@flusys/nestjs-iam 6.0.1 → 6.1.0

package/cjs/controllers/action.controller.js

@@ -8,13 +8,14 @@ Object.defineProperty(exports, "ActionController", {
         return ActionController;
     }
 });
-const _guards = require("@flusys/nestjs-shared/guards");
 const _nestjsshared = require("@flusys/nestjs-shared");
-const _config = require("../config");
+const _guards = require("@flusys/nestjs-shared/guards");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
+const _config = require("../config");
 const _actiondto = require("../dtos/action.dto");
 const _actionservice = require("../services/action.service");
+const _iamconfigservice = require("../services/iam-config.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -89,8 +90,8 @@ let ActionController = class ActionController extends (0, _nestjsshared.createAp
         }
     }
 }) {
-    async getActionsForPermission(user) {
-        const actions = await this.actionService.getActionsForPermission(user);
+    async getActionsForPermission(dto, user) {
+        const actions = await this.actionService.getActionsForPermission(user, dto?.companyId);
         return {
             success: true,
             message: 'Actions retrieved successfully',
@@ -107,8 +108,8 @@ let ActionController = class ActionController extends (0, _nestjsshared.createAp
             data: tree
         };
     }
-    constructor(actionService){
-        super(actionService), _define_property(this, "actionService", void 0), this.actionService = actionService;
+    constructor(actionService, iamConfigService){
+        super(actionService), _define_property(this, "actionService", void 0), _define_property(this, "iamConfigService", void 0), this.actionService = actionService, this.iamConfigService = iamConfigService;
     }
 };
 _ts_decorate([
@@ -117,15 +118,20 @@ _ts_decorate([
     (0, _swagger.ApiBearerAuth)(),
     (0, _swagger.ApiOperation)({
         summary: 'Get actions for permission assignment',
-        description: 'Returns actions available for permission assignment. If company feature enabled, filtered by company whitelist.'
+        description: "Returns actions available for permission assignment, filtered by company whitelist when company feature is enabled. Optional companyId scopes the whitelist to a specific company (must match the caller's own company); defaults to the caller's session company when omitted."
     }),
     (0, _swagger.ApiResponse)({
         status: 200,
         type: _nestjsshared.SingleResponseDto
     }),
-    _ts_param(0, (0, _nestjsshared.CurrentUser)()),
+    (0, _swagger.ApiBody)({
+        type: _actiondto.ActionTreeForPermissionDto
+    }),
+    _ts_param(0, (0, _common.Body)()),
+    _ts_param(1, (0, _nestjsshared.CurrentUser)()),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        typeof _actiondto.ActionTreeForPermissionDto === "undefined" ? Object : _actiondto.ActionTreeForPermissionDto,
         typeof _nestjsshared.ILoggedUserInfo === "undefined" ? Object : _nestjsshared.ILoggedUserInfo
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -159,8 +165,10 @@ ActionController = _ts_decorate([
     (0, _swagger.ApiTags)('IAM - Actions'),
     (0, _common.Controller)('iam/actions'),
     _ts_param(0, (0, _common.Inject)(_actionservice.ActionService)),
+    _ts_param(1, (0, _common.Inject)(_iamconfigservice.IAMConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof _actionservice.ActionService === "undefined" ? Object : _actionservice.ActionService
+        typeof _actionservice.ActionService === "undefined" ? Object : _actionservice.ActionService,
+        typeof _iamconfigservice.IAMConfigService === "undefined" ? Object : _iamconfigservice.IAMConfigService
     ])
 ], ActionController);

