@flusys/nestjs-iam 6.0.0 → 6.0.2

package/cjs/controllers/action.controller.js

@@ -8,13 +8,14 @@ Object.defineProperty(exports, "ActionController", {
         return ActionController;
     }
 });
-const _guards = require("@flusys/nestjs-shared/guards");
 const _nestjsshared = require("@flusys/nestjs-shared");
-const _config = require("../config");
+const _guards = require("@flusys/nestjs-shared/guards");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
+const _config = require("../config");
 const _actiondto = require("../dtos/action.dto");
 const _actionservice = require("../services/action.service");
+const _iamconfigservice = require("../services/iam-config.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -89,8 +90,8 @@ let ActionController = class ActionController extends (0, _nestjsshared.createAp
         }
     }
 }) {
-    async getActionsForPermission(user) {
-        const actions = await this.actionService.getActionsForPermission(user);
+    async getActionsForPermission(dto, user) {
+        const actions = await this.actionService.getActionsForPermission(user, dto?.companyId);
         return {
             success: true,
             message: 'Actions retrieved successfully',
@@ -107,8 +108,8 @@ let ActionController = class ActionController extends (0, _nestjsshared.createAp
             data: tree
         };
     }
-    constructor(actionService){
-        super(actionService), _define_property(this, "actionService", void 0), this.actionService = actionService;
+    constructor(actionService, iamConfigService){
+        super(actionService), _define_property(this, "actionService", void 0), _define_property(this, "iamConfigService", void 0), this.actionService = actionService, this.iamConfigService = iamConfigService;
     }
 };
 _ts_decorate([
@@ -117,15 +118,20 @@ _ts_decorate([
     (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Get actions for permission assignment',
-        description: 'Returns actions available for permission assignment. If company feature enabled, filtered by company whitelist.'
+        description: "Returns actions available for permission assignment, filtered by company whitelist when company feature is enabled. Optional companyId scopes the whitelist to a specific company (must match the caller's own company); defaults to the caller's session company when omitted."
     }),
     (0, _swagger.ApiResponse)({
         status: 200,
         type: _nestjsshared.SingleResponseDto
     }),
-    _ts_param(0, (0, _nestjsshared.CurrentUser)()),
+    (0, _swagger.ApiBody)({
+        type: _actiondto.ActionTreeForPermissionDto
+    }),
+    _ts_param(0, (0, _common.Body)()),
+    _ts_param(1, (0, _nestjsshared.CurrentUser)()),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        typeof _actiondto.ActionTreeForPermissionDto === "undefined" ? Object : _actiondto.ActionTreeForPermissionDto,
         typeof _nestjsshared.ILoggedUserInfo === "undefined" ? Object : _nestjsshared.ILoggedUserInfo
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -159,8 +165,10 @@ ActionController = _ts_decorate([
     (0, _swagger.ApiTags)('IAM - Actions'),
     (0, _common.Controller)('iam/actions'),
     _ts_param(0, (0, _common.Inject)(_actionservice.ActionService)),
+    _ts_param(1, (0, _common.Inject)(_iamconfigservice.IAMConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _actionservice.ActionService === "undefined" ? Object : _actionservice.ActionService
+        typeof _actionservice.ActionService === "undefined" ? Object : _actionservice.ActionService,
+        typeof _iamconfigservice.IAMConfigService === "undefined" ? Object : _iamconfigservice.IAMConfigService
     ])
 ], ActionController);

package/cjs/controllers/user-action-permission.controller.js

@@ -13,7 +13,6 @@ const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _config = require("../config");
 const _permissiondto = require("../dtos/permission.dto");
-const _helpers = require("../helpers");
 const _iamconfigservice = require("../services/iam-config.service");
 const _permissionservice = require("../services/permission.service");
 function _define_property(obj, key, value) {
@@ -45,7 +44,6 @@ function _ts_param(paramIndex, decorator) {
 }
 let UserActionPermissionController = class UserActionPermissionController {
     async assignUserActions(dto, user) {
-        (0, _helpers.validateCompanyAccess)(this.config, dto.companyId, user);
         const result = await this.permissionService.assignUserActions(dto);
         return {
             success: true,
@@ -60,7 +58,6 @@ let UserActionPermissionController = class UserActionPermissionController {
         };
     }
     async getUserActions(dto, user) {
-        (0, _helpers.validateCompanyAccess)(this.config, dto.companyId, user);
         const actions = await this.permissionService.getUserActions(dto.userId, dto.branchId, dto.companyId);
         return {
             success: true,

