@flusys/nestjs-iam 7.0.2 → 8.0.0-beta.1

package/cjs/services/action.service.js

@@ -1,337 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "ActionService", {
-    enumerable: true,
-    get: function() {
-        return ActionService;
-    }
-});
-const _classes = require("@flusys/nestjs-shared/classes");
-const _modules = require("@flusys/nestjs-shared/modules");
-const _common = require("@nestjs/common");
-const _typeorm = require("typeorm");
-const _config = require("../config");
-const _actionentity = require("../entities/action.entity");
-const _permissionwithcompanyentity = require("../entities/permission-with-company.entity");
-const _useriampermissionentity = require("../entities/user-iam-permission.entity");
-const _iamentitytypeenum = require("../enums/iam-entity-type.enum");
-const _iampermissiontypeenum = require("../enums/iam-permission-type.enum");
-const _iamconfigservice = require("./iam-config.service");
-const _iamdatasourceservice = require("./iam-datasource.service");
-const _permissioncacheservice = require("./permission-cache.service");
-const _permissionservice = require("./permission.service");
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-let ActionService = class ActionService extends _classes.ApiService {
-    async beforeUpdateOperation(dto, _user, _queryRunner) {
-        const dtos = Array.isArray(dto) ? dto : [
-            dto
-        ];
-        const ids = dtos.map((d)=>d.id);
-        await this.ensureDataSourceRepository();
-        const readonlyActions = await this.repository.find({
-            where: {
-                id: (0, _typeorm.In)(ids),
-                readOnly: true,
-                deletedAt: (0, _typeorm.IsNull)()
-            }
-        });
-        if (readonlyActions.length > 0) {
-            const names = readonlyActions.map((a)=>a.name).join(', ');
-            throw new _common.ForbiddenException({
-                message: `Cannot modify readonly action(s): ${names}`,
-                messageKey: _config.ACTION_MESSAGES.READONLY_UPDATE_FORBIDDEN,
-                messageVariables: {
-                    names
-                }
-            });
-        }
-    }
-    async beforeDeleteOperation(dto, user, queryRunner) {
-        const actionIds = Array.isArray(dto.id) ? dto.id : [
-            dto.id
-        ];
-        if (actionIds.length === 0) {
-            return;
-        }
-        await this.ensureDataSourceRepository();
-        const readonlyActions = await this.repository.find({
-            where: {
-                id: (0, _typeorm.In)(actionIds),
-                readOnly: true,
-                deletedAt: (0, _typeorm.IsNull)()
-            }
-        });
-        if (readonlyActions.length > 0) {
-            const names = readonlyActions.map((a)=>a.name).join(', ');
-            throw new _common.ForbiddenException({
-                message: `Cannot delete readonly action(s): ${names}`,
-                messageKey: _config.ACTION_MESSAGES.READONLY_DELETE_FORBIDDEN,
-                messageVariables: {
-                    names
-                }
-            });
-        }
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const permissionEntity = enableCompanyFeature ? _permissionwithcompanyentity.UserIamPermissionWithCompany : _useriampermissionentity.UserIamPermission;
-        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
-        const [roleActionRows, userActionRows, companyActionRows] = await Promise.all([
-            permissionRepo.find({
-                where: {
-                    permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
-                    sourceType: _iamentitytypeenum.IamEntityType.ROLE,
-                    targetType: _iamentitytypeenum.IamEntityType.ACTION,
-                    targetId: (0, _typeorm.In)(actionIds)
-                }
-            }),
-            permissionRepo.find({
-                where: {
-                    permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
-                    targetType: _iamentitytypeenum.IamEntityType.ACTION,
-                    targetId: (0, _typeorm.In)(actionIds)
-                }
-            }),
-            enableCompanyFeature ? permissionRepo.find({
-                where: {
-                    permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION,
-                    sourceType: _iamentitytypeenum.IamEntityType.COMPANY,
-                    targetType: _iamentitytypeenum.IamEntityType.ACTION,
-                    targetId: (0, _typeorm.In)(actionIds)
-                }
-            }) : Promise.resolve([])
-        ]);
-        const affectedUserIds = new Set(userActionRows.map((row)=>row.sourceId));
-        const affectedCompanyIds = [
-            ...new Set(companyActionRows.map((row)=>row.sourceId).filter((id)=>!!id))
