@flusys/nestjs-iam 6.0.2 → 6.1.1

package/cjs/entities/index.spec.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _index = require("./index");
+const _actionentity = require("./action.entity");
+const _roleentity = require("./role.entity");
+const _rolewithcompanyentity = require("./role-with-company.entity");
+const _useriampermissionentity = require("./user-iam-permission.entity");
+const _permissionwithcompanyentity = require("./permission-with-company.entity");
+describe('getIAMEntitiesByConfig', ()=>{
+    it('should always include Action', ()=>{
+        expect((0, _index.getIAMEntitiesByConfig)(false)).toContain(_actionentity.Action);
+        expect((0, _index.getIAMEntitiesByConfig)(true)).toContain(_actionentity.Action);
+    });
+    it('should default permissionMode to FULL and include Role + UserIamPermission when company feature is off', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(false);
+        expect(entities).toEqual(expect.arrayContaining([
+            _actionentity.Action,
+            _useriampermissionentity.UserIamPermission,
+            _roleentity.Role
+        ]));
+        expect(entities).not.toContain(_rolewithcompanyentity.RoleWithCompany);
+        expect(entities).not.toContain(_permissionwithcompanyentity.UserIamPermissionWithCompany);
+    });
+    it('should use the company-scoped permission entity when enableCompanyFeature is true', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(true, 'FULL');
+        expect(entities).toContain(_permissionwithcompanyentity.UserIamPermissionWithCompany);
+        expect(entities).not.toContain(_useriampermissionentity.UserIamPermission);
+    });
+    it('should use the company-scoped role entity when enableCompanyFeature is true', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(true, 'RBAC');
+        expect(entities).toContain(_rolewithcompanyentity.RoleWithCompany);
+        expect(entities).not.toContain(_roleentity.Role);
+    });
+    it('should include Role for RBAC mode', ()=>{
+        expect((0, _index.getIAMEntitiesByConfig)(false, 'RBAC')).toContain(_roleentity.Role);
+    });
+    it('should include Role for FULL mode', ()=>{
+        expect((0, _index.getIAMEntitiesByConfig)(false, 'FULL')).toContain(_roleentity.Role);
+    });
+    it('should exclude Role entirely for DIRECT mode', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(false, 'DIRECT');
+        expect(entities).not.toContain(_roleentity.Role);
+        expect(entities).not.toContain(_rolewithcompanyentity.RoleWithCompany);
+        expect(entities).toEqual(expect.arrayContaining([
+            _actionentity.Action,
+            _useriampermissionentity.UserIamPermission
+        ]));
+    });
+    it('should exclude the company-scoped Role for DIRECT mode even with company feature enabled', ()=>{
+        const entities = (0, _index.getIAMEntitiesByConfig)(true, 'DIRECT');
+        expect(entities).not.toContain(_rolewithcompanyentity.RoleWithCompany);
+        expect(entities).toContain(_permissionwithcompanyentity.UserIamPermissionWithCompany);
+    });
+});

package/cjs/entities/permission-base.entity.js

@@ -39,7 +39,7 @@ let PermissionBase = class PermissionBase extends _nestjsshared.Identity {
         return true;
     }
     constructor(...args){
-        super(...args), _define_property(this, "permissionType", void 0), _define_property(this, "sourceType", void 0), _define_property(this, "sourceId", void 0), _define_property(this, "targetType", void 0), _define_property(this, "targetId", void 0), _define_property(this, "userId", void 0), _define_property(this, "validFrom", void 0), _define_property(this, "validUntil", void 0), _define_property(this, "reason", void 0);
+        super(...args), _define_property(this, "permissionType", void 0), _define_property(this, "sourceType", void 0), _define_property(this, "sourceId", void 0), _define_property(this, "targetType", void 0), _define_property(this, "targetId", void 0), _define_property(this, "validFrom", void 0), _define_property(this, "validUntil", void 0), _define_property(this, "reason", void 0);
     }
 };
 _ts_decorate([
@@ -82,15 +82,6 @@ _ts_decorate([
     }),
     _ts_metadata("design:type", String)
 ], PermissionBase.prototype, "targetId", void 0);
-_ts_decorate([
-    (0, _typeorm.Column)({
-        type: 'varchar',
-        length: 150,
-        nullable: true,
-        name: 'user_id'
-    }),
-    _ts_metadata("design:type", Object)
-], PermissionBase.prototype, "userId", void 0);
 _ts_decorate([
     (0, _typeorm.Column)({
         type: 'timestamp',

