@flusys/nestjs-iam 1.1.0-beta → 2.0.0

package/fesm/controllers/user-action-permission.controller.js

@@ -25,17 +25,21 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { JwtAuthGuard, SingleResponseDto } from '@flusys/nestjs-shared';
-import { Body, Controller, Get, Inject, Param, Post, Query, UseGuards } from '@nestjs/common';
+import { JwtAuthGuard, SingleResponseDto, RequirePermission, USER_ACTION_PERMISSIONS, CurrentUser, ILoggedUserInfo } from '@flusys/nestjs-shared';
+import { Body, Controller, Inject, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
 import { AssignUserActionsDto, GetUserActionsDto, PermissionOperationResultDto } from '../dtos/permission.dto';
+import { validateCompanyAccess } from '../helpers';
 import { PermissionService } from '../services/permission.service';
+import { IAMConfigService } from '../services/iam-config.service';
 export class UserActionPermissionController {
-    async assignUserActions(dto) {
+    async assignUserActions(dto, user) {
+        validateCompanyAccess(this.config, dto.companyId, user, 'Cannot manage permissions for users in another company');
         return this.permissionService.assignUserActions(dto);
     }
-    async getUserActions(userId, query) {
-        const actions = await this.permissionService.getUserActions(userId, query.branchId, query.companyId);
+    async getUserActions(dto, user) {
+        validateCompanyAccess(this.config, dto.companyId, user, 'Cannot manage permissions for users in another company');
+        const actions = await this.permissionService.getUserActions(dto.userId, dto.branchId, dto.companyId);
         return {
             success: true,
             message: 'User actions retrieved successfully',
@@ -43,13 +47,16 @@ export class UserActionPermissionController {
         };
     }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(permissionService){
+    constructor(permissionService, config){
         _define_property(this, "permissionService", void 0);
+        _define_property(this, "config", void 0);
         this.permissionService = permissionService;
+        this.config = config;
     }
 }
 _ts_decorate([
     Post('user-actions/assign'),
+    RequirePermission(USER_ACTION_PERMISSIONS.ASSIGN),
     ApiOperation({
         summary: 'Assign/remove actions to/from user',
         description: 'Direct permissions. If company feature enabled, branchId is required.'
@@ -62,14 +69,17 @@ _ts_decorate([
         type: AssignUserActionsDto
     }),
     _ts_param(0, Body()),
+    _ts_param(1, CurrentUser()),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof AssignUserActionsDto === "undefined" ? Object : AssignUserActionsDto
+        typeof AssignUserActionsDto === "undefined" ? Object : AssignUserActionsDto,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
     ]),
     _ts_metadata("design:returntype", Promise)
 ], UserActionPermissionController.prototype, "assignUserActions", null);
 _ts_decorate([
-    Get('user-actions/:userId'),
+    Post('get-user-actions'),
+    RequirePermission(USER_ACTION_PERMISSIONS.READ),
     ApiOperation({
         summary: 'Get user direct actions',
         description: 'Returns direct action permissions for user. Filter by companyId and branchId.'
@@ -78,12 +88,15 @@ _ts_decorate([
         status: 200,
         type: SingleResponseDto
     }),
-    _ts_param(0, Param('userId')),
-    _ts_param(1, Query()),
+    ApiBody({
+        type: GetUserActionsDto
+    }),
+    _ts_param(0, Body()),
+    _ts_param(1, CurrentUser()),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        String,
-        typeof GetUserActionsDto === "undefined" ? Object : GetUserActionsDto
+        typeof GetUserActionsDto === "undefined" ? Object : GetUserActionsDto,
+        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
     ]),
     _ts_metadata("design:returntype", Promise)
 ], UserActionPermissionController.prototype, "getUserActions", null);
@@ -93,8 +106,10 @@ UserActionPermissionController = _ts_decorate([
     UseGuards(JwtAuthGuard),
     ApiBearerAuth(),
     _ts_param(0, Inject(PermissionService)),
+    _ts_param(1, Inject(IAMConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof PermissionService === "undefined" ? Object : PermissionService
+        typeof PermissionService === "undefined" ? Object : PermissionService,
+        typeof IAMConfigService === "undefined" ? Object : IAMConfigService
     ])
 ], UserActionPermissionController);

package/fesm/dtos/action.dto.js

@@ -254,30 +254,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Array)
 ], ActionTreeDto.prototype, "children", void 0);
-export class ActionQueryDto {
-    constructor(){
-        _define_property(this, "isActive", void 0);
-        _define_property(this, "parentId", void 0);
-    }
-}
-_ts_decorate([
-    ApiProperty({
-        description: 'Filter by active status',
-        required: false
-    }),
-    IsBoolean(),
-    IsOptional(),
-    _ts_metadata("design:type", Boolean)
-], ActionQueryDto.prototype, "isActive", void 0);
-_ts_decorate([
-    ApiProperty({
-        description: 'Filter by parent ID',
-        required: false
-    }),
-    IsUUID(),
-    IsOptional(),
-    _ts_metadata("design:type", String)
-], ActionQueryDto.prototype, "parentId", void 0);
 export class ActionTreeQueryDto {
     constructor(){
         _define_property(this, "search", void 0);

