@flusys/nestjs-form-builder 9.1.0 → 9.1.2

package/fesm/432.js

@@ -3,6 +3,7 @@ import { Identity as entities_Identity } from "@flusys/nestjs-shared/entities";
 import * as __rspack_external__flusys_nestjs_shared_classes_6076a329 from "@flusys/nestjs-shared/classes";
 import * as __rspack_external__flusys_nestjs_shared_decorators_c129b601 from "@flusys/nestjs-shared/decorators";
 import * as __rspack_external__flusys_nestjs_shared_dtos_c4585026 from "@flusys/nestjs-shared/dtos";
+import * as __rspack_external__flusys_nestjs_shared_interfaces_413f2706 from "@flusys/nestjs-shared/interfaces";
 import * as __rspack_external__flusys_nestjs_shared_modules_24702bee from "@flusys/nestjs-shared/modules";
 import * as __rspack_external__flusys_nestjs_shared_utils_9125c1f1 from "@flusys/nestjs-shared/utils";
 import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
@@ -67,7 +68,8 @@ const FORM_MESSAGES = {
     OTP_INVALID: 'form.email.otp.invalid',
     OTP_EXPIRED: 'form.email.otp.expired',
     OTP_TOO_MANY_ATTEMPTS: 'form.email.otp.too.many.attempts',
-    OTP_VERIFIED: 'form.email.otp.verified'
+    OTP_VERIFIED: 'form.email.otp.verified',
+    INVALID_COMPUTED_FIELD: 'form.invalid.computed.field'
 };
 const FORM_RESULT_MESSAGES = {
     GET_ALL_SUCCESS: 'form.result.get.all.success',
@@ -379,7 +381,7 @@ class Form extends entities_Identity {
     schema;
     schemaVersion;
     accessType;
-    actionGroups;
+    permissionLogic;
     tags;
     isActive;
 }
@@ -436,10 +438,10 @@ _ts_decorate([
     (0,external_typeorm_.Column)({
         type: getJsonColumnType(),
         nullable: true,
-        name: 'action_groups'
+        name: 'permission_logic'
     }),
     _ts_metadata("design:type", Object)
-], Form.prototype, "actionGroups", void 0);
+], Form.prototype, "permissionLogic", void 0);
 _ts_decorate([
     (0,external_typeorm_.Column)({
         type: getJsonColumnType(),
@@ -1168,19 +1170,20 @@ FormEmailAuthService = _ts_decorate([
 160(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(937);
 /* import */ var _flusys_nestjs_shared_decorators__rspack_import_1 = __webpack_require__(265);
-/* import */ var _flusys_nestjs_shared_modules__rspack_import_2 = __webpack_require__(236);
-/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(157);
-/* import */ var typeorm__rspack_import_4 = __webpack_require__(158);
-/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(769);
-/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(137);
-/* import */ var _dtos_form_result_dto_js__rspack_import_5 = __webpack_require__(788);
-/* import */ var _entities_index_js__rspack_import_6 = __webpack_require__(814);
-/* import */ var _enums_form_access_type_enum_js__rspack_import_13 = __webpack_require__(376);
-/* import */ var _utils_computed_field_utils_js__rspack_import_14 = __webpack_require__(801);
-/* import */ var _utils_permission_utils_js__rspack_import_7 = __webpack_require__(988);
-/* import */ var _form_builder_config_service_js__rspack_import_8 = __webpack_require__(781);
-/* import */ var _form_builder_datasource_provider_js__rspack_import_9 = __webpack_require__(593);
-/* import */ var _form_email_auth_service_js__rspack_import_10 = __webpack_require__(474);
+/* import */ var _flusys_nestjs_shared_interfaces__rspack_import_2 = __webpack_require__(103);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_3 = __webpack_require__(236);
+/* import */ var _nestjs_common__rspack_import_4 = __webpack_require__(157);
+/* import */ var typeorm__rspack_import_5 = __webpack_require__(158);
+/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(769);
+/* import */ var _config_index_js__rspack_import_14 = __webpack_require__(137);
+/* import */ var _dtos_form_result_dto_js__rspack_import_6 = __webpack_require__(788);
+/* import */ var _entities_index_js__rspack_import_7 = __webpack_require__(814);
+/* import */ var _enums_form_access_type_enum_js__rspack_import_15 = __webpack_require__(376);
+/* import */ var _utils_computed_field_utils_js__rspack_import_8 = __webpack_require__(801);
+/* import */ var _utils_permission_utils_js__rspack_import_9 = __webpack_require__(988);
+/* import */ var _form_builder_config_service_js__rspack_import_10 = __webpack_require__(781);
+/* import */ var _form_builder_datasource_provider_js__rspack_import_11 = __webpack_require__(593);
+/* import */ var _form_email_auth_service_js__rspack_import_12 = __webpack_require__(474);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1218,12 +1221,15 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
     cacheManager;
     utilsService;
     formBuilderConfig;
     dataSourceProvider;
     formEmailAuthService;
+    permissionResolver;
+    permissionCache;
     formRepository = null;
     // Serializes the single-response check-then-insert per (formId, email) within
     // this process, so a double-click/two-tab submission can't both pass the check
@@ -1231,13 +1237,13 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
     // per-instance lock would never be shared between the two racing requests.
