@flusys/nestjs-iam 6.0.1 → 6.1.0

package/cjs/services/permission.service.spec.js

@@ -0,0 +1,967 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _testing = require("@nestjs/testing");
+const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _config = require("../config");
+const _permissiondto = require("../dtos/permission.dto");
+const _actionentity = require("../entities/action.entity");
+const _roleentity = require("../entities/role.entity");
+const _rolewithcompanyentity = require("../entities/role-with-company.entity");
+const _actiontypeenum = require("../enums/action-type.enum");
+const _iamentitytypeenum = require("../enums/iam-entity-type.enum");
+const _iampermissiontypeenum = require("../enums/iam-permission-type.enum");
+const _permissiontypeenum = require("../enums/permission-type.enum");
+const _iamconfigservice = require("./iam-config.service");
+const _iamdatasourceservice = require("./iam-datasource.service");
+const _permissioncacheservice = require("./permission-cache.service");
+const _permissionservice = require("./permission.service");
+function buildPermissionRow(overrides = {}) {
+    const row = {
+        id: 'perm-uuid-1',
+        permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
+        sourceType: _iamentitytypeenum.IamEntityType.USER,
+        sourceId: 'user-1',
+        targetType: _iamentitytypeenum.IamEntityType.ACTION,
+        targetId: 'action-1',
+        userId: 'user-1',
+        companyId: null,
+        branchId: null,
+        validFrom: null,
+        validUntil: null,
+        reason: null,
+        createdAt: new Date(),
+        ...overrides
+    };
+    row.isValid = (now = new Date())=>{
+        if (row.validFrom && now < row.validFrom) return false;
+        if (row.validUntil && now > row.validUntil) return false;
+        return true;
+    };
+    return row;
+}
+function buildDeleteResult(affected) {
+    return {
+        affected,
+        raw: []
+    };
+}
+function mockRawMany(repo, rows) {
+    const builder = {
+        select: jest.fn().mockReturnThis(),
+        addSelect: jest.fn().mockReturnThis(),
+        where: jest.fn().mockReturnThis(),
+        andWhere: jest.fn().mockReturnThis(),
+        getRawMany: jest.fn().mockResolvedValue(rows)
+    };
+    repo.createQueryBuilder.mockReturnValue(builder);
+    return builder;
+}
+function buildAction(overrides = {}) {
+    return {
+        id: 'action-1',
+        name: 'View Users',
+        code: 'user.view',
+        description: null,
+        actionType: _actiontypeenum.ActionType.BACKEND,
+        parentId: null,
+        isActive: true,
+        ...overrides
+    };
+}
+describe('PermissionService', ()=>{
+    let service;
+    let mockPermissionRepo;
+    let mockActionRepo;
+    let mockRoleRepo;
+    let mockIamConfigService;
+    let mockPermissionCacheService;
+    let mockDataSourceProvider;
+    beforeEach(async ()=>{
+        mockPermissionRepo = (0, _repositorymock.createMockRepository)();
+        mockActionRepo = (0, _repositorymock.createMockRepository)();
+        mockRoleRepo = (0, _repositorymock.createMockRepository)();
+        mockDataSourceProvider = {
+            getRepository: jest.fn((entity)=>{
+                if (entity === _actionentity.Action) return Promise.resolve(mockActionRepo);
+                if (entity === _roleentity.Role || entity === _rolewithcompanyentity.RoleWithCompany) return Promise.resolve(mockRoleRepo);
+                return Promise.resolve(mockPermissionRepo);
+            }),
+            getDataSource: jest.fn()
+        };
+        mockIamConfigService = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false),
+            isDirectPermissionEnabled: jest.fn().mockReturnValue(true),
+            isRbacEnabled: jest.fn().mockReturnValue(true),
+            getPermissionMode: jest.fn().mockReturnValue(_permissiontypeenum.IAMPermissionMode.FULL)
+        };
+        mockPermissionCacheService = {
+            invalidateUser: jest.fn(),
+            invalidateUsers: jest.fn(),
+            getMyPermissions: jest.fn(),
+            setMyPermissions: jest.fn()
+        };
+        const module = await _testing.Test.createTestingModule({
+            providers: [
+                _permissionservice.PermissionService,
+                {
+                    provide: _permissioncacheservice.PermissionCacheService,
+                    useValue: mockPermissionCacheService
+                },
+                {
+                    provide: _iamconfigservice.IAMConfigService,
+                    useValue: mockIamConfigService
+                },
+                {
+                    provide: _iamdatasourceservice.IAMDataSourceService,
+                    useValue: mockDataSourceProvider
+                }
+            ]
+        }).compile();
+        service = await module.resolve(_permissionservice.PermissionService);
+    });
+    // ==================== User-Action Permissions ====================
