@flusys/nestjs-iam 6.0.0 → 6.0.2

package/cjs/services/permission.service.js

@@ -18,9 +18,9 @@ const _permissionwithcompanyentity = require("../entities/permission-with-compan
 const _rolewithcompanyentity = require("../entities/role-with-company.entity");
 const _roleentity = require("../entities/role.entity");
 const _useriampermissionentity = require("../entities/user-iam-permission.entity");
+const _actiontypeenum = require("../enums/action-type.enum");
 const _iamentitytypeenum = require("../enums/iam-entity-type.enum");
 const _iampermissiontypeenum = require("../enums/iam-permission-type.enum");
-const _actiontypeenum = require("../enums/action-type.enum");
 const _permissiontypeenum = require("../enums/permission-type.enum");
 const _iamconfigservice = require("./iam-config.service");
 const _iamdatasourceservice = require("./iam-datasource.service");
@@ -67,6 +67,18 @@ let PermissionService = class PermissionService {
         const entity = enableCompanyFeature ? _rolewithcompanyentity.RoleWithCompany : _roleentity.Role;
         return this.dataSourceProvider.getRepository(entity);
     }
+    async getActionsMap(actionIds) {
+        const actionRepo = await this.getActionRepository();
+        const actions = await actionRepo.find({
+            where: {
+                id: (0, _typeorm.In)(actionIds)
+            }
+        });
+        return new Map(actions.map((a)=>[
+                a.id,
+                a
+            ]));
+    }
     // User-Action Permissions
     async assignUserActions(dto) {
         if (!this.iamConfigService.isDirectPermissionEnabled()) {
@@ -143,12 +155,13 @@ let PermissionService = class PermissionService {
             const result = await permissionRepo.delete(whereDelete);
             removed = result.affected || 0;
         }
-        await this.invalidateUserPermissionCache(dto.userId, branchId, companyId);
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
+            branchId
+        ]);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
     async getUserActions(userId, branchId, companyId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const where = {
             permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
@@ -166,16 +179,7 @@ let PermissionService = class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actionWhere = {
-            id: (0, _typeorm.In)(actionIds)
-        };
-        const actions = await actionRepo.find({
-            where: actionWhere
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -272,7 +276,6 @@ let PermissionService = class PermissionService {
     }
     async getRoleActions(roleId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const permissions = await permissionRepo.find({
             where: {
                 permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
@@ -284,16 +287,7 @@ let PermissionService = class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actionWhere = {
-            id: (0, _typeorm.In)(actionIds)
-        };
-        const actions = await actionRepo.find({
-            where: actionWhere
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -320,8 +314,7 @@ let PermissionService = class PermissionService {
             }
             if (itemsToRemove.length > 0) {
                 const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
-                const cascadeResult = await this.removeCompanyActionsWithCascade(manager, dto.companyId, actionIdsToRemove);
-                removed = cascadeResult.removedCompanyActions;
+                removed = await this.removeCompanyActionsWithCascade(manager, dto.companyId, actionIdsToRemove);
             }
         });
         await this.invalidateCompanyMembersCache(dto.companyId);
@@ -377,37 +370,28 @@ let PermissionService = class PermissionService {
                 'id'
             ]
         });
-        let removedRoleActions = 0;
-        let removedUserActions = 0;
         if (companyRoles.length > 0) {
             const roleIds = companyRoles.map((role)=>role.id);
-            const roleResult = await permissionRepo.delete({
+            await permissionRepo.delete({
                 permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
                 sourceType: _iamentitytypeenum.IamEntityType.ROLE,
                 sourceId: (0, _typeorm.In)(roleIds),
                 targetType: _iamentitytypeenum.IamEntityType.ACTION,
                 targetId: (0, _typeorm.In)(actionIds)
             });
-            removedRoleActions = roleResult.affected || 0;
         }
         if (this.iamConfigService.isCompanyFeatureEnabled()) {
-            const userResult = await permissionRepo.delete({
+            await permissionRepo.delete({
                 permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
                 companyId,
                 targetType: _iamentitytypeenum.IamEntityType.ACTION,
                 targetId: (0, _typeorm.In)(actionIds)
             });
-            removedUserActions = userResult.affected || 0;
         }
-        return {
-            removedCompanyActions: companyResult.affected || 0,
-            removedRoleActions,
-            removedUserActions
-        };
+        return companyResult.affected || 0;
     }
     /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const permissions = await permissionRepo.find({
             where: {
                 permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION,
@@ -419,15 +403,7 @@ let PermissionService = class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actions = await actionRepo.find({
-            where: {
-                id: (0, _typeorm.In)(actionIds)
-            }
