@flusys/nestjs-iam 6.0.0 → 6.0.2

package/fesm/services/permission.service.js

@@ -35,9 +35,9 @@ import { UserIamPermissionWithCompany } from '../entities/permission-with-compan
 import { RoleWithCompany } from '../entities/role-with-company.entity';
 import { Role } from '../entities/role.entity';
 import { UserIamPermission } from '../entities/user-iam-permission.entity';
+import { ActionType } from '../enums/action-type.enum';
 import { IamEntityType } from '../enums/iam-entity-type.enum';
 import { IamPermissionType } from '../enums/iam-permission-type.enum';
-import { ActionType } from '../enums/action-type.enum';
 import { IAMPermissionMode } from '../enums/permission-type.enum';
 import { IAMConfigService } from './iam-config.service';
 import { IAMDataSourceService } from './iam-datasource.service';
@@ -57,6 +57,18 @@ export class PermissionService {
         const entity = enableCompanyFeature ? RoleWithCompany : Role;
         return this.dataSourceProvider.getRepository(entity);
     }
+    async getActionsMap(actionIds) {
+        const actionRepo = await this.getActionRepository();
+        const actions = await actionRepo.find({
+            where: {
+                id: In(actionIds)
+            }
+        });
+        return new Map(actions.map((a)=>[
+                a.id,
+                a
+            ]));
+    }
     // User-Action Permissions
     async assignUserActions(dto) {
         if (!this.iamConfigService.isDirectPermissionEnabled()) {
@@ -133,12 +145,13 @@ export class PermissionService {
             const result = await permissionRepo.delete(whereDelete);
             removed = result.affected || 0;
         }
-        await this.invalidateUserPermissionCache(dto.userId, branchId, companyId);
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
+            branchId
+        ]);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
     async getUserActions(userId, branchId, companyId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const where = {
             permissionType: IamPermissionType.USER_ACTION,
@@ -156,16 +169,7 @@ export class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actionWhere = {
-            id: In(actionIds)
-        };
-        const actions = await actionRepo.find({
-            where: actionWhere
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -262,7 +266,6 @@ export class PermissionService {
     }
     async getRoleActions(roleId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const permissions = await permissionRepo.find({
             where: {
                 permissionType: IamPermissionType.ROLE_ACTION,
@@ -274,16 +277,7 @@ export class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actionWhere = {
-            id: In(actionIds)
-        };
-        const actions = await actionRepo.find({
-            where: actionWhere
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -310,8 +304,7 @@ export class PermissionService {
             }
             if (itemsToRemove.length > 0) {
                 const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
-                const cascadeResult = await this.removeCompanyActionsWithCascade(manager, dto.companyId, actionIdsToRemove);
-                removed = cascadeResult.removedCompanyActions;
+                removed = await this.removeCompanyActionsWithCascade(manager, dto.companyId, actionIdsToRemove);
             }
         });
         await this.invalidateCompanyMembersCache(dto.companyId);
@@ -367,37 +360,28 @@ export class PermissionService {
                 'id'
             ]
         });
-        let removedRoleActions = 0;
-        let removedUserActions = 0;
         if (companyRoles.length > 0) {
             const roleIds = companyRoles.map((role)=>role.id);
-            const roleResult = await permissionRepo.delete({
+            await permissionRepo.delete({
                 permissionType: IamPermissionType.ROLE_ACTION,
                 sourceType: IamEntityType.ROLE,
                 sourceId: In(roleIds),
                 targetType: IamEntityType.ACTION,
                 targetId: In(actionIds)
             });
-            removedRoleActions = roleResult.affected || 0;
         }
         if (this.iamConfigService.isCompanyFeatureEnabled()) {
-            const userResult = await permissionRepo.delete({
+            await permissionRepo.delete({
                 permissionType: IamPermissionType.USER_ACTION,
                 companyId,
                 targetType: IamEntityType.ACTION,
                 targetId: In(actionIds)
             });
-            removedUserActions = userResult.affected || 0;
         }
-        return {
-            removedCompanyActions: companyResult.affected || 0,
-            removedRoleActions,
-            removedUserActions
-        };
+        return companyResult.affected || 0;
     }
     /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const permissions = await permissionRepo.find({
             where: {
                 permissionType: IamPermissionType.COMPANY_ACTION,
