@flusys/nestjs-iam 7.0.2 → 8.0.0-beta.1

package/fesm/services/action.service.js

@@ -1,327 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
-import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { BadRequestException, ForbiddenException, Inject, Injectable, Scope } from '@nestjs/common';
-import { In, IsNull } from 'typeorm';
-import { ACTION_MESSAGES, IAM_EVENT_ENTITIES, IAM_EVENT_MODULE, PERMISSION_OPERATION_MESSAGES } from '../config';
-import { Action } from '../entities/action.entity';
-import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
-import { UserIamPermission } from '../entities/user-iam-permission.entity';
-import { IamEntityType } from '../enums/iam-entity-type.enum';
-import { IamPermissionType } from '../enums/iam-permission-type.enum';
-import { IAMConfigService } from './iam-config.service';
-import { IAMDataSourceService } from './iam-datasource.service';
-import { PermissionCacheService } from './permission-cache.service';
-import { PermissionService } from './permission.service';
-export class ActionService extends ApiService {
-    async beforeUpdateOperation(dto, _user, _queryRunner) {
-        const dtos = Array.isArray(dto) ? dto : [
-            dto
-        ];
-        const ids = dtos.map((d)=>d.id);
-        await this.ensureDataSourceRepository();
-        const readonlyActions = await this.repository.find({
-            where: {
-                id: In(ids),
-                readOnly: true,
-                deletedAt: IsNull()
-            }
-        });
-        if (readonlyActions.length > 0) {
-            const names = readonlyActions.map((a)=>a.name).join(', ');
-            throw new ForbiddenException({
-                message: `Cannot modify readonly action(s): ${names}`,
-                messageKey: ACTION_MESSAGES.READONLY_UPDATE_FORBIDDEN,
-                messageVariables: {
-                    names
-                }
-            });
-        }
-    }
-    async beforeDeleteOperation(dto, user, queryRunner) {
-        const actionIds = Array.isArray(dto.id) ? dto.id : [
-            dto.id
-        ];
-        if (actionIds.length === 0) {
-            return;
-        }
-        await this.ensureDataSourceRepository();
-        const readonlyActions = await this.repository.find({
-            where: {
-                id: In(actionIds),
-                readOnly: true,
-                deletedAt: IsNull()
-            }
-        });
-        if (readonlyActions.length > 0) {
-            const names = readonlyActions.map((a)=>a.name).join(', ');
-            throw new ForbiddenException({
-                message: `Cannot delete readonly action(s): ${names}`,
-                messageKey: ACTION_MESSAGES.READONLY_DELETE_FORBIDDEN,
-                messageVariables: {
-                    names
-                }
-            });
-        }
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const permissionEntity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
-        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
-        const [roleActionRows, userActionRows, companyActionRows] = await Promise.all([
-            permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.ROLE_ACTION,
-                    sourceType: IamEntityType.ROLE,
-                    targetType: IamEntityType.ACTION,
-                    targetId: In(actionIds)
-                }
-            }),
-            permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.USER_ACTION,
-                    targetType: IamEntityType.ACTION,
-                    targetId: In(actionIds)
-                }
-            }),
-            enableCompanyFeature ? permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.COMPANY_ACTION,
-                    sourceType: IamEntityType.COMPANY,
-                    targetType: IamEntityType.ACTION,
-                    targetId: In(actionIds)
-                }
-            }) : Promise.resolve([])
-        ]);
-        const affectedUserIds = new Set(userActionRows.map((row)=>row.sourceId));
-        const affectedCompanyIds = [
-            ...new Set(companyActionRows.map((row)=>row.sourceId).filter((id)=>!!id))
-        ];
-        const affectedRoleIds = [
-            ...new Set(roleActionRows.map((row)=>row.sourceId))
-        ];
-        if (affectedRoleIds.length > 0) {
-            const userRoleRows = await permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.USER_ROLE,
-                    targetType: IamEntityType.ROLE,
-                    targetId: In(affectedRoleIds)
-                }
-            });
-            userRoleRows.forEach((row)=>affectedUserIds.add(row.sourceId));
-        }
-        await permissionRepo.delete({
-            permissionType: IamPermissionType.ROLE_ACTION,
-            targetType: IamEntityType.ACTION,
-            targetId: In(actionIds)
-        });
-        await permissionRepo.delete({
-            permissionType: IamPermissionType.USER_ACTION,
-            targetType: IamEntityType.ACTION,
-            targetId: In(actionIds)
-        });
-        await permissionRepo.delete({
-            permissionType: IamPermissionType.COMPANY_ACTION,
-            sourceType: IamEntityType.COMPANY,
-            targetType: IamEntityType.ACTION,
-            targetId: In(actionIds)
-        });
-        await Promise.all([
-            affectedUserIds.size > 0 ? this.permissionCacheService.invalidateUsers([
-                ...affectedUserIds
-            ]) : Promise.resolve(),