package/cjs/docs/iam-swagger.config.js

@@ -49,6 +49,12 @@ function iamSwaggerConfig(enableCompanyFeature = false, permissionMode = _permis
                 'branchId'
             ]
         },
+        {
+            schemaName: 'ActionTreeForPermissionDto',
+            properties: [
+                'companyId'
+            ]
+        },
         // Response DTOs with branchId
         {
             schemaName: 'UserActionResponseDto',

package/cjs/dtos/action.dto.js

@@ -15,6 +15,9 @@ _export(exports, {
     get ActionTreeDto () {
         return ActionTreeDto;
     },
+    get ActionTreeForPermissionDto () {
+        return ActionTreeForPermissionDto;
+    },
     get ActionTreeQueryDto () {
         return ActionTreeQueryDto;
     },
@@ -226,6 +229,20 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Array)
 ], ActionTreeDto.prototype, "children", void 0);
+let ActionTreeForPermissionDto = class ActionTreeForPermissionDto {
+    constructor(){
+        _define_property(this, "companyId", void 0);
+    }
+};
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        description: 'Company to scope the action whitelist to. Defaults to the current user session company when omitted.',
+        required: false
+    }),
+    (0, _classvalidator.IsUUID)(),
+    (0, _classvalidator.IsOptional)(),
+    _ts_metadata("design:type", String)
+], ActionTreeForPermissionDto.prototype, "companyId", void 0);
 let ActionTreeQueryDto = class ActionTreeQueryDto {
     constructor(){
         _define_property(this, "search", void 0);

package/cjs/modules/iam.module.js

@@ -68,7 +68,9 @@ let IAMModule = class IAMModule {
         return {
             provide: _nestjsshared.PERMISSION_GUARD_CONFIG,
             useValue: {
-                enableCompanyFeature
+                enableCompanyFeature,
+                userPermissionKeyFormat: `${_permissioncacheservice.MY_PERMISSIONS_CACHE_PREFIX}:user:{userId}`,
+                companyPermissionKeyFormat: `${_permissioncacheservice.MY_PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`
             }
         };
     }