@@ -409,15 +393,7 @@ export class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actions = await actionRepo.find({
-            where: {
-                id: In(actionIds)
-            }
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -520,7 +496,9 @@ export class PermissionService {
             const result = await permissionRepo.delete(whereDelete);
             removed = result.affected || 0;
         }
-        await this.invalidateUserPermissionCache(dto.userId, branchId, companyId);
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
+            branchId
+        ]);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
     /** Get user's roles (branch-scoped, filtered by companyId and branchId if provided) */ async getUserRoles(userId, branchId, companyId) {
@@ -571,9 +549,8 @@ export class PermissionService {
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const cacheOptions = {
             userId,
-            companyId,
-            branchId,
-            enableCompanyFeature
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId
         };
         const cachedData = await this.permissionCacheService.getMyPermissions(cacheOptions);
         if (cachedData) {
@@ -602,42 +579,25 @@ export class PermissionService {
             cachedEndpoints: cachedData.backendCodes.length
         };
     }
-    /** Get current tenant ID for multi-tenant cache keys */ getCurrentTenantId() {
-        if (!this.iamConfigService.isMultiTenant()) {
-            return undefined;
-        }
-        const tenant = this.dataSourceProvider.getCurrentTenant();
-        return tenant?.id;
-    }
-    /** Get parent IDs by codes, using cache first (tenant-aware) */ async getParentIdsByCodesWithCache(codes) {
-        const tenantId = this.getCurrentTenantId();
-        const cachedMap = await this.permissionCacheService.getActionIdsByCodes(codes, tenantId);
-        if (cachedMap) {
-            return new Set(Object.values(cachedMap));
-        }
+    /** Resolve action IDs for the given codes */ async getParentIdsByCodesWithCache(codes) {
         const actionRepo = await this.getActionRepository();
-        const allActions = await actionRepo.find({
+        const actions = await actionRepo.find({
+            where: {
+                code: In(codes)
+            },
             select: [
                 'id',
                 'code'
             ]
         });
-        const fullMap = {};
-        for (const action of allActions){
-            if (action.code) {
-                fullMap[action.code] = action.id;
-            }
-        }
-        await this.permissionCacheService.setActionCodeMap(fullMap, tenantId);
-        return new Set(codes.map((code)=>fullMap[code]).filter(Boolean));
+        return new Set(actions.map((action)=>action.id));
     }
     /** Fetch permissions from DB and cache them (empty permissions are also cached) */ async fetchAndCachePermissions(userId, branchId, companyId) {
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const cacheOptions = {
             userId,
-            companyId,
-            branchId,
-            enableCompanyFeature
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId
         };
         const emptyData = {
             frontendActions: [],
@@ -690,7 +650,8 @@ export class PermissionService {
         const actionRepo = await this.getActionRepository();
         const actions = await actionRepo.find({
             where: {
-                id: In(Array.from(actionIds))
+                id: In(Array.from(actionIds)),
+                isActive: true
             }
         });
         const backendActions = actions.filter((a)=>a.actionType === ActionType.BACKEND || a.actionType === ActionType.BOTH);
@@ -706,10 +667,7 @@ export class PermissionService {
                 })),
             backendCodes
         };
-        await Promise.all([
-            this.permissionCacheService.setMyPermissions(cacheOptions, cacheData),
-            this.permissionCacheService.setPermissions(cacheOptions, backendCodes)
-        ]);
+        await this.permissionCacheService.setMyPermissions(cacheOptions, cacheData);
         return cacheData;
     }
     // Helper Methods
@@ -743,9 +701,11 @@ export class PermissionService {
         const baseWhere = {
             permissionType: IamPermissionType.USER_ROLE,
             sourceType: IamEntityType.USER,
-            sourceId: userId,
-            companyId: companyId
+            sourceId: userId
         };
+        if (companyId) {
+            baseWhere.companyId = companyId;
+        }
         if (branchId) {
             // Get company-wide + branch-specific roles
             const companyWidePermissions = await permissionRepo.find({
@@ -829,14 +789,6 @@ export class PermissionService {
         }
         return Array.from(actionIds);
     }
-    /** Invalidate permission cache for a user */ async invalidateUserPermissionCache(userId, branchId, companyId) {
-        const branchIds = branchId !== undefined ? [
-            branchId
