@flusys/nestjs-iam 6.0.1 → 6.1.0

package/cjs/services/role.service.js

@@ -12,10 +12,16 @@ const _classes = require("@flusys/nestjs-shared/classes");
 const _modules = require("@flusys/nestjs-shared/modules");
 const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
+const _typeorm = require("typeorm");
+const _permissionwithcompanyentity = require("../entities/permission-with-company.entity");
 const _rolewithcompanyentity = require("../entities/role-with-company.entity");
 const _roleentity = require("../entities/role.entity");
+const _useriampermissionentity = require("../entities/user-iam-permission.entity");
+const _iamentitytypeenum = require("../enums/iam-entity-type.enum");
+const _iampermissiontypeenum = require("../enums/iam-permission-type.enum");
 const _iamconfigservice = require("./iam-config.service");
 const _iamdatasourceservice = require("./iam-datasource.service");
+const _permissioncacheservice = require("./permission-cache.service");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -44,6 +50,42 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let RoleService = class RoleService extends _classes.ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        await super.beforeDeleteOperation(dto, user, queryRunner);
+        const roleIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        if (roleIds.length === 0) {
+            return;
+        }
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const permissionEntity = enableCompanyFeature ? _permissionwithcompanyentity.UserIamPermissionWithCompany : _useriampermissionentity.UserIamPermission;
+        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
+        const userRoleRows = await permissionRepo.find({
+            where: {
+                permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+                sourceType: _iamentitytypeenum.IamEntityType.USER,
+                targetType: _iamentitytypeenum.IamEntityType.ROLE,
+                targetId: (0, _typeorm.In)(roleIds)
+            }
+        });
+        const affectedUserIds = [
+            ...new Set(userRoleRows.map((row)=>row.userId).filter((id)=>!!id))
+        ];
+        await permissionRepo.delete({
+            permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
+            sourceType: _iamentitytypeenum.IamEntityType.ROLE,
+            sourceId: (0, _typeorm.In)(roleIds)
+        });
+        await permissionRepo.delete({
+            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
+            targetType: _iamentitytypeenum.IamEntityType.ROLE,
+            targetId: (0, _typeorm.In)(roleIds)
+        });
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds);
+        }
+    }
     resolveEntity() {
         return this.iamConfigService.isCompanyFeatureEnabled() ? _rolewithcompanyentity.RoleWithCompany : _roleentity.Role;
     }
@@ -117,8 +159,8 @@ let RoleService = class RoleService extends _classes.ApiService {
             deletedById: entity.deletedById
         };
     }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider){
-        super('role', cacheManager, utilsService, RoleService.name, true, 'iam', undefined, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService;
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionCacheService){
+        super('role', cacheManager, utilsService, RoleService.name, true, 'iam', undefined, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionCacheService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionCacheService = permissionCacheService;
     }
 };
 RoleService = _ts_decorate([
@@ -129,11 +171,13 @@ RoleService = _ts_decorate([
     _ts_param(1, (0, _common.Inject)(_modules.UtilsService)),
     _ts_param(2, (0, _common.Inject)(_iamconfigservice.IAMConfigService)),
     _ts_param(3, (0, _common.Inject)(_iamdatasourceservice.IAMDataSourceService)),
+    _ts_param(4, (0, _common.Inject)(_permissioncacheservice.PermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
         typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
         typeof _iamconfigservice.IAMConfigService === "undefined" ? Object : _iamconfigservice.IAMConfigService,
-        typeof _iamdatasourceservice.IAMDataSourceService === "undefined" ? Object : _iamdatasourceservice.IAMDataSourceService
+        typeof _iamdatasourceservice.IAMDataSourceService === "undefined" ? Object : _iamdatasourceservice.IAMDataSourceService,
+        typeof _permissioncacheservice.PermissionCacheService === "undefined" ? Object : _permissioncacheservice.PermissionCacheService
     ])
 ], RoleService);