-            ...affectedCompanyIds.map((companyId)=>this.permissionCacheService.invalidateCompanyMembersCache(companyId))
-        ]);
-    }
-    // Query Customization
-    async getSelectQuery(query, _user, select) {
-        if (!select?.length) {
-            select = [
-                'id',
-                'name',
-                'code',
-                'description',
-                'actionType',
-                'permissionLogic',
-                'isActive',
-                'readOnly',
-                'parentId',
-                'serial',
-                'createdAt'
-            ];
-        }
-        query.select(select.map((f)=>`${this.entityName}.${f}`));
-        return {
-            query,
-            isRaw: false
-        };
-    }
-    async getGlobalSearchQuery(query, search) {
-        query.andWhere('(action.name LIKE :search OR action.code LIKE :search OR action.description LIKE :search)', {
-            search: `%${search}%`
-        });
-        return {
-            query,
-            isRaw: false
-        };
-    }
-    // Response Conversion
-    convertEntityToResponseDto(entity, _isRaw) {
-        return {
-            id: entity.id,
-            readOnly: entity.readOnly,
-            name: entity.name,
-            description: entity.description,
-            code: entity.code,
-            actionType: entity.actionType,
-            permissionLogic: entity.permissionLogic,
-            serial: entity.serial,
-            isActive: entity.isActive,
-            parentId: entity.parentId,
-            createdAt: entity.createdAt,
-            updatedAt: entity.updatedAt,
-            deletedAt: entity.deletedAt,
-            createdById: entity.createdById,
-            updatedById: entity.updatedById,
-            deletedById: entity.deletedById
-        };
-    }
-    requireUser(user, methodName) {
-        if (!user) {
-            throw new BadRequestException({
-                message: `User is required for ${methodName}`,
-                messageKey: PERMISSION_OPERATION_MESSAGES.USER_REQUIRED,
-                messageVariables: {
-                    method: methodName
-                }
-            });
-        }
-    }
-    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user, companyId) {
-        await this.ensureDataSourceRepository();
-        this.requireUser(user, 'getActionsForPermission');
-        let whereClause = {};
-        const targetCompanyId = companyId || user.companyId;
-        if (this.iamConfigService.isCompanyFeatureEnabled() && targetCompanyId) {
-            const companyActionIds = await this.permissionService.getCompanyActions(targetCompanyId, true);
-            if (companyActionIds.length === 0) {
-                return [];
-            }
-            whereClause = {
-                id: In(companyActionIds)
-            };
-        }
-        const actions = await this.repository.find({
-            where: whereClause,
-            select: this.actionSelectFields
-        });
-        return actions.map((action)=>this.convertEntityToResponseDto(action, false));
-    }
-    /** Get actions in hierarchical tree structure */ async getActionTree(user, search, isActive, withDeleted = false) {
-        await this.ensureDataSourceRepository();
-        this.requireUser(user, 'getActionTree');
-        const query = this.repository.createQueryBuilder('action');
-        if (!withDeleted) {
-            query.andWhere('action.deletedAt IS NULL');
-        }
-        if (isActive !== undefined) {
-            query.andWhere('action.isActive = :isActive', {
-                isActive
-            });
-        }
-        if (search?.trim()) {
-            query.andWhere('(action.name LIKE :search OR action.code LIKE :search)', {
-                search: `%${search.trim()}%`
-            });
-        }
-        const actions = await query.orderBy('action.serial', 'ASC').getMany();
-        return this.buildActionTree(actions);
-    }
-    buildActionTree(actions) {
-        if (!actions?.length) {
-            return [];
-        }
-        const map = new Map();
-        const rootNodes = [];
-        for (const action of actions){
-            const treeNode = {
-                ...this.convertEntityToResponseDto(action, false),
-                children: []
-            };
-            map.set(action.id, treeNode);
-        }
-        for (const action of actions){
-            const node = map.get(action.id);
-            if (!node) {
-                continue;
-            }
-            if (action.parentId && map.has(action.parentId)) {
-                const parent = map.get(action.parentId);
-                if (parent?.children) {
-                    parent.children.push(node);
-                }
-            } else {
-                rootNodes.push(node);
-            }
-        }
-        return rootNodes;
-    }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService, permissionCacheService){
-        super(IAM_EVENT_ENTITIES.ACTION, cacheManager, utilsService, ActionService.name, true, IAM_EVENT_MODULE, dataSourceProvider, Action), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionService", void 0), _define_property(this, "permissionCacheService", void 0), // Custom Methods
-        _define_property(this, "actionSelectFields", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.permissionCacheService = permissionCacheService, this.actionSelectFields = [
-            'id',
-            'code',
-            'name',
