@flusys/nestjs-iam 6.0.0 → 6.0.2

package/fesm/controllers/user-action-permission.controller.js

@@ -30,12 +30,10 @@ import { Body, Controller, Inject, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { PERMISSION_OPERATION_MESSAGES, USER_ACTION_PERMISSION_MESSAGES } from '../config';
 import { AssignUserActionsDto, GetUserActionsDto, PermissionOperationResultDto, UserActionResponseDto } from '../dtos/permission.dto';
-import { validateCompanyAccess } from '../helpers';
 import { IAMConfigService } from '../services/iam-config.service';
 import { PermissionService } from '../services/permission.service';
 export class UserActionPermissionController {
     async assignUserActions(dto, user) {
-        validateCompanyAccess(this.config, dto.companyId, user);
         const result = await this.permissionService.assignUserActions(dto);
         return {
             success: true,
@@ -50,7 +48,6 @@ export class UserActionPermissionController {
         };
     }
     async getUserActions(dto, user) {
-        validateCompanyAccess(this.config, dto.companyId, user);
         const actions = await this.permissionService.getUserActions(dto.userId, dto.branchId, dto.companyId);
         return {
             success: true,

package/fesm/docs/iam-swagger.config.js

@@ -39,6 +39,12 @@ export function iamSwaggerConfig(enableCompanyFeature = false, permissionMode =
                 'branchId'
             ]
         },
+        {
+            schemaName: 'ActionTreeForPermissionDto',
+            properties: [
+                'companyId'
+            ]
+        },
         // Response DTOs with branchId
         {
             schemaName: 'UserActionResponseDto',

package/fesm/dtos/action.dto.js

@@ -199,6 +199,20 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Array)
 ], ActionTreeDto.prototype, "children", void 0);
+export class ActionTreeForPermissionDto {
+    constructor(){
+        _define_property(this, "companyId", void 0);
+    }
+}
+_ts_decorate([
+    ApiProperty({
+        description: 'Company to scope the action whitelist to. Defaults to the current user session company when omitted.',
+        required: false
+    }),
+    IsUUID(),
+    IsOptional(),
+    _ts_metadata("design:type", String)
+], ActionTreeForPermissionDto.prototype, "companyId", void 0);
 export class ActionTreeQueryDto {
     constructor(){
         _define_property(this, "search", void 0);

package/fesm/modules/iam.module.js

@@ -14,7 +14,7 @@ import { PermissionModeHelper } from '../helpers';
 import { ActionService, PermissionService, RoleService } from '../services';
 import { IAMConfigService } from '../services/iam-config.service';
 import { IAMDataSourceService } from '../services/iam-datasource.service';
-import { PermissionCacheService } from '../services/permission-cache.service';
+import { MY_PERMISSIONS_CACHE_PREFIX, PermissionCacheService } from '../services/permission-cache.service';
 export class IAMModule {
     static getControllers(permissionMode, enableCompanyFeature) {
         const baseControllers = [
@@ -58,7 +58,9 @@ export class IAMModule {
         return {
             provide: PERMISSION_GUARD_CONFIG,
             useValue: {
-                enableCompanyFeature
+                enableCompanyFeature,
+                userPermissionKeyFormat: `${MY_PERMISSIONS_CACHE_PREFIX}:user:{userId}`,
+                companyPermissionKeyFormat: `${MY_PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`
             }
         };
     }