-        ] : [
-            null
-        ];
-        await this.permissionCacheService.invalidateUser(userId, companyId, branchIds);
-    }
     async invalidateRoleMembersCache(roleId) {
         const permissionRepo = await this.getPermissionRepository();
         const roleRepo = await this.getRoleRepository();
@@ -874,7 +826,7 @@ export class PermissionService {
                 ...new Set(userBranches.map((p)=>p.branchId))
             ];
         }
-        return this.permissionCacheService.invalidateRole(roleId, userIds, companyId, branchIds);
+        return this.permissionCacheService.invalidateUsers(userIds, companyId, branchIds);
     }
     /** Invalidate permission cache for all users in a company */ async invalidateCompanyMembersCache(companyId) {
         if (!this.iamConfigService.isCompanyFeatureEnabled()) {
@@ -895,6 +847,127 @@ export class PermissionService {
         }
         return await this.permissionCacheService.invalidateUsers(userIds, companyId, branchIds);
     }
+    async revokeCompanyPermissions(companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const roleRepo = await this.getRoleRepository();
+        const dataSource = permissionRepo.manager.connection;
+        const companyRoles = await roleRepo.find({
+            where: {
+                companyId,
+                deletedAt: IsNull()
+            },
+            select: [
+                'id'
+            ]
+        });
+        const roleIds = companyRoles.map((role)=>role.id);
+        const affectedUserRows = await permissionRepo.find({
+            where: {
+                permissionType: In([
+                    IamPermissionType.USER_ROLE,
+                    IamPermissionType.USER_ACTION
+                ]),
+                companyId
+            },
+            select: [
+                'userId'
+            ]
+        });
+        const affectedUserIds = [
+            ...new Set(affectedUserRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await dataSource.transaction(async (manager)=>{
+            const txRepo = manager.getRepository(permissionRepo.target);
+            await txRepo.delete({
+                permissionType: IamPermissionType.COMPANY_ACTION,
+                sourceType: IamEntityType.COMPANY,
+                sourceId: companyId
+            });
+            if (roleIds.length > 0) {
+                await txRepo.delete({
+                    permissionType: IamPermissionType.ROLE_ACTION,
+                    sourceType: IamEntityType.ROLE,
+                    sourceId: In(roleIds)
+                });
+            }
+            await txRepo.delete({
+                permissionType: In([
+                    IamPermissionType.USER_ROLE,
+                    IamPermissionType.USER_ACTION
+                ]),
+                companyId
+            });
+            if (roleIds.length > 0) {
+                const txRoleRepo = manager.getRepository(roleRepo.target);
+                await txRoleRepo.delete(roleIds);
+            }
+        });
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId);
+        }
+    }
+    async revokeBranchPermissions(branchId, companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const where = {
+            permissionType: In([
+                IamPermissionType.USER_ROLE,
+                IamPermissionType.USER_ACTION
+            ]),
+            branchId,
+            companyId
+        };
+        const affectedUserRows = await permissionRepo.find({
+            where,
+            select: [
+                'userId'
+            ]
+        });
+        const affectedUserIds = [
+            ...new Set(affectedUserRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await permissionRepo.delete(where);
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId, [
+                branchId
+            ]);
+        }
+    }
+    async revokeUserCompanyAccess(userId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        await permissionRepo.delete({
+            permissionType: In([
+                IamPermissionType.USER_ROLE,
+                IamPermissionType.USER_ACTION
+            ]),
+            sourceType: IamEntityType.USER,
+            sourceId: userId,
+            companyId
+        });
+        await this.permissionCacheService.invalidateUser(userId, companyId);
+    }
+    async revokeUserBranchAccess(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const where = {
+            permissionType: In([
+                IamPermissionType.USER_ROLE,
+                IamPermissionType.USER_ACTION
+            ]),
+            sourceType: IamEntityType.USER,
+            sourceId: userId,
+            branchId,
+            companyId
+        };
+        await permissionRepo.delete(where);
+        await this.permissionCacheService.invalidateUser(userId, companyId, [
+            branchId
+        ]);
+    }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(permissionCacheService, iamConfigService, dataSourceProvider){