-            'description',
-            'actionType',
-            'permissionLogic',
-            'isActive',
-            'parentId',
-            'serial'
-        ];
-    }
-}
-ActionService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Inject('CACHE_INSTANCE')),
-    _ts_param(1, Inject(UtilsService)),
-    _ts_param(2, Inject(IAMConfigService)),
-    _ts_param(3, Inject(IAMDataSourceService)),
-    _ts_param(4, Inject(PermissionService)),
-    _ts_param(5, Inject(PermissionCacheService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof HybridCache === "undefined" ? Object : HybridCache,
-        typeof UtilsService === "undefined" ? Object : UtilsService,
-        typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
-        typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService,
-        typeof PermissionService === "undefined" ? Object : PermissionService,
-        typeof PermissionCacheService === "undefined" ? Object : PermissionCacheService
-    ])
-], ActionService);

package/fesm/services/action.service.spec.js

@@ -1,347 +0,0 @@
-import { Test } from '@nestjs/testing';
-import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
-import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
-import { ActionType } from '../enums';
-import { ActionService } from './action.service';
-import { IAMConfigService } from './iam-config.service';
-import { IAMDataSourceService } from './iam-datasource.service';
-import { PermissionCacheService } from './permission-cache.service';
-import { PermissionService } from './permission.service';
-function buildAction(overrides = {}) {
-    return {
-        id: 'action-uuid-1',
-        readOnly: false,
-        name: 'View Products',
-        description: null,
-        code: 'products.read',
-        actionType: ActionType.BACKEND,
-        permissionLogic: null,
-        serial: 1,
-        isActive: true,
-        parentId: null,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        deletedAt: null,
-        createdById: null,
-        updatedById: null,
-        deletedById: null,
-        ...overrides
-    };
-}
-describe('ActionService', ()=>{
-    let service;
-    let mockRepo;
-    let mockIamConfigService;
-    let mockPermissionService;
-    let mockPermissionCacheService;
-    beforeEach(async ()=>{
-        mockRepo = createMockRepository();
-        mockRepo.find.mockResolvedValue([]);
-        const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
-        mockIamConfigService = {
-            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
-        };
-        mockPermissionService = {
-            getCompanyActions: jest.fn()
-        };
-        mockPermissionCacheService = {
-            invalidateUsers: jest.fn(),
-            invalidateCompanyMembersCache: jest.fn()
-        };
-        const module = await Test.createTestingModule({
-            providers: [
-                ActionService,
-                {
-                    provide: 'CACHE_INSTANCE',
-                    useValue: {}
-                },
-                {
-                    provide: UtilsService,
-                    useValue: {}
-                },
-                {
-                    provide: IAMConfigService,
-                    useValue: mockIamConfigService
-                },
-                {
-                    provide: IAMDataSourceService,
-                    useValue: mockDataSourceProvider
-                },
-                {
-                    provide: PermissionService,
-                    useValue: mockPermissionService
-                },
-                {
-                    provide: PermissionCacheService,
-                    useValue: mockPermissionCacheService
-                }
-            ]
-        }).compile();
-        service = await module.resolve(ActionService);
-    });
-    describe('getActionsForPermission', ()=>{
-        it('returns all actions when the company feature is disabled', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildAction()
-            ]);
-            const result = await service.getActionsForPermission(buildMockUser());
-            expect(mockPermissionService.getCompanyActions).not.toHaveBeenCalled();
-            expect(result).toHaveLength(1);
-            expect(result[0].code).toBe('products.read');
-        });
-        it('scopes actions to the company whitelist when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionService.getCompanyActions.mockResolvedValue([
-                'action-uuid-1'
-            ]);
-            mockRepo.find.mockResolvedValue([
-                buildAction()
-            ]);
-            await service.getActionsForPermission(buildMockUser(), 'company-uuid-1');
-            expect(mockPermissionService.getCompanyActions).toHaveBeenCalledWith('company-uuid-1', true);
-            expect(mockRepo.find).toHaveBeenCalledWith(expect.objectContaining({
-                where: {
-                    id: expect.anything()
-                }
-            }));
-        });
-        it('short-circuits without querying when the company has no whitelisted actions', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionService.getCompanyActions.mockResolvedValue([]);
-            const result = await service.getActionsForPermission(buildMockUser(), 'company-uuid-1');
-            expect(result).toEqual([]);
-            expect(mockRepo.find).not.toHaveBeenCalled();
-        });
-        it('throws when no user is provided', async ()=>{
