@flusys/nestjs-iam 6.2.0 → 6.2.2

package/cjs/dtos/permission.dto.js

@@ -544,18 +544,11 @@ _ts_decorate([
 ], UserRoleResponseDto.prototype, "createdAt", void 0);
 let FrontendActionDto = class FrontendActionDto {
     constructor(){
-        _define_property(this, "id", void 0);
         _define_property(this, "code", void 0);
         _define_property(this, "name", void 0);
         _define_property(this, "description", void 0);
     }
 };
-_ts_decorate([
-    (0, _swagger.ApiProperty)({
-        description: 'Action ID'
-    }),
-    _ts_metadata("design:type", String)
-], FrontendActionDto.prototype, "id", void 0);
 _ts_decorate([
     (0, _swagger.ApiProperty)({
         description: 'Action code'

package/cjs/services/permission-cache.service.js

@@ -166,7 +166,6 @@ let PermissionCacheService = class PermissionCacheService {
         }
         return {
             frontendActions: frontendActions.map((a)=>({
-                    id: a.id,
                     code: a.code,
                     name: a.name,
                     description: a.description
@@ -392,7 +391,8 @@ let PermissionCacheService = class PermissionCacheService {
             } catch  {
                 trackedKeys = [];
             }
-            if (!branchIds?.length) {
+            const hasCompanyWideScope = branchIds?.some((branchId)=>!branchId);
+            if (!branchIds?.length || hasCompanyWideScope) {
                 trackedKeys.forEach((key)=>keysToDelete.add(key));
                 keysToDelete.add(trackedKeysKey);
                 await untrackScope(trackedKeysKey);

package/cjs/services/permission-cache.service.spec.js

@@ -211,8 +211,6 @@ describe('PermissionCacheService', ()=>{
             expect(mockCacheManager.del).not.toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes'));
         });
         it('invalidates only the requested branch keys, keeping remaining branches tracked', async ()=>{
-            // company-scoped key format only differentiates by branchId when the guard config
-            // enables the company feature — otherwise every branch maps to the same cache key.
             const guardConfig = {
                 enableCompanyFeature: true
             };
@@ -229,18 +227,15 @@ describe('PermissionCacheService', ()=>{
                 ];
                 return undefined;
             });
-            // companyId given directly invokes invalidateScope (bypasses the tracked-scopes fan-out)
             await service.invalidateUser('user-1', 'company-1', [
                 'branch-a'
             ]);
-            // the specific branch key gets deleted
             const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
             expect(deletedKeys).toContain((0, _nestjsshared.buildPermissionCacheKey)({
                 userId: 'user-1',
                 companyId: 'company-1',
                 branchId: 'branch-a'
             }, guardConfig));
-            // remaining tracked keys get re-saved rather than the tracked-keys index being wiped
             expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys'), expect.arrayContaining([
                 keptKey,
                 'some-other-tracked-key'
@@ -269,6 +264,37 @@ describe('PermissionCacheService', ()=>{
             expect(deletedKeys).toContain(onlyKey);
             expect(deletedKeys.some((k)=>String(k).includes('permission-tracked-keys'))).toBe(true);
         });
+        it('wipes every tracked branch key when a null branchId (company-wide grant) is in the scope list', async ()=>{
+            const guardConfig = {
+                enableCompanyFeature: true
+            };
+            const service = buildService(guardConfig);
+            const branchAKey = (0, _nestjsshared.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-a'
+            }, guardConfig);
+            const branchBKey = (0, _nestjsshared.buildPermissionCacheKey)({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-b'
+            }, guardConfig);
+            const trackedKeysKey = 'permission-tracked-keys:user:user-1:company:company-1';
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    branchAKey,
+                    branchBKey
+                ];
+                return undefined;
+            });
+            await service.invalidateUser('user-1', 'company-1', [
+                null
+            ]);
+            const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
+            expect(deletedKeys).toContain(branchAKey);
+            expect(deletedKeys).toContain(branchBKey);
+            expect(deletedKeys.some((k)=>String(k).includes(trackedKeysKey))).toBe(true);
+        });
         it('without a companyId, invalidates every tracked scope for the user and clears the scopes index', async ()=>{
             const service = buildService();
             // scopes list mixes a nested tracked-keys index (company scope) with a raw cache key (untracked scope)
@@ -400,7 +426,7 @@ describe('PermissionCacheService', ()=>{
                 'user'
             ]);
             expect(result.frontendActions).toHaveLength(1);
-            expect(result.frontendActions[0].id).toBe('child-1');
+            expect(result.frontendActions[0].code).toBe('user.view');
         });
         it('returns an empty frontendActions list when parentCodes resolve to no known parents', async ()=>{
             const service = buildService();
@@ -563,7 +589,6 @@ describe('PermissionCacheService', ()=>{
             expect(result.cachedEndpoints).toBe(1);
             expect(result.frontendActions).toEqual([
                 {
-                    id: 'action-1',
                     code: 'user.view',
                     name: 'View Users',
                     description: null
@@ -606,9 +631,6 @@ describe('PermissionCacheService', ()=>{
             expect(result).toBe(2);
         });
         it('wipes every tracked cache entry per member instead of only branches with an existing permission row', async ()=>{
-            // Company-wide action changes are merged into every branch a member queries, including
-            // branches where the member holds no explicit permission row — so invalidation must not
-            // be narrowed to whatever branch_ids happen to already exist in the permission table.
             const service = buildService();
             mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
             mockRawMany(mockPermissionRepo, [
@@ -665,9 +687,6 @@ describe('PermissionCacheService', ()=>{
             expect(result).toBe(1);
         });
         it('wipes every tracked cache entry for role members instead of only branches with an existing permission row', async ()=>{
-            // Role actions are merged into every branch a member queries, including branches
-            // where the member holds no explicit permission row — so invalidation must not be
-            // narrowed to whatever branch_ids happen to already exist in the permission table.
             const service = buildService();
             mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
             mockPermissionRepo.find.mockResolvedValue([

