@flusys/nestjs-iam 1.0.0-rc → 2.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +219 -118
- package/cjs/controllers/company-action-permission.controller.js +2 -17
- package/cjs/controllers/my-permission.controller.js +1 -2
- package/cjs/controllers/role-permission.controller.js +3 -9
- package/cjs/controllers/user-action-permission.controller.js +3 -9
- package/cjs/dtos/action.dto.js +0 -27
- package/cjs/dtos/permission.dto.js +81 -27
- package/cjs/dtos/role.dto.js +0 -27
- package/cjs/helpers/company-access.helper.js +19 -0
- package/cjs/helpers/index.js +1 -1
- package/cjs/interfaces/iam-module-options.interface.js +0 -14
- package/cjs/interfaces/index.js +0 -1
- package/cjs/modules/iam.module.js +38 -106
- package/cjs/services/action.service.js +30 -41
- package/cjs/services/iam-config.service.js +2 -5
- package/cjs/services/{iam-datasource.provider.js → iam-datasource.service.js} +33 -36
- package/cjs/services/index.js +1 -1
- package/cjs/services/permission-cache.service.js +6 -46
- package/cjs/services/permission.service.js +52 -41
- package/cjs/services/role.service.js +3 -3
- package/controllers/company-action-permission.controller.d.ts +2 -5
- package/controllers/role-permission.controller.d.ts +0 -1
- package/controllers/user-action-permission.controller.d.ts +0 -1
- package/dtos/action.dto.d.ts +0 -4
- package/dtos/role.dto.d.ts +0 -4
- package/fesm/controllers/company-action-permission.controller.js +4 -19
- package/fesm/controllers/my-permission.controller.js +1 -2
- package/fesm/controllers/role-permission.controller.js +4 -10
- package/fesm/controllers/user-action-permission.controller.js +4 -10
- package/fesm/dtos/action.dto.js +0 -24
- package/fesm/dtos/permission.dto.js +81 -27
- package/fesm/dtos/role.dto.js +0 -24
- package/fesm/helpers/company-access.helper.js +14 -0
- package/fesm/helpers/index.js +1 -1
- package/fesm/interfaces/iam-module-options.interface.js +3 -1
- package/fesm/interfaces/index.js +0 -1
- package/fesm/modules/iam.module.js +40 -108
- package/fesm/services/action.service.js +31 -42
- package/fesm/services/iam-config.service.js +2 -5
- package/fesm/services/{iam-datasource.provider.js → iam-datasource.service.js} +31 -34
- package/fesm/services/index.js +1 -1
- package/fesm/services/permission-cache.service.js +6 -46
- package/fesm/services/permission.service.js +53 -42
- package/fesm/services/role.service.js +3 -3
- package/helpers/company-access.helper.d.ts +3 -0
- package/helpers/index.d.ts +1 -1
- package/interfaces/iam-module-options.interface.d.ts +9 -1
- package/interfaces/index.d.ts +0 -1
- package/modules/iam.module.d.ts +1 -2
- package/package.json +3 -3
- package/services/action.service.d.ts +6 -4
- package/services/iam-config.service.d.ts +0 -1
- package/services/{iam-datasource.provider.d.ts → iam-datasource.service.d.ts} +4 -5
- package/services/index.d.ts +1 -1
- package/services/permission-cache.service.d.ts +1 -4
- package/services/permission.service.d.ts +4 -2
- package/services/role.service.d.ts +3 -3
- package/cjs/helpers/permission-evaluator.helper.js +0 -175
- package/cjs/interfaces/iam-module-async-options.interface.js +0 -4
- package/fesm/helpers/permission-evaluator.helper.js +0 -165
- package/fesm/interfaces/iam-module-async-options.interface.js +0 -3
- package/helpers/permission-evaluator.helper.d.ts +0 -26
- package/interfaces/iam-module-async-options.interface.d.ts +0 -11
|
@@ -356,31 +356,45 @@ let UserActionResponseDto = class UserActionResponseDto {
|
|
|
356
356
|
}
|
|
357
357
|
};
|
|
358
358
|
_ts_decorate([
|
|
359
|
-
(0, _swagger.ApiProperty)(
|
|
359
|
+
(0, _swagger.ApiProperty)({
|
|
360
|
+
description: 'Permission ID'
|
|
361
|
+
}),
|
|
360
362
|
_ts_metadata("design:type", String)
|
|
361
363
|
], UserActionResponseDto.prototype, "id", void 0);
|
|
362
364
|
_ts_decorate([
|
|
363
|
-
(0, _swagger.ApiProperty)(
|
|
365
|
+
(0, _swagger.ApiProperty)({
