@flusys/nestjs-iam 6.4.1 → 7.0.0

package/cjs/config/event-actions.js

@@ -0,0 +1,36 @@
+/**
+ * Domain event actions published by the IAM module, alongside the CRUD
+ * lifecycle actions every ApiService emits.
+ */ "use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: Object.getOwnPropertyDescriptor(all, name).get
+    });
+}
+_export(exports, {
+    get IAM_EVENT_ACTIONS () {
+        return IAM_EVENT_ACTIONS;
+    },
+    get IAM_EVENT_ENTITIES () {
+        return IAM_EVENT_ENTITIES;
+    },
+    get IAM_EVENT_MODULE () {
+        return IAM_EVENT_MODULE;
+    }
+});
+const IAM_EVENT_ACTIONS = {
+    PERMISSIONS_ASSIGNED: 'permissions-assigned'
+};
+const IAM_EVENT_ENTITIES = {
+    ACTION: 'action',
+    ROLE: 'role',
+    USER_ACTION: 'user_action',
+    ROLE_ACTION: 'role_action',
+    COMPANY_ACTION: 'company_action',
+    USER_ROLE: 'user_role'
+};
+const IAM_EVENT_MODULE = 'iam';

package/cjs/config/index.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", {
     value: true
 });
+_export_star(require("./event-actions"), exports);
 _export_star(require("./iam.constants"), exports);
 _export_star(require("./message-keys"), exports);
 function _export_star(from, to) {

package/cjs/config/message-keys.js

@@ -25,6 +25,9 @@ _export(exports, {
     get PERMISSION_OPERATION_MESSAGES () {
         return PERMISSION_OPERATION_MESSAGES;
     },
+    get ROLE_MESSAGES () {
+        return ROLE_MESSAGES;
+    },
     get ROLE_PERMISSION_MESSAGES () {
         return ROLE_PERMISSION_MESSAGES;
     },
@@ -33,7 +36,13 @@ _export(exports, {
     }
 });
 const ACTION_MESSAGES = {
-    GET_ALL_SUCCESS: 'action.get.all.success'
+    GET_ALL_SUCCESS: 'action.get.all.success',
+    READONLY_UPDATE_FORBIDDEN: 'action.readonly.update.forbidden',
+    READONLY_DELETE_FORBIDDEN: 'action.readonly.delete.forbidden'
+};
+const ROLE_MESSAGES = {
+    READONLY_UPDATE_FORBIDDEN: 'role.readonly.update.forbidden',
+    READONLY_DELETE_FORBIDDEN: 'role.readonly.delete.forbidden'
 };
 const PERMISSION_OPERATION_MESSAGES = {
     PROCESS_SUCCESS: 'permission.process.success',

package/cjs/modules/iam.module.js

@@ -101,7 +101,8 @@ let IAMModule = class IAMModule {
             _iamconfigservice.IAMConfigService,
             _iamdatasourceservice.IAMDataSourceService,
             ...this.getServices(permissionMode),
-            this.getPermissionGuardConfigProvider(enableCompanyFeature)
+            this.getPermissionGuardConfigProvider(enableCompanyFeature),
+            (0, _modules.createModuleEventsProvider)('iam', _iamconstants.IAM_MODULE_OPTIONS)
         ];
         const module = {
             module: IAMModule,
@@ -128,7 +129,8 @@ let IAMModule = class IAMModule {
             _iamconfigservice.IAMConfigService,
             _iamdatasourceservice.IAMDataSourceService,
             ...this.getServices(permissionMode),
-            this.getPermissionGuardConfigProvider(enableCompanyFeature)
+            this.getPermissionGuardConfigProvider(enableCompanyFeature),
+            (0, _modules.createModuleEventsProvider)('iam', _iamconstants.IAM_MODULE_OPTIONS)
         ];
         const module = {
             module: IAMModule,

package/cjs/services/action.service.js

@@ -50,6 +50,30 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let ActionService = class ActionService extends _classes.ApiService {
+    async beforeUpdateOperation(dto, _user, _queryRunner) {
+        const dtos = Array.isArray(dto) ? dto : [
+            dto
+        ];
+        const ids = dtos.map((d)=>d.id);
+        await this.ensureDataSourceRepository();
+        const readonlyActions = await this.repository.find({
+            where: {
+                id: (0, _typeorm.In)(ids),
+                readOnly: true,
+                deletedAt: (0, _typeorm.IsNull)()
+            }
+        });
+        if (readonlyActions.length > 0) {
+            const names = readonlyActions.map((a)=>a.name).join(', ');
+            throw new _common.ForbiddenException({
+                message: `Cannot modify readonly action(s): ${names}`,
+                messageKey: _config.ACTION_MESSAGES.READONLY_UPDATE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+    }
     async beforeDeleteOperation(dto, user, queryRunner) {
         const actionIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
@@ -57,6 +81,24 @@ let ActionService = class ActionService extends _classes.ApiService {
         if (actionIds.length === 0) {
             return;
         }
+        await this.ensureDataSourceRepository();
+        const readonlyActions = await this.repository.find({
+            where: {
+                id: (0, _typeorm.In)(actionIds),
+                readOnly: true,
+                deletedAt: (0, _typeorm.IsNull)()
+            }
+        });
+        if (readonlyActions.length > 0) {
+            const names = readonlyActions.map((a)=>a.name).join(', ');
+            throw new _common.ForbiddenException({
+                message: `Cannot delete readonly action(s): ${names}`,
+                messageKey: _config.ACTION_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const permissionEntity = enableCompanyFeature ? _permissionwithcompanyentity.UserIamPermissionWithCompany : _useriampermissionentity.UserIamPermission;
         const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
@@ -136,6 +178,7 @@ let ActionService = class ActionService extends _classes.ApiService {
                 'actionType',
                 'permissionLogic',
                 'isActive',
+                'readOnly',
                 'parentId',
                 'serial',
                 'createdAt'

