@flusys/nestjs-iam 6.0.2 → 6.1.1

package/fesm/services/permission.service.js

@@ -35,10 +35,8 @@ import { UserIamPermissionWithCompany } from '../entities/permission-with-compan
 import { RoleWithCompany } from '../entities/role-with-company.entity';
 import { Role } from '../entities/role.entity';
 import { UserIamPermission } from '../entities/user-iam-permission.entity';
-import { ActionType } from '../enums/action-type.enum';
 import { IamEntityType } from '../enums/iam-entity-type.enum';
 import { IamPermissionType } from '../enums/iam-permission-type.enum';
-import { IAMPermissionMode } from '../enums/permission-type.enum';
 import { IAMConfigService } from './iam-config.service';
 import { IAMDataSourceService } from './iam-datasource.service';
 import { PermissionCacheService } from './permission-cache.service';
@@ -110,7 +108,6 @@ export class PermissionService {
                     sourceId: dto.userId,
                     targetType: IamEntityType.ACTION,
                     targetId: item.id,
-                    userId: dto.userId,
                     companyId: enableCompanyFeature ? companyId : null,
                     branchId: enableCompanyFeature ? branchId : null
                 }));
@@ -145,12 +142,12 @@ export class PermissionService {
             const result = await permissionRepo.delete(whereDelete);
             removed = result.affected || 0;
         }
-        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, enableCompanyFeature ? [
             branchId
-        ]);
+        ] : []);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
-    async getUserActions(userId, branchId, companyId) {
+    async getUserActions(userId, companyId, branchId) {
         const permissionRepo = await this.getPermissionRepository();
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const where = {
@@ -160,7 +157,7 @@ export class PermissionService {
         };
         if (enableCompanyFeature) {
             if (companyId) where.companyId = companyId;
-            where.branchId = branchId ?? null;
+            if (branchId) where.branchId = branchId;
         }
         const permissions = await permissionRepo.find({
             where
@@ -174,10 +171,11 @@ export class PermissionService {
             const action = actionMap.get(p.targetId);
             return {
                 id: p.id,
-                userId: p.userId,
+                userId: p.sourceId,
                 actionId: action.id,
                 actionCode: action.code ?? '',
                 actionName: action.name,
+                companyId: ('companyId' in p ? p.companyId : null) ?? null,
                 branchId: ('branchId' in p ? p.branchId : null) ?? null,
                 createdAt: p.createdAt
             };
@@ -231,7 +229,6 @@ export class PermissionService {
                     sourceId: dto.roleId,
                     targetType: IamEntityType.ACTION,
                     targetId: item.id,
-                    userId: null,
                     companyId: enableCompanyFeature ? roleCompanyId : null,
                     branchId: null
                 }));
@@ -261,7 +258,7 @@ export class PermissionService {
             });
             removed = result.affected || 0;
         }
-        await this.invalidateRoleMembersCache(dto.roleId);
+        await this.permissionCacheService.invalidateRoleMembersCache(dto.roleId);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
     async getRoleActions(roleId) {
@@ -293,94 +290,88 @@ export class PermissionService {
     // Company-Action Permissions (Whitelist)
     /** Assign or remove actions to/from a company (whitelist) */ async assignCompanyActions(dto) {
         const permissionRepo = await this.getPermissionRepository();
-        const dataSource = permissionRepo.manager.connection;
+        const dataSource = await this.dataSourceProvider.getDataSource();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
         let added = 0;
         let removed = 0;
         await dataSource.transaction(async (manager)=>{
             const transactionalPermissionRepo = manager.getRepository(permissionRepo.target);
             if (itemsToAdd.length > 0) {
-                added = await this.addCompanyActions(transactionalPermissionRepo, dto.companyId, itemsToAdd.map((item)=>item.id));
+                const actionIdsToAdd = itemsToAdd.map((item)=>item.id);
+                const existingPermissions = await transactionalPermissionRepo.find({
+                    where: {
+                        permissionType: IamPermissionType.COMPANY_ACTION,
+                        sourceType: IamEntityType.COMPANY,
+                        sourceId: dto.companyId,
+                        targetType: IamEntityType.ACTION,