package/cjs/controllers/action.controller.spec.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _actioncontroller = require("./action.controller");
+describe('ActionController', ()=>{
+    let controller;
+    let mockActionService;
+    let mockIamConfigService;
+    beforeEach(()=>{
+        mockActionService = {
+            insert: jest.fn(),
+            findById: jest.fn(),
+            getAll: jest.fn(),
+            update: jest.fn(),
+            delete: jest.fn(),
+            getActionsForPermission: jest.fn(),
+            getActionTree: jest.fn()
+        };
+        mockIamConfigService = {};
+        controller = new _actioncontroller.ActionController(mockActionService, mockIamConfigService);
+    });
+    it('wires the injected service onto the generated controller base', ()=>{
+        expect(controller.actionService).toBe(mockActionService);
+        expect(controller.service).toBe(mockActionService);
+    });
+    describe('getActionsForPermission', ()=>{
+        it('returns actions scoped to the caller session company when no companyId is given', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)();
+            mockActionService.getActionsForPermission.mockResolvedValue([
+                {
+                    id: 'action-1',
+                    code: 'user.create'
+                }
+            ]);
+            const result = await controller.getActionsForPermission({}, user);
+            expect(mockActionService.getActionsForPermission).toHaveBeenCalledWith(user, undefined);
+            expect(result.success).toBe(true);
+            expect(result.data).toEqual([
+                {
+                    id: 'action-1',
+                    code: 'user.create'
+                }
+            ]);
+        });
+        it('forwards an explicit companyId override', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)();
+            mockActionService.getActionsForPermission.mockResolvedValue([]);
+            await controller.getActionsForPermission({
+                companyId: 'company-2'
+            }, user);
+            expect(mockActionService.getActionsForPermission).toHaveBeenCalledWith(user, 'company-2');
+        });
+    });
+    describe('getActionTree', ()=>{
+        it('returns the hierarchical action tree with query filters applied', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)();
+            mockActionService.getActionTree.mockResolvedValue([
+                {
+                    id: 'action-1',
+                    children: []
+                }
+            ]);
+            const result = await controller.getActionTree({
+                search: 'user',
+                isActive: true,
+                withDeleted: false
+            }, user);
+            expect(mockActionService.getActionTree).toHaveBeenCalledWith(user, 'user', true, false);
+            expect(result.data).toEqual([
+                {
+                    id: 'action-1',
+                    children: []
+                }
+            ]);
+        });
+    });
+});

package/cjs/controllers/company-action-permission.controller.spec.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _companyactionpermissioncontroller = require("./company-action-permission.controller");
+describe('CompanyActionPermissionController', ()=>{
+    let controller;
+    let mockPermissionService;
+    beforeEach(()=>{
+        mockPermissionService = {
+            assignCompanyActions: jest.fn(),
+            getCompanyActions: jest.fn()
+        };
+        controller = new _companyactionpermissioncontroller.CompanyActionPermissionController(mockPermissionService);
+    });
+    describe('assignCompanyActions', ()=>{
+        it('whitelists actions for a company', async ()=>{
+            mockPermissionService.assignCompanyActions.mockResolvedValue({
+                added: 3,
+                removed: 0,
+                total: 3
+            });
+            const result = await controller.assignCompanyActions({
+                companyId: 'company-1',
+                actionIds: [
+                    'action-1',
+                    'action-2',
+                    'action-3'
+                ]
+            });
+            expect(mockPermissionService.assignCompanyActions).toHaveBeenCalledWith({
+                companyId: 'company-1',
+                actionIds: [
+                    'action-1',
+                    'action-2',
+                    'action-3'
+                ]
+            });
+            expect(result.success).toBe(true);
+            expect(result.data).toEqual({
+                added: 3,
+                removed: 0,
+                total: 3
+            });
+        });
+    });
+    describe('getCompanyActions', ()=>{
+        it('returns the whitelisted actions for a company', async ()=>{
+            mockPermissionService.getCompanyActions.mockResolvedValue([
+                {
+                    actionId: 'action-1'
+                }
+            ]);
+            const result = await controller.getCompanyActions({
+                companyId: 'company-1'
+            });
+            expect(mockPermissionService.getCompanyActions).toHaveBeenCalledWith('company-1');
+            expect(result.data).toEqual([
+                {
+                    actionId: 'action-1'
+                }
+            ]);
+        });
+    });
+});

