@flusys/nestjs-iam 6.0.1 → 6.1.0

package/cjs/services/permission.service.js

@@ -18,9 +18,9 @@ const _permissionwithcompanyentity = require("../entities/permission-with-compan
 const _rolewithcompanyentity = require("../entities/role-with-company.entity");
 const _roleentity = require("../entities/role.entity");
 const _useriampermissionentity = require("../entities/user-iam-permission.entity");
+const _actiontypeenum = require("../enums/action-type.enum");
 const _iamentitytypeenum = require("../enums/iam-entity-type.enum");
 const _iampermissiontypeenum = require("../enums/iam-permission-type.enum");
-const _actiontypeenum = require("../enums/action-type.enum");
 const _permissiontypeenum = require("../enums/permission-type.enum");
 const _iamconfigservice = require("./iam-config.service");
 const _iamdatasourceservice = require("./iam-datasource.service");
@@ -67,6 +67,18 @@ let PermissionService = class PermissionService {
         const entity = enableCompanyFeature ? _rolewithcompanyentity.RoleWithCompany : _roleentity.Role;
         return this.dataSourceProvider.getRepository(entity);
     }
+    async getActionsMap(actionIds) {
+        const actionRepo = await this.getActionRepository();
+        const actions = await actionRepo.find({
+            where: {
+                id: (0, _typeorm.In)(actionIds)
+            }
+        });
+        return new Map(actions.map((a)=>[
+                a.id,
+                a
+            ]));
+    }
     // User-Action Permissions
     async assignUserActions(dto) {
         if (!this.iamConfigService.isDirectPermissionEnabled()) {
@@ -143,12 +155,13 @@ let PermissionService = class PermissionService {
             const result = await permissionRepo.delete(whereDelete);
             removed = result.affected || 0;
         }
-        await this.invalidateUserPermissionCache(dto.userId, branchId, companyId);
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
+            branchId
+        ]);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
     async getUserActions(userId, branchId, companyId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const where = {
             permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
@@ -166,16 +179,7 @@ let PermissionService = class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actionWhere = {
-            id: (0, _typeorm.In)(actionIds)
-        };
-        const actions = await actionRepo.find({
-            where: actionWhere
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -272,7 +276,6 @@ let PermissionService = class PermissionService {
     }
     async getRoleActions(roleId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const permissions = await permissionRepo.find({
             where: {
                 permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
@@ -284,16 +287,7 @@ let PermissionService = class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actionWhere = {
-            id: (0, _typeorm.In)(actionIds)
-        };
-        const actions = await actionRepo.find({
-            where: actionWhere
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -320,8 +314,7 @@ let PermissionService = class PermissionService {
             }
             if (itemsToRemove.length > 0) {
                 const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
-                const cascadeResult = await this.removeCompanyActionsWithCascade(manager, dto.companyId, actionIdsToRemove);
-                removed = cascadeResult.removedCompanyActions;
+                removed = await this.removeCompanyActionsWithCascade(manager, dto.companyId, actionIdsToRemove);
             }
         });
         await this.invalidateCompanyMembersCache(dto.companyId);
@@ -377,37 +370,28 @@ let PermissionService = class PermissionService {
                 'id'
             ]
         });
-        let removedRoleActions = 0;
-        let removedUserActions = 0;
         if (companyRoles.length > 0) {
             const roleIds = companyRoles.map((role)=>role.id);
-            const roleResult = await permissionRepo.delete({
+            await permissionRepo.delete({
                 permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
                 sourceType: _iamentitytypeenum.IamEntityType.ROLE,
                 sourceId: (0, _typeorm.In)(roleIds),
                 targetType: _iamentitytypeenum.IamEntityType.ACTION,
                 targetId: (0, _typeorm.In)(actionIds)
             });
-            removedRoleActions = roleResult.affected || 0;
         }
         if (this.iamConfigService.isCompanyFeatureEnabled()) {
-            const userResult = await permissionRepo.delete({
+            await permissionRepo.delete({
                 permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
                 companyId,
                 targetType: _iamentitytypeenum.IamEntityType.ACTION,
                 targetId: (0, _typeorm.In)(actionIds)
             });
-            removedUserActions = userResult.affected || 0;
         }
-        return {
-            removedCompanyActions: companyResult.affected || 0,
-            removedRoleActions,
-            removedUserActions
-        };
+        return companyResult.affected || 0;
     }
     /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId) {
         const permissionRepo = await this.getPermissionRepository();
-        const actionRepo = await this.getActionRepository();
         const permissions = await permissionRepo.find({
             where: {
                 permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION,
@@ -419,15 +403,7 @@ let PermissionService = class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
-        const actions = await actionRepo.find({
-            where: {
-                id: (0, _typeorm.In)(actionIds)
