@flusys/nestjs-iam 6.0.1 → 6.1.0

package/cjs/docs/iam-swagger.config.spec.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _iamswaggerconfig = require("./iam-swagger.config");
+const _permissiontypeenum = require("../enums/permission-type.enum");
+describe('iamSwaggerConfig', ()=>{
+    it('should default to company disabled, FULL mode, single database', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)();
+        expect(config.title).toBe('IAM API');
+        expect(config.path).toBe('api/docs/iam');
+        expect(config.bearerAuth).toBe(true);
+        // enableCompanyFeature defaults to false, so company-scoped exclusions apply
+        expect(config.excludeSchemaProperties?.length).toBeGreaterThan(0);
+        expect(config.excludeQueryParameters?.length).toBeGreaterThan(0);
+        expect(config.description).not.toContain('Multi-Tenant Mode');
+    });
+    it('should always exclude auth-related tags regardless of configuration', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)(true, _permissiontypeenum.IAMPermissionMode.FULL);
+        expect(config.excludeTags).toEqual(expect.arrayContaining([
+            'Authentication',
+            'Users',
+            'Companies',
+            'Branches'
+        ]));
+    });
+    it('should exclude company-scoped schema properties and query params when company feature is off', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)(false);
+        expect(config.excludeSchemaProperties).toEqual(expect.arrayContaining([
+            expect.objectContaining({
+                schemaName: 'AssignUserActionsDto',
+                properties: [
+                    'companyId',
+                    'branchId'
+                ]
+            })
+        ]));
+        expect(config.excludeQueryParameters).toEqual(expect.arrayContaining([
+            expect.objectContaining({
+                pathPattern: '/iam/permissions/user-actions/*',
+                method: 'get'
+            })
+        ]));
+        expect(config.excludeTags).toContain('IAM - Company Action Permissions');
+    });
+    it('should not exclude company-scoped schema properties, query params, or tags when company feature is on', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)(true);
+        expect(config.excludeSchemaProperties).toEqual([]);
+        expect(config.excludeQueryParameters).toEqual([]);
+        expect(config.excludeTags).not.toContain('IAM - Company Action Permissions');
+    });
+    it('should hide DIRECT-mode tags in RBAC mode', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.RBAC);
+        expect(config.excludeTags).toContain('IAM - Permissions (Direct)');
+        expect(config.excludeTags).not.toContain('IAM - Permissions (RBAC)');
+        expect(config.excludeTags).not.toContain('IAM - Roles');
+    });
+    it('should hide RBAC-mode tags (including Roles) in DIRECT mode', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.DIRECT);
+        expect(config.excludeTags).toContain('IAM - Permissions (RBAC)');
+        expect(config.excludeTags).toContain('IAM - Roles');
+        expect(config.excludeTags).not.toContain('IAM - Permissions (Direct)');
+    });
+    it('should hide neither RBAC nor DIRECT tags in FULL mode', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.FULL);
+        expect(config.excludeTags).not.toContain('IAM - Permissions (RBAC)');
+        expect(config.excludeTags).not.toContain('IAM - Permissions (Direct)');
+        expect(config.excludeTags).not.toContain('IAM - Roles');
+    });
+    it('should mention multi-tenant mode in the description only for multi-tenant database mode', ()=>{
+        const multiTenant = (0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.FULL, 'multi-tenant');
+        const single = (0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.FULL, 'single');
+        expect(multiTenant.description).toContain('Multi-Tenant Mode');
+        expect(single.description).not.toContain('Multi-Tenant Mode');
+    });
+    it('should describe RBAC as active and DIRECT as disabled in the endpoints summary for RBAC mode', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.RBAC);
+        expect(config.description).toContain('**Roles**: CRUD operations');
+        expect(config.description).toContain('❌ **User-Actions**: Disabled (DIRECT mode not active)');
+    });
+    it('should describe DIRECT as active and Roles as disabled in the endpoints summary for DIRECT mode', ()=>{
+        const config = (0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.DIRECT);
+        expect(config.description).toContain('✅ **User-Actions**: Direct action assignment to users');
+        expect(config.description).toContain('❌ **Roles**: Disabled (RBAC mode not active)');
+    });
+    it('should describe company features as active only when company feature is enabled', ()=>{
+        const withCompany = (0, _iamswaggerconfig.iamSwaggerConfig)(true, _permissiontypeenum.IAMPermissionMode.FULL);
+        const withoutCompany = (0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.FULL);
+        expect(withCompany.description).toContain('Company Features (Active)');
+        expect(withCompany.description).toContain('✅ **Company-Actions**: Whitelist actions for companies');
+        expect(withoutCompany.description).not.toContain('Company Features (Active)');
+        expect(withoutCompany.description).toContain('❌ **Company-Actions**: Disabled (company feature not enabled)');
+    });
+    it('should describe the current permission mode label correctly for each mode', ()=>{
+        expect((0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.RBAC).description).toContain('**RBAC** (Role-Based Access Control)');
+        expect((0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.DIRECT).description).toContain('**DIRECT** (Direct User Permissions)');
+        expect((0, _iamswaggerconfig.iamSwaggerConfig)(false, _permissiontypeenum.IAMPermissionMode.FULL).description).toContain('**FULL** (RBAC + Direct)');
+    });
+});

