@flusys/nestjs-iam 7.0.2 → 8.0.0-beta.1

package/fesm/services/permission.service.js

@@ -1,904 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { LogAction } from '@flusys/nestjs-shared';
-import { publishDomainEvent } from '@flusys/nestjs-shared/classes';
-import { BadRequestException, ConflictException, Inject, Injectable, Scope } from '@nestjs/common';
-import { In, IsNull } from 'typeorm';
-import { IAM_EVENT_ACTIONS, IAM_EVENT_ENTITIES, IAM_EVENT_MODULE, IAM_MODE_MESSAGES, PERMISSION_OPERATION_MESSAGES } from '../config';
-import { AssignCompanyActionsDto, AssignRoleActionsDto, AssignUserActionsDto, AssignUserRolesDto, PermissionAction } from '../dtos/permission.dto';
-import { Action } from '../entities/action.entity';
-import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
-import { RoleWithCompany } from '../entities/role-with-company.entity';
-import { Role } from '../entities/role.entity';
-import { UserIamPermission } from '../entities/user-iam-permission.entity';
-import { IamEntityType } from '../enums/iam-entity-type.enum';
-import { IamPermissionType } from '../enums/iam-permission-type.enum';
-import { IAMConfigService } from './iam-config.service';
-import { IAMDataSourceService } from './iam-datasource.service';
-import { PermissionCacheService } from './permission-cache.service';
-export class PermissionService {
-    // Repository Getters
-    async getPermissionRepository() {
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const entity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
-        return this.dataSourceProvider.getRepository(entity);
-    }
-    async getActionRepository() {
-        return this.dataSourceProvider.getRepository(Action);
-    }
-    async getRoleRepository() {
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const entity = enableCompanyFeature ? RoleWithCompany : Role;
-        return this.dataSourceProvider.getRepository(entity);
-    }
-    async getActionsMap(actionIds) {
-        const actionRepo = await this.getActionRepository();
-        const actions = await actionRepo.find({
-            where: {
-                id: In(actionIds)
-            }
-        });
-        return new Map(actions.map((a)=>[
-                a.id,
-                a
-            ]));
-    }
-    // User-Action Permissions
-    async assignUserActions(dto) {
-        if (!this.iamConfigService.isDirectPermissionEnabled()) {
-            throw new BadRequestException({
-                message: 'Direct permission assignment not available in RBAC-only mode. Use role-based permissions instead.',
-                messageKey: IAM_MODE_MESSAGES.DIRECT_MODE_UNAVAILABLE
-            });
-        }
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const branchId = dto.branchId ?? null;
-        const companyId = dto.companyId ?? null;
-        const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
-        let added = 0;
-        let removed = 0;
-        if (itemsToAdd.length > 0) {
-            const actionIdsToAdd = itemsToAdd.map((item)=>item.id);
-            const whereFind = {
-                permissionType: IamPermissionType.USER_ACTION,
-                sourceType: IamEntityType.USER,
-                sourceId: dto.userId,
-                targetType: IamEntityType.ACTION,
-                targetId: In(actionIdsToAdd)
-            };
-            if (enableCompanyFeature) {
-                if (companyId) whereFind.companyId = companyId;
-                if (branchId) whereFind.branchId = branchId;
-            }
-            const existingPermissions = await permissionRepo.find({
-                where: whereFind,
-                select: [
-                    'targetId'
-                ]
-            });
-            const existingActionIds = new Set(existingPermissions.map((p)=>p.targetId));
-            const newPermissions = itemsToAdd.filter((item)=>!existingActionIds.has(item.id)).map((item)=>({
-                    permissionType: IamPermissionType.USER_ACTION,
-                    sourceType: IamEntityType.USER,
-                    sourceId: dto.userId,
-                    targetType: IamEntityType.ACTION,
-                    targetId: item.id,
-                    companyId: enableCompanyFeature ? companyId : null,
-                    branchId: enableCompanyFeature ? branchId : null
-                }));
-            if (newPermissions.length > 0) {
-                try {
-                    await permissionRepo.save(newPermissions);
-                    added = newPermissions.length;
-                } catch (error) {
-                    if (error?.code === 'ER_DUP_ENTRY' || error?.message?.includes('Duplicate entry')) {
-                        throw new ConflictException({
-                            message: 'Some permissions already exist for this user. Please refresh and try again.',
-                            messageKey: PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