package/fesm/dtos/permission.dto.js

@@ -196,10 +196,18 @@ _ts_decorate([
 ], AssignUserRolesDto.prototype, "items", void 0);
 export class GetUserActionsDto {
     constructor(){
+        _define_property(this, "userId", void 0);
         _define_property(this, "companyId", void 0);
         _define_property(this, "branchId", void 0);
     }
 }
+_ts_decorate([
+    ApiProperty({
+        description: 'User ID to get actions for'
+    }),
+    IsUUID(),
+    _ts_metadata("design:type", String)
+], GetUserActionsDto.prototype, "userId", void 0);
 _ts_decorate([
     ApiPropertyOptional({
         description: 'Company ID (ignored when enableCompanyFeature is false)'
@@ -216,18 +224,44 @@ _ts_decorate([
     IsOptional(),
     _ts_metadata("design:type", String)
 ], GetUserActionsDto.prototype, "branchId", void 0);
-// No query parameters needed for GetRoleActions
 export class GetRoleActionsDto {
+    constructor(){
+        _define_property(this, "roleId", void 0);
+    }
 }
-// No query parameters needed for GetCompanyActions
+_ts_decorate([
+    ApiProperty({
+        description: 'Role ID to get actions for'
+    }),
+    IsUUID(),
+    _ts_metadata("design:type", String)
+], GetRoleActionsDto.prototype, "roleId", void 0);
 export class GetCompanyActionsDto {
+    constructor(){
+        _define_property(this, "companyId", void 0);
+    }
 }
+_ts_decorate([
+    ApiProperty({
+        description: 'Company ID to get actions for'
+    }),
+    IsUUID(),
+    _ts_metadata("design:type", String)
+], GetCompanyActionsDto.prototype, "companyId", void 0);
 export class GetUserRolesDto {
     constructor(){
+        _define_property(this, "userId", void 0);
         _define_property(this, "companyId", void 0);
         _define_property(this, "branchId", void 0);
     }
 }
+_ts_decorate([
+    ApiProperty({
+        description: 'User ID to get roles for'
+    }),
+    IsUUID(),
+    _ts_metadata("design:type", String)
+], GetUserRolesDto.prototype, "userId", void 0);
 _ts_decorate([
     ApiPropertyOptional({
         description: 'Company ID (ignored when enableCompanyFeature is false)'
@@ -256,31 +290,45 @@ export class UserActionResponseDto {
     }
 }
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Permission ID'
+    }),
     _ts_metadata("design:type", String)
 ], UserActionResponseDto.prototype, "id", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'User ID'
+    }),
     _ts_metadata("design:type", String)
 ], UserActionResponseDto.prototype, "userId", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action ID'
+    }),
     _ts_metadata("design:type", String)
 ], UserActionResponseDto.prototype, "actionId", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action code'
+    }),
     _ts_metadata("design:type", String)
 ], UserActionResponseDto.prototype, "actionCode", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action name'
+    }),
     _ts_metadata("design:type", String)
 ], UserActionResponseDto.prototype, "actionName", void 0);
 _ts_decorate([
-    ApiPropertyOptional(),
+    ApiPropertyOptional({
+        description: 'Branch ID (null = company-wide)'
+    }),
     _ts_metadata("design:type", Object)
 ], UserActionResponseDto.prototype, "branchId", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'When this permission was created'
+    }),
     _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
 ], UserActionResponseDto.prototype, "createdAt", void 0);
 export class RoleActionResponseDto {
@@ -294,27 +342,39 @@ export class RoleActionResponseDto {
     }
 }
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Permission ID'
+    }),
     _ts_metadata("design:type", String)
 ], RoleActionResponseDto.prototype, "id", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Role ID'
+    }),
     _ts_metadata("design:type", String)
 ], RoleActionResponseDto.prototype, "roleId", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action ID'
+    }),
     _ts_metadata("design:type", String)
 ], RoleActionResponseDto.prototype, "actionId", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action code'
+    }),
     _ts_metadata("design:type", String)
 ], RoleActionResponseDto.prototype, "actionCode", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action name'
+    }),
     _ts_metadata("design:type", String)
 ], RoleActionResponseDto.prototype, "actionName", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'When this permission was created'
+    }),
     _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
 ], RoleActionResponseDto.prototype, "createdAt", void 0);
 export class CompanyActionResponseDto {
@@ -374,27 +434,39 @@ export class UserRoleResponseDto {
     }
 }
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Permission ID'
+    }),
     _ts_metadata("design:type", String)
 ], UserRoleResponseDto.prototype, "id", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'User ID'
+    }),
     _ts_metadata("design:type", String)
 ], UserRoleResponseDto.prototype, "userId", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Role ID'
+    }),
     _ts_metadata("design:type", String)
 ], UserRoleResponseDto.prototype, "roleId", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Role name'
+    }),
     _ts_metadata("design:type", String)
 ], UserRoleResponseDto.prototype, "roleName", void 0);
 _ts_decorate([
-    ApiPropertyOptional(),
+    ApiPropertyOptional({
+        description: 'Branch ID (null = company-wide)'
+    }),
     _ts_metadata("design:type", Object)
 ], UserRoleResponseDto.prototype, "branchId", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'When this permission was created'
+    }),
     _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
 ], UserRoleResponseDto.prototype, "createdAt", void 0);
 export class FrontendActionDto {
@@ -406,19 +478,27 @@ export class FrontendActionDto {
     }
 }
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action ID'
+    }),
     _ts_metadata("design:type", String)
 ], FrontendActionDto.prototype, "id", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action code'
+    }),
     _ts_metadata("design:type", String)
 ], FrontendActionDto.prototype, "code", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Action name'
+    }),
     _ts_metadata("design:type", String)
 ], FrontendActionDto.prototype, "name", void 0);
 _ts_decorate([
-    ApiPropertyOptional(),
+    ApiPropertyOptional({
+        description: 'Action description'
+    }),
     _ts_metadata("design:type", Object)
 ], FrontendActionDto.prototype, "description", void 0);
 export class MyPermissionsQueryDto {
@@ -473,18 +553,26 @@ export class PermissionOperationResultDto {
     }
 }
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Whether the operation succeeded'
+    }),
     _ts_metadata("design:type", Boolean)
 ], PermissionOperationResultDto.prototype, "success", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Number of permissions added'
+    }),
     _ts_metadata("design:type", Number)
 ], PermissionOperationResultDto.prototype, "added", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Number of permissions removed'
+    }),
     _ts_metadata("design:type", Number)
 ], PermissionOperationResultDto.prototype, "removed", void 0);
 _ts_decorate([
-    ApiProperty(),
+    ApiProperty({
+        description: 'Operation result message'
+    }),
     _ts_metadata("design:type", String)
 ], PermissionOperationResultDto.prototype, "message", void 0);