package/cjs/entities/permission-with-company.entity.js

@@ -87,9 +87,6 @@ UserIamPermissionWithCompany = _ts_decorate([
     (0, _typeorm.Index)([
         'permissionType'
     ]),
-    (0, _typeorm.Index)([
-        'userId'
-    ]),
     (0, _typeorm.Index)([
         'companyId'
     ]),

package/cjs/entities/user-iam-permission.entity.js

@@ -39,8 +39,5 @@ UserIamPermission = _ts_decorate([
     ]),
     (0, _typeorm.Index)([
         'permissionType'
-    ]),
-    (0, _typeorm.Index)([
-        'userId'
     ])
 ], UserIamPermission);

package/cjs/helpers/company-access.helper.spec.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _common = require("@nestjs/common");
+const _constants = require("@flusys/nestjs-shared/constants");
+const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
+const _companyaccesshelper = require("./company-access.helper");
+describe('validateCompanyAccess', ()=>{
+    function buildConfig(isCompanyFeatureEnabled) {
+        return {
+            isCompanyFeatureEnabled: jest.fn().mockReturnValue(isCompanyFeatureEnabled)
+        };
+    }
+    it('does not throw when company feature is disabled', ()=>{
+        const config = buildConfig(false);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user)).not.toThrow();
+    });
+    it('does not throw when companyId is undefined', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, undefined, user)).not.toThrow();
+    });
+    it('does not throw when the companyId matches the user company', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        expect(()=>(0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-1', user)).not.toThrow();
+    });
+    it('throws ForbiddenException with default message/key when the company does not match', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        try {
+            (0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user);
+            fail('expected validateCompanyAccess to throw');
+        } catch (error) {
+            expect(error).toBeInstanceOf(_common.ForbiddenException);
+            expect(error.getResponse()).toEqual(expect.objectContaining({
+                message: 'You do not have access to this company',
+                messageKey: _constants.AUTH_MESSAGES.COMPANY_NO_ACCESS
+            }));
+        }
+    });
+    it('throws with a custom message and messageKey when provided', ()=>{
+        const config = buildConfig(true);
+        const user = (0, _loggedusermock.buildMockUser)({
+            companyId: 'company-uuid-1'
+        });
+        try {
+            (0, _companyaccesshelper.validateCompanyAccess)(config, 'company-uuid-2', user, 'Custom message', 'custom.message.key');
+            fail('expected validateCompanyAccess to throw');
+        } catch (error) {
+            expect(error).toBeInstanceOf(_common.ForbiddenException);
+            expect(error.getResponse()).toEqual(expect.objectContaining({
+                message: 'Custom message',
+                messageKey: 'custom.message.key'
+            }));
+        }
+    });
+});