     // Does not span multiple app instances; see withSubmissionLock().
     static submissionLocks = new Map();
-    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider, formEmailAuthService){
-        super(_config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ENTITIES.FORM_RESULT */.eF.FORM_RESULT, cacheManager, utilsService, FormResultService.name, true, _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, _entities_index_js__rspack_import_6/* .FormResult */.ez), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.dataSourceProvider = dataSourceProvider, this.formEmailAuthService = formEmailAuthService;
+    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider, formEmailAuthService, permissionResolver, permissionCache){
+        super(_config_index_js__rspack_import_13/* .FORM_BUILDER_EVENT_ENTITIES.FORM_RESULT */.eF.FORM_RESULT, cacheManager, utilsService, FormResultService.name, true, _config_index_js__rspack_import_13/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, _entities_index_js__rspack_import_7/* .FormResult */.ez), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.dataSourceProvider = dataSourceProvider, this.formEmailAuthService = formEmailAuthService, this.permissionResolver = permissionResolver, this.permissionCache = permissionCache;
     }
     async ensureFormRepositoryInitialized() {
         if (!this.formRepository) {
             const enableCompanyFeature = this.formBuilderConfig.isCompanyFeatureEnabled();
-            const formEntity = enableCompanyFeature ? _entities_index_js__rspack_import_6/* .FormWithCompany */.Wl : _entities_index_js__rspack_import_6/* .Form */.lV;
+            const formEntity = enableCompanyFeature ? _entities_index_js__rspack_import_7/* .FormWithCompany */.Wl : _entities_index_js__rspack_import_7/* .Form */.lV;
             this.formRepository = await this.dataSourceProvider.getRepository(formEntity);
         }
     }
@@ -1264,13 +1270,13 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             where: {
                 id: formId,
                 isActive: true,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         if (!form) {
-            throw new _nestjs_common__rspack_import_3.NotFoundException({
+            throw new _nestjs_common__rspack_import_4.NotFoundException({
                 message: 'Form not found or inactive',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.NOT_FOUND */.Q.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_14/* .FORM_MESSAGES.NOT_FOUND */.Q.NOT_FOUND
             });
         }
         return form;
@@ -1283,64 +1289,67 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         }
     }
     static PUBLICLY_SUBMITTABLE_ACCESS_TYPES = new Set([
-        _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.PUBLIC */.h.PUBLIC,
-        _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED
+        _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.PUBLIC */.h.PUBLIC,
+        _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED
     ]);
     async validateSubmissionAccess(form, user, isPublic) {
         if (isPublic) {
             if (!FormResultService.PUBLICLY_SUBMITTABLE_ACCESS_TYPES.has(form.accessType)) {
-                throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+                throw new _nestjs_common__rspack_import_4.UnauthorizedException({
                     message: 'This form is not available for public submission',
-                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.NOT_PUBLIC */.Q.NOT_PUBLIC
+                    messageKey: _config_index_js__rspack_import_14/* .FORM_MESSAGES.NOT_PUBLIC */.Q.NOT_PUBLIC
                 });
             }
             return;
         }
         switch(form.accessType){
-            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.PUBLIC */.h.PUBLIC:
+            case _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.PUBLIC */.h.PUBLIC:
                 return;
-            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED:
-                throw new _nestjs_common__rspack_import_3.BadRequestException({
+            case _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED:
+                throw new _nestjs_common__rspack_import_4.BadRequestException({
                     message: 'Email-verified forms must be submitted through the public endpoint',
-                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                    messageKey: _config_index_js__rspack_import_14/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
                 });
-            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP:
-            case _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED:
+            case _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP:
+            case _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED:
                 break;
             default:
-                throw new _nestjs_common__rspack_import_3.BadRequestException({
+                throw new _nestjs_common__rspack_import_4.BadRequestException({
                     message: 'Invalid form access type',
-                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                    messageKey: _config_index_js__rspack_import_14/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
                 });
         }
         if (!user) {
-            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+            throw new _nestjs_common__rspack_import_4.UnauthorizedException({
                 message: 'Authentication required to submit this form',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.AUTH_REQUIRED */.Q.AUTH_REQUIRED
+                messageKey: _config_index_js__rspack_import_14/* .FORM_MESSAGES.AUTH_REQUIRED */.Q.AUTH_REQUIRED
             });
         }
-        if (form.accessType === _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.actionGroups?.length) {
-            const hasPermission = await (0,_utils_permission_utils_js__rspack_import_7/* .validateUserPermissions */.i)(user, form.actionGroups, this.cacheManager, this.formBuilderConfig.isCompanyFeatureEnabled());