package/fesm/services/action.service.js

@@ -31,10 +31,90 @@ import { BadRequestException, Inject, Injectable, Scope } from '@nestjs/common';
 import { In } from 'typeorm';
 import { PERMISSION_OPERATION_MESSAGES } from '../config';
 import { Action } from '../entities/action.entity';
+import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
+import { UserIamPermission } from '../entities/user-iam-permission.entity';
+import { IamEntityType } from '../enums/iam-entity-type.enum';
+import { IamPermissionType } from '../enums/iam-permission-type.enum';
 import { IAMConfigService } from './iam-config.service';
 import { IAMDataSourceService } from './iam-datasource.service';
+import { PermissionCacheService } from './permission-cache.service';
 import { PermissionService } from './permission.service';
 export class ActionService extends ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const actionIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        if (actionIds.length === 0) {
+            return;
+        }
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const permissionEntity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
+        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
+        const [roleActionRows, userActionRows, companyActionRows] = await Promise.all([
+            permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.ROLE_ACTION,
+                    sourceType: IamEntityType.ROLE,
+                    targetType: IamEntityType.ACTION,
+                    targetId: In(actionIds)
+                }
+            }),
+            permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.USER_ACTION,
+                    targetType: IamEntityType.ACTION,
+                    targetId: In(actionIds)
+                }
+            }),
+            enableCompanyFeature ? permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.COMPANY_ACTION,
+                    sourceType: IamEntityType.COMPANY,
+                    targetType: IamEntityType.ACTION,
+                    targetId: In(actionIds)
+                }
+            }) : Promise.resolve([])
+        ]);
+        const affectedUserIds = new Set(userActionRows.map((row)=>row.userId).filter((id)=>!!id));
+        const affectedCompanyIds = [
+            ...new Set(companyActionRows.map((row)=>row.sourceId).filter((id)=>!!id))
+        ];
+        const affectedRoleIds = [
+            ...new Set(roleActionRows.map((row)=>row.sourceId))
+        ];
+        if (affectedRoleIds.length > 0) {
+            const userRoleRows = await permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.USER_ROLE,
+                    targetType: IamEntityType.ROLE,
+                    targetId: In(affectedRoleIds)
+                }
+            });
+            userRoleRows.forEach((row)=>row.userId && affectedUserIds.add(row.userId));
+        }
+        await permissionRepo.delete({
+            permissionType: IamPermissionType.ROLE_ACTION,
+            targetType: IamEntityType.ACTION,
+            targetId: In(actionIds)
+        });
+        await permissionRepo.delete({
+            permissionType: IamPermissionType.USER_ACTION,
+            targetType: IamEntityType.ACTION,
+            targetId: In(actionIds)
+        });
+        await permissionRepo.delete({
+            permissionType: IamPermissionType.COMPANY_ACTION,
+            sourceType: IamEntityType.COMPANY,
+            targetType: IamEntityType.ACTION,
+            targetId: In(actionIds)
+        });
+        await Promise.all([
+            affectedUserIds.size > 0 ? this.permissionCacheService.invalidateUsers([
+                ...affectedUserIds
+            ]) : Promise.resolve(),
+            ...affectedCompanyIds.map((companyId)=>this.permissionService.invalidateCompanyMembersCache(companyId))
+        ]);
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -98,12 +178,13 @@ export class ActionService extends ApiService {
             });
         }
     }
-    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user) {
+    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user, companyId) {
         await this.ensureDataSourceRepository();
         this.requireUser(user, 'getActionsForPermission');
         let whereClause = {};
-        if (this.iamConfigService.isCompanyFeatureEnabled() && user.companyId) {
-            const companyActionIds = await this.permissionService.getCompanyActionIds(user.companyId);
+        const targetCompanyId = companyId || user.companyId;
+        if (this.iamConfigService.isCompanyFeatureEnabled() && targetCompanyId) {
+            const companyActionIds = await this.permissionService.getCompanyActionIds(targetCompanyId);
             if (companyActionIds.length === 0) {
                 return [];
             }
@@ -166,9 +247,9 @@ export class ActionService extends ApiService {
         }
         return rootNodes;
     }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService){
-        super('action', cacheManager, utilsService, ActionService.name, true, 'iam', Action, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionService", void 0), // Custom Methods
-        _define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.actionSelectFields = [
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService, permissionCacheService){
+        super('action', cacheManager, utilsService, ActionService.name, true, 'iam', Action, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionService", void 0), _define_property(this, "permissionCacheService", void 0), // Custom Methods
+        _define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.permissionCacheService = permissionCacheService, this.actionSelectFields = [
             'id',
             'code',
             'name',
@@ -190,12 +271,14 @@ ActionService = _ts_decorate([
     _ts_param(2, Inject(IAMConfigService)),
     _ts_param(3, Inject(IAMDataSourceService)),
     _ts_param(4, Inject(PermissionService)),
+    _ts_param(5, Inject(PermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof UtilsService === "undefined" ? Object : UtilsService,
         typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
         typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService,
-        typeof PermissionService === "undefined" ? Object : PermissionService
+        typeof PermissionService === "undefined" ? Object : PermissionService,
+        typeof PermissionCacheService === "undefined" ? Object : PermissionCacheService
     ])
 ], ActionService);