package/fesm/dtos/role.dto.js

@@ -104,30 +104,6 @@ _ts_decorate([
     IsNotEmpty(),
     _ts_metadata("design:type", String)
 ], UpdateRoleDto.prototype, "id", void 0);
-export class RoleQueryDto {
-    constructor(){
-        _define_property(this, "companyId", void 0);
-        _define_property(this, "isActive", void 0);
-    }
-}
-_ts_decorate([
-    ApiProperty({
-        description: 'Filter by company ID - Only available when company feature is enabled',
-        required: false
-    }),
-    IsUUID(),
-    IsOptional(),
-    _ts_metadata("design:type", String)
-], RoleQueryDto.prototype, "companyId", void 0);
-_ts_decorate([
-    ApiProperty({
-        description: 'Filter by active status',
-        required: false
-    }),
-    IsBoolean(),
-    IsOptional(),
-    _ts_metadata("design:type", Boolean)
-], RoleQueryDto.prototype, "isActive", void 0);
 export class RoleResponseDto {
     constructor(){
         _define_property(this, "id", void 0);

package/fesm/entities/permission-base.entity.js

@@ -40,18 +40,6 @@ export var IamEntityType = /*#__PURE__*/ function(IamEntityType) {
  * Permission Base Entity
  * Core permission fields - always included regardless of company feature
  */ export class PermissionBase extends Identity {
-    isUserRole() {
-        return this.permissionType === "user_role";
-    }
-    isRoleAction() {
-        return this.permissionType === "role_action";
-    }
-    isUserAction() {
-        return this.permissionType === "user_action";
-    }
-    isCompanyAction() {
-        return this.permissionType === "company_action";
-    }
     isValid(now = new Date()) {
         if (this.validFrom && now < this.validFrom) return false;
         if (this.validUntil && now > this.validUntil) return false;

package/fesm/helpers/company-access.helper.js

@@ -0,0 +1,14 @@
+import { ForbiddenException } from '@nestjs/common';
+/**
+ * Validates that user has access to the specified company.
+ * Used for user-action and role-permission operations when company feature is enabled.
+ *
+ * @throws ForbiddenException if user doesn't have access to the company
+ */ export function validateCompanyAccess(config, companyId, user, errorMessage = 'You do not have access to this company') {
+    if (!config.isCompanyFeatureEnabled() || !companyId) {
+        return;
+    }
+    if (user.companyId !== companyId) {
+        throw new ForbiddenException(errorMessage);
+    }
+}

package/fesm/helpers/index.js

@@ -1,2 +1,2 @@
-export * from './permission-evaluator.helper';
+export * from './company-access.helper';
 export * from './permission-mode.helper';

package/fesm/interfaces/iam-module-options.interface.js

@@ -1 +1,3 @@
-export * from './iam-module-async-options.interface';
+/**
+ * Async options for IAMModule registration
+ */ export { };

package/fesm/interfaces/index.js

@@ -1,4 +1,3 @@
 export * from './action.interface';
 export * from './role.interface';
 export * from './iam-module-options.interface';
-export * from './iam-module-async-options.interface';