package/cjs/services/role.service.spec.js

@@ -0,0 +1,312 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _testing = require("@nestjs/testing");
+const _modules = require("@flusys/nestjs-shared/modules");
+const _repositorymock = require("@test-utils/mocks/repository.mock");
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _roleentity = require("../entities/role.entity");
+const _rolewithcompanyentity = require("../entities/role-with-company.entity");
+const _iamconfigservice = require("./iam-config.service");
+const _iamdatasourceservice = require("./iam-datasource.service");
+const _permissioncacheservice = require("./permission-cache.service");
+const _roleservice = require("./role.service");
+function buildRole(overrides = {}) {
+    return {
+        id: 'role-uuid-1',
+        readOnly: false,
+        name: 'Manager',
+        description: null,
+        isActive: true,
+        serial: 1,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+describe('RoleService', ()=>{
+    let service;
+    let mockRepo;
+    let mockIamConfigService;
+    let mockPermissionCacheService;
+    beforeEach(async ()=>{
+        mockRepo = (0, _repositorymock.createMockRepository)();
+        const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
+        mockIamConfigService = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
+        };
+        mockPermissionCacheService = {
+            invalidateUsers: jest.fn()
+        };
+        const module = await _testing.Test.createTestingModule({
+            providers: [
+                _roleservice.RoleService,
+                {
+                    provide: 'CACHE_INSTANCE',
+                    useValue: {}
+                },
+                {
+                    provide: _modules.UtilsService,
+                    useValue: {}
+                },
+                {
+                    provide: _iamconfigservice.IAMConfigService,
+                    useValue: mockIamConfigService
+                },
+                {
+                    provide: _iamdatasourceservice.IAMDataSourceService,
+                    useValue: mockDataSourceProvider
+                },
+                {
+                    provide: _permissioncacheservice.PermissionCacheService,
+                    useValue: mockPermissionCacheService
+                }
+            ]
+        }).compile();
+        service = await module.resolve(_roleservice.RoleService);
+    });
+    describe('resolveEntity', ()=>{
+        it('resolves to Role when the company feature is disabled', ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            expect(service.resolveEntity()).toBe(_roleentity.Role);
+        });
+        it('resolves to RoleWithCompany when the company feature is enabled', ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.resolveEntity()).toBe(_rolewithcompanyentity.RoleWithCompany);
+        });
+    });
+    describe('convertSingleDtoToEntity', ()=>{
+        it('creates a plain entity without companyId when the company feature is disabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            await service.ensureDataSourceRepository();
+            mockRepo.create.mockReturnValue({});
+            const entity = await service.convertSingleDtoToEntity({
+                name: 'Manager'
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(entity.companyId).toBeUndefined();
+        });
+        it('stamps companyId from the DTO on create when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            await service.ensureDataSourceRepository();
+            mockRepo.create.mockReturnValue({});
+            const entity = await service.convertSingleDtoToEntity({
+                name: 'Manager',
+                companyId: 'company-explicit'
+            }, (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-from-user'
+            }));
+            expect(entity.companyId).toBe('company-explicit');
+        });
+        it('falls back to the user companyId on create when the DTO omits it', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            await service.ensureDataSourceRepository();
+            mockRepo.create.mockReturnValue({});
+            const entity = await service.convertSingleDtoToEntity({
+                name: 'Manager'
+            }, (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-from-user'
+            }));
+            expect(entity.companyId).toBe('company-from-user');
+        });
+        it('does not override companyId on update when the DTO omits it', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            await service.ensureDataSourceRepository();
+            const existing = buildRole({
+                id: 'role-uuid-1',
+                companyId: 'existing-company'
+            });
+            mockRepo.findOne.mockResolvedValue(existing);
+            const entity = await service.convertSingleDtoToEntity({
+                id: 'role-uuid-1',
+                name: 'Manager Updated'
+            }, (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-from-user'
+            }));
+            expect(entity.companyId).toBe('existing-company');
+        });
+        it('overrides companyId on update when explicitly provided in the DTO', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            await service.ensureDataSourceRepository();
+            const existing = buildRole({
+                id: 'role-uuid-1',
+                companyId: 'existing-company'
+            });
+            mockRepo.findOne.mockResolvedValue(existing);
+            const entity = await service.convertSingleDtoToEntity({
+                id: 'role-uuid-1',
+                name: 'Manager Updated',
+                companyId: 'new-company'
+            }, (0, _loggedusermock.buildMockUser)());
+            expect(entity.companyId).toBe('new-company');
+        });
+        it('throws NotFoundException when updating a role that does not exist', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            await service.ensureDataSourceRepository();
+            mockRepo.findOne.mockResolvedValue(null);
