@flusys/nestjs-iam 6.1.0 → 6.1.2

package/fesm/services/permission.service.spec.js

@@ -21,7 +21,6 @@ function buildPermissionRow(overrides = {}) {
         sourceId: 'user-1',
         targetType: IamEntityType.ACTION,
         targetId: 'action-1',
-        userId: 'user-1',
         companyId: null,
         branchId: null,
         validFrom: null,
@@ -95,8 +94,9 @@ describe('PermissionService', ()=>{
         mockPermissionCacheService = {
             invalidateUser: jest.fn(),
             invalidateUsers: jest.fn(),
-            getMyPermissions: jest.fn(),
-            setMyPermissions: jest.fn()
+            invalidateRoleMembersCache: jest.fn(),
+            invalidateCompanyMembersCache: jest.fn(),
+            getMyPermissionsResponse: jest.fn()
         };
         const module = await Test.createTestingModule({
             providers: [
@@ -168,9 +168,7 @@ describe('PermissionService', ()=>{
                 removed: 1,
                 total: 3
             });
-            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', null, [
-                null
-            ]);
+            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', null, []);
         });
         it('scopes new permissions and cache invalidation to the company/branch when the company feature is enabled', async ()=>{
             mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
@@ -241,7 +239,7 @@ describe('PermissionService', ()=>{
     describe('getUserActions', ()=>{
         it('returns an empty array without querying actions when the user has no permissions', async ()=>{
             mockPermissionRepo.find.mockResolvedValue([]);
-            const result = await service.getUserActions('user-1', undefined);
+            const result = await service.getUserActions('user-1', undefined, undefined);
             expect(result).toEqual([]);
             expect(mockActionRepo.find).not.toHaveBeenCalled();
         });
@@ -260,7 +258,7 @@ describe('PermissionService', ()=>{
                     id: 'action-1'
                 })
             ]);
-            const result = await service.getUserActions('user-1', undefined);
+            const result = await service.getUserActions('user-1', undefined, undefined);
             expect(result).toHaveLength(1);
             expect(result[0]).toEqual(expect.objectContaining({
                 actionId: 'action-1',
@@ -270,7 +268,7 @@ describe('PermissionService', ()=>{
         it('filters by companyId/branchId when the company feature is enabled', async ()=>{
             mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
             mockPermissionRepo.find.mockResolvedValue([]);
-            await service.getUserActions('user-1', 'branch-1', 'company-1');
+            await service.getUserActions('user-1', 'company-1', 'branch-1');
             expect(mockPermissionRepo.find).toHaveBeenCalledWith({
                 where: expect.objectContaining({
                     companyId: 'company-1',
@@ -332,31 +330,18 @@ describe('PermissionService', ()=>{
             });
         });
         it('removes role actions and reports counts and invalidates role member caches', async ()=>{
-            mockPermissionRepo.find.mockResolvedValueOnce([]) // existing check for add
-            .mockResolvedValueOnce([
-                buildPermissionRow({
-                    sourceId: 'user-9'
-                })
-            ]); // invalidateRoleMembersCache lookup (sourceId = the user who holds the role)
+            mockPermissionRepo.find.mockResolvedValue([]); // existing check for add
             mockPermissionRepo.save.mockResolvedValue([
                 {}
             ]);
             mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
-            mockRoleRepo.findOne.mockResolvedValue({
-                id: 'role-1',
-                companyId: null
-            });
             const result = await service.assignRoleActions(dto);
             expect(result).toEqual({
                 added: 1,
                 removed: 1,
                 total: 2
             });
-            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
-                'user-9'
-            ], null, [
-                null
-            ]);
+            expect(mockPermissionCacheService.invalidateRoleMembersCache).toHaveBeenCalledWith('role-1');
         });
     });
     describe('getRoleActions', ()=>{
@@ -395,7 +380,9 @@ describe('PermissionService', ()=>{
                     return mockPermissionRepo;
                 })
             };