+    describe('assignUserActions', ()=>{
+        const dto = {
+            userId: 'user-1',
+            items: [
+                {
+                    id: 'action-1',
+                    action: _permissiondto.PermissionAction.ADD
+                },
+                {
+                    id: 'action-2',
+                    action: _permissiondto.PermissionAction.ADD
+                },
+                {
+                    id: 'action-3',
+                    action: _permissiondto.PermissionAction.REMOVE
+                }
+            ]
+        };
+        it('throws BadRequestException when direct permissions are disabled (RBAC-only mode)', async ()=>{
+            mockIamConfigService.isDirectPermissionEnabled.mockReturnValue(false);
+            await expect(service.assignUserActions(dto)).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: _config.IAM_MODE_MESSAGES.DIRECT_MODE_UNAVAILABLE
+                })
+            });
+            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
+        });
+        it('adds only actions not already assigned, removes requested actions, and invalidates the user cache', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([
+                {
+                    targetId: 'action-1'
+                }
+            ]);
+            mockPermissionRepo.save.mockResolvedValue([
+                {}
+            ]);
+            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
+            const result = await service.assignUserActions(dto);
+            expect(mockPermissionRepo.save).toHaveBeenCalledWith([
+                expect.objectContaining({
+                    targetId: 'action-2',
+                    companyId: null,
+                    branchId: null
+                })
+            ]);
+            expect(result).toEqual({
+                added: 1,
+                removed: 1,
+                total: 3
+            });
+            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', null, [
+                null
+            ]);
+        });
+        it('scopes new permissions and cache invalidation to the company/branch when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionRepo.find.mockResolvedValue([]);
+            mockPermissionRepo.save.mockResolvedValue([
+                {},
+                {}
+            ]);
+            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
+            await service.assignUserActions({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-1',
+                items: dto.items
+            });
+            expect(mockPermissionRepo.find).toHaveBeenCalledWith(expect.objectContaining({
+                where: expect.objectContaining({
+                    companyId: 'company-1',
+                    branchId: 'branch-1'
+                })
+            }));
+            expect(mockPermissionRepo.save).toHaveBeenCalledWith([
+                expect.objectContaining({
+                    companyId: 'company-1',
+                    branchId: 'branch-1'
+                }),
+                expect.objectContaining({
+                    companyId: 'company-1',
+                    branchId: 'branch-1'
+                })
+            ]);
+            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', 'company-1', [
+                'branch-1'
+            ]);
+        });
+        it('translates a duplicate-entry DB error into ConflictException', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            mockPermissionRepo.save.mockRejectedValue({
+                code: 'ER_DUP_ENTRY'
+            });
+            await expect(service.assignUserActions(dto)).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: _config.PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
+                })
+            });
+        });
+        it('rethrows unknown errors from save as-is', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            const unexpected = new Error('connection lost');
+            mockPermissionRepo.save.mockRejectedValue(unexpected);
+            await expect(service.assignUserActions(dto)).rejects.toBe(unexpected);
+        });
+        it('does nothing but still invalidates the cache when items is empty', async ()=>{
+            const result = await service.assignUserActions({
+                userId: 'user-1',
+                items: []
+            });
+            expect(result).toEqual({
+                added: 0,
+                removed: 0,
+                total: 0
+            });
+            expect(mockPermissionRepo.save).not.toHaveBeenCalled();
+            expect(mockPermissionRepo.delete).not.toHaveBeenCalled();
+            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalled();
+        });
+    });
+    describe('getUserActions', ()=>{
+        it('returns an empty array without querying actions when the user has no permissions', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            const result = await service.getUserActions('user-1', undefined);
