@flusys/nestjs-iam 7.1.0 → 8.0.0

package/fesm/867.js

@@ -0,0 +1,3801 @@
+import { AUTH_MESSAGES } from "@flusys/nestjs-shared/constants";
+import * as __rspack_external__flusys_nestjs_shared_393d2cae from "@flusys/nestjs-shared";
+import * as __rspack_external__flusys_nestjs_shared_classes_6076a329 from "@flusys/nestjs-shared/classes";
+import * as __rspack_external__flusys_nestjs_shared_modules_24702bee from "@flusys/nestjs-shared/modules";
+import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
+import * as __rspack_external__nestjs_swagger_7cd450b5 from "@nestjs/swagger";
+import * as __rspack_external_class_transformer_c5a479fb from "class-transformer";
+import * as __rspack_external_class_validator_7b99ef4d from "class-validator";
+import * as __rspack_external_typeorm from "typeorm";
+import * as __rspack_external__nestjs_core_d7b00a1a from "@nestjs/core";
+import * as __rspack_external__flusys_nestjs_core_config_197fa0a9 from "@flusys/nestjs-core/config";
+import * as __rspack_external__flusys_nestjs_shared_utils_9125c1f1 from "@flusys/nestjs-shared/utils";
+export const __rspack_esm_id = 867;
+export const __rspack_esm_ids = [867];
+export const __webpack_modules__ = {
+916(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * Domain event actions published by the IAM module, alongside the CRUD
+ * lifecycle actions every ApiService emits.
+ */ const IAM_EVENT_ACTIONS = {
+    PERMISSIONS_ASSIGNED: 'permissions-assigned'
+};
+/** Every entity the IAM module publishes under, ApiService backed or not */ const IAM_EVENT_ENTITIES = {
+    ACTION: 'action',
+    ROLE: 'role',
+    USER_ACTION: 'user_action',
+    ROLE_ACTION: 'role_action',
+    COMPANY_ACTION: 'company_action',
+    USER_ROLE: 'user_role'
+};
+const IAM_EVENT_MODULE = 'iam';
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  H: IAM_EVENT_ENTITIES,
+  X: IAM_EVENT_ACTIONS
+});
+
+
+},
+180(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+const IAM_MODULE_OPTIONS = 'IAM_MODULE_OPTIONS';
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  G: IAM_MODULE_OPTIONS
+});
+
+
+},
+490(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+// ==================== IAM MODULE MESSAGE KEYS ====================
+const ACTION_MESSAGES = {
+    GET_ALL_SUCCESS: 'action.get.all.success',
+    READONLY_UPDATE_FORBIDDEN: 'action.readonly.update.forbidden',
+    READONLY_DELETE_FORBIDDEN: 'action.readonly.delete.forbidden'
+};
+const ROLE_MESSAGES = {
+    READONLY_UPDATE_FORBIDDEN: 'role.readonly.update.forbidden',
+    READONLY_DELETE_FORBIDDEN: 'role.readonly.delete.forbidden'
+};
+const PERMISSION_OPERATION_MESSAGES = {
+    PROCESS_SUCCESS: 'permission.process.success',
+    ALREADY_EXISTS: 'permission.already.exists',
+    USER_REQUIRED: 'permission.user.required'
+};
+const ROLE_PERMISSION_MESSAGES = {
+    ACTIONS_SUCCESS: 'role.permission.actions.success',
+    USER_ROLES_SUCCESS: 'role.permission.user.roles.success',
+    ROLE_USERS_SUCCESS: 'role.permission.role.users.success'
+};
+const USER_ACTION_PERMISSION_MESSAGES = {
+    GET_SUCCESS: 'user.action.permission.get.success',
+    ACTION_USERS_SUCCESS: 'user.action.permission.action.users.success'
+};
+const COMPANY_ACTION_PERMISSION_MESSAGES = {
+    GET_SUCCESS: 'company.action.permission.get.success'
+};
+const MY_PERMISSION_MESSAGES = {
+    GET_SUCCESS: 'my.permission.get.success',
+    MY_ROLES_SUCCESS: 'my.permission.roles.success',
+    MY_ACTIONS_SUCCESS: 'my.permission.actions.success'
+};
+const IAM_MODE_MESSAGES = {
+    DIRECT_MODE_UNAVAILABLE: 'iam.direct.mode.unavailable',
+    RBAC_MODE_UNAVAILABLE: 'iam.rbac.mode.unavailable',
+    ROLE_ASSIGNMENT_UNAVAILABLE: 'iam.role.assignment.unavailable'
+};
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  GG: COMPANY_ACTION_PERMISSION_MESSAGES,
+  P3: PERMISSION_OPERATION_MESSAGES,
+  Q$: ACTION_MESSAGES,
+  QW: ROLE_MESSAGES,
+  eh: ROLE_PERMISSION_MESSAGES,
+  k: USER_ACTION_PERMISSION_MESSAGES,
+  sb: MY_PERMISSION_MESSAGES,
+  xI: IAM_MODE_MESSAGES
+});
+
+
+},
+296(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_swagger__rspack_import_0 = __webpack_require__(176);
+/* import */ var class_transformer__rspack_import_1 = __webpack_require__(812);
+/* import */ var class_validator__rspack_import_2 = __webpack_require__(421);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+
+
+
+var PermissionAction = /*#__PURE__*/ function(PermissionAction) {
+    PermissionAction["ADD"] = "add";
+    PermissionAction["REMOVE"] = "remove";
+    return PermissionAction;
+}({});
+class PermissionItemDto {
+    id;
+    action;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'ID of the target (action or role)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], PermissionItemDto.prototype, "id", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action to perform',
+        enum: PermissionAction,
+        example: "add"
+    }),
+    (0,class_validator__rspack_import_2.IsEnum)(PermissionAction),
+    _ts_metadata("design:type", String)
+], PermissionItemDto.prototype, "action", void 0);
+class AssignUserActionsDto {
+    userId;
+    companyId;
+    branchId;
+    items;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'User ID'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], AssignUserActionsDto.prototype, "userId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Company ID (for company-wide or branch-specific assignments)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", String)
+], AssignUserActionsDto.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Branch ID (null = company-wide, set = branch-specific)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", String)
+], AssignUserActionsDto.prototype, "branchId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Array of actions to assign/remove',
+        type: [
+            PermissionItemDto
+        ]
+    }),
+    (0,class_validator__rspack_import_2.IsArray)(),
+    (0,class_validator__rspack_import_2.ValidateNested)({
+        each: true
+    }),
+    (0,class_transformer__rspack_import_1.Type)(()=>PermissionItemDto),
+    _ts_metadata("design:type", Array)
+], AssignUserActionsDto.prototype, "items", void 0);
+class AssignCompanyActionsDto {
+    companyId;
+    items;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Company ID'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], AssignCompanyActionsDto.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Array of actions to assign/remove to company (whitelist)',
+        type: [
+            PermissionItemDto
+        ]
+    }),
+    (0,class_validator__rspack_import_2.IsArray)(),
+    (0,class_validator__rspack_import_2.ValidateNested)({
+        each: true
+    }),
+    (0,class_transformer__rspack_import_1.Type)(()=>PermissionItemDto),
+    _ts_metadata("design:type", Array)
+], AssignCompanyActionsDto.prototype, "items", void 0);
+class AssignRoleActionsDto {
+    roleId;
+    items;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Role ID'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], AssignRoleActionsDto.prototype, "roleId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Array of actions to assign/remove',
+        type: [
+            PermissionItemDto
+        ]
+    }),
+    (0,class_validator__rspack_import_2.IsArray)(),
+    (0,class_validator__rspack_import_2.ValidateNested)({
+        each: true
+    }),
+    (0,class_transformer__rspack_import_1.Type)(()=>PermissionItemDto),
+    _ts_metadata("design:type", Array)
+], AssignRoleActionsDto.prototype, "items", void 0);
+class AssignUserRolesDto {
+    userId;
+    companyId;
+    branchId;
+    items;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'User ID'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], AssignUserRolesDto.prototype, "userId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Company ID (for company-wide or branch-specific assignments)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", String)
+], AssignUserRolesDto.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Branch ID (null = company-wide, set = branch-specific)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", String)
+], AssignUserRolesDto.prototype, "branchId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Array of roles to assign/remove',
+        type: [
+            PermissionItemDto
+        ]
+    }),
+    (0,class_validator__rspack_import_2.IsArray)(),
+    (0,class_validator__rspack_import_2.ValidateNested)({
+        each: true
+    }),
+    (0,class_transformer__rspack_import_1.Type)(()=>PermissionItemDto),
+    _ts_metadata("design:type", Array)
+], AssignUserRolesDto.prototype, "items", void 0);
+class GetUserActionsDto {
+    userId;
+    companyId;
+    branchId;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'User ID to get actions for'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], GetUserActionsDto.prototype, "userId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Company ID (ignored when enableCompanyFeature is false)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", String)
+], GetUserActionsDto.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Branch ID to filter by branch (ignored when enableCompanyFeature is false)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", String)
+], GetUserActionsDto.prototype, "branchId", void 0);
+class GetRoleActionsDto {
+    roleId;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Role ID to get actions for'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], GetRoleActionsDto.prototype, "roleId", void 0);
+class GetCompanyActionsDto {
+    companyId;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Company ID to get actions for'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], GetCompanyActionsDto.prototype, "companyId", void 0);
+class GetRoleUsersDto {
+    roleId;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Role ID to get assigned users for'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], GetRoleUsersDto.prototype, "roleId", void 0);
+class GetActionUsersDto {
+    actionId;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action ID to get assigned users for'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], GetActionUsersDto.prototype, "actionId", void 0);
+class GetUserRolesDto {
+    userId;
+    companyId;
+    branchId;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'User ID to get roles for'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    _ts_metadata("design:type", String)
+], GetUserRolesDto.prototype, "userId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Company ID (ignored when enableCompanyFeature is false)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", String)
+], GetUserRolesDto.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Branch ID to filter by branch (ignored when enableCompanyFeature is false)'
+    }),
+    (0,class_validator__rspack_import_2.IsUUID)(),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", String)
+], GetUserRolesDto.prototype, "branchId", void 0);
+class UserActionResponseDto {
+    id;
+    userId;
+    actionId;
+    actionCode;
+    actionName;
+    companyId;
+    branchId;
+    createdAt;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Permission ID'
+    }),
+    _ts_metadata("design:type", String)
+], UserActionResponseDto.prototype, "id", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'User ID'
+    }),
+    _ts_metadata("design:type", String)
+], UserActionResponseDto.prototype, "userId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action ID'
+    }),
+    _ts_metadata("design:type", String)
+], UserActionResponseDto.prototype, "actionId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action code'
+    }),
+    _ts_metadata("design:type", String)