package/cjs/services/action.service.js

@@ -14,8 +14,13 @@ const _common = require("@nestjs/common");
 const _typeorm = require("typeorm");
 const _config = require("../config");
 const _actionentity = require("../entities/action.entity");
+const _permissionwithcompanyentity = require("../entities/permission-with-company.entity");
+const _useriampermissionentity = require("../entities/user-iam-permission.entity");
+const _iamentitytypeenum = require("../enums/iam-entity-type.enum");
+const _iampermissiontypeenum = require("../enums/iam-permission-type.enum");
 const _iamconfigservice = require("./iam-config.service");
 const _iamdatasourceservice = require("./iam-datasource.service");
+const _permissioncacheservice = require("./permission-cache.service");
 const _permissionservice = require("./permission.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
@@ -45,6 +50,81 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let ActionService = class ActionService extends _classes.ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const actionIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        if (actionIds.length === 0) {
+            return;
+        }
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const permissionEntity = enableCompanyFeature ? _permissionwithcompanyentity.UserIamPermissionWithCompany : _useriampermissionentity.UserIamPermission;
+        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
+        const [roleActionRows, userActionRows, companyActionRows] = await Promise.all([
+            permissionRepo.find({
+                where: {
+                    permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
+                    sourceType: _iamentitytypeenum.IamEntityType.ROLE,
+                    targetType: _iamentitytypeenum.IamEntityType.ACTION,
+                    targetId: (0, _typeorm.In)(actionIds)
+                }
+            }),
+            permissionRepo.find({
+                where: {
+                    permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
+                    targetType: _iamentitytypeenum.IamEntityType.ACTION,
+                    targetId: (0, _typeorm.In)(actionIds)
+                }
+            }),
+            enableCompanyFeature ? permissionRepo.find({
+                where: {
+                    permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION,
+                    sourceType: _iamentitytypeenum.IamEntityType.COMPANY,
+                    targetType: _iamentitytypeenum.IamEntityType.ACTION,
+                    targetId: (0, _typeorm.In)(actionIds)
+                }
+            }) : Promise.resolve([])
+        ]);
+        const affectedUserIds = new Set(userActionRows.map((row)=>row.userId).filter((id)=>!!id));
+        const affectedCompanyIds = [
+            ...new Set(companyActionRows.map((row)=>row.sourceId).filter((id)=>!!id))
+        ];
+        const affectedRoleIds = [
+            ...new Set(roleActionRows.map((row)=>row.sourceId))
+        ];
+        if (affectedRoleIds.length > 0) {
+            const userRoleRows = await permissionRepo.find({
+                where: {
+                    permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                    targetType: _iamentitytypeenum.IamEntityType.ROLE,
+                    targetId: (0, _typeorm.In)(affectedRoleIds)
+                }
+            });
+            userRoleRows.forEach((row)=>row.userId && affectedUserIds.add(row.userId));
+        }
+        await permissionRepo.delete({
+            permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
+            targetType: _iamentitytypeenum.IamEntityType.ACTION,
+            targetId: (0, _typeorm.In)(actionIds)
+        });
+        await permissionRepo.delete({
+            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
+            targetType: _iamentitytypeenum.IamEntityType.ACTION,
+            targetId: (0, _typeorm.In)(actionIds)
+        });
+        await permissionRepo.delete({
+            permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION,
+            sourceType: _iamentitytypeenum.IamEntityType.COMPANY,
+            targetType: _iamentitytypeenum.IamEntityType.ACTION,
+            targetId: (0, _typeorm.In)(actionIds)
+        });
+        await Promise.all([
+            affectedUserIds.size > 0 ? this.permissionCacheService.invalidateUsers([
+                ...affectedUserIds
+            ]) : Promise.resolve(),
+            ...affectedCompanyIds.map((companyId)=>this.permissionService.invalidateCompanyMembersCache(companyId))
+        ]);
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -108,12 +188,13 @@ let ActionService = class ActionService extends _classes.ApiService {
             });
         }
     }
-    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user) {
+    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user, companyId) {
         await this.ensureDataSourceRepository();
         this.requireUser(user, 'getActionsForPermission');
         let whereClause = {};
-        if (this.iamConfigService.isCompanyFeatureEnabled() && user.companyId) {
-            const companyActionIds = await this.permissionService.getCompanyActionIds(user.companyId);
+        const targetCompanyId = companyId || user.companyId;
+        if (this.iamConfigService.isCompanyFeatureEnabled() && targetCompanyId) {
+            const companyActionIds = await this.permissionService.getCompanyActionIds(targetCompanyId);
             if (companyActionIds.length === 0) {
                 return [];
             }
@@ -176,9 +257,9 @@ let ActionService = class ActionService extends _classes.ApiService {
         }
         return rootNodes;
     }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService){
-        super('action', cacheManager, utilsService, ActionService.name, true, 'iam', _actionentity.Action, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionService", void 0), // Custom Methods
-        _define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.actionSelectFields = [
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService, permissionCacheService){
+        super('action', cacheManager, utilsService, ActionService.name, true, 'iam', _actionentity.Action, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionService", void 0), _define_property(this, "permissionCacheService", void 0), // Custom Methods
+        _define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.permissionCacheService = permissionCacheService, this.actionSelectFields = [
             'id',
             'code',
             'name',
@@ -200,12 +281,14 @@ ActionService = _ts_decorate([
     _ts_param(2, (0, _common.Inject)(_iamconfigservice.IAMConfigService)),
     _ts_param(3, (0, _common.Inject)(_iamdatasourceservice.IAMDataSourceService)),
     _ts_param(4, (0, _common.Inject)(_permissionservice.PermissionService)),
+    _ts_param(5, (0, _common.Inject)(_permissioncacheservice.PermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
         typeof _iamconfigservice.IAMConfigService === "undefined" ? Object : _iamconfigservice.IAMConfigService,
         typeof _iamdatasourceservice.IAMDataSourceService === "undefined" ? Object : _iamdatasourceservice.IAMDataSourceService,
-        typeof _permissionservice.PermissionService === "undefined" ? Object : _permissionservice.PermissionService
+        typeof _permissionservice.PermissionService === "undefined" ? Object : _permissionservice.PermissionService,
+        typeof _permissioncacheservice.PermissionCacheService === "undefined" ? Object : _permissioncacheservice.PermissionCacheService
     ])
 ], ActionService);