package/cjs/services/action.service.spec.js

@@ -41,6 +41,7 @@ describe('ActionService', ()=>{
     let mockPermissionCacheService;
     beforeEach(async ()=>{
         mockRepo = (0, _repositorymock.createMockRepository)();
+        mockRepo.find.mockResolvedValue([]);
         const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
         mockIamConfigService = {
             isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
@@ -310,5 +311,41 @@ describe('ActionService', ()=>{
             }, (0, _loggedusermock.buildMockUser)(), queryRunner);
             expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
         });
+        it('rejects deleting a readonly action', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildAction({
+                    readOnly: true
+                })
+            ]);
+            const permissionRepo = (0, _repositorymock.createMockRepository)();
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await expect(service.beforeDeleteOperation({
+                id: 'action-uuid-1',
+                type: 'delete'
+            }, (0, _loggedusermock.buildMockUser)(), queryRunner)).rejects.toThrow('Cannot delete readonly action');
+            expect(permissionRepo.find).not.toHaveBeenCalled();
+        });
+    });
+    describe('beforeUpdateOperation', ()=>{
+        it('rejects updating a readonly action', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildAction({
+                    readOnly: true
+                })
+            ]);
+            await expect(service.beforeUpdateOperation({
+                id: 'action-uuid-1',
+                name: 'Renamed'
+            }, (0, _loggedusermock.buildMockUser)(), {})).rejects.toThrow('Cannot modify readonly action');
+        });
+        it('allows updating a non-readonly action', async ()=>{
+            // The service filters readOnly: true in the query itself, so a non-readonly
+            // action never comes back — simulate that by resolving an empty array.
+            mockRepo.find.mockResolvedValue([]);
+            await expect(service.beforeUpdateOperation({
+                id: 'action-uuid-1',
+                name: 'Renamed'
+            }, (0, _loggedusermock.buildMockUser)(), {})).resolves.toBeUndefined();
+        });
     });
 });

package/cjs/services/permission.service.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "PermissionService", {
     }
 });
 const _nestjsshared = require("@flusys/nestjs-shared");
+const _classes = require("@flusys/nestjs-shared/classes");
 const _common = require("@nestjs/common");
 const _typeorm = require("typeorm");
 const _config = require("../config");
@@ -155,7 +156,9 @@ let PermissionService = class PermissionService {
         await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, enableCompanyFeature ? [
             branchId
         ] : []);
-        return this.buildOperationResult(dto.items.length, added, removed);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(_config.IAM_EVENT_ENTITIES.USER_ACTION, dto.userId, result);
+        return result;
     }
     async getUserActions(userId, companyId, branchId) {
         const permissionRepo = await this.getPermissionRepository();
@@ -269,7 +272,9 @@ let PermissionService = class PermissionService {
             removed = result.affected || 0;
         }
         await this.permissionCacheService.invalidateRoleMembersCache(dto.roleId);
-        return this.buildOperationResult(dto.items.length, added, removed);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(_config.IAM_EVENT_ENTITIES.ROLE_ACTION, dto.roleId, result);
+        return result;
     }
     async getRoleActions(roleId) {
         const permissionRepo = await this.getPermissionRepository();
@@ -379,7 +384,9 @@ let PermissionService = class PermissionService {
             }
         });
         await this.permissionCacheService.invalidateCompanyMembersCache(dto.companyId);
-        return this.buildOperationResult(dto.items.length, added, removed);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(_config.IAM_EVENT_ENTITIES.COMPANY_ACTION, dto.companyId, result);
+        return result;
     }
     /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId, isOnlyId = false) {
         const permissionRepo = await this.getPermissionRepository();
@@ -486,7 +493,9 @@ let PermissionService = class PermissionService {
         await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
             branchId
         ]);
-        return this.buildOperationResult(dto.items.length, added, removed);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(_config.IAM_EVENT_ENTITIES.USER_ROLE, dto.userId, result);
+        return result;
     }
     /** Get user's roles (branch-scoped, filtered by companyId and branchId if provided) */ async getUserRoles(userId, branchId, companyId) {
         const permissionRepo = await this.getPermissionRepository();
@@ -640,6 +649,21 @@ let PermissionService = class PermissionService {
             toRemove: items.filter((item)=>item.action === _permissiondto.PermissionAction.REMOVE)
         };
     }
+    async publishAssignmentEvent(entity, targetId, result) {
+        await (0, _classes.publishDomainEvent)({
+            module: _config.IAM_EVENT_MODULE,
+            entity,
+            action: _config.IAM_EVENT_ACTIONS.PERMISSIONS_ASSIGNED,
+            ids: [
+                targetId
+            ],
+            metadata: {
+                added: result.added,
+                removed: result.removed,
+                total: result.total
+            }
+        });
+    }
     /** Build standard operation result DTO */ buildOperationResult(_totalItems, added, removed) {
         return {
             added,