+], UserActionResponseDto.prototype, "actionCode", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action name'
+    }),
+    _ts_metadata("design:type", String)
+], UserActionResponseDto.prototype, "actionName", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Company ID (null = global)'
+    }),
+    _ts_metadata("design:type", Object)
+], UserActionResponseDto.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Branch ID (null = company-wide)'
+    }),
+    _ts_metadata("design:type", Object)
+], UserActionResponseDto.prototype, "branchId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'When this permission was created'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], UserActionResponseDto.prototype, "createdAt", void 0);
+class RoleActionResponseDto {
+    id;
+    roleId;
+    actionId;
+    actionCode;
+    actionName;
+    createdAt;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Permission ID'
+    }),
+    _ts_metadata("design:type", String)
+], RoleActionResponseDto.prototype, "id", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Role ID'
+    }),
+    _ts_metadata("design:type", String)
+], RoleActionResponseDto.prototype, "roleId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action ID'
+    }),
+    _ts_metadata("design:type", String)
+], RoleActionResponseDto.prototype, "actionId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action code'
+    }),
+    _ts_metadata("design:type", String)
+], RoleActionResponseDto.prototype, "actionCode", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action name'
+    }),
+    _ts_metadata("design:type", String)
+], RoleActionResponseDto.prototype, "actionName", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'When this permission was created'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], RoleActionResponseDto.prototype, "createdAt", void 0);
+class CompanyActionResponseDto {
+    id;
+    companyId;
+    actionId;
+    actionCode;
+    actionName;
+    createdAt;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Permission ID'
+    }),
+    _ts_metadata("design:type", String)
+], CompanyActionResponseDto.prototype, "id", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Company ID'
+    }),
+    _ts_metadata("design:type", String)
+], CompanyActionResponseDto.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action ID'
+    }),
+    _ts_metadata("design:type", String)
+], CompanyActionResponseDto.prototype, "actionId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action Code'
+    }),
+    _ts_metadata("design:type", String)
+], CompanyActionResponseDto.prototype, "actionCode", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action Name'
+    }),
+    _ts_metadata("design:type", String)
+], CompanyActionResponseDto.prototype, "actionName", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'When this permission was created'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], CompanyActionResponseDto.prototype, "createdAt", void 0);
+class UserRoleResponseDto {
+    id;
+    userId;
+    roleId;
+    roleName;
+    branchId;
+    createdAt;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Permission ID'
+    }),
+    _ts_metadata("design:type", String)
+], UserRoleResponseDto.prototype, "id", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'User ID'
+    }),
+    _ts_metadata("design:type", String)
+], UserRoleResponseDto.prototype, "userId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Role ID'
+    }),
+    _ts_metadata("design:type", String)
+], UserRoleResponseDto.prototype, "roleId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Role name'
+    }),
+    _ts_metadata("design:type", String)
+], UserRoleResponseDto.prototype, "roleName", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Branch ID (null = company-wide)'
+    }),
+    _ts_metadata("design:type", Object)
+], UserRoleResponseDto.prototype, "branchId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'When this permission was created'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], UserRoleResponseDto.prototype, "createdAt", void 0);
+class RoleUserResponseDto {
+    id;
+    userId;
+    createdAt;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Permission ID'
+    }),
+    _ts_metadata("design:type", String)
+], RoleUserResponseDto.prototype, "id", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'User ID'
+    }),
+    _ts_metadata("design:type", String)
+], RoleUserResponseDto.prototype, "userId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'When this permission was created'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], RoleUserResponseDto.prototype, "createdAt", void 0);
+class ActionUserResponseDto {
+    id;
+    userId;
+    createdAt;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Permission ID'
+    }),
+    _ts_metadata("design:type", String)
+], ActionUserResponseDto.prototype, "id", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'User ID'
+    }),
+    _ts_metadata("design:type", String)
+], ActionUserResponseDto.prototype, "userId", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'When this permission was created'
+    }),
+    _ts_metadata("design:type", typeof Date === "undefined" ? Object : Date)
+], ActionUserResponseDto.prototype, "createdAt", void 0);
+class FrontendActionDto {
+    code;
+    name;
+    description;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action code'
+    }),
+    _ts_metadata("design:type", String)
+], FrontendActionDto.prototype, "code", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Action name'
+    }),
+    _ts_metadata("design:type", String)
+], FrontendActionDto.prototype, "name", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Action description'
+    }),
+    _ts_metadata("design:type", Object)
+], FrontendActionDto.prototype, "description", void 0);
+class MyPermissionsQueryDto {
+    parentCodes;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiPropertyOptional)({
+        description: 'Filter by parent action codes',
+        example: [
+            'user',
+            'role'
+        ],
+        type: [
+            String
+        ]
+    }),
+    (0,class_validator__rspack_import_2.IsArray)(),
+    (0,class_validator__rspack_import_2.IsString)({
+        each: true
+    }),
+    (0,class_validator__rspack_import_2.IsOptional)(),
+    _ts_metadata("design:type", Array)
+], MyPermissionsQueryDto.prototype, "parentCodes", void 0);
+class MyPermissionsResponseDto {
+    frontendActions;
+    cachedEndpoints;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        type: [
+            FrontendActionDto
+        ]
+    }),
+    _ts_metadata("design:type", Array)
+], MyPermissionsResponseDto.prototype, "frontendActions", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Number of endpoint actions cached for PermissionGuard'
+    }),
+    _ts_metadata("design:type", Number)
+], MyPermissionsResponseDto.prototype, "cachedEndpoints", void 0);
+class PermissionOperationResultDto {
+    added;
+    removed;
+    total;
+}
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Number of permissions added'
+    }),
+    _ts_metadata("design:type", Number)
+], PermissionOperationResultDto.prototype, "added", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Number of permissions removed'
+    }),
+    _ts_metadata("design:type", Number)
+], PermissionOperationResultDto.prototype, "removed", void 0);
+_ts_decorate([
+    (0,_nestjs_swagger__rspack_import_0.ApiProperty)({
+        description: 'Number of permissions requested'
+    }),
+    _ts_metadata("design:type", Number)
+], PermissionOperationResultDto.prototype, "total", void 0);
+
+__webpack_require__.d(__webpack_exports__, {
+  $l: () => (RoleActionResponseDto),
+  A6: () => (GetRoleUsersDto),
+  CM: () => (GetUserActionsDto),
+  E4: () => (CompanyActionResponseDto),
+  LK: () => (UserRoleResponseDto),
+  MO: () => (RoleUserResponseDto),
+  Nx: () => (AssignCompanyActionsDto),
+  O_: () => (MyPermissionsQueryDto),
+  Q0: () => (GetUserRolesDto),
+  Uu: () => (PermissionItemDto),
+  Ww: () => (GetActionUsersDto),
+  Xz: () => (AssignUserRolesDto),
+  Yb: () => (FrontendActionDto),
+  Zn: () => (GetRoleActionsDto),
+  aG: () => (PermissionAction),
+  c8: () => (GetCompanyActionsDto),
+  cB: () => (ActionUserResponseDto),
+  cv: () => (AssignRoleActionsDto),
+  gF: () => (UserActionResponseDto),
+  ji: () => (MyPermissionsResponseDto),
+  xJ: () => (PermissionOperationResultDto),
+  zs: () => (AssignUserActionsDto)
+});
+
+
+},
+864(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(422);
+/* import */ var typeorm__rspack_import_1 = __webpack_require__(158);
+/* import */ var _enums_index_js__rspack_import_2 = __webpack_require__(560);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+
+
+
+class Action extends _flusys_nestjs_shared__rspack_import_0.Identity {
+    readOnly;
+    name;
+    description;
+    code;
+    actionType;
+    permissionLogic;
+    serial;
+    isActive;
+    parent;
+    parentId;
+    children;
+}
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'boolean',
+        nullable: false,
+        default: false,
+        name: 'read_only'
+    }),
+    _ts_metadata("design:type", Boolean)
+], Action.prototype, "readOnly", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 255,
+        nullable: false
+    }),
+    _ts_metadata("design:type", String)
+], Action.prototype, "name", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 500,
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], Action.prototype, "description", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 255,
+        nullable: true,
+        unique: true
+    }),
+    _ts_metadata("design:type", Object)
+], Action.prototype, "code", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 50,
+        nullable: false,
+        default: 'BACKEND',
+        name: 'action_type'
+    }),
+    _ts_metadata("design:type", typeof _enums_index_js__rspack_import_2/* .ActionType */.X === "undefined" ? Object : _enums_index_js__rspack_import_2/* .ActionType */.X)
+], Action.prototype, "actionType", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: (0,_flusys_nestjs_shared__rspack_import_0.getJsonColumnType)(),
+        nullable: true,
+        name: 'permission_logic'
+    }),
+    _ts_metadata("design:type", Object)
+], Action.prototype, "permissionLogic", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'int',
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], Action.prototype, "serial", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'boolean',
+        nullable: false,
+        default: true,
+        name: 'is_active'
+    }),
+    _ts_metadata("design:type", Boolean)
+], Action.prototype, "isActive", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.ManyToOne)('Action', 'children', {
+        nullable: true,
+        onDelete: 'CASCADE'
+    }),
+    (0,typeorm__rspack_import_1.JoinColumn)({
+        name: 'parent_id'
+    }),
+    _ts_metadata("design:type", Object)
+], Action.prototype, "parent", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'uuid',
+        nullable: true,
+        name: 'parent_id'
+    }),
+    _ts_metadata("design:type", Object)
+], Action.prototype, "parentId", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.OneToMany)('Action', 'parent'),
+    _ts_metadata("design:type", Array)
+], Action.prototype, "children", void 0);
+Action = _ts_decorate([
+    (0,typeorm__rspack_import_1.Entity)({
+        name: 'action'
+    }),
+    (0,typeorm__rspack_import_1.Index)([
+        'parentId'
+    ])
+], Action);
+
+__webpack_require__.d(__webpack_exports__, {
+  r: () => (Action)
+});
+
+
+},
+423(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(422);