package/cjs/controllers/my-permission.controller.spec.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _mypermissioncontroller = require("./my-permission.controller");
+describe('MyPermissionController', ()=>{
+    let controller;
+    let mockPermissionService;
+    beforeEach(()=>{
+        mockPermissionService = {
+            getMyPermissions: jest.fn()
+        };
+        controller = new _mypermissioncontroller.MyPermissionController(mockPermissionService);
+    });
+    describe('getMyPermissions', ()=>{
+        it('resolves permissions for the current user, branch, and company', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                id: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-1'
+            });
+            const permissions = {
+                menus: [],
+                actions: [
+                    'user.create'
+                ]
+            };
+            mockPermissionService.getMyPermissions.mockResolvedValue(permissions);
+            const result = await controller.getMyPermissions({
+                parentCodes: [
+                    'user'
+                ]
+            }, user);
+            expect(mockPermissionService.getMyPermissions).toHaveBeenCalledWith('user-1', 'branch-1', 'company-1', [
+                'user'
+            ]);
+            expect(result).toEqual({
+                success: true,
+                message: 'Permissions loaded successfully',
+                messageKey: expect.any(String),
+                data: permissions
+            });
+        });
+        it('passes null for missing branch and company context', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                id: 'user-1',
+                companyId: undefined,
+                branchId: undefined
+            });
+            mockPermissionService.getMyPermissions.mockResolvedValue({});
+            await controller.getMyPermissions({}, user);
+            expect(mockPermissionService.getMyPermissions).toHaveBeenCalledWith('user-1', null, null, undefined);
+        });
+    });
+});

package/cjs/controllers/role-permission.controller.spec.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _common = require("@nestjs/common");
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _rolepermissioncontroller = require("./role-permission.controller");
+describe('RolePermissionController', ()=>{
+    let controller;
+    let mockPermissionService;
+    let mockConfig;
+    beforeEach(()=>{
+        mockPermissionService = {
+            assignRoleActions: jest.fn(),
+            getRoleActions: jest.fn(),
+            assignUserRoles: jest.fn(),
+            getUserRoles: jest.fn()
+        };
+        mockConfig = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
+        };
+        controller = new _rolepermissioncontroller.RolePermissionController(mockPermissionService, mockConfig);
+    });
+    describe('assignRoleActions', ()=>{
+        it('assigns actions to a role and returns the operation summary', async ()=>{
+            mockPermissionService.assignRoleActions.mockResolvedValue({
+                added: 2,
+                removed: 1,
+                total: 3
+            });
+            const result = await controller.assignRoleActions({
+                roleId: 'role-1',
+                actionIds: [
+                    'action-1',
+                    'action-2'
+                ]
+            });
+            expect(mockPermissionService.assignRoleActions).toHaveBeenCalledWith({
+                roleId: 'role-1',
+                actionIds: [
+                    'action-1',
+                    'action-2'
+                ]
+            });
+            expect(result.success).toBe(true);
+            expect(result.data).toEqual({
+                added: 2,
+                removed: 1,
+                total: 3
+            });
+        });
+    });
+    describe('getRoleActions', ()=>{
+        it('returns actions assigned to the role', async ()=>{
+            mockPermissionService.getRoleActions.mockResolvedValue([
+                {
+                    actionId: 'action-1'
+                }
+            ]);
+            const result = await controller.getRoleActions({
+                roleId: 'role-1'
+            });
+            expect(mockPermissionService.getRoleActions).toHaveBeenCalledWith('role-1');
+            expect(result.data).toEqual([
+                {
+                    actionId: 'action-1'
+                }
+            ]);
+        });
+    });
+    describe('assignUserRoles', ()=>{
+        it('assigns roles to a user when the caller has access to the target company', async ()=>{
+            mockConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            mockPermissionService.assignUserRoles.mockResolvedValue({
+                added: 1,
+                removed: 0,
+                total: 1
+            });
+            const result = await controller.assignUserRoles({
+                userId: 'user-2',
+                roleIds: [
+                    'role-1'
+                ],
+                companyId: 'company-1'
+            }, user);
+            expect(mockPermissionService.assignUserRoles).toHaveBeenCalledWith({
+                userId: 'user-2',
+                roleIds: [
+                    'role-1'
+                ],
+                companyId: 'company-1'
+            });
+            expect(result.data).toEqual({
+                added: 1,
+                removed: 0,
+                total: 1
+            });
+        });
+        it('rejects assignment when the caller has no access to the target company', async ()=>{
+            mockConfig.isCompanyFeatureEnabled.mockReturnValue(true);
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            await expect(controller.assignUserRoles({
+                userId: 'user-2',
+                roleIds: [
+                    'role-1'
+                ],
+                companyId: 'company-2'
+            }, user)).rejects.toThrow(_common.ForbiddenException);
+            expect(mockPermissionService.assignUserRoles).not.toHaveBeenCalled();
+        });
+    });
+    describe('getUserRoles', ()=>{
+        it('returns roles assigned to the user scoped by branch and company', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            });
+            mockPermissionService.getUserRoles.mockResolvedValue([
+                {
+                    roleId: 'role-1'
+                }
+            ]);
+            const result = await controller.getUserRoles({
+                userId: 'user-2',
+                branchId: 'branch-1',
+                companyId: 'company-1'
+            }, user);
+            expect(mockPermissionService.getUserRoles).toHaveBeenCalledWith('user-2', 'branch-1', 'company-1');
+            expect(result.data).toEqual([
+                {
+                    roleId: 'role-1'
+                }
+            ]);
+        });
+    });
+});