|
|
366
|
+
description: 'User ID'
|
|
367
|
+
}),
|
|
364
368
|
_ts_metadata("design:type", String)
|
|
365
369
|
], UserActionResponseDto.prototype, "userId", void 0);
|
|
366
370
|
_ts_decorate([
|
|
367
|
-
(0, _swagger.ApiProperty)(
|
|
371
|
+
(0, _swagger.ApiProperty)({
|
|
372
|
+
description: 'Action ID'
|
|
373
|
+
}),
|
|
368
374
|
_ts_metadata("design:type", String)
|
|
369
375
|
], UserActionResponseDto.prototype, "actionId", void 0);
|
|
370
376
|
_ts_decorate([
|
|
371
|
-
(0, _swagger.ApiProperty)(
|
|
377
|
+
(0, _swagger.ApiProperty)({
|
|
378
|
+
description: 'Action code'
|
|
379
|
+
}),
|
|
372
380
|
_ts_metadata("design:type", String)
|
|
373
381
|
], UserActionResponseDto.prototype, "actionCode", void 0);
|
|
374
382
|
_ts_decorate([
|
|
375
|
-
(0, _swagger.ApiProperty)(
|
|
383
|
+
(0, _swagger.ApiProperty)({
|
|
384
|
+
description: 'Action name'
|
|
385
|
+
}),
|
|
376
386
|
_ts_metadata("design:type", String)
|
|
377
387
|
], UserActionResponseDto.prototype, "actionName", void 0);
|
|
378
388
|
_ts_decorate([
|
|
379
|
-
(0, _swagger.ApiPropertyOptional)(
|
|
389
|
+
(0, _swagger.ApiPropertyOptional)({
|
|
390
|
+
description: 'Branch ID (null = company-wide)'
|
|
391
|
+
}),
|
|
380
392
|
_ts_metadata("design:type", Object)
|
|
381
393
|
], UserActionResponseDto.prototype, "branchId", void 0);
|
|
382
394
|
_ts_decorate([
|
|
383
|
-
(0, _swagger.ApiProperty)(
|
|
395
|
+
(0, _swagger.ApiProperty)({
|
|
396
|
+
description: 'When this permission was created'
|
|
397
|
+
}),
|
|
384
398
|
_ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
|
|
385
399
|
], UserActionResponseDto.prototype, "createdAt", void 0);
|
|
386
400
|
let RoleActionResponseDto = class RoleActionResponseDto {
|
|
@@ -394,27 +408,39 @@ let RoleActionResponseDto = class RoleActionResponseDto {
|
|
|
394
408
|
}
|
|
395
409
|
};
|
|
396
410
|
_ts_decorate([
|
|
397
|
-
(0, _swagger.ApiProperty)(
|
|
411
|
+
(0, _swagger.ApiProperty)({
|
|
412
|
+
description: 'Permission ID'
|
|
413
|
+
}),
|
|
398
414
|
_ts_metadata("design:type", String)
|
|
399
415
|
], RoleActionResponseDto.prototype, "id", void 0);
|
|
400
416
|
_ts_decorate([
|
|
401
|
-
(0, _swagger.ApiProperty)(
|
|
417
|
+
(0, _swagger.ApiProperty)({
|
|
418
|
+
description: 'Role ID'
|
|
419
|
+
}),
|
|
402
420
|
_ts_metadata("design:type", String)
|
|
403
421
|
], RoleActionResponseDto.prototype, "roleId", void 0);
|
|
404
422
|
_ts_decorate([
|
|
405
|
-
(0, _swagger.ApiProperty)(
|
|
423
|
+
(0, _swagger.ApiProperty)({
|
|
424
|
+
description: 'Action ID'
|
|
425
|
+
}),
|
|
406
426
|
_ts_metadata("design:type", String)
|
|
407
427
|
], RoleActionResponseDto.prototype, "actionId", void 0);
|
|
408
428
|
_ts_decorate([
|
|
409
|
-
(0, _swagger.ApiProperty)(
|
|
429
|
+
(0, _swagger.ApiProperty)({
|
|
430
|
+
description: 'Action code'
|
|
431
|
+
}),
|
|
410
432
|
_ts_metadata("design:type", String)
|
|
411
433
|
], RoleActionResponseDto.prototype, "actionCode", void 0);
|
|
412
434
|
_ts_decorate([
|
|
413
|
-
(0, _swagger.ApiProperty)(
|
|
435
|
+
(0, _swagger.ApiProperty)({
|
|
436
|
+
description: 'Action name'
|
|
437
|
+
}),
|
|
414
438
|
_ts_metadata("design:type", String)
|
|
415
439
|
], RoleActionResponseDto.prototype, "actionName", void 0);
|
|
416
440
|
_ts_decorate([
|
|
417
|
-
(0, _swagger.ApiProperty)(
|
|
441
|
+
(0, _swagger.ApiProperty)({
|
|
442
|
+
description: 'When this permission was created'
|
|
443
|
+
}),
|
|
418
444
|
_ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
|
|
419
445
|
], RoleActionResponseDto.prototype, "createdAt", void 0);
|
|
420
446
|
let CompanyActionResponseDto = class CompanyActionResponseDto {
|
|
@@ -474,27 +500,39 @@ let UserRoleResponseDto = class UserRoleResponseDto {
|
|
|
474
500
|
}
|
|
475
501
|
};
|
|
476
502
|
_ts_decorate([
|
|
477
|
-
(0, _swagger.ApiProperty)(
|
|
503
|
+
(0, _swagger.ApiProperty)({
|
|
504
|
+