+            expect(result).toEqual([]);
+            expect(mockActionRepo.find).not.toHaveBeenCalled();
+        });
+        it('joins permissions with their actions and filters out permissions for deleted actions', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([
+                buildPermissionRow({
+                    targetId: 'action-1'
+                }),
+                buildPermissionRow({
+                    id: 'perm-2',
+                    targetId: 'action-missing'
+                })
+            ]);
+            mockActionRepo.find.mockResolvedValue([
+                buildAction({
+                    id: 'action-1'
+                })
+            ]);
+            const result = await service.getUserActions('user-1', undefined);
+            expect(result).toHaveLength(1);
+            expect(result[0]).toEqual(expect.objectContaining({
+                actionId: 'action-1',
+                actionCode: 'user.view'
+            }));
+        });
+        it('filters by companyId/branchId when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionRepo.find.mockResolvedValue([]);
+            await service.getUserActions('user-1', 'branch-1', 'company-1');
+            expect(mockPermissionRepo.find).toHaveBeenCalledWith({
+                where: expect.objectContaining({
+                    companyId: 'company-1',
+                    branchId: 'branch-1'
+                })
+            });
+        });
+    });
+    // ==================== Role-Action Permissions ====================
+    describe('assignRoleActions', ()=>{
+        const dto = {
+            roleId: 'role-1',
+            items: [
+                {
+                    id: 'action-1',
+                    action: _permissiondto.PermissionAction.ADD
+                },
+                {
+                    id: 'action-2',
+                    action: _permissiondto.PermissionAction.REMOVE
+                }
+            ]
+        };
+        it('throws BadRequestException when RBAC is disabled (DIRECT-only mode)', async ()=>{
+            mockIamConfigService.isRbacEnabled.mockReturnValue(false);
+            await expect(service.assignRoleActions(dto)).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: _config.IAM_MODE_MESSAGES.RBAC_MODE_UNAVAILABLE
+                })
+            });
+        });
+        it('resolves the role company scope from the role repository when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRoleRepo.findOne.mockResolvedValue({
+                id: 'role-1',
+                companyId: 'company-9'
+            });
+            mockPermissionRepo.find.mockResolvedValue([]);
+            mockPermissionRepo.save.mockResolvedValue([
+                {}
+            ]);
+            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
+            await service.assignRoleActions(dto);
+            expect(mockPermissionRepo.save).toHaveBeenCalledWith([
+                expect.objectContaining({
+                    companyId: 'company-9'
+                })
+            ]);
+        });
+        it('translates duplicate role-action entries into ConflictException', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            mockPermissionRepo.save.mockRejectedValue({
+                message: 'Duplicate entry for key'
+            });
+            await expect(service.assignRoleActions(dto)).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: _config.PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
+                })
+            });
+        });
+        it('removes role actions and reports counts and invalidates role member caches', async ()=>{
+            mockPermissionRepo.find.mockResolvedValueOnce([]) // existing check for add
+            .mockResolvedValueOnce([
+                buildPermissionRow({
+                    sourceId: 'user-9'
+                })
+            ]); // invalidateRoleMembersCache lookup (sourceId = the user who holds the role)
+            mockPermissionRepo.save.mockResolvedValue([
+                {}
+            ]);
+            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
+            mockRoleRepo.findOne.mockResolvedValue({
+                id: 'role-1',
+                companyId: null
+            });
+            const result = await service.assignRoleActions(dto);
+            expect(result).toEqual({
+                added: 1,
+                removed: 1,
+                total: 2
+            });
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
+                'user-9'
+            ], null, [
+                null
+            ]);
+        });
+    });
+    describe('getRoleActions', ()=>{
+        it('returns an empty array when the role has no actions assigned', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            const result = await service.getRoleActions('role-1');