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -530,7 +506,9 @@ let PermissionService = class PermissionService {
             const result = await permissionRepo.delete(whereDelete);
             removed = result.affected || 0;
         }
-        await this.invalidateUserPermissionCache(dto.userId, branchId, companyId);
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
+            branchId
+        ]);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
     /** Get user's roles (branch-scoped, filtered by companyId and branchId if provided) */ async getUserRoles(userId, branchId, companyId) {
@@ -581,9 +559,8 @@ let PermissionService = class PermissionService {
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const cacheOptions = {
             userId,
-            companyId,
-            branchId,
-            enableCompanyFeature
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId
         };
         const cachedData = await this.permissionCacheService.getMyPermissions(cacheOptions);
         if (cachedData) {
@@ -612,42 +589,25 @@ let PermissionService = class PermissionService {
             cachedEndpoints: cachedData.backendCodes.length
         };
     }
-    /** Get current tenant ID for multi-tenant cache keys */ getCurrentTenantId() {
-        if (!this.iamConfigService.isMultiTenant()) {
-            return undefined;
-        }
-        const tenant = this.dataSourceProvider.getCurrentTenant();
-        return tenant?.id;
-    }
-    /** Get parent IDs by codes, using cache first (tenant-aware) */ async getParentIdsByCodesWithCache(codes) {
-        const tenantId = this.getCurrentTenantId();
-        const cachedMap = await this.permissionCacheService.getActionIdsByCodes(codes, tenantId);
-        if (cachedMap) {
-            return new Set(Object.values(cachedMap));
-        }
+    /** Resolve action IDs for the given codes */ async getParentIdsByCodesWithCache(codes) {
         const actionRepo = await this.getActionRepository();
-        const allActions = await actionRepo.find({
+        const actions = await actionRepo.find({
+            where: {
+                code: (0, _typeorm.In)(codes)
+            },
             select: [
                 'id',
                 'code'
             ]
         });
-        const fullMap = {};
-        for (const action of allActions){
-            if (action.code) {
-                fullMap[action.code] = action.id;
-            }
-        }
-        await this.permissionCacheService.setActionCodeMap(fullMap, tenantId);
-        return new Set(codes.map((code)=>fullMap[code]).filter(Boolean));
+        return new Set(actions.map((action)=>action.id));
     }
     /** Fetch permissions from DB and cache them (empty permissions are also cached) */ async fetchAndCachePermissions(userId, branchId, companyId) {
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const cacheOptions = {
             userId,
-            companyId,
-            branchId,
-            enableCompanyFeature
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId
         };
         const emptyData = {
             frontendActions: [],
@@ -700,7 +660,8 @@ let PermissionService = class PermissionService {
         const actionRepo = await this.getActionRepository();
         const actions = await actionRepo.find({
             where: {
-                id: (0, _typeorm.In)(Array.from(actionIds))
+                id: (0, _typeorm.In)(Array.from(actionIds)),
+                isActive: true
             }
         });
         const backendActions = actions.filter((a)=>a.actionType === _actiontypeenum.ActionType.BACKEND || a.actionType === _actiontypeenum.ActionType.BOTH);
@@ -716,10 +677,7 @@ let PermissionService = class PermissionService {
                 })),
             backendCodes
         };
-        await Promise.all([
-            this.permissionCacheService.setMyPermissions(cacheOptions, cacheData),
-            this.permissionCacheService.setPermissions(cacheOptions, backendCodes)
-        ]);
+        await this.permissionCacheService.setMyPermissions(cacheOptions, cacheData);
         return cacheData;
     }
     // Helper Methods
@@ -753,9 +711,11 @@ let PermissionService = class PermissionService {
         const baseWhere = {
             permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
             sourceType: _iamentitytypeenum.IamEntityType.USER,
-            sourceId: userId,
-            companyId: companyId
+            sourceId: userId
         };
+        if (companyId) {
+            baseWhere.companyId = companyId;
+        }
         if (branchId) {
             // Get company-wide + branch-specific roles
             const companyWidePermissions = await permissionRepo.find({
@@ -839,14 +799,6 @@ let PermissionService = class PermissionService {
         }
         return Array.from(actionIds);
     }
-    /** Invalidate permission cache for a user */ async invalidateUserPermissionCache(userId, branchId, companyId) {
-        const branchIds = branchId !== undefined ? [
-            branchId
-        ] : [
-            null
-        ];
-        await this.permissionCacheService.invalidateUser(userId, companyId, branchIds);
-    }
     async invalidateRoleMembersCache(roleId) {
         const permissionRepo = await this.getPermissionRepository();
         const roleRepo = await this.getRoleRepository();
@@ -884,7 +836,7 @@ let PermissionService = class PermissionService {
                 ...new Set(userBranches.map((p)=>p.branchId))
             ];
         }
-        return this.permissionCacheService.invalidateRole(roleId, userIds, companyId, branchIds);
+        return this.permissionCacheService.invalidateUsers(userIds, companyId, branchIds);
