@flusys/nestjs-iam 6.0.1 → 6.1.0

package/fesm/modules/iam.module.js

@@ -14,7 +14,7 @@ import { PermissionModeHelper } from '../helpers';
 import { ActionService, PermissionService, RoleService } from '../services';
 import { IAMConfigService } from '../services/iam-config.service';
 import { IAMDataSourceService } from '../services/iam-datasource.service';
-import { PermissionCacheService } from '../services/permission-cache.service';
+import { MY_PERMISSIONS_CACHE_PREFIX, PermissionCacheService } from '../services/permission-cache.service';
 export class IAMModule {
     static getControllers(permissionMode, enableCompanyFeature) {
         const baseControllers = [
@@ -58,7 +58,9 @@ export class IAMModule {
         return {
             provide: PERMISSION_GUARD_CONFIG,
             useValue: {
-                enableCompanyFeature
+                enableCompanyFeature,
+                userPermissionKeyFormat: `${MY_PERMISSIONS_CACHE_PREFIX}:user:{userId}`,
+                companyPermissionKeyFormat: `${MY_PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`
             }
         };
     }

package/fesm/modules/iam.module.spec.js

@@ -0,0 +1,289 @@
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+import { PERMISSION_GUARD_CONFIG } from '@flusys/nestjs-shared';
+import { IAMModule } from './iam.module';
+import { IAM_MODULE_OPTIONS } from '../config/iam.constants';
+import { ActionController, CompanyActionPermissionController, MyPermissionController, RoleController, RolePermissionController, UserActionPermissionController } from '../controllers';
+import { ActionService, PermissionService, RoleService } from '../services';
+import { IAMConfigService } from '../services/iam-config.service';
+import { IAMDataSourceService } from '../services/iam-datasource.service';
+import { PermissionCacheService } from '../services/permission-cache.service';
+function providerTokens(providers) {
+    return providers.map((p)=>typeof p === 'function' ? p : p.provide);
+}
+describe('IAMModule', ()=>{
+    describe('forRoot - controller/service registration matrix', ()=>{
+        it('should register no controllers by default (includeController defaults to false)', ()=>{
+            const dynamicModule = IAMModule.forRoot();
+            expect(dynamicModule.controllers).toEqual([]);
+        });
+        it('DIRECT mode: registers only UserActionPermissionController beyond the base set', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                ActionController,
+                MyPermissionController,
+                UserActionPermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).not.toContain(RoleService);
+        });
+        it('RBAC mode: registers RoleController + RolePermissionController but not UserActionPermissionController', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                ActionController,
+                MyPermissionController,
+                RoleController,
+                RolePermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).toContain(RoleService);
+        });
+        it('FULL mode: registers every permission controller', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                ActionController,
+                MyPermissionController,
+                RoleController,
+                UserActionPermissionController,
+                RolePermissionController
+            ]);
+        });
+        it('defaults to FULL mode when permissionMode is omitted', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                RoleController,
+                UserActionPermissionController,
+                RolePermissionController
+            ]));
+        });
+        it('defaults to FULL mode when permissionMode is an unrecognized string', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'BOGUS'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                RoleController,
+                UserActionPermissionController,
+                RolePermissionController
+            ]));
+        });
+        it('adds CompanyActionPermissionController only when enableCompanyFeature is true', ()=>{
+            const withCompany = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const withoutCompany = IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: false
+                }
+            });
+            expect(withCompany.controllers).toContain(CompanyActionPermissionController);
+            expect(withoutCompany.controllers).not.toContain(CompanyActionPermissionController);
+        });
+        it('excludes RoleService for DIRECT mode but includes it for RBAC/FULL', ()=>{
+            const direct = IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            const rbac = IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            const full = IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(providerTokens(direct.providers)).not.toContain(RoleService);
+            expect(providerTokens(rbac.providers)).toContain(RoleService);
+            expect(providerTokens(full.providers)).toContain(RoleService);
+            expect(providerTokens(direct.exports)).not.toContain(RoleService);
+            expect(providerTokens(rbac.exports)).toContain(RoleService);
+        });
+        it('always registers the base providers/exports (ActionService, PermissionService, PermissionCacheService)', ()=>{