+/* import */ var typeorm__rspack_import_1 = __webpack_require__(158);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+
+
+/**
+ * Permission Base Entity
+ * Core permission fields - always included regardless of company feature
+ */ class PermissionBase extends _flusys_nestjs_shared__rspack_import_0.Identity {
+    permissionType;
+    sourceType;
+    sourceId;
+    targetType;
+    targetId;
+    validFrom;
+    validUntil;
+    reason;
+    isValid(now = new Date()) {
+        if (this.validFrom && now < this.validFrom) return false;
+        if (this.validUntil && now > this.validUntil) return false;
+        return true;
+    }
+}
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 50,
+        name: 'permission_type'
+    }),
+    _ts_metadata("design:type", String)
+], PermissionBase.prototype, "permissionType", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 50,
+        name: 'source_type'
+    }),
+    _ts_metadata("design:type", String)
+], PermissionBase.prototype, "sourceType", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 150,
+        name: 'source_id'
+    }),
+    _ts_metadata("design:type", String)
+], PermissionBase.prototype, "sourceId", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 50,
+        name: 'target_type'
+    }),
+    _ts_metadata("design:type", String)
+], PermissionBase.prototype, "targetType", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 150,
+        name: 'target_id'
+    }),
+    _ts_metadata("design:type", String)
+], PermissionBase.prototype, "targetId", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'timestamp',
+        nullable: true,
+        name: 'valid_from'
+    }),
+    _ts_metadata("design:type", Object)
+], PermissionBase.prototype, "validFrom", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'timestamp',
+        nullable: true,
+        name: 'valid_until'
+    }),
+    _ts_metadata("design:type", Object)
+], PermissionBase.prototype, "validUntil", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'text',
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], PermissionBase.prototype, "reason", void 0);
+
+__webpack_require__.d(__webpack_exports__, {
+  $: () => (PermissionBase)
+});
+
+
+},
+746(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var typeorm__rspack_import_0 = __webpack_require__(158);
+/* import */ var _permission_base_entity_js__rspack_import_1 = __webpack_require__(423);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+
+
+class UserIamPermissionWithCompany extends _permission_base_entity_js__rspack_import_1/* .PermissionBase */.$ {
+    /**
+   * Company ID - Company scope for this permission
+   * - null: Global permission (not company-specific)
+   * - set: Permission belongs to this company
+   */ companyId;
+    /**
+   * Branch ID - Branch scope for this permission
+   * - null: Company-wide permission (all branches in company)
+   * - set: Permission applies only to this specific branch
+   */ branchId;
+}
+_ts_decorate([
+    (0,typeorm__rspack_import_0.Column)({
+        type: 'varchar',
+        length: 150,
+        nullable: true,
+        name: 'company_id'
+    }),
+    _ts_metadata("design:type", Object)
+], UserIamPermissionWithCompany.prototype, "companyId", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_0.Column)({
+        type: 'varchar',
+        length: 150,
+        nullable: true,
+        name: 'branch_id'
+    }),
+    _ts_metadata("design:type", Object)
+], UserIamPermissionWithCompany.prototype, "branchId", void 0);
+UserIamPermissionWithCompany = _ts_decorate([
+    (0,typeorm__rspack_import_0.Entity)({
+        name: 'user_iam_permission'
+    }),
+    (0,typeorm__rspack_import_0.Index)([
+        'permissionType',
+        'sourceId',
+        'targetId',
+        'companyId',
+        'branchId'
+    ], {
+        unique: true
+    }),
+    (0,typeorm__rspack_import_0.Index)([
+        'sourceId',
+        'sourceType'
+    ]),
+    (0,typeorm__rspack_import_0.Index)([
+        'targetId',
+        'targetType'
+    ]),
+    (0,typeorm__rspack_import_0.Index)([
+        'permissionType'
+    ]),
+    (0,typeorm__rspack_import_0.Index)([
+        'companyId'
+    ]),
+    (0,typeorm__rspack_import_0.Index)([
+        'branchId'
+    ]),
+    (0,typeorm__rspack_import_0.Index)([
+        'companyId',
+        'branchId'
+    ])
+], UserIamPermissionWithCompany);
+
+__webpack_require__.d(__webpack_exports__, {
+  t: () => (UserIamPermissionWithCompany)
+});
+
+
+},
+784(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(422);
+/* import */ var typeorm__rspack_import_1 = __webpack_require__(158);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+
+
+class RoleBase extends _flusys_nestjs_shared__rspack_import_0.Identity {
+    readOnly;
+    name;
+    description;
+    isActive;
+    serial;
+}
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'boolean',
+        nullable: false,
+        default: false,
+        name: 'read_only'
+    }),
+    _ts_metadata("design:type", Boolean)
+], RoleBase.prototype, "readOnly", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 255,
+        nullable: false
+    }),
+    _ts_metadata("design:type", String)
+], RoleBase.prototype, "name", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'varchar',
+        length: 500,
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], RoleBase.prototype, "description", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'boolean',
+        nullable: false,
+        default: true,
+        name: 'is_active'
+    }),
+    _ts_metadata("design:type", Boolean)
+], RoleBase.prototype, "isActive", void 0);
+_ts_decorate([
+    (0,typeorm__rspack_import_1.Column)({
+        type: 'int',
+        nullable: true
+    }),
+    _ts_metadata("design:type", Object)
+], RoleBase.prototype, "serial", void 0);
+
+__webpack_require__.d(__webpack_exports__, {
+  u: () => (RoleBase)
+});
+
+
+},
+353(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var typeorm__rspack_import_0 = __webpack_require__(158);
+/* import */ var _role_base_entity_js__rspack_import_1 = __webpack_require__(784);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+
+
+class RoleWithCompany extends _role_base_entity_js__rspack_import_1/* .RoleBase */.u {
+    companyId;
+}
+_ts_decorate([
+    (0,typeorm__rspack_import_0.Column)({
+        type: 'uuid',
+        nullable: true,
+        name: 'company_id'
+    }),
+    _ts_metadata("design:type", Object)
+], RoleWithCompany.prototype, "companyId", void 0);
+RoleWithCompany = _ts_decorate([
+    (0,typeorm__rspack_import_0.Entity)({
+        name: 'role'
+    }),
+    (0,typeorm__rspack_import_0.Index)([
+        'companyId'
+    ])
+], RoleWithCompany);
+
+__webpack_require__.d(__webpack_exports__, {
+  g: () => (RoleWithCompany)
+});
+
+
+},
+326(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var typeorm__rspack_import_0 = __webpack_require__(158);
+/* import */ var _role_base_entity_js__rspack_import_1 = __webpack_require__(784);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+
+
+class Role extends _role_base_entity_js__rspack_import_1/* .RoleBase */.u {
+}
+Role = _ts_decorate([
+    (0,typeorm__rspack_import_0.Entity)({
+        name: 'role'
+    })
+], Role);
+
+__webpack_require__.d(__webpack_exports__, {
+  X: () => (Role)
+});
+
+
+},
+489(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var typeorm__rspack_import_0 = __webpack_require__(158);
+/* import */ var _permission_base_entity_js__rspack_import_1 = __webpack_require__(423);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+
+
+class UserIamPermission extends _permission_base_entity_js__rspack_import_1/* .PermissionBase */.$ {
+}
+UserIamPermission = _ts_decorate([
+    (0,typeorm__rspack_import_0.Entity)({
+        name: 'user_iam_permission'
+    }),
+    (0,typeorm__rspack_import_0.Index)([
+        'permissionType',
+        'sourceId',
+        'targetId'
+    ], {
+        unique: true
+    }),
+    (0,typeorm__rspack_import_0.Index)([
+        'sourceId',
+        'sourceType'
+    ]),
+    (0,typeorm__rspack_import_0.Index)([
+        'targetId',
+        'targetType'
+    ]),
+    (0,typeorm__rspack_import_0.Index)([
+        'permissionType'
+    ])
+], UserIamPermission);
+
+__webpack_require__.d(__webpack_exports__, {
+  y: () => (UserIamPermission)
+});
+
+
+},
+560(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * ActionType Enum - Categorizes actions by their usage context
+ *
+ * - BACKEND: Actions for API endpoint permissions (cached for PermissionGuard)
+ * - FRONTEND: Actions for frontend features (returned in my-permissions API)
+ * - BOTH: Actions used for both backend and frontend (cached + returned)
+ */ var ActionType = /*#__PURE__*/ function(ActionType) {
+    ActionType["BACKEND"] = "backend";
+    ActionType["FRONTEND"] = "frontend";
+    ActionType["BOTH"] = "both";
+    return ActionType;
+}({});
+
+__webpack_require__.d(__webpack_exports__, {
+  X: () => (ActionType)
+});
+
+
+},
+85(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+var IamEntityType = /*#__PURE__*/ function(IamEntityType) {
+    IamEntityType["USER"] = "user";
+    IamEntityType["ROLE"] = "role";
+    IamEntityType["ACTION"] = "action";
+    IamEntityType["COMPANY"] = "company";
+    return IamEntityType;
+}({});
+
+__webpack_require__.d(__webpack_exports__, {
+  n: () => (IamEntityType)
+});
+
+
+},
+517(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+var IamPermissionType = /*#__PURE__*/ function(IamPermissionType) {
+    IamPermissionType["USER_ROLE"] = "user_role";
+    IamPermissionType["ROLE_ACTION"] = "role_action";
+    IamPermissionType["USER_ACTION"] = "user_action";
+    IamPermissionType["COMPANY_ACTION"] = "company_action";
+    return IamPermissionType;
+}({});
+
+__webpack_require__.d(__webpack_exports__, {
+  V: () => (IamPermissionType)
+});
+
+
+},
+841(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+var IAMPermissionMode = /*#__PURE__*/ function(IAMPermissionMode) {
+    IAMPermissionMode[IAMPermissionMode["RBAC"] = 1] = "RBAC";
+    IAMPermissionMode[IAMPermissionMode["DIRECT"] = 2] = "DIRECT";
+    IAMPermissionMode[IAMPermissionMode["FULL"] = 3] = "FULL";
+    return IAMPermissionMode;
+}({});
+
+__webpack_require__.d(__webpack_exports__, {
+  w: () => (IAMPermissionMode)
+});
+
+
+},
+674(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  T: () => (/* reexport */ PermissionModeHelper),
+  u: () => (/* reexport */ validateCompanyAccess)
+});
+
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+;// CONCATENATED MODULE: external "@flusys/nestjs-shared/constants"
+
+;// CONCATENATED MODULE: ./projects/nestjs-iam/src/helpers/company-access.helper.ts
+
+
+/**
+ * Validates that user has access to the specified company.
+ * Used for user-action and role-permission operations when company feature is enabled.
+ *
+ * @throws ForbiddenException if user doesn't have access to the company
+ */ function validateCompanyAccess(config, companyId, user, errorMessage = 'You do not have access to this company', messageKey = AUTH_MESSAGES.COMPANY_NO_ACCESS) {
+    if (!config.isCompanyFeatureEnabled() || !companyId) {
+        return;
+    }
+    if (user.companyId !== companyId) {
+        throw new common_.ForbiddenException({
+            message: errorMessage,
+            messageKey
+        });
+    }
+}
+
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/enums/permission-type.enum.ts
+var permission_type_enum = __webpack_require__(841);
+;// CONCATENATED MODULE: ./projects/nestjs-iam/src/helpers/permission-mode.helper.ts
+
+/**
+ * Helper for converting permission mode strings to enum values
+ *
+ * **Purpose:** Centralize the conversion logic from IBootstrapAppConfig.permissionMode
+ * (string) to IAMPermissionMode enum to prevent duplication and sync issues.