package/cjs/helpers/permission-mode.helper.spec.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _permissiontypeenum = require("../enums/permission-type.enum");
+const _permissionmodehelper = require("./permission-mode.helper");
+describe('PermissionModeHelper', ()=>{
+    describe('fromString', ()=>{
+        it('converts "RBAC" to IAMPermissionMode.RBAC', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('RBAC')).toBe(_permissiontypeenum.IAMPermissionMode.RBAC);
+        });
+        it('converts "DIRECT" to IAMPermissionMode.DIRECT', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('DIRECT')).toBe(_permissiontypeenum.IAMPermissionMode.DIRECT);
+        });
+        it('converts "FULL" to IAMPermissionMode.FULL', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('FULL')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is undefined', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString(undefined)).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is empty', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('defaults to FULL when the string is not a known mode', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('INVALID_MODE')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+        it('is case-sensitive and falls back to FULL for lowercase input', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.fromString('rbac')).toBe(_permissiontypeenum.IAMPermissionMode.FULL);
+        });
+    });
+    describe('toString', ()=>{
+        it('converts IAMPermissionMode.RBAC to "RBAC"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.RBAC)).toBe('RBAC');
+        });
+        it('converts IAMPermissionMode.DIRECT to "DIRECT"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.DIRECT)).toBe('DIRECT');
+        });
+        it('converts IAMPermissionMode.FULL to "FULL"', ()=>{
+            expect(_permissionmodehelper.PermissionModeHelper.toString(_permissiontypeenum.IAMPermissionMode.FULL)).toBe('FULL');
+        });
+    });
+    describe('round trip', ()=>{
+        it('fromString(toString(mode)) returns the original mode for every enum value', ()=>{
+            const modes = [
+                _permissiontypeenum.IAMPermissionMode.RBAC,
+                _permissiontypeenum.IAMPermissionMode.DIRECT,
+                _permissiontypeenum.IAMPermissionMode.FULL
+            ];
+            for (const mode of modes){
+                expect(_permissionmodehelper.PermissionModeHelper.fromString(_permissionmodehelper.PermissionModeHelper.toString(mode))).toBe(mode);
+            }
+        });
+    });
+});

package/cjs/modules/iam.module.js

@@ -69,8 +69,8 @@ let IAMModule = class IAMModule {
             provide: _nestjsshared.PERMISSION_GUARD_CONFIG,
             useValue: {
                 enableCompanyFeature,
-                userPermissionKeyFormat: `${_permissioncacheservice.MY_PERMISSIONS_CACHE_PREFIX}:user:{userId}`,
-                companyPermissionKeyFormat: `${_permissioncacheservice.MY_PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`
+                userPermissionKeyFormat: `${_nestjsshared.PERMISSIONS_CACHE_PREFIX}:user:{userId}`,
+                companyPermissionKeyFormat: `${_nestjsshared.PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`
             }
         };
     }