+                        targetId: In(actionIdsToAdd)
+                    },
+                    select: [
+                        'targetId'
+                    ]
+                });
+                const existingActionIds = new Set(existingPermissions.map((p)=>p.targetId));
+                const newActionIds = actionIdsToAdd.filter((id)=>!existingActionIds.has(id));
+                if (newActionIds.length > 0) {
+                    const newPermissions = newActionIds.map((actionId)=>transactionalPermissionRepo.create({
+                            permissionType: IamPermissionType.COMPANY_ACTION,
+                            sourceType: IamEntityType.COMPANY,
+                            sourceId: dto.companyId,
+                            targetType: IamEntityType.ACTION,
+                            targetId: actionId
+                        }));
+                    await transactionalPermissionRepo.save(newPermissions);
+                    added = newPermissions.length;
+                }
             }
             if (itemsToRemove.length > 0) {
                 const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
-                removed = await this.removeCompanyActionsWithCascade(manager, dto.companyId, actionIdsToRemove);
+                const companyResult = await transactionalPermissionRepo.delete({
+                    permissionType: IamPermissionType.COMPANY_ACTION,
+                    sourceType: IamEntityType.COMPANY,
+                    sourceId: dto.companyId,
+                    targetType: IamEntityType.ACTION,
+                    targetId: In(actionIdsToRemove)
+                });
+                removed = companyResult.affected || 0;
+                // Cascade: an action no longer on the company whitelist must not remain
+                // reachable via role grants or direct user grants scoped to this company.
+                const roleEntity = enableCompanyFeature ? RoleWithCompany : Role;
+                const roleRepo = manager.getRepository(roleEntity);
+                const companyRoles = await roleRepo.find({
+                    where: {
+                        companyId: dto.companyId,
+                        deletedAt: IsNull()
+                    },
+                    select: [
+                        'id'
+                    ]
+                });
+                if (companyRoles.length > 0) {
+                    const roleIds = companyRoles.map((role)=>role.id);
+                    await transactionalPermissionRepo.delete({
+                        permissionType: IamPermissionType.ROLE_ACTION,
+                        sourceType: IamEntityType.ROLE,
+                        sourceId: In(roleIds),
+                        targetType: IamEntityType.ACTION,
+                        targetId: In(actionIdsToRemove)
+                    });
+                }
+                if (enableCompanyFeature) {
+                    await transactionalPermissionRepo.delete({
+                        permissionType: IamPermissionType.USER_ACTION,
+                        companyId: dto.companyId,
+                        targetType: IamEntityType.ACTION,
+                        targetId: In(actionIdsToRemove)
+                    });
+                }
             }
         });
-        await this.invalidateCompanyMembersCache(dto.companyId);
+        await this.permissionCacheService.invalidateCompanyMembersCache(dto.companyId);
         return this.buildOperationResult(dto.items.length, added, removed);
     }
-    async addCompanyActions(permissionRepo, companyId, actionIds) {
-        const existingPermissions = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.COMPANY_ACTION,
-                sourceType: IamEntityType.COMPANY,
-                sourceId: companyId,
-                targetType: IamEntityType.ACTION,
-                targetId: In(actionIds)
-            },
-            select: [
-                'targetId'
-            ]
-        });
-        const existingActionIds = new Set(existingPermissions.map((p)=>p.targetId));
-        const newActionIds = actionIds.filter((id)=>!existingActionIds.has(id));
-        if (newActionIds.length === 0) {
-            return 0;
-        }
-        const newPermissions = newActionIds.map((actionId)=>permissionRepo.create({
-                permissionType: IamPermissionType.COMPANY_ACTION,
-                sourceType: IamEntityType.COMPANY,
-                sourceId: companyId,
-                targetType: IamEntityType.ACTION,
-                targetId: actionId,
-                userId: null
-            }));
-        await permissionRepo.save(newPermissions);
-        return newPermissions.length;
-    }
-    async removeCompanyActionsWithCascade(manager, companyId, actionIds) {