-            }
-        });
-        const actionMap = new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
+        const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
             return {
@@ -530,7 +506,9 @@ let PermissionService = class PermissionService {
             const result = await permissionRepo.delete(whereDelete);
             removed = result.affected || 0;
         }
-        await this.invalidateUserPermissionCache(dto.userId, branchId, companyId);
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
+            branchId
+        ]);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
     /** Get user's roles (branch-scoped, filtered by companyId and branchId if provided) */ async getUserRoles(userId, branchId, companyId) {
@@ -581,9 +559,8 @@ let PermissionService = class PermissionService {
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const cacheOptions = {
             userId,
-            companyId,
-            branchId,
-            enableCompanyFeature
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId
         };
         const cachedData = await this.permissionCacheService.getMyPermissions(cacheOptions);
         if (cachedData) {
@@ -612,42 +589,25 @@ let PermissionService = class PermissionService {
             cachedEndpoints: cachedData.backendCodes.length
         };
     }
-    /** Get current tenant ID for multi-tenant cache keys */ getCurrentTenantId() {
-        if (!this.iamConfigService.isMultiTenant()) {
-            return undefined;
-        }
-        const tenant = this.dataSourceProvider.getCurrentTenant();
-        return tenant?.id;
-    }
-    /** Get parent IDs by codes, using cache first (tenant-aware) */ async getParentIdsByCodesWithCache(codes) {
-        const tenantId = this.getCurrentTenantId();
-        const cachedMap = await this.permissionCacheService.getActionIdsByCodes(codes, tenantId);
-        if (cachedMap) {
-            return new Set(Object.values(cachedMap));
-        }
+    /** Resolve action IDs for the given codes */ async getParentIdsByCodesWithCache(codes) {
         const actionRepo = await this.getActionRepository();
-        const allActions = await actionRepo.find({
+        const actions = await actionRepo.find({
+            where: {
+                code: (0, _typeorm.In)(codes)
+            },
             select: [
                 'id',
                 'code'
             ]
         });
-        const fullMap = {};
-        for (const action of allActions){
-            if (action.code) {
-                fullMap[action.code] = action.id;
-            }
-        }
-        await this.permissionCacheService.setActionCodeMap(fullMap, tenantId);
-        return new Set(codes.map((code)=>fullMap[code]).filter(Boolean));
+        return new Set(actions.map((action)=>action.id));
     }
     /** Fetch permissions from DB and cache them (empty permissions are also cached) */ async fetchAndCachePermissions(userId, branchId, companyId) {
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const cacheOptions = {
             userId,
-            companyId,
-            branchId,
-            enableCompanyFeature
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId
         };
         const emptyData = {
             frontendActions: [],
@@ -700,7 +660,8 @@ let PermissionService = class PermissionService {
         const actionRepo = await this.getActionRepository();
         const actions = await actionRepo.find({
             where: {
-                id: (0, _typeorm.In)(Array.from(actionIds))
+                id: (0, _typeorm.In)(Array.from(actionIds)),
+                isActive: true
             }
         });
         const backendActions = actions.filter((a)=>a.actionType === _actiontypeenum.ActionType.BACKEND || a.actionType === _actiontypeenum.ActionType.BOTH);
@@ -716,10 +677,7 @@ let PermissionService = class PermissionService {
                 })),
             backendCodes
         };
-        await Promise.all([
-            this.permissionCacheService.setMyPermissions(cacheOptions, cacheData),
-            this.permissionCacheService.setPermissions(cacheOptions, backendCodes)
-        ]);
+        await this.permissionCacheService.setMyPermissions(cacheOptions, cacheData);
         return cacheData;
     }
     // Helper Methods
@@ -753,9 +711,11 @@ let PermissionService = class PermissionService {
         const baseWhere = {
             permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
             sourceType: _iamentitytypeenum.IamEntityType.USER,
-            sourceId: userId,
-            companyId: companyId
+            sourceId: userId
         };
+        if (companyId) {
+            baseWhere.companyId = companyId;
+        }
         if (branchId) {
             // Get company-wide + branch-specific roles
             const companyWidePermissions = await permissionRepo.find({
@@ -839,14 +799,6 @@ let PermissionService = class PermissionService {
         }
         return Array.from(actionIds);
     }
-    /** Invalidate permission cache for a user */ async invalidateUserPermissionCache(userId, branchId, companyId) {
-        const branchIds = branchId !== undefined ? [
-            branchId
-        ] : [
-            null
-        ];
-        await this.permissionCacheService.invalidateUser(userId, companyId, branchIds);
-    }
     async invalidateRoleMembersCache(roleId) {
         const permissionRepo = await this.getPermissionRepository();
         const roleRepo = await this.getRoleRepository();
@@ -884,7 +836,7 @@ let PermissionService = class PermissionService {
                 ...new Set(userBranches.map((p)=>p.branchId))
             ];
         }
-        return this.permissionCacheService.invalidateRole(roleId, userIds, companyId, branchIds);
