService {
             isActive: form.isActive
         };
     }
-    /**
-   * Get form for authenticated submission
-   * Returns full form for users who are logged in
-   */ async getAuthenticatedForm(formId, user) {
+    async getAuthenticatedForm(formId, user) {
         const form = await this.getFormForSubmission(formId, user);
         // For action_group access, check permissions from cache
         if (form.accessType === _formaccesstypeenum.FormAccessType.ACTION_GROUP && form.actionGroups?.length) {
@@ -280,13 +270,7 @@ let FormService = class FormService extends _classes.RequestScopedApiService {
                 throw new _common.ForbiddenException('You do not have permission to access this form');
             }
         }
-        return {
-            id: form.id,
-            name: form.name,
-            description: form.description,
-            schema: form.schema,
-            schemaVersion: form.schemaVersion
-        };
+        return this.toPublicForm(form);
     }
     constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider){
         super('form', null, cacheManager, utilsService, FormService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "formBuilderConfig", void 0), _define_property(this, "dataSourceProvider", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.dataSourceProvider = dataSourceProvider;

package/cjs/utils/computed-field.utils.js

@@ -23,16 +23,22 @@ Object.defineProperty(exports, "calculateComputedFields", {
     }
 });
 // ============================================================================
-// Type Guards
+// Type Guards & Helpers
 // ============================================================================
+function isObject(value) {
+    return typeof value === 'object' && value !== null;
+}
 function isDirectValueConfig(config) {
-    return typeof config === 'object' && config !== null && config.type === 'direct' && 'value' in config;
+    return isObject(config) && config.type === 'direct' && 'value' in config;
 }
 function isFieldReferenceConfig(config) {
-    return typeof config === 'object' && config !== null && config.type === 'field_reference' && 'fieldId' in config;
+    return isObject(config) && config.type === 'field_reference' && 'fieldId' in config;
 }
 function isArithmeticConfig(config) {
-    return typeof config === 'object' && config !== null && config.type === 'arithmetic' && 'operation' in config && 'operands' in config && Array.isArray(config.operands);
+    return isObject(config) && config.type === 'arithmetic' && 'operation' in config && 'operands' in config && Array.isArray(config.operands);
+}
+function isEmptyValue(value) {
+    return value === null || value === undefined || value === '' || Array.isArray(value) && value.length === 0;
 }
 /**
  * Normalize operator to uppercase string (handles both enum and string values)
@@ -95,9 +101,9 @@ function calculateComputedFields(formData, computedFields) {
         case 'not_equals':
             return fieldValue !== compareValue && String(fieldValue) !== String(compareValue);
         case 'is_empty':
-            return fieldValue === null || fieldValue === undefined || fieldValue === '' || Array.isArray(fieldValue) && fieldValue.length === 0;
+            return isEmptyValue(fieldValue);
         case 'is_not_empty':
-            return fieldValue !== null && fieldValue !== undefined && fieldValue !== '' && !(Array.isArray(fieldValue) && fieldValue.length === 0);
+            return !isEmptyValue(fieldValue);
         case 'contains':
             return String(fieldValue).includes(String(compareValue));
         case 'not_contains':
@@ -123,25 +129,11 @@ function calculateComputedFields(formData, computedFields) {
         case 'is_not_checked':
             return fieldValue === false || fieldValue === 'false' || fieldValue === 0 || !fieldValue;
         case 'is_any_of':
-            if (Array.isArray(compareValue)) {
-                return compareValue.includes(fieldValue);
-            }
-            return false;
-        case 'is_none_of':
-            if (Array.isArray(compareValue)) {
-                return !compareValue.includes(fieldValue);
-            }
-            return true;
         case 'in':
-            if (Array.isArray(compareValue)) {
-                return compareValue.includes(fieldValue);
-            }
-            return false;
+            return Array.isArray(compareValue) && compareValue.includes(fieldValue);
+        case 'is_none_of':
         case 'not_in':
-            if (Array.isArray(compareValue)) {
-                return !compareValue.includes(fieldValue);
-            }
-            return true;
+            return !Array.isArray(compareValue) || !compareValue.includes(fieldValue);
         default:
             return false;
     }
@@ -183,8 +175,10 @@ function calculateComputedFields(formData, computedFields) {
     }
     switch(config.operation){
         case 'sum':
+        case 'increment':
             return values.reduce((acc, val)=>acc + val, 0);
         case 'subtract':
+        case 'decrement':
             return values.reduce((acc, val, idx)=>idx === 0 ? val : acc - val, 0);
         case 'multiply':
             return values.reduce((acc, val)=>acc * val, 1);
@@ -199,12 +193,6 @@ function calculateComputedFields(formData, computedFields) {
             return Math.min(...values);
         case 'max':
             return Math.max(...values);
-        case 'increment':
-            // First value is the base, rest are increments
-            return values.reduce((acc, val)=>acc + val, 0);
-        case 'decrement':
-            // First value is the base, rest are decrements
-            return values.reduce((acc, val, idx)=>idx === 0 ? val : acc - val, 0);
         default:
             return null;
     }