package/cjs/dtos/action.dto.js

@@ -15,6 +15,9 @@ _export(exports, {
     get ActionTreeDto () {
         return ActionTreeDto;
     },
+    get ActionTreeForPermissionDto () {
+        return ActionTreeForPermissionDto;
+    },
     get ActionTreeQueryDto () {
         return ActionTreeQueryDto;
     },
@@ -226,6 +229,20 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", Array)
 ], ActionTreeDto.prototype, "children", void 0);
+let ActionTreeForPermissionDto = class ActionTreeForPermissionDto {
+    constructor(){
+        _define_property(this, "companyId", void 0);
+    }
+};
+_ts_decorate([
+    (0, _swagger.ApiProperty)({
+        description: 'Company to scope the action whitelist to. Defaults to the current user session company when omitted.',
+        required: false
+    }),
+    (0, _classvalidator.IsUUID)(),
+    (0, _classvalidator.IsOptional)(),
+    _ts_metadata("design:type", String)
+], ActionTreeForPermissionDto.prototype, "companyId", void 0);
 let ActionTreeQueryDto = class ActionTreeQueryDto {
     constructor(){
         _define_property(this, "search", void 0);

package/cjs/entities/index.spec.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _index = require("./index");
+const _actionentity = require("./action.entity");
+const _roleentity = require("./role.entity");
+const _rolewithcompanyentity = require("./role-with-company.entity");
+const _useriampermissionentity = require("./user-iam-permission.entity");
+const _permissionwithcompanyentity = require("./permission-with-company.entity");
+describe('getIAMEntitiesByConfig', ()=>{
+    it('should always include Action', ()=>{
+        expect((0, _index.getIAMEntitiesByConfig)(false)).toContain(_actionentity.Action);
+        expect((0, _index.getIAMEntitiesByConfig)(true)).toContain(_actionentity.Action);
+    });
+    it('should default permissionMode to FULL and include Role + UserIamPermission when company feature is off', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(false);
+        expect(entities).toEqual(expect.arrayContaining([
+            _actionentity.Action,
+            _useriampermissionentity.UserIamPermission,
+            _roleentity.Role
+        ]));
+        expect(entities).not.toContain(_rolewithcompanyentity.RoleWithCompany);
+        expect(entities).not.toContain(_permissionwithcompanyentity.UserIamPermissionWithCompany);
+    });
+    it('should use the company-scoped permission entity when enableCompanyFeature is true', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(true, 'FULL');
+        expect(entities).toContain(_permissionwithcompanyentity.UserIamPermissionWithCompany);
+        expect(entities).not.toContain(_useriampermissionentity.UserIamPermission);
+    });
+    it('should use the company-scoped role entity when enableCompanyFeature is true', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(true, 'RBAC');
+        expect(entities).toContain(_rolewithcompanyentity.RoleWithCompany);
+        expect(entities).not.toContain(_roleentity.Role);
+    });
+    it('should include Role for RBAC mode', ()=>{
+        expect((0, _index.getIAMEntitiesByConfig)(false, 'RBAC')).toContain(_roleentity.Role);
+    });
+    it('should include Role for FULL mode', ()=>{
+        expect((0, _index.getIAMEntitiesByConfig)(false, 'FULL')).toContain(_roleentity.Role);
+    });
+    it('should exclude Role entirely for DIRECT mode', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(false, 'DIRECT');
+        expect(entities).not.toContain(_roleentity.Role);
+        expect(entities).not.toContain(_rolewithcompanyentity.RoleWithCompany);
+        expect(entities).toEqual(expect.arrayContaining([
+            _actionentity.Action,
+            _useriampermissionentity.UserIamPermission
+        ]));
+    });
+    it('should exclude the company-scoped Role for DIRECT mode even with company feature enabled', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(true, 'DIRECT');
+        expect(entities).not.toContain(_rolewithcompanyentity.RoleWithCompany);
+        expect(entities).toContain(_permissionwithcompanyentity.UserIamPermissionWithCompany);
+    });
+});

package/cjs/helpers/company-access.helper.spec.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _common = require("@nestjs/common");
+const _constants = require("@flusys/nestjs-shared/constants");
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _companyaccesshelper = require("./company-access.helper");
+describe('validateCompanyAccess', ()=>{
+    function buildConfig(isCompanyFeatureEnabled) {
+        return {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(isCompanyFeatureEnabled)
+        };
+    }
+    it('does not throw when company feature is disabled', ()=>{
+        const config = buildConfig(false);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user)).not.toThrow();
+    });
+    it('does not throw when companyId is undefined', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, undefined, user)).not.toThrow();
+    });
+    it('does not throw when the companyId matches the user company', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-1', user)).not.toThrow();
+    });
+    it('throws ForbiddenException with default message/key when the company does not match', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        try {
+            (0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user);
+            fail('expected validateCompanyAccess to throw');
+        } catch (error) {
+            expect(error).toBeInstanceOf(_common.ForbiddenException);
+            expect(error.getResponse()).toEqual(expect.objectContaining({
+                message: 'You do not have access to this company',
+                messageKey: _constants.AUTH_MESSAGES.COMPANY_NO_ACCESS
+            }));
+        }
+    });
+    it('throws with a custom message and messageKey when provided', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        try {
+            (0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user, 'Custom message', 'custom.message.key');
+            fail('expected validateCompanyAccess to throw');
+        } catch (error) {
+            expect(error).toBeInstanceOf(_common.ForbiddenException);
+            expect(error.getResponse()).toEqual(expect.objectContaining({
+                message: 'Custom message',
+                messageKey: 'custom.message.key'
+            }));
+        }
+    });
+});