         _define_property(this, "permissionCacheService", void 0);
@@ -949,6 +1022,54 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], PermissionService.prototype, "assignUserRoles", null);
+_ts_decorate([
+    LogAction({
+        action: 'iam.revokeCompanyPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeCompanyPermissions", null);
+_ts_decorate([
+    LogAction({
+        action: 'iam.revokeBranchPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeBranchPermissions", null);
+_ts_decorate([
+    LogAction({
+        action: 'iam.revokeUserCompanyAccess',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeUserCompanyAccess", null);
+_ts_decorate([
+    LogAction({
+        action: 'iam.revokeUserBranchAccess',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeUserBranchAccess", null);
 PermissionService = _ts_decorate([
     Injectable({
         scope: Scope.REQUEST

package/fesm/services/role.service.js

@@ -25,15 +25,57 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { HybridCache, ApiService } from '@flusys/nestjs-shared/classes';
+import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { applyCompanyFilter } from '@flusys/nestjs-shared/utils';
 import { Inject, Injectable, Scope } from '@nestjs/common';
+import { In } from 'typeorm';
+import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
 import { RoleWithCompany } from '../entities/role-with-company.entity';
 import { Role } from '../entities/role.entity';
+import { UserIamPermission } from '../entities/user-iam-permission.entity';
+import { IamEntityType } from '../enums/iam-entity-type.enum';
+import { IamPermissionType } from '../enums/iam-permission-type.enum';
 import { IAMConfigService } from './iam-config.service';
 import { IAMDataSourceService } from './iam-datasource.service';
+import { PermissionCacheService } from './permission-cache.service';
 export class RoleService extends ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        await super.beforeDeleteOperation(dto, user, queryRunner);
+        const roleIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        if (roleIds.length === 0) {
+            return;
+        }
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const permissionEntity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
+        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
+        const userRoleRows = await permissionRepo.find({
+            where: {
+                permissionType: IamPermissionType.USER_ROLE,
+                sourceType: IamEntityType.USER,
+                targetType: IamEntityType.ROLE,
+                targetId: In(roleIds)
+            }
+        });
+        const affectedUserIds = [
+            ...new Set(userRoleRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await permissionRepo.delete({
+            permissionType: IamPermissionType.ROLE_ACTION,
+            sourceType: IamEntityType.ROLE,
+            sourceId: In(roleIds)
+        });
+        await permissionRepo.delete({
+            permissionType: IamPermissionType.USER_ROLE,
+            targetType: IamEntityType.ROLE,
+            targetId: In(roleIds)
+        });
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds);
+        }
+    }
     resolveEntity() {
         return this.iamConfigService.isCompanyFeatureEnabled() ? RoleWithCompany : Role;
     }
@@ -107,8 +149,8 @@ export class RoleService extends ApiService {
             deletedById: entity.deletedById
         };
     }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider){
-        super('role', cacheManager, utilsService, RoleService.name, true, 'iam', undefined, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService;
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionCacheService){
+        super('role', cacheManager, utilsService, RoleService.name, true, 'iam', undefined, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionCacheService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionCacheService = permissionCacheService;
     }
 }
 RoleService = _ts_decorate([
@@ -119,11 +161,13 @@ RoleService = _ts_decorate([
     _ts_param(1, Inject(UtilsService)),
     _ts_param(2, Inject(IAMConfigService)),
     _ts_param(3, Inject(IAMDataSourceService)),
+    _ts_param(4, Inject(PermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof UtilsService === "undefined" ? Object : UtilsService,
         typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
-        typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService
+        typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService,
+        typeof PermissionCacheService === "undefined" ? Object : PermissionCacheService
     ])
 ], RoleService);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-iam",
-  "version": "6.0.0",
+  "version": "6.0.2",
   "description": "Identity and Access Management (IAM) module for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -90,7 +90,7 @@
     "express": "^5.0.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.0.0",
-    "@flusys/nestjs-shared": "6.0.0"