-        const permissionEntity = this.iamConfigService.isCompanyFeatureEnabled() ? UserIamPermissionWithCompany : UserIamPermission;
-        const permissionRepo = manager.getRepository(permissionEntity);
-        const companyResult = await permissionRepo.delete({
-            permissionType: IamPermissionType.COMPANY_ACTION,
-            sourceType: IamEntityType.COMPANY,
-            sourceId: companyId,
-            targetType: IamEntityType.ACTION,
-            targetId: In(actionIds)
-        });
-        const roleEntity = this.iamConfigService.isCompanyFeatureEnabled() ? RoleWithCompany : Role;
-        const roleRepo = manager.getRepository(roleEntity);
-        const companyRoles = await roleRepo.find({
-            where: {
-                companyId,
-                deletedAt: IsNull()
-            },
-            select: [
-                'id'
-            ]
-        });
-        if (companyRoles.length > 0) {
-            const roleIds = companyRoles.map((role)=>role.id);
-            await permissionRepo.delete({
-                permissionType: IamPermissionType.ROLE_ACTION,
-                sourceType: IamEntityType.ROLE,
-                sourceId: In(roleIds),
-                targetType: IamEntityType.ACTION,
-                targetId: In(actionIds)
-            });
-        }
-        if (this.iamConfigService.isCompanyFeatureEnabled()) {
-            await permissionRepo.delete({
-                permissionType: IamPermissionType.USER_ACTION,
-                companyId,
-                targetType: IamEntityType.ACTION,
-                targetId: In(actionIds)
-            });
-        }
-        return companyResult.affected || 0;
-    }
-    /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId) {
+    /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId, isOnlyId = false) {
         const permissionRepo = await this.getPermissionRepository();
         const permissions = await permissionRepo.find({
             where: {
@@ -393,6 +384,7 @@ export class PermissionService {
             return [];
         }
         const actionIds = permissions.map((p)=>p.targetId);
+        if (isOnlyId) return actionIds;
         const actionMap = await this.getActionsMap(actionIds);
         return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
             const action = actionMap.get(p.targetId);
@@ -406,20 +398,6 @@ export class PermissionService {
             };
         });
     }
-    /** Get action IDs whitelisted for a company */ async getCompanyActionIds(companyId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const permissions = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.COMPANY_ACTION,
-                sourceType: IamEntityType.COMPANY,
-                sourceId: companyId
-            },
-            select: [
-                'targetId'
-            ]
-        });
-        return permissions.map((p)=>p.targetId);
-    }
     // User-Role Permissions
     /** Assign user to roles (branch-scoped when company feature is enabled) */ async assignUserRoles(dto) {
         if (!this.iamConfigService.isRbacEnabled()) {
@@ -461,7 +439,6 @@ export class PermissionService {
                     sourceId: dto.userId,
                     targetType: IamEntityType.ROLE,
                     targetId: item.id,
-                    userId: dto.userId,
                     companyId: enableCompanyFeature ? companyId : null,
                     branchId: enableCompanyFeature ? branchId : null
                 }));
@@ -512,7 +489,7 @@ export class PermissionService {
         };
         if (enableCompanyFeature) {
             if (companyId) where.companyId = companyId;
-            where.branchId = branchId ?? null;
+            if (branchId) where.branchId = branchId;
         }
         const permissions = await permissionRepo.find({
             where
@@ -536,7 +513,7 @@ export class PermissionService {
             const permissionEntity = p;
             return {
                 id: p.id,
-                userId: p.userId,
+                userId: p.sourceId,
                 roleId: role.id,
                 roleName: role.name,
                 branchId: enableCompanyFeature ? permissionEntity.branchId ?? null : null,
@@ -546,129 +523,7 @@ export class PermissionService {
     }
     // My Permissions
     /** Get user's effective permissions (cache-first approach) */ async getMyPermissions(userId, branchId, companyId, parentCodes) {
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const cacheOptions = {
-            userId,
-            companyId: enableCompanyFeature ? companyId : null,
-            branchId
-        };
-        const cachedData = await this.permissionCacheService.getMyPermissions(cacheOptions);