package/cjs/helpers/permission-mode.helper.spec.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _permissiontypeenum = require("../enums/permission-type.enum");
+const _permissionmodehelper = require("./permission-mode.helper");
+describe('PermissionModeHelper', ()=>{
+    describe('fromString', ()=>{
+        it('converts "RBAC" to IAMPermissionMode.RBAC', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('RBAC')).toBe(_permissiontypeenum.IAMPermissionMode.RBAC);
+        });
+        it('converts "DIRECT" to IAMPermissionMode.DIRECT', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('DIRECT')).toBe(_permissiontypeenum.IAMPermissionMode.DIRECT);
+        });
+        it('converts "FULL" to IAMPermissionMode.FULL', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('FULL')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is undefined', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString(undefined)).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is empty', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is not a known mode', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('INVALID_MODE')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('is case-sensitive and falls back to FULL for lowercase input', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('rbac')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+    });
+    describe('toString', ()=>{
+        it('converts IAMPermissionMode.RBAC to "RBAC"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.RBAC)).toBe('RBAC');
+        });
+        it('converts IAMPermissionMode.DIRECT to "DIRECT"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.DIRECT)).toBe('DIRECT');
+        });
+        it('converts IAMPermissionMode.FULL to "FULL"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.FULL)).toBe('FULL');
+        });
+    });
+    describe('round trip', ()=>{
+        it('fromString(toString(mode)) returns the original mode for every enum value', ()=>{
+            const modes = [
+                _permissiontypeenum.IAMPermissionMode.RBAC,
+                _permissiontypeenum.IAMPermissionMode.DIRECT,
+                _permissiontypeenum.IAMPermissionMode.FULL
+            ];
+            for (const mode of modes){
+                expect(_permissionmodehelper.PermissionModeHelper.fromString(_permissionmodehelper.PermissionModeHelper.toString(mode))).toBe(mode);
+            }
+        });
+    });
+});

package/cjs/modules/iam.module.js

@@ -68,7 +68,9 @@ let IAMModule = class IAMModule {
         return {
             provide: _nestjsshared.PERMISSION_GUARD_CONFIG,
             useValue: {
-                enableCompanyFeature
+                enableCompanyFeature,
+                userPermissionKeyFormat: `${_permissioncacheservice.MY_PERMISSIONS_CACHE_PREFIX}:user:{userId}`,
+                companyPermissionKeyFormat: `${_permissioncacheservice.MY_PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`
             }
         };
     }