-            mockPermissionRepo.manager.connection.transaction = jest.fn().mockImplementation((cb)=>cb(fakeManager));
+            mockDataSourceProvider.getDataSource.mockResolvedValue({
+                transaction: jest.fn().mockImplementation((cb)=>cb(fakeManager))
+            });
             return fakeManager;
         }
         it('adds new company-whitelisted actions inside a transaction, skipping duplicates', async ()=>{
@@ -429,7 +416,7 @@ describe('PermissionService', ()=>{
                 })
             ]);
             expect(result.added).toBe(1);
-            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled(); // no company feature -> invalidateCompanyMembersCache no-ops
+            expect(mockPermissionCacheService.invalidateCompanyMembersCache).toHaveBeenCalledWith('company-1');
         });
         it('cascades removal to role-action and user-action permissions for the company', async ()=>{
             mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
@@ -497,7 +484,7 @@ describe('PermissionService', ()=>{
                     targetId: 'action-2'
                 }
             ]);
-            const result = await service.getCompanyActionIds('company-1');
+            const result = await service.getCompanyActions('company-1', true);
             expect(result).toEqual([
                 'action-1',
                 'action-2'
@@ -584,287 +571,26 @@ describe('PermissionService', ()=>{
     });
     // ==================== My Permissions / permission-mode branching ====================
     describe('getMyPermissions', ()=>{
-        it('returns the response built directly from cached data on a cache hit', async ()=>{
-            mockPermissionCacheService.getMyPermissions.mockResolvedValue({
+        it('delegates to the cache service and returns its response', async ()=>{
+            const response = {
                 frontendActions: [
                     {
                         id: 'action-1',
                         code: 'user.view',
                         name: 'View',
-                        description: null,
-                        parentId: null
-                    }
-                ],
-                backendCodes: [
-                    'user.read'
-                ]
-            });
-            const result = await service.getMyPermissions('user-1', null, 'company-1');
-            expect(result.frontendActions).toHaveLength(1);
-            expect(result.cachedEndpoints).toBe(1);
-            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
-        });
-        it('fetches from the database and caches the result on a cache miss', async ()=>{
-            mockPermissionCacheService.getMyPermissions.mockResolvedValue(null);
-            mockPermissionRepo.find.mockResolvedValue([]);
-            const result = await service.getMyPermissions('user-1', null, null);
-            expect(result).toEqual({
-                frontendActions: [],
-                cachedEndpoints: 0
-            });
-            expect(mockPermissionCacheService.setMyPermissions).toHaveBeenCalled();
-        });
-        it('filters frontend actions by parentCodes when provided', async ()=>{
-            mockPermissionCacheService.getMyPermissions.mockResolvedValue({
-                frontendActions: [
-                    {
-                        id: 'child-1',
-                        code: 'user.view',
-                        name: 'View',
-                        description: null,
-                        parentId: 'parent-1'
-                    },
-                    {
-                        id: 'child-2',
-                        code: 'other.view',
-                        name: 'View 2',
-                        description: null,
-                        parentId: 'other-parent'
+                        description: null
                     }
                 ],
-                backendCodes: []
-            });
-            mockActionRepo.find.mockResolvedValue([
-                {
-                    id: 'parent-1',
-                    code: 'user'
-                }
-            ]);
-            const result = await service.getMyPermissions('user-1', null, null, [
-                'user'
-            ]);
-            expect(result.frontendActions).toHaveLength(1);
-            expect(result.frontendActions[0].id).toBe('child-1');
-        });
-        it('returns an empty frontendActions list when parentCodes resolve to no known parents', async ()=>{
-            mockPermissionCacheService.getMyPermissions.mockResolvedValue({
-                frontendActions: [
-                    {
-                        id: 'child-1',