package/fesm/services/permission-cache.service.js

@@ -25,86 +25,122 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { HybridCache, LogAction } from '@flusys/nestjs-shared';
-import { Inject, Injectable } from '@nestjs/common';
+import { envConfig } from '@flusys/nestjs-core/config';
+import { buildPermissionCacheKey, HybridCache, LogAction, PERMISSION_GUARD_CONFIG, PERMISSIONS_CACHE_PREFIX, PermissionCacheKeyOptions, PermissionGuardConfig } from '@flusys/nestjs-shared';
+import { Inject, Injectable, Optional } from '@nestjs/common';
+export { PermissionCacheKeyOptions } from '@flusys/nestjs-shared';
+export const MY_PERMISSIONS_CACHE_PREFIX = PERMISSIONS_CACHE_PREFIX;
+const NO_COMPANY_SCOPE = 'none';
 export class PermissionCacheService {
     // Cache Key Generation
-    generateCacheKey(options) {
-        return this.buildCacheKey(this.CACHE_PREFIX, options);
+    parseDurationMs(duration) {
+        const unitMs = {
+            ms: 1,
+            s: 1000,
+            m: 60000,
+            h: 3600000,
+            d: 86400000,
+            w: 604800000
+        };
+        const match = /^(\d+)\s*(ms|s|m|h|d|w)?$/i.exec(duration.trim());
+        if (!match) {
+            return unitMs.h; // fallback: 1 hour
+        }
+        const unit = (match[2] || 'ms').toLowerCase();
+        return Number(match[1]) * unitMs[unit];
     }
-    generateMyPermissionsCacheKey(options) {
-        return this.buildCacheKey(this.MY_PERMISSIONS_PREFIX, options);
+    buildCacheKey(options) {
+        return buildPermissionCacheKey(options, this.guardConfig);
     }
-    buildCacheKey(prefix, options) {
-        const { userId, companyId, branchId, enableCompanyFeature } = options;
-        if (enableCompanyFeature && companyId) {
-            return `${prefix}:company:${companyId}:branch:${branchId || 'null'}:user:${userId}`;
-        }
-        return `${prefix}:user:${userId}`;
+    scopeToken(companyId) {
+        return companyId || NO_COMPANY_SCOPE;
     }
-    // Cache Operations
-    async setPermissions(options, permissions) {
-        const key = this.generateCacheKey(options);
-        await this.cacheManager.set(key, permissions, this.TTL);
+    buildTrackedKeysKey(userId, companyId) {
+        return `${this.TRACKED_KEYS_PREFIX}:user:${userId}:company:${this.scopeToken(companyId)}`;
+    }
+    buildTrackedScopesKey(userId) {
+        return `${this.TRACKED_SCOPES_PREFIX}:user:${userId}`;
     }
-    // My-Permissions Cache Operations
+    // Cache Operations
     async setMyPermissions(options, data) {
-        const key = this.generateMyPermissionsCacheKey(options);
+        const key = this.buildCacheKey(options);
         await this.cacheManager.set(key, data, this.TTL);
+        await this.trackKey(options.userId, key, options.companyId);
     }
     async getMyPermissions(options) {
         try {
-            const key = this.generateMyPermissionsCacheKey(options);
+            const key = this.buildCacheKey(options);
             const result = await this.cacheManager.get(key);
             return result || null;
         } catch  {
             return null;
         }
     }
-    // Action Code Cache Operations (tenant-aware for multi-tenant mode)
-    /** Generate tenant-aware cache key for action codes */ generateActionCodeCacheKey(tenantId) {
-        if (tenantId) {
-            return `${this.ACTION_CODE_PREFIX}:tenant:${tenantId}:map`;
-        }
-        return `${this.ACTION_CODE_PREFIX}:map`;
-    }
-    async setActionCodeMap(codeToIdMap, tenantId) {
-        const key = this.generateActionCodeCacheKey(tenantId);
-        await this.cacheManager.set(key, codeToIdMap, this.ACTION_CODE_TTL);
-    }
-    async getActionIdsByCodes(codes, tenantId) {
