@flusys/nestjs-iam 6.0.2 → 6.1.1

package/fesm/services/permission-cache.service.js

@@ -26,12 +26,37 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { envConfig } from '@flusys/nestjs-core/config';
-import { buildPermissionCacheKey, HybridCache, LogAction, PERMISSION_GUARD_CONFIG, PERMISSIONS_CACHE_PREFIX, PermissionCacheKeyOptions, PermissionGuardConfig } from '@flusys/nestjs-shared';
-import { Inject, Injectable, Optional } from '@nestjs/common';
+import { buildPermissionCacheKey, HybridCache, LogAction, PERMISSION_GUARD_CONFIG, PermissionCacheKeyOptions, PermissionGuardConfig } from '@flusys/nestjs-shared';
+import { Inject, Injectable, Optional, Scope } from '@nestjs/common';
+import { In, IsNull } from 'typeorm';
+import { Action } from '../entities/action.entity';
+import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
+import { RoleWithCompany } from '../entities/role-with-company.entity';
+import { Role } from '../entities/role.entity';
+import { UserIamPermission } from '../entities/user-iam-permission.entity';
+import { ActionType } from '../enums/action-type.enum';
+import { IamEntityType } from '../enums/iam-entity-type.enum';
+import { IamPermissionType } from '../enums/iam-permission-type.enum';
+import { IAMPermissionMode } from '../enums/permission-type.enum';
+import { IAMConfigService } from './iam-config.service';
+import { IAMDataSourceService } from './iam-datasource.service';
 export { PermissionCacheKeyOptions } from '@flusys/nestjs-shared';
-export const MY_PERMISSIONS_CACHE_PREFIX = PERMISSIONS_CACHE_PREFIX;
 const NO_COMPANY_SCOPE = 'none';
 export class PermissionCacheService {
+    // Repository Getters
+    async getPermissionRepository() {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const entity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    async getActionRepository() {
+        return this.dataSourceProvider.getRepository(Action);
+    }
+    async getRoleRepository() {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const entity = enableCompanyFeature ? RoleWithCompany : Role;
+        return this.dataSourceProvider.getRepository(entity);
+    }
     // Cache Key Generation
     parseDurationMs(duration) {
         const unitMs = {
@@ -78,69 +103,305 @@ export class PermissionCacheService {
     }
     async trackKey(userId, key, companyId) {
         try {
-            const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
-            const keys = await this.cacheManager.get(trackedKeysKey) || [];
-            if (!keys.includes(key)) {
-                keys.push(key);
-                await this.cacheManager.set(trackedKeysKey, keys, this.TTL);
+            let scopeKey = key;
+            if (companyId) {
+                scopeKey = this.buildTrackedKeysKey(userId, companyId);
+                const keys = await this.cacheManager.get(scopeKey) || [];
+                if (!keys.includes(key)) {
+                    keys.push(key);
+                    await this.cacheManager.set(scopeKey, keys, this.TTL);
+                }
             }
             const scopesKey = this.buildTrackedScopesKey(userId);
             const scopes = await this.cacheManager.get(scopesKey) || [];
-            const scope = this.scopeToken(companyId);
-            if (!scopes.includes(scope)) {
-                scopes.push(scope);
+            if (!scopes.includes(scopeKey)) {
+                scopes.push(scopeKey);
                 await this.cacheManager.set(scopesKey, scopes, this.TTL);
             }
         } catch  {
         // tracking is best-effort; a missed entry only widens invalidation, never narrows it
         }
     }
-    // Cache Invalidation
-    async invalidateUser(userId, companyId, branchIds) {
-        if (companyId) {
-            await this.invalidateScope(userId, companyId, branchIds);
-            return;
+    // My Permissions (cache-first read, DB-backed rebuild)
+    /** Get user's effective permissions (cache-first approach) */ async getMyPermissionsResponse(userId, branchId, companyId, parentCodes) {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const cacheOptions = {
+            userId,
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId: enableCompanyFeature ? branchId : null
+        };
+        const cachedData = await this.getMyPermissions(cacheOptions);
+        if (cachedData) {
+            return this.buildResponseFromCache(cachedData, parentCodes);
         }
-        // No company scope given: clear every company/branch scope tracked for this user
-        const scopesKey = this.buildTrackedScopesKey(userId);
-        let scopes = [];
-        try {
-            scopes = await this.cacheManager.get(scopesKey) || [];
-        } catch  {
-            scopes = [];
+        const freshData = await this.fetchAndCachePermissions(userId, branchId, companyId);
+        return this.buildResponseFromCache(freshData, parentCodes);
+    }
+    /** Build response from cached data, applying optional parentCodes filter */ async buildResponseFromCache(cachedData, parentCodes) {
+        let frontendActions = cachedData.frontendActions;
+        if (parentCodes?.length) {
+            const parentIds = await this.getParentIdsByCodesWithCache(parentCodes);
+            if (parentIds.size > 0) {
+                frontendActions = frontendActions.filter((a)=>a.parentId && parentIds.has(a.parentId));