package/cjs/utils/permission.utils.js

@@ -2,26 +2,18 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get buildPermissionCacheKey () {
-        return buildPermissionCacheKey;
-    },
-    get getUserPermissionsFromCache () {
-        return getUserPermissionsFromCache;
-    },
-    get validateUserPermissions () {
+Object.defineProperty(exports, "validateUserPermissions", {
+    enumerable: true,
+    get: function() {
         return validateUserPermissions;
     }
 });
 const _common = require("@nestjs/common");
 const CACHE_PREFIX = 'permissions';
-function buildPermissionCacheKey(user, enableCompanyFeature) {
+/**
+ * Build permission cache key for a user
+ * Uses same cache key format as PermissionGuard in nestjs-shared
+ */ function buildPermissionCacheKey(user, enableCompanyFeature) {
     if (enableCompanyFeature && user.companyId) {
         // Company-based permissions
         return `${CACHE_PREFIX}:company:${user.companyId}:branch:${user.branchId || 'null'}:user:${user.id}`;
@@ -29,7 +21,10 @@ function buildPermissionCacheKey(user, enableCompanyFeature) {
     // User-based permissions
     return `${CACHE_PREFIX}:user:${user.id}`;
 }
-async function getUserPermissionsFromCache(user, cacheManager, enableCompanyFeature, logger) {
+/**
+ * Get user permissions from cache
+ * Fail-closed: if cache fails, deny access rather than allowing potentially unauthorized access
+ */ async function getUserPermissionsFromCache(user, cacheManager, enableCompanyFeature, logger) {
     const cacheKey = buildPermissionCacheKey(user, enableCompanyFeature);
     try {
         const permissions = await cacheManager.get(cacheKey);