-                        });
-                    }
-                    throw error;
-                }
-            }
-        }
-        if (itemsToRemove.length > 0) {
-            const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
-            const whereDelete = {
-                permissionType: IamPermissionType.USER_ACTION,
-                sourceType: IamEntityType.USER,
-                sourceId: dto.userId,
-                targetType: IamEntityType.ACTION,
-                targetId: In(actionIdsToRemove)
-            };
-            if (enableCompanyFeature) {
-                if (companyId) whereDelete.companyId = companyId;
-                if (branchId) whereDelete.branchId = branchId;
-            }
-            const result = await permissionRepo.delete(whereDelete);
-            removed = result.affected || 0;
-        }
-        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, enableCompanyFeature ? [
-            branchId
-        ] : []);
-        const result = this.buildOperationResult(dto.items.length, added, removed);
-        await this.publishAssignmentEvent(IAM_EVENT_ENTITIES.USER_ACTION, dto.userId, result);
-        return result;
-    }
-    async getUserActions(userId, companyId, branchId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const where = {
-            permissionType: IamPermissionType.USER_ACTION,
-            sourceType: IamEntityType.USER,
-            sourceId: userId
-        };
-        if (enableCompanyFeature) {
-            if (companyId) where.companyId = companyId;
-            if (branchId) where.branchId = branchId;
-        }
-        const permissions = await permissionRepo.find({
-            where
-        });
-        if (permissions.length === 0) {
-            return [];
-        }
-        const actionIds = permissions.map((p)=>p.targetId);
-        const actionMap = await this.getActionsMap(actionIds);
-        return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
-            const action = actionMap.get(p.targetId);
-            return {
-                id: p.id,
-                userId: p.sourceId,
-                actionId: action.id,
-                actionCode: action.code ?? '',
-                actionName: action.name,
-                companyId: ('companyId' in p ? p.companyId : null) ?? null,
-                branchId: ('branchId' in p ? p.branchId : null) ?? null,
-                createdAt: p.createdAt
-            };
-        });
-    }
-    // Role-Action Permissions
-    async assignRoleActions(dto) {
-        if (!this.iamConfigService.isRbacEnabled()) {
-            throw new BadRequestException({
-                message: 'Role-based permission assignment not available in DIRECT-only mode. Use direct user permissions instead.',
-                messageKey: IAM_MODE_MESSAGES.RBAC_MODE_UNAVAILABLE
-            });
-        }
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        let roleCompanyId = null;
-        if (enableCompanyFeature) {
-            const roleRepo = await this.getRoleRepository();
-            const role = await roleRepo.findOne({
-                where: {
-                    id: dto.roleId
-                },
-                select: [
-                    'id',
-                    'companyId'
-                ]
-            });
-            roleCompanyId = role?.companyId ?? null;
-        }
-        const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
-        let added = 0;
-        let removed = 0;
-        if (itemsToAdd.length > 0) {
-            const actionIdsToAdd = itemsToAdd.map((item)=>item.id);
-            const existingPermissions = await permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.ROLE_ACTION,
-                    sourceType: IamEntityType.ROLE,
-                    sourceId: dto.roleId,
-                    targetType: IamEntityType.ACTION,
-                    targetId: In(actionIdsToAdd)
-                },
-                select: [
-                    'targetId'
-                ]
-            });
-            const existingActionIds = new Set(existingPermissions.map((p)=>p.targetId));
-            const newPermissions = itemsToAdd.filter((item)=>!existingActionIds.has(item.id)).map((item)=>({
-                    permissionType: IamPermissionType.ROLE_ACTION,
-                    sourceType: IamEntityType.ROLE,
-                    sourceId: dto.roleId,
-                    targetType: IamEntityType.ACTION,
-                    targetId: item.id,
-                    companyId: enableCompanyFeature ? roleCompanyId : null,
-                    branchId: null
-                }));
-            if (newPermissions.length > 0) {
-                try {
-                    await permissionRepo.save(newPermissions);
-                    added = newPermissions.length;
-                } catch (error) {
-                    if (error?.code === 'ER_DUP_ENTRY' || error?.message?.includes('Duplicate entry')) {