+            expect(result).toEqual([]);
+        });
+        it('maps role-action permissions to their action details', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([
+                buildPermissionRow({
+                    sourceId: 'role-1',
+                    targetId: 'action-1'
+                })
+            ]);
+            mockActionRepo.find.mockResolvedValue([
+                buildAction({
+                    id: 'action-1'
+                })
+            ]);
+            const result = await service.getRoleActions('role-1');
+            expect(result).toEqual([
+                expect.objectContaining({
+                    roleId: 'role-1',
+                    actionCode: 'user.view'
+                })
+            ]);
+        });
+    });
+    // ==================== Company-Action Permissions ====================
+    describe('assignCompanyActions', ()=>{
+        function mockTransaction() {
+            const fakeManager = {
+                getRepository: jest.fn((entity)=>{
+                    if (entity === _roleentity.Role || entity === _rolewithcompanyentity.RoleWithCompany) return mockRoleRepo;
+                    return mockPermissionRepo;
+                })
+            };
+            mockPermissionRepo.manager.connection.transaction = jest.fn().mockImplementation((cb)=>cb(fakeManager));
+            return fakeManager;
+        }
+        it('adds new company-whitelisted actions inside a transaction, skipping duplicates', async ()=>{
+            mockTransaction();
+            mockPermissionRepo.find.mockResolvedValue([
+                {
+                    targetId: 'action-1'
+                }
+            ]);
+            mockPermissionRepo.create.mockImplementation((data)=>data);
+            mockPermissionRepo.save.mockResolvedValue([
+                {}
+            ]);
+            const result = await service.assignCompanyActions({
+                companyId: 'company-1',
+                items: [
+                    {
+                        id: 'action-1',
+                        action: _permissiondto.PermissionAction.ADD
+                    },
+                    {
+                        id: 'action-2',
+                        action: _permissiondto.PermissionAction.ADD
+                    }
+                ]
+            });
+            expect(mockPermissionRepo.save).toHaveBeenCalledWith([
+                expect.objectContaining({
+                    targetId: 'action-2',
+                    sourceId: 'company-1'
+                })
+            ]);
+            expect(result.added).toBe(1);
+            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled(); // no company feature -> invalidateCompanyMembersCache no-ops
+        });
+        it('cascades removal to role-action and user-action permissions for the company', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockTransaction();
+            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(2));
+            mockRoleRepo.find.mockResolvedValue([
+                {
+                    id: 'role-1'
+                }
+            ]);
+            mockRawMany(mockPermissionRepo, []);
+            const result = await service.assignCompanyActions({
+                companyId: 'company-1',
+                items: [
+                    {
+                        id: 'action-1',
+                        action: _permissiondto.PermissionAction.REMOVE
+                    }
+                ]
+            });
+            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION
+            }));
+            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION
+            }));
+            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION
+            }));
+            expect(result.removed).toBe(2);
+        });
+    });
+    describe('getCompanyActions / getCompanyActionIds', ()=>{
+        it('getCompanyActions returns an empty array when the company has no whitelist entries', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            expect(await service.getCompanyActions('company-1')).toEqual([]);
+        });
+        it('getCompanyActions maps whitelist entries to action details', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([
+                buildPermissionRow({
+                    sourceType: _iamentitytypeenum.IamEntityType.COMPANY,
+                    sourceId: 'company-1',
+                    targetId: 'action-1'
+                })
+            ]);
+            mockActionRepo.find.mockResolvedValue([
+                buildAction({
+                    id: 'action-1'
+                })
+            ]);
+            const result = await service.getCompanyActions('company-1');
+            expect(result).toEqual([
+                expect.objectContaining({
+                    companyId: 'company-1',
+                    actionCode: 'user.view'
+                })
+            ]);