description: 'Permission ID'
|
|
505
|
+
}),
|
|
478
506
|
_ts_metadata("design:type", String)
|
|
479
507
|
], UserRoleResponseDto.prototype, "id", void 0);
|
|
480
508
|
_ts_decorate([
|
|
481
|
-
(0, _swagger.ApiProperty)(
|
|
509
|
+
(0, _swagger.ApiProperty)({
|
|
510
|
+
description: 'User ID'
|
|
511
|
+
}),
|
|
482
512
|
_ts_metadata("design:type", String)
|
|
483
513
|
], UserRoleResponseDto.prototype, "userId", void 0);
|
|
484
514
|
_ts_decorate([
|
|
485
|
-
(0, _swagger.ApiProperty)(
|
|
515
|
+
(0, _swagger.ApiProperty)({
|
|
516
|
+
description: 'Role ID'
|
|
517
|
+
}),
|
|
486
518
|
_ts_metadata("design:type", String)
|
|
487
519
|
], UserRoleResponseDto.prototype, "roleId", void 0);
|
|
488
520
|
_ts_decorate([
|
|
489
|
-
(0, _swagger.ApiProperty)(
|
|
521
|
+
(0, _swagger.ApiProperty)({
|
|
522
|
+
description: 'Role name'
|
|
523
|
+
}),
|
|
490
524
|
_ts_metadata("design:type", String)
|
|
491
525
|
], UserRoleResponseDto.prototype, "roleName", void 0);
|
|
492
526
|
_ts_decorate([
|
|
493
|
-
(0, _swagger.ApiPropertyOptional)(
|
|
527
|
+
(0, _swagger.ApiPropertyOptional)({
|
|
528
|
+
description: 'Branch ID (null = company-wide)'
|
|
529
|
+
}),
|
|
494
530
|
_ts_metadata("design:type", Object)
|
|
495
531
|
], UserRoleResponseDto.prototype, "branchId", void 0);
|
|
496
532
|
_ts_decorate([
|
|
497
|
-
(0, _swagger.ApiProperty)(
|
|
533
|
+
(0, _swagger.ApiProperty)({
|
|
534
|
+
description: 'When this permission was created'
|
|
535
|
+
}),
|
|
498
536
|
_ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
|
|
499
537
|
], UserRoleResponseDto.prototype, "createdAt", void 0);
|
|
500
538
|
let FrontendActionDto = class FrontendActionDto {
|
|
@@ -506,19 +544,27 @@ let FrontendActionDto = class FrontendActionDto {
|
|
|
506
544
|
}
|
|
507
545
|
};
|
|
508
546
|
_ts_decorate([
|
|
509
|
-
(0, _swagger.ApiProperty)(
|
|
547
|
+
(0, _swagger.ApiProperty)({
|
|
548
|
+
description: 'Action ID'
|
|
549
|
+
}),
|
|
510
550
|
_ts_metadata("design:type", String)
|
|
511
551
|
], FrontendActionDto.prototype, "id", void 0);
|
|
512
552
|
_ts_decorate([
|
|
513
|
-
(0, _swagger.ApiProperty)(
|
|
553
|
+
(0, _swagger.ApiProperty)({
|
|
554
|
+
description: 'Action code'
|
|
555
|
+
}),
|
|
514
556
|
_ts_metadata("design:type", String)
|
|
515
557
|
], FrontendActionDto.prototype, "code", void 0);
|
|
516
558
|
_ts_decorate([
|
|
517
|
-
(0, _swagger.ApiProperty)(
|
|
559
|
+
(0, _swagger.ApiProperty)({
|
|
560
|
+
description: 'Action name'
|
|
561
|
+
}),
|
|
518
562
|
_ts_metadata("design:type", String)
|
|
519
563
|
], FrontendActionDto.prototype, "name", void 0);
|
|
520
564
|
_ts_decorate([
|
|
521
|
-
(0, _swagger.ApiPropertyOptional)(
|
|
565
|
+
(0, _swagger.ApiPropertyOptional)({
|
|
566
|
+
description: 'Action description'
|
|
567
|
+
}),
|
|
522
568
|
_ts_metadata("design:type", Object)
|
|
523
569
|
], FrontendActionDto.prototype, "description", void 0);
|
|
524
570
|
let MyPermissionsQueryDto = class MyPermissionsQueryDto {
|
|
@@ -573,18 +619,26 @@ let PermissionOperationResultDto = class PermissionOperationResultDto {
|
|
|
573
619
|
}
|
|
574
620
|
};
|
|
575
621
|
_ts_decorate([
|
|
576
|
-
(0, _swagger.ApiProperty)(
|
|
622
|
+
(0, _swagger.ApiProperty)({
|
|
623
|
+
description: 'Whether the operation succeeded'
|
|
624
|
+
}),
|
|
577
625
|
_ts_metadata("design:type", Boolean)
|
|
578
626
|
], PermissionOperationResultDto.prototype, "success", void 0);
|
|
579
627
|
_ts_decorate([
|
|
580
|
-
(0, _swagger.ApiProperty)(
|
|
628
|
+
(0, _swagger.ApiProperty)({
|
|
629
|
+
description: 'Number of permissions added'
|
|
630
|
+
}),
|
|
581
631
|
_ts_metadata("design:type", Number)
|
|
582
632
|
], PermissionOperationResultDto.prototype, "added", void 0);
|
|
583
633
|
_ts_decorate([
|
|
584
|
-
(0, _swagger.ApiProperty)(
|
|
634
|
+
(0, _swagger.ApiProperty)({
|
|
635
|
+
description: 'Number of permissions removed'
