@flusys/nestjs-form-builder 9.1.0-rc.1 → 9.1.1

package/README.md

@@ -145,6 +145,23 @@ TypeOrmModule.forRoot({
 
 The service selects the correct entity automatically at request time — no manual switching needed.
 
+### ACTION_GROUP permission rule
+
+An `ACTION_GROUP` form stores `permissionLogic` — an `ILogicNode` AND / OR tree from `@flusys/nestjs-shared/interfaces` (up to `MAX_PERMISSION_LOGIC_DEPTH` nested groups and `MAX_PERMISSION_LOGIC_CODES` codes), validated with `permissionLogicProblem()` from `@flusys/nestjs-shared/utils`:
+
+```typescript
+{
+  type: 'group',
+  operator: 'AND',
+  children: [
+    { type: 'action', actionId: 'hr.survey.submit' },
+    { type: 'group', operator: 'OR', children: [{ type: 'action', actionId: 'hr.manager' }, { type: 'action', actionId: 'hr.admin' }] },
+  ],
+}
+```
+
+Fetching (`form/authenticated/:id`) and submitting check it with `evaluatePermissionLogic()` against the user's codes from `loadPermissionCodes()` (`PERMISSION_RESOLVER`, else `SharedPermissionCacheService`); when the codes cannot be read, access fails closed (403 `form.permission.check.failed`). A form with no rule is open to any logged-in user.
+
 ---
 
 ## 3. EMAIL_VERIFIED Access Type

package/dtos/form.dto.d.ts

@@ -1,4 +1,5 @@
 import { IdentityResponseDto } from '@flusys/nestjs-shared/dtos';
+import { type ILogicNode } from '@flusys/nestjs-shared/interfaces';
 import { FormAccessType } from '../enums/form-access-type.enum.js';
 export declare class CreateFormDto {
     name: string;
@@ -6,7 +7,7 @@ export declare class CreateFormDto {
     slug?: string;
     schema: Record<string, unknown>;
     accessType?: FormAccessType;
-    actionGroups?: string[];
+    permissionLogic?: ILogicNode | null;
     tags?: string[];
     companyId?: string;
     isActive?: boolean;
@@ -23,15 +24,15 @@ export declare class FormResponseDto extends IdentityResponseDto {
     schema: Record<string, unknown>;
     schemaVersion: number;
     accessType: FormAccessType;
-    actionGroups: string[] | null;
+    permissionLogic: ILogicNode | null;
     tags: string[] | null;
     companyId: string | null;
     isActive: boolean;
 }
-declare const PublicFormResponseDto_base: import("@nestjs/common").Type<Pick<FormResponseDto, "description" | "name" | "schema" | "id" | "schemaVersion">>;
+declare const PublicFormResponseDto_base: import("@nestjs/common").Type<Pick<FormResponseDto, "name" | "description" | "schema" | "id" | "schemaVersion">>;
 export declare class PublicFormResponseDto extends PublicFormResponseDto_base {
 }
-declare const FormAccessInfoResponseDto_base: import("@nestjs/common").Type<Pick<FormResponseDto, "description" | "name" | "accessType" | "actionGroups" | "isActive" | "id">>;
+declare const FormAccessInfoResponseDto_base: import("@nestjs/common").Type<Pick<FormResponseDto, "name" | "description" | "accessType" | "permissionLogic" | "isActive" | "id">>;
 export declare class FormAccessInfoResponseDto extends FormAccessInfoResponseDto_base {
 }
 export declare class EmailVerifiedFormResponseDto extends PublicFormResponseDto {

package/entities/form.entity.d.ts

@@ -1,4 +1,5 @@
 import { Identity } from '@flusys/nestjs-shared/entities';
+import { type ILogicNode } from '@flusys/nestjs-shared/interfaces';
 import { FormAccessType } from '../enums/form-access-type.enum.js';
 export declare class Form extends Identity {
     name: string;
@@ -7,7 +8,7 @@ export declare class Form extends Identity {
     schema: Record<string, unknown>;
     schemaVersion: number;
     accessType: FormAccessType;
-    actionGroups: string[] | null;
+    permissionLogic: ILogicNode | null;
     tags: string[] | null;
     isActive: boolean;
 }