package/cjs/modules/iam.module.spec.js

@@ -0,0 +1,293 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+const _nestjsshared = require("@flusys/nestjs-shared");
+const _iammodule = require("./iam.module");
+const _iamconstants = require("../config/iam.constants");
+const _controllers = require("../controllers");
+const _services = require("../services");
+const _iamconfigservice = require("../services/iam-config.service");
+const _iamdatasourceservice = require("../services/iam-datasource.service");
+const _permissioncacheservice = require("../services/permission-cache.service");
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function providerTokens(providers) {
+    return providers.map((p)=>typeof p === 'function' ? p : p.provide);
+}
+describe('IAMModule', ()=>{
+    describe('forRoot - controller/service registration matrix', ()=>{
+        it('should register no controllers by default (includeController defaults to false)', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(dynamicModule.controllers).toEqual([]);
+        });
+        it('DIRECT mode: registers only UserActionPermissionController beyond the base set', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.UserActionPermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).not.toContain(_services.RoleService);
+        });
+        it('RBAC mode: registers RoleController + RolePermissionController but not UserActionPermissionController', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.RoleController,
+                _controllers.RolePermissionController
+            ]);
+            expect(providerTokens(dynamicModule.providers)).toContain(_services.RoleService);
+        });
+        it('FULL mode: registers every permission controller', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]);
+        });
+        it('defaults to FULL mode when permissionMode is omitted', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]));
+        });
+        it('defaults to FULL mode when permissionMode is an unrecognized string', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'BOGUS'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual(expect.arrayContaining([
+                _controllers.RoleController,
+                _controllers.UserActionPermissionController,
+                _controllers.RolePermissionController
+            ]));
+        });
+        it('adds CompanyActionPermissionController only when enableCompanyFeature is true', ()=>{
+            const withCompany = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const withoutCompany = _iammodule.IAMModule.forRoot({
+                includeController: true,
+                bootstrapAppConfig: {
+                    enableCompanyFeature: false
+                }
+            });
+            expect(withCompany.controllers).toContain(_controllers.CompanyActionPermissionController);
+            expect(withoutCompany.controllers).not.toContain(_controllers.CompanyActionPermissionController);
+        });
+        it('excludes RoleService for DIRECT mode but includes it for RBAC/FULL', ()=>{
+            const direct = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            const rbac = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            });
+            const full = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    permissionMode: 'FULL'
+                }
+            });
+            expect(providerTokens(direct.providers)).not.toContain(_services.RoleService);
+            expect(providerTokens(rbac.providers)).toContain(_services.RoleService);
+            expect(providerTokens(full.providers)).toContain(_services.RoleService);
+            expect(providerTokens(direct.exports)).not.toContain(_services.RoleService);
+            expect(providerTokens(rbac.exports)).toContain(_services.RoleService);
+        });
+        it('always registers the base providers/exports (ActionService, PermissionService, PermissionCacheService)', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(providerTokens(dynamicModule.providers)).toEqual(expect.arrayContaining([
+                _iamconfigservice.IAMConfigService,
+                _iamdatasourceservice.IAMDataSourceService,
+                _services.ActionService,
+                _services.PermissionService,
+                _permissioncacheservice.PermissionCacheService
+            ]));
+            expect(dynamicModule.exports).toEqual(expect.arrayContaining([
+                _iamconfigservice.IAMConfigService,
+                _iamdatasourceservice.IAMDataSourceService,
+                _services.ActionService,
+                _services.PermissionService,
+                _permissioncacheservice.PermissionCacheService,
+                _nestjsshared.PERMISSION_GUARD_CONFIG
+            ]));
+        });
+    });
+    describe('forRoot - options/global handling', ()=>{
+        it('should not set `global` on the returned module when global is false/omitted', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot();
+            expect(dynamicModule.global).toBeUndefined();
+        });
+        it('should set global: true when requested', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                global: true
+            });
+            expect(dynamicModule.global).toBe(true);
+        });
+        it('should register IAM_MODULE_OPTIONS with the given options', ()=>{
+            const options = {
+                includeController: true
+            };
+            const dynamicModule = _iammodule.IAMModule.forRoot(options);
+            const provider = dynamicModule.providers.find((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(provider.useValue).toBe(options);
+        });
+        it('should build a company-aware PERMISSION_GUARD_CONFIG provider', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRoot({
+                bootstrapAppConfig: {
+                    enableCompanyFeature: true
+                }
+            });
+            const provider = dynamicModule.providers.find((p)=>p.provide === _nestjsshared.PERMISSION_GUARD_CONFIG);
+            expect(provider.useValue.enableCompanyFeature).toBe(true);
+            expect(provider.useValue.userPermissionKeyFormat).toContain('{userId}');
+            expect(provider.useValue.companyPermissionKeyFormat).toContain('{companyId}');
+        });
+    });
+    describe('forRootAsync', ()=>{
+        it('mirrors the controller/service registration matrix of forRoot', ()=>{
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'DIRECT'
+                }
+            });
+            expect(dynamicModule.controllers).toEqual([
+                _controllers.ActionController,
+                _controllers.MyPermissionController,
+                _controllers.UserActionPermissionController
+            ]);
+        });
+        it('should forward external imports alongside CacheModule/UtilsModule', ()=>{
+            let FakeImportedModule = class FakeImportedModule {
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                imports: [
+                    FakeImportedModule
+                ]
+            });
+            expect(dynamicModule.imports).toEqual(expect.arrayContaining([
+                FakeImportedModule
+            ]));
+        });
+        it('useFactory: registers a single options provider using the given inject tokens', async ()=>{
+            const useFactory = jest.fn().mockResolvedValue({
+                foo: 'bar'
+            });
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useFactory,
+                inject: [
+                    'SOME_TOKEN'
+                ]
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.useFactory).toBe(useFactory);
+            expect(provider.inject).toEqual([
+                'SOME_TOKEN'
+            ]);
+        });
+        it('useClass: registers both the class provider and an options provider that calls createIAMOptions()', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-class'
+                    }));
+                }
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useClass: MyOptionsFactory
+            });
+            const classProvider = dynamicModule.providers.find((p)=>p.provide === MyOptionsFactory);
+            expect(classProvider.useClass).toBe(MyOptionsFactory);
+            const optionsProvider = dynamicModule.providers.find((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProvider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await optionsProvider.useFactory(instance);
+            expect(instance.createIAMOptions).toHaveBeenCalled();
+            expect(resolved).toEqual({
+                foo: 'from-class'
+            });
+        });
+        it('useExisting: registers a single options provider injecting the existing factory', async ()=>{
+            let MyOptionsFactory = class MyOptionsFactory {
+                constructor(){
+                    _define_property(this, "createIAMOptions", jest.fn().mockResolvedValue({
+                        foo: 'from-existing'
+                    }));
+                }
+            };
+            const dynamicModule = _iammodule.IAMModule.forRootAsync({
+                useExisting: MyOptionsFactory
+            });
+            const optionsProviders = dynamicModule.providers.filter((p)=>p.provide === _iamconstants.IAM_MODULE_OPTIONS);
+            expect(optionsProviders).toHaveLength(1);
+            const provider = optionsProviders[0];
+            expect(provider.inject).toEqual([
+                MyOptionsFactory
+            ]);
+            const instance = new MyOptionsFactory();
+            const resolved = await provider.useFactory(instance);
+            expect(resolved).toEqual({
+                foo: 'from-existing'
+            });
+        });
+    });
+    describe('forFeature', ()=>{
+        it('should behave identically to forRoot', ()=>{
+            const options = {
+                includeController: true,
+                bootstrapAppConfig: {
+                    permissionMode: 'RBAC'
+                }
+            };
+            expect(_iammodule.IAMModule.forFeature(options)).toEqual(_iammodule.IAMModule.forRoot(options));
+        });
+    });
+});