+ *
+ * **Used by:**
+ * - iam.module.ts (forRoot, forRootAsync)
+ * - iam-config.service.ts (getPermissionMode)
+ * - main.ts (Swagger setup)
+ */ class PermissionModeHelper {
+    /**
+   * Convert permission mode string to enum value
+   *
+   * @param modeStr - Permission mode string ('FULL', 'RBAC', 'DIRECT')
+   * @returns IAMPermissionMode enum value
+   * @default IAMPermissionMode.FULL if invalid/missing
+   *
+   * @example
+   * ```typescript
+   * const mode = PermissionModeHelper.fromString('RBAC');
+   * // Returns: IAMPermissionMode.RBAC
+   *
+   * const mode = PermissionModeHelper.fromString(undefined);
+   * // Returns: IAMPermissionMode.FULL (default)
+   * ```
+   */ static fromString(modeStr) {
+        if (!modeStr) {
+            return permission_type_enum/* .IAMPermissionMode.FULL */.w.FULL;
+        }
+        const mode = permission_type_enum/* .IAMPermissionMode */.w[modeStr];
+        return mode ?? permission_type_enum/* .IAMPermissionMode.FULL */.w.FULL;
+    }
+    /**
+   * Convert enum value to string (for serialization/logging)
+   *
+   * @param mode - IAMPermissionMode enum value
+   * @returns String representation
+   *
+   * @example
+   * ```typescript
+   * const str = PermissionModeHelper.toString(IAMPermissionMode.RBAC);
+   * // Returns: 'RBAC'
+   * ```
+   */ static toString(mode) {
+        return permission_type_enum/* .IAMPermissionMode */.w[mode];
+    }
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-iam/src/helpers/index.ts
+
+
+
+
+},
+713(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(937);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_1 = __webpack_require__(236);
+/* import */ var _nestjs_common__rspack_import_2 = __webpack_require__(157);
+/* import */ var typeorm__rspack_import_3 = __webpack_require__(158);
+/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(916);
+/* import */ var _config_index_js__rspack_import_12 = __webpack_require__(490);
+/* import */ var _entities_action_entity_js__rspack_import_4 = __webpack_require__(864);
+/* import */ var _entities_permission_with_company_entity_js__rspack_import_5 = __webpack_require__(746);
+/* import */ var _entities_user_iam_permission_entity_js__rspack_import_6 = __webpack_require__(489);
+/* import */ var _enums_iam_entity_type_enum_js__rspack_import_14 = __webpack_require__(85);
+/* import */ var _enums_iam_permission_type_enum_js__rspack_import_13 = __webpack_require__(517);
+/* import */ var _iam_config_service_js__rspack_import_7 = __webpack_require__(645);
+/* import */ var _iam_datasource_service_js__rspack_import_8 = __webpack_require__(831);
+/* import */ var _permission_cache_service_js__rspack_import_9 = __webpack_require__(99);
+/* import */ var _permission_service_js__rspack_import_10 = __webpack_require__(472);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+class ActionService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
+    cacheManager;
+    utilsService;
+    iamConfigService;
+    permissionService;
+    permissionCacheService;
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionService, permissionCacheService){
+        super(_config_index_js__rspack_import_11/* .IAM_EVENT_ENTITIES.ACTION */.H.ACTION, cacheManager, utilsService, ActionService.name, true, (/* inlined export .IAM_EVENT_MODULE */"iam"), dataSourceProvider, _entities_action_entity_js__rspack_import_4/* .Action */.r), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionService = permissionService, this.permissionCacheService = permissionCacheService;
+    }
+    async beforeUpdateOperation(dto, _user, _queryRunner) {
+        const dtos = Array.isArray(dto) ? dto : [
+            dto
+        ];
+        const ids = dtos.map((d)=>d.id);
+        await this.ensureDataSourceRepository();
+        const readonlyActions = await this.repository.find({
+            where: {
+                id: (0,typeorm__rspack_import_3.In)(ids),
+                readOnly: true,
+                deletedAt: (0,typeorm__rspack_import_3.IsNull)()
+            }
+        });
+        if (readonlyActions.length > 0) {
+            const names = readonlyActions.map((a)=>a.name).join(', ');
+            throw new _nestjs_common__rspack_import_2.ForbiddenException({
+                message: `Cannot modify readonly action(s): ${names}`,
+                messageKey: _config_index_js__rspack_import_12/* .ACTION_MESSAGES.READONLY_UPDATE_FORBIDDEN */.Q$.READONLY_UPDATE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+    }
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        const actionIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        if (actionIds.length === 0) {
+            return;
+        }
+        await this.ensureDataSourceRepository();
+        const readonlyActions = await this.repository.find({
+            where: {
+                id: (0,typeorm__rspack_import_3.In)(actionIds),
+                readOnly: true,
+                deletedAt: (0,typeorm__rspack_import_3.IsNull)()
+            }
+        });
+        if (readonlyActions.length > 0) {
+            const names = readonlyActions.map((a)=>a.name).join(', ');
+            throw new _nestjs_common__rspack_import_2.ForbiddenException({
+                message: `Cannot delete readonly action(s): ${names}`,
+                messageKey: _config_index_js__rspack_import_12/* .ACTION_MESSAGES.READONLY_DELETE_FORBIDDEN */.Q$.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const permissionEntity = enableCompanyFeature ? _entities_permission_with_company_entity_js__rspack_import_5/* .UserIamPermissionWithCompany */.t : _entities_user_iam_permission_entity_js__rspack_import_6/* .UserIamPermission */.y;
+        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
+        const [roleActionRows, userActionRows, companyActionRows] = await Promise.all([
+            permissionRepo.find({
+                where: {
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_13/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+                    sourceType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.ROLE */.n.ROLE,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.ACTION */.n.ACTION,
+                    targetId: (0,typeorm__rspack_import_3.In)(actionIds)
+                }
+            }),
+            permissionRepo.find({
+                where: {
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_13/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.ACTION */.n.ACTION,
+                    targetId: (0,typeorm__rspack_import_3.In)(actionIds)
+                }
+            }),
+            enableCompanyFeature ? permissionRepo.find({
+                where: {
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_13/* .IamPermissionType.COMPANY_ACTION */.V.COMPANY_ACTION,
+                    sourceType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.COMPANY */.n.COMPANY,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.ACTION */.n.ACTION,
+                    targetId: (0,typeorm__rspack_import_3.In)(actionIds)
+                }
+            }) : Promise.resolve([])
+        ]);
+        const affectedUserIds = new Set(userActionRows.map((row)=>row.sourceId));
+        const affectedCompanyIds = [
+            ...new Set(companyActionRows.map((row)=>row.sourceId).filter((id)=>!!id))
+        ];
+        const affectedRoleIds = [
+            ...new Set(roleActionRows.map((row)=>row.sourceId))
+        ];
+        if (affectedRoleIds.length > 0) {
+            const userRoleRows = await permissionRepo.find({
+                where: {
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_13/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.ROLE */.n.ROLE,
+                    targetId: (0,typeorm__rspack_import_3.In)(affectedRoleIds)
+                }
+            });
+            userRoleRows.forEach((row)=>affectedUserIds.add(row.sourceId));
+        }
+        await permissionRepo.delete({
+            permissionType: _enums_iam_permission_type_enum_js__rspack_import_13/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+            targetType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.ACTION */.n.ACTION,
+            targetId: (0,typeorm__rspack_import_3.In)(actionIds)
+        });
+        await permissionRepo.delete({
+            permissionType: _enums_iam_permission_type_enum_js__rspack_import_13/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+            targetType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.ACTION */.n.ACTION,
+            targetId: (0,typeorm__rspack_import_3.In)(actionIds)
+        });
+        await permissionRepo.delete({
+            permissionType: _enums_iam_permission_type_enum_js__rspack_import_13/* .IamPermissionType.COMPANY_ACTION */.V.COMPANY_ACTION,
+            sourceType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.COMPANY */.n.COMPANY,
+            targetType: _enums_iam_entity_type_enum_js__rspack_import_14/* .IamEntityType.ACTION */.n.ACTION,
+            targetId: (0,typeorm__rspack_import_3.In)(actionIds)
+        });
+        await Promise.all([
+            affectedUserIds.size > 0 ? this.permissionCacheService.invalidateUsers([
+                ...affectedUserIds
+            ]) : Promise.resolve(),
+            ...affectedCompanyIds.map((companyId)=>this.permissionCacheService.invalidateCompanyMembersCache(companyId))
+        ]);
+    }
+    // Query Customization
+    async getSelectQuery(query, _user, select) {
+        if (!select?.length) {
+            select = [
+                'id',
+                'name',
+                'code',
+                'description',
+                'actionType',
+                'permissionLogic',
+                'isActive',
+                'readOnly',
+                'parentId',
+                'serial',
+                'createdAt'
+            ];
+        }
+        query.select(select.map((f)=>`${this.entityName}.${f}`));
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getGlobalSearchQuery(query, search) {
+        query.andWhere('(action.name LIKE :search OR action.code LIKE :search OR action.description LIKE :search)', {
+            search: `%${search}%`
+        });
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    // Response Conversion
+    convertEntityToResponseDto(entity, _isRaw) {
+        return {
+            id: entity.id,
+            readOnly: entity.readOnly,
+            name: entity.name,
+            description: entity.description,
+            code: entity.code,
+            actionType: entity.actionType,
+            permissionLogic: entity.permissionLogic,
+            serial: entity.serial,
+            isActive: entity.isActive,
+            parentId: entity.parentId,
+            createdAt: entity.createdAt,
+            updatedAt: entity.updatedAt,
+            deletedAt: entity.deletedAt,
+            createdById: entity.createdById,
+            updatedById: entity.updatedById,
+            deletedById: entity.deletedById
+        };
+    }
+    // Custom Methods
+    actionSelectFields = [
+        'id',
+        'code',
+        'name',
+        'description',
+        'actionType',
+        'permissionLogic',
+        'isActive',
+        'parentId',
+        'serial'
+    ];
+    requireUser(user, methodName) {
+        if (!user) {
+            throw new _nestjs_common__rspack_import_2.BadRequestException({
+                message: `User is required for ${methodName}`,
+                messageKey: _config_index_js__rspack_import_12/* .PERMISSION_OPERATION_MESSAGES.USER_REQUIRED */.P3.USER_REQUIRED,
+                messageVariables: {
+                    method: methodName
+                }
+            });
+        }
+    }
+    /** Get actions available for permission assignment (filtered by company whitelist) */ async getActionsForPermission(user, companyId) {
+        await this.ensureDataSourceRepository();
+        this.requireUser(user, 'getActionsForPermission');
+        let whereClause = {};
+        const targetCompanyId = companyId || user.companyId;
+        if (this.iamConfigService.isCompanyFeatureEnabled() && targetCompanyId) {
+            const companyActionIds = await this.permissionService.getCompanyActions(targetCompanyId, true);
+            if (companyActionIds.length === 0) {
+                return [];
+            }
+            whereClause = {
+                id: (0,typeorm__rspack_import_3.In)(companyActionIds)
+            };
+        }
+        const actions = await this.repository.find({
+            where: whereClause,
+            select: this.actionSelectFields
+        });
+        return actions.map((action)=>this.convertEntityToResponseDto(action, false));
+    }
+    /** Get actions in hierarchical tree structure */ async getActionTree(user, search, isActive, withDeleted = false) {
+        await this.ensureDataSourceRepository();
+        this.requireUser(user, 'getActionTree');
+        const query = this.repository.createQueryBuilder('action');
+        if (!withDeleted) {
+            query.andWhere('action.deletedAt IS NULL');
+        }
+        if (isActive !== undefined) {
+            query.andWhere('action.isActive = :isActive', {
+                isActive
+            });
+        }
+        if (search?.trim()) {
+            query.andWhere('(action.name LIKE :search OR action.code LIKE :search)', {
+                search: `%${search.trim()}%`
+            });
+        }
+        const actions = await query.orderBy('action.serial', 'ASC').getMany();
+        return this.buildActionTree(actions);
+    }
+    buildActionTree(actions) {
+        if (!actions?.length) {
+            return [];
+        }
+        const map = new Map();
+        const rootNodes = [];
+        for (const action of actions){
+            const treeNode = {
+                ...this.convertEntityToResponseDto(action, false),
+                children: []
+            };
+            map.set(action.id, treeNode);
+        }
+        for (const action of actions){
+            const node = map.get(action.id);
+            if (!node) {
+                continue;
+            }
+            if (action.parentId && map.has(action.parentId)) {
+                const parent = map.get(action.parentId);
+                if (parent?.children) {
+                    parent.children.push(node);
+                }
+            } else {
+                rootNodes.push(node);
+            }
+        }
+        return rootNodes;
+    }
+}
+ActionService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_2.Injectable)({
+        scope: _nestjs_common__rspack_import_2.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_2.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,_nestjs_common__rspack_import_2.Inject)(_flusys_nestjs_shared_modules__rspack_import_1.UtilsService)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_2.Inject)(_iam_config_service_js__rspack_import_7/* .IAMConfigService */.N)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_2.Inject)(_iam_datasource_service_js__rspack_import_8/* .IAMDataSourceService */.U)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_2.Inject)(_permission_service_js__rspack_import_10/* .PermissionService */.n)),
+    _ts_param(5, (0,_nestjs_common__rspack_import_2.Inject)(_permission_cache_service_js__rspack_import_9/* .PermissionCacheService */.D)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