-        ];
-        const affectedRoleIds = [
-            ...new Set(roleActionRows.map((row)=>row.sourceId))
-        ];
-        if (affectedRoleIds.length > 0) {
-            const userRoleRows = await permissionRepo.find({
-                where: {
-                    permissionType: _iampermissiontypeenum.IamPermissionType.USER_ROLE,
-                    targetType: _iamentitytypeenum.IamEntityType.ROLE,
-                    targetId: (0, _typeorm.In)(affectedRoleIds)
-                }
-            });
-            userRoleRows.forEach((row)=>affectedUserIds.add(row.sourceId));
-        }
-        await permissionRepo.delete({
-            permissionType: _iampermissiontypeenum.IamPermissionType.ROLE_ACTION,
-            targetType: _iamentitytypeenum.IamEntityType.ACTION,
-            targetId: (0, _typeorm.In)(actionIds)
-        });
-        await permissionRepo.delete({
-            permissionType: _iampermissiontypeenum.IamPermissionType.USER_ACTION,
-            targetType: _iamentitytypeenum.IamEntityType.ACTION,
-            targetId: (0, _typeorm.In)(actionIds)
-        });
-        await permissionRepo.delete({
-            permissionType: _iampermissiontypeenum.IamPermissionType.COMPANY_ACTION,
-            sourceType: _iamentitytypeenum.IamEntityType.COMPANY,
-            targetType: _iamentitytypeenum.IamEntityType.ACTION,
-            targetId: (0, _typeorm.In)(actionIds)
-        });
-        await Promise.all([
-            affectedUserIds.size > 0 ? this.permissionCacheService.invalidateUsers([
-                ...affectedUserIds
-            ]) : Promise.resolve(),
-            ...affectedCompanyIds.map((companyId)=>this.permissionCacheService.invalidateCompanyMembersCache(companyId))
-        ]);
-    }
-    // Query Customization
-    async getSelectQuery(query, _user, select) {
-        if (!select?.length) {
-            select = [
-                'id',
-                'name',
-                'code',
-                'description',
-                'actionType',
-                'permissionLogic',
-                'isActive',
-                'readOnly',
-                'parentId',
-                'serial',
-                'createdAt'
-            ];
-        }
-        query.select(select.map((f)=>`${this.entityName}.${f}`));
-        return {
-            query,
-            isRaw: false
-        };
-    }
-    async getGlobalSearchQuery(query, search) {
-        query.andWhere('(action.name LIKE :search OR action.code LIKE :search OR action.description LIKE :search)', {
-            search: `%${search}%`
-        });
-        return {
-            query,
-            isRaw: false
-        };
-    }
-    // Response Conversion
-    convertEntityToResponseDto(entity, _isRaw) {
-        return {
-            id: entity.id,
-            readOnly: entity.readOnly,
-            name: entity.name,
-            description: entity.description,
-            code: entity.code,
-            actionType: entity.actionType,
-            permissionLogic: entity.permissionLogic,
-            serial: entity.serial,
-            isActive: entity.isActive,
-            parentId: entity.parentId,
-            createdAt: entity.createdAt,
-            updatedAt: entity.updatedAt,
-            deletedAt: entity.deletedAt,
-            createdById: entity.createdById,
-            updatedById: entity.updatedById,
-            deletedById: entity.deletedById
-        };
-    }
-    requireUser(user, methodName) {
-        if (!user) {
-            throw new _common.BadRequestException({
-                message: `User is required for ${methodName}`,
-                messageKey: _config.PERMISSION_OPERATION_MESSAGES.USER_REQUIRED,
-                messageVariables: {
-                    method: methodName
-                }
-            });
-        }
-    }
-    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user, companyId) {
-        await this.ensureDataSourceRepository();
-        this.requireUser(user, 'getActionsForPermission');
-        let whereClause = {};
-        const targetCompanyId = companyId || user.companyId;
-        if (this.iamConfigService.isCompanyFeatureEnabled() && targetCompanyId) {
-            const companyActionIds = await this.permissionService.getCompanyActions(targetCompanyId, true);
-            if (companyActionIds.length === 0) {
-                return [];
-            }
-            whereClause = {
-                id: (0, _typeorm.In)(companyActionIds)
-            };
-        }
-        const actions = await this.repository.find({
-            where: whereClause,
-            select: this.actionSelectFields
-        });
-        return actions.map((action)=>this.convertEntityToResponseDto(action, false));
-    }