+            const dynamicModule = IAMModule.forRoot();
+            expect(providerTokens(dynamicModule.providers)).toEqual(expect.arrayContaining([
+                IAMConfigService,
+                IAMDataSourceService,
+                ActionService,
+                PermissionService,
+                PermissionCacheService
+            ]));
+            expect(dynamicModule.exports).toEqual(expect.arrayContaining([
+                IAMConfigService,
+                IAMDataSourceService,
+                ActionService,
+                PermissionService,
+                PermissionCacheService,
+                PERMISSION_GUARD_CONFIG
+            ]));
+        });
+    });
+    describe('forRoot - options/global handling', ()=>{
+        it('should not set `global` on the returned module when global is false/omitted', ()=>{
+            const dynamicModule = IAMModule.forRoot();
+            expect(dynamicModule.global).toBeUndefined();
+        });
+        it('should set global: true when requested', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                global: true
+            });
+            expect(dynamicModule.global).toBe(true);
+        });
+        it('should register IAM_MODULE_OPTIONS with the given options', ()=>{
+            const options = {
+                includeController: true
+            };
+            const dynamicModule = IAMModule.forRoot(options);
+            const provider = dynamicModule.providers.find((p)=>p.provide === IAM_MODULE_OPTIONS);
+            expect(provider.useValue).toBe(options);
+        });
+        it('should build a company-aware PERMISSION_GUARD_CONFIG provider', ()=>{
+            const dynamicModule = IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const provider = dynamicModule.providers.find((p)=>p.provide === PERMISSION_GUARD_CONFIG);
+            expect(provider.useValue.enableCompanyFeature).toBe(true);
+            expect(provider.useValue.userPermissionKeyFormat).toContain('{userId}');
+            expect(provider.useValue.companyPermissionKeyFormat).toContain('{companyId}');
+        });
+    });
+    describe('forRootAsync', ()=>{
+        it('mirrors the controller/service registration matrix of forRoot', ()=>{
+            const dynamicModule = IAMModule.forRootAsync({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                ActionController,
+                MyPermissionController,
+                UserActionPermissionController
+            ]);
+        });
+        it('should forward external imports alongside CacheModule/UtilsModule', ()=>{
+            let FakeImportedModule = class FakeImportedModule {
+            };
+            const dynamicModule = IAMModule.forRootAsync({
+                imports: [
+                    FakeImportedModule
+                ]
+            });
+            expect(dynamicModule.imports).toEqual(expect.arrayContaining([
+                FakeImportedModule
+            ]));
+        });
+        it('useFactory: registers a single options provider using the given inject tokens', async ()=>{
+            const useFactory = jest.fn().mockResolvedValue({
+                foo: 'bar'
+            });
+            const dynamicModule = IAMModule.forRootAsync({
+                useFactory,
+                inject: [
+                    'SOME_TOKEN'
+                ]
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.useFactory).toBe(useFactory);
+            expect(provider.inject).toEqual([
+                'SOME_TOKEN'
+            ]);
+        });
+        it('useClass: registers both the class provider and an options provider that calls createIAMOptions()', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-class'
+                    }));
+                }
+            };
+            const dynamicModule = IAMModule.forRootAsync({
+                useClass: MyOptionsFactory
+            });
+            const classProvider = dynamicModule.providers.find((p)=>p.provide === MyOptionsFactory);
+            expect(classProvider.useClass).toBe(MyOptionsFactory);
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === IAM_MODULE_OPTIONS);
+            expect(optionsProvider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await optionsProvider.useFactory(instance);
+            expect(instance.createIAMOptions).toHaveBeenCalled();
+            expect(resolved).toEqual({
+                foo: 'from-class'
+            });
+        });
+        it('useExisting: registers a single options provider injecting the existing factory', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-existing'
+                    }));
+                }
+            };
+            const dynamicModule = IAMModule.forRootAsync({
+                useExisting: MyOptionsFactory
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await provider.useFactory(instance);
+            expect(resolved).toEqual({
+                foo: 'from-existing'
+            });
+        });
+    });
+    describe('forFeature', ()=>{
+        it('should behave identically to forRoot', ()=>{
+            const options = {
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            };
+            expect(IAMModule.forFeature(options)).toEqual(IAMModule.forRoot(options));
+        });
+    });
+});

