@flusys/nestjs-iam 7.0.2 → 8.0.0-beta.1

package/fesm/controllers/role-permission.controller.js

@@ -1,181 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { ApiResponseDto, CurrentUser, ILoggedUserInfo, JwtAuthGuard, PermissionGuard, RequirePermission, ROLE_ACTION_PERMISSIONS, USER_ROLE_PERMISSIONS } from '@flusys/nestjs-shared';
-import { Body, Controller, Inject, Post, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiBody, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { PERMISSION_OPERATION_MESSAGES, ROLE_PERMISSION_MESSAGES } from '../config';
-import { AssignRoleActionsDto, AssignUserRolesDto, GetRoleActionsDto, GetUserRolesDto, PermissionOperationResultDto, RoleActionResponseDto, UserRoleResponseDto } from '../dtos/permission.dto';
-import { validateCompanyAccess } from '../helpers';
-import { IAMConfigService } from '../services/iam-config.service';
-import { PermissionService } from '../services/permission.service';
-export class RolePermissionController {
-    async assignRoleActions(dto) {
-        const result = await this.permissionService.assignRoleActions(dto);
-        return {
-            success: true,
-            message: 'Role actions updated successfully',
-            messageKey: PERMISSION_OPERATION_MESSAGES.PROCESS_SUCCESS,
-            messageVariables: {
-                added: result.added,
-                removed: result.removed,
-                total: result.total
-            },
-            data: result
-        };
-    }
-    async getRoleActions(dto) {
-        const actions = await this.permissionService.getRoleActions(dto.roleId);
-        return {
-            success: true,
-            message: 'Role actions retrieved successfully',
-            messageKey: ROLE_PERMISSION_MESSAGES.ACTIONS_SUCCESS,
-            data: actions
-        };
-    }
-    async assignUserRoles(dto, user) {
-        validateCompanyAccess(this.config, dto.companyId, user);
-        const result = await this.permissionService.assignUserRoles(dto);
-        return {
-            success: true,
-            message: 'User roles updated successfully',
-            messageKey: PERMISSION_OPERATION_MESSAGES.PROCESS_SUCCESS,
-            messageVariables: {
-                added: result.added,
-                removed: result.removed,
-                total: result.total
-            },
-            data: result
-        };
-    }
-    async getUserRoles(dto, user) {
-        validateCompanyAccess(this.config, dto.companyId, user);
-        const roles = await this.permissionService.getUserRoles(dto.userId, dto.branchId, dto.companyId);
-        return {
-            success: true,
-            message: 'User roles retrieved successfully',
-            messageKey: ROLE_PERMISSION_MESSAGES.USER_ROLES_SUCCESS,
-            data: roles
-        };
-    }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(permissionService, config){
-        _define_property(this, "permissionService", void 0);
-        _define_property(this, "config", void 0);
-        this.permissionService = permissionService;
-        this.config = config;
-    }
-}
-_ts_decorate([
-    Post('role-actions/assign'),
-    RequirePermission(ROLE_ACTION_PERMISSIONS.ASSIGN),
-    ApiOperation({
-        summary: 'Assign/remove actions to/from role',
-        description: 'RBAC mode. No branch scoping.'
-    }),
-    ApiResponseDto(PermissionOperationResultDto),
-    ApiBody({
-        type: AssignRoleActionsDto
-    }),
-    _ts_param(0, Body()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AssignRoleActionsDto === "undefined" ? Object : AssignRoleActionsDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], RolePermissionController.prototype, "assignRoleActions", null);
-_ts_decorate([
-    Post('get-role-actions'),
-    RequirePermission(ROLE_ACTION_PERMISSIONS.READ),
-    ApiOperation({
-        summary: 'Get role actions',
-        description: 'Returns actions assigned to role.'
-    }),
-    ApiResponseDto(RoleActionResponseDto, true, 'single'),
-    ApiBody({
-        type: GetRoleActionsDto
-    }),
-    _ts_param(0, Body()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof GetRoleActionsDto === "undefined" ? Object : GetRoleActionsDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], RolePermissionController.prototype, "getRoleActions", null);
-_ts_decorate([
-    Post('user-roles/assign'),
-    RequirePermission(USER_ROLE_PERMISSIONS.ASSIGN),
-    ApiOperation({
-        summary: 'Assign/remove roles to/from user',
-        description: 'RBAC mode. If company feature enabled, branchId is required.'
-    }),
-    ApiResponseDto(PermissionOperationResultDto),
-    ApiBody({
-        type: AssignUserRolesDto
-    }),
-    _ts_param(0, Body()),
-    _ts_param(1, CurrentUser()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AssignUserRolesDto === "undefined" ? Object : AssignUserRolesDto,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], RolePermissionController.prototype, "assignUserRoles", null);
-_ts_decorate([
-    Post('get-user-roles'),
-    RequirePermission(USER_ROLE_PERMISSIONS.READ),
-    ApiOperation({
-        summary: 'Get user roles',
-        description: 'Returns roles assigned to user. Filter by companyId and branchId.'
-    }),
-    ApiResponseDto(UserRoleResponseDto, true, 'single'),
-    ApiBody({
-        type: GetUserRolesDto
-    }),
-    _ts_param(0, Body()),
-    _ts_param(1, CurrentUser()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof GetUserRolesDto === "undefined" ? Object : GetUserRolesDto,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], RolePermissionController.prototype, "getUserRoles", null);
-RolePermissionController = _ts_decorate([
-    ApiTags('IAM - Role Permissions'),
-    Controller('iam/permissions'),
-    UseGuards(JwtAuthGuard, PermissionGuard),
-    ApiBearerAuth(),
-    _ts_param(0, Inject(PermissionService)),
-    _ts_param(1, Inject(IAMConfigService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof PermissionService === "undefined" ? Object : PermissionService,
-        typeof IAMConfigService === "undefined" ? Object : IAMConfigService
-    ])
-], RolePermissionController);