package/controllers/form-result.controller.d.ts

@@ -1,15 +1,16 @@
+import { ListResponseDto, SingleResponseDto } from '@flusys/nestjs-shared/dtos';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { CreateFormResultDto, FormResultResponseDto, GetMyDraftDto, GetResultsByFormDto, SubmitFormDto, UpdateDraftDto, UpdateFormResultDto } from '../dtos';
 import { FormResultService } from '../services/form-result.service';
 declare const FormResultController_base: abstract new (service: FormResultService) => {
     service: FormResultService;
-    insert(addDto: CreateFormResultDto, user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").SingleResponseDto<FormResultResponseDto>>;
-    insertMany(addDto: CreateFormResultDto[], user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").BulkResponseDto<FormResultResponseDto>>;
-    getById(id: string, body: import("@flusys/nestjs-shared").GetByIdBodyDto, user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").SingleResponseDto<FormResultResponseDto>>;
-    update(updateDto: UpdateFormResultDto, user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").SingleResponseDto<FormResultResponseDto>>;
-    updateMany(updateDtos: UpdateFormResultDto[], user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").BulkResponseDto<FormResultResponseDto>>;
-    getAll(filterAndPaginationDto: import("@flusys/nestjs-shared").FilterAndPaginationDto, user: ILoggedUserInfo | null, search?: string): Promise<import("@flusys/nestjs-shared").ListResponseDto<FormResultResponseDto>>;
-    delete(deleteDto: import("@flusys/nestjs-shared").DeleteDto, user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared").MessageResponseDto>;
+    insert(addDto: CreateFormResultDto, user: ILoggedUserInfo | null): Promise<SingleResponseDto<FormResultResponseDto>>;
+    insertMany(addDto: CreateFormResultDto[], user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared/dtos").BulkResponseDto<FormResultResponseDto>>;
+    getById(id: string, body: import("@flusys/nestjs-shared/dtos").GetByIdBodyDto, user: ILoggedUserInfo | null): Promise<SingleResponseDto<FormResultResponseDto>>;
+    update(updateDto: UpdateFormResultDto, user: ILoggedUserInfo | null): Promise<SingleResponseDto<FormResultResponseDto>>;
+    updateMany(updateDtos: UpdateFormResultDto[], user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared/dtos").BulkResponseDto<FormResultResponseDto>>;
+    getAll(filterAndPaginationDto: import("@flusys/nestjs-shared/dtos").FilterAndPaginationDto, user: ILoggedUserInfo | null, search?: string): Promise<ListResponseDto<FormResultResponseDto>>;
+    delete(deleteDto: import("@flusys/nestjs-shared/dtos").DeleteDto, user: ILoggedUserInfo | null): Promise<import("@flusys/nestjs-shared/dtos").MessageResponseDto>;
 };
 export declare class FormResultController extends FormResultController_base {
     formResultService: FormResultService;
@@ -18,10 +19,7 @@ export declare class FormResultController extends FormResultController_base {
     submitPublicForm(dto: SubmitFormDto): Promise<FormResultResponseDto>;
     getMyDraft(dto: GetMyDraftDto, user: ILoggedUserInfo): Promise<FormResultResponseDto | null>;
     updateDraft(dto: UpdateDraftDto, user: ILoggedUserInfo): Promise<FormResultResponseDto>;
-    getByFormId(dto: GetResultsByFormDto, user: ILoggedUserInfo): Promise<{
-        data: FormResultResponseDto[];
-        total: number;
-    }>;
-    hasUserSubmitted(dto: GetMyDraftDto, user: ILoggedUserInfo): Promise<boolean>;
+    getByFormId(dto: GetResultsByFormDto, user: ILoggedUserInfo): Promise<ListResponseDto<FormResultResponseDto>>;
+    hasUserSubmitted(dto: GetMyDraftDto, user: ILoggedUserInfo): Promise<SingleResponseDto<boolean>>;
 }
 export {};

package/dtos/form-result.dto.d.ts

@@ -1,5 +1,5 @@
+import { IdentityResponseDto } from '@flusys/nestjs-shared/dtos';
 export declare class SubmitFormDto {
-    [key: string]: unknown;
     formId: string;
     data: Record<string, unknown>;
     isDraft?: boolean;
@@ -12,31 +12,20 @@ export declare class CreateFormResultDto extends SubmitFormDto {
 }
 declare const UpdateFormResultDto_base: import("@nestjs/common").Type<Partial<CreateFormResultDto>>;
 export declare class UpdateFormResultDto extends UpdateFormResultDto_base {
-    [key: string]: unknown;
     id: string;
 }
-export declare class FormResultQueryDto {
-    [key: string]: unknown;
-    formId?: string;
-    isDraft?: boolean;
-    submittedById?: string;
-}
 export declare class GetMyDraftDto {
-    [key: string]: unknown;
     formId: string;
 }
 export declare class UpdateDraftDto extends SubmitFormDto {
     draftId: string;
 }
 export declare class GetResultsByFormDto {
-    [key: string]: unknown;
     formId: string;
     page?: number;
     pageSize?: number;
 }
-export declare class FormResultResponseDto {
-    [key: string]: unknown;
-    id: string;
+export declare class FormResultResponseDto extends IdentityResponseDto {
     formId: string;
     schemaVersionSnapshot: Record<string, unknown>;
     schemaVersion: number;
@@ -45,11 +34,5 @@ export declare class FormResultResponseDto {
     submittedAt: Date;
     isDraft: boolean;
     metadata: Record<string, unknown> | null;
-    createdAt: Date;
-    updatedAt: Date;
-    deletedAt: Date | null;
-    createdById: string | null;
-    updatedById: string | null;
-    deletedById: string | null;
 }
 export {};