|
|
636
|
+
}),
|
|
585
637
|
_ts_metadata("design:type", Number)
|
|
586
638
|
], PermissionOperationResultDto.prototype, "removed", void 0);
|
|
587
639
|
_ts_decorate([
|
|
588
|
-
(0, _swagger.ApiProperty)(
|
|
640
|
+
(0, _swagger.ApiProperty)({
|
|
641
|
+
description: 'Operation result message'
|
|
642
|
+
}),
|
|
589
643
|
_ts_metadata("design:type", String)
|
|
590
644
|
], PermissionOperationResultDto.prototype, "message", void 0);
|
package/cjs/dtos/role.dto.js
CHANGED
|
@@ -12,9 +12,6 @@ _export(exports, {
|
|
|
12
12
|
get CreateRoleDto () {
|
|
13
13
|
return CreateRoleDto;
|
|
14
14
|
},
|
|
15
|
-
get RoleQueryDto () {
|
|
16
|
-
return RoleQueryDto;
|
|
17
|
-
},
|
|
18
15
|
get RoleResponseDto () {
|
|
19
16
|
return RoleResponseDto;
|
|
20
17
|
},
|
|
@@ -128,30 +125,6 @@ _ts_decorate([
|
|
|
128
125
|
(0, _classvalidator.IsNotEmpty)(),
|
|
129
126
|
_ts_metadata("design:type", String)
|
|
130
127
|
], UpdateRoleDto.prototype, "id", void 0);
|
|
131
|
-
let RoleQueryDto = class RoleQueryDto {
|
|
132
|
-
constructor(){
|
|
133
|
-
_define_property(this, "companyId", void 0);
|
|
134
|
-
_define_property(this, "isActive", void 0);
|
|
135
|
-
}
|
|
136
|
-
};
|
|
137
|
-
_ts_decorate([
|
|
138
|
-
(0, _swagger.ApiProperty)({
|
|
139
|
-
description: 'Filter by company ID - Only available when company feature is enabled',
|
|
140
|
-
required: false
|
|
141
|
-
}),
|
|
142
|
-
(0, _classvalidator.IsUUID)(),
|
|
143
|
-
(0, _classvalidator.IsOptional)(),
|
|
144
|
-
_ts_metadata("design:type", String)
|
|
145
|
-
], RoleQueryDto.prototype, "companyId", void 0);
|
|
146
|
-
_ts_decorate([
|
|
147
|
-
(0, _swagger.ApiProperty)({
|
|
148
|
-
description: 'Filter by active status',
|
|
149
|
-
required: false
|
|
150
|
-
}),
|
|
151
|
-
(0, _classvalidator.IsBoolean)(),
|
|
152
|
-
(0, _classvalidator.IsOptional)(),
|
|
153
|
-
_ts_metadata("design:type", Boolean)
|
|
154
|
-
], RoleQueryDto.prototype, "isActive", void 0);
|
|
155
128
|
let RoleResponseDto = class RoleResponseDto {
|
|
156
129
|
constructor(){
|
|
157
130
|
_define_property(this, "id", void 0);
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
Object.defineProperty(exports, "__esModule", {
|
|
3
|
+
value: true
|
|
4
|
+
});
|
|
5
|
+
Object.defineProperty(exports, "validateCompanyAccess", {
|
|
6
|
+
enumerable: true,
|
|
7
|
+
get: function() {
|
|
8
|
+
return validateCompanyAccess;
|
|
9
|
+
}
|
|
10
|
+
});
|
|
11
|
+
const _common = require("@nestjs/common");
|
|
12
|
+
function validateCompanyAccess(config, companyId, user, errorMessage = 'You do not have access to this company') {
|
|
13
|
+
if (!config.isCompanyFeatureEnabled() || !companyId) {
|
|
14
|
+
return;
|
|
15
|
+
}
|
|
16
|
+
if (user.companyId !== companyId) {
|
|
17
|
+
throw new _common.ForbiddenException(errorMessage);
|
|
18
|
+
}
|
|
19
|
+
}
|
package/cjs/helpers/index.js
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", {
|
|
3
3
|
value: true
|
|
4
4
|
});
|
|
5
|
-
_export_star(require("./
|
|
5
|
+
_export_star(require("./company-access.helper"), exports);
|
|
6
6
|
_export_star(require("./permission-mode.helper"), exports);
|
|
7
7
|
function _export_star(from, to) {
|
|
8
8
|
Object.keys(from).forEach(function(k) {
|
|
@@ -2,17 +2,3 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", {
|
|
3
3
|
value: true
|
|
4
4
|
});
|
|
5
|
-
_export_star(require("./iam-module-async-options.interface"), exports);
|
|
6
|
-
function _export_star(from, to) {
|
|
7
|
-
Object.keys(from).forEach(function(k) {
|
|
8
|
-
if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {
|
|
9
|
-
Object.defineProperty(to, k, {
|
|
10
|
-
enumerable: true,
|
|
11
|
-
get: function() {
|
|
12
|
-
return from[k];
|
|
13
|
-
}
|
|
14
|
-
});
|
|
15
|
-
}
|
|
16
|
-
});
|
|
17
|
-
return from;
|
|
18
|
-
}
|
package/cjs/interfaces/index.js
CHANGED
|
@@ -5,7 +5,6 @@ Object.defineProperty(exports, "__esModule", {