+    "@flusys/nestjs-core": "6.0.2",
+    "@flusys/nestjs-shared": "6.0.2"
   }
 }

package/services/action.service.d.ts

@@ -1,19 +1,23 @@
 import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
+import { DeleteDto } from '@flusys/nestjs-shared/dtos';
 import { ILoggedUserInfo } from '@flusys/nestjs-shared/interfaces';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { SelectQueryBuilder } from 'typeorm';
+import { QueryRunner, SelectQueryBuilder } from 'typeorm';
 import { CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
 import { Action } from '../entities/action.entity';
 import { IAction, IActionTree } from '../interfaces/action.interface';
 import { IAMConfigService } from './iam-config.service';
 import { IAMDataSourceService } from './iam-datasource.service';
+import { PermissionCacheService } from './permission-cache.service';
 import { PermissionService } from './permission.service';
 export declare class ActionService extends ApiService<CreateActionDto, UpdateActionDto, IAction, Action> {
     protected cacheManager: HybridCache;
     protected utilsService: UtilsService;
     private readonly iamConfigService;
     private readonly permissionService;
-    constructor(cacheManager: HybridCache, utilsService: UtilsService, iamConfigService: IAMConfigService, dataSourceProvider: IAMDataSourceService, permissionService: PermissionService);
+    private readonly permissionCacheService;
+    constructor(cacheManager: HybridCache, utilsService: UtilsService, iamConfigService: IAMConfigService, dataSourceProvider: IAMDataSourceService, permissionService: PermissionService, permissionCacheService: PermissionCacheService);
+    protected beforeDeleteOperation(dto: DeleteDto, user: ILoggedUserInfo | null, queryRunner: QueryRunner): Promise<void>;
     getSelectQuery(query: SelectQueryBuilder<Action>, _user: ILoggedUserInfo | null, select?: string[]): Promise<{
         query: SelectQueryBuilder<Action>;
         isRaw: boolean;
@@ -25,7 +29,7 @@ export declare class ActionService extends ApiService<CreateActionDto, UpdateAct
     protected convertEntityToResponseDto(entity: Action, _isRaw: boolean): IAction;
     private readonly actionSelectFields;
     private requireUser;
-    getActionsForPermission(user: ILoggedUserInfo): Promise<IAction[]>;
+    getActionsForPermission(user: ILoggedUserInfo, companyId?: string): Promise<IAction[]>;
     getActionTree(user: ILoggedUserInfo, search?: string, isActive?: boolean, withDeleted?: boolean): Promise<IActionTree[]>;
     private buildActionTree;
 }

package/services/permission-cache.service.d.ts

@@ -1,10 +1,5 @@
-import { HybridCache } from '@flusys/nestjs-shared';
-export interface PermissionCacheKeyOptions {
-    userId: string;
-    companyId?: string | null;
-    branchId?: string | null;
-    enableCompanyFeature: boolean;
-}
+import { HybridCache, PermissionCacheKeyOptions, PermissionGuardConfig } from '@flusys/nestjs-shared';
+export { PermissionCacheKeyOptions } from '@flusys/nestjs-shared';
 export interface CachedMyPermissions {
     frontendActions: Array<{
         id: string;
@@ -15,24 +10,23 @@ export interface CachedMyPermissions {
     }>;
     backendCodes: string[];
 }
+export declare const MY_PERMISSIONS_CACHE_PREFIX = "my-permissions";
 export declare class PermissionCacheService {
     private readonly cacheManager;
+    private readonly guardConfig?;
+    private readonly TRACKED_KEYS_PREFIX;
+    private readonly TRACKED_SCOPES_PREFIX;
     private readonly TTL;
-    private readonly ACTION_CODE_TTL;
-    private readonly CACHE_PREFIX;
-    private readonly MY_PERMISSIONS_PREFIX;
-    private readonly ACTION_CODE_PREFIX;
-    constructor(cacheManager: HybridCache);
-    generateCacheKey(options: PermissionCacheKeyOptions): string;
-    generateMyPermissionsCacheKey(options: PermissionCacheKeyOptions): string;
+    constructor(cacheManager: HybridCache, guardConfig?: PermissionGuardConfig | undefined);
+    private parseDurationMs;
     private buildCacheKey;
-    setPermissions(options: PermissionCacheKeyOptions, permissions: string[]): Promise<void>;
+    private scopeToken;
+    private buildTrackedKeysKey;
+    private buildTrackedScopesKey;
     setMyPermissions(options: PermissionCacheKeyOptions, data: CachedMyPermissions): Promise<void>;
     getMyPermissions(options: PermissionCacheKeyOptions): Promise<CachedMyPermissions | null>;
-    private generateActionCodeCacheKey;
-    setActionCodeMap(codeToIdMap: Record<string, string>, tenantId?: string): Promise<void>;
-    getActionIdsByCodes(codes: string[], tenantId?: string): Promise<Record<string, string> | null>;
+    private trackKey;
     invalidateUser(userId: string, companyId?: string | null, branchIds?: (string | null)[]): Promise<void>;
+    private invalidateScope;
     invalidateUsers(userIds: string[], companyId?: string | null, branchIds?: (string | null)[]): Promise<number>;
-    invalidateRole(_roleId: string, userIds: string[], companyId?: string | null, branchIds?: (string | null)[]): Promise<number>;
 }