+        });
+        it('getCompanyActionIds returns just the whitelisted action ids', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([
+                {
+                    targetId: 'action-1'
+                },
+                {
+                    targetId: 'action-2'
+                }
+            ]);
+            const result = await service.getCompanyActionIds('company-1');
+            expect(result).toEqual([
+                'action-1',
+                'action-2'
+            ]);
+        });
+    });
+    // ==================== User-Role Permissions ====================
+    describe('assignUserRoles', ()=>{
+        const dto = {
+            userId: 'user-1',
+            items: [
+                {
+                    id: 'role-1',
+                    action: _permissiondto.PermissionAction.ADD
+                }
+            ]
+        };
+        it('throws BadRequestException when RBAC is disabled (DIRECT-only mode)', async ()=>{
+            mockIamConfigService.isRbacEnabled.mockReturnValue(false);
+            await expect(service.assignUserRoles(dto)).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: _config.IAM_MODE_MESSAGES.ROLE_ASSIGNMENT_UNAVAILABLE
+                })
+            });
+        });
+        it('adds new role assignments and invalidates the user cache', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            mockPermissionRepo.save.mockResolvedValue([
+                {}
+            ]);
+            const result = await service.assignUserRoles(dto);
+            expect(result).toEqual({
+                added: 1,
+                removed: 0,
+                total: 1
+            });
+            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', null, [
+                null
+            ]);
+        });
+        it('translates duplicate user-role entries into ConflictException', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            mockPermissionRepo.save.mockRejectedValue({
+                code: 'ER_DUP_ENTRY'
+            });
+            await expect(service.assignUserRoles(dto)).rejects.toMatchObject({
+                response: expect.objectContaining({
+                    messageKey: _config.PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
+                })
+            });
+        });
+    });
+    describe('getUserRoles', ()=>{
+        it('returns an empty array when the user has no role assignments', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([]);
+            expect(await service.getUserRoles('user-1')).toEqual([]);
+            expect(mockRoleRepo.find).not.toHaveBeenCalled();
+        });
+        it('joins role permissions with role details and filters out permissions for deleted roles', async ()=>{
+            mockPermissionRepo.find.mockResolvedValue([
+                buildPermissionRow({
+                    targetId: 'role-1',
+                    targetType: _iamentitytypeenum.IamEntityType.ROLE
+                }),
+                buildPermissionRow({
+                    id: 'perm-2',
+                    targetId: 'role-missing',
+                    targetType: _iamentitytypeenum.IamEntityType.ROLE
+                })
+            ]);
+            mockRoleRepo.find.mockResolvedValue([
+                {
+                    id: 'role-1',
+                    name: 'Manager'
+                }
+            ]);
+            const result = await service.getUserRoles('user-1');
+            expect(result).toHaveLength(1);
+            expect(result[0]).toEqual(expect.objectContaining({
+                roleId: 'role-1',
+                roleName: 'Manager'
+            }));
+        });
+    });
+    // ==================== My Permissions / permission-mode branching ====================
+    describe('getMyPermissions', ()=>{
+        it('returns the response built directly from cached data on a cache hit', async ()=>{
+            mockPermissionCacheService.getMyPermissions.mockResolvedValue({
+                frontendActions: [
+                    {
+                        id: 'action-1',
+                        code: 'user.view',
+                        name: 'View',
+                        description: null,
+                        parentId: null
+                    }
+                ],
+                backendCodes: [
+                    'user.read'
+                ]
+            });
+            const result = await service.getMyPermissions('user-1', null, 'company-1');
+            expect(result.frontendActions).toHaveLength(1);
+            expect(result.cachedEndpoints).toBe(1);
+            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
+        });
+        it('fetches from the database and caches the result on a cache miss', async ()=>{
+            mockPermissionCacheService.getMyPermissions.mockResolvedValue(null);
+            mockPermissionRepo.find.mockResolvedValue([]);