package/cjs/services/permission.service.spec.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", {
     value: true
 });
 const _testing = require("@nestjs/testing");
+const _classes = require("@flusys/nestjs-shared/classes");
 const _repositorymock = require("@test-utils/mocks/repository.mock");
 const _config = require("../config");
 const _permissiondto = require("../dtos/permission.dto");
@@ -834,4 +835,84 @@ describe('PermissionService', ()=>{
             ]);
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            _classes.EventBusRegistry.reset();
+            _classes.EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            _classes.EventBusRegistry.configureModule('iam', {
+                enabled: true
+            });
+            mockIamConfigService.isDirectPermissionEnabled.mockReturnValue(true);
+            mockPermissionRepo.find.mockResolvedValue([]);
+            mockPermissionRepo.save.mockResolvedValue([
+                {}
+            ]);
+            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
+        });
+        afterEach(()=>{
+            _classes.EventBusRegistry.reset();
+        });
+        it('publishes iam.user_action.permissions-assigned with the operation counts', async ()=>{
+            await service.assignUserActions({
+                userId: 'user-1',
+                items: [
+                    {
+                        id: 'action-1',
+                        action: _permissiondto.PermissionAction.ADD
+                    }
+                ]
+            });
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'iam.user_action.permissions-assigned',
+                payload: expect.objectContaining({
+                    ids: [
+                        'user-1'
+                    ],
+                    metadata: expect.objectContaining({
+                        total: 1
+                    })
+                })
+            }));
+        });
+        it('publishes iam.user_role.permissions-assigned when roles are assigned', async ()=>{
+            mockRoleRepo.find.mockResolvedValue([
+                {
+                    id: 'role-1'
+                }
+            ]);
+            await service.assignUserRoles({
+                userId: 'user-1',
+                items: [
+                    {
+                        id: 'role-1',
+                        action: _permissiondto.PermissionAction.ADD
+                    }
+                ]
+            });
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'iam.user_role.permissions-assigned'
+            }));
+        });
+        it('does not publish when the iam module has events disabled', async ()=>{
+            _classes.EventBusRegistry.configureModule('iam', {
+                enabled: false
+            });
+            await service.assignUserActions({
+                userId: 'user-1',
+                items: [
+                    {
+                        id: 'action-1',
+                        action: _permissiondto.PermissionAction.ADD
+                    }
+                ]
+            });
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/cjs/services/role.service.js

@@ -13,6 +13,7 @@ const _modules = require("@flusys/nestjs-shared/modules");
 const _utils = require("@flusys/nestjs-shared/utils");
 const _common = require("@nestjs/common");
 const _typeorm = require("typeorm");
+const _config = require("../config");
 const _permissionwithcompanyentity = require("../entities/permission-with-company.entity");
 const _rolewithcompanyentity = require("../entities/role-with-company.entity");
 const _roleentity = require("../entities/role.entity");
@@ -50,6 +51,30 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 let RoleService = class RoleService extends _classes.ApiService {
+    async beforeUpdateOperation(dto, _user, _queryRunner) {
+        const dtos = Array.isArray(dto) ? dto : [
+            dto
+        ];
+        const ids = dtos.map((d)=>d.id);
+        await this.ensureDataSourceRepository();
+        const readonlyRoles = await this.repository.find({
+            where: {
+                id: (0, _typeorm.In)(ids),
+                readOnly: true,
+                deletedAt: (0, _typeorm.IsNull)()
+            }
+        });
+        if (readonlyRoles.length > 0) {
+            const names = readonlyRoles.map((r)=>r.name).join(', ');
+            throw new _common.ForbiddenException({
+                message: `Cannot modify readonly role(s): ${names}`,
+                messageKey: _config.ROLE_MESSAGES.READONLY_UPDATE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+    }
     async beforeDeleteOperation(dto, user, queryRunner) {
         await super.beforeDeleteOperation(dto, user, queryRunner);
         const roleIds = Array.isArray(dto.id) ? dto.id : [
@@ -58,6 +83,24 @@ let RoleService = class RoleService extends _classes.ApiService {
         if (roleIds.length === 0) {
             return;
         }
+        await this.ensureDataSourceRepository();
+        const readonlyRoles = await this.repository.find({
+            where: {
+                id: (0, _typeorm.In)(roleIds),
+                readOnly: true,
+                deletedAt: (0, _typeorm.IsNull)()
+            }
+        });
+        if (readonlyRoles.length > 0) {
+            const names = readonlyRoles.map((r)=>r.name).join(', ');
+            throw new _common.ForbiddenException({
+                message: `Cannot delete readonly role(s): ${names}`,
+                messageKey: _config.ROLE_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const permissionEntity = enableCompanyFeature ? _permissionwithcompanyentity.UserIamPermissionWithCompany : _useriampermissionentity.UserIamPermission;
         const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
@@ -111,6 +154,7 @@ let RoleService = class RoleService extends _classes.ApiService {
                 'name',
                 'description',
                 'isActive',
+                'readOnly',
                 'serial',
                 'createdAt'
             ];

