@flusys/nestjs-iam 0.1.0-beta.1 → 0.1.0-beta.2

package/fesm/modules/iam.module.js

@@ -0,0 +1,227 @@
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+import { CacheModule, UtilsModule } from '@flusys/nestjs-shared/modules';
+import { Module, Scope } from '@nestjs/common';
+import { getRepositoryToken } from '@nestjs/typeorm';
+import { IAM_MODULE_OPTIONS } from '../config/iam.constants';
+import { ActionController, CompanyActionPermissionController, MyPermissionController, RoleController, RolePermissionController, UserActionPermissionController } from '../controllers';
+import { Action, Role, RoleWithCompany, UserIamPermission, UserIamPermissionWithCompany } from '../entities';
+import { IAMPermissionMode } from '../enums/permission-type.enum';
+import { PermissionEvaluatorHelper, PermissionModeHelper } from '../helpers';
+import { ActionService, PermissionService, RoleService } from '../services';
+import { IAMConfigService } from '../services/iam-config.service';
+import { IAMDataSourceProvider } from '../services/iam-datasource.provider';
+import { PermissionCacheService } from '../services/permission-cache.service';
+export class IAMModule {
+    static getControllers(permissionMode, enableCompanyFeature) {
+        const baseControllers = [
+            ActionController,
+            MyPermissionController
+        ];
+        // Direct permission mode - user actions only
+        if (permissionMode === IAMPermissionMode.DIRECT) {
+            baseControllers.push(UserActionPermissionController);
+        }
+        // RBAC mode - role actions and user roles only
+        if (permissionMode === IAMPermissionMode.RBAC) {
+            baseControllers.push(RoleController);
+            baseControllers.push(RolePermissionController);
+        }
+        // FULL mode - all permission controllers
+        if (permissionMode === IAMPermissionMode.FULL) {
+            baseControllers.push(RoleController);
+            baseControllers.push(UserActionPermissionController);
+            baseControllers.push(RolePermissionController);
+        }
+        // Company action permissions - only if company feature enabled
+        if (enableCompanyFeature) {
+            baseControllers.push(CompanyActionPermissionController);
+        }
+        return baseControllers;
+    }
+    static getEntities(permissionMode, enableCompanyFeature) {
+        // Core entities
+        const entities = [];
+        // Action entity - always included
+        entities.push(Action);
+        // Permission entity is always needed
+        if (enableCompanyFeature) {
+            entities.push(UserIamPermissionWithCompany);
+        } else {
+            entities.push(UserIamPermission);
+        }
+        // Role entity - Only for RBAC or FULL mode
+        if (permissionMode === IAMPermissionMode.RBAC || permissionMode === IAMPermissionMode.FULL) {
+            if (enableCompanyFeature) {
+                entities.push(RoleWithCompany);
+            } else {
+                entities.push(Role);
+            }
+        }
+        return entities;
+    }
+    static getServices(permissionMode) {
+        const services = [
+            ActionService,
+            PermissionService,
+            PermissionCacheService,
+            PermissionEvaluatorHelper
+        ];
+        // RoleService - Only for RBAC or FULL mode
+        if (permissionMode === IAMPermissionMode.RBAC || permissionMode === IAMPermissionMode.FULL) {
+            services.push(RoleService);
+        }
+        return services;
+    }
+    /**
+   * Create repository providers that use IAMDataSourceProvider
+   * This replaces TypeOrmModule.forFeature() functionality
+   */ static getRepositoryProviders(permissionMode, enableCompanyFeature) {
+        const entities = this.getEntities(permissionMode, enableCompanyFeature);
+        return entities.map((entity)=>({
+                provide: getRepositoryToken(entity),
+                scope: Scope.REQUEST,
+                useFactory: async (dataSourceProvider)=>{
+                    return await dataSourceProvider.getRepository(entity);
+                },
+                inject: [
+                    IAMDataSourceProvider
+                ]
+            }));
+    }
+    static forRoot(options = {}) {
+        const { global = false, includeController = false } = options;
+        const databaseMode = options.bootstrapAppConfig?.databaseMode;
+        const enableCompanyFeature = options.bootstrapAppConfig?.enableCompanyFeature ?? false;