-        if (cachedData) {
-            return this.buildResponseFromCache(cachedData, parentCodes);
-        }
-        const freshData = await this.fetchAndCachePermissions(userId, branchId, companyId);
-        return this.buildResponseFromCache(freshData, parentCodes);
-    }
-    /** Build response from cached data, applying optional parentCodes filter */ async buildResponseFromCache(cachedData, parentCodes) {
-        let frontendActions = cachedData.frontendActions;
-        if (parentCodes?.length) {
-            const parentIds = await this.getParentIdsByCodesWithCache(parentCodes);
-            if (parentIds.size > 0) {
-                frontendActions = frontendActions.filter((a)=>a.parentId && parentIds.has(a.parentId));
-            } else {
-                frontendActions = [];
-            }
-        }
-        return {
-            frontendActions: frontendActions.map((a)=>({
-                    id: a.id,
-                    code: a.code,
-                    name: a.name,
-                    description: a.description
-                })),
-            cachedEndpoints: cachedData.backendCodes.length
-        };
-    }
-    /** Resolve action IDs for the given codes */ async getParentIdsByCodesWithCache(codes) {
-        const actionRepo = await this.getActionRepository();
-        const actions = await actionRepo.find({
-            where: {
-                code: In(codes)
-            },
-            select: [
-                'id',
-                'code'
-            ]
-        });
-        return new Set(actions.map((action)=>action.id));
-    }
-    /** Fetch permissions from DB and cache them (empty permissions are also cached) */ async fetchAndCachePermissions(userId, branchId, companyId) {
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const cacheOptions = {
-            userId,
-            companyId: enableCompanyFeature ? companyId : null,
-            branchId
-        };
-        const emptyData = {
-            frontendActions: [],
-            backendCodes: []
-        };
-        const allActionIds = await this.collectAllActionIds(userId, branchId, companyId);
-        if (allActionIds.size === 0) {
-            await this.permissionCacheService.setMyPermissions(cacheOptions, emptyData);
-            return emptyData;
-        }
-        await this.applyCompanyWhitelist(allActionIds, companyId);
-        if (allActionIds.size === 0) {
-            await this.permissionCacheService.setMyPermissions(cacheOptions, emptyData);
-            return emptyData;
-        }
-        return this.buildAndCachePermissionData(allActionIds, cacheOptions);
-    }
-    /** Collect all action IDs based on permission mode (RBAC, DIRECT, or FULL) */ async collectAllActionIds(userId, branchId, companyId) {
-        const permissionMode = this.iamConfigService.getPermissionMode();
-        const allActionIds = new Set();
-        if (permissionMode === IAMPermissionMode.RBAC || permissionMode === IAMPermissionMode.FULL) {
-            const userRoleIds = await this.getUserRoleIds(userId, branchId, companyId);
-            if (userRoleIds.length > 0) {
-                const roleActionIds = await this.getRoleActionIds(userRoleIds);
-                roleActionIds.forEach((id)=>allActionIds.add(id));
-            }
-        }
-        if (permissionMode === IAMPermissionMode.DIRECT || permissionMode === IAMPermissionMode.FULL) {
-            const userActionIds = await this.getUserActionIds(userId, branchId, companyId);
-            userActionIds.forEach((id)=>allActionIds.add(id));
-        }
-        return allActionIds;
-    }
-    /** Apply company whitelist filter to action IDs (mutates the set) */ async applyCompanyWhitelist(actionIds, companyId) {
-        if (!this.iamConfigService.isCompanyFeatureEnabled() || !companyId) {
-            return;
-        }
-        const companyActionIds = await this.getCompanyActionIds(companyId);
-        if (companyActionIds.length === 0) {
-            return;
-        }
-        const allowedActionIds = new Set(companyActionIds);
-        for (const actionId of actionIds){
-            if (!allowedActionIds.has(actionId)) {
-                actionIds.delete(actionId);
-            }
-        }
-    }
-    /** Fetch actions from DB, separate by type, build cache data, and cache it */ async buildAndCachePermissionData(actionIds, cacheOptions) {
-        const actionRepo = await this.getActionRepository();
-        const actions = await actionRepo.find({
-            where: {
-                id: In(Array.from(actionIds)),
-                isActive: true
-            }
-        });
-        const backendActions = actions.filter((a)=>a.actionType === ActionType.BACKEND || a.actionType === ActionType.BOTH);