package/cjs/services/role.service.spec.js

@@ -36,6 +36,7 @@ describe('RoleService', ()=>{
     let mockPermissionCacheService;
     beforeEach(async ()=>{
         mockRepo = (0, _repositorymock.createMockRepository)();
+        mockRepo.find.mockResolvedValue([]);
         const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
         mockIamConfigService = {
             isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
@@ -305,5 +306,39 @@ describe('RoleService', ()=>{
                 'user-1'
             ]);
         });
+        it('rejects deleting a readonly role', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildRole({
+                    readOnly: true
+                })
+            ]);
+            const permissionRepo = (0, _repositorymock.createMockRepository)();
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await expect(service.beforeDeleteOperation({
+                id: 'role-uuid-1',
+                type: 'delete'
+            }, (0, _loggedusermock.buildMockUser)(), queryRunner)).rejects.toThrow('Cannot delete readonly role');
+            expect(permissionRepo.find).not.toHaveBeenCalled();
+        });
+    });
+    describe('beforeUpdateOperation', ()=>{
+        it('rejects updating a readonly role', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildRole({
+                    readOnly: true
+                })
+            ]);
+            await expect(service.beforeUpdateOperation({
+                id: 'role-uuid-1',
+                name: 'Renamed'
+            }, (0, _loggedusermock.buildMockUser)(), {})).rejects.toThrow('Cannot modify readonly role');
+        });
+        it('allows updating a non-readonly role', async ()=>{
+            mockRepo.find.mockResolvedValue([]);
+            await expect(service.beforeUpdateOperation({
+                id: 'role-uuid-1',
+                name: 'Renamed'
+            }, (0, _loggedusermock.buildMockUser)(), {})).resolves.toBeUndefined();
+        });
     });
 });

package/config/event-actions.d.ts

@@ -0,0 +1,12 @@
+export declare const IAM_EVENT_ACTIONS: {
+    readonly PERMISSIONS_ASSIGNED: "permissions-assigned";
+};
+export declare const IAM_EVENT_ENTITIES: {
+    readonly ACTION: "action";
+    readonly ROLE: "role";
+    readonly USER_ACTION: "user_action";
+    readonly ROLE_ACTION: "role_action";
+    readonly COMPANY_ACTION: "company_action";
+    readonly USER_ROLE: "user_role";
+};
+export declare const IAM_EVENT_MODULE = "iam";

package/config/index.d.ts

@@ -1,2 +1,3 @@
+export * from './event-actions';
 export * from './iam.constants';
 export * from './message-keys';

package/config/message-keys.d.ts

@@ -1,5 +1,11 @@
 export declare const ACTION_MESSAGES: {
     readonly GET_ALL_SUCCESS: "action.get.all.success";
+    readonly READONLY_UPDATE_FORBIDDEN: "action.readonly.update.forbidden";
+    readonly READONLY_DELETE_FORBIDDEN: "action.readonly.delete.forbidden";
+};
+export declare const ROLE_MESSAGES: {
+    readonly READONLY_UPDATE_FORBIDDEN: "role.readonly.update.forbidden";
+    readonly READONLY_DELETE_FORBIDDEN: "role.readonly.delete.forbidden";
 };
 export declare const PERMISSION_OPERATION_MESSAGES: {
     readonly PROCESS_SUCCESS: "permission.process.success";

package/fesm/config/event-actions.js

@@ -0,0 +1,15 @@
+/**
+ * Domain event actions published by the IAM module, alongside the CRUD
+ * lifecycle actions every ApiService emits.
+ */ export const IAM_EVENT_ACTIONS = {
+    PERMISSIONS_ASSIGNED: 'permissions-assigned'
+};
+/** Every entity the IAM module publishes under, ApiService backed or not */ export const IAM_EVENT_ENTITIES = {
+    ACTION: 'action',
+    ROLE: 'role',
+    USER_ACTION: 'user_action',
+    ROLE_ACTION: 'role_action',
+    COMPANY_ACTION: 'company_action',
+    USER_ROLE: 'user_role'
+};
+export const IAM_EVENT_MODULE = 'iam';

package/fesm/config/index.js

@@ -1,2 +1,3 @@
+export * from './event-actions';
 export * from './iam.constants';
 export * from './message-keys';

package/fesm/config/message-keys.js

@@ -1,6 +1,12 @@
 // ==================== IAM MODULE MESSAGE KEYS ====================
 export const ACTION_MESSAGES = {
-    GET_ALL_SUCCESS: 'action.get.all.success'
+    GET_ALL_SUCCESS: 'action.get.all.success',
+    READONLY_UPDATE_FORBIDDEN: 'action.readonly.update.forbidden',
+    READONLY_DELETE_FORBIDDEN: 'action.readonly.delete.forbidden'
+};
+export const ROLE_MESSAGES = {
+    READONLY_UPDATE_FORBIDDEN: 'role.readonly.update.forbidden',
+    READONLY_DELETE_FORBIDDEN: 'role.readonly.delete.forbidden'
 };
 export const PERMISSION_OPERATION_MESSAGES = {
     PROCESS_SUCCESS: 'permission.process.success',

