@flusys/nestjs-iam 6.0.2 → 6.1.1

package/fesm/services/role.service.spec.js

@@ -0,0 +1,305 @@
+import { Test } from '@nestjs/testing';
+import { UtilsService } from '@flusys/nestjs-shared/modules';
+import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
+import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
+import { Role } from '../entities/role.entity';
+import { RoleWithCompany } from '../entities/role-with-company.entity';
+import { IAMConfigService } from './iam-config.service';
+import { IAMDataSourceService } from './iam-datasource.service';
+import { PermissionCacheService } from './permission-cache.service';
+import { RoleService } from './role.service';
+function buildRole(overrides = {}) {
+    return {
+        id: 'role-uuid-1',
+        readOnly: false,
+        name: 'Manager',
+        description: null,
+        isActive: true,
+        serial: 1,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+        deletedAt: null,
+        createdById: null,
+        updatedById: null,
+        deletedById: null,
+        ...overrides
+    };
+}
+describe('RoleService', ()=>{
+    let service;
+    let mockRepo;
+    let mockIamConfigService;
+    let mockPermissionCacheService;
+    beforeEach(async ()=>{
+        mockRepo = createMockRepository();
+        const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
+        mockIamConfigService = {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
+        };
+        mockPermissionCacheService = {
+            invalidateUsers: jest.fn()
+        };
+        const module = await Test.createTestingModule({
+            providers: [
+                RoleService,
+                {
+                    provide: 'CACHE_INSTANCE',
+                    useValue: {}
+                },
+                {
+                    provide: UtilsService,
+                    useValue: {}
+                },
+                {
+                    provide: IAMConfigService,
+                    useValue: mockIamConfigService
+                },
+                {
+                    provide: IAMDataSourceService,
+                    useValue: mockDataSourceProvider
+                },
+                {
+                    provide: PermissionCacheService,
+                    useValue: mockPermissionCacheService
+                }
+            ]
+        }).compile();
+        service = await module.resolve(RoleService);
+    });
+    describe('resolveEntity', ()=>{
+        it('resolves to Role when the company feature is disabled', ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            expect(service.resolveEntity()).toBe(Role);
+        });
+        it('resolves to RoleWithCompany when the company feature is enabled', ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            expect(service.resolveEntity()).toBe(RoleWithCompany);
+        });
+    });
+    describe('convertSingleDtoToEntity', ()=>{
+        it('creates a plain entity without companyId when the company feature is disabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            await service.ensureDataSourceRepository();
+            mockRepo.create.mockReturnValue({});
+            const entity = await service.convertSingleDtoToEntity({
+                name: 'Manager'
+            }, buildMockUser());
+            expect(entity.companyId).toBeUndefined();
+        });
+        it('stamps companyId from the DTO on create when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            await service.ensureDataSourceRepository();
+            mockRepo.create.mockReturnValue({});
+            const entity = await service.convertSingleDtoToEntity({
+                name: 'Manager',
+                companyId: 'company-explicit'
+            }, buildMockUser({
+                companyId: 'company-from-user'
+            }));
+            expect(entity.companyId).toBe('company-explicit');
+        });
+        it('falls back to the user companyId on create when the DTO omits it', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            await service.ensureDataSourceRepository();
+            mockRepo.create.mockReturnValue({});
+            const entity = await service.convertSingleDtoToEntity({
+                name: 'Manager'
+            }, buildMockUser({
+                companyId: 'company-from-user'
+            }));
+            expect(entity.companyId).toBe('company-from-user');
+        });
+        it('does not override companyId on update when the DTO omits it', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            await service.ensureDataSourceRepository();
+            const existing = buildRole({
+                id: 'role-uuid-1',
+                companyId: 'existing-company'
+            });
+            mockRepo.findOne.mockResolvedValue(existing);
+            const entity = await service.convertSingleDtoToEntity({
+                id: 'role-uuid-1',
+                name: 'Manager Updated'
+            }, buildMockUser({
+                companyId: 'company-from-user'
+            }));
+            expect(entity.companyId).toBe('existing-company');
+        });
+        it('overrides companyId on update when explicitly provided in the DTO', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            await service.ensureDataSourceRepository();
+            const existing = buildRole({
+                id: 'role-uuid-1',
+                companyId: 'existing-company'
+            });
+            mockRepo.findOne.mockResolvedValue(existing);
+            const entity = await service.convertSingleDtoToEntity({
+                id: 'role-uuid-1',
+                name: 'Manager Updated',
+                companyId: 'new-company'
+            }, buildMockUser());
+            expect(entity.companyId).toBe('new-company');
+        });
+        it('throws NotFoundException when updating a role that does not exist', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            await service.ensureDataSourceRepository();
+            mockRepo.findOne.mockResolvedValue(null);
+            await expect(service.convertSingleDtoToEntity({
+                id: 'missing-role'