-            if (!hasPermission) {
-                throw new _nestjs_common__rspack_import_3.ForbiddenException({
+        if (form.accessType === _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.permissionLogic) {
+            const permitted = await (0,_utils_permission_utils_js__rspack_import_9/* .hasFormPermission */.E)(user, form.permissionLogic, {
+                resolver: this.permissionResolver,
+                cache: this.permissionCache
+            });
+            if (!permitted) {
+                throw new _nestjs_common__rspack_import_4.ForbiddenException({
                     message: 'You do not have permission to submit this form',
-                    messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.ACCESS_DENIED */.Q.ACCESS_DENIED
+                    messageKey: _config_index_js__rspack_import_14/* .FORM_MESSAGES.ACCESS_DENIED */.Q.ACCESS_DENIED
                 });
             }
-        } else if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED) {
-            throw new _nestjs_common__rspack_import_3.BadRequestException({
+        } else if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.AUTHENTICATED */.h.AUTHENTICATED) {
+            throw new _nestjs_common__rspack_import_4.BadRequestException({
                 message: 'Invalid form access type',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
+                messageKey: _config_index_js__rspack_import_14/* .FORM_MESSAGES.INVALID_ACCESS_TYPE */.Q.INVALID_ACCESS_TYPE
             });
         }
     }
     async resolveEmailVerifiedSubmitter(form, user, accessToken) {
-        if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_13/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED) return null;
+        if (form.accessType !== _enums_form_access_type_enum_js__rspack_import_15/* .FormAccessType.EMAIL_VERIFIED */.h.EMAIL_VERIFIED) return null;
         const email = await this.formEmailAuthService.resolveSubmitterEmail(form.id, user ?? undefined, accessToken);
         if (!email) {
-            throw new _nestjs_common__rspack_import_3.UnauthorizedException({
+            throw new _nestjs_common__rspack_import_4.UnauthorizedException({
                 message: 'Email verification required to submit this form',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_MESSAGES.EMAIL_VERIFICATION_REQUIRED */.Q.EMAIL_VERIFICATION_REQUIRED
+                messageKey: _config_index_js__rspack_import_14/* .FORM_MESSAGES.EMAIL_VERIFICATION_REQUIRED */.Q.EMAIL_VERIFICATION_REQUIRED
             });
         }
         return email;
@@ -1354,13 +1363,13 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
                 formId: form.id,
                 submitterEmail,
                 isDraft: false,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         if (count > 0) {
-            throw new _nestjs_common__rspack_import_3.ConflictException({
+            throw new _nestjs_common__rspack_import_4.ConflictException({
                 message: 'You have already submitted a response to this form',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_RESULT_MESSAGES.ALREADY_SUBMITTED */.y.ALREADY_SUBMITTED
+                messageKey: _config_index_js__rspack_import_14/* .FORM_RESULT_MESSAGES.ALREADY_SUBMITTED */.y.ALREADY_SUBMITTED
             });
         }
     }
@@ -1369,7 +1378,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             formId,
             submittedById: userId,
             isDraft: true,
-            deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+            deletedAt: (0,typeorm__rspack_import_5.IsNull)()
         };
     }
     // Query Customization
@@ -1405,13 +1414,10 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         if (isDraft) {
             return data;
         }
-        const schema = form.schema;
-        const settings = schema?.settings;
-        const computedFields = settings?.computedFields;
-        if (!computedFields || computedFields.length === 0) {
+        const computedValues = (0,_utils_computed_field_utils_js__rspack_import_8/* .calculateComputedFields */.XZ)(data, form.schema);
+        if (Object.keys(computedValues).length === 0) {
             return data;
         }
-        const computedValues = (0,_utils_computed_field_utils_js__rspack_import_14/* .calculateComputedFields */.X)(data, computedFields);
         return {
             ...data,
             _computed: computedValues
@@ -1514,13 +1520,13 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
             where: {
                 id: draftId,
                 submittedById: user.id,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         if (!draft) {
-            throw new _nestjs_common__rspack_import_3.NotFoundException({
+            throw new _nestjs_common__rspack_import_4.NotFoundException({
                 message: 'Draft not found',
-                messageKey: _config_index_js__rspack_import_12/* .FORM_RESULT_MESSAGES.NOT_FOUND */.y.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_14/* .FORM_RESULT_MESSAGES.NOT_FOUND */.y.NOT_FOUND
             });
         }
         const form = await this.getActiveForm(dto.formId);
@@ -1540,7 +1546,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
         return this.convertEntityToResponseDto(saved, false);
     }
     async publishSubmissionEvent(result, formId, isDraft, user) {
-        await this.publishDomainAction(isDraft ? _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ACTIONS.DRAFT_SAVED */.ov.DRAFT_SAVED : _config_index_js__rspack_import_11/* .FORM_BUILDER_EVENT_ACTIONS.SUBMITTED */.ov.SUBMITTED, {
+        await this.publishDomainAction(isDraft ? _config_index_js__rspack_import_13/* .FORM_BUILDER_EVENT_ACTIONS.DRAFT_SAVED */.ov.DRAFT_SAVED : _config_index_js__rspack_import_13/* .FORM_BUILDER_EVENT_ACTIONS.SUBMITTED */.ov.SUBMITTED, {
             ids: [
                 result.id
             ],
@@ -1581,7 +1587,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
                 formId,
                 submittedById: user.id,
                 isDraft: false,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         return count > 0;