-    /** Get actions in hierarchical tree structure */ async getActionTree(user, search, isActive, withDeleted = false) {
-        await this.ensureDataSourceRepository();
-        this.requireUser(user, 'getActionTree');
-        const query = this.repository.createQueryBuilder('action');
-        if (!withDeleted) {
-            query.andWhere('action.deletedAt IS NULL');
-        }
-        if (isActive !== undefined) {
-            query.andWhere('action.isActive = :isActive', {
-                isActive
-            });
-        }
-        if (search?.trim()) {
-            query.andWhere('(action.name LIKE :search OR action.code LIKE :search)', {
-                search: `%${search.trim()}%`
-            });
-        }
-        const actions = await query.orderBy('action.serial', 'ASC').getMany();
-        return this.buildActionTree(actions);
-    }
-    buildActionTree(actions) {
-        if (!actions?.length) {
-            return [];
-        }
-        const map = new Map();
-        const rootNodes = [];
-        for (const action of actions){
-            const treeNode = {
-                ...this.convertEntityToResponseDto(action, false),
-                children: []
-            };
-            map.set(action.id, treeNode);
-        }
-        for (const action of actions){
-            const node = map.get(action.id);
-            if (!node) {
-                continue;
-            }
-            if (action.parentId && map.has(action.parentId)) {
-                const parent = map.get(action.parentId);
-                if (parent?.children) {
-                    parent.children.push(node);
-                }
-            } else {
-                rootNodes.push(node);
-            }
-        }
-        return rootNodes;
-    }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService, permissionCacheService){
-        super(_config.IAM_EVENT_ENTITIES.ACTION, cacheManager, utilsService, ActionService.name, true, _config.IAM_EVENT_MODULE, dataSourceProvider, _actionentity.Action), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionService", void 0), _define_property(this, "permissionCacheService", void 0), // Custom Methods
-        _define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.permissionCacheService = permissionCacheService, this.actionSelectFields = [
-            'id',
-            'code',
-            'name',
-            'description',
-            'actionType',
-            'permissionLogic',
-            'isActive',
-            'parentId',
-            'serial'
-        ];
-    }
-};
-ActionService = _ts_decorate([
-    (0, _common.Injectable)({
-        scope: _common.Scope.REQUEST
-    }),
-    _ts_param(0, (0, _common.Inject)('CACHE_INSTANCE')),
-    _ts_param(1, (0, _common.Inject)(_modules.UtilsService)),
-    _ts_param(2, (0, _common.Inject)(_iamconfigservice.IAMConfigService)),
-    _ts_param(3, (0, _common.Inject)(_iamdatasourceservice.IAMDataSourceService)),
-    _ts_param(4, (0, _common.Inject)(_permissionservice.PermissionService)),
-    _ts_param(5, (0, _common.Inject)(_permissioncacheservice.PermissionCacheService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _classes.HybridCache === "undefined" ? Object : _classes.HybridCache,
-        typeof _modules.UtilsService === "undefined" ? Object : _modules.UtilsService,
-        typeof _iamconfigservice.IAMConfigService === "undefined" ? Object : _iamconfigservice.IAMConfigService,
-        typeof _iamdatasourceservice.IAMDataSourceService === "undefined" ? Object : _iamdatasourceservice.IAMDataSourceService,
-        typeof _permissionservice.PermissionService === "undefined" ? Object : _permissionservice.PermissionService,
-        typeof _permissioncacheservice.PermissionCacheService === "undefined" ? Object : _permissioncacheservice.PermissionCacheService
-    ])
-], ActionService);

package/cjs/services/action.service.spec.js

@@ -1,351 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-const _testing = require("@nestjs/testing");
-const _modules = require("@flusys/nestjs-shared/modules");
-const _repositorymock = require("@test-utils/mocks/repository.mock");
-const _loggedusermock = require("@test-utils/mocks/logged-user.mock");
-const _enums = require("../enums");
-const _actionservice = require("./action.service");
-const _iamconfigservice = require("./iam-config.service");
-const _iamdatasourceservice = require("./iam-datasource.service");
-const _permissioncacheservice = require("./permission-cache.service");
-const _permissionservice = require("./permission.service");
-function buildAction(overrides = {}) {
-    return {
-        id: 'action-uuid-1',
-        readOnly: false,
-        name: 'View Products',
-        description: null,
-        code: 'products.read',
-        actionType: _enums.ActionType.BACKEND,