package/fesm/modules/iam.module.js

@@ -5,7 +5,7 @@ function _ts_decorate(decorators, target, key, desc) {
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 import { PERMISSION_GUARD_CONFIG, PERMISSIONS_CACHE_PREFIX } from '@flusys/nestjs-shared';
-import { CacheModule, UtilsModule } from '@flusys/nestjs-shared/modules';
+import { CacheModule, UtilsModule, createModuleEventsProvider } from '@flusys/nestjs-shared/modules';
 import { Module } from '@nestjs/common';
 import { IAM_MODULE_OPTIONS } from '../config/iam.constants';
 import { ActionController, CompanyActionPermissionController, MyPermissionController, RoleController, RolePermissionController, UserActionPermissionController } from '../controllers';
@@ -91,7 +91,8 @@ export class IAMModule {
             IAMConfigService,
             IAMDataSourceService,
             ...this.getServices(permissionMode),
-            this.getPermissionGuardConfigProvider(enableCompanyFeature)
+            this.getPermissionGuardConfigProvider(enableCompanyFeature),
+            createModuleEventsProvider('iam', IAM_MODULE_OPTIONS)
         ];
         const module = {
             module: IAMModule,
@@ -118,7 +119,8 @@ export class IAMModule {
             IAMConfigService,
             IAMDataSourceService,
             ...this.getServices(permissionMode),
-            this.getPermissionGuardConfigProvider(enableCompanyFeature)
+            this.getPermissionGuardConfigProvider(enableCompanyFeature),
+            createModuleEventsProvider('iam', IAM_MODULE_OPTIONS)
         ];
         const module = {
             module: IAMModule,

package/fesm/services/action.service.js

@@ -27,9 +27,9 @@ function _ts_param(paramIndex, decorator) {
 }
 import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { BadRequestException, Inject, Injectable, Scope } from '@nestjs/common';
-import { In } from 'typeorm';
-import { PERMISSION_OPERATION_MESSAGES } from '../config';
+import { BadRequestException, ForbiddenException, Inject, Injectable, Scope } from '@nestjs/common';
+import { In, IsNull } from 'typeorm';
+import { ACTION_MESSAGES, PERMISSION_OPERATION_MESSAGES } from '../config';
 import { Action } from '../entities/action.entity';
 import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
 import { UserIamPermission } from '../entities/user-iam-permission.entity';
@@ -40,6 +40,30 @@ import { IAMDataSourceService } from './iam-datasource.service';
 import { PermissionCacheService } from './permission-cache.service';
 import { PermissionService } from './permission.service';
 export class ActionService extends ApiService {
+    async beforeUpdateOperation(dto, _user, _queryRunner) {
+        const dtos = Array.isArray(dto) ? dto : [
+            dto
+        ];
+        const ids = dtos.map((d)=>d.id);
+        await this.ensureDataSourceRepository();
+        const readonlyActions = await this.repository.find({
+            where: {
+                id: In(ids),
+                readOnly: true,
+                deletedAt: IsNull()
+            }
+        });
+        if (readonlyActions.length > 0) {
+            const names = readonlyActions.map((a)=>a.name).join(', ');
+            throw new ForbiddenException({
+                message: `Cannot modify readonly action(s): ${names}`,
+                messageKey: ACTION_MESSAGES.READONLY_UPDATE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+    }
     async beforeDeleteOperation(dto, user, queryRunner) {
         const actionIds = Array.isArray(dto.id) ? dto.id : [
             dto.id
@@ -47,6 +71,24 @@ export class ActionService extends ApiService {
         if (actionIds.length === 0) {
             return;
         }
+        await this.ensureDataSourceRepository();
+        const readonlyActions = await this.repository.find({
+            where: {
+                id: In(actionIds),
+                readOnly: true,
+                deletedAt: IsNull()
+            }
+        });
+        if (readonlyActions.length > 0) {
+            const names = readonlyActions.map((a)=>a.name).join(', ');
+            throw new ForbiddenException({
+                message: `Cannot delete readonly action(s): ${names}`,
+                messageKey: ACTION_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const permissionEntity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
         const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
@@ -126,6 +168,7 @@ export class ActionService extends ApiService {
                 'actionType',
                 'permissionLogic',
                 'isActive',
+                'readOnly',
                 'parentId',
                 'serial',
                 'createdAt'