-            await expect(service.getActionsForPermission(null)).rejects.toThrow();
-        });
-    });
-    describe('getActionTree', ()=>{
-        it('nests child actions under their parent', async ()=>{
-            const parent = buildAction({
-                id: 'parent-1',
-                parentId: null,
-                serial: 1
-            });
-            const child = buildAction({
-                id: 'child-1',
-                parentId: 'parent-1',
-                serial: 2,
-                code: 'products.create'
-            });
-            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
-                parent,
-                child
-            ]);
-            const tree = await service.getActionTree(buildMockUser());
-            expect(tree).toHaveLength(1);
-            expect(tree[0].id).toBe('parent-1');
-            expect(tree[0].children).toHaveLength(1);
-            expect(tree[0].children?.[0].id).toBe('child-1');
-        });
-        it('throws when no user is provided', async ()=>{
-            await expect(service.getActionTree(null)).rejects.toThrow();
-        });
-        it('treats an action with a missing/unknown parentId as a root node', async ()=>{
-            const orphan = buildAction({
-                id: 'orphan-1',
-                parentId: 'does-not-exist'
-            });
-            mockRepo.createQueryBuilder().getMany.mockResolvedValue([
-                orphan
-            ]);
-            const tree = await service.getActionTree(buildMockUser());
-            expect(tree).toHaveLength(1);
-            expect(tree[0].id).toBe('orphan-1');
-        });
-        it('excludes soft-deleted actions by default and applies search/isActive filters', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            query.getMany.mockResolvedValue([]);
-            await service.getActionTree(buildMockUser(), 'view', true, false);
-            expect(query.andWhere).toHaveBeenCalledWith('action.deletedAt IS NULL');
-            expect(query.andWhere).toHaveBeenCalledWith('action.isActive = :isActive', {
-                isActive: true
-            });
-            expect(query.andWhere).toHaveBeenCalledWith('(action.name LIKE :search OR action.code LIKE :search)', {
-                search: '%view%'
-            });
-        });
-        it('includes soft-deleted actions when withDeleted is true', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            query.getMany.mockResolvedValue([]);
-            await service.getActionTree(buildMockUser(), undefined, undefined, true);
-            expect(query.andWhere).not.toHaveBeenCalledWith('action.deletedAt IS NULL');
-        });
-    });
-    describe('getSelectQuery', ()=>{
-        it('selects the default field set when none is provided', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(query, buildMockUser());
-            expect(query.select).toHaveBeenCalledWith(expect.arrayContaining([
-                'action.code',
-                'action.actionType',
-                'action.permissionLogic'
-            ]));
-        });
-        it('uses the explicitly provided select list as-is', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(query, buildMockUser(), [
-                'id',
-                'code'
-            ]);
-            expect(query.select).toHaveBeenCalledWith([
-                'action.id',
-                'action.code'
-            ]);
-        });
-    });
-    describe('getGlobalSearchQuery', ()=>{
-        it('filters by name, code, or description', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            await service.getGlobalSearchQuery(query, 'view');
-            expect(query.andWhere).toHaveBeenCalledWith('(action.name LIKE :search OR action.code LIKE :search OR action.description LIKE :search)', {
-                search: '%view%'
-            });
-        });
-    });
-    describe('convertEntityToResponseDto', ()=>{
-        it('maps every entity field onto the response shape', ()=>{
-            const entity = buildAction({
-                code: 'user.view'
-            });
-            const dto = service.convertEntityToResponseDto(entity, false);
-            expect(dto).toEqual(expect.objectContaining({
-                id: entity.id,
-                code: 'user.view',
-                actionType: ActionType.BACKEND
-            }));
-        });
-    });
-    describe('beforeDeleteOperation', ()=>{
-        function buildQueryRunner(permissionRepo) {
-            return {
-                manager: {
-                    getRepository: jest.fn().mockReturnValue(permissionRepo)
-                }
-            };
-        }
-        it('does nothing when the delete DTO has no ids', async ()=>{
-            const permissionRepo = createMockRepository();
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [],
-                type: 'delete'
-            }, buildMockUser(), queryRunner);
-            expect(permissionRepo.find).not.toHaveBeenCalled();
-        });
-        it('cascades role/user/company action-permission cleanup and invalidates affected caches', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
-            const permissionRepo = createMockRepository();
-            // Company feature is disabled, so companyActionRows resolves via Promise.resolve([]) and
-            // never calls permissionRepo.find() — only 3 real find() calls happen: role-action,
-            // user-action, then the role -> user cascade lookup.