package/fesm/controllers/role-permission.controller.spec.js

@@ -1,136 +0,0 @@
-import { ForbiddenException } from '@nestjs/common';
-import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
-import { RolePermissionController } from './role-permission.controller';
-describe('RolePermissionController', ()=>{
-    let controller;
-    let mockPermissionService;
-    let mockConfig;
-    beforeEach(()=>{
-        mockPermissionService = {
-            assignRoleActions: jest.fn(),
-            getRoleActions: jest.fn(),
-            assignUserRoles: jest.fn(),
-            getUserRoles: jest.fn()
-        };
-        mockConfig = {
-            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
-        };
-        controller = new RolePermissionController(mockPermissionService, mockConfig);
-    });
-    describe('assignRoleActions', ()=>{
-        it('assigns actions to a role and returns the operation summary', async ()=>{
-            mockPermissionService.assignRoleActions.mockResolvedValue({
-                added: 2,
-                removed: 1,
-                total: 3
-            });
-            const result = await controller.assignRoleActions({
-                roleId: 'role-1',
-                actionIds: [
-                    'action-1',
-                    'action-2'
-                ]
-            });
-            expect(mockPermissionService.assignRoleActions).toHaveBeenCalledWith({
-                roleId: 'role-1',
-                actionIds: [
-                    'action-1',
-                    'action-2'
-                ]
-            });
-            expect(result.success).toBe(true);
-            expect(result.data).toEqual({
-                added: 2,
-                removed: 1,
-                total: 3
-            });
-        });
-    });
-    describe('getRoleActions', ()=>{
-        it('returns actions assigned to the role', async ()=>{
-            mockPermissionService.getRoleActions.mockResolvedValue([
-                {
-                    actionId: 'action-1'
-                }
-            ]);
-            const result = await controller.getRoleActions({
-                roleId: 'role-1'
-            });
-            expect(mockPermissionService.getRoleActions).toHaveBeenCalledWith('role-1');
-            expect(result.data).toEqual([
-                {
-                    actionId: 'action-1'
-                }
-            ]);
-        });
-    });
-    describe('assignUserRoles', ()=>{
-        it('assigns roles to a user when the caller has access to the target company', async ()=>{
-            mockConfig.isCompanyFeatureEnabled.mockReturnValue(true);
-            const user = buildMockUser({
-                companyId: 'company-1'
-            });
-            mockPermissionService.assignUserRoles.mockResolvedValue({
-                added: 1,
-                removed: 0,
-                total: 1
-            });
-            const result = await controller.assignUserRoles({
-                userId: 'user-2',
-                roleIds: [
-                    'role-1'
-                ],
-                companyId: 'company-1'
-            }, user);
-            expect(mockPermissionService.assignUserRoles).toHaveBeenCalledWith({
-                userId: 'user-2',
-                roleIds: [
-                    'role-1'
-                ],
-                companyId: 'company-1'
-            });
-            expect(result.data).toEqual({
-                added: 1,
-                removed: 0,
-                total: 1
-            });
-        });
-        it('rejects assignment when the caller has no access to the target company', async ()=>{
-            mockConfig.isCompanyFeatureEnabled.mockReturnValue(true);
-            const user = buildMockUser({
-                companyId: 'company-1'
-            });
-            await expect(controller.assignUserRoles({
-                userId: 'user-2',
-                roleIds: [
-                    'role-1'
-                ],
-                companyId: 'company-2'
-            }, user)).rejects.toThrow(ForbiddenException);
-            expect(mockPermissionService.assignUserRoles).not.toHaveBeenCalled();
-        });
-    });
-    describe('getUserRoles', ()=>{
-        it('returns roles assigned to the user scoped by branch and company', async ()=>{
-            const user = buildMockUser({
-                companyId: 'company-1'
-            });
-            mockPermissionService.getUserRoles.mockResolvedValue([
-                {
-                    roleId: 'role-1'
-                }
-            ]);
-            const result = await controller.getUserRoles({
-                userId: 'user-2',
-                branchId: 'branch-1',
-                companyId: 'company-1'
-            }, user);
-            expect(mockPermissionService.getUserRoles).toHaveBeenCalledWith('user-2', 'branch-1', 'company-1');
-            expect(result.data).toEqual([
-                {
-                    roleId: 'role-1'
-                }
-            ]);
-        });
-    });
-});