     }
     /** Invalidate permission cache for all users in a company */ async invalidateCompanyMembersCache(companyId) {
         if (!this.iamConfigService.isCompanyFeatureEnabled()) {
@@ -905,6 +857,127 @@ let PermissionService = class PermissionService {
         }
         return await this.permissionCacheService.invalidateUsers(userIds, companyId, branchIds);
     }
+    async revokeCompanyPermissions(companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const roleRepo = await this.getRoleRepository();
+        const dataSource = permissionRepo.manager.connection;
+        const companyRoles = await roleRepo.find({
+            where: {
+                companyId,
+                deletedAt: (0, _typeorm.IsNull)()
+            },
+            select: [
+                'id'
+            ]
+        });
+        const roleIds = companyRoles.map((role)=>role.id);
+        const affectedUserRows = await permissionRepo.find({
+            where: {
+                permissionType: (0, _typeorm.In)([
+                    _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                    _iampermissiontypeenum.IamPermissionType.USER_ACTION
+                ]),
+                companyId
+            },
+            select: [
+                'userId'
+            ]
+        });
+        const affectedUserIds = [
+            ...new Set(affectedUserRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await dataSource.transaction(async (manager)=>{
+            const txRepo = manager.getRepository(permissionRepo.target);
+            await txRepo.delete({
+                permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION,
+                sourceType: _iamentitytypeenum.IamEntityType.COMPANY,
+                sourceId: companyId
+            });
+            if (roleIds.length > 0) {
+                await txRepo.delete({
+                    permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
+                    sourceType: _iamentitytypeenum.IamEntityType.ROLE,
+                    sourceId: (0, _typeorm.In)(roleIds)
+                });
+            }
+            await txRepo.delete({
+                permissionType: (0, _typeorm.In)([
+                    _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                    _iampermissiontypeenum.IamPermissionType.USER_ACTION
+                ]),
+                companyId
+            });
+            if (roleIds.length > 0) {
+                const txRoleRepo = manager.getRepository(roleRepo.target);
+                await txRoleRepo.delete(roleIds);
+            }
+        });
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId);
+        }
+    }
+    async revokeBranchPermissions(branchId, companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const where = {
+            permissionType: (0, _typeorm.In)([
+                _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                _iampermissiontypeenum.IamPermissionType.USER_ACTION
+            ]),
+            branchId,
+            companyId
+        };
+        const affectedUserRows = await permissionRepo.find({
+            where,
+            select: [
+                'userId'
+            ]
+        });
+        const affectedUserIds = [
+            ...new Set(affectedUserRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await permissionRepo.delete(where);
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId, [
+                branchId
+            ]);
+        }
+    }
+    async revokeUserCompanyAccess(userId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        await permissionRepo.delete({
+            permissionType: (0, _typeorm.In)([
+                _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                _iampermissiontypeenum.IamPermissionType.USER_ACTION
+            ]),
+            sourceType: _iamentitytypeenum.IamEntityType.USER,
+            sourceId: userId,
+            companyId
+        });
+        await this.permissionCacheService.invalidateUser(userId, companyId);
+    }
+    async revokeUserBranchAccess(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const where = {
+            permissionType: (0, _typeorm.In)([
+                _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                _iampermissiontypeenum.IamPermissionType.USER_ACTION
+            ]),
+            sourceType: _iamentitytypeenum.IamEntityType.USER,
+            sourceId: userId,
+            branchId,
+            companyId
+        };
+        await permissionRepo.delete(where);
+        await this.permissionCacheService.invalidateUser(userId, companyId, [
+            branchId
+        ]);
+    }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(permissionCacheService, iamConfigService, dataSourceProvider){
         _define_property(this, "permissionCacheService", void 0);
@@ -959,6 +1032,54 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], PermissionService.prototype, "assignUserRoles", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'iam.revokeCompanyPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeCompanyPermissions", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'iam.revokeBranchPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeBranchPermissions", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'iam.revokeUserCompanyAccess',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeUserCompanyAccess", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'iam.revokeUserBranchAccess',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeUserBranchAccess", null);
 PermissionService = _ts_decorate([
     (0, _common.Injectable)({
         scope: _common.Scope.REQUEST