+            }, buildMockUser())).rejects.toThrow();
+        });
+    });
+    describe('getSelectQuery', ()=>{
+        it('selects the default field set without companyId when the company feature is disabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, buildMockUser());
+            expect(query.select).toHaveBeenCalledWith(expect.not.arrayContaining([
+                'role.companyId'
+            ]));
+        });
+        it('includes companyId in the default field set when the company feature is enabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, buildMockUser());
+            expect(query.select).toHaveBeenCalledWith(expect.arrayContaining([
+                'role.companyId'
+            ]));
+        });
+        it('uses the explicitly provided select list as-is', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getSelectQuery(query, buildMockUser(), [
+                'id',
+                'name'
+            ]);
+            expect(query.select).toHaveBeenCalledWith([
+                'role.id',
+                'role.name'
+            ]);
+        });
+    });
+    describe('getGlobalSearchQuery', ()=>{
+        it('filters by name or description', async ()=>{
+            const query = mockRepo.createQueryBuilder();
+            await service.getGlobalSearchQuery(query, 'manager');
+            expect(query.andWhere).toHaveBeenCalledWith('(role.name LIKE :search OR role.description LIKE :search)', {
+                search: '%manager%'
+            });
+        });
+    });
+    describe('getExtraManipulateQuery', ()=>{
+        it('applies a company filter clause when the company feature is enabled and the user has a company', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
+            const query = mockRepo.createQueryBuilder();
+            await service.getExtraManipulateQuery(query, {}, buildMockUser({
+                companyId: 'company-1'
+            }));
+            expect(query.andWhere).toHaveBeenCalledWith('role.companyId = :companyId', {
+                companyId: 'company-1'
+            });
+        });
+        it('does not apply a company filter when the company feature is disabled', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            const query = mockRepo.createQueryBuilder();
+            await service.getExtraManipulateQuery(query, {}, buildMockUser({
+                companyId: 'company-1'
+            }));
+            expect(query.andWhere).not.toHaveBeenCalled();
+        });
+    });
+    describe('convertEntityToResponseDto', ()=>{
+        it('defaults companyId to null when the entity has no companyId field', ()=>{
+            const entity = buildRole();
+            const dto = service.convertEntityToResponseDto(entity, false);
+            expect(dto.companyId).toBeNull();
+        });
+        it('surfaces companyId when present on the entity', ()=>{
+            const entity = buildRole({
+                companyId: 'company-1'
+            });
+            const dto = service.convertEntityToResponseDto(entity, false);
+            expect(dto.companyId).toBe('company-1');
+        });
+    });
+    describe('beforeDeleteOperation', ()=>{
+        function buildQueryRunner(permissionRepo) {
+            return {
+                manager: {
+                    getRepository: jest.fn().mockReturnValue(permissionRepo)
+                }
+            };
+        }
+        it('does nothing when the delete DTO has no ids', async ()=>{
+            const permissionRepo = createMockRepository();
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(permissionRepo.find).not.toHaveBeenCalled();
+        });
+        it('cascades ROLE_ACTION and USER_ROLE cleanup and invalidates affected users cache', async ()=>{
+            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
+            const permissionRepo = createMockRepository();
+            permissionRepo.find.mockResolvedValue([
+                {
+                    sourceId: 'user-1'
+                },
+                {
+                    sourceId: 'user-2'
+                }
+            ]);
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: 'role-uuid-1',
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'role_action',
+                sourceType: 'role'
+            }));
+            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
+                permissionType: 'user_role',
+                targetType: 'role'
+            }));
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
+                'user-1',
+                'user-2'
+            ]);
+        });
+        it('does not invalidate any cache when no users are affected', async ()=>{
+            const permissionRepo = createMockRepository();
+            permissionRepo.find.mockResolvedValue([]);
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [
+                    'role-uuid-1'
+                ],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
+        });
+        it('supports array ids and dedupes affected user ids', async ()=>{
+            const permissionRepo = createMockRepository();
+            permissionRepo.find.mockResolvedValue([
+                {
+                    sourceId: 'user-1'
+                },
+                {
+                    sourceId: 'user-1'
+                }
+            ]);
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await service.beforeDeleteOperation({
+                id: [
+                    'role-uuid-1',
+                    'role-uuid-2'
+                ],
+                type: 'delete'
+            }, buildMockUser(), queryRunner);
+            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
+                'user-1'
+            ]);
+        });
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-iam",
-  "version": "6.0.2",
+  "version": "6.1.1",
   "description": "Identity and Access Management (IAM) module for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -90,7 +90,7 @@
     "express": "^5.0.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.0.2",
-    "@flusys/nestjs-shared": "6.0.2"
+    "@flusys/nestjs-core": "6.1.1",
+    "@flusys/nestjs-shared": "6.1.1"
   }
 }