+            await expect(service.convertSingleDtoToEntity({
+                id: 'missing-role'
+            }, (0, _loggedusermock.buildMockUser)())).rejects.toThrow();
+        });
+    });
+    describe('getSelectQuery', ()=>{
+        it('selects the default field set without companyId when the company feature is disabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)());
+            expect(query.select).toHaveBeenCalledWith(expect.not.arrayContaining([
+                'role.companyId'
+            ]));
+        });
+        it('includes companyId in the default field set when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)());
+            expect(query.select).toHaveBeenCalledWith(expect.arrayContaining([
+                'role.companyId'
+            ]));
+        });
+        it('uses the explicitly provided select list as-is', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)(), [
+                'id',
+                'name'
+            ]);
+            expect(query.select).toHaveBeenCalledWith([
+                'role.id',
+                'role.name'
+            ]);
+        });
+    });
+    describe('getGlobalSearchQuery', ()=>{
+        it('filters by name or description', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getGlobalSearchQuery(query, 'manager');
+            expect(query.andWhere).toHaveBeenCalledWith('(role.name LIKE :search OR role.description LIKE :search)', {
+                search: '%manager%'
+            });
+        });
+    });
+    describe('getExtraManipulateQuery', ()=>{
+        it('applies a company filter clause when the company feature is enabled and the user has a company', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            const query = mockRepo.createQueryBuilder();
+            await service.getExtraManipulateQuery(query, {}, (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            }));
+            expect(query.andWhere).toHaveBeenCalledWith('role.companyId = :companyId', {
+                companyId: 'company-1'
+            });
+        });
+        it('does not apply a company filter when the company feature is disabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            const query = mockRepo.createQueryBuilder();
+            await service.getExtraManipulateQuery(query, {}, (0, _loggedusermock.buildMockUser)({
+                companyId: 'company-1'
+            }));
+            expect(query.andWhere).not.toHaveBeenCalled();
+        });
+    });
+    describe('convertEntityToResponseDto', ()=>{
+        it('defaults companyId to null when the entity has no companyId field', ()=>{
+            const entity = buildRole();
+            const dto = service.convertEntityToResponseDto(entity, false);
+            expect(dto.companyId).toBeNull();
+        });
+        it('surfaces companyId when present on the entity', ()=>{
+            const entity = buildRole({
+                companyId: 'company-1'
+            });
+            const dto = service.convertEntityToResponseDto(entity, false);
+            expect(dto.companyId).toBe('company-1');
+        });
+    });
+    describe('beforeDeleteOperation', ()=>{
+        function buildQueryRunner(permissionRepo) {
+            return {
+                manager: {
+                    getRepository: jest.fn().mockReturnValue(permissionRepo)
+                }
+            };
+        }
+        it('does nothing when the delete DTO has no ids', async ()=>{
+            const permissionRepo = (0, _repositorymock.createMockRepository)();
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [],
+                type: 'delete'
+            }, (0, _loggedusermock.buildMockUser)(), queryRunner);
+            expect(permissionRepo.find).not.toHaveBeenCalled();
+        });
+        it('cascades ROLE_ACTION and USER_ROLE cleanup and invalidates affected users cache', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            const permissionRepo = (0, _repositorymock.createMockRepository)();
+            permissionRepo.find.mockResolvedValue([
+                {
+                    userId: 'user-1'
+                },
+                {
+                    userId: 'user-2'
+                },
+                {
+                    userId: null
+                }
+            ]);
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: 'role-uuid-1',
+                type: 'delete'
+            }, (0, _loggedusermock.buildMockUser)(), queryRunner);
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'role_action',
+                sourceType: 'role'
+            }));
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'user_role',
+                targetType: 'role'
+            }));
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
+                'user-1',
+                'user-2'
+            ]);
+        });
+        it('does not invalidate any cache when no users are affected', async ()=>{
+            const permissionRepo = (0, _repositorymock.createMockRepository)();
+            permissionRepo.find.mockResolvedValue([]);
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [
+                    'role-uuid-1'
+                ],
+                type: 'delete'
+            }, (0, _loggedusermock.buildMockUser)(), queryRunner);
+            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
+        });
+        it('supports array ids and dedupes affected user ids', async ()=>{
+            const permissionRepo = (0, _repositorymock.createMockRepository)();
+            permissionRepo.find.mockResolvedValue([
+                {
+                    userId: 'user-1'
+                },
+                {
+                    userId: 'user-1'
+                }
+            ]);
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [
+                    'role-uuid-1',
+                    'role-uuid-2'
+                ],
+                type: 'delete'
+            }, (0, _loggedusermock.buildMockUser)(), queryRunner);
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
+                'user-1'
+            ]);
+        });
+    });
+});