-        const frontendActions = actions.filter((a)=>a.actionType === ActionType.FRONTEND || a.actionType === ActionType.BOTH);
-        const backendCodes = backendActions.map((a)=>a.code).filter((c)=>!!c);
-        const cacheData = {
-            frontendActions: frontendActions.map((a)=>({
-                    id: a.id,
-                    code: a.code ?? '',
-                    name: a.name,
-                    description: a.description,
-                    parentId: a.parentId
-                })),
-            backendCodes
-        };
-        await this.permissionCacheService.setMyPermissions(cacheOptions, cacheData);
-        return cacheData;
+        return this.permissionCacheService.getMyPermissionsResponse(userId, branchId, companyId, parentCodes);
     }
     // Helper Methods
     /** Split permission items into add and remove arrays */ splitItemsByAction(items) {
@@ -684,176 +539,13 @@ export class PermissionService {
             total: _totalItems
         };
     }
-    /** Get role IDs assigned to a user (merges company-wide + branch-specific roles) */ async getUserRoleIds(userId, branchId, companyId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        if (!enableCompanyFeature) {
-            const permissions = await permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.USER_ROLE,
-                    sourceType: IamEntityType.USER,
-                    sourceId: userId
-                }
-            });
-            return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
-        }
-        const roleIds = new Set();
-        const baseWhere = {
-            permissionType: IamPermissionType.USER_ROLE,
-            sourceType: IamEntityType.USER,
-            sourceId: userId
-        };
-        if (companyId) {
-            baseWhere.companyId = companyId;
-        }
-        if (branchId) {
-            // Get company-wide + branch-specific roles
-            const companyWidePermissions = await permissionRepo.find({
-                where: {
-                    ...baseWhere,
-                    branchId: IsNull()
-                }
-            });
-            companyWidePermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
-            const branchPermissions = await permissionRepo.find({
-                where: {
-                    ...baseWhere,
-                    branchId
-                }
-            });
-            branchPermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
-        } else {
-            // No branch context: get all roles for this company
-            const allPermissions = await permissionRepo.find({
-                where: baseWhere
-            });
-            allPermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
-        }
-        return Array.from(roleIds);
-    }
-    async getRoleActionIds(roleIds) {
-        const permissionRepo = await this.getPermissionRepository();
-        const permissions = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.ROLE_ACTION,
-                sourceType: IamEntityType.ROLE,
-                sourceId: In(roleIds)
-            }
-        });
-        return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
-    }
-    /** Get action IDs directly assigned to a user (merges company-wide + branch-specific actions) */ async getUserActionIds(userId, branchId, companyId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        if (!enableCompanyFeature) {
-            const permissions = await permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.USER_ACTION,
-                    sourceType: IamEntityType.USER,
-                    sourceId: userId
-                }
-            });
-            return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
-        }
-        const actionIds = new Set();
-        const baseWhere = {
-            permissionType: IamPermissionType.USER_ACTION,
-            sourceType: IamEntityType.USER,
-            sourceId: userId
-        };
-        if (companyId) {
-            baseWhere.companyId = companyId;
-        }
-        if (branchId) {
-            // Get company-wide + branch-specific actions
-            const companyWidePermissions = await permissionRepo.find({
-                where: {
-                    ...baseWhere,
-                    branchId: IsNull()
-                }
-            });
-            companyWidePermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
-            const branchPermissions = await permissionRepo.find({
-                where: {
-                    ...baseWhere,
-                    branchId
-                }
-            });
-            branchPermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