package/fesm/432.js

@@ -3,6 +3,7 @@ import { Identity as entities_Identity } from "@flusys/nestjs-shared/entities";
 import * as __rspack_external__flusys_nestjs_shared_classes_6076a329 from "@flusys/nestjs-shared/classes";
 import * as __rspack_external__flusys_nestjs_shared_decorators_c129b601 from "@flusys/nestjs-shared/decorators";
 import * as __rspack_external__flusys_nestjs_shared_dtos_c4585026 from "@flusys/nestjs-shared/dtos";
+import * as __rspack_external__flusys_nestjs_shared_interfaces_413f2706 from "@flusys/nestjs-shared/interfaces";
 import * as __rspack_external__flusys_nestjs_shared_modules_24702bee from "@flusys/nestjs-shared/modules";
 import * as __rspack_external__flusys_nestjs_shared_utils_9125c1f1 from "@flusys/nestjs-shared/utils";
 import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
@@ -379,7 +380,7 @@ class Form extends entities_Identity {
     schema;
     schemaVersion;
     accessType;
-    actionGroups;
+    permissionLogic;
     tags;
     isActive;
 }
@@ -436,10 +437,10 @@ _ts_decorate([
     (0,external_typeorm_.Column)({
         type: getJsonColumnType(),
         nullable: true,
-        name: 'action_groups'
+        name: 'permission_logic'
     }),
     _ts_metadata("design:type", Object)
-], Form.prototype, "actionGroups", void 0);
+], Form.prototype, "permissionLogic", void 0);
 _ts_decorate([
     (0,external_typeorm_.Column)({
         type: getJsonColumnType(),
@@ -1168,19 +1169,20 @@ FormEmailAuthService = _ts_decorate([
 160(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(937);
 /* import */ var _flusys_nestjs_shared_decorators__rspack_import_1 = __webpack_require__(265);
-/* import */ var _flusys_nestjs_shared_modules__rspack_import_2 = __webpack_require__(236);
-/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(157);
-/* import */ var typeorm__rspack_import_4 = __webpack_require__(158);
-/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(769);
-/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(137);
-/* import */ var _dtos_form_result_dto_js__rspack_import_5 = __webpack_require__(788);
-/* import */ var _entities_index_js__rspack_import_6 = __webpack_require__(814);
-/* import */ var _enums_form_access_type_enum_js__rspack_import_13 = __webpack_require__(376);
-/* import */ var _utils_computed_field_utils_js__rspack_import_14 = __webpack_require__(801);
-/* import */ var _utils_permission_utils_js__rspack_import_7 = __webpack_require__(988);
-/* import */ var _form_builder_config_service_js__rspack_import_8 = __webpack_require__(781);
-/* import */ var _form_builder_datasource_provider_js__rspack_import_9 = __webpack_require__(593);
-/* import */ var _form_email_auth_service_js__rspack_import_10 = __webpack_require__(474);
+/* import */ var _flusys_nestjs_shared_interfaces__rspack_import_2 = __webpack_require__(103);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_3 = __webpack_require__(236);
+/* import */ var _nestjs_common__rspack_import_4 = __webpack_require__(157);
+/* import */ var typeorm__rspack_import_5 = __webpack_require__(158);
+/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(769);
+/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(137);
+/* import */ var _dtos_form_result_dto_js__rspack_import_6 = __webpack_require__(788);
+/* import */ var _entities_index_js__rspack_import_7 = __webpack_require__(814);
+/* import */ var _enums_form_access_type_enum_js__rspack_import_14 = __webpack_require__(376);
+/* import */ var _utils_computed_field_utils_js__rspack_import_15 = __webpack_require__(801);
+/* import */ var _utils_permission_utils_js__rspack_import_8 = __webpack_require__(988);
+/* import */ var _form_builder_config_service_js__rspack_import_9 = __webpack_require__(781);
+/* import */ var _form_builder_datasource_provider_js__rspack_import_10 = __webpack_require__(593);
+/* import */ var _form_email_auth_service_js__rspack_import_11 = __webpack_require__(474);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1218,12 +1220,15 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
     cacheManager;
     utilsService;
     formBuilderConfig;
     dataSourceProvider;
     formEmailAuthService;
+    permissionResolver;
+    permissionCache;
     formRepository = null;
     // Serializes the single-response check-then-insert per (formId, email) within
     // this process, so a double-click/two-tab submission can't both pass the check
@@ -1231,13 +1236,13 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
     // per-instance lock would never be shared between the two racing requests.
     // Does not span multiple app instances; see withSubmissionLock().
     static submissionLocks = new Map();
-    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider, formEmailAuthService){
-        super(_config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ENTITIES.FORM_RESULT */.eF.FORM_RESULT, cacheManager, utilsService, FormResultService.name, true, _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, _entities_index_js__rspack_import_6/* .FormResult */.ez), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.dataSourceProvider = dataSourceProvider, this.formEmailAuthService = formEmailAuthService;
+    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider, formEmailAuthService, permissionResolver, permissionCache){
+        super(_config_index_js__rspack_import_12/* .FORM_BUILDER_EVENT_ENTITIES.FORM_RESULT */.eF.FORM_RESULT, cacheManager, utilsService, FormResultService.name, true, _config_index_js__rspack_import_12/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, _entities_index_js__rspack_import_7/* .FormResult */.ez), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.dataSourceProvider = dataSourceProvider, this.formEmailAuthService = formEmailAuthService, this.permissionResolver = permissionResolver, this.permissionCache = permissionCache;
     }
     async ensureFormRepositoryInitialized() {
         if (!this.formRepository) {
             const enableCompanyFeature = this.formBuilderConfig.isCompanyFeatureEnabled();
-            const formEntity = enableCompanyFeature ? _entities_index_js__rspack_import_6/* .FormWithCompany */.Wl : _entities_index_js__rspack_import_6/* .Form */.lV;
+            const formEntity = enableCompanyFeature ? _entities_index_js__rspack_import_7/* .FormWithCompany */.Wl : _entities_index_js__rspack_import_7/* .Form */.lV;
             this.formRepository = await this.dataSourceProvider.getRepository(formEntity);
         }
     }
@@ -1264,13 +1269,13 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             where: {
                 id: formId,
                 isActive: true,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         if (!form) {
-            throw new _nestjs_common__rspack_import_3.NotFoundException({
+            throw new _nestjs_common__rspack_import_4.NotFoundException({
                 message: 'Form not found or inactive',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.NOT_FOUND */.Q.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_13/* .FORM_MESSAGES.NOT_FOUND */.Q.NOT_FOUND
             });
         }
         return form;
@@ -1283,64 +1288,67 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         }
     }
     static PUBLICLY_SUBMITTABLE_ACCESS_TYPES = new Set([
-        _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.PUBLIC */.h.PUBLIC,
-        _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED
+        _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.PUBLIC */.h.PUBLIC,
+        _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED
     ]);
     async validateSubmissionAccess(form, user, isPublic) {
         if (isPublic) {
             if (!FormResultService.PUBLICLY_SUBMITTABLE_ACCESS_TYPES.has(form.accessType)) {
-                throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                throw new _nestjs_common__rspack_import_4.UnauthorizedException({
                     message: 'This form is not available for public submission',
-                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.NOT_PUBLIC */.Q.NOT_PUBLIC
+                    messageKey: _config_index_js__rspack_import_13/* .FORM_MESSAGES.NOT_PUBLIC */.Q.NOT_PUBLIC
                 });
             }
             return;
         }
         switch(form.accessType){
-            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.PUBLIC */.h.PUBLIC:
+            case _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.PUBLIC */.h.PUBLIC:
                 return;
-            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED:
-                throw new _nestjs_common__rspack_import_3.BadRequestException({
+            case _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED:
+                throw new _nestjs_common__rspack_import_4.BadRequestException({
                     message: 'Email-verified forms must be submitted through the public endpoint',
-                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                    messageKey: _config_index_js__rspack_import_13/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
                 });
-            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP:
-            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED:
+            case _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP:
+            case _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED:
                 break;
             default:
-                throw new _nestjs_common__rspack_import_3.BadRequestException({
+                throw new _nestjs_common__rspack_import_4.BadRequestException({
                     message: 'Invalid form access type',
-                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                    messageKey: _config_index_js__rspack_import_13/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
                 });
         }
         if (!user) {
-            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+            throw new _nestjs_common__rspack_import_4.UnauthorizedException({
                 message: 'Authentication required to submit this form',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.AUTH_REQUIRED */.Q.AUTH_REQUIRED