package/controllers/action.controller.d.ts

@@ -1,6 +1,7 @@
 import { ILoggedUserInfo, SingleResponseDto } from '@flusys/nestjs-shared';
-import { ActionResponseDto, ActionTreeQueryDto, CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
+import { ActionResponseDto, ActionTreeForPermissionDto, ActionTreeQueryDto, CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
 import { ActionService } from '../services/action.service';
+import { IAMConfigService } from '../services/iam-config.service';
 declare const ActionController_base: abstract new (service: ActionService) => {
     readonly enabledEndpoints: import("@flusys/nestjs-shared").ApiEndpoint[] | "all";
     service: ActionService;
@@ -18,8 +19,9 @@ declare const ActionController_base: abstract new (service: ActionService) => {
 };
 export declare class ActionController extends ActionController_base {
     actionService: ActionService;
-    constructor(actionService: ActionService);
-    getActionsForPermission(user: ILoggedUserInfo): Promise<SingleResponseDto<ActionResponseDto[]>>;
+    private readonly iamConfigService;
+    constructor(actionService: ActionService, iamConfigService: IAMConfigService);
+    getActionsForPermission(dto: ActionTreeForPermissionDto, user: ILoggedUserInfo): Promise<SingleResponseDto<ActionResponseDto[]>>;
     getActionTree(query: ActionTreeQueryDto, user: ILoggedUserInfo): Promise<SingleResponseDto<ActionResponseDto[]>>;
 }
 export {};

package/dtos/action.dto.d.ts

@@ -29,6 +29,9 @@ export declare class ActionResponseDto extends IdentityResponseDto {
 export declare class ActionTreeDto extends ActionResponseDto {
     children: ActionTreeDto[];
 }
+export declare class ActionTreeForPermissionDto {
+    companyId?: string;
+}
 export declare class ActionTreeQueryDto {
     search?: string;
     isActive?: boolean;

package/entities/index.d.ts

@@ -9,7 +9,7 @@ import { UserIamPermissionWithCompany } from './permission-with-company.entity';
 import { RoleWithCompany } from './role-with-company.entity';
 import { Role } from './role.entity';
 import { UserIamPermission } from './user-iam-permission.entity';
-export declare const IAMCoreEntities: (typeof Role | typeof UserIamPermission)[];
+export declare const IAMCoreEntities: (typeof UserIamPermission | typeof Role)[];
 export declare const IAMCompanyEntities: (typeof UserIamPermissionWithCompany | typeof RoleWithCompany)[];
-export declare const IAMAllEntities: (typeof Role | typeof UserIamPermission)[];
+export declare const IAMAllEntities: (typeof UserIamPermission | typeof Role)[];
 export declare function getIAMEntitiesByConfig(enableCompanyFeature: boolean, permissionMode?: 'FULL' | 'RBAC' | 'DIRECT'): any[];