package/fesm/services/action.service.js

@@ -31,10 +31,90 @@ import { BadRequestException, Inject, Injectable, Scope } from '@nestjs/common';
 import { In } from 'typeorm';
 import { PERMISSION_OPERATION_MESSAGES } from '../config';
 import { Action } from '../entities/action.entity';
+import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
+import { UserIamPermission } from '../entities/user-iam-permission.entity';
+import { IamEntityType } from '../enums/iam-entity-type.enum';
+import { IamPermissionType } from '../enums/iam-permission-type.enum';
 import { IAMConfigService } from './iam-config.service';
 import { IAMDataSourceService } from './iam-datasource.service';
+import { PermissionCacheService } from './permission-cache.service';
 import { PermissionService } from './permission.service';
 export class ActionService extends ApiService {
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const actionIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        if (actionIds.length === 0) {
+            return;
+        }
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const permissionEntity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
+        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
+        const [roleActionRows, userActionRows, companyActionRows] = await Promise.all([
+            permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.ROLE_ACTION,
+                    sourceType: IamEntityType.ROLE,
+                    targetType: IamEntityType.ACTION,
+                    targetId: In(actionIds)
+                }
+            }),
+            permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.USER_ACTION,
+                    targetType: IamEntityType.ACTION,
+                    targetId: In(actionIds)
+                }
+            }),
+            enableCompanyFeature ? permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.COMPANY_ACTION,
+                    sourceType: IamEntityType.COMPANY,
+                    targetType: IamEntityType.ACTION,
+                    targetId: In(actionIds)
+                }
+            }) : Promise.resolve([])
+        ]);
+        const affectedUserIds = new Set(userActionRows.map((row)=>row.userId).filter((id)=>!!id));
+        const affectedCompanyIds = [
+            ...new Set(companyActionRows.map((row)=>row.sourceId).filter((id)=>!!id))
+        ];
+        const affectedRoleIds = [
+            ...new Set(roleActionRows.map((row)=>row.sourceId))
+        ];
+        if (affectedRoleIds.length > 0) {
+            const userRoleRows = await permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.USER_ROLE,
+                    targetType: IamEntityType.ROLE,
+                    targetId: In(affectedRoleIds)
+                }
+            });
+            userRoleRows.forEach((row)=>row.userId && affectedUserIds.add(row.userId));
+        }
+        await permissionRepo.delete({
+            permissionType: IamPermissionType.ROLE_ACTION,
+            targetType: IamEntityType.ACTION,
+            targetId: In(actionIds)
+        });
+        await permissionRepo.delete({
+            permissionType: IamPermissionType.USER_ACTION,
+            targetType: IamEntityType.ACTION,
+            targetId: In(actionIds)
+        });
+        await permissionRepo.delete({
+            permissionType: IamPermissionType.COMPANY_ACTION,
+            sourceType: IamEntityType.COMPANY,
+            targetType: IamEntityType.ACTION,
+            targetId: In(actionIds)
+        });
+        await Promise.all([
+            affectedUserIds.size > 0 ? this.permissionCacheService.invalidateUsers([
+                ...affectedUserIds
+            ]) : Promise.resolve(),
+            ...affectedCompanyIds.map((companyId)=>this.permissionService.invalidateCompanyMembersCache(companyId))
+        ]);
+    }
     // Query Customization
     async getSelectQuery(query, _user, select) {
         if (!select?.length) {
@@ -98,12 +178,13 @@ export class ActionService extends ApiService {
             });
         }
     }
-    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user) {
+    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user, companyId) {
         await this.ensureDataSourceRepository();
         this.requireUser(user, 'getActionsForPermission');
         let whereClause = {};
-        if (this.iamConfigService.isCompanyFeatureEnabled() && user.companyId) {
-            const companyActionIds = await this.permissionService.getCompanyActionIds(user.companyId);
+        const targetCompanyId = companyId || user.companyId;
+        if (this.iamConfigService.isCompanyFeatureEnabled() && targetCompanyId) {
+            const companyActionIds = await this.permissionService.getCompanyActionIds(targetCompanyId);
             if (companyActionIds.length === 0) {
                 return [];
             }
@@ -166,9 +247,9 @@ export class ActionService extends ApiService {
         }
         return rootNodes;
     }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService){
-        super('action', cacheManager, utilsService, ActionService.name, true, 'iam', Action, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionService", void 0), // Custom Methods
-        _define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.actionSelectFields = [
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService, permissionCacheService){
+        super('action', cacheManager, utilsService, ActionService.name, true, 'iam', Action, dataSourceProvider), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionService", void 0), _define_property(this, "permissionCacheService", void 0), // Custom Methods
+        _define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.permissionCacheService = permissionCacheService, this.actionSelectFields = [
             'id',
             'code',
             'name',
@@ -190,12 +271,14 @@ ActionService = _ts_decorate([
     _ts_param(2, Inject(IAMConfigService)),
     _ts_param(3, Inject(IAMDataSourceService)),
     _ts_param(4, Inject(PermissionService)),
+    _ts_param(5, Inject(PermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof HybridCache === "undefined" ? Object : HybridCache,
         typeof UtilsService === "undefined" ? Object : UtilsService,
         typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
         typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService,
-        typeof PermissionService === "undefined" ? Object : PermissionService
+        typeof PermissionService === "undefined" ? Object : PermissionService,
+        typeof PermissionCacheService === "undefined" ? Object : PermissionCacheService
     ])
 ], ActionService);