+                messageKey: _config_index_js__rspack_import_13/* .FORM_MESSAGES.AUTH_REQUIRED */.Q.AUTH_REQUIRED
             });
         }
-        if (form.accessType === _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.actionGroups?.length) {
-            const hasPermission = await (0,_utils_permission_utils_js__rspack_import_7/* .validateUserPermissions */.i)(user, form.actionGroups, this.cacheManager, this.formBuilderConfig.isCompanyFeatureEnabled());
-            if (!hasPermission) {
-                throw new _nestjs_common__rspack_import_3.ForbiddenException({
+        if (form.accessType === _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.permissionLogic) {
+            const permitted = await (0,_utils_permission_utils_js__rspack_import_8/* .hasFormPermission */.E)(user, form.permissionLogic, {
+                resolver: this.permissionResolver,
+                cache: this.permissionCache
+            });
+            if (!permitted) {
+                throw new _nestjs_common__rspack_import_4.ForbiddenException({
                     message: 'You do not have permission to submit this form',
-                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.ACCESS_DENIED */.Q.ACCESS_DENIED
+                    messageKey: _config_index_js__rspack_import_13/* .FORM_MESSAGES.ACCESS_DENIED */.Q.ACCESS_DENIED
                 });
             }
-        } else if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED) {
-            throw new _nestjs_common__rspack_import_3.BadRequestException({
+        } else if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED) {
+            throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Invalid form access type',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                messageKey: _config_index_js__rspack_import_13/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
             });
         }
     }
     async resolveEmailVerifiedSubmitter(form, user, accessToken) {
-        if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED) return null;
+        if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_14/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED) return null;
         const email = await this.formEmailAuthService.resolveSubmitterEmail(form.id, user ?? undefined, accessToken);
         if (!email) {
-            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+            throw new _nestjs_common__rspack_import_4.UnauthorizedException({
                 message: 'Email verification required to submit this form',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.EMAIL_VERIFICATION_REQUIRED */.Q.EMAIL_VERIFICATION_REQUIRED
+                messageKey: _config_index_js__rspack_import_13/* .FORM_MESSAGES.EMAIL_VERIFICATION_REQUIRED */.Q.EMAIL_VERIFICATION_REQUIRED
             });
         }
         return email;
@@ -1354,13 +1362,13 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
                 formId: form.id,
                 submitterEmail,
                 isDraft: false,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         if (count > 0) {
-            throw new _nestjs_common__rspack_import_3.ConflictException({
+            throw new _nestjs_common__rspack_import_4.ConflictException({
                 message: 'You have already submitted a response to this form',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_RESULT_MESSAGES.ALREADY_SUBMITTED */.y.ALREADY_SUBMITTED
+                messageKey: _config_index_js__rspack_import_13/* .FORM_RESULT_MESSAGES.ALREADY_SUBMITTED */.y.ALREADY_SUBMITTED
             });
         }
     }
@@ -1369,7 +1377,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             formId,
             submittedById: userId,
             isDraft: true,
-            deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+            deletedAt: (0,typeorm__rspack_import_5.IsNull)()
         };
     }
     // Query Customization
@@ -1411,7 +1419,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         if (!computedFields || computedFields.length === 0) {
             return data;
         }
-        const computedValues = (0,_utils_computed_field_utils_js__rspack_import_14/* .calculateComputedFields */.X)(data, computedFields);
+        const computedValues = (0,_utils_computed_field_utils_js__rspack_import_15/* .calculateComputedFields */.X)(data, computedFields);
         return {
             ...data,
             _computed: computedValues
@@ -1514,13 +1522,13 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             where: {
                 id: draftId,
                 submittedById: user.id,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         if (!draft) {
-            throw new _nestjs_common__rspack_import_3.NotFoundException({
+            throw new _nestjs_common__rspack_import_4.NotFoundException({
                 message: 'Draft not found',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_RESULT_MESSAGES.NOT_FOUND */.y.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_13/* .FORM_RESULT_MESSAGES.NOT_FOUND */.y.NOT_FOUND
             });
         }
         const form = await this.getActiveForm(dto.formId);
@@ -1540,7 +1548,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         return this.convertEntityToResponseDto(saved, false);
     }
     async publishSubmissionEvent(result, formId, isDraft, user) {
-        await this.publishDomainAction(isDraft ? _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ACTIONS.DRAFT_SAVED */.ov.DRAFT_SAVED : _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ACTIONS.SUBMITTED */.ov.SUBMITTED, {
+        await this.publishDomainAction(isDraft ? _config_index_js__rspack_import_12/* .FORM_BUILDER_EVENT_ACTIONS.DRAFT_SAVED */.ov.DRAFT_SAVED : _config_index_js__rspack_import_12/* .FORM_BUILDER_EVENT_ACTIONS.SUBMITTED */.ov.SUBMITTED, {
             ids: [
                 result.id
             ],
@@ -1581,7 +1589,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
                 formId,
                 submittedById: user.id,
                 isDraft: false,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         return count > 0;
@@ -1595,7 +1603,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
                 formId,
                 submitterEmail: email,
                 isDraft: false,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         return count > 0;
@@ -1608,7 +1616,7 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _dtos_form_result_dto_js__rspack_import_5/* .SubmitFormDto */.sH === "undefined" ? Object : _dtos_form_result_dto_js__rspack_import_5/* .SubmitFormDto */.sH,
+        typeof _dtos_form_result_dto_js__rspack_import_6/* .SubmitFormDto */.sH === "undefined" ? Object : _dtos_form_result_dto_js__rspack_import_6/* .SubmitFormDto */.sH,
         Object,
         void 0
     ]),
@@ -1622,27 +1630,33 @@ _ts_decorate([
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         String,
-        typeof _dtos_form_result_dto_js__rspack_import_5/* .SubmitFormDto */.sH === "undefined" ? Object : _dtos_form_result_dto_js__rspack_import_5/* .SubmitFormDto */.sH,
+        typeof _dtos_form_result_dto_js__rspack_import_6/* .SubmitFormDto */.sH === "undefined" ? Object : _dtos_form_result_dto_js__rspack_import_6/* .SubmitFormDto */.sH,
         typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
     ]),
     _ts_metadata("design:returntype", Promise)
 ], FormResultService.prototype, "updateDraft", null);
 FormResultService = _ts_decorate([
-    (0,_nestjs_common__rspack_import_3.Injectable)({
-        scope: _nestjs_common__rspack_import_3.Scope.REQUEST
+    (0,_nestjs_common__rspack_import_4.Injectable)({
+        scope: _nestjs_common__rspack_import_4.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
-    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_2.UtilsService)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._)),
-    _ts_param(4, (0,_nestjs_common__rspack_import_3.Inject)(_form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_3.UtilsService)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_form_builder_config_service_js__rspack_import_9/* .FormBuilderConfigService */.j)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_form_builder_datasource_provider_js__rspack_import_10/* .FormBuilderDataSourceProvider */._)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Inject)(_form_email_auth_service_js__rspack_import_11/* .FormEmailAuthService */.w)),
+    _ts_param(5, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(5, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.PERMISSION_RESOLVER)),
+    _ts_param(6, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(6, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
-        typeof _flusys_nestjs_shared_modules__rspack_import_2.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_2.UtilsService,
-        typeof _form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j === "undefined" ? Object : _form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j,
-        typeof _form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : _form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._,
-        typeof _form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w === "undefined" ? Object : _form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w
+        typeof _flusys_nestjs_shared_modules__rspack_import_3.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_3.UtilsService,
+        typeof _form_builder_config_service_js__rspack_import_9/* .FormBuilderConfigService */.j === "undefined" ? Object : _form_builder_config_service_js__rspack_import_9/* .FormBuilderConfigService */.j,
+        typeof _form_builder_datasource_provider_js__rspack_import_10/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : _form_builder_datasource_provider_js__rspack_import_10/* .FormBuilderDataSourceProvider */._,
+        typeof _form_email_auth_service_js__rspack_import_11/* .FormEmailAuthService */.w === "undefined" ? Object : _form_email_auth_service_js__rspack_import_11/* .FormEmailAuthService */.w,
+        typeof IPermissionResolver === "undefined" ? Object : IPermissionResolver,
+        typeof _flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService
     ])
 ], FormResultService);
 