+    async trackKey(userId, key, companyId) {
         try {
-            const key = this.generateActionCodeCacheKey(tenantId);
-            const fullMap = await this.cacheManager.get(key);
-            if (!fullMap) {
-                return null;
+            const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
+            const keys = await this.cacheManager.get(trackedKeysKey) || [];
+            if (!keys.includes(key)) {
+                keys.push(key);
+                await this.cacheManager.set(trackedKeysKey, keys, this.TTL);
             }
-            const result = {};
-            for (const code of codes){
-                if (fullMap[code]) {
-                    result[code] = fullMap[code];
-                }
+            const scopesKey = this.buildTrackedScopesKey(userId);
+            const scopes = await this.cacheManager.get(scopesKey) || [];
+            const scope = this.scopeToken(companyId);
+            if (!scopes.includes(scope)) {
+                scopes.push(scope);
+                await this.cacheManager.set(scopesKey, scopes, this.TTL);
             }
-            return Object.keys(result).length > 0 ? result : null;
         } catch  {
-            return null;
+        // tracking is best-effort; a missed entry only widens invalidation, never narrows it
         }
     }
     // Cache Invalidation
     async invalidateUser(userId, companyId, branchIds) {
-        const keysToDelete = [
-            `${this.CACHE_PREFIX}:user:${userId}`,
-            `${this.MY_PERMISSIONS_PREFIX}:user:${userId}`
-        ];
         if (companyId) {
-            const branches = branchIds?.length ? branchIds : [
-                null
-            ];
-            for (const branchId of branches){
-                keysToDelete.push(`${this.CACHE_PREFIX}:company:${companyId}:branch:${branchId || 'null'}:user:${userId}`, `${this.MY_PERMISSIONS_PREFIX}:company:${companyId}:branch:${branchId || 'null'}:user:${userId}`);
+            await this.invalidateScope(userId, companyId, branchIds);
+            return;
+        }
+        // No company scope given: clear every company/branch scope tracked for this user
+        const scopesKey = this.buildTrackedScopesKey(userId);
+        let scopes = [];
+        try {
+            scopes = await this.cacheManager.get(scopesKey) || [];
+        } catch  {
+            scopes = [];
+        }
+        await Promise.all(scopes.map((scope)=>this.invalidateScope(userId, scope === NO_COMPANY_SCOPE ? null : scope, branchIds)));
+        await this.cacheManager.del(scopesKey);
+    }
+    async invalidateScope(userId, companyId, branchIds) {
+        const keysToDelete = new Set();
+        const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
+        let trackedKeys = [];
+        try {
+            trackedKeys = await this.cacheManager.get(trackedKeysKey) || [];
+        } catch  {
+            trackedKeys = [];
+        }
+        if (!branchIds?.length) {
+            trackedKeys.forEach((key)=>keysToDelete.add(key));
+            keysToDelete.add(trackedKeysKey);
+        } else {
+            // Branch scope given: only invalidate those branches, keep the rest tracked
+            branchIds.forEach((branchId)=>keysToDelete.add(this.buildCacheKey({
+                    userId,
+                    companyId,
+                    branchId
+                })));
+            const remainingKeys = trackedKeys.filter((key)=>!keysToDelete.has(key));
+            if (remainingKeys.length) {
+                await this.cacheManager.set(trackedKeysKey, remainingKeys, this.TTL);
+            } else {
+                keysToDelete.add(trackedKeysKey);
             }
         }