+        typeof _flusys_nestjs_shared_modules__rspack_import_1.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_1.UtilsService,
+        typeof _iam_config_service_js__rspack_import_7/* .IAMConfigService */.N === "undefined" ? Object : _iam_config_service_js__rspack_import_7/* .IAMConfigService */.N,
+        typeof _iam_datasource_service_js__rspack_import_8/* .IAMDataSourceService */.U === "undefined" ? Object : _iam_datasource_service_js__rspack_import_8/* .IAMDataSourceService */.U,
+        typeof _permission_service_js__rspack_import_10/* .PermissionService */.n === "undefined" ? Object : _permission_service_js__rspack_import_10/* .PermissionService */.n,
+        typeof _permission_cache_service_js__rspack_import_9/* .PermissionCacheService */.D === "undefined" ? Object : _permission_cache_service_js__rspack_import_9/* .PermissionCacheService */.D
+    ])
+], ActionService);
+
+__webpack_require__.d(__webpack_exports__, {
+  u: () => (ActionService)
+});
+
+
+},
+645(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+/* import */ var _config_iam_constants_js__rspack_import_3 = __webpack_require__(180);
+/* import */ var _enums_permission_type_enum_js__rspack_import_2 = __webpack_require__(841);
+/* import */ var _helpers_index_js__rspack_import_1 = __webpack_require__(674);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+class IAMConfigService {
+    options;
+    constructor(injectedOptions){
+        this.options = injectedOptions ?? {
+            global: false,
+            includeController: false
+        };
+    }
+    // Database Mode
+    getDatabaseMode() {
+        return this.options.bootstrapAppConfig?.databaseMode ?? 'single';
+    }
+    isMultiTenant() {
+        return this.getDatabaseMode() === 'multi-tenant';
+    }
+    // Feature Flags
+    isCompanyFeatureEnabled() {
+        return this.options.bootstrapAppConfig?.enableCompanyFeature ?? false;
+    }
+    // Permission Mode
+    getPermissionMode() {
+        return _helpers_index_js__rspack_import_1/* .PermissionModeHelper.fromString */.T.fromString(this.options.bootstrapAppConfig?.permissionMode);
+    }
+    isRbacEnabled() {
+        const mode = this.getPermissionMode();
+        return mode === _enums_permission_type_enum_js__rspack_import_2/* .IAMPermissionMode.RBAC */.w.RBAC || mode === _enums_permission_type_enum_js__rspack_import_2/* .IAMPermissionMode.FULL */.w.FULL;
+    }
+    isDirectPermissionEnabled() {
+        const mode = this.getPermissionMode();
+        return mode === _enums_permission_type_enum_js__rspack_import_2/* .IAMPermissionMode.DIRECT */.w.DIRECT || mode === _enums_permission_type_enum_js__rspack_import_2/* .IAMPermissionMode.FULL */.w.FULL;
+    }
+    // Options
+    getOptions() {
+        return this.options;
+    }
+}
+IAMConfigService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_0.Injectable)(),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Optional)()),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_config_iam_constants_js__rspack_import_3/* .IAM_MODULE_OPTIONS */.G)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof IAMModuleOptions === "undefined" ? Object : IAMModuleOptions
+    ])
+], IAMConfigService);
+
+__webpack_require__.d(__webpack_exports__, {
+  N: () => (IAMConfigService)
+});
+
+
+},
+831(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  U: () => (/* binding */ IAMDataSourceService)
+});
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/modules"
+var modules_ = __webpack_require__(236);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+;// CONCATENATED MODULE: external "@nestjs/core"
+
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/helpers/index.ts + 3 modules
+var helpers = __webpack_require__(674);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/services/iam-config.service.ts
+var iam_config_service = __webpack_require__(645);
+;// CONCATENATED MODULE: ./projects/nestjs-iam/src/services/iam-datasource.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+class IAMDataSourceService extends modules_.MultiTenantDataSourceService {
+    configService;
+    static tenantConnections = new Map();
+    static singleDataSource = null;
+    static tenantsRegistry = new Map();
+    static initialized = false;
+    static connectionLocks = new Map();
+    static singleConnectionLock = null;
+    constructor(configService, request){
+        super(IAMDataSourceService.buildParentOptions(configService.getOptions()), request), this.configService = configService;
+    }
+    static buildParentOptions(options) {
+        return {
+            bootstrapAppConfig: options.bootstrapAppConfig,
+            defaultDatabaseConfig: options.config?.defaultDatabaseConfig,
+            tenantDefaultDatabaseConfig: options.config?.tenantDefaultDatabaseConfig,
+            tenants: options.config?.tenants
+        };
+    }
+    getEnableCompanyFeatureForTenant(tenant) {
+        return tenant?.enableCompanyFeature ?? this.configService.isCompanyFeatureEnabled();
+    }
+    async getIAMEntities() {
+        const { getIAMEntitiesByConfig } = await __webpack_require__.e(/* import() */ 364).then(__webpack_require__.bind(__webpack_require__, 743));
+        const enableCompanyFeature = this.getEnableCompanyFeatureForTenant(this.getCurrentTenant() ?? undefined);
+        const permissionMode = helpers/* .PermissionModeHelper.toString */.T.toString(this.configService.getPermissionMode());
+        return getIAMEntitiesByConfig(enableCompanyFeature, permissionMode);
+    }
+    async createDataSourceFromConfig(config) {
+        const entities = await this.getIAMEntities();
+        return await super.createDataSourceFromConfig(config, entities);
+    }
+}
+IAMDataSourceService = _ts_decorate([
+    (0,common_.Injectable)({
+        scope: common_.Scope.REQUEST
+    }),
+    _ts_param(0, (0,common_.Inject)(iam_config_service/* .IAMConfigService */.N)),
+    _ts_param(1, (0,common_.Optional)()),
+    _ts_param(1, (0,common_.Inject)(__rspack_external__nestjs_core_d7b00a1a.REQUEST)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof iam_config_service/* .IAMConfigService */.N === "undefined" ? Object : iam_config_service/* .IAMConfigService */.N,
+        typeof Request === "undefined" ? Object : Request
+    ])
+], IAMDataSourceService);
+
+
+},
+99(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  D: () => (/* binding */ PermissionCacheService)
+});
+
+;// CONCATENATED MODULE: external "@flusys/nestjs-core/config"
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared"
+var nestjs_shared_ = __webpack_require__(422);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+// EXTERNAL MODULE: external "typeorm"
+var external_typeorm_ = __webpack_require__(158);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/action.entity.ts
+var action_entity = __webpack_require__(864);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/permission-with-company.entity.ts
+var permission_with_company_entity = __webpack_require__(746);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/role-with-company.entity.ts
+var role_with_company_entity = __webpack_require__(353);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/role.entity.ts
+var role_entity = __webpack_require__(326);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/user-iam-permission.entity.ts
+var user_iam_permission_entity = __webpack_require__(489);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/enums/action-type.enum.ts
+var action_type_enum = __webpack_require__(560);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/enums/iam-entity-type.enum.ts
+var iam_entity_type_enum = __webpack_require__(85);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/enums/iam-permission-type.enum.ts
+var iam_permission_type_enum = __webpack_require__(517);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/enums/permission-type.enum.ts
+var permission_type_enum = __webpack_require__(841);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/services/iam-config.service.ts
+var iam_config_service = __webpack_require__(645);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/services/iam-datasource.service.ts + 1 modules
+var iam_datasource_service = __webpack_require__(831);
+;// CONCATENATED MODULE: ./projects/nestjs-iam/src/services/permission-cache.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+const NO_COMPANY_SCOPE = 'none';
+class PermissionCacheService {
+    cacheManager;
+    iamConfigService;
+    dataSourceProvider;
+    guardConfig;
+    TRACKED_KEYS_PREFIX = 'permission-tracked-keys';
+    TRACKED_SCOPES_PREFIX = 'permission-tracked-scopes';
+    TTL;
+    constructor(cacheManager, iamConfigService, dataSourceProvider, guardConfig){
+        this.cacheManager = cacheManager;
+        this.iamConfigService = iamConfigService;
+        this.dataSourceProvider = dataSourceProvider;
+        this.guardConfig = guardConfig;
+        this.TTL = this.parseDurationMs(__rspack_external__flusys_nestjs_core_config_197fa0a9.envConfig.getJwtConfig().refreshExpiration);
+    }
+    // Repository Getters
+    async getPermissionRepository() {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const entity = enableCompanyFeature ? permission_with_company_entity/* .UserIamPermissionWithCompany */.t : user_iam_permission_entity/* .UserIamPermission */.y;
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    async getActionRepository() {
+        return this.dataSourceProvider.getRepository(action_entity/* .Action */.r);
+    }
+    async getRoleRepository() {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const entity = enableCompanyFeature ? role_with_company_entity/* .RoleWithCompany */.g : role_entity/* .Role */.X;
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    // Cache Key Generation
+    parseDurationMs(duration) {
+        const unitMs = {
+            ms: 1,
+            s: 1000,
+            m: 60000,
+            h: 3600000,
+            d: 86400000,
+            w: 604800000
+        };
+        const match = /^(\d+)\s*(ms|s|m|h|d|w)?$/i.exec(duration.trim());
+        if (!match) {
+            return unitMs.h; // fallback: 1 hour
+        }
+        const unit = (match[2] || 'ms').toLowerCase();
+        return Number(match[1]) * unitMs[unit];
+    }
+    buildCacheKey(options) {
+        return (0,nestjs_shared_.buildPermissionCacheKey)(options, this.guardConfig);
+    }
+    scopeToken(companyId) {
+        return companyId || NO_COMPANY_SCOPE;
+    }
+    buildTrackedKeysKey(userId, companyId) {
+        return `${this.TRACKED_KEYS_PREFIX}:user:${userId}:company:${this.scopeToken(companyId)}`;
+    }
+    buildTrackedScopesKey(userId) {
+        return `${this.TRACKED_SCOPES_PREFIX}:user:${userId}`;
+    }
+    // Cache Operations
+    async setMyPermissions(options, data) {
+        const key = this.buildCacheKey(options);
+        await this.cacheManager.set(key, data, this.TTL);
+        await this.trackKey(options.userId, key, options.companyId);
+    }
+    async getMyPermissions(options) {
+        try {
+            const key = this.buildCacheKey(options);
+            const result = await this.cacheManager.get(key);
+            return result || null;
+        } catch  {
+            return null;
+        }
+    }
+    async trackKey(userId, key, companyId) {
+        try {
+            let scopeKey = key;
+            if (companyId) {
+                scopeKey = this.buildTrackedKeysKey(userId, companyId);
+                const keys = await this.cacheManager.get(scopeKey) || [];
+                if (!keys.includes(key)) {
+                    keys.push(key);
+                    await this.cacheManager.set(scopeKey, keys, this.TTL);
+                }
+            }
+            const scopesKey = this.buildTrackedScopesKey(userId);
+            const scopes = await this.cacheManager.get(scopesKey) || [];
+            if (!scopes.includes(scopeKey)) {
+                scopes.push(scopeKey);
+                await this.cacheManager.set(scopesKey, scopes, this.TTL);
+            }
+        } catch  {
+        // tracking is best-effort; a missed entry only widens invalidation, never narrows it
+        }
+    }
+    // My Permissions (cache-first read, DB-backed rebuild)
+    /** Get user's effective permissions (cache-first approach) */ async getMyPermissionsResponse(userId, branchId, companyId, parentCodes) {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const cacheOptions = {
+            userId,
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId: enableCompanyFeature ? branchId : null
+        };
+        const cachedData = await this.getMyPermissions(cacheOptions);
+        if (cachedData) {
+            return this.buildResponseFromCache(cachedData, parentCodes);
+        }
+        const freshData = await this.fetchAndCachePermissions(userId, branchId, companyId);
+        return this.buildResponseFromCache(freshData, parentCodes);
+    }
+    /** Build response from cached data, applying optional parentCodes filter */ async buildResponseFromCache(cachedData, parentCodes) {
+        let frontendActions = cachedData.frontendActions;
+        if (parentCodes?.length) {
+            const parentIds = await this.getParentIdsByCodesWithCache(parentCodes);
+            if (parentIds.size > 0) {
+                frontendActions = frontendActions.filter((a)=>a.parentId && parentIds.has(a.parentId));
+            } else {
+                frontendActions = [];
+            }
+        }
+        return {
+            frontendActions: frontendActions.map((a)=>({
+                    code: a.code,
+                    name: a.name,
+                    description: a.description
+                })),
+            cachedEndpoints: cachedData.backendCodes.length
+        };
+    }
+    /** Resolve action IDs for the given codes */ async getParentIdsByCodesWithCache(codes) {
+        const actionRepo = await this.getActionRepository();
+        const actions = await actionRepo.find({
+            where: {
+                code: (0,external_typeorm_.In)(codes)
+            },
+            select: [
+                'id',
+                'code'
+            ]
+        });
+        return new Set(actions.map((action)=>action.id));
+    }
+    /** Fetch permissions from DB and cache them (empty permissions are also cached) */ async fetchAndCachePermissions(userId, branchId, companyId) {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const cacheOptions = {
+            userId,
+            companyId: enableCompanyFeature ? companyId : null,
+            branchId
+        };
+        const emptyData = {
+            frontendActions: [],
+            backendCodes: []
+        };
+        const allActionIds = await this.collectAllActionIds(userId, branchId, companyId);
+        if (allActionIds.size === 0) {
+            await this.setMyPermissions(cacheOptions, emptyData);
+            return emptyData;
+        }
+        return this.buildAndCachePermissionData(allActionIds, cacheOptions);
+    }
+    /** Collect all action IDs based on permission mode (RBAC, DIRECT, or FULL) */ async collectAllActionIds(userId, branchId, companyId) {
+        const permissionMode = this.iamConfigService.getPermissionMode();
+        const allActionIds = new Set();
+        if (permissionMode === permission_type_enum/* .IAMPermissionMode.RBAC */.w.RBAC || permissionMode === permission_type_enum/* .IAMPermissionMode.FULL */.w.FULL) {
+            const userRoleIds = await this.getUserRoleIds(userId, branchId, companyId);