@@ -1663,6 +1677,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/classes"
 var classes_ = __webpack_require__(937);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/interfaces"
+var interfaces_ = __webpack_require__(103);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/modules"
 var modules_ = __webpack_require__(236);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
@@ -1721,12 +1737,15 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class FormService extends classes_.ApiService {
     cacheManager;
     utilsService;
     formBuilderConfig;
-    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider){
-        super(event_actions/* .FORM_BUILDER_EVENT_ENTITIES.FORM */.eF.FORM, cacheManager, utilsService, FormService.name, true, event_actions/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, formBuilderConfig.isCompanyFeatureEnabled() ? entities/* .FormWithCompany */.Wl : entities/* .Form */.lV), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig;
+    permissionResolver;
+    permissionCache;
+    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider, permissionResolver, permissionCache){
+        super(event_actions/* .FORM_BUILDER_EVENT_ENTITIES.FORM */.eF.FORM, cacheManager, utilsService, FormService.name, true, event_actions/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, formBuilderConfig.isCompanyFeatureEnabled() ? entities/* .FormWithCompany */.Wl : entities/* .Form */.lV), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.permissionResolver = permissionResolver, this.permissionCache = permissionCache;
     }
     // Entity Conversion
     async convertSingleDtoToEntity(dto, user) {
@@ -1786,7 +1805,7 @@ class FormService extends classes_.ApiService {
                 'schema',
                 'schemaVersion',
                 'accessType',
-                'actionGroups',
+                'permissionLogic',
                 'tags',
                 'isActive',
                 'createdAt',
@@ -1856,7 +1875,7 @@ class FormService extends classes_.ApiService {
             schema: entity.schema,
             schemaVersion: entity.schemaVersion,
             accessType: entity.accessType,
-            actionGroups: entity.actionGroups,
+            permissionLogic: entity.permissionLogic,
             tags: entity.tags,
             isActive: entity.isActive,
             companyId: entityWithCompany.companyId ?? null,
@@ -1966,7 +1985,7 @@ class FormService extends classes_.ApiService {
                 'name',
                 'description',
                 'accessType',
-                'actionGroups',
+                'permissionLogic',
                 'isActive'
             ]
         });
@@ -1981,7 +2000,7 @@ class FormService extends classes_.ApiService {
             name: form.name,
             description: form.description,
             accessType: form.accessType,
-            actionGroups: form.actionGroups,
+            permissionLogic: form.permissionLogic,
             isActive: form.isActive
         };
     }
@@ -2014,10 +2033,12 @@ class FormService extends classes_.ApiService {
     }
     async getAuthenticatedForm(formId, user) {
         const form = await this.getFormForSubmission(formId, user);
-        // For action_group access, check permissions from cache
-        if (form.accessType === form_access_type_enum/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.actionGroups?.length) {
-            const hasPermission = await (0,permission_utils/* .validateUserPermissions */.i)(user, form.actionGroups, this.cacheManager, this.formBuilderConfig.isCompanyFeatureEnabled());
-            if (!hasPermission) {
+        if (form.accessType === form_access_type_enum/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.permissionLogic) {
+            const permitted = await (0,permission_utils/* .hasFormPermission */.E)(user, form.permissionLogic, {
+                resolver: this.permissionResolver,
+                cache: this.permissionCache
+            });
+            if (!permitted) {
                 throw new common_.ForbiddenException({
                     message: 'You do not have permission to access this form',
                     messageKey: message_keys/* .FORM_MESSAGES.ACCESS_DENIED */.Q.ACCESS_DENIED
@@ -2035,12 +2056,18 @@ FormService = _ts_decorate([
     _ts_param(1, (0,common_.Inject)(modules_.UtilsService)),
     _ts_param(2, (0,common_.Inject)(form_builder_config_service/* .FormBuilderConfigService */.j)),
     _ts_param(3, (0,common_.Inject)(form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._)),
+    _ts_param(4, (0,common_.Optional)()),
+    _ts_param(4, (0,common_.Inject)(interfaces_.PERMISSION_RESOLVER)),
+    _ts_param(5, (0,common_.Optional)()),
+    _ts_param(5, (0,common_.Inject)(modules_.SharedPermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof classes_.HybridCache === "undefined" ? Object : classes_.HybridCache,
         typeof modules_.UtilsService === "undefined" ? Object : modules_.UtilsService,
         typeof form_builder_config_service/* .FormBuilderConfigService */.j === "undefined" ? Object : form_builder_config_service/* .FormBuilderConfigService */.j,
-        typeof form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._
+        typeof form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._,
+        typeof IPermissionResolver === "undefined" ? Object : IPermissionResolver,
+        typeof modules_.SharedPermissionCacheService === "undefined" ? Object : modules_.SharedPermissionCacheService
     ])
 ], FormService);
 