@@ -1595,7 +1601,7 @@ class FormResultService extends _flusys_nestjs_shared_classes__rspack_import_0.A
                 formId,
                 submitterEmail: email,
                 isDraft: false,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         return count > 0;
@@ -1608,7 +1614,7 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _dtos_form_result_dto_js__rspack_import_5/* .SubmitFormDto */.sH === "undefined" ? Object : _dtos_form_result_dto_js__rspack_import_5/* .SubmitFormDto */.sH,
+        typeof _dtos_form_result_dto_js__rspack_import_6/* .SubmitFormDto */.sH === "undefined" ? Object : _dtos_form_result_dto_js__rspack_import_6/* .SubmitFormDto */.sH,
         Object,
         void 0
     ]),
@@ -1622,27 +1628,33 @@ _ts_decorate([
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         String,
-        typeof _dtos_form_result_dto_js__rspack_import_5/* .SubmitFormDto */.sH === "undefined" ? Object : _dtos_form_result_dto_js__rspack_import_5/* .SubmitFormDto */.sH,
+        typeof _dtos_form_result_dto_js__rspack_import_6/* .SubmitFormDto */.sH === "undefined" ? Object : _dtos_form_result_dto_js__rspack_import_6/* .SubmitFormDto */.sH,
         typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
     ]),
     _ts_metadata("design:returntype", Promise)
 ], FormResultService.prototype, "updateDraft", null);
 FormResultService = _ts_decorate([
-    (0,_nestjs_common__rspack_import_3.Injectable)({
-        scope: _nestjs_common__rspack_import_3.Scope.REQUEST
+    (0,_nestjs_common__rspack_import_4.Injectable)({
+        scope: _nestjs_common__rspack_import_4.Scope.REQUEST
     }),
-    _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
-    _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_2.UtilsService)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._)),
-    _ts_param(4, (0,_nestjs_common__rspack_import_3.Inject)(_form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_4.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_3.UtilsService)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_4.Inject)(_form_builder_config_service_js__rspack_import_10/* .FormBuilderConfigService */.j)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_4.Inject)(_form_builder_datasource_provider_js__rspack_import_11/* .FormBuilderDataSourceProvider */._)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_4.Inject)(_form_email_auth_service_js__rspack_import_12/* .FormEmailAuthService */.w)),
+    _ts_param(5, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(5, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_interfaces__rspack_import_2.PERMISSION_RESOLVER)),
+    _ts_param(6, (0,_nestjs_common__rspack_import_4.Optional)()),
+    _ts_param(6, (0,_nestjs_common__rspack_import_4.Inject)(_flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
-        typeof _flusys_nestjs_shared_modules__rspack_import_2.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_2.UtilsService,
-        typeof _form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j === "undefined" ? Object : _form_builder_config_service_js__rspack_import_8/* .FormBuilderConfigService */.j,
-        typeof _form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : _form_builder_datasource_provider_js__rspack_import_9/* .FormBuilderDataSourceProvider */._,
-        typeof _form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w === "undefined" ? Object : _form_email_auth_service_js__rspack_import_10/* .FormEmailAuthService */.w
+        typeof _flusys_nestjs_shared_modules__rspack_import_3.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_3.UtilsService,
+        typeof _form_builder_config_service_js__rspack_import_10/* .FormBuilderConfigService */.j === "undefined" ? Object : _form_builder_config_service_js__rspack_import_10/* .FormBuilderConfigService */.j,
+        typeof _form_builder_datasource_provider_js__rspack_import_11/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : _form_builder_datasource_provider_js__rspack_import_11/* .FormBuilderDataSourceProvider */._,
+        typeof _form_email_auth_service_js__rspack_import_12/* .FormEmailAuthService */.w === "undefined" ? Object : _form_email_auth_service_js__rspack_import_12/* .FormEmailAuthService */.w,
+        typeof IPermissionResolver === "undefined" ? Object : IPermissionResolver,
+        typeof _flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_3.SharedPermissionCacheService
     ])
 ], FormResultService);
 
@@ -1663,6 +1675,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/classes"
 var classes_ = __webpack_require__(937);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/interfaces"
+var interfaces_ = __webpack_require__(103);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/modules"
 var modules_ = __webpack_require__(236);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
@@ -1679,6 +1693,8 @@ var message_keys = __webpack_require__(137);
 var entities = __webpack_require__(814);
 // EXTERNAL MODULE: ./projects/nestjs-form-builder/src/enums/form-access-type.enum.ts
 var form_access_type_enum = __webpack_require__(376);
+// EXTERNAL MODULE: ./projects/nestjs-form-builder/src/utils/computed-field.utils.ts
+var computed_field_utils = __webpack_require__(801);
 // EXTERNAL MODULE: ./projects/nestjs-form-builder/src/utils/permission.utils.ts
 var permission_utils = __webpack_require__(988);
 // EXTERNAL MODULE: ./projects/nestjs-form-builder/src/services/form-builder-config.service.ts
@@ -1721,17 +1737,24 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
 class FormService extends classes_.ApiService {
     cacheManager;
     utilsService;
     formBuilderConfig;
-    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider){
-        super(event_actions/* .FORM_BUILDER_EVENT_ENTITIES.FORM */.eF.FORM, cacheManager, utilsService, FormService.name, true, event_actions/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, formBuilderConfig.isCompanyFeatureEnabled() ? entities/* .FormWithCompany */.Wl : entities/* .Form */.lV), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig;
+    permissionResolver;