package/fesm/controllers/role.controller.js

@@ -1,92 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { createApiController, ROLE_PERMISSIONS } from '@flusys/nestjs-shared';
-import { Controller, Inject } from '@nestjs/common';
-import { ApiTags } from '@nestjs/swagger';
-import { CreateRoleDto, RoleResponseDto, UpdateRoleDto } from '../dtos/role.dto';
-import { RoleService } from '../services/role.service';
-export class RoleController extends createApiController(CreateRoleDto, UpdateRoleDto, RoleResponseDto, {
-    entityName: 'role',
-    security: {
-        insert: {
-            level: 'permission',
-            permissions: [
-                ROLE_PERMISSIONS.CREATE
-            ]
-        },
-        insertMany: {
-            level: 'permission',
-            permissions: [
-                ROLE_PERMISSIONS.CREATE
-            ]
-        },
-        getById: {
-            level: 'permission',
-            permissions: [
-                ROLE_PERMISSIONS.READ
-            ]
-        },
-        getAll: {
-            level: 'permission',
-            permissions: [
-                ROLE_PERMISSIONS.READ
-            ]
-        },
-        update: {
-            level: 'permission',
-            permissions: [
-                ROLE_PERMISSIONS.UPDATE
-            ]
-        },
-        updateMany: {
-            level: 'permission',
-            permissions: [
-                ROLE_PERMISSIONS.UPDATE
-            ]
-        },
-        delete: {
-            level: 'permission',
-            permissions: [
-                ROLE_PERMISSIONS.DELETE
-            ]
-        }
-    }
-}) {
-    constructor(roleService){
-        super(roleService), _define_property(this, "roleService", void 0), this.roleService = roleService;
-    }
-}
-RoleController = _ts_decorate([
-    ApiTags('IAM - Roles'),
-    Controller('iam/roles'),
-    _ts_param(0, Inject(RoleService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof RoleService === "undefined" ? Object : RoleService
-    ])
-], RoleController);