package/dtos/form.dto.d.ts

@@ -1,6 +1,6 @@
 import { FormAccessType } from '../enums/form-access-type.enum';
+import { IdentityResponseDto } from '@flusys/nestjs-shared/dtos';
 export declare class CreateFormDto {
-    [key: string]: unknown;
     name: string;
     description?: string;
     slug?: string;
@@ -13,19 +13,10 @@ export declare class CreateFormDto {
 }
 declare const UpdateFormDto_base: import("@nestjs/common").Type<Partial<CreateFormDto>>;
 export declare class UpdateFormDto extends UpdateFormDto_base {
-    [key: string]: unknown;
     id: string;
     schemaVersion?: number;
 }
-export declare class FormQueryDto {
-    [key: string]: unknown;
-    companyId?: string;
-    isActive?: boolean;
-    accessType?: FormAccessType;
-}
-export declare class FormResponseDto {
-    [key: string]: unknown;
-    id: string;
+export declare class FormResponseDto extends IdentityResponseDto {
     name: string;
     description: string | null;
     slug: string | null;
@@ -36,28 +27,11 @@ export declare class FormResponseDto {
     companyId: string | null;
     isActive: boolean;
     metadata: Record<string, unknown> | null;
-    createdAt: Date;
-    updatedAt: Date;
-    deletedAt: Date | null;
-    createdById: string | null;
-    updatedById: string | null;
-    deletedById: string | null;
 }
-export declare class PublicFormResponseDto {
-    [key: string]: unknown;
-    id: string;
-    name: string;
-    description: string | null;
-    schema: Record<string, unknown>;
-    schemaVersion: number;
+declare const PublicFormResponseDto_base: import("@nestjs/common").Type<Pick<FormResponseDto, "description" | "name" | "schema" | "id" | "schemaVersion">>;
+export declare class PublicFormResponseDto extends PublicFormResponseDto_base {
 }
-export declare class FormAccessInfoResponseDto {
-    [key: string]: unknown;
-    id: string;
-    name: string;
-    description: string | null;
-    accessType: FormAccessType;
-    actionGroups: string[] | null;
-    isActive: boolean;
+declare const FormAccessInfoResponseDto_base: import("@nestjs/common").Type<Pick<FormResponseDto, "description" | "name" | "accessType" | "actionGroups" | "isActive" | "id">>;
+export declare class FormAccessInfoResponseDto extends FormAccessInfoResponseDto_base {
 }
 export {};

package/entities/form-with-company.entity.d.ts

@@ -1,4 +1,4 @@
-import { FormBase } from './form-base.entity';
-export declare class FormWithCompany extends FormBase {
+import { Form } from './form.entity';
+export declare class FormWithCompany extends Form {
     companyId: string | null;
 }

package/entities/form.entity.d.ts

@@ -1,3 +1,13 @@
-import { FormBase } from './form-base.entity';
-export declare class Form extends FormBase {
+import { Identity } from '@flusys/nestjs-shared/entities';
+import { FormAccessType } from '../enums/form-access-type.enum';
+export declare class Form extends Identity {
+    name: string;
+    description: string | null;
+    slug: string | null;
+    schema: Record<string, unknown>;
+    schemaVersion: number;
+    accessType: FormAccessType;
+    actionGroups: string[] | null;
+    isActive: boolean;
+    metadata: Record<string, unknown> | null;
 }

package/entities/index.d.ts

@@ -1,5 +1,10 @@
-export * from './form-base.entity';
 export * from './form.entity';
-export * from './form-with-company.entity';
 export * from './form-result.entity';
+export * from './form-with-company.entity';
+import { Form } from './form.entity';
+import { FormResult } from './form-result.entity';
+import { FormWithCompany } from './form-with-company.entity';
+export declare const FormCoreEntities: (typeof Form | typeof FormResult)[];
+export declare const FormCompanyEntities: (typeof FormResult | typeof FormWithCompany)[];
 export declare function getFormBuilderEntitiesByConfig(enableCompanyFeature: boolean): any[];
+export { Form as FormBase } from './form.entity';