+            } else {
+                frontendActions = [];
+            }
         }
-        await Promise.all(scopes.map((scope)=>this.invalidateScope(userId, scope === NO_COMPANY_SCOPE ? null : scope, branchIds)));
-        await this.cacheManager.del(scopesKey);
+        return {
+            frontendActions: frontendActions.map((a)=>({
+                    id: a.id,
+                    code: a.code,
+                    name: a.name,
+                    description: a.description
+                })),
+            cachedEndpoints: cachedData.backendCodes.length
+        };
     }
-    async invalidateScope(userId, companyId, branchIds) {
-        const keysToDelete = new Set();
-        const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
-        let trackedKeys = [];
-        try {
-            trackedKeys = await this.cacheManager.get(trackedKeysKey) || [];
-        } catch  {
-            trackedKeys = [];
+    /** Resolve action IDs for the given codes */ async getParentIdsByCodesWithCache(codes) {
+        const actionRepo = await this.getActionRepository();
+        const actions = await actionRepo.find({
+            where: {
+                code: In(codes)
+            },
+            select: [
+                'id',
+                'code'
+            ]
+        });
+        return new Set(actions.map((action)=>action.id));
+    }
+    /** Fetch permissions from DB and cache them (empty permissions are also cached) */ async fetchAndCachePermissions(userId, branchId, companyId) {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const cacheOptions = {
+            userId,
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId
+        };
+        const emptyData = {
+            frontendActions: [],
+            backendCodes: []
+        };
+        const allActionIds = await this.collectAllActionIds(userId, branchId, companyId);
+        if (allActionIds.size === 0) {
+            await this.setMyPermissions(cacheOptions, emptyData);
+            return emptyData;
+        }
+        return this.buildAndCachePermissionData(allActionIds, cacheOptions);
+    }
+    /** Collect all action IDs based on permission mode (RBAC, DIRECT, or FULL) */ async collectAllActionIds(userId, branchId, companyId) {
+        const permissionMode = this.iamConfigService.getPermissionMode();
+        const allActionIds = new Set();
+        if (permissionMode === IAMPermissionMode.RBAC || permissionMode === IAMPermissionMode.FULL) {
+            const userRoleIds = await this.getUserRoleIds(userId, branchId, companyId);
+            if (userRoleIds.length > 0) {
+                const roleActionIds = await this.getRoleActionIds(userRoleIds);
+                roleActionIds.forEach((id)=>allActionIds.add(id));
+            }
+        }
+        if (permissionMode === IAMPermissionMode.DIRECT || permissionMode === IAMPermissionMode.FULL) {
+            const userActionIds = await this.getUserActionIds(userId, branchId, companyId);
+            userActionIds.forEach((id)=>allActionIds.add(id));
+        }
+        return allActionIds;
+    }
+    /** Fetch actions from DB, separate by type, build cache data, and cache it */ async buildAndCachePermissionData(actionIds, cacheOptions) {
+        const actionRepo = await this.getActionRepository();
+        const actions = await actionRepo.find({
+            where: {
+                id: In(Array.from(actionIds)),
+                isActive: true
+            }
+        });
+        const backendActions = actions.filter((a)=>a.actionType === ActionType.BACKEND || a.actionType === ActionType.BOTH);
+        const frontendActions = actions.filter((a)=>a.actionType === ActionType.FRONTEND || a.actionType === ActionType.BOTH);
+        const backendCodes = backendActions.map((a)=>a.code).filter((c)=>!!c);
+        const cacheData = {
+            frontendActions: frontendActions.map((a)=>({
+                    id: a.id,
+                    code: a.code ?? '',
+                    name: a.name,
+                    description: a.description,
+                    parentId: a.parentId
+                })),
+            backendCodes
+        };
+        await this.setMyPermissions(cacheOptions, cacheData);
+        return cacheData;
+    }
+    /** Get role IDs assigned to a user (merges company-wide + branch-specific roles) */ async getUserRoleIds(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        if (!enableCompanyFeature) {
+            const permissions = await permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.USER_ROLE,
+                    sourceType: IamEntityType.USER,
+                    sourceId: userId
+                }
+            });
+            return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
         }
-        if (!branchIds?.length) {
-            trackedKeys.forEach((key)=>keysToDelete.add(key));
-            keysToDelete.add(trackedKeysKey);
+        const roleIds = new Set();
+        const baseWhere = {
+            permissionType: IamPermissionType.USER_ROLE,
+            sourceType: IamEntityType.USER,
+            sourceId: userId
+        };
+        if (companyId) {
+            baseWhere.companyId = companyId;
+        }
+        if (branchId) {
+            // Get company-wide + branch-specific roles