package/cjs/modules/iam.module.spec.js

@@ -0,0 +1,293 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _nestjsshared = require("@flusys/nestjs-shared");
+const _iammodule = require("./iam.module");
+const _iamconstants = require("../config/iam.constants");
+const _controllers = require("../controllers");
+const _services = require("../services");
+const _iamconfigservice = require("../services/iam-config.service");
+const _iamdatasourceservice = require("../services/iam-datasource.service");
+const _permissioncacheservice = require("../services/permission-cache.service");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function providerTokens(providers) {
+    return providers.map((p)=>typeof p === 'function' ? p : p.provide);
+}
+describe('IAMModule', ()=>{
+    describe('forRoot - controller/service registration matrix', ()=>{
+        it('should register no controllers by default (includeController defaults to false)', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(dynamicModule.controllers).toEqual([]);
+        });
+        it('DIRECT mode: registers only UserActionPermissionController beyond the base set', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.UserActionPermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).not.toContain(_services.RoleService);
+        });
+        it('RBAC mode: registers RoleController + RolePermissionController but not UserActionPermissionController', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.RoleController,
+                _controllers.RolePermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).toContain(_services.RoleService);
+        });
+        it('FULL mode: registers every permission controller', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]);
+        });
+        it('defaults to FULL mode when permissionMode is omitted', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]));
+        });
+        it('defaults to FULL mode when permissionMode is an unrecognized string', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'BOGUS'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]));
+        });
+        it('adds CompanyActionPermissionController only when enableCompanyFeature is true', ()=>{
+            const withCompany = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const withoutCompany = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: false
+                }
+            });
+            expect(withCompany.controllers).toContain(_controllers.CompanyActionPermissionController);
+            expect(withoutCompany.controllers).not.toContain(_controllers.CompanyActionPermissionController);
+        });
+        it('excludes RoleService for DIRECT mode but includes it for RBAC/FULL', ()=>{
+            const direct = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            const rbac = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            const full = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(providerTokens(direct.providers)).not.toContain(_services.RoleService);
+            expect(providerTokens(rbac.providers)).toContain(_services.RoleService);
+            expect(providerTokens(full.providers)).toContain(_services.RoleService);
+            expect(providerTokens(direct.exports)).not.toContain(_services.RoleService);
+            expect(providerTokens(rbac.exports)).toContain(_services.RoleService);
+        });
+        it('always registers the base providers/exports (ActionService, PermissionService, PermissionCacheService)', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(providerTokens(dynamicModule.providers)).toEqual(expect.arrayContaining([
+                _iamconfigservice.IAMConfigService,
+                _iamdatasourceservice.IAMDataSourceService,
+                _services.ActionService,
+                _services.PermissionService,
+                _permissioncacheservice.PermissionCacheService
+            ]));
+            expect(dynamicModule.exports).toEqual(expect.arrayContaining([
+                _iamconfigservice.IAMConfigService,
+                _iamdatasourceservice.IAMDataSourceService,
+                _services.ActionService,
+                _services.PermissionService,
+                _permissioncacheservice.PermissionCacheService,