-                        code: 'user.view',
-                        name: 'View',
-                        description: null,
-                        parentId: 'parent-1'
-                    }
-                ],
-                backendCodes: []
-            });
-            mockActionRepo.find.mockResolvedValue([]);
-            const result = await service.getMyPermissions('user-1', null, null, [
-                'unknown-parent-code'
-            ]);
-            expect(result.frontendActions).toEqual([]);
-        });
-    });
-    describe('collectAllActionIds (permission-mode branching)', ()=>{
-        it('RBAC mode: collects only role-derived action ids, ignoring direct user actions', async ()=>{
-            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.RBAC);
-            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
-                if (where.permissionType === IamPermissionType.USER_ROLE) {
-                    return [
-                        buildPermissionRow({
-                            permissionType: IamPermissionType.USER_ROLE,
-                            targetId: 'role-1'
-                        })
-                    ];
-                }
-                if (where.permissionType === IamPermissionType.ROLE_ACTION) {
-                    return [
-                        buildPermissionRow({
-                            permissionType: IamPermissionType.ROLE_ACTION,
-                            targetId: 'action-role-1'
-                        })
-                    ];
-                }
-                if (where.permissionType === IamPermissionType.USER_ACTION) {
-                    throw new Error('DIRECT lookup should not run in RBAC mode');
-                }
-                return [];
-            });
-            const result = await service.collectAllActionIds('user-1', null, null);
-            expect(Array.from(result)).toEqual([
-                'action-role-1'
-            ]);
-        });
-        it('DIRECT mode: collects only directly-assigned user action ids, ignoring roles', async ()=>{
-            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.DIRECT);
-            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
-                if (where.permissionType === IamPermissionType.USER_ROLE) {
-                    throw new Error('RBAC lookup should not run in DIRECT mode');
-                }
-                if (where.permissionType === IamPermissionType.USER_ACTION) {
-                    return [
-                        buildPermissionRow({
-                            permissionType: IamPermissionType.USER_ACTION,
-                            targetId: 'action-direct-1'
-                        })
-                    ];
-                }
-                return [];
-            });
-            const result = await service.collectAllActionIds('user-1', null, null);
-            expect(Array.from(result)).toEqual([
-                'action-direct-1'
-            ]);
-        });
-        it('FULL mode: merges role-derived and direct action ids, de-duplicating overlaps', async ()=>{
-            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.FULL);
-            mockPermissionRepo.find.mockImplementation(async ({ where })=>{
-                if (where.permissionType === IamPermissionType.USER_ROLE) {
-                    return [
-                        buildPermissionRow({
-                            permissionType: IamPermissionType.USER_ROLE,
-                            targetId: 'role-1'
-                        })
-                    ];
-                }
-                if (where.permissionType === IamPermissionType.ROLE_ACTION) {
-                    return [
-                        buildPermissionRow({
-                            permissionType: IamPermissionType.ROLE_ACTION,
-                            targetId: 'action-shared'
-                        })
-                    ];
-                }
-                if (where.permissionType === IamPermissionType.USER_ACTION) {
-                    return [
-                        buildPermissionRow({
-                            permissionType: IamPermissionType.USER_ACTION,
-                            targetId: 'action-shared'
-                        }),
-                        buildPermissionRow({
-                            permissionType: IamPermissionType.USER_ACTION,
-                            targetId: 'action-direct-only'
-                        })
-                    ];
-                }
-                return [];
-            });