+            if (userRoleIds.length > 0) {
+                const roleActionIds = await this.getRoleActionIds(userRoleIds);
+                roleActionIds.forEach((id)=>allActionIds.add(id));
+            }
+        }
+        if (permissionMode === permission_type_enum/* .IAMPermissionMode.DIRECT */.w.DIRECT || permissionMode === permission_type_enum/* .IAMPermissionMode.FULL */.w.FULL) {
+            const userActionIds = await this.getUserActionIds(userId, branchId, companyId);
+            userActionIds.forEach((id)=>allActionIds.add(id));
+        }
+        return allActionIds;
+    }
+    /** Fetch actions from DB, separate by type, build cache data, and cache it */ async buildAndCachePermissionData(actionIds, cacheOptions) {
+        const actionRepo = await this.getActionRepository();
+        const actions = await actionRepo.find({
+            where: {
+                id: (0,external_typeorm_.In)(Array.from(actionIds)),
+                isActive: true
+            }
+        });
+        const backendActions = actions.filter((a)=>a.actionType === action_type_enum/* .ActionType.BACKEND */.X.BACKEND || a.actionType === action_type_enum/* .ActionType.BOTH */.X.BOTH);
+        const frontendActions = actions.filter((a)=>a.actionType === action_type_enum/* .ActionType.FRONTEND */.X.FRONTEND || a.actionType === action_type_enum/* .ActionType.BOTH */.X.BOTH);
+        const backendCodes = backendActions.map((a)=>a.code).filter((c)=>!!c);
+        const cacheData = {
+            frontendActions: frontendActions.map((a)=>({
+                    id: a.id,
+                    code: a.code ?? '',
+                    name: a.name,
+                    description: a.description,
+                    parentId: a.parentId
+                })),
+            backendCodes
+        };
+        await this.setMyPermissions(cacheOptions, cacheData);
+        return cacheData;
+    }
+    /** Get role IDs assigned to a user (merges company-wide + branch-specific roles) */ async getUserRoleIds(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        if (!enableCompanyFeature) {
+            const permissions = await permissionRepo.find({
+                where: {
+                    permissionType: iam_permission_type_enum/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                    sourceType: iam_entity_type_enum/* .IamEntityType.USER */.n.USER,
+                    sourceId: userId
+                }
+            });
+            return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
+        }
+        const roleIds = new Set();
+        const baseWhere = {
+            permissionType: iam_permission_type_enum/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+            sourceType: iam_entity_type_enum/* .IamEntityType.USER */.n.USER,
+            sourceId: userId
+        };
+        if (companyId) {
+            baseWhere.companyId = companyId;
+        }
+        if (branchId) {
+            // Get company-wide + branch-specific roles
+            const companyWidePermissions = await permissionRepo.find({
+                where: {
+                    ...baseWhere,
+                    branchId: (0,external_typeorm_.IsNull)()
+                }
+            });
+            companyWidePermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
+            const branchPermissions = await permissionRepo.find({
+                where: {
+                    ...baseWhere,
+                    branchId
+                }
+            });
+            branchPermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
+        } else {
+            // No branch context: get all roles for this company
+            const allPermissions = await permissionRepo.find({
+                where: baseWhere
+            });
+            allPermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
+        }
+        return Array.from(roleIds);
+    }
+    async getRoleActionIds(roleIds) {
+        const permissionRepo = await this.getPermissionRepository();
+        const permissions = await permissionRepo.find({
+            where: {
+                permissionType: iam_permission_type_enum/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+                sourceType: iam_entity_type_enum/* .IamEntityType.ROLE */.n.ROLE,
+                sourceId: (0,external_typeorm_.In)(roleIds)
+            }
+        });
+        return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
+    }
+    /** Get action IDs directly assigned to a user (merges company-wide + branch-specific actions) */ async getUserActionIds(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        if (!enableCompanyFeature) {
+            const permissions = await permissionRepo.find({
+                where: {
+                    permissionType: iam_permission_type_enum/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+                    sourceType: iam_entity_type_enum/* .IamEntityType.USER */.n.USER,
+                    sourceId: userId
+                }
+            });
+            return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
+        }
+        const actionIds = new Set();
+        const baseWhere = {
+            permissionType: iam_permission_type_enum/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+            sourceType: iam_entity_type_enum/* .IamEntityType.USER */.n.USER,
+            sourceId: userId
+        };
+        if (companyId) {
+            baseWhere.companyId = companyId;
+        }
+        if (branchId) {
+            // Get company-wide + branch-specific actions
+            const companyWidePermissions = await permissionRepo.find({
+                where: {
+                    ...baseWhere,
+                    branchId: (0,external_typeorm_.IsNull)()
+                }
+            });
+            companyWidePermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
+            const branchPermissions = await permissionRepo.find({
+                where: {
+                    ...baseWhere,
+                    branchId
+                }
+            });
+            branchPermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
+        } else {
+            // No branch context: get all actions for this company
+            const allPermissions = await permissionRepo.find({
+                where: baseWhere
+            });
+            allPermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
+        }
+        return Array.from(actionIds);
+    }
+    // Cache Invalidation
+    async invalidateUser(userId, companyId, branchIds) {
+        const keysToDelete = new Set();
+        /** Drop a scope entry from the tracked-scopes index, or queue the whole index for deletion once nothing remains */ const untrackScope = async (scopeKey)=>{
+            const scopesKeysKey = this.buildTrackedScopesKey(userId);
+            let scopesKeys = [];
+            try {
+                scopesKeys = await this.cacheManager.get(scopesKeysKey) || [];
+            } catch  {
+                scopesKeys = [];
+            }
+            if (scopeKey) {
+                const remainingScopes = scopesKeys.filter((scope)=>scope !== scopeKey);
+                if (remainingScopes.length > 0) {
+                    await this.cacheManager.set(scopesKeysKey, remainingScopes, this.TTL);
+                } else {
+                    keysToDelete.add(scopesKeysKey);
+                }
+            } else {
+                for (const scope of scopesKeys){
+                    if (scope.startsWith(this.TRACKED_KEYS_PREFIX)) {
+                        let nestedKeys = [];
+                        try {
+                            nestedKeys = await this.cacheManager.get(scope) || [];
+                        } catch  {
+                            nestedKeys = [];
+                        }
+                        nestedKeys.forEach((key)=>keysToDelete.add(key));
+                    }
+                    keysToDelete.add(scope);
+                }
+                keysToDelete.add(scopesKeysKey);
+            }
+        };
+        if (companyId) {
+            const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
+            let trackedKeys = [];
+            try {
+                trackedKeys = await this.cacheManager.get(trackedKeysKey) || [];
+            } catch  {
+                trackedKeys = [];
+            }
+            const hasCompanyWideScope = branchIds?.some((branchId)=>!branchId);
+            if (!branchIds?.length || hasCompanyWideScope) {
+                trackedKeys.forEach((key)=>keysToDelete.add(key));
+                keysToDelete.add(trackedKeysKey);
+                await untrackScope(trackedKeysKey);
+            } else {
+                // Branch scope given: only invalidate those branches, keep the rest tracked
+                branchIds.forEach((branchId)=>keysToDelete.add(this.buildCacheKey({
+                        userId,
+                        companyId,
+                        branchId
+                    })));
+                const remainingKeys = trackedKeys.filter((key)=>!keysToDelete.has(key));
+                if (remainingKeys.length) {
+                    await this.cacheManager.set(trackedKeysKey, remainingKeys, this.TTL);
+                } else {
+                    keysToDelete.add(trackedKeysKey);
+                    await untrackScope(trackedKeysKey);
+                }
+            }
+        } else {
+            await untrackScope();
+        }
+        await Promise.all(Array.from(keysToDelete).map(async (key)=>{
+            try {
+                await this.cacheManager.del(key);
+            } catch  {}
+        }));
+    }
+    async invalidateUsers(userIds, companyId, branchIds) {
+        if (userIds.length === 0) {
+            return 0;
+        }
+        const results = await Promise.allSettled(userIds.map((userId)=>this.invalidateUser(userId, companyId, branchIds)));
+        return results.filter((r)=>r.status === 'fulfilled').length;
+    }
+    /** Invalidate permission cache for all users holding a given role */ async invalidateRoleMembersCache(roleId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const roleRepo = await this.getRoleRepository();
+        const userRoles = await permissionRepo.find({
+            where: {
+                permissionType: iam_permission_type_enum/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                sourceType: iam_entity_type_enum/* .IamEntityType.USER */.n.USER,
+                targetType: iam_entity_type_enum/* .IamEntityType.ROLE */.n.ROLE,
+                targetId: roleId
+            }
+        });
+        const userIds = [
+            ...new Set(userRoles.map((ur)=>ur.sourceId))
+        ];
+        if (userIds.length === 0) {
+            return 0;
+        }
+        const role = await roleRepo.findOne({
+            where: {
+                id: roleId
+            }
+        });
+        const companyId = role?.companyId || null;
+        return this.invalidateUsers(userIds, companyId);
+    }
+    /** Invalidate permission cache for all users in a company */ async invalidateCompanyMembersCache(companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return 0;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const userPermissions = await permissionRepo.createQueryBuilder('p').select('DISTINCT p.source_id', 'userId').where('p.company_id = :companyId', {
+            companyId
+        }).andWhere('p.source_type = :sourceType', {
+            sourceType: iam_entity_type_enum/* .IamEntityType.USER */.n.USER
+        }).getRawMany();
+        const userIds = [
+            ...new Set(userPermissions.map((p)=>p.userId).filter(Boolean))
+        ];
+        if (userIds.length === 0) {
+            return 0;
+        }
+        return this.invalidateUsers(userIds, companyId);
+    }
+}
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'permissionCache.setMyPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof PermissionCacheKeyOptions === "undefined" ? Object : PermissionCacheKeyOptions,
+        typeof CachedMyPermissions === "undefined" ? Object : CachedMyPermissions
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionCacheService.prototype, "setMyPermissions", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'permissionCache.invalidateUser',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        Object,
+        Array
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionCacheService.prototype, "invalidateUser", null);
+_ts_decorate([
+    (0,nestjs_shared_.LogAction)({
+        action: 'permissionCache.invalidateUsers',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        Array,
+        Object,
+        Array
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionCacheService.prototype, "invalidateUsers", null);
+PermissionCacheService = _ts_decorate([
+    (0,common_.Injectable)({
+        scope: common_.Scope.REQUEST
+    }),
+    _ts_param(0, (0,common_.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,common_.Inject)(iam_config_service/* .IAMConfigService */.N)),
+    _ts_param(2, (0,common_.Inject)(iam_datasource_service/* .IAMDataSourceService */.U)),
+    _ts_param(3, (0,common_.Optional)()),
+    _ts_param(3, (0,common_.Inject)(nestjs_shared_.PERMISSION_GUARD_CONFIG)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof nestjs_shared_.HybridCache === "undefined" ? Object : nestjs_shared_.HybridCache,
+        typeof iam_config_service/* .IAMConfigService */.N === "undefined" ? Object : iam_config_service/* .IAMConfigService */.N,
+        typeof iam_datasource_service/* .IAMDataSourceService */.U === "undefined" ? Object : iam_datasource_service/* .IAMDataSourceService */.U,
+        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
+    ])
+], PermissionCacheService);
+
+
+},
+472(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared__rspack_import_0 = __webpack_require__(422);
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_1 = __webpack_require__(937);
+/* import */ var _nestjs_common__rspack_import_2 = __webpack_require__(157);
+/* import */ var typeorm__rspack_import_3 = __webpack_require__(158);
+/* import */ var _config_index_js__rspack_import_13 = __webpack_require__(490);
+/* import */ var _config_index_js__rspack_import_16 = __webpack_require__(916);
+/* import */ var _dtos_permission_dto_js__rspack_import_4 = __webpack_require__(296);
+/* import */ var _entities_action_entity_js__rspack_import_5 = __webpack_require__(864);
+/* import */ var _entities_permission_with_company_entity_js__rspack_import_6 = __webpack_require__(746);
+/* import */ var _entities_role_with_company_entity_js__rspack_import_7 = __webpack_require__(353);
+/* import */ var _entities_role_entity_js__rspack_import_8 = __webpack_require__(326);
+/* import */ var _entities_user_iam_permission_entity_js__rspack_import_9 = __webpack_require__(489);
+/* import */ var _enums_iam_entity_type_enum_js__rspack_import_15 = __webpack_require__(85);
+/* import */ var _enums_iam_permission_type_enum_js__rspack_import_14 = __webpack_require__(517);
+/* import */ var _iam_config_service_js__rspack_import_10 = __webpack_require__(645);
+/* import */ var _iam_datasource_service_js__rspack_import_11 = __webpack_require__(831);
+/* import */ var _permission_cache_service_js__rspack_import_12 = __webpack_require__(99);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+class PermissionService {