-                        throw new ConflictException({
-                            message: 'Some role-action permissions already exist. Please refresh and try again.',
-                            messageKey: PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
-                        });
-                    }
-                    throw error;
-                }
-            }
-        }
-        if (itemsToRemove.length > 0) {
-            const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
-            const result = await permissionRepo.delete({
-                permissionType: IamPermissionType.ROLE_ACTION,
-                sourceType: IamEntityType.ROLE,
-                sourceId: dto.roleId,
-                targetType: IamEntityType.ACTION,
-                targetId: In(actionIdsToRemove)
-            });
-            removed = result.affected || 0;
-        }
-        await this.permissionCacheService.invalidateRoleMembersCache(dto.roleId);
-        const result = this.buildOperationResult(dto.items.length, added, removed);
-        await this.publishAssignmentEvent(IAM_EVENT_ENTITIES.ROLE_ACTION, dto.roleId, result);
-        return result;
-    }
-    async getRoleActions(roleId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const permissions = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.ROLE_ACTION,
-                sourceType: IamEntityType.ROLE,
-                sourceId: roleId
-            }
-        });
-        if (permissions.length === 0) {
-            return [];
-        }
-        const actionIds = permissions.map((p)=>p.targetId);
-        const actionMap = await this.getActionsMap(actionIds);
-        return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
-            const action = actionMap.get(p.targetId);
-            return {
-                id: p.id,
-                roleId: p.sourceId,
-                actionId: action.id,
-                actionCode: action.code ?? '',
-                actionName: action.name,
-                createdAt: p.createdAt
-            };
-        });
-    }
-    // Company-Action Permissions (Whitelist)
-    /** Assign or remove actions to/from a company (whitelist) */ async assignCompanyActions(dto) {
-        const permissionRepo = await this.getPermissionRepository();
-        const dataSource = await this.dataSourceProvider.getDataSource();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
-        let added = 0;
-        let removed = 0;
-        await dataSource.transaction(async (manager)=>{
-            const transactionalPermissionRepo = manager.getRepository(permissionRepo.target);
-            if (itemsToAdd.length > 0) {
-                const actionIdsToAdd = itemsToAdd.map((item)=>item.id);
-                const existingPermissions = await transactionalPermissionRepo.find({
-                    where: {
-                        permissionType: IamPermissionType.COMPANY_ACTION,
-                        sourceType: IamEntityType.COMPANY,
-                        sourceId: dto.companyId,
-                        targetType: IamEntityType.ACTION,
-                        targetId: In(actionIdsToAdd)
-                    },
-                    select: [
-                        'targetId'
-                    ]
-                });
-                const existingActionIds = new Set(existingPermissions.map((p)=>p.targetId));
-                const newActionIds = actionIdsToAdd.filter((id)=>!existingActionIds.has(id));
-                if (newActionIds.length > 0) {
-                    const newPermissions = newActionIds.map((actionId)=>transactionalPermissionRepo.create({
-                            permissionType: IamPermissionType.COMPANY_ACTION,
-                            sourceType: IamEntityType.COMPANY,
-                            sourceId: dto.companyId,
-                            targetType: IamEntityType.ACTION,
-                            targetId: actionId
-                        }));
-                    await transactionalPermissionRepo.save(newPermissions);
-                    added = newPermissions.length;
-                }
-            }
-            if (itemsToRemove.length > 0) {
-                const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
-                const companyResult = await transactionalPermissionRepo.delete({
-                    permissionType: IamPermissionType.COMPANY_ACTION,
-                    sourceType: IamEntityType.COMPANY,
-                    sourceId: dto.companyId,
-                    targetType: IamEntityType.ACTION,
-                    targetId: In(actionIdsToRemove)
-                });
-                removed = companyResult.affected || 0;
-                // Cascade: an action no longer on the company whitelist must not remain
-                // reachable via role grants or direct user grants scoped to this company.