package/fesm/controllers/action.controller.js

@@ -25,13 +25,14 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
+import { ACTION_PERMISSIONS, createApiController, CurrentUser, ILoggedUserInfo, SingleResponseDto } from '@flusys/nestjs-shared';
 import { JwtAuthGuard } from '@flusys/nestjs-shared/guards';
-import { createApiController, CurrentUser, ILoggedUserInfo, SingleResponseDto, ACTION_PERMISSIONS } from '@flusys/nestjs-shared';
-import { ACTION_MESSAGES } from '../config';
 import { Body, Controller, Inject, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiBody, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';
-import { ActionResponseDto, ActionTreeQueryDto, CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
+import { ACTION_MESSAGES } from '../config';
+import { ActionResponseDto, ActionTreeForPermissionDto, ActionTreeQueryDto, CreateActionDto, UpdateActionDto } from '../dtos/action.dto';
 import { ActionService } from '../services/action.service';
+import { IAMConfigService } from '../services/iam-config.service';
 export class ActionController extends createApiController(CreateActionDto, UpdateActionDto, ActionResponseDto, {
     entityName: 'action',
     security: {
@@ -79,8 +80,8 @@ export class ActionController extends createApiController(CreateActionDto, Updat
         }
     }
 }) {
-    async getActionsForPermission(user) {
-        const actions = await this.actionService.getActionsForPermission(user);
+    async getActionsForPermission(dto, user) {
+        const actions = await this.actionService.getActionsForPermission(user, dto?.companyId);
         return {
             success: true,
             message: 'Actions retrieved successfully',
@@ -97,8 +98,8 @@ export class ActionController extends createApiController(CreateActionDto, Updat
             data: tree
         };
     }
-    constructor(actionService){
-        super(actionService), _define_property(this, "actionService", void 0), this.actionService = actionService;
+    constructor(actionService, iamConfigService){
+        super(actionService), _define_property(this, "actionService", void 0), _define_property(this, "iamConfigService", void 0), this.actionService = actionService, this.iamConfigService = iamConfigService;
     }
 }
 _ts_decorate([
@@ -107,15 +108,20 @@ _ts_decorate([
     ApiBearerAuth(),
     ApiOperation({
         summary: 'Get actions for permission assignment',
-        description: 'Returns actions available for permission assignment. If company feature enabled, filtered by company whitelist.'
+        description: "Returns actions available for permission assignment, filtered by company whitelist when company feature is enabled. Optional companyId scopes the whitelist to a specific company (must match the caller's own company); defaults to the caller's session company when omitted."
     }),
     ApiResponse({
         status: 200,
         type: SingleResponseDto
     }),
-    _ts_param(0, CurrentUser()),
+    ApiBody({
+        type: ActionTreeForPermissionDto
+    }),
+    _ts_param(0, Body()),
+    _ts_param(1, CurrentUser()),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
+        typeof ActionTreeForPermissionDto === "undefined" ? Object : ActionTreeForPermissionDto,
         typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
     ]),
     _ts_metadata("design:returntype", Promise)
@@ -149,8 +155,10 @@ ActionController = _ts_decorate([
     ApiTags('IAM - Actions'),
     Controller('iam/actions'),
     _ts_param(0, Inject(ActionService)),
+    _ts_param(1, Inject(IAMConfigService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
-        typeof ActionService === "undefined" ? Object : ActionService
+        typeof ActionService === "undefined" ? Object : ActionService,
+        typeof IAMConfigService === "undefined" ? Object : IAMConfigService
     ])
 ], ActionController);