+            const companyWidePermissions = await permissionRepo.find({
+                where: {
+                    ...baseWhere,
+                    branchId: IsNull()
+                }
+            });
+            companyWidePermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
+            const branchPermissions = await permissionRepo.find({
+                where: {
+                    ...baseWhere,
+                    branchId
+                }
+            });
+            branchPermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
         } else {
-            // Branch scope given: only invalidate those branches, keep the rest tracked
-            branchIds.forEach((branchId)=>keysToDelete.add(this.buildCacheKey({
-                    userId,
-                    companyId,
+            // No branch context: get all roles for this company
+            const allPermissions = await permissionRepo.find({
+                where: baseWhere
+            });
+            allPermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
+        }
+        return Array.from(roleIds);
+    }
+    async getRoleActionIds(roleIds) {
+        const permissionRepo = await this.getPermissionRepository();
+        const permissions = await permissionRepo.find({
+            where: {
+                permissionType: IamPermissionType.ROLE_ACTION,
+                sourceType: IamEntityType.ROLE,
+                sourceId: In(roleIds)
+            }
+        });
+        return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
+    }
+    /** Get action IDs directly assigned to a user (merges company-wide + branch-specific actions) */ async getUserActionIds(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        if (!enableCompanyFeature) {
+            const permissions = await permissionRepo.find({
+                where: {
+                    permissionType: IamPermissionType.USER_ACTION,
+                    sourceType: IamEntityType.USER,
+                    sourceId: userId
+                }
+            });
+            return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
+        }
+        const actionIds = new Set();
+        const baseWhere = {
+            permissionType: IamPermissionType.USER_ACTION,
+            sourceType: IamEntityType.USER,
+            sourceId: userId
+        };
+        if (companyId) {
+            baseWhere.companyId = companyId;
+        }
+        if (branchId) {
+            // Get company-wide + branch-specific actions
+            const companyWidePermissions = await permissionRepo.find({
+                where: {
+                    ...baseWhere,
+                    branchId: IsNull()
+                }
+            });
+            companyWidePermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
+            const branchPermissions = await permissionRepo.find({
+                where: {
+                    ...baseWhere,
                     branchId
-                })));
-            const remainingKeys = trackedKeys.filter((key)=>!keysToDelete.has(key));
-            if (remainingKeys.length) {
-                await this.cacheManager.set(trackedKeysKey, remainingKeys, this.TTL);
+                }
+            });
+            branchPermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
+        } else {
+            // No branch context: get all actions for this company
+            const allPermissions = await permissionRepo.find({
+                where: baseWhere
+            });
+            allPermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
+        }
+        return Array.from(actionIds);
+    }
+    // Cache Invalidation
+    async invalidateUser(userId, companyId, branchIds) {
+        const keysToDelete = new Set();
+        /** Drop a scope entry from the tracked-scopes index, or queue the whole index for deletion once nothing remains */ const untrackScope = async (scopeKey)=>{
+            const scopesKeysKey = this.buildTrackedScopesKey(userId);
+            let scopesKeys = [];
+            try {
+                scopesKeys = await this.cacheManager.get(scopesKeysKey) || [];
+            } catch  {
+                scopesKeys = [];
+            }
+            if (scopeKey) {
+                const remainingScopes = scopesKeys.filter((scope)=>scope !== scopeKey);
+                if (remainingScopes.length > 0) {
+                    await this.cacheManager.set(scopesKeysKey, remainingScopes, this.TTL);
+                } else {
+                    keysToDelete.add(scopesKeysKey);
+                }
             } else {
+                for (const scope of scopesKeys){
+                    if (scope.startsWith(this.TRACKED_KEYS_PREFIX)) {
+                        let nestedKeys = [];
+                        try {
+                            nestedKeys = await this.cacheManager.get(scope) || [];
+                        } catch  {
+                            nestedKeys = [];
+                        }
+                        nestedKeys.forEach((key)=>keysToDelete.add(key));
+                    }
+                    keysToDelete.add(scope);
+                }
+                keysToDelete.add(scopesKeysKey);
+            }
+        };
+        if (companyId) {
+            const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