-            const result = await service.collectAllActionIds('user-1', null, null);
-            expect(Array.from(result).sort()).toEqual([
-                'action-direct-only',
-                'action-shared'
-            ]);
-        });
-        it('excludes expired/not-yet-valid permission rows via isValid()', async ()=>{
-            mockIamConfigService.getPermissionMode.mockReturnValue(IAMPermissionMode.DIRECT);
-            const expired = buildPermissionRow({
-                permissionType: IamPermissionType.USER_ACTION,
-                targetId: 'action-expired',
-                validUntil: new Date('2000-01-01')
-            });
-            const active = buildPermissionRow({
-                permissionType: IamPermissionType.USER_ACTION,
-                targetId: 'action-active'
-            });
-            mockPermissionRepo.find.mockResolvedValue([
-                expired,
-                active
-            ]);
-            const result = await service.collectAllActionIds('user-1', null, null);
-            expect(Array.from(result)).toEqual([
-                'action-active'
-            ]);
-        });
-    });
-    describe('applyCompanyWhitelist', ()=>{
-        it('is a no-op when the company feature is disabled', async ()=>{
-            const actionIds = new Set([
-                'action-1',
-                'action-2'
-            ]);
-            await service.applyCompanyWhitelist(actionIds, 'company-1');
-            expect(actionIds).toEqual(new Set([
-                'action-1',
-                'action-2'
-            ]));
-            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
-        });
-        it('is a no-op when companyId is missing even if the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            const actionIds = new Set([
-                'action-1'
-            ]);
-            await service.applyCompanyWhitelist(actionIds, null);
-            expect(actionIds).toEqual(new Set([
-                'action-1'
-            ]));
-        });
-        it('does not filter anything when the company has an empty whitelist', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionRepo.find.mockResolvedValue([]);
-            const actionIds = new Set([
-                'action-1',
-                'action-2'
-            ]);
-            await service.applyCompanyWhitelist(actionIds, 'company-1');
-            expect(actionIds).toEqual(new Set([
-                'action-1',
-                'action-2'
-            ]));
-        });
-        it('removes action ids that are not present in the company whitelist', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionRepo.find.mockResolvedValue([
-                {
-                    targetId: 'action-1'
-                }
-            ]);
-            const actionIds = new Set([
-                'action-1',
-                'action-2'
-            ]);
-            await service.applyCompanyWhitelist(actionIds, 'company-1');
-            expect(actionIds).toEqual(new Set([
-                'action-1'
-            ]));
-        });
-    });
-    // ==================== Cache invalidation helpers ====================
-    describe('invalidateCompanyMembersCache', ()=>{
-        it('returns 0 without querying when the company feature is disabled', async ()=>{
-            const result = await service.invalidateCompanyMembersCache('company-1');
-            expect(result).toBe(0);
-            expect(mockPermissionRepo.createQueryBuilder).not.toHaveBeenCalled();
-        });
-        it('returns 0 when the company has no members with permissions', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockRawMany(mockPermissionRepo, []);
-            const result = await service.invalidateCompanyMembersCache('company-1');
-            expect(result).toBe(0);
-        });
-        it('invalidates every distinct member user id for the company', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockRawMany(mockPermissionRepo, [
-                {
-                    userId: 'user-1',
-                    branchId: 'branch-1'
-                },
-                {
-                    userId: 'user-2',
-                    branchId: null
-                }
+                cachedEndpoints: 1
+            };
+            mockPermissionCacheService.getMyPermissionsResponse.mockResolvedValue(response);
+            const result = await service.getMyPermissions('user-1', null, 'company-1', [
+                'parent-code'
             ]);
-            mockPermissionCacheService.invalidateUsers.mockResolvedValue(2);