-        await Promise.all(keysToDelete.map((key)=>this.cacheManager.del(key)));
+        await Promise.all([
+            ...keysToDelete
+        ].map((key)=>this.cacheManager.del(key)));
     }
     async invalidateUsers(userIds, companyId, branchIds) {
         if (userIds.length === 0) {
@@ -113,39 +149,19 @@ export class PermissionCacheService {
         const results = await Promise.allSettled(userIds.map((userId)=>this.invalidateUser(userId, companyId, branchIds)));
         return results.filter((r)=>r.status === 'fulfilled').length;
     }
-    async invalidateRole(_roleId, userIds, companyId, branchIds) {
-        if (userIds.length === 0) {
-            return 0;
-        }
-        return await this.invalidateUsers(userIds, companyId, branchIds);
-    }
-    constructor(cacheManager){
+    constructor(cacheManager, guardConfig){
         _define_property(this, "cacheManager", void 0);
-        _define_property(this, "TTL", void 0); // 1 hour
-        _define_property(this, "ACTION_CODE_TTL", void 0); // 2 hours for action codes (less frequent changes)
-        _define_property(this, "CACHE_PREFIX", void 0);
-        _define_property(this, "MY_PERMISSIONS_PREFIX", void 0);
-        _define_property(this, "ACTION_CODE_PREFIX", void 0);
+        _define_property(this, "guardConfig", void 0);
+        _define_property(this, "TRACKED_KEYS_PREFIX", void 0);
+        _define_property(this, "TRACKED_SCOPES_PREFIX", void 0);
+        _define_property(this, "TTL", void 0);
         this.cacheManager = cacheManager;
-        this.TTL = 3600000;
-        this.ACTION_CODE_TTL = 7200000;
-        this.CACHE_PREFIX = 'permissions';
-        this.MY_PERMISSIONS_PREFIX = 'my-permissions';
-        this.ACTION_CODE_PREFIX = 'action-codes';
+        this.guardConfig = guardConfig;
+        this.TRACKED_KEYS_PREFIX = 'permission-tracked-keys';
+        this.TRACKED_SCOPES_PREFIX = 'permission-tracked-scopes';
+        this.TTL = this.parseDurationMs(envConfig.getJwtConfig().refreshExpiration);
     }
 }
-_ts_decorate([
-    LogAction({
-        action: 'permissionCache.setPermissions',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof PermissionCacheKeyOptions === "undefined" ? Object : PermissionCacheKeyOptions,
-        Array
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "setPermissions", null);
 _ts_decorate([
     LogAction({
         action: 'permissionCache.setMyPermissions',
@@ -158,18 +174,6 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], PermissionCacheService.prototype, "setMyPermissions", null);
-_ts_decorate([
-    LogAction({
-        action: 'permissionCache.setActionCodeMap',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof Record === "undefined" ? Object : Record,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "setActionCodeMap", null);
 _ts_decorate([
     LogAction({
         action: 'permissionCache.invalidateUser',
@@ -196,25 +200,14 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], PermissionCacheService.prototype, "invalidateUsers", null);
-_ts_decorate([
-    LogAction({
-        action: 'permissionCache.invalidateRole',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        Array,
-        Object,
-        Array
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "invalidateRole", null);
 PermissionCacheService = _ts_decorate([
     Injectable(),
     _ts_param(0, Inject('CACHE_INSTANCE')),
+    _ts_param(1, Optional()),
+    _ts_param(1, Inject(PERMISSION_GUARD_CONFIG)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof HybridCache === "undefined" ? Object : HybridCache
+        typeof HybridCache === "undefined" ? Object : HybridCache,
+        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
     ])
 ], PermissionCacheService);