-                const roleEntity = enableCompanyFeature ? RoleWithCompany : Role;
-                const roleRepo = manager.getRepository(roleEntity);
-                const companyRoles = await roleRepo.find({
-                    where: {
-                        companyId: dto.companyId,
-                        deletedAt: IsNull()
-                    },
-                    select: [
-                        'id'
-                    ]
-                });
-                if (companyRoles.length > 0) {
-                    const roleIds = companyRoles.map((role)=>role.id);
-                    await transactionalPermissionRepo.delete({
-                        permissionType: IamPermissionType.ROLE_ACTION,
-                        sourceType: IamEntityType.ROLE,
-                        sourceId: In(roleIds),
-                        targetType: IamEntityType.ACTION,
-                        targetId: In(actionIdsToRemove)
-                    });
-                }
-                if (enableCompanyFeature) {
-                    await transactionalPermissionRepo.delete({
-                        permissionType: IamPermissionType.USER_ACTION,
-                        companyId: dto.companyId,
-                        targetType: IamEntityType.ACTION,
-                        targetId: In(actionIdsToRemove)
-                    });
-                }
-            }
-        });
-        await this.permissionCacheService.invalidateCompanyMembersCache(dto.companyId);
-        const result = this.buildOperationResult(dto.items.length, added, removed);
-        await this.publishAssignmentEvent(IAM_EVENT_ENTITIES.COMPANY_ACTION, dto.companyId, result);
-        return result;
-    }
-    /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId, isOnlyId = false) {
-        const permissionRepo = await this.getPermissionRepository();
-        const permissions = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.COMPANY_ACTION,
-                sourceType: IamEntityType.COMPANY,
-                sourceId: companyId
-            }
-        });
-        if (permissions.length === 0) {
-            return [];
-        }
-        const actionIds = permissions.map((p)=>p.targetId);
-        if (isOnlyId) return actionIds;
-        const actionMap = await this.getActionsMap(actionIds);
-        return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
-            const action = actionMap.get(p.targetId);
-            return {
-                id: p.id,
-                companyId: companyId,
-                actionId: action.id,
-                actionCode: action.code ?? '',
-                actionName: action.name,
-                createdAt: p.createdAt
-            };
-        });
-    }
-    // User-Role Permissions
-    /** Assign user to roles (branch-scoped when company feature is enabled) */ async assignUserRoles(dto) {
-        if (!this.iamConfigService.isRbacEnabled()) {
-            throw new BadRequestException({
-                message: 'Role assignment not available in DIRECT-only mode. Use direct user permissions instead.',
-                messageKey: IAM_MODE_MESSAGES.ROLE_ASSIGNMENT_UNAVAILABLE
-            });
-        }
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const branchId = dto.branchId ?? null;
-        const companyId = dto.companyId ?? null;
-        const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
-        let added = 0;
-        let removed = 0;
-        if (itemsToAdd.length > 0) {
-            const roleIdsToAdd = itemsToAdd.map((item)=>item.id);
-            const whereFind = {
-                permissionType: IamPermissionType.USER_ROLE,
-                sourceType: IamEntityType.USER,
-                sourceId: dto.userId,
-                targetType: IamEntityType.ROLE,
-                targetId: In(roleIdsToAdd)
-            };
-            if (enableCompanyFeature) {
-                if (companyId) whereFind.companyId = companyId;
-                if (branchId) whereFind.branchId = branchId;
-            }
-            const existingPermissions = await permissionRepo.find({
-                where: whereFind,
-                select: [
-                    'targetId'
-                ]
-            });
-            const existingRoleIds = new Set(existingPermissions.map((p)=>p.targetId));
-            const newPermissions = itemsToAdd.filter((item)=>!existingRoleIds.has(item.id)).map((item)=>({
-                    permissionType: IamPermissionType.USER_ROLE,
-                    sourceType: IamEntityType.USER,
-                    sourceId: dto.userId,
-                    targetType: IamEntityType.ROLE,
-                    targetId: item.id,
-                    companyId: enableCompanyFeature ? companyId : null,
-                    branchId: enableCompanyFeature ? branchId : null
-                }));
-            if (newPermissions.length > 0) {
-                try {
-                    await permissionRepo.save(newPermissions);
-                    added = newPermissions.length;
-                } catch (error) {
-                    if (error?.code === 'ER_DUP_ENTRY' || error?.message?.includes('Duplicate entry')) {