-        permissionLogic: null,
-        serial: 1,
-        isActive: true,
-        parentId: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        deletedAt: null,
-        createdById: null,
-        updatedById: null,
-        deletedById: null,
-        ...overrides
-    };
-}
-describe('ActionService', ()=>{
-    let service;
-    let mockRepo;
-    let mockIamConfigService;
-    let mockPermissionService;
-    let mockPermissionCacheService;
-    beforeEach(async ()=>{
-        mockRepo = (0, _repositorymock.createMockRepository)();
-        mockRepo.find.mockResolvedValue([]);
-        const mockDataSourceProvider = (0, _repositorymock.createMockDataSourceProvider)(mockRepo);
-        mockIamConfigService = {
-            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
-        };
-        mockPermissionService = {
-            getCompanyActions: jest.fn()
-        };
-        mockPermissionCacheService = {
-            invalidateUsers: jest.fn(),
-            invalidateCompanyMembersCache: jest.fn()
-        };
-        const module = await _testing.Test.createTestingModule({
-            providers: [
-                _actionservice.ActionService,
-                {
-                    provide: 'CACHE_INSTANCE',
-                    useValue: {}
-                },
-                {
-                    provide: _modules.UtilsService,
-                    useValue: {}
-                },
-                {
-                    provide: _iamconfigservice.IAMConfigService,
-                    useValue: mockIamConfigService
-                },
-                {
-                    provide: _iamdatasourceservice.IAMDataSourceService,
-                    useValue: mockDataSourceProvider
-                },
-                {
-                    provide: _permissionservice.PermissionService,
-                    useValue: mockPermissionService
-                },
-                {
-                    provide: _permissioncacheservice.PermissionCacheService,
-                    useValue: mockPermissionCacheService
-                }
-            ]
-        }).compile();
-        service = await module.resolve(_actionservice.ActionService);
-    });
-    describe('getActionsForPermission', ()=>{
-        it('returns all actions when the company feature is disabled', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildAction()
-            ]);
-            const result = await service.getActionsForPermission((0, _loggedusermock.buildMockUser)());
-            expect(mockPermissionService.getCompanyActions).not.toHaveBeenCalled();
-            expect(result).toHaveLength(1);
-            expect(result[0].code).toBe('products.read');
-        });
-        it('scopes actions to the company whitelist when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionService.getCompanyActions.mockResolvedValue([
-                'action-uuid-1'
-            ]);
-            mockRepo.find.mockResolvedValue([
-                buildAction()
-            ]);
-            await service.getActionsForPermission((0, _loggedusermock.buildMockUser)(), 'company-uuid-1');
-            expect(mockPermissionService.getCompanyActions).toHaveBeenCalledWith('company-uuid-1', true);
-            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
-                where: {
-                    id: expect.anything()
-                }
-            }));
-        });
-        it('short-circuits without querying when the company has no whitelisted actions', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionService.getCompanyActions.mockResolvedValue([]);
-            const result = await service.getActionsForPermission((0, _loggedusermock.buildMockUser)(), 'company-uuid-1');
-            expect(result).toEqual([]);
-            expect(mockRepo.find).not.toHaveBeenCalled();
-        });
-        it('throws when no user is provided', async ()=>{
-            await expect(service.getActionsForPermission(null)).rejects.toThrow();
-        });
-    });
-    describe('getActionTree', ()=>{
-        it('nests child actions under their parent', async ()=>{
-            const parent = buildAction({
-                id: 'parent-1',
-                parentId: null,
-                serial: 1
-            });
-            const child = buildAction({
-                id: 'child-1',
-                parentId: 'parent-1',
-                serial: 2,
-                code: 'products.create'
-            });
-            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
-                parent,
-                child
-            ]);
-            const tree = await service.getActionTree((0, _loggedusermock.buildMockUser)());
-            expect(tree).toHaveLength(1);
-            expect(tree[0].id).toBe('parent-1');