package/fesm/services/action.service.spec.js

@@ -37,6 +37,7 @@ describe('ActionService', ()=>{
     let mockPermissionCacheService;
     beforeEach(async ()=>{
         mockRepo = createMockRepository();
+        mockRepo.find.mockResolvedValue([]);
         const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
         mockIamConfigService = {
             isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
@@ -306,5 +307,41 @@ describe('ActionService', ()=>{
             }, buildMockUser(), queryRunner);
             expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
         });
+        it('rejects deleting a readonly action', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildAction({
+                    readOnly: true
+                })
+            ]);
+            const permissionRepo = createMockRepository();
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await expect(service.beforeDeleteOperation({
+                id: 'action-uuid-1',
+                type: 'delete'
+            }, buildMockUser(), queryRunner)).rejects.toThrow('Cannot delete readonly action');
+            expect(permissionRepo.find).not.toHaveBeenCalled();
+        });
+    });
+    describe('beforeUpdateOperation', ()=>{
+        it('rejects updating a readonly action', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildAction({
+                    readOnly: true
+                })
+            ]);
+            await expect(service.beforeUpdateOperation({
+                id: 'action-uuid-1',
+                name: 'Renamed'
+            }, buildMockUser(), {})).rejects.toThrow('Cannot modify readonly action');
+        });
+        it('allows updating a non-readonly action', async ()=>{
+            // The service filters readOnly: true in the query itself, so a non-readonly
+            // action never comes back — simulate that by resolving an empty array.
+            mockRepo.find.mockResolvedValue([]);
+            await expect(service.beforeUpdateOperation({
+                id: 'action-uuid-1',
+                name: 'Renamed'
+            }, buildMockUser(), {})).resolves.toBeUndefined();
+        });
     });
 });

package/fesm/services/permission.service.js

@@ -26,9 +26,10 @@ function _ts_param(paramIndex, decorator) {
     };
 }
 import { LogAction } from '@flusys/nestjs-shared';
+import { publishDomainEvent } from '@flusys/nestjs-shared/classes';
 import { BadRequestException, ConflictException, Inject, Injectable, Scope } from '@nestjs/common';
 import { In, IsNull } from 'typeorm';
-import { IAM_MODE_MESSAGES, PERMISSION_OPERATION_MESSAGES } from '../config';
+import { IAM_EVENT_ACTIONS, IAM_EVENT_ENTITIES, IAM_EVENT_MODULE, IAM_MODE_MESSAGES, PERMISSION_OPERATION_MESSAGES } from '../config';
 import { AssignCompanyActionsDto, AssignRoleActionsDto, AssignUserActionsDto, AssignUserRolesDto, PermissionAction } from '../dtos/permission.dto';
 import { Action } from '../entities/action.entity';
 import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
@@ -145,7 +146,9 @@ export class PermissionService {
         await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, enableCompanyFeature ? [
             branchId
         ] : []);
-        return this.buildOperationResult(dto.items.length, added, removed);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(IAM_EVENT_ENTITIES.USER_ACTION, dto.userId, result);
+        return result;
     }
     async getUserActions(userId, companyId, branchId) {
         const permissionRepo = await this.getPermissionRepository();
@@ -259,7 +262,9 @@ export class PermissionService {
             removed = result.affected || 0;
         }
         await this.permissionCacheService.invalidateRoleMembersCache(dto.roleId);
-        return this.buildOperationResult(dto.items.length, added, removed);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(IAM_EVENT_ENTITIES.ROLE_ACTION, dto.roleId, result);
+        return result;
     }
     async getRoleActions(roleId) {
         const permissionRepo = await this.getPermissionRepository();
@@ -369,7 +374,9 @@ export class PermissionService {
             }
         });
         await this.permissionCacheService.invalidateCompanyMembersCache(dto.companyId);
-        return this.buildOperationResult(dto.items.length, added, removed);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(IAM_EVENT_ENTITIES.COMPANY_ACTION, dto.companyId, result);
+        return result;
     }
     /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId, isOnlyId = false) {
         const permissionRepo = await this.getPermissionRepository();
@@ -476,7 +483,9 @@ export class PermissionService {
         await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
             branchId
         ]);
-        return this.buildOperationResult(dto.items.length, added, removed);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(IAM_EVENT_ENTITIES.USER_ROLE, dto.userId, result);
+        return result;
     }
     /** Get user's roles (branch-scoped, filtered by companyId and branchId if provided) */ async getUserRoles(userId, branchId, companyId) {
         const permissionRepo = await this.getPermissionRepository();
@@ -630,6 +639,21 @@ export class PermissionService {
             toRemove: items.filter((item)=>item.action === PermissionAction.REMOVE)
         };
     }
+    async publishAssignmentEvent(entity, targetId, result) {
+        await publishDomainEvent({
+            module: IAM_EVENT_MODULE,
+            entity,
+            action: IAM_EVENT_ACTIONS.PERMISSIONS_ASSIGNED,
+            ids: [
+                targetId
+            ],
+            metadata: {
+                added: result.added,
+                removed: result.removed,
+                total: result.total
+            }
+        });
+    }
     /** Build standard operation result DTO */ buildOperationResult(_totalItems, added, removed) {
         return {
             added,