-            permissionRepo.find.mockResolvedValueOnce([
-                {
-                    sourceId: 'role-1'
-                }
-            ]) // role-action rows referencing the deleted action
-            .mockResolvedValueOnce([
-                {
-                    sourceId: 'user-1'
-                }
-            ]) // direct user-action rows
-            .mockResolvedValueOnce([
-                {
-                    sourceId: 'user-2'
-                }
-            ]); // users holding role-1 (cascaded lookup)
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: 'action-uuid-1',
-                type: 'delete'
-            }, buildMockUser(), queryRunner);
-            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: 'role_action'
-            }));
-            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: 'user_action'
-            }));
-            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: 'company_action'
-            }));
-            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith(expect.arrayContaining([
-                'user-1',
-                'user-2'
-            ]));
-            expect(mockPermissionCacheService.invalidateCompanyMembersCache).not.toHaveBeenCalled();
-        });
-        it('also queries and invalidates company whitelist entries when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            const permissionRepo = createMockRepository();
-            permissionRepo.find.mockResolvedValueOnce([]) // role-action rows
-            .mockResolvedValueOnce([]) // direct user-action rows
-            .mockResolvedValueOnce([
-                {
-                    sourceId: 'company-1'
-                }
-            ]); // company-action rows
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [
-                    'action-uuid-1'
-                ],
-                type: 'delete'
-            }, buildMockUser(), queryRunner);
-            expect(mockPermissionCacheService.invalidateCompanyMembersCache).toHaveBeenCalledWith('company-1');
-        });
-        it('does not invalidate any cache when nothing is affected', async ()=>{
-            const permissionRepo = createMockRepository();
-            permissionRepo.find.mockResolvedValue([]);
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [
-                    'action-uuid-1'
-                ],
-                type: 'delete'
-            }, buildMockUser(), queryRunner);
-            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
-        });
-        it('rejects deleting a readonly action', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildAction({
-                    readOnly: true
-                })
-            ]);
-            const permissionRepo = createMockRepository();
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await expect(service.beforeDeleteOperation({
-                id: 'action-uuid-1',
-                type: 'delete'
-            }, buildMockUser(), queryRunner)).rejects.toThrow('Cannot delete readonly action');
-            expect(permissionRepo.find).not.toHaveBeenCalled();
-        });
-    });
-    describe('beforeUpdateOperation', ()=>{
-        it('rejects updating a readonly action', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildAction({
-                    readOnly: true
-                })
-            ]);
-            await expect(service.beforeUpdateOperation({
-                id: 'action-uuid-1',
-                name: 'Renamed'
-            }, buildMockUser(), {})).rejects.toThrow('Cannot modify readonly action');
-        });
-        it('allows updating a non-readonly action', async ()=>{
-            // The service filters readOnly: true in the query itself, so a non-readonly
-            // action never comes back — simulate that by resolving an empty array.
-            mockRepo.find.mockResolvedValue([]);
-            await expect(service.beforeUpdateOperation({
-                id: 'action-uuid-1',
-                name: 'Renamed'
-            }, buildMockUser(), {})).resolves.toBeUndefined();
-        });
-    });
-});