+    permissionCache;
+    constructor(cacheManager, utilsService, formBuilderConfig, dataSourceProvider, permissionResolver, permissionCache){
+        super(event_actions/* .FORM_BUILDER_EVENT_ENTITIES.FORM */.eF.FORM, cacheManager, utilsService, FormService.name, true, event_actions/* .FORM_BUILDER_EVENT_MODULE */.T$, dataSourceProvider, formBuilderConfig.isCompanyFeatureEnabled() ? entities/* .FormWithCompany */.Wl : entities/* .Form */.lV), this.cacheManager = cacheManager, this.utilsService = utilsService, this.formBuilderConfig = formBuilderConfig, this.permissionResolver = permissionResolver, this.permissionCache = permissionCache;
     }
     // Entity Conversion
     async convertSingleDtoToEntity(dto, user) {
         let form = {};
         let isUpdate = false;
+        if (dto.schema) {
+            this.assertValidComputedFields(dto.schema);
+        }
         // NOTE: Using 'id' in dto check instead of instanceof - instanceof may not work after esbuild bundling
         if ('id' in dto && dto.id && typeof dto.id === 'string') {
             const dbData = await this.repository.findOne({
@@ -1776,6 +1799,19 @@ class FormService extends classes_.ApiService {
         }
         return form;
     }
+    assertValidComputedFields(schema) {
+        const issue = (0,computed_field_utils/* .findComputedFieldIssue */.Qc)(schema);
+        if (!issue) return;
+        throw new common_.BadRequestException({
+            message: `Computed field "${issue.field}" is invalid (${issue.code}).`,
+            messageKey: message_keys/* .FORM_MESSAGES.INVALID_COMPUTED_FIELD */.Q.INVALID_COMPUTED_FIELD,
+            messageVariables: {
+                field: issue.field,
+                code: issue.code,
+                ...issue.variables
+            }
+        });
+    }
     async getSelectQuery(query, _user, select) {
         if (!select || !select.length) {
             select = [
@@ -1786,7 +1822,7 @@ class FormService extends classes_.ApiService {
                 'schema',
                 'schemaVersion',
                 'accessType',
-                'actionGroups',
+                'permissionLogic',
                 'tags',
                 'isActive',
                 'createdAt',
@@ -1856,7 +1892,7 @@ class FormService extends classes_.ApiService {
             schema: entity.schema,
             schemaVersion: entity.schemaVersion,
             accessType: entity.accessType,
-            actionGroups: entity.actionGroups,
+            permissionLogic: entity.permissionLogic,
             tags: entity.tags,
             isActive: entity.isActive,
             companyId: entityWithCompany.companyId ?? null,
@@ -1966,7 +2002,7 @@ class FormService extends classes_.ApiService {
                 'name',
                 'description',
                 'accessType',
-                'actionGroups',
+                'permissionLogic',
                 'isActive'
             ]
         });
@@ -1981,7 +2017,7 @@ class FormService extends classes_.ApiService {
             name: form.name,
             description: form.description,
             accessType: form.accessType,
-            actionGroups: form.actionGroups,
+            permissionLogic: form.permissionLogic,
             isActive: form.isActive
         };
     }
@@ -2014,10 +2050,12 @@ class FormService extends classes_.ApiService {
     }
     async getAuthenticatedForm(formId, user) {
         const form = await this.getFormForSubmission(formId, user);
-        // For action_group access, check permissions from cache
-        if (form.accessType === form_access_type_enum/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.actionGroups?.length) {
-            const hasPermission = await (0,permission_utils/* .validateUserPermissions */.i)(user, form.actionGroups, this.cacheManager, this.formBuilderConfig.isCompanyFeatureEnabled());
-            if (!hasPermission) {
+        if (form.accessType === form_access_type_enum/* .FormAccessType.ACTION_GROUP */.h.ACTION_GROUP && form.permissionLogic) {
+            const permitted = await (0,permission_utils/* .hasFormPermission */.E)(user, form.permissionLogic, {
+                resolver: this.permissionResolver,
+                cache: this.permissionCache
+            });
+            if (!permitted) {
                 throw new common_.ForbiddenException({
                     message: 'You do not have permission to access this form',
                     messageKey: message_keys/* .FORM_MESSAGES.ACCESS_DENIED */.Q.ACCESS_DENIED
@@ -2035,268 +2073,192 @@ FormService = _ts_decorate([
     _ts_param(1, (0,common_.Inject)(modules_.UtilsService)),
     _ts_param(2, (0,common_.Inject)(form_builder_config_service/* .FormBuilderConfigService */.j)),
     _ts_param(3, (0,common_.Inject)(form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._)),
+    _ts_param(4, (0,common_.Optional)()),
+    _ts_param(4, (0,common_.Inject)(interfaces_.PERMISSION_RESOLVER)),
+    _ts_param(5, (0,common_.Optional)()),
+    _ts_param(5, (0,common_.Inject)(modules_.SharedPermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof classes_.HybridCache === "undefined" ? Object : classes_.HybridCache,
         typeof modules_.UtilsService === "undefined" ? Object : modules_.UtilsService,
         typeof form_builder_config_service/* .FormBuilderConfigService */.j === "undefined" ? Object : form_builder_config_service/* .FormBuilderConfigService */.j,
-        typeof form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._
+        typeof form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._ === "undefined" ? Object : form_builder_datasource_provider/* .FormBuilderDataSourceProvider */._,
+        typeof IPermissionResolver === "undefined" ? Object : IPermissionResolver,
+        typeof modules_.SharedPermissionCacheService === "undefined" ? Object : modules_.SharedPermissionCacheService
     ])
 ], FormService);
 
 
 },
 801(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/**
- * Computed Field Calculation Utilities
- *
- * This module provides functions to calculate computed field values
- * based on form submission data and computed field definitions.