-            const result = await service.invalidateCompanyMembersCache('company-1');
-            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
-                'user-1',
-                'user-2'
-            ], 'company-1', [
-                'branch-1',
-                null
+            expect(mockPermissionCacheService.getMyPermissionsResponse).toHaveBeenCalledWith('user-1', null, 'company-1', [
+                'parent-code'
             ]);
-            expect(result).toBe(2);
+            expect(result).toBe(response);
         });
     });
     describe('revokeCompanyPermissions', ()=>{
@@ -882,10 +608,7 @@ describe('PermissionService', ()=>{
             ]);
             mockPermissionRepo.find.mockResolvedValue([
                 {
-                    userId: 'user-1'
-                },
-                {
-                    userId: null
+                    sourceId: 'user-1'
                 }
             ]);
             const fakeTxRepo = {
@@ -894,12 +617,14 @@ describe('PermissionService', ()=>{
             const fakeTxRoleRepo = {
                 delete: jest.fn().mockResolvedValue(buildDeleteResult(1))
             };
-            mockPermissionRepo.manager.connection.transaction = jest.fn().mockImplementation((cb)=>cb({
-                    getRepository: jest.fn((target)=>{
-                        if (target === mockRoleRepo.target) return fakeTxRoleRepo;
-                        return fakeTxRepo;
-                    })
-                }));
+            mockDataSourceProvider.getDataSource.mockResolvedValue({
+                transaction: jest.fn().mockImplementation((cb)=>cb({
+                        getRepository: jest.fn((target)=>{
+                            if (target === mockRoleRepo.target) return fakeTxRoleRepo;
+                            return fakeTxRepo;
+                        })
+                    }))
+            });
             await service.revokeCompanyPermissions('company-1');
             expect(fakeTxRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
                 permissionType: IamPermissionType.COMPANY_ACTION
@@ -921,7 +646,7 @@ describe('PermissionService', ()=>{
             mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
             mockPermissionRepo.find.mockResolvedValue([
                 {
-                    userId: 'user-1'
+                    sourceId: 'user-1'
                 }
             ]);
             mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));

package/fesm/services/role.service.js

@@ -60,7 +60,7 @@ export class RoleService extends ApiService {
             }
         });
         const affectedUserIds = [
-            ...new Set(userRoleRows.map((row)=>row.userId).filter((id)=>!!id))
+            ...new Set(userRoleRows.map((row)=>row.sourceId))
         ];
         await permissionRepo.delete({
             permissionType: IamPermissionType.ROLE_ACTION,

package/fesm/services/role.service.spec.js

@@ -243,13 +243,10 @@ describe('RoleService', ()=>{
             const permissionRepo = createMockRepository();
             permissionRepo.find.mockResolvedValue([
                 {
-                    userId: 'user-1'
+                    sourceId: 'user-1'
                 },
                 {
-                    userId: 'user-2'
-                },
-                {
-                    userId: null
+                    sourceId: 'user-2'
                 }
             ]);
             const queryRunner = buildQueryRunner(permissionRepo);
@@ -286,10 +283,10 @@ describe('RoleService', ()=>{
             const permissionRepo = createMockRepository();
             permissionRepo.find.mockResolvedValue([
                 {
-                    userId: 'user-1'
+                    sourceId: 'user-1'
                 },
                 {
-                    userId: 'user-1'
+                    sourceId: 'user-1'
                 }
             ]);
             const queryRunner = buildQueryRunner(permissionRepo);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-iam",
-  "version": "6.1.0",
+  "version": "6.1.2",
   "description": "Identity and Access Management (IAM) module for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -90,7 +90,7 @@
     "express": "^5.0.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.1.0",
-    "@flusys/nestjs-shared": "6.1.0"
+    "@flusys/nestjs-core": "6.1.2",
+    "@flusys/nestjs-shared": "6.1.2"
   }
 }

package/services/permission-cache.service.d.ts

@@ -1,4 +1,7 @@
 import { HybridCache, PermissionCacheKeyOptions, PermissionGuardConfig } from '@flusys/nestjs-shared';