|
|
|
5
5
|
_export_star(require("./action.interface"), exports);
|
|
6
6
|
_export_star(require("./role.interface"), exports);
|
|
7
7
|
_export_star(require("./iam-module-options.interface"), exports);
|
|
8
|
-
_export_star(require("./iam-module-async-options.interface"), exports);
|
|
9
8
|
function _export_star(from, to) {
|
|
10
9
|
Object.keys(from).forEach(function(k) {
|
|
11
10
|
if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {
|
|
@@ -11,15 +11,13 @@ Object.defineProperty(exports, "IAMModule", {
|
|
|
11
11
|
const _nestjsshared = require("@flusys/nestjs-shared");
|
|
12
12
|
const _modules = require("@flusys/nestjs-shared/modules");
|
|
13
13
|
const _common = require("@nestjs/common");
|
|
14
|
-
const _typeorm = require("@nestjs/typeorm");
|
|
15
14
|
const _iamconstants = require("../config/iam.constants");
|
|
16
15
|
const _controllers = require("../controllers");
|
|
17
|
-
const _entities = require("../entities");
|
|
18
16
|
const _permissiontypeenum = require("../enums/permission-type.enum");
|
|
19
17
|
const _helpers = require("../helpers");
|
|
20
18
|
const _services = require("../services");
|
|
21
19
|
const _iamconfigservice = require("../services/iam-config.service");
|
|
22
|
-
const
|
|
20
|
+
const _iamdatasourceservice = require("../services/iam-datasource.service");
|
|
23
21
|
const _permissioncacheservice = require("../services/permission-cache.service");
|
|
24
22
|
function _ts_decorate(decorators, target, key, desc) {
|
|
25
23
|
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
|
@@ -54,33 +52,11 @@ let IAMModule = class IAMModule {
|
|
|
54
52
|
}
|
|
55
53
|
return baseControllers;
|
|
56
54
|
}
|
|
57
|
-
static getEntities(permissionMode, enableCompanyFeature) {
|
|
58
|
-
// Core entities
|
|
59
|
-
const entities = [];
|
|
60
|
-
// Action entity - always included
|
|
61
|
-
entities.push(_entities.Action);
|
|
62
|
-
// Permission entity is always needed
|
|
63
|
-
if (enableCompanyFeature) {
|
|
64
|
-
entities.push(_entities.UserIamPermissionWithCompany);
|
|
65
|
-
} else {
|
|
66
|
-
entities.push(_entities.UserIamPermission);
|
|
67
|
-
}
|
|
68
|
-
// Role entity - Only for RBAC or FULL mode
|
|
69
|
-
if (permissionMode === _permissiontypeenum.IAMPermissionMode.RBAC || permissionMode === _permissiontypeenum.IAMPermissionMode.FULL) {
|
|
70
|
-
if (enableCompanyFeature) {
|
|
71
|
-
entities.push(_entities.RoleWithCompany);
|
|
72
|
-
} else {
|
|
73
|
-
entities.push(_entities.Role);
|
|
74
|
-
}
|
|
75
|
-
}
|
|
76
|
-
return entities;
|
|
77
|
-
}
|
|
78
55
|
static getServices(permissionMode) {
|
|
79
56
|
const services = [
|
|
80
57
|
_services.ActionService,
|
|
81
58
|
_services.PermissionService,
|
|
82
|
-
_permissioncacheservice.PermissionCacheService
|
|
83
|
-
_helpers.PermissionEvaluatorHelper
|
|
59
|
+
_permissioncacheservice.PermissionCacheService
|
|
84
60
|
];
|
|
85
61
|
// RoleService - Only for RBAC or FULL mode
|
|
86
62
|
if (permissionMode === _permissiontypeenum.IAMPermissionMode.RBAC || permissionMode === _permissiontypeenum.IAMPermissionMode.FULL) {
|
|
@@ -88,10 +64,7 @@ let IAMModule = class IAMModule {
|
|
|
88
64
|
}
|
|
89
65
|
return services;
|
|
90
66
|
}
|
|
91
|
-
|
|
92
|
-
* Provide PermissionGuard config with enableCompanyFeature
|
|
93
|
-
* This ensures guard uses correct cache key format matching the permission cache service
|
|
94
|
-
*/ static getPermissionGuardConfigProvider(enableCompanyFeature) {
|
|
67
|
+
static getPermissionGuardConfigProvider(enableCompanyFeature) {
|
|
95
68
|
return {
|
|
96
69
|
provide: _nestjsshared.PERMISSION_GUARD_CONFIG,
|
|
97
70
|
useValue: {
|
|
@@ -99,30 +72,24 @@ let IAMModule = class IAMModule {
|
|
|
99
72
|
}
|
|
100
73
|
};
|
|
101
74
|
}
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
]
|
|
116
|
-
}));
|
|
75
|
+
static getExports(permissionMode) {
|
|
76
|