@@ -2250,53 +2277,31 @@ __webpack_require__.d(__webpack_exports__, {
 
 },
 988(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _config_index_js__rspack_import_1 = __webpack_require__(137);
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_0 = __webpack_require__(216);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(157);
+/* import */ var _config_index_js__rspack_import_2 = __webpack_require__(137);
 
 
-const CACHE_PREFIX = 'permissions';
-/**
- * Build permission cache key for a user
- * Uses same cache key format as PermissionGuard in nestjs-shared
- */ function buildPermissionCacheKey(user, enableCompanyFeature) {
-    if (enableCompanyFeature && user.companyId) {
-        return `${CACHE_PREFIX}:company:${user.companyId}:branch:${user.branchId || 'null'}:user:${user.id}`;
-    }
-    return `${CACHE_PREFIX}:user:${user.id}`;
-}
-/**
- * Get user permissions from cache
- * Fail-closed: if cache fails, deny access rather than allowing potentially unauthorized access
- */ async function getUserPermissionsFromCache(user, cacheManager, enableCompanyFeature) {
-    const cacheKey = buildPermissionCacheKey(user, enableCompanyFeature);
+
+/** Whether `user` passes a form's AND / OR permission rule; fails closed when permissions cannot be read. */ async function hasFormPermission(user, logic, sources) {
+    let granted;
     try {
-        const permissions = await cacheManager.get(cacheKey);
-        return permissions ?? [];
+        granted = await (0,_flusys_nestjs_shared_utils__rspack_import_0.loadPermissionCodes)({
+            userId: user.id,
+            companyId: user.companyId,
+            branchId: user.branchId
+        }, sources);
     } catch  {
-        throw new _nestjs_common__rspack_import_0.ForbiddenException({
+        throw new _nestjs_common__rspack_import_1.ForbiddenException({
             message: 'Unable to verify permissions. Please try again.',
-            messageKey: _config_index_js__rspack_import_1/* .FORM_MESSAGES.PERMISSION_CHECK_FAILED */.Q.PERMISSION_CHECK_FAILED
+            messageKey: _config_index_js__rspack_import_2/* .FORM_MESSAGES.PERMISSION_CHECK_FAILED */.Q.PERMISSION_CHECK_FAILED
         });
     }
-}
-/**
- * Validate user has at least one of the required permissions
- *
- * @param user - The logged-in user
- * @param requiredPermissions - Array of required permission strings (user needs at least one)
- * @param cacheManager - Cache manager instance
- * @param enableCompanyFeature - Whether company feature is enabled
- * @returns true if user has permission, false otherwise
- */ async function validateUserPermissions(user, requiredPermissions, cacheManager, enableCompanyFeature) {
-    if (!requiredPermissions.length) {
-        return true;
-    }
-    const userPermissions = await getUserPermissionsFromCache(user, cacheManager, enableCompanyFeature);
-    return requiredPermissions.some((perm)=>userPermissions.includes(perm));
+    return (0,_flusys_nestjs_shared_utils__rspack_import_0.evaluatePermissionLogic)(logic, granted).passed;
 }
 
 __webpack_require__.d(__webpack_exports__, {
-  i: () => (validateUserPermissions)
+  E: () => (hasFormPermission)
 });
 
 
@@ -2318,6 +2323,12 @@ module.exports = __rspack_external__flusys_nestjs_shared_decorators_c129b601;
 module.exports = __rspack_external__flusys_nestjs_shared_dtos_c4585026;
 
 
+},
+103(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_interfaces_413f2706;
+
+
 },
 236(module) {
 

package/fesm/720.js

@@ -733,6 +733,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/dtos"
 var dtos_ = __webpack_require__(873);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
+var utils_ = __webpack_require__(216);
 // EXTERNAL MODULE: external "@nestjs/swagger"
 var swagger_ = __webpack_require__(176);
 // EXTERNAL MODULE: external "class-transformer"
@@ -765,13 +767,23 @@ function _ts_metadata(metadataKey, metadataValue) {
 
 
 
+
+function IsPermissionLogic() {
+    return (0,external_class_validator_.ValidateBy)({
+        name: 'isPermissionLogic',
+        validator: {
+            validate: (value)=>(0,utils_.permissionLogicProblem)(value) === null,
+            defaultMessage: ()=>`$property must be a non-empty AND / OR permission rule with at most ${utils_.MAX_PERMISSION_LOGIC_CODES} permissions`
+        }
+    });
+}
 class CreateFormDto {
     name;
     description;
     slug;
     schema;
     accessType;
-    actionGroups;
+    permissionLogic;
     tags;
     companyId;
     isActive;
@@ -833,20 +845,28 @@ _ts_decorate([
 ], CreateFormDto.prototype, "accessType", void 0);
 _ts_decorate([
     (0,swagger_.ApiProperty)({
-        description: 'Action groups for permission-based access (only used when accessType is action_group)',
-        example: [
-            'hr.survey.submit',
-            'employee.feedback.submit'
-        ],
-        required: false
-    }),
-    (0,external_class_validator_.IsArray)(),
-    (0,external_class_validator_.IsString)({
-        each: true
+        description: 'AND / OR permission rule a user must pass (only used when accessType is action_group)',
+        example: {
+            type: 'group',
+            operator: 'OR',
+            children: [
+                {
+                    type: 'action',
+                    actionId: 'hr.survey.submit'
+                },
+                {
+                    type: 'action',
+                    actionId: 'employee.feedback.submit'
+                }
+            ]
+        },
+        required: false,
+        nullable: true
     }),
+    IsPermissionLogic(),
     (0,external_class_validator_.IsOptional)(),
-    _ts_metadata("design:type", Array)
-], CreateFormDto.prototype, "actionGroups", void 0);
+    _ts_metadata("design:type", Object)
+], CreateFormDto.prototype, "permissionLogic", void 0);
 _ts_decorate([
     (0,swagger_.ApiProperty)({
         description: 'Tags used by consuming modules to fetch this form (e.g. survey, review)',
@@ -911,7 +931,7 @@ class FormResponseDto extends dtos_.IdentityResponseDto {
     schema;
     schemaVersion;
     accessType;
-    actionGroups;
+    permissionLogic;
     tags;
     companyId;
     isActive;
@@ -950,9 +970,11 @@ _ts_decorate([
 ], FormResponseDto.prototype, "accessType", void 0);
 _ts_decorate([
     (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
+    (0,swagger_.ApiProperty)({
+        nullable: true
+    }),
     _ts_metadata("design:type", Object)
-], FormResponseDto.prototype, "actionGroups", void 0);
+], FormResponseDto.prototype, "permissionLogic", void 0);
 _ts_decorate([
     (0,external_class_transformer_.Expose)(),
     (0,swagger_.ApiProperty)(),
@@ -981,7 +1003,7 @@ class FormAccessInfoResponseDto extends (0,swagger_.PickType)(FormResponseDto, [
     'name',
     'description',
     'accessType',
-    'actionGroups',
+    'permissionLogic',
     'isActive'
 ]) {
 }

package/fesm/docs/index.js

@@ -99,7 +99,7 @@ All queries automatically filter by current user's company context.
 