package/cjs/services/permission.service.spec.js

@@ -579,7 +579,6 @@ describe('PermissionService', ()=>{
             const response = {
                 frontendActions: [
                     {
-                        id: 'action-1',
                         code: 'user.view',
                         name: 'View',
                         description: null

package/dtos/permission.dto.d.ts

@@ -77,7 +77,6 @@ export declare class UserRoleResponseDto {
     createdAt: Date;
 }
 export declare class FrontendActionDto {
-    id: string;
     code: string;
     name: string;
     description: string | null;

package/fesm/dtos/permission.dto.js

@@ -478,18 +478,11 @@ _ts_decorate([
 ], UserRoleResponseDto.prototype, "createdAt", void 0);
 export class FrontendActionDto {
     constructor(){
-        _define_property(this, "id", void 0);
         _define_property(this, "code", void 0);
         _define_property(this, "name", void 0);
         _define_property(this, "description", void 0);
     }
 }
-_ts_decorate([
-    ApiProperty({
-        description: 'Action ID'
-    }),
-    _ts_metadata("design:type", String)
-], FrontendActionDto.prototype, "id", void 0);
 _ts_decorate([
     ApiProperty({
         description: 'Action code'

package/fesm/services/permission-cache.service.js

@@ -149,7 +149,6 @@ export class PermissionCacheService {
         }
         return {
             frontendActions: frontendActions.map((a)=>({
-                    id: a.id,
                     code: a.code,
                     name: a.name,
                     description: a.description
@@ -375,7 +374,8 @@ export class PermissionCacheService {
             } catch  {
                 trackedKeys = [];
             }
-            if (!branchIds?.length) {
+            const hasCompanyWideScope = branchIds?.some((branchId)=>!branchId);
+            if (!branchIds?.length || hasCompanyWideScope) {
                 trackedKeys.forEach((key)=>keysToDelete.add(key));
                 keysToDelete.add(trackedKeysKey);
                 await untrackScope(trackedKeysKey);