-                        throw new ConflictException({
-                            message: 'Some user-role permissions already exist. Please refresh and try again.',
-                            messageKey: PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
-                        });
-                    }
-                    throw error;
-                }
-            }
-        }
-        if (itemsToRemove.length > 0) {
-            const roleIdsToRemove = itemsToRemove.map((item)=>item.id);
-            const whereDelete = {
-                permissionType: IamPermissionType.USER_ROLE,
-                sourceType: IamEntityType.USER,
-                sourceId: dto.userId,
-                targetType: IamEntityType.ROLE,
-                targetId: In(roleIdsToRemove)
-            };
-            if (enableCompanyFeature) {
-                if (companyId) whereDelete.companyId = companyId;
-                if (branchId) whereDelete.branchId = branchId;
-            }
-            const result = await permissionRepo.delete(whereDelete);
-            removed = result.affected || 0;
-        }
-        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
-            branchId
-        ]);
-        const result = this.buildOperationResult(dto.items.length, added, removed);
-        await this.publishAssignmentEvent(IAM_EVENT_ENTITIES.USER_ROLE, dto.userId, result);
-        return result;
-    }
-    /** Get user's roles (branch-scoped, filtered by companyId and branchId if provided) */ async getUserRoles(userId, branchId, companyId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const roleRepo = await this.getRoleRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const where = {
-            permissionType: IamPermissionType.USER_ROLE,
-            sourceType: IamEntityType.USER,
-            sourceId: userId
-        };
-        if (enableCompanyFeature) {
-            if (companyId) where.companyId = companyId;
-            if (branchId) where.branchId = branchId;
-        }
-        const permissions = await permissionRepo.find({
-            where
-        });
-        if (permissions.length === 0) {
-            return [];
-        }
-        const roleIds = permissions.map((p)=>p.targetId);
-        const roleWhere = {
-            id: In(roleIds)
-        };
-        const roles = await roleRepo.find({
-            where: roleWhere
-        });
-        const roleMap = new Map(roles.map((r)=>[
-                r.id,
-                r
-            ]));
-        return permissions.filter((p)=>roleMap.has(p.targetId)).map((p)=>{
-            const role = roleMap.get(p.targetId);
-            const permissionEntity = p;
-            return {
-                id: p.id,
-                userId: p.sourceId,
-                roleId: role.id,
-                roleName: role.name,
-                branchId: enableCompanyFeature ? permissionEntity.branchId ?? null : null,
-                createdAt: p.createdAt
-            };
-        });
-    }
-    // Effective (Merged) Permissions — self-scoped, company-wide + branch-specific
-    /** Get user's effective roles: company-wide (branchId null) merged with branch-specific */ async getUserEffectiveRoles(userId, companyId, branchId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const roleRepo = await this.getRoleRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const baseWhere = {
-            permissionType: IamPermissionType.USER_ROLE,
-            sourceType: IamEntityType.USER,
-            sourceId: userId
-        };
-        if (enableCompanyFeature && companyId) baseWhere.companyId = companyId;
-        const permissions = enableCompanyFeature && branchId ? await permissionRepo.find({
-            where: [
-                {
-                    ...baseWhere,
-                    branchId: IsNull()
-                },
-                {
-                    ...baseWhere,
-                    branchId
-                }
-            ]
-        }) : await permissionRepo.find({
-            where: baseWhere
-        });
-        const validPermissions = permissions.filter((p)=>p.isValid());
-        if (validPermissions.length === 0) {
-            return [];
-        }
-        const roleIds = [
-            ...new Set(validPermissions.map((p)=>p.targetId))
-        ];
-        const roles = await roleRepo.find({
-            where: {
-                id: In(roleIds)
-            }
-        });
-        const roleMap = new Map(roles.map((r)=>[
-                r.id,
-                r
-            ]));
-        return validPermissions.filter((p)=>roleMap.has(p.targetId)).map((p)=>{
-            const role = roleMap.get(p.targetId);
-            return {
-                id: p.id,
-                userId: p.sourceId,
-                roleId: role.id,
-                roleName: role.name,
-                branchId: enableCompanyFeature ? p.branchId ?? null : null,
-                createdAt: p.createdAt
-            };
-        });
-    }
-    /** Get user's effective actions: company-wide (branchId null) merged with branch-specific */ async getUserEffectiveActions(userId, companyId, branchId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const baseWhere = {