+        // Read permissionMode from bootstrap config using helper
+        const permissionMode = PermissionModeHelper.fromString(options.bootstrapAppConfig?.permissionMode);
+        const isMultiTenant = databaseMode === 'multi-tenant';
+        const entities = this.getEntities(permissionMode, enableCompanyFeature);
+        const controllers = includeController ? this.getControllers(permissionMode, enableCompanyFeature) : [];
+        const providers = [
+            {
+                provide: IAM_MODULE_OPTIONS,
+                useValue: options
+            },
+            IAMConfigService,
+            IAMDataSourceProvider,
+            ...this.getServices(permissionMode)
+        ];
+        const imports = [
+            CacheModule,
+            UtilsModule
+        ];
+        const module = {
+            module: IAMModule,
+            imports,
+            controllers,
+            providers,
+            exports: [
+                IAMConfigService,
+                IAMDataSourceProvider,
+                ActionService,
+                PermissionService,
+                PermissionCacheService,
+                PermissionEvaluatorHelper,
+                ...permissionMode === IAMPermissionMode.RBAC || permissionMode === IAMPermissionMode.FULL ? [
+                    RoleService
+                ] : []
+            ]
+        };
+        if (global) {
+            return {
+                ...module,
+                global: true
+            };
+        }
+        return module;
+    }
+    static forRootAsync(asyncOptions) {
+        const { global = false, includeController = false, imports: externalImports = [] } = asyncOptions;
+        const databaseMode = asyncOptions.bootstrapAppConfig?.databaseMode;
+        const enableCompanyFeature = asyncOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
+        // Read permissionMode from bootstrap config using helper
+        const permissionMode = PermissionModeHelper.fromString(asyncOptions.bootstrapAppConfig?.permissionMode);
+        const isMultiTenant = databaseMode === 'multi-tenant';
+        const entities = this.getEntities(permissionMode, enableCompanyFeature);
+        const controllers = includeController ? this.getControllers(permissionMode, enableCompanyFeature) : [];
+        const asyncProviders = this.createAsyncProviders(asyncOptions);
+        const providers = [
+            ...asyncProviders,
+            IAMConfigService,
+            IAMDataSourceProvider,
+            ...this.getServices(permissionMode)
+        ];
+        const imports = [
+            ...externalImports,
+            CacheModule,
+            UtilsModule
+        ];
+        const module = {
+            module: IAMModule,
+            imports,
+            controllers,
+            providers,
+            exports: [
+                IAMConfigService,
+                IAMDataSourceProvider,
+                ActionService,
+                PermissionService,
+                PermissionCacheService,
+                PermissionEvaluatorHelper,
+                ...permissionMode === IAMPermissionMode.RBAC || permissionMode === IAMPermissionMode.FULL ? [
+                    RoleService
+                ] : []
+            ]
+        };
+        if (global) {
+            return {
+                ...module,
+                global: true
+            };
+        }
+        return module;
+    }
+    static createAsyncProviders(options) {
+        if (options.useExisting || options.useFactory) {
+            return [
+                this.createAsyncOptionsProvider(options)
+            ];
+        }
+        const useClass = options.useClass;
+        return [
+            this.createAsyncOptionsProvider(options),
+            {
+                provide: useClass,
+                useClass
+            }
+        ];
+    }
+    static createAsyncOptionsProvider(options) {
+        if (options.useFactory) {
+            return {
+                provide: IAM_MODULE_OPTIONS,
+                useFactory: options.useFactory,
+                inject: options.inject || []
+            };
+        }
+        const inject = [
+            options.useClass || options.useExisting
+        ];
+        return {
+            provide: IAM_MODULE_OPTIONS,
+            useFactory: async (optionsFactory)=>optionsFactory.createIAMOptions(),
+            inject
+        };
+    }
+    static forFeature(options = {}) {
+        return this.forRoot(options);
+    }
+}
+IAMModule = _ts_decorate([
+    Module({})
+], IAMModule);