+    permissionCacheService;
+    iamConfigService;
+    dataSourceProvider;
+    // NOTE: @Inject() required for bundled code - type metadata may be lost during esbuild
+    constructor(permissionCacheService, iamConfigService, dataSourceProvider){
+        this.permissionCacheService = permissionCacheService;
+        this.iamConfigService = iamConfigService;
+        this.dataSourceProvider = dataSourceProvider;
+    }
+    // Repository Getters
+    async getPermissionRepository() {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const entity = enableCompanyFeature ? _entities_permission_with_company_entity_js__rspack_import_6/* .UserIamPermissionWithCompany */.t : _entities_user_iam_permission_entity_js__rspack_import_9/* .UserIamPermission */.y;
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    async getActionRepository() {
+        return this.dataSourceProvider.getRepository(_entities_action_entity_js__rspack_import_5/* .Action */.r);
+    }
+    async getRoleRepository() {
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const entity = enableCompanyFeature ? _entities_role_with_company_entity_js__rspack_import_7/* .RoleWithCompany */.g : _entities_role_entity_js__rspack_import_8/* .Role */.X;
+        return this.dataSourceProvider.getRepository(entity);
+    }
+    async getActionsMap(actionIds) {
+        const actionRepo = await this.getActionRepository();
+        const actions = await actionRepo.find({
+            where: {
+                id: (0,typeorm__rspack_import_3.In)(actionIds)
+            }
+        });
+        return new Map(actions.map((a)=>[
+                a.id,
+                a
+            ]));
+    }
+    // User-Action Permissions
+    async assignUserActions(dto) {
+        if (!this.iamConfigService.isDirectPermissionEnabled()) {
+            throw new _nestjs_common__rspack_import_2.BadRequestException({
+                message: 'Direct permission assignment not available in RBAC-only mode. Use role-based permissions instead.',
+                messageKey: _config_index_js__rspack_import_13/* .IAM_MODE_MESSAGES.DIRECT_MODE_UNAVAILABLE */.xI.DIRECT_MODE_UNAVAILABLE
+            });
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const branchId = dto.branchId ?? null;
+        const companyId = dto.companyId ?? null;
+        const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
+        let added = 0;
+        let removed = 0;
+        if (itemsToAdd.length > 0) {
+            const actionIdsToAdd = itemsToAdd.map((item)=>item.id);
+            const whereFind = {
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+                sourceId: dto.userId,
+                targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                targetId: (0,typeorm__rspack_import_3.In)(actionIdsToAdd)
+            };
+            if (enableCompanyFeature) {
+                if (companyId) whereFind.companyId = companyId;
+                if (branchId) whereFind.branchId = branchId;
+            }
+            const existingPermissions = await permissionRepo.find({
+                where: whereFind,
+                select: [
+                    'targetId'
+                ]
+            });
+            const existingActionIds = new Set(existingPermissions.map((p)=>p.targetId));
+            const newPermissions = itemsToAdd.filter((item)=>!existingActionIds.has(item.id)).map((item)=>({
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+                    sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+                    sourceId: dto.userId,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                    targetId: item.id,
+                    companyId: enableCompanyFeature ? companyId : null,
+                    branchId: enableCompanyFeature ? branchId : null
+                }));
+            if (newPermissions.length > 0) {
+                try {
+                    await permissionRepo.save(newPermissions);
+                    added = newPermissions.length;
+                } catch (error) {
+                    if (error?.code === 'ER_DUP_ENTRY' || error?.message?.includes('Duplicate entry')) {
+                        throw new _nestjs_common__rspack_import_2.ConflictException({
+                            message: 'Some permissions already exist for this user. Please refresh and try again.',
+                            messageKey: _config_index_js__rspack_import_13/* .PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS */.P3.ALREADY_EXISTS
+                        });
+                    }
+                    throw error;
+                }
+            }
+        }
+        if (itemsToRemove.length > 0) {
+            const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
+            const whereDelete = {
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+                sourceId: dto.userId,
+                targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                targetId: (0,typeorm__rspack_import_3.In)(actionIdsToRemove)
+            };
+            if (enableCompanyFeature) {
+                if (companyId) whereDelete.companyId = companyId;
+                if (branchId) whereDelete.branchId = branchId;
+            }
+            const result = await permissionRepo.delete(whereDelete);
+            removed = result.affected || 0;
+        }
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, enableCompanyFeature ? [
+            branchId
+        ] : []);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(_config_index_js__rspack_import_16/* .IAM_EVENT_ENTITIES.USER_ACTION */.H.USER_ACTION, dto.userId, result);
+        return result;
+    }
+    async getUserActions(userId, companyId, branchId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const where = {
+            permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+            sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+            sourceId: userId
+        };
+        if (enableCompanyFeature) {
+            if (companyId) where.companyId = companyId;
+            if (branchId) where.branchId = branchId;
+        }
+        const permissions = await permissionRepo.find({
+            where
+        });
+        if (permissions.length === 0) {
+            return [];
+        }
+        const actionIds = permissions.map((p)=>p.targetId);
+        const actionMap = await this.getActionsMap(actionIds);
+        return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
+            const action = actionMap.get(p.targetId);
+            return {
+                id: p.id,
+                userId: p.sourceId,
+                actionId: action.id,
+                actionCode: action.code ?? '',
+                actionName: action.name,
+                companyId: ('companyId' in p ? p.companyId : null) ?? null,
+                branchId: ('branchId' in p ? p.branchId : null) ?? null,
+                createdAt: p.createdAt
+            };
+        });
+    }
+    /** Get users directly assigned an action (reverse lookup: action -> users) */ async getUsersForAction(actionId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const permissions = await permissionRepo.find({
+            where: {
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+                targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                targetId: actionId
+            }
+        });
+        return permissions.map((p)=>({
+                id: p.id,
+                userId: p.sourceId,
+                createdAt: p.createdAt
+            }));
+    }
+    // Role-Action Permissions
+    async assignRoleActions(dto) {
+        if (!this.iamConfigService.isRbacEnabled()) {
+            throw new _nestjs_common__rspack_import_2.BadRequestException({
+                message: 'Role-based permission assignment not available in DIRECT-only mode. Use direct user permissions instead.',
+                messageKey: _config_index_js__rspack_import_13/* .IAM_MODE_MESSAGES.RBAC_MODE_UNAVAILABLE */.xI.RBAC_MODE_UNAVAILABLE
+            });
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        let roleCompanyId = null;
+        if (enableCompanyFeature) {
+            const roleRepo = await this.getRoleRepository();
+            const role = await roleRepo.findOne({
+                where: {
+                    id: dto.roleId
+                },
+                select: [
+                    'id',
+                    'companyId'
+                ]
+            });
+            roleCompanyId = role?.companyId ?? null;
+        }
+        const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
+        let added = 0;
+        let removed = 0;
+        if (itemsToAdd.length > 0) {
+            const actionIdsToAdd = itemsToAdd.map((item)=>item.id);
+            const existingPermissions = await permissionRepo.find({
+                where: {
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+                    sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                    sourceId: dto.roleId,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                    targetId: (0,typeorm__rspack_import_3.In)(actionIdsToAdd)
+                },
+                select: [
+                    'targetId'
+                ]
+            });
+            const existingActionIds = new Set(existingPermissions.map((p)=>p.targetId));
+            const newPermissions = itemsToAdd.filter((item)=>!existingActionIds.has(item.id)).map((item)=>({
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+                    sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                    sourceId: dto.roleId,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                    targetId: item.id,
+                    companyId: enableCompanyFeature ? roleCompanyId : null,
+                    branchId: null
+                }));
+            if (newPermissions.length > 0) {
+                try {
+                    await permissionRepo.save(newPermissions);
+                    added = newPermissions.length;
+                } catch (error) {
+                    if (error?.code === 'ER_DUP_ENTRY' || error?.message?.includes('Duplicate entry')) {
+                        throw new _nestjs_common__rspack_import_2.ConflictException({
+                            message: 'Some role-action permissions already exist. Please refresh and try again.',
+                            messageKey: _config_index_js__rspack_import_13/* .PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS */.P3.ALREADY_EXISTS
+                        });
+                    }
+                    throw error;
+                }
+            }
+        }
+        if (itemsToRemove.length > 0) {
+            const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
+            const result = await permissionRepo.delete({
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                sourceId: dto.roleId,
+                targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                targetId: (0,typeorm__rspack_import_3.In)(actionIdsToRemove)
+            });
+            removed = result.affected || 0;
+        }
+        await this.permissionCacheService.invalidateRoleMembersCache(dto.roleId);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(_config_index_js__rspack_import_16/* .IAM_EVENT_ENTITIES.ROLE_ACTION */.H.ROLE_ACTION, dto.roleId, result);
+        return result;
+    }
+    async getRoleActions(roleId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const permissions = await permissionRepo.find({
+            where: {
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                sourceId: roleId
+            }
+        });
+        if (permissions.length === 0) {
+            return [];
+        }
+        const actionIds = permissions.map((p)=>p.targetId);
+        const actionMap = await this.getActionsMap(actionIds);
+        return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
+            const action = actionMap.get(p.targetId);
+            return {
+                id: p.id,
+                roleId: p.sourceId,
+                actionId: action.id,
+                actionCode: action.code ?? '',
+                actionName: action.name,
+                createdAt: p.createdAt
+            };
+        });
+    }
+    // Company-Action Permissions (Whitelist)
+    /** Assign or remove actions to/from a company (whitelist) */ async assignCompanyActions(dto) {
+        const permissionRepo = await this.getPermissionRepository();
+        const dataSource = await this.dataSourceProvider.getDataSource();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
+        let added = 0;
+        let removed = 0;
+        await dataSource.transaction(async (manager)=>{
+            const transactionalPermissionRepo = manager.getRepository(permissionRepo.target);
+            if (itemsToAdd.length > 0) {
+                const actionIdsToAdd = itemsToAdd.map((item)=>item.id);
+                const existingPermissions = await transactionalPermissionRepo.find({
+                    where: {
+                        permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.COMPANY_ACTION */.V.COMPANY_ACTION,
+                        sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.COMPANY */.n.COMPANY,
+                        sourceId: dto.companyId,
+                        targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                        targetId: (0,typeorm__rspack_import_3.In)(actionIdsToAdd)
+                    },
+                    select: [
+                        'targetId'
+                    ]
+                });
+                const existingActionIds = new Set(existingPermissions.map((p)=>p.targetId));
+                const newActionIds = actionIdsToAdd.filter((id)=>!existingActionIds.has(id));
+                if (newActionIds.length > 0) {
+                    const newPermissions = newActionIds.map((actionId)=>transactionalPermissionRepo.create({
+                            permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.COMPANY_ACTION */.V.COMPANY_ACTION,
+                            sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.COMPANY */.n.COMPANY,
+                            sourceId: dto.companyId,
+                            targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                            targetId: actionId
+                        }));
+                    await transactionalPermissionRepo.save(newPermissions);
+                    added = newPermissions.length;
+                }
+            }
+            if (itemsToRemove.length > 0) {
+                const actionIdsToRemove = itemsToRemove.map((item)=>item.id);
+                const companyResult = await transactionalPermissionRepo.delete({
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.COMPANY_ACTION */.V.COMPANY_ACTION,
+                    sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.COMPANY */.n.COMPANY,
+                    sourceId: dto.companyId,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                    targetId: (0,typeorm__rspack_import_3.In)(actionIdsToRemove)
+                });
+                removed = companyResult.affected || 0;
+                // Cascade: an action no longer on the company whitelist must not remain
+                // reachable via role grants or direct user grants scoped to this company.