package/cjs/services/role.service.js

@@ -12,10 +12,16 @@ const _classes = require("@flusys/nestjs-shared/classes");
 const _modules = require("@flusys/nestjs-shared/modules");
 const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
+const _typeorm = require("typeorm");
+const _permissionwithcompanyentity = require("../entities/permission-with-company.entity");
 const _rolewithcompanyentity = require("../entities/role-with-company.entity");
 const _roleentity = require("../entities/role.entity");
+const _useriampermissionentity = require("../entities/user-iam-permission.entity");
+const _iamentitytypeenum = require("../enums/iam-entity-type.enum");
+const _iampermissiontypeenum = require("../enums/iam-permission-type.enum");
 const _iamconfigservice = require("./iam-config.service");
 const _iamdatasourceservice = require("./iam-datasource.service");
+const _permissioncacheservice = require("./permission-cache.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -44,6 +50,42 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let RoleService = class RoleService extends _classes.ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        await super.beforeDeleteOperation(dto, user, queryRunner);
+        const roleIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        if (roleIds.length === 0) {
+            return;
+        }
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const permissionEntity = enableCompanyFeature ? _permissionwithcompanyentity.UserIamPermissionWithCompany : _useriampermissionentity.UserIamPermission;
+        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
+        const userRoleRows = await permissionRepo.find({
+            where: {
+                permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                sourceType: _iamentitytypeenum.IamEntityType.USER,
+                targetType: _iamentitytypeenum.IamEntityType.ROLE,
+                targetId: (0, _typeorm.In)(roleIds)
+            }
+        });
+        const affectedUserIds = [
+            ...new Set(userRoleRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await permissionRepo.delete({
+            permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
+            sourceType: _iamentitytypeenum.IamEntityType.ROLE,
+            sourceId: (0, _typeorm.In)(roleIds)
+        });
+        await permissionRepo.delete({
+            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+            targetType: _iamentitytypeenum.IamEntityType.ROLE,
+            targetId: (0, _typeorm.In)(roleIds)
+        });
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds);
+        }
+    }
     resolveEntity() {
         return this.iamConfigService.isCompanyFeatureEnabled() ? _rolewithcompanyentity.RoleWithCompany : _roleentity.Role;
     }
@@ -117,8 +159,8 @@ let RoleService = class RoleService extends _classes.ApiService {
             deletedById: entity.deletedById
         };
     }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider){
-        super('role', cacheManager, utilsService, RoleService.name, true, 'iam', undefined, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService;
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionCacheService){
+        super('role', cacheManager, utilsService, RoleService.name, true, 'iam', undefined, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionCacheService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionCacheService = permissionCacheService;
     }
 };
 RoleService = _ts_decorate([
@@ -129,11 +171,13 @@ RoleService = _ts_decorate([
     _ts_param(1, (0, _common.Inject)(_modules.UtilsService)),
     _ts_param(2, (0, _common.Inject)(_iamconfigservice.IAMConfigService)),
     _ts_param(3, (0, _common.Inject)(_iamdatasourceservice.IAMDataSourceService)),
+    _ts_param(4, (0, _common.Inject)(_permissioncacheservice.PermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
         typeof _iamconfigservice.IAMConfigService === "undefined" ? Object : _iamconfigservice.IAMConfigService,
-        typeof _iamdatasourceservice.IAMDataSourceService === "undefined" ? Object : _iamdatasourceservice.IAMDataSourceService
+        typeof _iamdatasourceservice.IAMDataSourceService === "undefined" ? Object : _iamdatasourceservice.IAMDataSourceService,
+        typeof _permissioncacheservice.PermissionCacheService === "undefined" ? Object : _permissioncacheservice.PermissionCacheService
     ])
 ], RoleService);