- *
- * NOTE: Interface definitions here mirror @flusys/ng-form-builder interfaces
- * but are defined separately to avoid cross-package dependencies.
- * Both use compatible JSON structures for form schema serialization.
- *
- * @see FLUSYS_NG/projects/ng-form-builder/interfaces/computed-field.interface.ts
- */ // ============================================================================
-// Type Definitions
-// ============================================================================
-// ============================================================================
-// Type Guards & Helpers
-// ============================================================================
-function isObject(value) {
-    return typeof value === 'object' && value !== null;
-}
-function isDirectValueConfig(config) {
-    return isObject(config) && config.type === 'direct' && 'value' in config;
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_0 = __webpack_require__(216);
+
+/** A field reference to an earlier computed field: `computed.<key>`. */ const COMPUTED_REF_PREFIX = 'computed.';
+const COMPUTED_KEY_PATTERN = /^[A-Za-z_]\w*$/;
+function asSchema(schema) {
+    return typeof schema === 'object' && schema !== null ? schema : {};
 }
-function isFieldReferenceConfig(config) {
-    return isObject(config) && config.type === 'field_reference' && 'fieldId' in config;
+function formFields(schema) {
+    return (schema.sections ?? []).flatMap((section)=>section.fields ?? []).filter((field)=>typeof field?.id === 'string');
 }
-function isArithmeticConfig(config) {
-    return isObject(config) && config.type === 'arithmetic' && 'operation' in config && 'operands' in config && Array.isArray(config.operands);
+/** References resolve by field id, by field name (what templates use), or `computed.<key>`. */ function createResolver(data, fields, computed) {
+    const idByName = new Map(fields.filter((f)=>f.name).map((f)=>[
+            f.name,
+            f.id
+        ]));
+    return (ref)=>{
+        if (ref.startsWith(COMPUTED_REF_PREFIX)) {
+            const key = ref.slice(COMPUTED_REF_PREFIX.length);
+            return Object.hasOwn(computed, key) ? computed[key] : undefined;
+        }
+        if (Object.hasOwn(data, ref)) return data[ref];
+        const id = idByName.get(ref);
+        return id !== undefined && Object.hasOwn(data, id) ? data[id] : undefined;
+    };
 }
-function isEmptyValue(value) {
-    return value === null || value === undefined || value === '' || Array.isArray(value) && value.length === 0;
+function castValue(value, valueType) {
+    if (value === null || value === undefined) return null;
+    switch(valueType){
+        case 'number':
+            try {
+                return (0,_flusys_nestjs_shared_utils__rspack_import_0.expressionToNumber)(value);
+            } catch  {
+                return null;
+            }
+        case 'boolean':
+            if (typeof value === 'boolean') return value;
+            return [
+                'true',
+                '1',
+                'yes'
+            ].includes(((0,_flusys_nestjs_shared_utils__rspack_import_0.expressionToText)(value) ?? '').trim().toLowerCase());
+        default:
+            return (0,_flusys_nestjs_shared_utils__rspack_import_0.expressionToText)(value);
+    }
 }
-/**
- * Normalize operator to uppercase string (handles both enum and string values)
- */ function normalizeOperator(op) {
-    const strOp = String(op).toUpperCase();
-    return strOp === 'OR' ? 'OR' : 'AND';
+function computeField(field, ctx) {
+    for (const rule of field.rules ?? []){
+        if (!rule.condition || (0,_flusys_nestjs_shared_utils__rspack_import_0.evaluateConditionGroup)(rule.condition, ctx)) return (0,_flusys_nestjs_shared_utils__rspack_import_0.evaluateExpression)(rule.value, ctx);
+    }
+    return field.defaultValue ?? null;
 }
 /**
- * Calculate all computed fields for a form submission
- *
- * @param formData - The submitted form data (field values by field ID)
- * @param computedFields - Array of computed field definitions from form settings
- * @returns Object containing computed field values keyed by their key property
- */ function calculateComputedFields(formData, computedFields) {
-    if (!computedFields || computedFields.length === 0) {
-        return {};
-    }
+ * Computed values for a submission, keyed by each computed field's `key`. Fields run in order,
+ * so a field may use earlier ones (`computed.<key>`); a field whose rules fail at run time gets
+ * its default value instead of failing the submission.