 ### Action Group Forms
 - Permission-based access via IAM
-- User must have specific permissions
+- User must pass the form's \`permissionLogic\` AND / OR rule (an \`ILogicNode\` tree)
 - Use \`/form-builder/form/authenticated/:id\` to get form
 - Use \`/form-builder/result/submit\` to submit
 

package/fesm/dtos/index.js

@@ -1,4 +1,5 @@
 import * as __rspack_external__flusys_nestjs_shared_dtos_c4585026 from "@flusys/nestjs-shared/dtos";
+import * as __rspack_external__flusys_nestjs_shared_utils_9125c1f1 from "@flusys/nestjs-shared/utils";
 import * as __rspack_external__nestjs_swagger_7cd450b5 from "@nestjs/swagger";
 import * as __rspack_external_class_transformer_c5a479fb from "class-transformer";
 import * as __rspack_external_class_validator_7b99ef4d from "class-validator";
@@ -270,6 +271,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/dtos"
 var dtos_ = __webpack_require__(873);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
+var utils_ = __webpack_require__(216);
 // EXTERNAL MODULE: external "@nestjs/swagger"
 var swagger_ = __webpack_require__(176);
 // EXTERNAL MODULE: external "class-transformer"
@@ -302,13 +305,23 @@ function _ts_metadata(metadataKey, metadataValue) {
 
 
 
+
+function IsPermissionLogic() {
+    return (0,external_class_validator_.ValidateBy)({
+        name: 'isPermissionLogic',
+        validator: {
+            validate: (value)=>(0,utils_.permissionLogicProblem)(value) === null,
+            defaultMessage: ()=>`$property must be a non-empty AND / OR permission rule with at most ${utils_.MAX_PERMISSION_LOGIC_CODES} permissions`
+        }
+    });
+}
 class CreateFormDto {
     name;
     description;
     slug;
     schema;
     accessType;
-    actionGroups;
+    permissionLogic;
     tags;
     companyId;
     isActive;
@@ -370,20 +383,28 @@ _ts_decorate([
 ], CreateFormDto.prototype, "accessType", void 0);
 _ts_decorate([
     (0,swagger_.ApiProperty)({
-        description: 'Action groups for permission-based access (only used when accessType is action_group)',
-        example: [
-            'hr.survey.submit',
-            'employee.feedback.submit'
-        ],
-        required: false
-    }),
-    (0,external_class_validator_.IsArray)(),
-    (0,external_class_validator_.IsString)({
-        each: true
-    }),
+        description: 'AND / OR permission rule a user must pass (only used when accessType is action_group)',
+        example: {
+            type: 'group',
+            operator: 'OR',
+            children: [
+                {
+                    type: 'action',
+                    actionId: 'hr.survey.submit'
+                },
+                {
+                    type: 'action',
+                    actionId: 'employee.feedback.submit'
+                }
+            ]
+        },
+        required: false,
+        nullable: true
+    }),
+    IsPermissionLogic(),
     (0,external_class_validator_.IsOptional)(),
-    _ts_metadata("design:type", Array)
-], CreateFormDto.prototype, "actionGroups", void 0);
+    _ts_metadata("design:type", Object)
+], CreateFormDto.prototype, "permissionLogic", void 0);
 _ts_decorate([
     (0,swagger_.ApiProperty)({
         description: 'Tags used by consuming modules to fetch this form (e.g. survey, review)',
@@ -448,7 +469,7 @@ class FormResponseDto extends dtos_.IdentityResponseDto {
     schema;
     schemaVersion;
     accessType;
-    actionGroups;
+    permissionLogic;
     tags;
     companyId;
     isActive;
@@ -487,9 +508,11 @@ _ts_decorate([
 ], FormResponseDto.prototype, "accessType", void 0);
 _ts_decorate([
     (0,external_class_transformer_.Expose)(),
-    (0,swagger_.ApiProperty)(),
+    (0,swagger_.ApiProperty)({
+        nullable: true
+    }),
     _ts_metadata("design:type", Object)
-], FormResponseDto.prototype, "actionGroups", void 0);
+], FormResponseDto.prototype, "permissionLogic", void 0);
 _ts_decorate([
     (0,external_class_transformer_.Expose)(),
     (0,swagger_.ApiProperty)(),
@@ -518,7 +541,7 @@ class FormAccessInfoResponseDto extends (0,swagger_.PickType)(FormResponseDto, [
     'name',
     'description',
     'accessType',
-    'actionGroups',
+    'permissionLogic',
     'isActive'
 ]) {
 }
@@ -691,6 +714,12 @@ __webpack_require__.d(__webpack_exports__, {
 module.exports = __rspack_external__flusys_nestjs_shared_dtos_c4585026;
 
 
+},
+216(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_utils_9125c1f1;
+
+
 },
 176(module) {
 

package/fesm/entities/index.js

@@ -56,7 +56,7 @@ class Form extends entities_Identity {
     schema;
     schemaVersion;
     accessType;
-    actionGroups;
+    permissionLogic;
     tags;
     isActive;
 }
@@ -113,10 +113,10 @@ _ts_decorate([
     (0,external_typeorm_.Column)({
         type: getJsonColumnType(),
         nullable: true,
-        name: 'action_groups'
+        name: 'permission_logic'
     }),
     _ts_metadata("design:type", Object)
-], Form.prototype, "actionGroups", void 0);
+], Form.prototype, "permissionLogic", void 0);
 _ts_decorate([
     (0,external_typeorm_.Column)({
         type: getJsonColumnType(),

package/fesm/index.js

@@ -118,7 +118,7 @@ All queries automatically filter by current user's company context.
 
 ### Action Group Forms
 - Permission-based access via IAM
-- User must have specific permissions
+- User must pass the form's \`permissionLogic\` AND / OR rule (an \`ILogicNode\` tree)
 - Use \`/form-builder/form/authenticated/:id\` to get form
 - Use \`/form-builder/result/submit\` to submit
 
@@ -239,7 +239,7 @@ __webpack_require__.d(__webpack_exports__, {
   XZ: () => (/* reexport */ computed_field_utils/* .calculateComputedFields */.X),
   aY: () => (/* reexport */ docs/* .formBuilderSwaggerConfig */.a),
   iO: () => (/* reexport */ entities.getFormBuilderEntitiesByConfig),
-  io: () => (/* reexport */ permission_utils/* .validateUserPermissions */.i)
+  EY: () => (/* reexport */ permission_utils/* .hasFormPermission */.E)
 });
 