package/fesm/controllers/action.controller.spec.js

@@ -0,0 +1,75 @@
+import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
+import { ActionController } from './action.controller';
+describe('ActionController', ()=>{
+    let controller;
+    let mockActionService;
+    let mockIamConfigService;
+    beforeEach(()=>{
+        mockActionService = {
+            insert: jest.fn(),
+            findById: jest.fn(),
+            getAll: jest.fn(),
+            update: jest.fn(),
+            delete: jest.fn(),
+            getActionsForPermission: jest.fn(),
+            getActionTree: jest.fn()
+        };
+        mockIamConfigService = {};
+        controller = new ActionController(mockActionService, mockIamConfigService);
+    });
+    it('wires the injected service onto the generated controller base', ()=>{
+        expect(controller.actionService).toBe(mockActionService);
+        expect(controller.service).toBe(mockActionService);
+    });
+    describe('getActionsForPermission', ()=>{
+        it('returns actions scoped to the caller session company when no companyId is given', async ()=>{
+            const user = buildMockUser();
+            mockActionService.getActionsForPermission.mockResolvedValue([
+                {
+                    id: 'action-1',
+                    code: 'user.create'
+                }
+            ]);
+            const result = await controller.getActionsForPermission({}, user);
+            expect(mockActionService.getActionsForPermission).toHaveBeenCalledWith(user, undefined);
+            expect(result.success).toBe(true);
+            expect(result.data).toEqual([
+                {
+                    id: 'action-1',
+                    code: 'user.create'
+                }
+            ]);
+        });
+        it('forwards an explicit companyId override', async ()=>{
+            const user = buildMockUser();
+            mockActionService.getActionsForPermission.mockResolvedValue([]);
+            await controller.getActionsForPermission({
+                companyId: 'company-2'
+            }, user);
+            expect(mockActionService.getActionsForPermission).toHaveBeenCalledWith(user, 'company-2');
+        });
+    });
+    describe('getActionTree', ()=>{
+        it('returns the hierarchical action tree with query filters applied', async ()=>{
+            const user = buildMockUser();
+            mockActionService.getActionTree.mockResolvedValue([
+                {
+                    id: 'action-1',
+                    children: []
+                }
+            ]);
+            const result = await controller.getActionTree({
+                search: 'user',
+                isActive: true,
+                withDeleted: false
+            }, user);
+            expect(mockActionService.getActionTree).toHaveBeenCalledWith(user, 'user', true, false);
+            expect(result.data).toEqual([
+                {
+                    id: 'action-1',
+                    children: []
+                }
+            ]);
+        });
+    });
+});

package/fesm/controllers/company-action-permission.controller.spec.js

@@ -0,0 +1,61 @@
+import { CompanyActionPermissionController } from './company-action-permission.controller';
+describe('CompanyActionPermissionController', ()=>{
+    let controller;
+    let mockPermissionService;
+    beforeEach(()=>{
+        mockPermissionService = {
+            assignCompanyActions: jest.fn(),
+            getCompanyActions: jest.fn()
+        };
+        controller = new CompanyActionPermissionController(mockPermissionService);
+    });
+    describe('assignCompanyActions', ()=>{
+        it('whitelists actions for a company', async ()=>{
+            mockPermissionService.assignCompanyActions.mockResolvedValue({
+                added: 3,
+                removed: 0,
+                total: 3
+            });
+            const result = await controller.assignCompanyActions({
+                companyId: 'company-1',
+                actionIds: [
+                    'action-1',
+                    'action-2',
+                    'action-3'
+                ]
+            });
+            expect(mockPermissionService.assignCompanyActions).toHaveBeenCalledWith({
+                companyId: 'company-1',
+                actionIds: [
+                    'action-1',
+                    'action-2',
+                    'action-3'
+                ]
+            });
+            expect(result.success).toBe(true);
+            expect(result.data).toEqual({
+                added: 3,
+                removed: 0,
+                total: 3
+            });
+        });
+    });
+    describe('getCompanyActions', ()=>{
+        it('returns the whitelisted actions for a company', async ()=>{
+            mockPermissionService.getCompanyActions.mockResolvedValue([
+                {
+                    actionId: 'action-1'
+                }
+            ]);
+            const result = await controller.getCompanyActions({
+                companyId: 'company-1'
+            });
+            expect(mockPermissionService.getCompanyActions).toHaveBeenCalledWith('company-1');
+            expect(result.data).toEqual([
+                {
+                    actionId: 'action-1'
+                }
+            ]);
+        });
+    });
+});