-            expect(tree[0].children).toHaveLength(1);
-            expect(tree[0].children?.[0].id).toBe('child-1');
-        });
-        it('throws when no user is provided', async ()=>{
-            await expect(service.getActionTree(null)).rejects.toThrow();
-        });
-        it('treats an action with a missing/unknown parentId as a root node', async ()=>{
-            const orphan = buildAction({
-                id: 'orphan-1',
-                parentId: 'does-not-exist'
-            });
-            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
-                orphan
-            ]);
-            const tree = await service.getActionTree((0, _loggedusermock.buildMockUser)());
-            expect(tree).toHaveLength(1);
-            expect(tree[0].id).toBe('orphan-1');
-        });
-        it('excludes soft-deleted actions by default and applies search/isActive filters', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            query.getMany.mockResolvedValue([]);
-            await service.getActionTree((0, _loggedusermock.buildMockUser)(), 'view', true, false);
-            expect(query.andWhere).toHaveBeenCalledWith('action.deletedAt IS NULL');
-            expect(query.andWhere).toHaveBeenCalledWith('action.isActive = :isActive', {
-                isActive: true
-            });
-            expect(query.andWhere).toHaveBeenCalledWith('(action.name LIKE :search OR action.code LIKE :search)', {
-                search: '%view%'
-            });
-        });
-        it('includes soft-deleted actions when withDeleted is true', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            query.getMany.mockResolvedValue([]);
-            await service.getActionTree((0, _loggedusermock.buildMockUser)(), undefined, undefined, true);
-            expect(query.andWhere).not.toHaveBeenCalledWith('action.deletedAt IS NULL');
-        });
-    });
-    describe('getSelectQuery', ()=>{
-        it('selects the default field set when none is provided', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)());
-            expect(query.select).toHaveBeenCalledWith(expect.arrayContaining([
-                'action.code',
-                'action.actionType',
-                'action.permissionLogic'
-            ]));
-        });
-        it('uses the explicitly provided select list as-is', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(query, (0, _loggedusermock.buildMockUser)(), [
-                'id',
-                'code'
-            ]);
-            expect(query.select).toHaveBeenCalledWith([
-                'action.id',
-                'action.code'
-            ]);
-        });
-    });
-    describe('getGlobalSearchQuery', ()=>{
-        it('filters by name, code, or description', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            await service.getGlobalSearchQuery(query, 'view');
-            expect(query.andWhere).toHaveBeenCalledWith('(action.name LIKE :search OR action.code LIKE :search OR action.description LIKE :search)', {
-                search: '%view%'
-            });
-        });
-    });
-    describe('convertEntityToResponseDto', ()=>{
-        it('maps every entity field onto the response shape', ()=>{
-            const entity = buildAction({
-                code: 'user.view'
-            });
-            const dto = service.convertEntityToResponseDto(entity, false);
-            expect(dto).toEqual(expect.objectContaining({
-                id: entity.id,
-                code: 'user.view',
-                actionType: _enums.ActionType.BACKEND
-            }));
-        });
-    });
-    describe('beforeDeleteOperation', ()=>{
-        function buildQueryRunner(permissionRepo) {
-            return {
-                manager: {
-                    getRepository: jest.fn().mockReturnValue(permissionRepo)
-                }
-            };
-        }
-        it('does nothing when the delete DTO has no ids', async ()=>{
-            const permissionRepo = (0, _repositorymock.createMockRepository)();
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [],
-                type: 'delete'
-            }, (0, _loggedusermock.buildMockUser)(), queryRunner);
-            expect(permissionRepo.find).not.toHaveBeenCalled();
-        });
-        it('cascades role/user/company action-permission cleanup and invalidates affected caches', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
-            const permissionRepo = (0, _repositorymock.createMockRepository)();
-            // Company feature is disabled, so companyActionRows resolves via Promise.resolve([]) and
-            // never calls permissionRepo.find() — only 3 real find() calls happen: role-action,
-            // user-action, then the role -> user cascade lookup.