+            let trackedKeys = [];
+            try {
+                trackedKeys = await this.cacheManager.get(trackedKeysKey) || [];
+            } catch  {
+                trackedKeys = [];
+            }
+            if (!branchIds?.length) {
+                trackedKeys.forEach((key)=>keysToDelete.add(key));
                 keysToDelete.add(trackedKeysKey);
+                await untrackScope(trackedKeysKey);
+            } else {
+                // Branch scope given: only invalidate those branches, keep the rest tracked
+                branchIds.forEach((branchId)=>keysToDelete.add(this.buildCacheKey({
+                        userId,
+                        companyId,
+                        branchId
+                    })));
+                const remainingKeys = trackedKeys.filter((key)=>!keysToDelete.has(key));
+                if (remainingKeys.length) {
+                    await this.cacheManager.set(trackedKeysKey, remainingKeys, this.TTL);
+                } else {
+                    keysToDelete.add(trackedKeysKey);
+                    await untrackScope(trackedKeysKey);
+                }
             }
+        } else {
+            await untrackScope();
         }
-        await Promise.all([
-            ...keysToDelete
-        ].map((key)=>this.cacheManager.del(key)));
+        await Promise.all(Array.from(keysToDelete).map(async (key)=>{
+            try {
+                await this.cacheManager.del(key);
+            } catch  {}
+        }));
     }
     async invalidateUsers(userIds, companyId, branchIds) {
         if (userIds.length === 0) {
@@ -149,13 +410,60 @@ export class PermissionCacheService {
         const results = await Promise.allSettled(userIds.map((userId)=>this.invalidateUser(userId, companyId, branchIds)));
         return results.filter((r)=>r.status === 'fulfilled').length;
     }
-    constructor(cacheManager, guardConfig){
+    /** Invalidate permission cache for all users holding a given role */ async invalidateRoleMembersCache(roleId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const roleRepo = await this.getRoleRepository();
+        const userRoles = await permissionRepo.find({
+            where: {
+                permissionType: IamPermissionType.USER_ROLE,
+                sourceType: IamEntityType.USER,
+                targetType: IamEntityType.ROLE,
+                targetId: roleId
+            }
+        });
+        const userIds = [
+            ...new Set(userRoles.map((ur)=>ur.sourceId))
+        ];
+        if (userIds.length === 0) {
+            return 0;
+        }
+        const role = await roleRepo.findOne({
+            where: {
+                id: roleId
+            }
+        });
+        const companyId = role?.companyId || null;
+        return this.invalidateUsers(userIds, companyId);
+    }
+    /** Invalidate permission cache for all users in a company */ async invalidateCompanyMembersCache(companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return 0;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const userPermissions = await permissionRepo.createQueryBuilder('p').select('DISTINCT p.source_id', 'userId').where('p.company_id = :companyId', {
+            companyId
+        }).andWhere('p.source_type = :sourceType', {
+            sourceType: IamEntityType.USER
+        }).getRawMany();
+        const userIds = [
+            ...new Set(userPermissions.map((p)=>p.userId).filter(Boolean))
+        ];
+        if (userIds.length === 0) {
+            return 0;
+        }
+        return this.invalidateUsers(userIds, companyId);
+    }
+    constructor(cacheManager, iamConfigService, dataSourceProvider, guardConfig){
         _define_property(this, "cacheManager", void 0);
+        _define_property(this, "iamConfigService", void 0);
+        _define_property(this, "dataSourceProvider", void 0);
         _define_property(this, "guardConfig", void 0);
         _define_property(this, "TRACKED_KEYS_PREFIX", void 0);
         _define_property(this, "TRACKED_SCOPES_PREFIX", void 0);
         _define_property(this, "TTL", void 0);
         this.cacheManager = cacheManager;
+        this.iamConfigService = iamConfigService;
+        this.dataSourceProvider = dataSourceProvider;
         this.guardConfig = guardConfig;
         this.TRACKED_KEYS_PREFIX = 'permission-tracked-keys';
         this.TRACKED_SCOPES_PREFIX = 'permission-tracked-scopes';
@@ -201,13 +509,19 @@ _ts_decorate([
     _ts_metadata("design:returntype", Promise)
 ], PermissionCacheService.prototype, "invalidateUsers", null);
 PermissionCacheService = _ts_decorate([
-    Injectable(),
+    Injectable({
+        scope: Scope.REQUEST
+    }),
     _ts_param(0, Inject('CACHE_INSTANCE')),
-    _ts_param(1, Optional()),
-    _ts_param(1, Inject(PERMISSION_GUARD_CONFIG)),
+    _ts_param(1, Inject(IAMConfigService)),
+    _ts_param(2, Inject(IAMDataSourceService)),
+    _ts_param(3, Optional()),
+    _ts_param(3, Inject(PERMISSION_GUARD_CONFIG)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof HybridCache === "undefined" ? Object : HybridCache,
+        typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
+        typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService,
         typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
     ])
 ], PermissionCacheService);