+            const result = await service.getMyPermissions('user-1', null, null);
+            expect(result).toEqual({
+                frontendActions: [],
+                cachedEndpoints: 0
+            });
+            expect(mockPermissionCacheService.setMyPermissions).toHaveBeenCalled();
+        });
+        it('filters frontend actions by parentCodes when provided', async ()=>{
+            mockPermissionCacheService.getMyPermissions.mockResolvedValue({
+                frontendActions: [
+                    {
+                        id: 'child-1',
+                        code: 'user.view',
+                        name: 'View',
+                        description: null,
+                        parentId: 'parent-1'
+                    },
+                    {
+                        id: 'child-2',
+                        code: 'other.view',
+                        name: 'View 2',
+                        description: null,
+                        parentId: 'other-parent'
+                    }
+                ],
+                backendCodes: []
+            });
+            mockActionRepo.find.mockResolvedValue([
+                {
+                    id: 'parent-1',
+                    code: 'user'
+                }
+            ]);
+            const result = await service.getMyPermissions('user-1', null, null, [
+                'user'
+            ]);
+            expect(result.frontendActions).toHaveLength(1);
+            expect(result.frontendActions[0].id).toBe('child-1');
+        });
+        it('returns an empty frontendActions list when parentCodes resolve to no known parents', async ()=>{
+            mockPermissionCacheService.getMyPermissions.mockResolvedValue({
+                frontendActions: [
+                    {
+                        id: 'child-1',
+                        code: 'user.view',
+                        name: 'View',
+                        description: null,
+                        parentId: 'parent-1'
+                    }
+                ],
+                backendCodes: []
+            });
+            mockActionRepo.find.mockResolvedValue([]);
+            const result = await service.getMyPermissions('user-1', null, null, [
+                'unknown-parent-code'
+            ]);
+            expect(result.frontendActions).toEqual([]);
+        });
+    });
+    describe('collectAllActionIds (permission-mode branching)', ()=>{
+        it('RBAC mode: collects only role-derived action ids, ignoring direct user actions', async ()=>{
+            mockIamConfigService.getPermissionMode.mockReturnValue(_permissiontypeenum.IAMPermissionMode.RBAC);
+            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
+                if (where.permissionType === _iampermissiontypeenum.IamPermissionType.USER_ROLE) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                            targetId: 'role-1'
+                        })
+                    ];
+                }
+                if (where.permissionType === _iampermissiontypeenum.IamPermissionType.ROLE_ACTION) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
+                            targetId: 'action-role-1'
+                        })
+                    ];
+                }
+                if (where.permissionType === _iampermissiontypeenum.IamPermissionType.USER_ACTION) {
+                    throw new Error('DIRECT lookup should not run in RBAC mode');
+                }
+                return [];
+            });
+            const result = await service.collectAllActionIds('user-1', null, null);
+            expect(Array.from(result)).toEqual([
+                'action-role-1'
+            ]);
+        });
+        it('DIRECT mode: collects only directly-assigned user action ids, ignoring roles', async ()=>{
+            mockIamConfigService.getPermissionMode.mockReturnValue(_permissiontypeenum.IAMPermissionMode.DIRECT);
+            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
+                if (where.permissionType === _iampermissiontypeenum.IamPermissionType.USER_ROLE) {
+                    throw new Error('RBAC lookup should not run in DIRECT mode');
+                }
+                if (where.permissionType === _iampermissiontypeenum.IamPermissionType.USER_ACTION) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
+                            targetId: 'action-direct-1'
+                        })
+                    ];
+                }
+                return [];
+            });
+            const result = await service.collectAllActionIds('user-1', null, null);
+            expect(Array.from(result)).toEqual([
+                'action-direct-1'
+            ]);
+        });
+        it('FULL mode: merges role-derived and direct action ids, de-duplicating overlaps', async ()=>{
+            mockIamConfigService.getPermissionMode.mockReturnValue(_permissiontypeenum.IAMPermissionMode.FULL);
+            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