+                _nestjsshared.PERMISSION_GUARD_CONFIG
+            ]));
+        });
+    });
+    describe('forRoot - options/global handling', ()=>{
+        it('should not set `global` on the returned module when global is false/omitted', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(dynamicModule.global).toBeUndefined();
+        });
+        it('should set global: true when requested', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                global: true
+            });
+            expect(dynamicModule.global).toBe(true);
+        });
+        it('should register IAM_MODULE_OPTIONS with the given options', ()=>{
+            const options = {
+                includeController: true
+            };
+            const dynamicModule = _iammodule.IAMModule.forRoot(options);
+            const provider = dynamicModule.providers.find((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(provider.useValue).toBe(options);
+        });
+        it('should build a company-aware PERMISSION_GUARD_CONFIG provider', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const provider = dynamicModule.providers.find((p)=>p.provide === _nestjsshared.PERMISSION_GUARD_CONFIG);
+            expect(provider.useValue.enableCompanyFeature).toBe(true);
+            expect(provider.useValue.userPermissionKeyFormat).toContain('{userId}');
+            expect(provider.useValue.companyPermissionKeyFormat).toContain('{companyId}');
+        });
+    });
+    describe('forRootAsync', ()=>{
+        it('mirrors the controller/service registration matrix of forRoot', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.UserActionPermissionController
+            ]);
+        });
+        it('should forward external imports alongside CacheModule/UtilsModule', ()=>{
+            let FakeImportedModule = class FakeImportedModule {
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                imports: [
+                    FakeImportedModule
+                ]
+            });
+            expect(dynamicModule.imports).toEqual(expect.arrayContaining([
+                FakeImportedModule
+            ]));
+        });
+        it('useFactory: registers a single options provider using the given inject tokens', async ()=>{
+            const useFactory = jest.fn().mockResolvedValue({
+                foo: 'bar'
+            });
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useFactory,
+                inject: [
+                    'SOME_TOKEN'
+                ]
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.useFactory).toBe(useFactory);
+            expect(provider.inject).toEqual([
+                'SOME_TOKEN'
+            ]);
+        });
+        it('useClass: registers both the class provider and an options provider that calls createIAMOptions()', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-class'
+                    }));
+                }
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useClass: MyOptionsFactory
+            });
+            const classProvider = dynamicModule.providers.find((p)=>p.provide === MyOptionsFactory);
+            expect(classProvider.useClass).toBe(MyOptionsFactory);
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProvider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await optionsProvider.useFactory(instance);
+            expect(instance.createIAMOptions).toHaveBeenCalled();
+            expect(resolved).toEqual({
+                foo: 'from-class'
+            });
+        });
+        it('useExisting: registers a single options provider injecting the existing factory', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-existing'
+                    }));
+                }
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useExisting: MyOptionsFactory
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await provider.useFactory(instance);
+            expect(resolved).toEqual({
+                foo: 'from-existing'
+            });
+        });
+    });
+    describe('forFeature', ()=>{
+        it('should behave identically to forRoot', ()=>{
+            const options = {
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            };
+            expect(_iammodule.IAMModule.forFeature(options)).toEqual(_iammodule.IAMModule.forRoot(options));
+        });
+    });
+});