-        } else {
-            // No branch context: get all actions for this company
-            const allPermissions = await permissionRepo.find({
-                where: baseWhere
-            });
-            allPermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
-        }
-        return Array.from(actionIds);
-    }
-    async invalidateRoleMembersCache(roleId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const roleRepo = await this.getRoleRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const userRoles = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.USER_ROLE,
-                sourceType: IamEntityType.USER,
-                targetType: IamEntityType.ROLE,
-                targetId: roleId
-            }
-        });
-        const userIds = [
-            ...new Set(userRoles.map((ur)=>ur.sourceId))
-        ];
-        if (userIds.length === 0) {
-            return 0;
-        }
-        const role = await roleRepo.findOne({
-            where: {
-                id: roleId
-            }
-        });
-        const companyId = role?.companyId || null;
-        let branchIds = [
-            null
-        ];
-        if (enableCompanyFeature && companyId) {
-            const userBranches = await permissionRepo.createQueryBuilder('p').select('DISTINCT p.branch_id', 'branchId').where('p.user_id IN (:...userIds)', {
-                userIds
-            }).andWhere('p.company_id = :companyId', {
-                companyId
-            }).getRawMany();
-            branchIds = [
-                ...new Set(userBranches.map((p)=>p.branchId))
-            ];
-        }
-        return this.permissionCacheService.invalidateUsers(userIds, companyId, branchIds);
-    }
-    /** Invalidate permission cache for all users in a company */ async invalidateCompanyMembersCache(companyId) {
-        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
-            return 0;
-        }
-        const permissionRepo = await this.getPermissionRepository();
-        const userPermissions = await permissionRepo.createQueryBuilder('p').select('DISTINCT p.user_id', 'userId').addSelect('p.branch_id', 'branchId').where('p.company_id = :companyId', {
-            companyId
-        }).andWhere('p.user_id IS NOT NULL').getRawMany();
-        const userIds = [
-            ...new Set(userPermissions.map((p)=>p.userId).filter(Boolean))
-        ];
-        const branchIds = [
-            ...new Set(userPermissions.map((p)=>p.branchId))
-        ]; // includes null
-        if (userIds.length === 0) {
-            return 0;
-        }
-        return await this.permissionCacheService.invalidateUsers(userIds, companyId, branchIds);
-    }
     async revokeCompanyPermissions(companyId) {
         if (!this.iamConfigService.isCompanyFeatureEnabled()) {
             return;
         }
         const permissionRepo = await this.getPermissionRepository();
         const roleRepo = await this.getRoleRepository();
-        const dataSource = permissionRepo.manager.connection;
+        const dataSource = await this.dataSourceProvider.getDataSource();
         const companyRoles = await roleRepo.find({
             where: {
                 companyId,
@@ -870,14 +562,15 @@ export class PermissionService {
                     IamPermissionType.USER_ROLE,
                     IamPermissionType.USER_ACTION
                 ]),
+                sourceType: IamEntityType.USER,
                 companyId
             },
             select: [
-                'userId'
+                'sourceId'
             ]
         });
         const affectedUserIds = [
-            ...new Set(affectedUserRows.map((row)=>row.userId).filter((id)=>!!id))
+            ...new Set(affectedUserRows.map((row)=>row.sourceId))
         ];
         await dataSource.transaction(async (manager)=>{
             const txRepo = manager.getRepository(permissionRepo.target);
@@ -919,17 +612,20 @@ export class PermissionService {
                 IamPermissionType.USER_ROLE,
                 IamPermissionType.USER_ACTION
             ]),
-            branchId,
-            companyId
+            companyId,
+            branchId
         };
         const affectedUserRows = await permissionRepo.find({
-            where,
+            where: {
+                ...where,
+                sourceType: IamEntityType.USER
+            },
             select: [
-                'userId'
+                'sourceId'
             ]
         });
         const affectedUserIds = [
-            ...new Set(affectedUserRows.map((row)=>row.userId).filter((id)=>!!id))
+            ...new Set(affectedUserRows.map((row)=>row.sourceId))
         ];
         await permissionRepo.delete(where);
         if (affectedUserIds.length > 0) {