+                if (where.permissionType === _iampermissiontypeenum.IamPermissionType.USER_ROLE) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                            targetId: 'role-1'
+                        })
+                    ];
+                }
+                if (where.permissionType === _iampermissiontypeenum.IamPermissionType.ROLE_ACTION) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
+                            targetId: 'action-shared'
+                        })
+                    ];
+                }
+                if (where.permissionType === _iampermissiontypeenum.IamPermissionType.USER_ACTION) {
+                    return [
+                        buildPermissionRow({
+                            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
+                            targetId: 'action-shared'
+                        }),
+                        buildPermissionRow({
+                            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
+                            targetId: 'action-direct-only'
+                        })
+                    ];
+                }
+                return [];
+            });
+            const result = await service.collectAllActionIds('user-1', null, null);
+            expect(Array.from(result).sort()).toEqual([
+                'action-direct-only',
+                'action-shared'
+            ]);
+        });
+        it('excludes expired/not-yet-valid permission rows via isValid()', async ()=>{
+            mockIamConfigService.getPermissionMode.mockReturnValue(_permissiontypeenum.IAMPermissionMode.DIRECT);
+            const expired = buildPermissionRow({
+                permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
+                targetId: 'action-expired',
+                validUntil: new Date('2000-01-01')
+            });
+            const active = buildPermissionRow({
+                permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
+                targetId: 'action-active'
+            });
+            mockPermissionRepo.find.mockResolvedValue([
+                expired,
+                active
+            ]);
+            const result = await service.collectAllActionIds('user-1', null, null);
+            expect(Array.from(result)).toEqual([
+                'action-active'
+            ]);
+        });
+    });
+    describe('applyCompanyWhitelist', ()=>{
+        it('is a no-op when the company feature is disabled', async ()=>{
+            const actionIds = new Set([
+                'action-1',
+                'action-2'
+            ]);
+            await service.applyCompanyWhitelist(actionIds, 'company-1');
+            expect(actionIds).toEqual(new Set([
+                'action-1',
+                'action-2'
+            ]));
+            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
+        });
+        it('is a no-op when companyId is missing even if the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            const actionIds = new Set([
+                'action-1'
+            ]);
+            await service.applyCompanyWhitelist(actionIds, null);
+            expect(actionIds).toEqual(new Set([
+                'action-1'
+            ]));
+        });
+        it('does not filter anything when the company has an empty whitelist', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionRepo.find.mockResolvedValue([]);
+            const actionIds = new Set([
+                'action-1',
+                'action-2'
+            ]);
+            await service.applyCompanyWhitelist(actionIds, 'company-1');
+            expect(actionIds).toEqual(new Set([
+                'action-1',
+                'action-2'
+            ]));
+        });
+        it('removes action ids that are not present in the company whitelist', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionRepo.find.mockResolvedValue([
+                {
+                    targetId: 'action-1'
+                }
+            ]);
+            const actionIds = new Set([
+                'action-1',
+                'action-2'
+            ]);
+            await service.applyCompanyWhitelist(actionIds, 'company-1');
+            expect(actionIds).toEqual(new Set([
+                'action-1'
+            ]));
+        });
+    });
+    // ==================== Cache invalidation helpers ====================
+    describe('invalidateCompanyMembersCache', ()=>{
+        it('returns 0 without querying when the company feature is disabled', async ()=>{
+            const result = await service.invalidateCompanyMembersCache('company-1');
+            expect(result).toBe(0);
+            expect(mockPermissionRepo.createQueryBuilder).not.toHaveBeenCalled();
+        });
+        it('returns 0 when the company has no members with permissions', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRawMany(mockPermissionRepo, []);