+
const baseExports = [
|
|
77
|
+
_iamconfigservice.IAMConfigService,
|
|
78
|
+
_iamdatasourceservice.IAMDataSourceService,
|
|
79
|
+
_services.ActionService,
|
|
80
|
+
_services.PermissionService,
|
|
81
|
+
_permissioncacheservice.PermissionCacheService,
|
|
82
|
+
_nestjsshared.PERMISSION_GUARD_CONFIG
|
|
83
|
+
];
|
|
84
|
+
if (permissionMode === _permissiontypeenum.IAMPermissionMode.RBAC || permissionMode === _permissiontypeenum.IAMPermissionMode.FULL) {
|
|
85
|
+
baseExports.push(_services.RoleService);
|
|
86
|
+
}
|
|
87
|
+
return baseExports;
|
|
117
88
|
}
|
|
118
89
|
static forRoot(options = {}) {
|
|
119
90
|
const { global = false, includeController = false } = options;
|
|
120
|
-
const databaseMode = options.bootstrapAppConfig?.databaseMode;
|
|
121
91
|
const enableCompanyFeature = options.bootstrapAppConfig?.enableCompanyFeature ?? false;
|
|
122
|
-
// Read permissionMode from bootstrap config using helper
|
|
123
92
|
const permissionMode = _helpers.PermissionModeHelper.fromString(options.bootstrapAppConfig?.permissionMode);
|
|
124
|
-
const isMultiTenant = databaseMode === 'multi-tenant';
|
|
125
|
-
const entities = this.getEntities(permissionMode, enableCompanyFeature);
|
|
126
93
|
const controllers = includeController ? this.getControllers(permissionMode, enableCompanyFeature) : [];
|
|
127
94
|
const providers = [
|
|
128
95
|
{
|
|
@@ -130,87 +97,52 @@ let IAMModule = class IAMModule {
|
|
|
130
97
|
useValue: options
|
|
131
98
|
},
|
|
132
99
|
_iamconfigservice.IAMConfigService,
|
|
133
|
-
|
|
100
|
+
_iamdatasourceservice.IAMDataSourceService,
|
|
134
101
|
...this.getServices(permissionMode),
|
|
135
102
|
this.getPermissionGuardConfigProvider(enableCompanyFeature)
|
|
136
103
|
];
|
|
137
|
-
const imports = [
|
|
138
|
-
_modules.CacheModule,
|
|
139
|
-
_modules.UtilsModule
|
|
140
|
-
];
|
|
141
104
|
const module = {
|
|
142
105
|
module: IAMModule,
|
|
143
|
-
imports
|
|
106
|
+
imports: [
|
|
107
|
+
_modules.CacheModule,
|
|
108
|
+
_modules.UtilsModule
|
|
109
|
+
],
|
|
144
110
|
controllers,
|
|
145
111
|
providers,
|
|
146
|
-
exports:
|
|
147
|
-
_iamconfigservice.IAMConfigService,
|
|
148
|
-
_iamdatasourceprovider.IAMDataSourceProvider,
|
|
149
|
-
_services.ActionService,
|
|
150
|
-
_services.PermissionService,
|
|
151
|
-
_permissioncacheservice.PermissionCacheService,
|
|
152
|
-
_helpers.PermissionEvaluatorHelper,
|
|
153
|
-
_nestjsshared.PERMISSION_GUARD_CONFIG,
|
|
154
|
-
...permissionMode === _permissiontypeenum.IAMPermissionMode.RBAC || permissionMode === _permissiontypeenum.IAMPermissionMode.FULL ? [
|
|
155
|
-
_services.RoleService
|
|
156
|
-
] : []
|
|
157
|
-
]
|
|
112
|
+
exports: this.getExports(permissionMode)
|
|
158
113
|
};
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
};
|
|
164
|
-
}
|
|
165
|
-
return module;
|
|
114
|
+
return global ? {
|
|
115
|
+
...module,
|
|
116
|
+
global: true
|
|
117
|
+
} : module;
|
|
166
118
|
}
|
|
167
119
|
static forRootAsync(asyncOptions) {
|
|
168
120
|
const { global = false, includeController = false, imports: externalImports = [] } = asyncOptions;
|
|
169
|
-
const databaseMode = asyncOptions.bootstrapAppConfig?.databaseMode;
|
|
170
121
|
const enableCompanyFeature = asyncOptions.bootstrapAppConfig?.enableCompanyFeature ?? false;
|
|
171
|
-
// Read permissionMode from bootstrap config using helper
|
|
172
122
|
const permissionMode = _helpers.PermissionModeHelper.fromString(asyncOptions.bootstrapAppConfig?.permissionMode);
|
|
173
|
-
const isMultiTenant = databaseMode === 'multi-tenant';
|
|
174
|
-
const entities = this.getEntities(permissionMode, enableCompanyFeature);
|
|
175
123
|
const controllers = includeController ? this.getControllers(permissionMode, enableCompanyFeature) : [];
|
|
176
|
-
const asyncProviders = this.createAsyncProviders(asyncOptions);
|
|
177
124
|
const providers = [
|
|
178
|
-
...