 // EXTERNAL MODULE: ./projects/nestjs-form-builder/src/config/index.ts
@@ -533,5 +533,5 @@ var __webpack_exports__VerifyOtpResponseDto = __webpack_exports__.TU;
 var __webpack_exports__calculateComputedFields = __webpack_exports__.XZ;
 var __webpack_exports__formBuilderSwaggerConfig = __webpack_exports__.aY;
 var __webpack_exports__getFormBuilderEntitiesByConfig = __webpack_exports__.iO;
-var __webpack_exports__validateUserPermissions = __webpack_exports__.io;
-export { __webpack_exports__CreateFormDto as CreateFormDto, __webpack_exports__CreateFormResultDto as CreateFormResultDto, __webpack_exports__EmailVerifiedFormResponseDto as EmailVerifiedFormResponseDto, __webpack_exports__FORM_BUILDER_EMAIL_PROVIDER as FORM_BUILDER_EMAIL_PROVIDER, __webpack_exports__FORM_BUILDER_EVENT_ACTIONS as FORM_BUILDER_EVENT_ACTIONS, __webpack_exports__FORM_BUILDER_EVENT_ENTITIES as FORM_BUILDER_EVENT_ENTITIES, __webpack_exports__FORM_BUILDER_EVENT_MODULE as FORM_BUILDER_EVENT_MODULE, __webpack_exports__FORM_BUILDER_MODULE_OPTIONS as FORM_BUILDER_MODULE_OPTIONS, __webpack_exports__FORM_MESSAGES as FORM_MESSAGES, __webpack_exports__FORM_RESULT_MESSAGES as FORM_RESULT_MESSAGES, __webpack_exports__Form as Form, __webpack_exports__FormAccessInfoResponseDto as FormAccessInfoResponseDto, __webpack_exports__FormAccessType as FormAccessType, __webpack_exports__FormBase as FormBase, __webpack_exports__FormBuilderConfigService as FormBuilderConfigService, __webpack_exports__FormBuilderDataSourceProvider as FormBuilderDataSourceProvider, __webpack_exports__FormBuilderModule as FormBuilderModule, __webpack_exports__FormCompanyEntities as FormCompanyEntities, __webpack_exports__FormController as FormController, __webpack_exports__FormCoreEntities as FormCoreEntities, __webpack_exports__FormEmailAuthController as FormEmailAuthController, __webpack_exports__FormEmailAuthService as FormEmailAuthService, __webpack_exports__FormEmailVerification as FormEmailVerification, __webpack_exports__FormResponseDto as FormResponseDto, __webpack_exports__FormResult as FormResult, __webpack_exports__FormResultController as FormResultController, __webpack_exports__FormResultResponseDto as FormResultResponseDto, __webpack_exports__FormResultService as FormResultService, __webpack_exports__FormService as FormService, __webpack_exports__FormWithCompany as FormWithCompany, __webpack_exports__GetMyDraftDto as GetMyDraftDto, __webpack_exports__GetResultsByFormDto as GetResultsByFormDto, __webpack_exports__HasSubmittedEmailDto as HasSubmittedEmailDto, __webpack_exports__LoadEmailVerifiedFormDto as LoadEmailVerifiedFormDto, __webpack_exports__PublicFormResponseDto as PublicFormResponseDto, __webpack_exports__RequestFormEmailOtpDto as RequestFormEmailOtpDto, __webpack_exports__SubmitFormDto as SubmitFormDto, __webpack_exports__UpdateDraftDto as UpdateDraftDto, __webpack_exports__UpdateFormDto as UpdateFormDto, __webpack_exports__UpdateFormResultDto as UpdateFormResultDto, __webpack_exports__VerifyFormEmailOtpDto as VerifyFormEmailOtpDto, __webpack_exports__VerifyOtpResponseDto as VerifyOtpResponseDto, __webpack_exports__calculateComputedFields as calculateComputedFields, __webpack_exports__formBuilderSwaggerConfig as formBuilderSwaggerConfig, __webpack_exports__getFormBuilderEntitiesByConfig as getFormBuilderEntitiesByConfig, __webpack_exports__validateUserPermissions as validateUserPermissions };
+var __webpack_exports__hasFormPermission = __webpack_exports__.EY;
+export { __webpack_exports__CreateFormDto as CreateFormDto, __webpack_exports__CreateFormResultDto as CreateFormResultDto, __webpack_exports__EmailVerifiedFormResponseDto as EmailVerifiedFormResponseDto, __webpack_exports__FORM_BUILDER_EMAIL_PROVIDER as FORM_BUILDER_EMAIL_PROVIDER, __webpack_exports__FORM_BUILDER_EVENT_ACTIONS as FORM_BUILDER_EVENT_ACTIONS, __webpack_exports__FORM_BUILDER_EVENT_ENTITIES as FORM_BUILDER_EVENT_ENTITIES, __webpack_exports__FORM_BUILDER_EVENT_MODULE as FORM_BUILDER_EVENT_MODULE, __webpack_exports__FORM_BUILDER_MODULE_OPTIONS as FORM_BUILDER_MODULE_OPTIONS, __webpack_exports__FORM_MESSAGES as FORM_MESSAGES, __webpack_exports__FORM_RESULT_MESSAGES as FORM_RESULT_MESSAGES, __webpack_exports__Form as Form, __webpack_exports__FormAccessInfoResponseDto as FormAccessInfoResponseDto, __webpack_exports__FormAccessType as FormAccessType, __webpack_exports__FormBase as FormBase, __webpack_exports__FormBuilderConfigService as FormBuilderConfigService, __webpack_exports__FormBuilderDataSourceProvider as FormBuilderDataSourceProvider, __webpack_exports__FormBuilderModule as FormBuilderModule, __webpack_exports__FormCompanyEntities as FormCompanyEntities, __webpack_exports__FormController as FormController, __webpack_exports__FormCoreEntities as FormCoreEntities, __webpack_exports__FormEmailAuthController as FormEmailAuthController, __webpack_exports__FormEmailAuthService as FormEmailAuthService, __webpack_exports__FormEmailVerification as FormEmailVerification, __webpack_exports__FormResponseDto as FormResponseDto, __webpack_exports__FormResult as FormResult, __webpack_exports__FormResultController as FormResultController, __webpack_exports__FormResultResponseDto as FormResultResponseDto, __webpack_exports__FormResultService as FormResultService, __webpack_exports__FormService as FormService, __webpack_exports__FormWithCompany as FormWithCompany, __webpack_exports__GetMyDraftDto as GetMyDraftDto, __webpack_exports__GetResultsByFormDto as GetResultsByFormDto, __webpack_exports__HasSubmittedEmailDto as HasSubmittedEmailDto, __webpack_exports__LoadEmailVerifiedFormDto as LoadEmailVerifiedFormDto, __webpack_exports__PublicFormResponseDto as PublicFormResponseDto, __webpack_exports__RequestFormEmailOtpDto as RequestFormEmailOtpDto, __webpack_exports__SubmitFormDto as SubmitFormDto, __webpack_exports__UpdateDraftDto as UpdateDraftDto, __webpack_exports__UpdateFormDto as UpdateFormDto, __webpack_exports__UpdateFormResultDto as UpdateFormResultDto, __webpack_exports__VerifyFormEmailOtpDto as VerifyFormEmailOtpDto, __webpack_exports__VerifyOtpResponseDto as VerifyOtpResponseDto, __webpack_exports__calculateComputedFields as calculateComputedFields, __webpack_exports__formBuilderSwaggerConfig as formBuilderSwaggerConfig, __webpack_exports__getFormBuilderEntitiesByConfig as getFormBuilderEntitiesByConfig, __webpack_exports__hasFormPermission as hasFormPermission };