-            permissionType: IamPermissionType.USER_ACTION,
-            sourceType: IamEntityType.USER,
-            sourceId: userId
-        };
-        if (enableCompanyFeature && companyId) baseWhere.companyId = companyId;
-        const permissions = enableCompanyFeature && branchId ? await permissionRepo.find({
-            where: [
-                {
-                    ...baseWhere,
-                    branchId: IsNull()
-                },
-                {
-                    ...baseWhere,
-                    branchId
-                }
-            ]
-        }) : await permissionRepo.find({
-            where: baseWhere
-        });
-        const validPermissions = permissions.filter((p)=>p.isValid());
-        if (validPermissions.length === 0) {
-            return [];
-        }
-        const actionIds = [
-            ...new Set(validPermissions.map((p)=>p.targetId))
-        ];
-        const actionMap = await this.getActionsMap(actionIds);
-        return validPermissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
-            const action = actionMap.get(p.targetId);
-            return {
-                id: p.id,
-                userId: p.sourceId,
-                actionId: action.id,
-                actionCode: action.code ?? '',
-                actionName: action.name,
-                companyId: ('companyId' in p ? p.companyId : null) ?? null,
-                branchId: ('branchId' in p ? p.branchId : null) ?? null,
-                createdAt: p.createdAt
-            };
-        });
-    }
-    // My Permissions
-    /** Get user's effective permissions (cache-first approach) */ async getMyPermissions(userId, branchId, companyId, parentCodes) {
-        return this.permissionCacheService.getMyPermissionsResponse(userId, branchId, companyId, parentCodes);
-    }
-    // Helper Methods
-    /** Split permission items into add and remove arrays */ splitItemsByAction(items) {
-        return {
-            toAdd: items.filter((item)=>item.action === PermissionAction.ADD),
-            toRemove: items.filter((item)=>item.action === PermissionAction.REMOVE)
-        };
-    }
-    async publishAssignmentEvent(entity, targetId, result) {
-        await publishDomainEvent({
-            module: IAM_EVENT_MODULE,
-            entity,
-            action: IAM_EVENT_ACTIONS.PERMISSIONS_ASSIGNED,
-            ids: [
-                targetId
-            ],
-            metadata: {
-                added: result.added,
-                removed: result.removed,
-                total: result.total
-            }
-        });
-    }
-    /** Build standard operation result DTO */ buildOperationResult(_totalItems, added, removed) {
-        return {
-            added,
-            removed,
-            total: _totalItems
-        };
-    }
-    async revokeCompanyPermissions(companyId) {
-        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
-            return;
-        }
-        const permissionRepo = await this.getPermissionRepository();
-        const roleRepo = await this.getRoleRepository();
-        const dataSource = await this.dataSourceProvider.getDataSource();
-        const companyRoles = await roleRepo.find({
-            where: {
-                companyId,
-                deletedAt: IsNull()
-            },
-            select: [
-                'id'
-            ]
-        });
-        const roleIds = companyRoles.map((role)=>role.id);
-        const affectedUserRows = await permissionRepo.find({
-            where: {
-                permissionType: In([
-                    IamPermissionType.USER_ROLE,
-                    IamPermissionType.USER_ACTION
-                ]),
-                sourceType: IamEntityType.USER,
-                companyId
-            },
-            select: [
-                'sourceId'
-            ]
-        });
-        const affectedUserIds = [
-            ...new Set(affectedUserRows.map((row)=>row.sourceId))
-        ];
-        await dataSource.transaction(async (manager)=>{
-            const txRepo = manager.getRepository(permissionRepo.target);
-            await txRepo.delete({
-                permissionType: IamPermissionType.COMPANY_ACTION,
-                sourceType: IamEntityType.COMPANY,
-                sourceId: companyId
-            });
-            if (roleIds.length > 0) {
-                await txRepo.delete({
-                    permissionType: IamPermissionType.ROLE_ACTION,
-                    sourceType: IamEntityType.ROLE,
-                    sourceId: In(roleIds)
-                });
-            }
-            await txRepo.delete({
-                permissionType: In([
-                    IamPermissionType.USER_ROLE,
-                    IamPermissionType.USER_ACTION
-                ]),
-                companyId
-            });
-            if (roleIds.length > 0) {
-                const txRoleRepo = manager.getRepository(roleRepo.target);
-                await txRoleRepo.delete(roleIds);
-            }
-        });
-        if (affectedUserIds.length > 0) {
-            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId);