package/controllers/action.controller.d.ts

@@ -1,6 +1,7 @@
 import { ILoggedUserInfo, SingleResponseDto } from '@flusys/nestjs-shared';
-import { ActionResponseDto, ActionTreeQueryDto, CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
+import { ActionResponseDto, ActionTreeForPermissionDto, ActionTreeQueryDto, CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
 import { ActionService } from '../services/action.service';
+import { IAMConfigService } from '../services/iam-config.service';
 declare const ActionController_base: abstract new (service: ActionService) => {
     readonly enabledEndpoints: import("@flusys/nestjs-shared").ApiEndpoint[] | "all";
     service: ActionService;
@@ -18,8 +19,9 @@ declare const ActionController_base: abstract new (service: ActionService) => {
 };
 export declare class ActionController extends ActionController_base {
     actionService: ActionService;
-    constructor(actionService: ActionService);
-    getActionsForPermission(user: ILoggedUserInfo): Promise<SingleResponseDto<ActionResponseDto[]>>;
+    private readonly iamConfigService;
+    constructor(actionService: ActionService, iamConfigService: IAMConfigService);
+    getActionsForPermission(dto: ActionTreeForPermissionDto, user: ILoggedUserInfo): Promise<SingleResponseDto<ActionResponseDto[]>>;
     getActionTree(query: ActionTreeQueryDto, user: ILoggedUserInfo): Promise<SingleResponseDto<ActionResponseDto[]>>;
 }
 export {};

package/dtos/action.dto.d.ts

@@ -29,6 +29,9 @@ export declare class ActionResponseDto extends IdentityResponseDto {
 export declare class ActionTreeDto extends ActionResponseDto {
     children: ActionTreeDto[];
 }
+export declare class ActionTreeForPermissionDto {
+    companyId?: string;
+}
 export declare class ActionTreeQueryDto {
     search?: string;
     isActive?: boolean;