+ */ function calculateComputedFields(data, schema) {
+    const parsed = asSchema(schema);
+    const computedFields = parsed.settings?.computedFields ?? [];
     const result = {};
+    if (computedFields.length === 0) return result;
+    const ctx = {
+        resolveRef: createResolver(data, formFields(parsed), result)
+    };
     for (const field of computedFields){
+        let value;
         try {
-            const value = calculateComputedField(formData, field);
-            result[field.key] = value;
-        } catch (error) {
-            // If calculation fails, use default value or null
-            result[field.key] = field.defaultValue ?? null;
+            value = computeField(field, ctx);
+        } catch  {
+            value = field.defaultValue ?? null;
         }
+        result[field.key] = castValue(value, field.valueType);
     }
     return result;
 }
-/**
- * Calculate a single computed field value
- */ function calculateComputedField(formData, field) {
-    // Evaluate rules in order, first matching rule wins
-    for (const rule of field.rules){
-        if (evaluateCondition(formData, rule.condition)) {
-            return executeComputation(formData, rule.computation, field.valueType);
+/** First problem in the schema's computed fields, or null. Run on save so authors see it there, not at submit. */ function findComputedFieldIssue(schema) {
+    const parsed = asSchema(schema);
+    const computedFields = parsed.settings?.computedFields ?? [];
+    const fields = formFields(parsed);
+    const knownRefs = new Set(fields.flatMap((f)=>f.name ? [
+            f.id,
+            f.name
+        ] : [
+            f.id
+        ]));
+    const earlierKeys = new Set();
+    for (const field of computedFields){
+        const label = String(field?.name || field?.key || '');
+        if (typeof field?.key !== 'string' || !COMPUTED_KEY_PATTERN.test(field.key)) {
+            return {
+                field: label,
+                code: 'invalid_key',
+                variables: {
+                    key: String(field?.key ?? '')
+                }
+            };
         }
-    }
-    // No rule matched, return default
-    return field.defaultValue ?? null;
-}
-/**
- * Evaluate a condition group
- */ function evaluateCondition(formData, conditionGroup) {
-    // No condition = always true
-    if (!conditionGroup || !conditionGroup.conditions || conditionGroup.conditions.length === 0) {
-        return true;
-    }
-    const results = conditionGroup.conditions.map((condition)=>evaluateSingleCondition(formData, condition));
-    // Normalize operator to handle both string and enum values
-    const operator = normalizeOperator(conditionGroup.operator);
-    if (operator === 'AND') {
-        return results.every((r)=>r);
-    } else {
-        return results.some((r)=>r);
-    }
-}
-/**
- * Evaluate a single condition
- */ function evaluateSingleCondition(formData, condition) {
-    const fieldValue = formData[condition.fieldId];
-    const compareValue = condition.value;
-    switch(condition.comparison){
-        case 'equals':
-            return fieldValue === compareValue || String(fieldValue) === String(compareValue);
-        case 'not_equals':
-            return fieldValue !== compareValue && String(fieldValue) !== String(compareValue);
-        case 'is_empty':
-            return isEmptyValue(fieldValue);
-        case 'is_not_empty':
-            return !isEmptyValue(fieldValue);
-        case 'contains':
-            return String(fieldValue).includes(String(compareValue));
-        case 'not_contains':
-            return !String(fieldValue).includes(String(compareValue));
-        case 'starts_with':
-            return String(fieldValue).startsWith(String(compareValue));
-        case 'ends_with':
-            return String(fieldValue).endsWith(String(compareValue));
-        case 'greater_than':
-            return Number(fieldValue) > Number(compareValue);
-        case 'less_than':
-            return Number(fieldValue) < Number(compareValue);
-        case 'greater_or_equal':
-            return Number(fieldValue) >= Number(compareValue);
-        case 'less_or_equal':
-            return Number(fieldValue) <= Number(compareValue);
-        case 'is_before':
-            return new Date(String(fieldValue)) < new Date(String(compareValue));
-        case 'is_after':
-            return new Date(String(fieldValue)) > new Date(String(compareValue));
-        case 'is_checked':
-            return fieldValue === true || fieldValue === 'true' || fieldValue === 1;
-        case 'is_not_checked':
-            return fieldValue === false || fieldValue === 'false' || fieldValue === 0 || !fieldValue;
-        case 'is_any_of':
-        case 'in':
-            return Array.isArray(compareValue) && compareValue.includes(fieldValue);
-        case 'is_none_of':
-        case 'not_in':
-            return !Array.isArray(compareValue) || !compareValue.includes(fieldValue);
-        default:
-            return false;
-    }
-}
-/**
- * Execute a computation and return the result
- */ function executeComputation(formData, computation, valueType) {
-    const { config } = computation;
-    // Use type guards for safe access
-    if (computation.type === 'direct' && isDirectValueConfig(config)) {
-        return valueType === 'number' ? Number(config.value) : String(config.value);
-    }
-    if (computation.type === 'field_reference' && isFieldReferenceConfig(config)) {
-        const value = formData[config.fieldId];
-        if (value === null || value === undefined) {
-            return null;
+        if (earlierKeys.has(field.key)) return {
+            field: label,
+            code: 'duplicate_key',
+            variables: {
+                key: field.key
+            }
+        };
+        if (!Array.isArray(field.rules)) return {
+            field: label,
+            code: 'invalid_node',
+            variables: {
+                type: 'rules'
+            }
+        };