-        }
-    }
-    async revokeBranchPermissions(branchId, companyId) {
-        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
-            return;
-        }
-        const permissionRepo = await this.getPermissionRepository();
-        const where = {
-            permissionType: In([
-                IamPermissionType.USER_ROLE,
-                IamPermissionType.USER_ACTION
-            ]),
-            companyId,
-            branchId
-        };
-        const affectedUserRows = await permissionRepo.find({
-            where: {
-                ...where,
-                sourceType: IamEntityType.USER
-            },
-            select: [
-                'sourceId'
-            ]
-        });
-        const affectedUserIds = [
-            ...new Set(affectedUserRows.map((row)=>row.sourceId))
-        ];
-        await permissionRepo.delete(where);
-        if (affectedUserIds.length > 0) {
-            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId, [
-                branchId
-            ]);
-        }
-    }
-    async revokeUserCompanyAccess(userId, companyId) {
-        const permissionRepo = await this.getPermissionRepository();
-        await permissionRepo.delete({
-            permissionType: In([
-                IamPermissionType.USER_ROLE,
-                IamPermissionType.USER_ACTION
-            ]),
-            sourceType: IamEntityType.USER,
-            sourceId: userId,
-            companyId
-        });
-        await this.permissionCacheService.invalidateUser(userId, companyId);
-    }
-    async revokeUserBranchAccess(userId, branchId, companyId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const where = {
-            permissionType: In([
-                IamPermissionType.USER_ROLE,
-                IamPermissionType.USER_ACTION
-            ]),
-            sourceType: IamEntityType.USER,
-            sourceId: userId,
-            branchId,
-            companyId
-        };
-        await permissionRepo.delete(where);
-        await this.permissionCacheService.invalidateUser(userId, companyId, [
-            branchId
-        ]);
-    }
-    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
-    constructor(permissionCacheService, iamConfigService, dataSourceProvider){
-        _define_property(this, "permissionCacheService", void 0);
-        _define_property(this, "iamConfigService", void 0);
-        _define_property(this, "dataSourceProvider", void 0);
-        this.permissionCacheService = permissionCacheService;
-        this.iamConfigService = iamConfigService;
-        this.dataSourceProvider = dataSourceProvider;
-    }
-}
-_ts_decorate([
-    LogAction({
-        action: 'iam.assignUserActions',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AssignUserActionsDto === "undefined" ? Object : AssignUserActionsDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionService.prototype, "assignUserActions", null);
-_ts_decorate([
-    LogAction({
-        action: 'iam.assignRoleActions',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AssignRoleActionsDto === "undefined" ? Object : AssignRoleActionsDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionService.prototype, "assignRoleActions", null);
-_ts_decorate([
-    LogAction({
-        action: 'iam.assignCompanyActions',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AssignCompanyActionsDto === "undefined" ? Object : AssignCompanyActionsDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionService.prototype, "assignCompanyActions", null);
-_ts_decorate([
-    LogAction({
-        action: 'iam.assignUserRoles',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof AssignUserRolesDto === "undefined" ? Object : AssignUserRolesDto
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionService.prototype, "assignUserRoles", null);
-_ts_decorate([
-    LogAction({
-        action: 'iam.revokeCompanyPermissions',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionService.prototype, "revokeCompanyPermissions", null);
-_ts_decorate([
-    LogAction({
-        action: 'iam.revokeBranchPermissions',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionService.prototype, "revokeBranchPermissions", null);
-_ts_decorate([
-    LogAction({
-        action: 'iam.revokeUserCompanyAccess',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionService.prototype, "revokeUserCompanyAccess", null);
-_ts_decorate([
-    LogAction({
-        action: 'iam.revokeUserBranchAccess',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        String,
-        String
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionService.prototype, "revokeUserBranchAccess", null);
-PermissionService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Inject(PermissionCacheService)),
-    _ts_param(1, Inject(IAMConfigService)),
-    _ts_param(2, Inject(IAMDataSourceService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof PermissionCacheService === "undefined" ? Object : PermissionCacheService,
-        typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
-        typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService
-    ])
-], PermissionService);