package/interfaces/form.interface.d.ts

@@ -1,4 +1,4 @@
-import { type IIdentity } from '@flusys/nestjs-shared/interfaces';
+import { type IIdentity, type ILogicNode } from '@flusys/nestjs-shared/interfaces';
 import { FormAccessType } from '../enums/form-access-type.enum.js';
 export interface IForm extends IIdentity {
     name: string;
@@ -7,7 +7,7 @@ export interface IForm extends IIdentity {
     schema: Record<string, unknown>;
     schemaVersion: number;
     accessType: FormAccessType;
-    actionGroups: string[] | null;
+    permissionLogic: ILogicNode | null;
     tags: string[] | null;
     isActive: boolean;
     companyId: string | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-form-builder",
-  "version": "9.1.0-rc.1",
+  "version": "9.1.1",
   "description": "Dynamic form builder module with schema versioning and access control",
   "type": "module",
   "main": "./fesm/index.js",
@@ -65,17 +65,17 @@
     "@nestjs/common": "^12.0.0",
     "@nestjs/config": "^12.0.0",
     "@nestjs/core": "^12.0.0",
-    "@nestjs/platform-express": "^12.0.0",
+    "@nestjs/platform-express": "^12.1.2",
     "@nestjs/swagger": "^12.0.0",
     "@nestjs/throttler": "^6.5.0",
     "@nestjs/typeorm": "^12.0.0",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.15.0",
-    "typeorm": "^0.3.0",
+    "typeorm": "^0.3.31",
     "express": "^5.0.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "9.1.0-rc.1",
-    "@flusys/nestjs-shared": "9.1.0-rc.1"
+    "@flusys/nestjs-core": "9.1.1",
+    "@flusys/nestjs-shared": "9.1.1"
   }
 }

package/services/form-result.service.d.ts

@@ -1,7 +1,7 @@
 import { HybridCache, ApiService } from '@flusys/nestjs-shared/classes';
 import { FilterAndPaginationDto } from '@flusys/nestjs-shared/dtos';
-import { type ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
-import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { type ILoggedUserInfo, type IPermissionResolver } from '@flusys/nestjs-shared/interfaces';
+import { SharedPermissionCacheService, UtilsService } from '@flusys/nestjs-shared/modules';
 import { SelectQueryBuilder } from 'typeorm';
 import { CreateFormResultDto, SubmitFormDto, UpdateFormResultDto } from '../dtos/form-result.dto.js';
 import { FormResult } from '../entities/index.js';
@@ -15,9 +15,11 @@ export declare class FormResultService extends ApiService<CreateFormResultDto, U
     private readonly formBuilderConfig;
     private readonly dataSourceProvider;
     private readonly formEmailAuthService;
+    private readonly permissionResolver?;
+    private readonly permissionCache?;
     private formRepository;
     private static readonly submissionLocks;
-    constructor(cacheManager: HybridCache, utilsService: UtilsService, formBuilderConfig: FormBuilderConfigService, dataSourceProvider: FormBuilderDataSourceProvider, formEmailAuthService: FormEmailAuthService);
+    constructor(cacheManager: HybridCache, utilsService: UtilsService, formBuilderConfig: FormBuilderConfigService, dataSourceProvider: FormBuilderDataSourceProvider, formEmailAuthService: FormEmailAuthService, permissionResolver?: IPermissionResolver | undefined, permissionCache?: SharedPermissionCacheService | undefined);
     private ensureFormRepositoryInitialized;
     private withSubmissionLock;
     private getActiveForm;

package/services/form.service.d.ts

@@ -1,7 +1,7 @@
 import { HybridCache, ApiService } from '@flusys/nestjs-shared/classes';
 import { FilterAndPaginationDto } from '@flusys/nestjs-shared/dtos';
-import { type ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
-import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { type ILoggedUserInfo, type ILogicNode, type IPermissionResolver } from '@flusys/nestjs-shared/interfaces';
+import { SharedPermissionCacheService, UtilsService } from '@flusys/nestjs-shared/modules';
 import { SelectQueryBuilder } from 'typeorm';
 import { CreateFormDto, UpdateFormDto } from '../dtos/form.dto.js';
 import { Form } from '../entities/index.js';
@@ -13,7 +13,9 @@ export declare class FormService extends ApiService<CreateFormDto, UpdateFormDto
     protected cacheManager: HybridCache;
     protected utilsService: UtilsService;
     private readonly formBuilderConfig;
-    constructor(cacheManager: HybridCache, utilsService: UtilsService, formBuilderConfig: FormBuilderConfigService, dataSourceProvider: FormBuilderDataSourceProvider);
+    private readonly permissionResolver?;
+    private readonly permissionCache?;
+    constructor(cacheManager: HybridCache, utilsService: UtilsService, formBuilderConfig: FormBuilderConfigService, dataSourceProvider: FormBuilderDataSourceProvider, permissionResolver?: IPermissionResolver | undefined, permissionCache?: SharedPermissionCacheService | undefined);
     convertSingleDtoToEntity(dto: CreateFormDto | UpdateFormDto, user: ILoggedUserInfo | null): Promise<Form>;
     getSelectQuery(query: SelectQueryBuilder<Form>, _user: ILoggedUserInfo | null, select?: string[]): Promise<{
         query: SelectQueryBuilder<Form>;
@@ -40,7 +42,7 @@ export declare class FormService extends ApiService<CreateFormDto, UpdateFormDto
         name: string;
         description: string | null;
         accessType: FormAccessType;
-        actionGroups: string[] | null;
+        permissionLogic: ILogicNode | null;
         isActive: boolean;
     }>;
     getEmailVerifiedFormEntity(formId: string): Promise<Form>;

package/utils/permission.utils.d.ts

@@ -1,3 +1,3 @@
-import { HybridCache } from '@flusys/nestjs-shared/classes';
-import { type ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
-export declare function validateUserPermissions(user: ILoggedUserInfo, requiredPermissions: string[], cacheManager: HybridCache, enableCompanyFeature: boolean): Promise<boolean>;
+import { type ILoggedUserInfo, type ILogicNode } from '@flusys/nestjs-shared/interfaces';
+import { type IPermissionSources } from '@flusys/nestjs-shared/utils';
+export declare function hasFormPermission(user: ILoggedUserInfo, logic: ILogicNode, sources: IPermissionSources): Promise<boolean>;