package/fesm/services/permission.service.spec.js

@@ -1,4 +1,5 @@
 import { Test } from '@nestjs/testing';
+import { EventBusRegistry } from '@flusys/nestjs-shared/classes';
 import { createMockRepository } from '@test-utils/mocks/repository.mock';
 import { IAM_MODE_MESSAGES, PERMISSION_OPERATION_MESSAGES } from '../config';
 import { PermissionAction } from '../dtos/permission.dto';
@@ -830,4 +831,84 @@ describe('PermissionService', ()=>{
             ]);
         });
     });
+    describe('domain events', ()=>{
+        let publish;
+        beforeEach(()=>{
+            publish = jest.fn().mockResolvedValue(undefined);
+            EventBusRegistry.reset();
+            EventBusRegistry.setBus({
+                publish,
+                subscribe: jest.fn(),
+                close: jest.fn()
+            });
+            EventBusRegistry.configureModule('iam', {
+                enabled: true
+            });
+            mockIamConfigService.isDirectPermissionEnabled.mockReturnValue(true);
+            mockPermissionRepo.find.mockResolvedValue([]);
+            mockPermissionRepo.save.mockResolvedValue([
+                {}
+            ]);
+            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
+        });
+        afterEach(()=>{
+            EventBusRegistry.reset();
+        });
+        it('publishes iam.user_action.permissions-assigned with the operation counts', async ()=>{
+            await service.assignUserActions({
+                userId: 'user-1',
+                items: [
+                    {
+                        id: 'action-1',
+                        action: PermissionAction.ADD
+                    }
+                ]
+            });
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'iam.user_action.permissions-assigned',
+                payload: expect.objectContaining({
+                    ids: [
+                        'user-1'
+                    ],
+                    metadata: expect.objectContaining({
+                        total: 1
+                    })
+                })
+            }));
+        });
+        it('publishes iam.user_role.permissions-assigned when roles are assigned', async ()=>{
+            mockRoleRepo.find.mockResolvedValue([
+                {
+                    id: 'role-1'
+                }
+            ]);
+            await service.assignUserRoles({
+                userId: 'user-1',
+                items: [
+                    {
+                        id: 'role-1',
+                        action: PermissionAction.ADD
+                    }
+                ]
+            });
+            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
+                name: 'iam.user_role.permissions-assigned'
+            }));
+        });
+        it('does not publish when the iam module has events disabled', async ()=>{
+            EventBusRegistry.configureModule('iam', {
+                enabled: false
+            });
+            await service.assignUserActions({
+                userId: 'user-1',
+                items: [
+                    {
+                        id: 'action-1',
+                        action: PermissionAction.ADD
+                    }
+                ]
+            });
+            expect(publish).not.toHaveBeenCalled();
+        });
+    });
 });

package/fesm/services/role.service.js

@@ -28,8 +28,9 @@ function _ts_param(paramIndex, decorator) {
 import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
 import { UtilsService } from '@flusys/nestjs-shared/modules';
 import { applyCompanyFilter } from '@flusys/nestjs-shared/utils';
-import { Inject, Injectable, Scope } from '@nestjs/common';
-import { In } from 'typeorm';
+import { ForbiddenException, Inject, Injectable, Scope } from '@nestjs/common';
+import { In, IsNull } from 'typeorm';
+import { ROLE_MESSAGES } from '../config';
 import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
 import { RoleWithCompany } from '../entities/role-with-company.entity';
 import { Role } from '../entities/role.entity';
@@ -40,6 +41,30 @@ import { IAMConfigService } from './iam-config.service';
 import { IAMDataSourceService } from './iam-datasource.service';
 import { PermissionCacheService } from './permission-cache.service';
 export class RoleService extends ApiService {
+    async beforeUpdateOperation(dto, _user, _queryRunner) {
+        const dtos = Array.isArray(dto) ? dto : [
+            dto
+        ];
+        const ids = dtos.map((d)=>d.id);
+        await this.ensureDataSourceRepository();
+        const readonlyRoles = await this.repository.find({
+            where: {
+                id: In(ids),
+                readOnly: true,
+                deletedAt: IsNull()
+            }
+        });
+        if (readonlyRoles.length > 0) {
+            const names = readonlyRoles.map((r)=>r.name).join(', ');
+            throw new ForbiddenException({
+                message: `Cannot modify readonly role(s): ${names}`,
+                messageKey: ROLE_MESSAGES.READONLY_UPDATE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+    }
     async beforeDeleteOperation(dto, user, queryRunner) {
         await super.beforeDeleteOperation(dto, user, queryRunner);
         const roleIds = Array.isArray(dto.id) ? dto.id : [
@@ -48,6 +73,24 @@ export class RoleService extends ApiService {
         if (roleIds.length === 0) {
             return;
         }
+        await this.ensureDataSourceRepository();
+        const readonlyRoles = await this.repository.find({
+            where: {
+                id: In(roleIds),
+                readOnly: true,
+                deletedAt: IsNull()
+            }
+        });
+        if (readonlyRoles.length > 0) {
+            const names = readonlyRoles.map((r)=>r.name).join(', ');
+            throw new ForbiddenException({
+                message: `Cannot delete readonly role(s): ${names}`,
+                messageKey: ROLE_MESSAGES.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
         const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
         const permissionEntity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
         const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
@@ -101,6 +144,7 @@ export class RoleService extends ApiService {
                 'name',
                 'description',
                 'isActive',
+                'readOnly',
                 'serial',
                 'createdAt'
             ];