+        return this.permissionCacheService.invalidateUsers(userIds, companyId, branchIds);
     }
     /** Invalidate permission cache for all users in a company */ async invalidateCompanyMembersCache(companyId) {
         if (!this.iamConfigService.isCompanyFeatureEnabled()) {
@@ -905,6 +857,127 @@ let PermissionService = class PermissionService {
         }
         return await this.permissionCacheService.invalidateUsers(userIds, companyId, branchIds);
     }
+    async revokeCompanyPermissions(companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const roleRepo = await this.getRoleRepository();
+        const dataSource = permissionRepo.manager.connection;
+        const companyRoles = await roleRepo.find({
+            where: {
+                companyId,
+                deletedAt: (0, _typeorm.IsNull)()
+            },
+            select: [
+                'id'
+            ]
+        });
+        const roleIds = companyRoles.map((role)=>role.id);
+        const affectedUserRows = await permissionRepo.find({
+            where: {
+                permissionType: (0, _typeorm.In)([
+                    _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                    _iampermissiontypeenum.IamPermissionType.USER_ACTION
+                ]),
+                companyId
+            },
+            select: [
+                'userId'
+            ]
+        });
+        const affectedUserIds = [
+            ...new Set(affectedUserRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await dataSource.transaction(async (manager)=>{
+            const txRepo = manager.getRepository(permissionRepo.target);
+            await txRepo.delete({
+                permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION,
+                sourceType: _iamentitytypeenum.IamEntityType.COMPANY,
+                sourceId: companyId
+            });
+            if (roleIds.length > 0) {
+                await txRepo.delete({
+                    permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
+                    sourceType: _iamentitytypeenum.IamEntityType.ROLE,
+                    sourceId: (0, _typeorm.In)(roleIds)
+                });
+            }
+            await txRepo.delete({
+                permissionType: (0, _typeorm.In)([
+                    _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                    _iampermissiontypeenum.IamPermissionType.USER_ACTION
+                ]),
+                companyId
+            });
+            if (roleIds.length > 0) {
+                const txRoleRepo = manager.getRepository(roleRepo.target);
+                await txRoleRepo.delete(roleIds);
+            }
+        });
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId);
+        }
+    }
+    async revokeBranchPermissions(branchId, companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const where = {
+            permissionType: (0, _typeorm.In)([
+                _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                _iampermissiontypeenum.IamPermissionType.USER_ACTION
+            ]),
+            branchId,
+            companyId
+        };
+        const affectedUserRows = await permissionRepo.find({
+            where,
+            select: [
+                'userId'
+            ]
+        });
+        const affectedUserIds = [
+            ...new Set(affectedUserRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await permissionRepo.delete(where);
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId, [
+                branchId
+            ]);
+        }
+    }
+    async revokeUserCompanyAccess(userId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        await permissionRepo.delete({
+            permissionType: (0, _typeorm.In)([
+                _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                _iampermissiontypeenum.IamPermissionType.USER_ACTION
+            ]),
+            sourceType: _iamentitytypeenum.IamEntityType.USER,
+            sourceId: userId,
+            companyId
+        });
+        await this.permissionCacheService.invalidateUser(userId, companyId);
+    }
+    async revokeUserBranchAccess(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const where = {
+            permissionType: (0, _typeorm.In)([
+                _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                _iampermissiontypeenum.IamPermissionType.USER_ACTION
+            ]),
+            sourceType: _iamentitytypeenum.IamEntityType.USER,
+            sourceId: userId,
+            branchId,
+            companyId
+        };
+        await permissionRepo.delete(where);
+        await this.permissionCacheService.invalidateUser(userId, companyId, [
+            branchId
+        ]);
+    }
     // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
     constructor(permissionCacheService, iamConfigService, dataSourceProvider){
         _define_property(this, "permissionCacheService", void 0);
@@ -959,6 +1032,54 @@ _ts_decorate([
     ]),
     _ts_metadata("design:returntype", Promise)
 ], PermissionService.prototype, "assignUserRoles", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'iam.revokeCompanyPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeCompanyPermissions", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'iam.revokeBranchPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeBranchPermissions", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'iam.revokeUserCompanyAccess',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeUserCompanyAccess", null);
+_ts_decorate([
+    (0, _nestjsshared.LogAction)({
+        action: 'iam.revokeUserBranchAccess',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeUserBranchAccess", null);
 PermissionService = _ts_decorate([
     (0, _common.Injectable)({
         scope: _common.Scope.REQUEST