|
|
125
|
+
...this.createAsyncProviders(asyncOptions),
|
|
179
126
|
_iamconfigservice.IAMConfigService,
|
|
180
|
-
|
|
127
|
+
_iamdatasourceservice.IAMDataSourceService,
|
|
181
128
|
...this.getServices(permissionMode),
|
|
182
129
|
this.getPermissionGuardConfigProvider(enableCompanyFeature)
|
|
183
130
|
];
|
|
184
|
-
const imports = [
|
|
185
|
-
...externalImports,
|
|
186
|
-
_modules.CacheModule,
|
|
187
|
-
_modules.UtilsModule
|
|
188
|
-
];
|
|
189
131
|
const module = {
|
|
190
132
|
module: IAMModule,
|
|
191
|
-
imports
|
|
133
|
+
imports: [
|
|
134
|
+
...externalImports,
|
|
135
|
+
_modules.CacheModule,
|
|
136
|
+
_modules.UtilsModule
|
|
137
|
+
],
|
|
192
138
|
controllers,
|
|
193
139
|
providers,
|
|
194
|
-
exports:
|
|
195
|
-
_iamconfigservice.IAMConfigService,
|
|
196
|
-
_iamdatasourceprovider.IAMDataSourceProvider,
|
|
197
|
-
_services.ActionService,
|
|
198
|
-
_services.PermissionService,
|
|
199
|
-
_permissioncacheservice.PermissionCacheService,
|
|
200
|
-
_helpers.PermissionEvaluatorHelper,
|
|
201
|
-
_nestjsshared.PERMISSION_GUARD_CONFIG,
|
|
202
|
-
...permissionMode === _permissiontypeenum.IAMPermissionMode.RBAC || permissionMode === _permissiontypeenum.IAMPermissionMode.FULL ? [
|
|
203
|
-
_services.RoleService
|
|
204
|
-
] : []
|
|
205
|
-
]
|
|
140
|
+
exports: this.getExports(permissionMode)
|
|
206
141
|
};
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
};
|
|
212
|
-
}
|
|
213
|
-
return module;
|
|
142
|
+
return global ? {
|
|
143
|
+
...module,
|
|
144
|
+
global: true
|
|
145
|
+
} : module;
|
|
214
146
|
}
|
|
215
147
|
static createAsyncProviders(options) {
|
|
216
148
|
if (options.useExisting || options.useFactory) {
|
|
@@ -14,7 +14,7 @@ const _common = require("@nestjs/common");
|
|
|
14
14
|
const _typeorm = require("typeorm");
|
|
15
15
|
const _actionentity = require("../entities/action.entity");
|
|
16
16
|
const _iamconfigservice = require("./iam-config.service");
|
|
17
|
-
const
|
|
17
|
+
const _iamdatasourceservice = require("./iam-datasource.service");
|
|
18
18
|
const _permissionservice = require("./permission.service");
|
|
19
19
|
function _define_property(obj, key, value) {
|
|
20
20
|
if (key in obj) {
|
|
@@ -103,55 +103,33 @@ let ActionService = class ActionService extends _classes.RequestScopedApiService
|
|
|
103
103
|
deletedById: entity.deletedById
|
|
104
104
|
};
|
|
105
105
|
}
|
|
106
|
-
|
|
107
|
-
/** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user) {
|
|
108
|
-
await this.ensureRepositoryInitialized();
|
|
106
|
+
requireUser(user, methodName) {
|
|
109
107
|
if (!user) {
|
|
110
|
-
throw new _common.BadRequestException(
|
|
108
|
+
throw new _common.BadRequestException(`User is required for ${methodName}`);
|
|
111
109
|
}
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
'permissionLogic',
|
|
119
|
-
'isActive',
|
|
120
|
-
'parentId',
|
|
121
|
-
'serial'
|
|
122
|
-
];
|
|
123
|
-
const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
|
|
124
|
-
if (enableCompanyFeature && user.companyId) {
|
|
110
|
+
}
|
|
111
|
+
/** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user) {
|
|
112
|
+
await this.ensureRepositoryInitialized();
|
|
113
|
+
this.requireUser(user, 'getActionsForPermission');
|
|
114
|
+
let whereClause = {};
|
|
115
|
+
if (this.iamConfigService.isCompanyFeatureEnabled() && user.companyId) {
|
|
125
116
|
const companyActionIds = await this.permissionService.getCompanyActionIds(user.companyId);
|
|
126
117
|
if (companyActionIds.length === 0) {
|
|
127
118
|
return [];
|
|
128
119
|
}
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
},
|
|
133
|
-
select: selectFields
|
|
134
|
-
});
|
|
135
|
-
return actions.map((action)=>this.convertEntityToResponseDto(action, false));
|
|
120
|
+
whereClause = {
|
|
121
|
+
id: (0, _typeorm.In)(companyActionIds)
|
|
122
|
+
};
|
|
136
123
|
}
|
|
137
124
|
const actions = await this.repository.find({
|
|
138
|
-
|
|
125
|
+
where: whereClause,
|
|
126
|
+
select: this.actionSelectFields