-            permissionRepo.find.mockResolvedValueOnce([
-                {
-                    sourceId: 'role-1'
-                }
-            ]) // role-action rows referencing the deleted action
-            .mockResolvedValueOnce([
-                {
-                    sourceId: 'user-1'
-                }
-            ]) // direct user-action rows
-            .mockResolvedValueOnce([
-                {
-                    sourceId: 'user-2'
-                }
-            ]); // users holding role-1 (cascaded lookup)
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: 'action-uuid-1',
-                type: 'delete'
-            }, (0, _loggedusermock.buildMockUser)(), queryRunner);
-            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: 'role_action'
-            }));
-            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: 'user_action'
-            }));
-            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: 'company_action'
-            }));
-            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith(expect.arrayContaining([
-                'user-1',
-                'user-2'
-            ]));
-            expect(mockPermissionCacheService.invalidateCompanyMembersCache).not.toHaveBeenCalled();
-        });
-        it('also queries and invalidates company whitelist entries when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            const permissionRepo = (0, _repositorymock.createMockRepository)();
-            permissionRepo.find.mockResolvedValueOnce([]) // role-action rows
-            .mockResolvedValueOnce([]) // direct user-action rows
-            .mockResolvedValueOnce([
-                {
-                    sourceId: 'company-1'
-                }
-            ]); // company-action rows
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [
-                    'action-uuid-1'
-                ],
-                type: 'delete'
-            }, (0, _loggedusermock.buildMockUser)(), queryRunner);
-            expect(mockPermissionCacheService.invalidateCompanyMembersCache).toHaveBeenCalledWith('company-1');
-        });
-        it('does not invalidate any cache when nothing is affected', async ()=>{
-            const permissionRepo = (0, _repositorymock.createMockRepository)();
-            permissionRepo.find.mockResolvedValue([]);
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [
-                    'action-uuid-1'
-                ],
-                type: 'delete'
-            }, (0, _loggedusermock.buildMockUser)(), queryRunner);
-            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
-        });
-        it('rejects deleting a readonly action', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildAction({
-                    readOnly: true
-                })
-            ]);
-            const permissionRepo = (0, _repositorymock.createMockRepository)();
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await expect(service.beforeDeleteOperation({
-                id: 'action-uuid-1',
-                type: 'delete'
-            }, (0, _loggedusermock.buildMockUser)(), queryRunner)).rejects.toThrow('Cannot delete readonly action');
-            expect(permissionRepo.find).not.toHaveBeenCalled();
-        });
-    });
-    describe('beforeUpdateOperation', ()=>{
-        it('rejects updating a readonly action', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildAction({
-                    readOnly: true
-                })
-            ]);
-            await expect(service.beforeUpdateOperation({
-                id: 'action-uuid-1',
-                name: 'Renamed'
-            }, (0, _loggedusermock.buildMockUser)(), {})).rejects.toThrow('Cannot modify readonly action');
-        });
-        it('allows updating a non-readonly action', async ()=>{
-            // The service filters readOnly: true in the query itself, so a non-readonly
-            // action never comes back — simulate that by resolving an empty array.
-            mockRepo.find.mockResolvedValue([]);
-            await expect(service.beforeUpdateOperation({
-                id: 'action-uuid-1',
-                name: 'Renamed'
-            }, (0, _loggedusermock.buildMockUser)(), {})).resolves.toBeUndefined();
-        });
-    });
-});