package/cjs/controllers/role.controller.spec.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _rolecontroller = require("./role.controller");
+function buildRole(overrides = {}) {
+    return {
+        id: 'role-1',
+        name: 'Admin',
+        description: null,
+        isActive: true,
+        readOnly: false,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        ...overrides
+    };
+}
+describe('RoleController', ()=>{
+    let controller;
+    let mockRoleService;
+    beforeEach(()=>{
+        mockRoleService = {
+            insert: jest.fn(),
+            findById: jest.fn(),
+            getAll: jest.fn(),
+            update: jest.fn(),
+            delete: jest.fn()
+        };
+        controller = new _rolecontroller.RoleController(mockRoleService);
+    });
+    it('wires the injected service onto the generated controller base', ()=>{
+        expect(controller.roleService).toBe(mockRoleService);
+        expect(controller.service).toBe(mockRoleService);
+    });
+    describe('insert', ()=>{
+        it('creates a role and returns the mapped response', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)();
+            mockRoleService.insert.mockResolvedValue(buildRole());
+            const result = await controller.insert({
+                name: 'Admin'
+            }, user);
+            expect(mockRoleService.insert).toHaveBeenCalledWith({
+                name: 'Admin'
+            }, user);
+            expect(result.success).toBe(true);
+            expect(result.data).toEqual(expect.objectContaining({
+                id: 'role-1',
+                name: 'Admin'
+            }));
+        });
+    });
+    describe('getAll', ()=>{
+        it('paginates roles and maps the response list', async ()=>{
+            mockRoleService.getAll.mockResolvedValue({
+                data: [
+                    buildRole()
+                ],
+                total: 1
+            });
+            const result = await controller.getAll({}, (0, _loggedusermock.buildMockUser)(), '');
+            expect(mockRoleService.getAll).toHaveBeenCalledWith('', {}, (0, _loggedusermock.buildMockUser)());
+            expect(result.data).toHaveLength(1);
+        });
+    });
+    describe('delete', ()=>{
+        it('delegates soft-delete to the service', async ()=>{
+            mockRoleService.delete.mockResolvedValue({
+                count: 1
+            });
+            const result = await controller.delete({
+                id: [
+                    'role-1'
+                ],
+                type: 'delete'
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(mockRoleService.delete).toHaveBeenCalledWith({
+                id: [
+                    'role-1'
+                ],
+                type: 'delete'
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(result.success).toBe(true);
+        });
+    });
+});