|
|
139
127
|
});
|
|
140
128
|
return actions.map((action)=>this.convertEntityToResponseDto(action, false));
|
|
141
129
|
}
|
|
142
|
-
/**
|
|
143
|
-
* Get actions in hierarchical tree structure
|
|
144
|
-
*
|
|
145
|
-
* @param user - Logged in user info for company filtering
|
|
146
|
-
* @param search - Optional search term (name or code)
|
|
147
|
-
* @param isActive - Optional filter by active status
|
|
148
|
-
* @param withDeleted - Include deleted actions (default: false)
|
|
149
|
-
* @returns Array of root actions with nested children
|
|
150
|
-
*/ async getActionTree(user, search, isActive, withDeleted = false) {
|
|
130
|
+
/** Get actions in hierarchical tree structure */ async getActionTree(user, search, isActive, withDeleted = false) {
|
|
151
131
|
await this.ensureRepositoryInitialized();
|
|
152
|
-
|
|
153
|
-
throw new _common.BadRequestException('User is required for getActionTree');
|
|
154
|
-
}
|
|
132
|
+
this.requireUser(user, 'getActionTree');
|
|
155
133
|
const query = this.repository.createQueryBuilder('action');
|
|
156
134
|
if (!withDeleted) {
|
|
157
135
|
query.andWhere('action.deletedAt IS NULL');
|
|
@@ -199,7 +177,18 @@ let ActionService = class ActionService extends _classes.RequestScopedApiService
|
|
|
199
177
|
return rootNodes;
|
|
200
178
|
}
|
|
201
179
|
constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService){
|
|
202
|
-
super('action', null, cacheManager, utilsService, ActionService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "permissionService", void 0),
|
|
180
|
+
super('action', null, cacheManager, utilsService, ActionService.name, true), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "dataSourceProvider", void 0), _define_property(this, "permissionService", void 0), // Custom Methods
|
|
181
|
+
_define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.dataSourceProvider = dataSourceProvider, this.permissionService = permissionService, this.actionSelectFields = [
|
|
182
|
+
'id',
|
|
183
|
+
'code',
|
|
184
|
+
'name',
|
|
185
|
+
'description',
|
|
186
|
+
'actionType',
|
|
187
|
+
'permissionLogic',
|
|
188
|
+
'isActive',
|
|
189
|
+
'parentId',
|
|
190
|
+
'serial'
|
|
191
|
+
];
|
|
203
192
|
}
|
|
204
193
|
};
|
|
205
194
|
ActionService = _ts_decorate([
|
|
@@ -209,14 +198,14 @@ ActionService = _ts_decorate([
|
|
|
209
198
|
_ts_param(0, (0, _common.Inject)('CACHE_INSTANCE')),
|
|
210
199
|
_ts_param(1, (0, _common.Inject)(_modules.UtilsService)),
|
|
211
200
|
_ts_param(2, (0, _common.Inject)(_iamconfigservice.IAMConfigService)),
|
|
212
|
-
_ts_param(3, (0, _common.Inject)(
|
|
201
|
+
_ts_param(3, (0, _common.Inject)(_iamdatasourceservice.IAMDataSourceService)),
|
|
213
202
|
_ts_param(4, (0, _common.Inject)(_permissionservice.PermissionService)),
|
|
214
203
|
_ts_metadata("design:type", Function),
|
|
215
204
|
_ts_metadata("design:paramtypes", [
|
|
216
205
|
typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
|
|
217
206
|
typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
|
|
218
207
|
typeof _iamconfigservice.IAMConfigService === "undefined" ? Object : _iamconfigservice.IAMConfigService,
|
|
219
|
-
typeof
|
|
208
|
+
typeof _iamdatasourceservice.IAMDataSourceService === "undefined" ? Object : _iamdatasourceservice.IAMDataSourceService,
|
|
220
209
|
typeof _permissionservice.PermissionService === "undefined" ? Object : _permissionservice.PermissionService
|
|
221
210
|
])
|
|
222
211
|
], ActionService);
|
|
@@ -48,12 +48,9 @@ let IAMConfigService = class IAMConfigService {
|
|
|
48
48
|
isMultiTenant() {
|
|
49
49
|
return this.getDatabaseMode() === 'multi-tenant';
|
|
50
50
|
}
|
|
51
|
-
//
|
|
52
|
-
getEnableCompanyFeature() {
|
|
53
|
-
return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
|
|
54
|
-
}
|
|
51
|
+
// Feature Flags
|
|
55
52
|
isCompanyFeatureEnabled() {
|
|
56
|
-
return this.
|
|
53
|
+
return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
|
|
57
54
|
}
|
|
58
55
|
// Permission Mode
|
|
59
56
|
getPermissionMode() {
|