package/fesm/services/role.service.spec.js

@@ -32,6 +32,7 @@ describe('RoleService', ()=>{
     let mockPermissionCacheService;
     beforeEach(async ()=>{
         mockRepo = createMockRepository();
+        mockRepo.find.mockResolvedValue([]);
         const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
         mockIamConfigService = {
             isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
@@ -301,5 +302,39 @@ describe('RoleService', ()=>{
                 'user-1'
             ]);
         });
+        it('rejects deleting a readonly role', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildRole({
+                    readOnly: true
+                })
+            ]);
+            const permissionRepo = createMockRepository();
+            const queryRunner = buildQueryRunner(permissionRepo);
+            await expect(service.beforeDeleteOperation({
+                id: 'role-uuid-1',
+                type: 'delete'
+            }, buildMockUser(), queryRunner)).rejects.toThrow('Cannot delete readonly role');
+            expect(permissionRepo.find).not.toHaveBeenCalled();
+        });
+    });
+    describe('beforeUpdateOperation', ()=>{
+        it('rejects updating a readonly role', async ()=>{
+            mockRepo.find.mockResolvedValue([
+                buildRole({
+                    readOnly: true
+                })
+            ]);
+            await expect(service.beforeUpdateOperation({
+                id: 'role-uuid-1',
+                name: 'Renamed'
+            }, buildMockUser(), {})).rejects.toThrow('Cannot modify readonly role');
+        });
+        it('allows updating a non-readonly role', async ()=>{
+            mockRepo.find.mockResolvedValue([]);
+            await expect(service.beforeUpdateOperation({
+                id: 'role-uuid-1',
+                name: 'Renamed'
+            }, buildMockUser(), {})).resolves.toBeUndefined();
+        });
     });
 });

package/interfaces/iam-module-options.interface.d.ts

@@ -1,6 +1,8 @@
 import { IBootstrapAppConfig, IDataSourceServiceOptions, IDynamicModuleConfig, IModuleOptionsFactory } from '@flusys/nestjs-core';
+import { IModuleEventsConfig } from '@flusys/nestjs-shared/interfaces';
 import { ModuleMetadata, Type } from '@nestjs/common';
 export interface IIAMModuleConfig extends IDataSourceServiceOptions {
+    events?: IModuleEventsConfig;
 }
 export interface IAMModuleOptions extends IDynamicModuleConfig {
     bootstrapAppConfig?: IBootstrapAppConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-iam",
-  "version": "6.4.1",
+  "version": "7.0.0",
   "description": "Identity and Access Management (IAM) module for NestJS applications",
   "main": "cjs/index.js",
   "module": "fesm/index.js",
@@ -90,7 +90,7 @@
     "express": "^5.0.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "6.4.1",
-    "@flusys/nestjs-shared": "6.4.1"
+    "@flusys/nestjs-core": "7.0.0",
+    "@flusys/nestjs-shared": "7.0.0"
   }
 }

package/services/action.service.d.ts

@@ -17,6 +17,7 @@ export declare class ActionService extends ApiService<CreateActionDto, UpdateAct
     private readonly permissionService;
     private readonly permissionCacheService;
     constructor(cacheManager: HybridCache, utilsService: UtilsService, iamConfigService: IAMConfigService, dataSourceProvider: IAMDataSourceService, permissionService: PermissionService, permissionCacheService: PermissionCacheService);
+    protected beforeUpdateOperation(dto: UpdateActionDto | UpdateActionDto[], _user: ILoggedUserInfo | null, _queryRunner: QueryRunner): Promise<void>;
     protected beforeDeleteOperation(dto: DeleteDto, user: ILoggedUserInfo | null, queryRunner: QueryRunner): Promise<void>;
     getSelectQuery(query: SelectQueryBuilder<Action>, _user: ILoggedUserInfo | null, select?: string[]): Promise<{
         query: SelectQueryBuilder<Action>;

package/services/permission.service.d.ts

@@ -23,6 +23,7 @@ export declare class PermissionService {
     getUserEffectiveActions(userId: string, companyId?: string | null, branchId?: string | null): Promise<UserActionResponseDto[]>;
     getMyPermissions(userId: string, branchId: string | null, companyId?: string | null, parentCodes?: string[]): Promise<MyPermissionsResponseDto>;
     private splitItemsByAction;
+    private publishAssignmentEvent;
     private buildOperationResult;
     revokeCompanyPermissions(companyId: string): Promise<void>;
     revokeBranchPermissions(branchId: string, companyId: string): Promise<void>;

package/services/role.service.d.ts

@@ -15,6 +15,7 @@ export declare class RoleService extends ApiService<CreateRoleDto, UpdateRoleDto
     private readonly iamConfigService;
     private readonly permissionCacheService;
     constructor(cacheManager: HybridCache, utilsService: UtilsService, iamConfigService: IAMConfigService, dataSourceProvider: IAMDataSourceService, permissionCacheService: PermissionCacheService);
+    protected beforeUpdateOperation(dto: UpdateRoleDto | UpdateRoleDto[], _user: ILoggedUserInfo | null, _queryRunner: QueryRunner): Promise<void>;
     protected beforeDeleteOperation(dto: DeleteDto, user: ILoggedUserInfo | null, queryRunner: QueryRunner): Promise<void>;
     protected resolveEntity(): EntityTarget<RoleBase>;
     convertSingleDtoToEntity(dto: CreateRoleDto | UpdateRoleDto, user: ILoggedUserInfo | null): Promise<RoleBase>;