+            const result = await service.invalidateCompanyMembersCache('company-1');
+            expect(result).toBe(0);
+        });
+        it('invalidates every distinct member user id for the company', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRawMany(mockPermissionRepo, [
+                {
+                    userId: 'user-1',
+                    branchId: 'branch-1'
+                },
+                {
+                    userId: 'user-2',
+                    branchId: null
+                }
+            ]);
+            mockPermissionCacheService.invalidateUsers.mockResolvedValue(2);
+            const result = await service.invalidateCompanyMembersCache('company-1');
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
+                'user-1',
+                'user-2'
+            ], 'company-1', [
+                'branch-1',
+                null
+            ]);
+            expect(result).toBe(2);
+        });
+    });
+    describe('revokeCompanyPermissions', ()=>{
+        it('does nothing when the company feature is disabled', async ()=>{
+            await service.revokeCompanyPermissions('company-1');
+            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
+            expect(mockRoleRepo.find).not.toHaveBeenCalled();
+        });
+        it('deletes company/role/user permissions transactionally and invalidates affected users', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockRoleRepo.find.mockResolvedValue([
+                {
+                    id: 'role-1'
+                }
+            ]);
+            mockPermissionRepo.find.mockResolvedValue([
+                {
+                    userId: 'user-1'
+                },
+                {
+                    userId: null
+                }
+            ]);
+            const fakeTxRepo = {
+                delete: jest.fn().mockResolvedValue(buildDeleteResult(1))
+            };
+            const fakeTxRoleRepo = {
+                delete: jest.fn().mockResolvedValue(buildDeleteResult(1))
+            };
+            mockPermissionRepo.manager.connection.transaction = jest.fn().mockImplementation((cb)=>cb({
+                    getRepository: jest.fn((target)=>{
+                        if (target === mockRoleRepo.target) return fakeTxRoleRepo;
+                        return fakeTxRepo;
+                    })
+                }));
+            await service.revokeCompanyPermissions('company-1');
+            expect(fakeTxRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION
+            }));
+            expect(fakeTxRoleRepo.delete).toHaveBeenCalledWith([
+                'role-1'
+            ]);
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
+                'user-1'
+            ], 'company-1');
+        });
+    });
+    describe('revokeBranchPermissions', ()=>{
+        it('does nothing when the company feature is disabled', async ()=>{
+            await service.revokeBranchPermissions('branch-1', 'company-1');
+            expect(mockPermissionRepo.delete).not.toHaveBeenCalled();
+        });
+        it('deletes matching branch permissions and invalidates affected users', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            mockPermissionRepo.find.mockResolvedValue([
+                {
+                    userId: 'user-1'
+                }
+            ]);
+            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
+            await service.revokeBranchPermissions('branch-1', 'company-1');
+            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                branchId: 'branch-1',
+                companyId: 'company-1'
+            }));
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
+                'user-1'
+            ], 'company-1', [
+                'branch-1'
+            ]);
+        });
+    });
+    describe('revokeUserCompanyAccess', ()=>{
+        it('deletes user-role and user-action permissions for the company and invalidates the user cache', async ()=>{
+            await service.revokeUserCompanyAccess('user-1', 'company-1');
+            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                sourceId: 'user-1',
+                companyId: 'company-1'
+            }));
+            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', 'company-1');
+        });
+    });
+    describe('revokeUserBranchAccess', ()=>{
+        it('deletes branch-scoped permissions for the user and invalidates the user+branch cache', async ()=>{
+            await service.revokeUserBranchAccess('user-1', 'branch-1', 'company-1');
+            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                sourceId: 'user-1',
+                branchId: 'branch-1',
+                companyId: 'company-1'
+            }));
+            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', 'company-1', [
+                'branch-1'
+            ]);
+        });
+    });
+});