package/entities/index.d.ts

@@ -9,7 +9,7 @@ import { UserIamPermissionWithCompany } from './permission-with-company.entity';
 import { RoleWithCompany } from './role-with-company.entity';
 import { Role } from './role.entity';
 import { UserIamPermission } from './user-iam-permission.entity';
-export declare const IAMCoreEntities: (typeof Role | typeof UserIamPermission)[];
+export declare const IAMCoreEntities: (typeof UserIamPermission | typeof Role)[];
 export declare const IAMCompanyEntities: (typeof UserIamPermissionWithCompany | typeof RoleWithCompany)[];
-export declare const IAMAllEntities: (typeof Role | typeof UserIamPermission)[];
+export declare const IAMAllEntities: (typeof UserIamPermission | typeof Role)[];
 export declare function getIAMEntitiesByConfig(enableCompanyFeature: boolean, permissionMode?: 'FULL' | 'RBAC' | 'DIRECT'): any[];

package/fesm/controllers/action.controller.js

@@ -25,13 +25,14 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
+import { ACTION_PERMISSIONS, createApiController, CurrentUser, ILoggedUserInfo, SingleResponseDto } from '@flusys/nestjs-shared';
 import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
-import { createApiController, CurrentUser, ILoggedUserInfo, SingleResponseDto, ACTION_PERMISSIONS } from '@flusys/nestjs-shared';
-import { ACTION_MESSAGES } from '../config';
 import { Body, Controller, Inject, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
-import { ActionResponseDto, ActionTreeQueryDto, CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
+import { ACTION_MESSAGES } from '../config';
+import { ActionResponseDto, ActionTreeForPermissionDto, ActionTreeQueryDto, CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
 import { ActionService } from '../services/action.service';
+import { IAMConfigService } from '../services/iam-config.service';
 export class ActionController extends createApiController(CreateActionDto, UpdateActionDto, ActionResponseDto, {
     entityName: 'action',
     security: {
@@ -79,8 +80,8 @@ export class ActionController extends createApiController(CreateActionDto, Updat
         }
     }
 }) {
-    async getActionsForPermission(user) {
-        const actions = await this.actionService.getActionsForPermission(user);
+    async getActionsForPermission(dto, user) {
+        const actions = await this.actionService.getActionsForPermission(user, dto?.companyId);
         return {
             success: true,
             message: 'Actions retrieved successfully',
@@ -97,8 +98,8 @@ export class ActionController extends createApiController(CreateActionDto, Updat
             data: tree
         };
     }
-    constructor(actionService){
-        super(actionService), _define_property(this, "actionService", void 0), this.actionService = actionService;
+    constructor(actionService, iamConfigService){
+        super(actionService), _define_property(this, "actionService", void 0), _define_property(this, "iamConfigService", void 0), this.actionService = actionService, this.iamConfigService = iamConfigService;
     }
 }
 _ts_decorate([
@@ -107,15 +108,20 @@ _ts_decorate([
     ApiBearerAuth(),
     ApiOperation({
         summary: 'Get actions for permission assignment',
-        description: 'Returns actions available for permission assignment. If company feature enabled, filtered by company whitelist.'
+        description: "Returns actions available for permission assignment, filtered by company whitelist when company feature is enabled. Optional companyId scopes the whitelist to a specific company (must match the caller's own company); defaults to the caller's session company when omitted."
     }),
     ApiResponse({
         status: 200,
         type: SingleResponseDto
     }),
-    _ts_param(0, CurrentUser()),
+    ApiBody({
+        type: ActionTreeForPermissionDto
+    }),
+    _ts_param(0, Body()),
+    _ts_param(1, CurrentUser()),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        typeof ActionTreeForPermissionDto === "undefined" ? Object : ActionTreeForPermissionDto,
         typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -149,8 +155,10 @@ ActionController = _ts_decorate([
     ApiTags('IAM - Actions'),
     Controller('iam/actions'),
     _ts_param(0, Inject(ActionService)),
+    _ts_param(1, Inject(IAMConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof ActionService === "undefined" ? Object : ActionService
+        typeof ActionService === "undefined" ? Object : ActionService,
+        typeof IAMConfigService === "undefined" ? Object : IAMConfigService
     ])
 ], ActionController);