+        const isKnownRef = (ref)=>knownRefs.has(ref) || ref.startsWith(COMPUTED_REF_PREFIX) && earlierKeys.has(ref.slice(COMPUTED_REF_PREFIX.length));
+        try {
+            for (const rule of field.rules){
+                if (rule.condition) (0,_flusys_nestjs_shared_utils__rspack_import_0.assertValidConditionGroup)(rule.condition, {
+                    isKnownRef
+                });
+                (0,_flusys_nestjs_shared_utils__rspack_import_0.assertValidExpression)(rule.value, {
+                    isKnownRef
+                });
+            }
+        } catch (error) {
+            if ((0,_flusys_nestjs_shared_utils__rspack_import_0.isExpressionError)(error)) return {
+                field: label,
+                code: error.code,
+                variables: error.variables
+            };
+            throw error;
         }
-        return valueType === 'number' ? Number(value) : String(value);
+        earlierKeys.add(field.key);
     }
-    if (computation.type === 'arithmetic' && isArithmeticConfig(config)) {
-        return calculateArithmetic(formData, config);
-    }
-    // Unknown computation type
     return null;
 }
-/**
- * Perform arithmetic calculation
- */ function calculateArithmetic(formData, config) {
-    const values = config.operands.map((operand)=>{
-        if (operand.type === 'constant') {
-            return operand.value ?? 0;
-        } else {
-            const fieldValue = formData[operand.fieldId ?? ''];
-            return fieldValue !== null && fieldValue !== undefined ? Number(fieldValue) : 0;
-        }
-    });
-    if (values.length === 0) {
-        return null;
-    }
-    switch(config.operation){
-        case 'sum':
-        case 'increment':
-            return values.reduce((acc, val)=>acc + val, 0);
-        case 'subtract':
-        case 'decrement':
-            return values.reduce((acc, val, idx)=>idx === 0 ? val : acc - val, 0);
-        case 'multiply':
-            return values.reduce((acc, val)=>acc * val, 1);
-        case 'divide':
-            {
-                const [first, ...rest] = values;
-                return rest.reduce((acc, val)=>val !== 0 ? acc / val : acc, first);
-            }
-        case 'average':
-            return values.reduce((acc, val)=>acc + val, 0) / values.length;
-        case 'min':
-            return Math.min(...values);
-        case 'max':
-            return Math.max(...values);
-        default:
-            return null;
-    }
-}
 
 __webpack_require__.d(__webpack_exports__, {
-  X: () => (calculateComputedFields)
+  Qc: () => (findComputedFieldIssue),
+  XZ: () => (calculateComputedFields)
+}, {
+  xI: COMPUTED_REF_PREFIX
 });
 
 
 },
 988(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _config_index_js__rspack_import_1 = __webpack_require__(137);
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_0 = __webpack_require__(216);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(157);
+/* import */ var _config_index_js__rspack_import_2 = __webpack_require__(137);
 
 
-const CACHE_PREFIX = 'permissions';
-/**
- * Build permission cache key for a user
- * Uses same cache key format as PermissionGuard in nestjs-shared
- */ function buildPermissionCacheKey(user, enableCompanyFeature) {
-    if (enableCompanyFeature && user.companyId) {
-        return `${CACHE_PREFIX}:company:${user.companyId}:branch:${user.branchId || 'null'}:user:${user.id}`;
-    }
-    return `${CACHE_PREFIX}:user:${user.id}`;
-}
-/**
- * Get user permissions from cache
- * Fail-closed: if cache fails, deny access rather than allowing potentially unauthorized access
- */ async function getUserPermissionsFromCache(user, cacheManager, enableCompanyFeature) {
-    const cacheKey = buildPermissionCacheKey(user, enableCompanyFeature);
+
+/** Whether `user` passes a form's AND / OR permission rule; fails closed when permissions cannot be read. */ async function hasFormPermission(user, logic, sources) {
+    let granted;
     try {
-        const permissions = await cacheManager.get(cacheKey);
-        return permissions ?? [];
+        granted = await (0,_flusys_nestjs_shared_utils__rspack_import_0.loadPermissionCodes)({
+            userId: user.id,
+            companyId: user.companyId,
+            branchId: user.branchId
+        }, sources);
     } catch  {
-        throw new _nestjs_common__rspack_import_0.ForbiddenException({
+        throw new _nestjs_common__rspack_import_1.ForbiddenException({
             message: 'Unable to verify permissions. Please try again.',
-            messageKey: _config_index_js__rspack_import_1/* .FORM_MESSAGES.PERMISSION_CHECK_FAILED */.Q.PERMISSION_CHECK_FAILED
+            messageKey: _config_index_js__rspack_import_2/* .FORM_MESSAGES.PERMISSION_CHECK_FAILED */.Q.PERMISSION_CHECK_FAILED
         });
     }
-}
-/**
- * Validate user has at least one of the required permissions
- *
- * @param user - The logged-in user
- * @param requiredPermissions - Array of required permission strings (user needs at least one)
- * @param cacheManager - Cache manager instance
- * @param enableCompanyFeature - Whether company feature is enabled
- * @returns true if user has permission, false otherwise
- */ async function validateUserPermissions(user, requiredPermissions, cacheManager, enableCompanyFeature) {
-    if (!requiredPermissions.length) {
-        return true;
-    }
-    const userPermissions = await getUserPermissionsFromCache(user, cacheManager, enableCompanyFeature);
-    return requiredPermissions.some((perm)=>userPermissions.includes(perm));
+    return (0,_flusys_nestjs_shared_utils__rspack_import_0.evaluatePermissionLogic)(logic, granted).passed;
 }
 
 __webpack_require__.d(__webpack_exports__, {
-  i: () => (validateUserPermissions)
+  E: () => (hasFormPermission)
 });
 
 
@@ -2318,6 +2280,12 @@ module.exports = __rspack_external__flusys_nestjs_shared_decorators_c129b601;
 module.exports = __rspack_external__flusys_nestjs_shared_dtos_c4585026;
 
 
+},
+103(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_interfaces_413f2706;
+
+
 },
 236(module) {