package/cjs/controllers/user-action-permission.controller.js

@@ -13,7 +13,6 @@ const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _config = require("../config");
 const _permissiondto = require("../dtos/permission.dto");
-const _helpers = require("../helpers");
 const _iamconfigservice = require("../services/iam-config.service");
 const _permissionservice = require("../services/permission.service");
 function _define_property(obj, key, value) {
@@ -45,7 +44,6 @@ function _ts_param(paramIndex, decorator) {
 }
 let UserActionPermissionController = class UserActionPermissionController {
     async assignUserActions(dto, user) {
-        (0, _helpers.validateCompanyAccess)(this.config, dto.companyId, user);
         const result = await this.permissionService.assignUserActions(dto);
         return {
             success: true,
@@ -60,7 +58,6 @@ let UserActionPermissionController = class UserActionPermissionController {
         };
     }
     async getUserActions(dto, user) {
-        (0, _helpers.validateCompanyAccess)(this.config, dto.companyId, user);
         const actions = await this.permissionService.getUserActions(dto.userId, dto.branchId, dto.companyId);
         return {
             success: true,

package/cjs/controllers/user-action-permission.controller.spec.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _useractionpermissioncontroller = require("./user-action-permission.controller");
+describe('UserActionPermissionController', ()=>{
+    let controller;
+    let mockPermissionService;
+    let mockConfig;
+    beforeEach(()=>{
+        mockPermissionService = {
+            assignUserActions: jest.fn(),
+            getUserActions: jest.fn()
+        };
+        mockConfig = {};
+        controller = new _useractionpermissioncontroller.UserActionPermissionController(mockPermissionService, mockConfig);
+    });
+    describe('assignUserActions', ()=>{
+        it('assigns direct action permissions to a user', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)();
+            mockPermissionService.assignUserActions.mockResolvedValue({
+                added: 1,
+                removed: 0,
+                total: 1
+            });
+            const result = await controller.assignUserActions({
+                userId: 'user-2',
+                actionIds: [
+                    'action-1'
+                ]
+            }, user);
+            expect(mockPermissionService.assignUserActions).toHaveBeenCalledWith({
+                userId: 'user-2',
+                actionIds: [
+                    'action-1'
+                ]
+            });
+            expect(result.success).toBe(true);
+            expect(result.data).toEqual({
+                added: 1,
+                removed: 0,
+                total: 1
+            });
+        });
+    });
+    describe('getUserActions', ()=>{
+        it('returns direct action permissions for a user scoped by branch/company', async ()=>{
+            const user = (0, _loggedusermock.buildMockUser)();
+            mockPermissionService.getUserActions.mockResolvedValue([
+                {
+                    actionId: 'action-1'
+                }
+            ]);
+            const result = await controller.getUserActions({
+                userId: 'user-2',
+                branchId: 'branch-1',
+                companyId: 'company-1'
+            }, user);
+            expect(mockPermissionService.getUserActions).toHaveBeenCalledWith('user-2', 'branch-1', 'company-1');
+            expect(result.data).toEqual([
+                {
+                    actionId: 'action-1'
+                }
+            ]);
+        });
+    });
+});

package/cjs/docs/iam-swagger.config.js

@@ -49,6 +49,12 @@ function iamSwaggerConfig(enableCompanyFeature = false, permissionMode = _permis
                 'branchId'
             ]
         },
+        {
+            schemaName: 'ActionTreeForPermissionDto',
+            properties: [
+                'companyId'
+            ]
+        },
         // Response DTOs with branchId
         {
             schemaName: 'UserActionResponseDto',