package/fesm/controllers/role.controller.spec.js

@@ -1,82 +0,0 @@
-import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
-import { RoleController } from './role.controller';
-function buildRole(overrides = {}) {
-    return {
-        id: 'role-1',
-        name: 'Admin',
-        description: null,
-        isActive: true,
-        readOnly: false,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        ...overrides
-    };
-}
-describe('RoleController', ()=>{
-    let controller;
-    let mockRoleService;
-    beforeEach(()=>{
-        mockRoleService = {
-            insert: jest.fn(),
-            findById: jest.fn(),
-            getAll: jest.fn(),
-            update: jest.fn(),
-            delete: jest.fn()
-        };
-        controller = new RoleController(mockRoleService);
-    });
-    it('wires the injected service onto the generated controller base', ()=>{
-        expect(controller.roleService).toBe(mockRoleService);
-        expect(controller.service).toBe(mockRoleService);
-    });
-    describe('insert', ()=>{
-        it('creates a role and returns the mapped response', async ()=>{
-            const user = buildMockUser();
-            mockRoleService.insert.mockResolvedValue(buildRole());
-            const result = await controller.insert({
-                name: 'Admin'
-            }, user);
-            expect(mockRoleService.insert).toHaveBeenCalledWith({
-                name: 'Admin'
-            }, user);
-            expect(result.success).toBe(true);
-            expect(result.data).toEqual(expect.objectContaining({
-                id: 'role-1',
-                name: 'Admin'
-            }));
-        });
-    });
-    describe('getAll', ()=>{
-        it('paginates roles and maps the response list', async ()=>{
-            mockRoleService.getAll.mockResolvedValue({
-                data: [
-                    buildRole()
-                ],
-                total: 1
-            });
-            const result = await controller.getAll({}, buildMockUser(), '');
-            expect(mockRoleService.getAll).toHaveBeenCalledWith('', {}, buildMockUser());
-            expect(result.data).toHaveLength(1);
-        });
-    });
-    describe('delete', ()=>{
-        it('delegates soft-delete to the service', async ()=>{
-            mockRoleService.delete.mockResolvedValue({
-                count: 1
-            });
-            const result = await controller.delete({
-                id: [
-                    'role-1'
-                ],
-                type: 'delete'
-            }, buildMockUser());
-            expect(mockRoleService.delete).toHaveBeenCalledWith({
-                id: [
-                    'role-1'
-                ],
-                type: 'delete'
-            }, buildMockUser());
-            expect(result.success).toBe(true);
-        });
-    });
-});