package/fesm/modules/index.js

@@ -0,0 +1 @@
+export * from './iam.module';

package/fesm/services/action.service.js

@@ -0,0 +1,243 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+import { RequestScopedApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { Inject, Injectable, Logger, NotFoundException, Scope } from '@nestjs/common';
+import { In } from 'typeorm';
+import { Action } from '../entities/action.entity';
+import { IAMConfigService } from './iam-config.service';
+import { IAMDataSourceProvider } from './iam-datasource.provider';
+import { PermissionService } from './permission.service';
+export class ActionService extends RequestScopedApiService {
+    /**
+   * Resolve entity class for this service
+   * @returns Action entity class
+   */ resolveEntity() {
+        return Action;
+    }
+    /**
+   * Get DataSource provider for this service
+   * @returns IAMDataSourceProvider instance
+   */ getDataSourceProvider() {
+        return this.dataSourceProvider;
+    }
+    // ==================== Entity Conversion ====================
+    async convertSingleDtoToEntity(dto, _user) {
+        if (!('id' in dto) || !dto.id) {
+            return dto;
+        }
+        const existingAction = await this.repository.findOne({
+            where: {
+                id: dto.id
+            }
+        });
+        if (!existingAction) {
+            throw new NotFoundException(`Action with ID ${dto.id} not found`);
+        }
+        return {
+            ...existingAction,
+            ...dto
+        };
+    }
+    async getSelectQuery(query, _user, select) {
+        if (!select || !select.length) {
+            select = [
+                'id',
+                'name',
+                'code',
+                'description',
+                'actionType',
+                'permissionLogic',
+                'isActive',
+                'parentId',
+                'serial',
+                'createdAt'
+            ];
+        }
+        const selectFields = select.map((field)=>`${this.entityName}.${field}`);
+        query.select(selectFields);
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getGlobalSearchQuery(query, search, _user) {
+        query.andWhere('(action.name LIKE :search OR action.code LIKE :search OR action.description LIKE :search)', {
+            search: `%${search}%`
+        });
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    /**
+   * Override: Convert entity to response DTO
+   */ convertEntityToResponseDto(entity, _isRaw) {
+        return {
+            id: entity.id,
+            readOnly: entity.readOnly,
+            name: entity.name,
+            description: entity.description,
+            code: entity.code,
+            actionType: entity.actionType,
+            permissionLogic: entity.permissionLogic,
+            serial: entity.serial,
+            isActive: entity.isActive,
+            parentId: entity.parentId,
+            metadata: entity.metadata,
+            createdAt: entity.createdAt,
+            updatedAt: entity.updatedAt,
+            deletedAt: entity.deletedAt,
+            createdById: entity.createdById,
+            updatedById: entity.updatedById,
+            deletedById: entity.deletedById
+        };
+    }
+    /**
+   * Get actions available for permission assignment (filtered by company whitelist)
+   *
+   * @param user - Logged in user info
+   * @returns Array of actions with id, code, and name fields
+   */ async getActionsForPermission(user) {
+        await this.ensureRepositoryInitialized();
+        if (!user) {
+            throw new Error('User is required for getActionsForPermission');
+        }
+        const selectFields = [
+            'id',
+            'code',
+            'name',
+            'description',
+            'actionType',
+            'permissionLogic',
+            'isActive',
+            'parentId',
+            'serial'
+        ];
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        if (enableCompanyFeature && user.companyId) {
+            const companyActionIds = await this.permissionService.getCompanyActionIds(user.companyId);
+            if (companyActionIds.length === 0) {
+                return [];
+            }
+            const actions = await this.repository.find({
+                where: {
+                    id: In(companyActionIds)
+                },
+                select: selectFields
+            });
+            return actions.map((action)=>this.convertEntityToResponseDto(action, false));
+        }
+        const actions = await this.repository.find({
+            select: selectFields
+        });
+        return actions.map((action)=>this.convertEntityToResponseDto(action, false));
+    }
+    /**
+   * Get actions in hierarchical tree structure
+   *
+   * @param user - Logged in user info for company filtering
+   * @param search - Optional search term (name or code)
+   * @param isActive - Optional filter by active status
+   * @param withDeleted - Include deleted actions (default: false)
+   * @returns Array of root actions with nested children
+   */ async getActionTree(user, search, isActive, withDeleted = false) {
+        await this.ensureRepositoryInitialized();
+        if (!user) {
+            throw new Error('User is required for getActionTree');
+        }
+        const query = this.repository.createQueryBuilder('action');
+        if (!withDeleted) {
+            query.andWhere('action.deletedAt IS NULL');
+        }
+        if (isActive !== undefined) {
+            query.andWhere('action.isActive = :isActive', {
+                isActive
+            });
+        }
+        if (search?.trim()) {
+            query.andWhere('(action.name LIKE :search OR action.code LIKE :search)', {
+                search: `%${search.trim()}%`
+            });
+        }
+        const actions = await query.orderBy('action.serial', 'ASC').getMany();
+        return this.buildActionTree(actions);
+    }
+    buildActionTree(actions) {
+        if (!actions?.length) {
+            return [];
+        }
+        const map = new Map();
+        const rootNodes = [];
+        for (const action of actions){
+            const treeNode = {
+                ...this.convertEntityToResponseDto(action, false),
+                children: []
+            };
+            map.set(action.id, treeNode);
+        }
+        for (const action of actions){
+            const node = map.get(action.id);
+            if (!node) {
+                continue;
+            }
+            if (action.parentId && map.has(action.parentId)) {
+                const parent = map.get(action.parentId);
+                if (parent?.children) {
+                    parent.children.push(node);
+                }
+            } else {
+                rootNodes.push(node);
+            }
+        }
+        return rootNodes;
+    }
+    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService){
+        // Repository will be set asynchronously by RequestScopedApiService
+        super('action', null, cacheManager, utilsService, ActionService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "permissionService", void 0), _define_property(this, "logger", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.dataSourceProvider = dataSourceProvider, this.permissionService = permissionService, this.logger = new Logger(ActionService.name);
+    }
+}
+ActionService = _ts_decorate([
+    Injectable({
+        scope: Scope.REQUEST
+    }),
+    _ts_param(0, Inject('CACHE_INSTANCE')),
+    _ts_param(1, Inject(UtilsService)),
+    _ts_param(2, Inject(IAMConfigService)),
+    _ts_param(3, Inject(IAMDataSourceProvider)),
+    _ts_param(4, Inject(PermissionService)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof HybridCache === "undefined" ? Object : HybridCache,
+        typeof UtilsService === "undefined" ? Object : UtilsService,
+        typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
+        typeof IAMDataSourceProvider === "undefined" ? Object : IAMDataSourceProvider,
+        typeof PermissionService === "undefined" ? Object : PermissionService
+    ])
+], ActionService);