package/services/permission-cache.service.d.ts

@@ -1,4 +1,7 @@
 import { HybridCache, PermissionCacheKeyOptions, PermissionGuardConfig } from '@flusys/nestjs-shared';
+import { MyPermissionsResponseDto } from '../dtos/permission.dto';
+import { IAMConfigService } from './iam-config.service';
+import { IAMDataSourceService } from './iam-datasource.service';
 export { PermissionCacheKeyOptions } from '@flusys/nestjs-shared';
 export interface CachedMyPermissions {
     frontendActions: Array<{
@@ -10,14 +13,18 @@ export interface CachedMyPermissions {
     }>;
     backendCodes: string[];
 }
-export declare const MY_PERMISSIONS_CACHE_PREFIX = "my-permissions";
 export declare class PermissionCacheService {
     private readonly cacheManager;
+    private readonly iamConfigService;
+    private readonly dataSourceProvider;
     private readonly guardConfig?;
     private readonly TRACKED_KEYS_PREFIX;
     private readonly TRACKED_SCOPES_PREFIX;
     private readonly TTL;
-    constructor(cacheManager: HybridCache, guardConfig?: PermissionGuardConfig | undefined);
+    constructor(cacheManager: HybridCache, iamConfigService: IAMConfigService, dataSourceProvider: IAMDataSourceService, guardConfig?: PermissionGuardConfig | undefined);
+    private getPermissionRepository;
+    private getActionRepository;
+    private getRoleRepository;
     private parseDurationMs;
     private buildCacheKey;
     private scopeToken;
@@ -26,7 +33,17 @@ export declare class PermissionCacheService {
     setMyPermissions(options: PermissionCacheKeyOptions, data: CachedMyPermissions): Promise<void>;
     getMyPermissions(options: PermissionCacheKeyOptions): Promise<CachedMyPermissions | null>;
     private trackKey;
+    getMyPermissionsResponse(userId: string, branchId: string | null, companyId?: string | null, parentCodes?: string[]): Promise<MyPermissionsResponseDto>;
+    private buildResponseFromCache;
+    private getParentIdsByCodesWithCache;
+    private fetchAndCachePermissions;
+    private collectAllActionIds;
+    private buildAndCachePermissionData;
+    private getUserRoleIds;
+    private getRoleActionIds;
+    private getUserActionIds;
     invalidateUser(userId: string, companyId?: string | null, branchIds?: (string | null)[]): Promise<void>;
-    private invalidateScope;
     invalidateUsers(userIds: string[], companyId?: string | null, branchIds?: (string | null)[]): Promise<number>;
+    invalidateRoleMembersCache(roleId: string): Promise<number>;
+    invalidateCompanyMembersCache(companyId: string): Promise<number>;
 }

package/services/permission.service.d.ts

@@ -12,30 +12,16 @@ export declare class PermissionService {
     private getRoleRepository;
     private getActionsMap;
     assignUserActions(dto: AssignUserActionsDto): Promise<PermissionOperationResultDto>;
-    getUserActions(userId: string, branchId: string | undefined, companyId?: string | undefined): Promise<UserActionResponseDto[]>;
+    getUserActions(userId: string, companyId: string | undefined, branchId: string | undefined): Promise<UserActionResponseDto[]>;
     assignRoleActions(dto: AssignRoleActionsDto): Promise<PermissionOperationResultDto>;
     getRoleActions(roleId: string): Promise<RoleActionResponseDto[]>;
     assignCompanyActions(dto: AssignCompanyActionsDto): Promise<PermissionOperationResultDto>;
-    private addCompanyActions;
-    private removeCompanyActionsWithCascade;
-    getCompanyActions(companyId: string): Promise<CompanyActionResponseDto[]>;
-    getCompanyActionIds(companyId: string): Promise<string[]>;
+    getCompanyActions(companyId: string, isOnlyId?: boolean): Promise<CompanyActionResponseDto[] | string[]>;
     assignUserRoles(dto: AssignUserRolesDto): Promise<PermissionOperationResultDto>;
     getUserRoles(userId: string, branchId?: string | undefined, companyId?: string | undefined): Promise<UserRoleResponseDto[]>;
     getMyPermissions(userId: string, branchId: string | null, companyId?: string | null, parentCodes?: string[]): Promise<MyPermissionsResponseDto>;
-    private buildResponseFromCache;
-    private getParentIdsByCodesWithCache;
-    private fetchAndCachePermissions;
-    private collectAllActionIds;
-    private applyCompanyWhitelist;
-    private buildAndCachePermissionData;
     private splitItemsByAction;
     private buildOperationResult;
-    private getUserRoleIds;
-    private getRoleActionIds;
-    private getUserActionIds;
-    private invalidateRoleMembersCache;
-    invalidateCompanyMembersCache(companyId: string): Promise<number>;
     revokeCompanyPermissions(companyId: string): Promise<void>;
     revokeBranchPermissions(branchId: string, companyId: string): Promise<void>;
     revokeUserCompanyAccess(userId: string, companyId: string): Promise<void>;