package/fesm/controllers/user-action-permission.controller.js

@@ -1,119 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { ApiResponseDto, CurrentUser, ILoggedUserInfo, JwtAuthGuard, PermissionGuard, RequirePermission, USER_ACTION_PERMISSIONS } from '@flusys/nestjs-shared';
-import { Body, Controller, Inject, Post, UseGuards } from '@nestjs/common';
-import { ApiBearerAuth, ApiBody, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { PERMISSION_OPERATION_MESSAGES, USER_ACTION_PERMISSION_MESSAGES } from '../config';
-import { AssignUserActionsDto, GetUserActionsDto, PermissionOperationResultDto, UserActionResponseDto } from '../dtos/permission.dto';
-import { IAMConfigService } from '../services/iam-config.service';
-import { PermissionService } from '../services/permission.service';
-export class UserActionPermissionController {
-    async assignUserActions(dto, user) {
-        const result = await this.permissionService.assignUserActions(dto);
-        return {
-            success: true,
-            message: 'User actions updated successfully',
-            messageKey: PERMISSION_OPERATION_MESSAGES.PROCESS_SUCCESS,
-            messageVariables: {
-                added: result.added,
-                removed: result.removed,
-                total: result.total
-            },
-            data: result
-        };
-    }
-    async getUserActions(dto, user) {
-        const actions = await this.permissionService.getUserActions(dto.userId, dto.companyId, dto.branchId);
-        return {
-            success: true,
-            message: 'User actions retrieved successfully',
-            messageKey: USER_ACTION_PERMISSION_MESSAGES.GET_SUCCESS,
-            data: actions
-        };
-    }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(permissionService, config){
-        _define_property(this, "permissionService", void 0);
-        _define_property(this, "config", void 0);
-        this.permissionService = permissionService;
-        this.config = config;
-    }
-}
-_ts_decorate([
-    Post('user-actions/assign'),
-    RequirePermission(USER_ACTION_PERMISSIONS.ASSIGN),
-    ApiOperation({
-        summary: 'Assign/remove actions to/from user',
-        description: 'Direct permissions. If company feature enabled, branchId is required.'
-    }),
-    ApiResponseDto(PermissionOperationResultDto),
-    ApiBody({
-        type: AssignUserActionsDto
-    }),
-    _ts_param(0, Body()),
-    _ts_param(1, CurrentUser()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AssignUserActionsDto === "undefined" ? Object : AssignUserActionsDto,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], UserActionPermissionController.prototype, "assignUserActions", null);
-_ts_decorate([
-    Post('get-user-actions'),
-    RequirePermission(USER_ACTION_PERMISSIONS.READ),
-    ApiOperation({
-        summary: 'Get user direct actions',
-        description: 'Returns direct action permissions for user. Filter by companyId and branchId.'
-    }),
-    ApiResponseDto(UserActionResponseDto, true, 'single'),
-    ApiBody({
-        type: GetUserActionsDto
-    }),
-    _ts_param(0, Body()),
-    _ts_param(1, CurrentUser()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof GetUserActionsDto === "undefined" ? Object : GetUserActionsDto,
-        typeof ILoggedUserInfo === "undefined" ? Object : ILoggedUserInfo
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], UserActionPermissionController.prototype, "getUserActions", null);
-UserActionPermissionController = _ts_decorate([
-    ApiTags('IAM - User Action Permissions'),
-    Controller('iam/permissions'),
-    UseGuards(JwtAuthGuard, PermissionGuard),
-    ApiBearerAuth(),
-    _ts_param(0, Inject(PermissionService)),
-    _ts_param(1, Inject(IAMConfigService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof PermissionService === "undefined" ? Object : PermissionService,
-        typeof IAMConfigService === "undefined" ? Object : IAMConfigService
-    ])
-], UserActionPermissionController);

package/fesm/controllers/user-action-permission.controller.spec.js

@@ -1,64 +0,0 @@
-import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
-import { UserActionPermissionController } from './user-action-permission.controller';
-describe('UserActionPermissionController', ()=>{
-    let controller;
-    let mockPermissionService;
-    let mockConfig;
-    beforeEach(()=>{
-        mockPermissionService = {
-            assignUserActions: jest.fn(),
-            getUserActions: jest.fn()
-        };
-        mockConfig = {};
-        controller = new UserActionPermissionController(mockPermissionService, mockConfig);
-    });
-    describe('assignUserActions', ()=>{
-        it('assigns direct action permissions to a user', async ()=>{
-            const user = buildMockUser();
-            mockPermissionService.assignUserActions.mockResolvedValue({
-                added: 1,
-                removed: 0,
-                total: 1
-            });
-            const result = await controller.assignUserActions({
-                userId: 'user-2',
-                actionIds: [
-                    'action-1'
-                ]
-            }, user);
-            expect(mockPermissionService.assignUserActions).toHaveBeenCalledWith({
-                userId: 'user-2',
-                actionIds: [
-                    'action-1'
-                ]
-            });
-            expect(result.success).toBe(true);
-            expect(result.data).toEqual({
-                added: 1,
-                removed: 0,
-                total: 1
-            });
-        });
-    });
-    describe('getUserActions', ()=>{
-        it('returns direct action permissions for a user scoped by branch/company', async ()=>{
-            const user = buildMockUser();
-            mockPermissionService.getUserActions.mockResolvedValue([
-                {
-                    actionId: 'action-1'
-                }
-            ]);
-            const result = await controller.getUserActions({
-                userId: 'user-2',
-                branchId: 'branch-1',
-                companyId: 'company-1'
-            }, user);
-            expect(mockPermissionService.getUserActions).toHaveBeenCalledWith('user-2', 'company-1', 'branch-1');
-            expect(result.data).toEqual([
-                {
-                    actionId: 'action-1'
-                }
-            ]);
-        });
-    });
-});