package/fesm/services/permission-cache.service.spec.js

@@ -207,8 +207,6 @@ describe('PermissionCacheService', ()=>{
             expect(mockCacheManager.del).not.toHaveBeenCalledWith(expect.stringContaining('permission-tracked-scopes'));
         });
         it('invalidates only the requested branch keys, keeping remaining branches tracked', async ()=>{
-            // company-scoped key format only differentiates by branchId when the guard config
-            // enables the company feature — otherwise every branch maps to the same cache key.
             const guardConfig = {
                 enableCompanyFeature: true
             };
@@ -225,18 +223,15 @@ describe('PermissionCacheService', ()=>{
                 ];
                 return undefined;
             });
-            // companyId given directly invokes invalidateScope (bypasses the tracked-scopes fan-out)
             await service.invalidateUser('user-1', 'company-1', [
                 'branch-a'
             ]);
-            // the specific branch key gets deleted
             const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
             expect(deletedKeys).toContain(buildPermissionCacheKey({
                 userId: 'user-1',
                 companyId: 'company-1',
                 branchId: 'branch-a'
             }, guardConfig));
-            // remaining tracked keys get re-saved rather than the tracked-keys index being wiped
             expect(mockCacheManager.set).toHaveBeenCalledWith(expect.stringContaining('permission-tracked-keys'), expect.arrayContaining([
                 keptKey,
                 'some-other-tracked-key'
@@ -265,6 +260,37 @@ describe('PermissionCacheService', ()=>{
             expect(deletedKeys).toContain(onlyKey);
             expect(deletedKeys.some((k)=>String(k).includes('permission-tracked-keys'))).toBe(true);
         });
+        it('wipes every tracked branch key when a null branchId (company-wide grant) is in the scope list', async ()=>{
+            const guardConfig = {
+                enableCompanyFeature: true
+            };
+            const service = buildService(guardConfig);
+            const branchAKey = buildPermissionCacheKey({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-a'
+            }, guardConfig);
+            const branchBKey = buildPermissionCacheKey({
+                userId: 'user-1',
+                companyId: 'company-1',
+                branchId: 'branch-b'
+            }, guardConfig);
+            const trackedKeysKey = 'permission-tracked-keys:user:user-1:company:company-1';
+            mockCacheManager.get.mockImplementation(async (key)=>{
+                if (key.includes('permission-tracked-keys')) return [
+                    branchAKey,
+                    branchBKey
+                ];
+                return undefined;
+            });
+            await service.invalidateUser('user-1', 'company-1', [
+                null
+            ]);
+            const deletedKeys = mockCacheManager.del.mock.calls.map(([key])=>key);
+            expect(deletedKeys).toContain(branchAKey);
+            expect(deletedKeys).toContain(branchBKey);
+            expect(deletedKeys.some((k)=>String(k).includes(trackedKeysKey))).toBe(true);
+        });
         it('without a companyId, invalidates every tracked scope for the user and clears the scopes index', async ()=>{
             const service = buildService();
             // scopes list mixes a nested tracked-keys index (company scope) with a raw cache key (untracked scope)
@@ -396,7 +422,7 @@ describe('PermissionCacheService', ()=>{
                 'user'
             ]);
             expect(result.frontendActions).toHaveLength(1);
-            expect(result.frontendActions[0].id).toBe('child-1');
+            expect(result.frontendActions[0].code).toBe('user.view');
         });
         it('returns an empty frontendActions list when parentCodes resolve to no known parents', async ()=>{
             const service = buildService();
@@ -559,7 +585,6 @@ describe('PermissionCacheService', ()=>{
             expect(result.cachedEndpoints).toBe(1);
             expect(result.frontendActions).toEqual([
                 {
-                    id: 'action-1',
                     code: 'user.view',
                     name: 'View Users',
                     description: null
@@ -602,9 +627,6 @@ describe('PermissionCacheService', ()=>{
             expect(result).toBe(2);
         });
         it('wipes every tracked cache entry per member instead of only branches with an existing permission row', async ()=>{
-            // Company-wide action changes are merged into every branch a member queries, including
-            // branches where the member holds no explicit permission row — so invalidation must not
-            // be narrowed to whatever branch_ids happen to already exist in the permission table.
             const service = buildService();
             mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
             mockRawMany(mockPermissionRepo, [
@@ -661,9 +683,6 @@ describe('PermissionCacheService', ()=>{
             expect(result).toBe(1);
         });
         it('wipes every tracked cache entry for role members instead of only branches with an existing permission row', async ()=>{
-            // Role actions are merged into every branch a member queries, including branches
-            // where the member holds no explicit permission row — so invalidation must not be
-            // narrowed to whatever branch_ids happen to already exist in the permission table.
             const service = buildService();
             mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
             mockPermissionRepo.find.mockResolvedValue([

package/fesm/services/permission.service.spec.js

@@ -575,7 +575,6 @@ describe('PermissionService', ()=>{
             const response = {
                 frontendActions: [
                     {
-                        id: 'action-1',
                         code: 'user.view',
                         name: 'View',
                         description: null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-iam",
-  "version": "6.2.0",
+  "version": "6.2.2",
   "description": "Identity and Access Management (IAM) module for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -90,7 +90,7 @@
     "express": "^5.0.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.2.0",
-    "@flusys/nestjs-shared": "6.2.0"
+    "@flusys/nestjs-core": "6.2.2",
+    "@flusys/nestjs-shared": "6.2.2"
   }
 }