package/fesm/controllers/form-result.controller.js

@@ -25,8 +25,8 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { createApiController } from '@flusys/nestjs-shared/classes';
-import { CurrentUser, Public } from '@flusys/nestjs-shared/decorators';
+import { createApiController, FORM_RESULT_PERMISSIONS } from '@flusys/nestjs-shared/classes';
+import { CurrentUser, Public, RequirePermission } from '@flusys/nestjs-shared/decorators';
 import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { Body, Controller, HttpCode, HttpStatus, Inject, Post, UseGuards } from '@nestjs/common';
@@ -34,7 +34,50 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { CreateFormResultDto, FormResultResponseDto, GetMyDraftDto, GetResultsByFormDto, SubmitFormDto, UpdateDraftDto, UpdateFormResultDto } from '../dtos';
 import { FormResultService } from '../services/form-result.service';
 export class FormResultController extends createApiController(CreateFormResultDto, UpdateFormResultDto, FormResultResponseDto, {
-    security: 'jwt'
+    security: {
+        insert: {
+            level: 'permission',
+            permissions: [
+                FORM_RESULT_PERMISSIONS.CREATE
+            ]
+        },
+        insertMany: {
+            level: 'permission',
+            permissions: [
+                FORM_RESULT_PERMISSIONS.CREATE
+            ]
+        },
+        getById: {
+            level: 'permission',
+            permissions: [
+                FORM_RESULT_PERMISSIONS.READ
+            ]
+        },
+        getAll: {
+            level: 'permission',
+            permissions: [
+                FORM_RESULT_PERMISSIONS.READ
+            ]
+        },
+        update: {
+            level: 'permission',
+            permissions: [
+                FORM_RESULT_PERMISSIONS.UPDATE
+            ]
+        },
+        updateMany: {
+            level: 'permission',
+            permissions: [
+                FORM_RESULT_PERMISSIONS.UPDATE
+            ]
+        },
+        delete: {
+            level: 'permission',
+            permissions: [
+                FORM_RESULT_PERMISSIONS.DELETE
+            ]
+        }
+    }
 }) {
     // Submit Endpoints
     /**
@@ -63,16 +106,34 @@ export class FormResultController extends createApiController(CreateFormResultDt
     /**
    * Get results by form ID with pagination
    */ async getByFormId(dto, user) {
-        return this.formResultService.getByFormId(dto.formId, user, {
-            page: dto.page ?? 0,
-            pageSize: dto.pageSize ?? 10
+        const page = dto.page ?? 0;
+        const pageSize = dto.pageSize ?? 10;
+        const result = await this.formResultService.getByFormId(dto.formId, user, {
+            page,
+            pageSize
         });
+        return {
+            success: true,
+            message: 'Form results retrieved successfully',
+            data: result.data,
+            meta: {
+                total: result.total,
+                page,
+                pageSize,
+                count: result.data.length
+            }
+        };
     }
     /**
    * Check if current user has already submitted this form (non-draft)
    * Used for single response mode
    */ async hasUserSubmitted(dto, user) {
-        return this.formResultService.hasUserSubmitted(dto.formId, user);
+        const hasSubmitted = await this.formResultService.hasUserSubmitted(dto.formId, user);
+        return {
+            success: true,
+            message: hasSubmitted ? 'User has submitted this form' : 'User has not submitted this form',
+            data: hasSubmitted
+        };
     }
     constructor(formResultService){
         super(formResultService), _define_property(this, "formResultService", void 0), this.formResultService = formResultService;
@@ -147,6 +208,7 @@ _ts_decorate([
     Post('by-form'),
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
+    RequirePermission(FORM_RESULT_PERMISSIONS.READ),
     HttpCode(HttpStatus.OK),
     ApiOperation({
         summary: 'Get results by form ID'