package/cjs/services/action.service.js

@@ -85,7 +85,7 @@ let ActionService = class ActionService extends _classes.ApiService {
                 }
             }) : Promise.resolve([])
         ]);
-        const affectedUserIds = new Set(userActionRows.map((row)=>row.userId).filter((id)=>!!id));
+        const affectedUserIds = new Set(userActionRows.map((row)=>row.sourceId));
         const affectedCompanyIds = [
             ...new Set(companyActionRows.map((row)=>row.sourceId).filter((id)=>!!id))
         ];
@@ -100,7 +100,7 @@ let ActionService = class ActionService extends _classes.ApiService {
                     targetId: (0, _typeorm.In)(affectedRoleIds)
                 }
             });
-            userRoleRows.forEach((row)=>row.userId && affectedUserIds.add(row.userId));
+            userRoleRows.forEach((row)=>affectedUserIds.add(row.sourceId));
         }
         await permissionRepo.delete({
             permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
@@ -122,7 +122,7 @@ let ActionService = class ActionService extends _classes.ApiService {
             affectedUserIds.size > 0 ? this.permissionCacheService.invalidateUsers([
                 ...affectedUserIds
             ]) : Promise.resolve(),
-            ...affectedCompanyIds.map((companyId)=>this.permissionService.invalidateCompanyMembersCache(companyId))
+            ...affectedCompanyIds.map((companyId)=>this.permissionCacheService.invalidateCompanyMembersCache(companyId))
         ]);
     }
     // Query Customization
@@ -194,7 +194,7 @@ let ActionService = class ActionService extends _classes.ApiService {
         let whereClause = {};
         const targetCompanyId = companyId || user.companyId;
         if (this.iamConfigService.isCompanyFeatureEnabled() && targetCompanyId) {
-            const companyActionIds = await this.permissionService.getCompanyActionIds(targetCompanyId);
+            const companyActionIds = await this.permissionService.getCompanyActions(targetCompanyId, true);
             if (companyActionIds.length === 0) {
                 return [];
             }