package/cjs/services/permission-cache.service.js

@@ -2,12 +2,24 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
-Object.defineProperty(exports, "PermissionCacheService", {
-    enumerable: true,
-    get: function() {
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get MY_PERMISSIONS_CACHE_PREFIX () {
+        return MY_PERMISSIONS_CACHE_PREFIX;
+    },
+    get PermissionCacheKeyOptions () {
+        return _nestjsshared.PermissionCacheKeyOptions;
+    },
+    get PermissionCacheService () {
         return PermissionCacheService;
     }
 });
+const _config = require("@flusys/nestjs-core/config");
 const _nestjsshared = require("@flusys/nestjs-shared");
 const _common = require("@nestjs/common");
 function _define_property(obj, key, value) {
@@ -37,84 +49,118 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
+const MY_PERMISSIONS_CACHE_PREFIX = _nestjsshared.PERMISSIONS_CACHE_PREFIX;
+const NO_COMPANY_SCOPE = 'none';
 let PermissionCacheService = class PermissionCacheService {
     // Cache Key Generation
-    generateCacheKey(options) {
-        return this.buildCacheKey(this.CACHE_PREFIX, options);
+    parseDurationMs(duration) {
+        const unitMs = {
+            ms: 1,
+            s: 1000,
+            m: 60000,
+            h: 3600000,
+            d: 86400000,
+            w: 604800000
+        };
+        const match = /^(\d+)\s*(ms|s|m|h|d|w)?$/i.exec(duration.trim());
+        if (!match) {
+            return unitMs.h; // fallback: 1 hour
+        }
+        const unit = (match[2] || 'ms').toLowerCase();
+        return Number(match[1]) * unitMs[unit];
     }
-    generateMyPermissionsCacheKey(options) {
-        return this.buildCacheKey(this.MY_PERMISSIONS_PREFIX, options);
+    buildCacheKey(options) {
+        return (0, _nestjsshared.buildPermissionCacheKey)(options, this.guardConfig);
     }
-    buildCacheKey(prefix, options) {
-        const { userId, companyId, branchId, enableCompanyFeature } = options;
-        if (enableCompanyFeature && companyId) {
-            return `${prefix}:company:${companyId}:branch:${branchId || 'null'}:user:${userId}`;
-        }
-        return `${prefix}:user:${userId}`;
+    scopeToken(companyId) {
+        return companyId || NO_COMPANY_SCOPE;
     }
-    // Cache Operations
-    async setPermissions(options, permissions) {
-        const key = this.generateCacheKey(options);
-        await this.cacheManager.set(key, permissions, this.TTL);
+    buildTrackedKeysKey(userId, companyId) {
+        return `${this.TRACKED_KEYS_PREFIX}:user:${userId}:company:${this.scopeToken(companyId)}`;
     }
-    // My-Permissions Cache Operations
+    buildTrackedScopesKey(userId) {
+        return `${this.TRACKED_SCOPES_PREFIX}:user:${userId}`;
+    }
+    // Cache Operations
     async setMyPermissions(options, data) {
-        const key = this.generateMyPermissionsCacheKey(options);
+        const key = this.buildCacheKey(options);
         await this.cacheManager.set(key, data, this.TTL);
+        await this.trackKey(options.userId, key, options.companyId);
     }
     async getMyPermissions(options) {
         try {
-            const key = this.generateMyPermissionsCacheKey(options);
+            const key = this.buildCacheKey(options);
             const result = await this.cacheManager.get(key);
             return result || null;
         } catch  {
             return null;
         }
     }
-    // Action Code Cache Operations (tenant-aware for multi-tenant mode)
-    /** Generate tenant-aware cache key for action codes */ generateActionCodeCacheKey(tenantId) {
-        if (tenantId) {
-            return `${this.ACTION_CODE_PREFIX}:tenant:${tenantId}:map`;
-        }
-        return `${this.ACTION_CODE_PREFIX}:map`;
-    }
-    async setActionCodeMap(codeToIdMap, tenantId) {
-        const key = this.generateActionCodeCacheKey(tenantId);
-        await this.cacheManager.set(key, codeToIdMap, this.ACTION_CODE_TTL);
-    }
-    async getActionIdsByCodes(codes, tenantId) {