+import { MyPermissionsResponseDto } from '../dtos/permission.dto';
+import { IAMConfigService } from './iam-config.service';
+import { IAMDataSourceService } from './iam-datasource.service';
 export { PermissionCacheKeyOptions } from '@flusys/nestjs-shared';
 export interface CachedMyPermissions {
     frontendActions: Array<{
@@ -10,14 +13,18 @@ export interface CachedMyPermissions {
     }>;
     backendCodes: string[];
 }
-export declare const MY_PERMISSIONS_CACHE_PREFIX = "my-permissions";
 export declare class PermissionCacheService {
     private readonly cacheManager;
+    private readonly iamConfigService;
+    private readonly dataSourceProvider;
     private readonly guardConfig?;
     private readonly TRACKED_KEYS_PREFIX;
     private readonly TRACKED_SCOPES_PREFIX;
     private readonly TTL;
-    constructor(cacheManager: HybridCache, guardConfig?: PermissionGuardConfig | undefined);
+    constructor(cacheManager: HybridCache, iamConfigService: IAMConfigService, dataSourceProvider: IAMDataSourceService, guardConfig?: PermissionGuardConfig | undefined);
+    private getPermissionRepository;
+    private getActionRepository;
+    private getRoleRepository;
     private parseDurationMs;
     private buildCacheKey;
     private scopeToken;
@@ -26,7 +33,17 @@ export declare class PermissionCacheService {
     setMyPermissions(options: PermissionCacheKeyOptions, data: CachedMyPermissions): Promise<void>;
     getMyPermissions(options: PermissionCacheKeyOptions): Promise<CachedMyPermissions | null>;
     private trackKey;
+    getMyPermissionsResponse(userId: string, branchId: string | null, companyId?: string | null, parentCodes?: string[]): Promise<MyPermissionsResponseDto>;
+    private buildResponseFromCache;
+    private getParentIdsByCodesWithCache;
+    private fetchAndCachePermissions;
+    private collectAllActionIds;
+    private buildAndCachePermissionData;
+    private getUserRoleIds;
+    private getRoleActionIds;
+    private getUserActionIds;
     invalidateUser(userId: string, companyId?: string | null, branchIds?: (string | null)[]): Promise<void>;
-    private invalidateScope;
     invalidateUsers(userIds: string[], companyId?: string | null, branchIds?: (string | null)[]): Promise<number>;
+    invalidateRoleMembersCache(roleId: string): Promise<number>;
+    invalidateCompanyMembersCache(companyId: string): Promise<number>;
 }

package/services/permission.service.d.ts

@@ -12,30 +12,16 @@ export declare class PermissionService {
     private getRoleRepository;
     private getActionsMap;
     assignUserActions(dto: AssignUserActionsDto): Promise<PermissionOperationResultDto>;
-    getUserActions(userId: string, branchId: string | undefined, companyId?: string | undefined): Promise<UserActionResponseDto[]>;
+    getUserActions(userId: string, companyId: string | undefined, branchId: string | undefined): Promise<UserActionResponseDto[]>;
     assignRoleActions(dto: AssignRoleActionsDto): Promise<PermissionOperationResultDto>;
     getRoleActions(roleId: string): Promise<RoleActionResponseDto[]>;
     assignCompanyActions(dto: AssignCompanyActionsDto): Promise<PermissionOperationResultDto>;
-    private addCompanyActions;
-    private removeCompanyActionsWithCascade;
-    getCompanyActions(companyId: string): Promise<CompanyActionResponseDto[]>;
-    getCompanyActionIds(companyId: string): Promise<string[]>;
+    getCompanyActions(companyId: string, isOnlyId?: boolean): Promise<CompanyActionResponseDto[] | string[]>;
     assignUserRoles(dto: AssignUserRolesDto): Promise<PermissionOperationResultDto>;
     getUserRoles(userId: string, branchId?: string | undefined, companyId?: string | undefined): Promise<UserRoleResponseDto[]>;
     getMyPermissions(userId: string, branchId: string | null, companyId?: string | null, parentCodes?: string[]): Promise<MyPermissionsResponseDto>;
-    private buildResponseFromCache;
-    private getParentIdsByCodesWithCache;
-    private fetchAndCachePermissions;
-    private collectAllActionIds;
-    private applyCompanyWhitelist;
-    private buildAndCachePermissionData;
     private splitItemsByAction;
     private buildOperationResult;
-    private getUserRoleIds;
-    private getRoleActionIds;
-    private getUserActionIds;
-    private invalidateRoleMembersCache;
-    invalidateCompanyMembersCache(companyId: string): Promise<number>;
     revokeCompanyPermissions(companyId: string): Promise<void>;
     revokeBranchPermissions(branchId: string, companyId: string): Promise<void>;
     revokeUserCompanyAccess(userId: string, companyId: string): Promise<void>;