package/fesm/services/iam-config.service.js

@@ -0,0 +1,97 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+import { Inject, Injectable, Optional } from '@nestjs/common';
+import { IAM_MODULE_OPTIONS } from '../config/iam.constants';
+import { IAMPermissionMode } from '../enums/permission-type.enum';
+import { PermissionModeHelper } from '../helpers';
+import { IAMModuleOptions } from '../interfaces/iam-module-options.interface';
+export class IAMConfigService {
+    // ==================== Database Mode ====================
+    /**
+   * Get database mode (single or multi-tenant)
+   */ getDatabaseMode() {
+        return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
+    }
+    /**
+   * Check if running in multi-tenant mode
+   */ isMultiTenant() {
+        return this.getDatabaseMode() === 'multi-tenant';
+    }
+    // ==================== Company Feature ====================
+    /**
+   * Get enable company feature flag
+   */ getEnableCompanyFeature() {
+        return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
+    }
+    /**
+   * Check if company feature is enabled (alias for getEnableCompanyFeature)
+   */ isCompanyFeatureEnabled() {
+        return this.getEnableCompanyFeature();
+    }
+    // ==================== Permission Mode ====================
+    /**
+   * Get permission mode from bootstrap config
+   *
+   * **Note:** Reads from bootstrapAppConfig (not runtime config)
+   * because permissionMode affects entity/controller registration.
+   */ getPermissionMode() {
+        return PermissionModeHelper.fromString(this.options.bootstrapAppConfig?.permissionMode);
+    }
+    /**
+   * Check if RBAC (role-based) permissions are enabled
+   */ isRbacEnabled() {
+        const mode = this.getPermissionMode();
+        return mode === IAMPermissionMode.RBAC || mode === IAMPermissionMode.FULL;
+    }
+    /**
+   * Check if direct (user-level) permissions are enabled
+   */ isDirectPermissionEnabled() {
+        const mode = this.getPermissionMode();
+        return mode === IAMPermissionMode.DIRECT || mode === IAMPermissionMode.FULL;
+    }
+    // ==================== Options ====================
+    getOptions() {
+        return this.options;
+    }
+    constructor(injectedOptions){
+        _define_property(this, "options", void 0);
+        this.options = injectedOptions ?? {
+            global: false,
+            includeController: false
+        };
+    }
+}
+IAMConfigService = _ts_decorate([
+    Injectable(),
+    _ts_param(0, Optional()),
+    _ts_param(0, Inject(IAM_MODULE_OPTIONS)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof IAMModuleOptions === "undefined" ? Object : IAMModuleOptions
+    ])
+], IAMConfigService);