+    async trackKey(userId, key, companyId) {
         try {
-            const key = this.generateActionCodeCacheKey(tenantId);
-            const fullMap = await this.cacheManager.get(key);
-            if (!fullMap) {
-                return null;
+            const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
+            const keys = await this.cacheManager.get(trackedKeysKey) || [];
+            if (!keys.includes(key)) {
+                keys.push(key);
+                await this.cacheManager.set(trackedKeysKey, keys, this.TTL);
             }
-            const result = {};
-            for (const code of codes){
-                if (fullMap[code]) {
-                    result[code] = fullMap[code];
-                }
+            const scopesKey = this.buildTrackedScopesKey(userId);
+            const scopes = await this.cacheManager.get(scopesKey) || [];
+            const scope = this.scopeToken(companyId);
+            if (!scopes.includes(scope)) {
+                scopes.push(scope);
+                await this.cacheManager.set(scopesKey, scopes, this.TTL);
             }
-            return Object.keys(result).length > 0 ? result : null;
         } catch  {
-            return null;
+        // tracking is best-effort; a missed entry only widens invalidation, never narrows it
         }
     }
     // Cache Invalidation
     async invalidateUser(userId, companyId, branchIds) {
-        const keysToDelete = [
-            `${this.CACHE_PREFIX}:user:${userId}`,
-            `${this.MY_PERMISSIONS_PREFIX}:user:${userId}`
-        ];
         if (companyId) {
-            const branches = branchIds?.length ? branchIds : [
-                null
-            ];
-            for (const branchId of branches){
-                keysToDelete.push(`${this.CACHE_PREFIX}:company:${companyId}:branch:${branchId || 'null'}:user:${userId}`, `${this.MY_PERMISSIONS_PREFIX}:company:${companyId}:branch:${branchId || 'null'}:user:${userId}`);
+            await this.invalidateScope(userId, companyId, branchIds);
+            return;
+        }
+        // No company scope given: clear every company/branch scope tracked for this user
+        const scopesKey = this.buildTrackedScopesKey(userId);
+        let scopes = [];
+        try {
+            scopes = await this.cacheManager.get(scopesKey) || [];
+        } catch  {
+            scopes = [];
+        }
+        await Promise.all(scopes.map((scope)=>this.invalidateScope(userId, scope === NO_COMPANY_SCOPE ? null : scope, branchIds)));
+        await this.cacheManager.del(scopesKey);
+    }
+    async invalidateScope(userId, companyId, branchIds) {
+        const keysToDelete = new Set();
+        const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
+        let trackedKeys = [];
+        try {
+            trackedKeys = await this.cacheManager.get(trackedKeysKey) || [];
+        } catch  {
+            trackedKeys = [];
+        }
+        if (!branchIds?.length) {
+            trackedKeys.forEach((key)=>keysToDelete.add(key));
+            keysToDelete.add(trackedKeysKey);
+        } else {
+            // Branch scope given: only invalidate those branches, keep the rest tracked
+            branchIds.forEach((branchId)=>keysToDelete.add(this.buildCacheKey({
+                    userId,
+                    companyId,
+                    branchId
+                })));
+            const remainingKeys = trackedKeys.filter((key)=>!keysToDelete.has(key));
+            if (remainingKeys.length) {
+                await this.cacheManager.set(trackedKeysKey, remainingKeys, this.TTL);
+            } else {
+                keysToDelete.add(trackedKeysKey);
             }
         }
-        await Promise.all(keysToDelete.map((key)=>this.cacheManager.del(key)));
+        await Promise.all([
+            ...keysToDelete
+        ].map((key)=>this.cacheManager.del(key)));
     }
     async invalidateUsers(userIds, companyId, branchIds) {
         if (userIds.length === 0) {
@@ -123,39 +169,19 @@ let PermissionCacheService = class PermissionCacheService {
         const results = await Promise.allSettled(userIds.map((userId)=>this.invalidateUser(userId, companyId, branchIds)));
         return results.filter((r)=>r.status === 'fulfilled').length;
     }
-    async invalidateRole(_roleId, userIds, companyId, branchIds) {
-        if (userIds.length === 0) {
-            return 0;
-        }
-        return await this.invalidateUsers(userIds, companyId, branchIds);
-    }
-    constructor(cacheManager){
+    constructor(cacheManager, guardConfig){
         _define_property(this, "cacheManager", void 0);
-        _define_property(this, "TTL", void 0); // 1 hour
-        _define_property(this, "ACTION_CODE_TTL", void 0); // 2 hours for action codes (less frequent changes)
-        _define_property(this, "CACHE_PREFIX", void 0);
-        _define_property(this, "MY_PERMISSIONS_PREFIX", void 0);
-        _define_property(this, "ACTION_CODE_PREFIX", void 0);
+        _define_property(this, "guardConfig", void 0);
+        _define_property(this, "TRACKED_KEYS_PREFIX", void 0);
+        _define_property(this, "TRACKED_SCOPES_PREFIX", void 0);
+        _define_property(this, "TTL", void 0);
         this.cacheManager = cacheManager;
-        this.TTL = 3600000;
-        this.ACTION_CODE_TTL = 7200000;
-        this.CACHE_PREFIX = 'permissions';
-        this.MY_PERMISSIONS_PREFIX = 'my-permissions';
-        this.ACTION_CODE_PREFIX = 'action-codes';
+        this.guardConfig = guardConfig;
+        this.TRACKED_KEYS_PREFIX = 'permission-tracked-keys';
+        this.TRACKED_SCOPES_PREFIX = 'permission-tracked-scopes';
+        this.TTL = this.parseDurationMs(_config.envConfig.getJwtConfig().refreshExpiration);
     }
 };
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'permissionCache.setPermissions',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof PermissionCacheKeyOptions === "undefined" ? Object : PermissionCacheKeyOptions,
-        Array
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "setPermissions", null);
 _ts_decorate([
     (0, _nestjsshared.LogAction)({
         action: 'permissionCache.setMyPermissions',
@@ -163,23 +189,11 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof PermissionCacheKeyOptions === "undefined" ? Object : PermissionCacheKeyOptions,
+        typeof _nestjsshared.PermissionCacheKeyOptions === "undefined" ? Object : _nestjsshared.PermissionCacheKeyOptions,
         typeof CachedMyPermissions === "undefined" ? Object : CachedMyPermissions
     ]),
     _ts_metadata("design:returntype", Promise)
 ], PermissionCacheService.prototype, "setMyPermissions", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'permissionCache.setActionCodeMap',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof Record === "undefined" ? Object : Record,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "setActionCodeMap", null);
 _ts_decorate([
     (0, _nestjsshared.LogAction)({
         action: 'permissionCache.invalidateUser',
@@ -206,25 +220,14 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], PermissionCacheService.prototype, "invalidateUsers", null);
-_ts_decorate([
-    (0, _nestjsshared.LogAction)({
-        action: 'permissionCache.invalidateRole',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        Array,
-        Object,
-        Array
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "invalidateRole", null);
 PermissionCacheService = _ts_decorate([
     (0, _common.Injectable)(),
     _ts_param(0, (0, _common.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0, _common.Optional)()),
+    _ts_param(1, (0, _common.Inject)(_nestjsshared.PERMISSION_GUARD_CONFIG)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _nestjsshared.HybridCache === "undefined" ? Object : _nestjsshared.HybridCache
+        typeof _nestjsshared.HybridCache === "undefined" ? Object : _nestjsshared.HybridCache,
+        typeof _nestjsshared.PermissionGuardConfig === "undefined" ? Object : _nestjsshared.PermissionGuardConfig
     ])
 ], PermissionCacheService);