+                const roleEntity = enableCompanyFeature ? _entities_role_with_company_entity_js__rspack_import_7/* .RoleWithCompany */.g : _entities_role_entity_js__rspack_import_8/* .Role */.X;
+                const roleRepo = manager.getRepository(roleEntity);
+                const companyRoles = await roleRepo.find({
+                    where: {
+                        companyId: dto.companyId,
+                        deletedAt: (0,typeorm__rspack_import_3.IsNull)()
+                    },
+                    select: [
+                        'id'
+                    ]
+                });
+                if (companyRoles.length > 0) {
+                    const roleIds = companyRoles.map((role)=>role.id);
+                    await transactionalPermissionRepo.delete({
+                        permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+                        sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                        sourceId: (0,typeorm__rspack_import_3.In)(roleIds),
+                        targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                        targetId: (0,typeorm__rspack_import_3.In)(actionIdsToRemove)
+                    });
+                }
+                if (enableCompanyFeature) {
+                    await transactionalPermissionRepo.delete({
+                        permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+                        companyId: dto.companyId,
+                        targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ACTION */.n.ACTION,
+                        targetId: (0,typeorm__rspack_import_3.In)(actionIdsToRemove)
+                    });
+                }
+            }
+        });
+        await this.permissionCacheService.invalidateCompanyMembersCache(dto.companyId);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(_config_index_js__rspack_import_16/* .IAM_EVENT_ENTITIES.COMPANY_ACTION */.H.COMPANY_ACTION, dto.companyId, result);
+        return result;
+    }
+    /** Get all actions assigned to a company (whitelist) */ async getCompanyActions(companyId, isOnlyId = false) {
+        const permissionRepo = await this.getPermissionRepository();
+        const permissions = await permissionRepo.find({
+            where: {
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.COMPANY_ACTION */.V.COMPANY_ACTION,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.COMPANY */.n.COMPANY,
+                sourceId: companyId
+            }
+        });
+        if (permissions.length === 0) {
+            return [];
+        }
+        const actionIds = permissions.map((p)=>p.targetId);
+        if (isOnlyId) return actionIds;
+        const actionMap = await this.getActionsMap(actionIds);
+        return permissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
+            const action = actionMap.get(p.targetId);
+            return {
+                id: p.id,
+                companyId: companyId,
+                actionId: action.id,
+                actionCode: action.code ?? '',
+                actionName: action.name,
+                createdAt: p.createdAt
+            };
+        });
+    }
+    // User-Role Permissions
+    /** Assign user to roles (branch-scoped when company feature is enabled) */ async assignUserRoles(dto) {
+        if (!this.iamConfigService.isRbacEnabled()) {
+            throw new _nestjs_common__rspack_import_2.BadRequestException({
+                message: 'Role assignment not available in DIRECT-only mode. Use direct user permissions instead.',
+                messageKey: _config_index_js__rspack_import_13/* .IAM_MODE_MESSAGES.ROLE_ASSIGNMENT_UNAVAILABLE */.xI.ROLE_ASSIGNMENT_UNAVAILABLE
+            });
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const branchId = dto.branchId ?? null;
+        const companyId = dto.companyId ?? null;
+        const { toAdd: itemsToAdd, toRemove: itemsToRemove } = this.splitItemsByAction(dto.items);
+        let added = 0;
+        let removed = 0;
+        if (itemsToAdd.length > 0) {
+            const roleIdsToAdd = itemsToAdd.map((item)=>item.id);
+            const whereFind = {
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+                sourceId: dto.userId,
+                targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                targetId: (0,typeorm__rspack_import_3.In)(roleIdsToAdd)
+            };
+            if (enableCompanyFeature) {
+                if (companyId) whereFind.companyId = companyId;
+                if (branchId) whereFind.branchId = branchId;
+            }
+            const existingPermissions = await permissionRepo.find({
+                where: whereFind,
+                select: [
+                    'targetId'
+                ]
+            });
+            const existingRoleIds = new Set(existingPermissions.map((p)=>p.targetId));
+            const newPermissions = itemsToAdd.filter((item)=>!existingRoleIds.has(item.id)).map((item)=>({
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                    sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+                    sourceId: dto.userId,
+                    targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                    targetId: item.id,
+                    companyId: enableCompanyFeature ? companyId : null,
+                    branchId: enableCompanyFeature ? branchId : null
+                }));
+            if (newPermissions.length > 0) {
+                try {
+                    await permissionRepo.save(newPermissions);
+                    added = newPermissions.length;
+                } catch (error) {
+                    if (error?.code === 'ER_DUP_ENTRY' || error?.message?.includes('Duplicate entry')) {
+                        throw new _nestjs_common__rspack_import_2.ConflictException({
+                            message: 'Some user-role permissions already exist. Please refresh and try again.',
+                            messageKey: _config_index_js__rspack_import_13/* .PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS */.P3.ALREADY_EXISTS
+                        });
+                    }
+                    throw error;
+                }
+            }
+        }
+        if (itemsToRemove.length > 0) {
+            const roleIdsToRemove = itemsToRemove.map((item)=>item.id);
+            const whereDelete = {
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+                sourceId: dto.userId,
+                targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                targetId: (0,typeorm__rspack_import_3.In)(roleIdsToRemove)
+            };
+            if (enableCompanyFeature) {
+                if (companyId) whereDelete.companyId = companyId;
+                if (branchId) whereDelete.branchId = branchId;
+            }
+            const result = await permissionRepo.delete(whereDelete);
+            removed = result.affected || 0;
+        }
+        await this.permissionCacheService.invalidateUser(dto.userId, enableCompanyFeature ? companyId : null, [
+            branchId
+        ]);
+        const result = this.buildOperationResult(dto.items.length, added, removed);
+        await this.publishAssignmentEvent(_config_index_js__rspack_import_16/* .IAM_EVENT_ENTITIES.USER_ROLE */.H.USER_ROLE, dto.userId, result);
+        return result;
+    }
+    /** Get user's roles (branch-scoped, filtered by companyId and branchId if provided) */ async getUserRoles(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const roleRepo = await this.getRoleRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const where = {
+            permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+            sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+            sourceId: userId
+        };
+        if (enableCompanyFeature) {
+            if (companyId) where.companyId = companyId;
+            if (branchId) where.branchId = branchId;
+        }
+        const permissions = await permissionRepo.find({
+            where
+        });
+        if (permissions.length === 0) {
+            return [];
+        }
+        const roleIds = permissions.map((p)=>p.targetId);
+        const roleWhere = {
+            id: (0,typeorm__rspack_import_3.In)(roleIds)
+        };
+        const roles = await roleRepo.find({
+            where: roleWhere
+        });
+        const roleMap = new Map(roles.map((r)=>[
+                r.id,
+                r
+            ]));
+        return permissions.filter((p)=>roleMap.has(p.targetId)).map((p)=>{
+            const role = roleMap.get(p.targetId);
+            const permissionEntity = p;
+            return {
+                id: p.id,
+                userId: p.sourceId,
+                roleId: role.id,
+                roleName: role.name,
+                branchId: enableCompanyFeature ? permissionEntity.branchId ?? null : null,
+                createdAt: p.createdAt
+            };
+        });
+    }
+    /** Get users assigned a role (reverse lookup: role -> users) */ async getUsersForRole(roleId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const permissions = await permissionRepo.find({
+            where: {
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                targetType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                targetId: roleId
+            }
+        });
+        return permissions.map((p)=>({
+                id: p.id,
+                userId: p.sourceId,
+                createdAt: p.createdAt
+            }));
+    }
+    // Effective (Merged) Permissions — self-scoped, company-wide + branch-specific
+    /** Get user's effective roles: company-wide (branchId null) merged with branch-specific */ async getUserEffectiveRoles(userId, companyId, branchId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const roleRepo = await this.getRoleRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const baseWhere = {
+            permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+            sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+            sourceId: userId
+        };
+        if (enableCompanyFeature && companyId) baseWhere.companyId = companyId;
+        const permissions = enableCompanyFeature && branchId ? await permissionRepo.find({
+            where: [
+                {
+                    ...baseWhere,
+                    branchId: (0,typeorm__rspack_import_3.IsNull)()
+                },
+                {
+                    ...baseWhere,
+                    branchId
+                }
+            ]
+        }) : await permissionRepo.find({
+            where: baseWhere
+        });
+        const validPermissions = permissions.filter((p)=>p.isValid());
+        if (validPermissions.length === 0) {
+            return [];
+        }
+        const roleIds = [
+            ...new Set(validPermissions.map((p)=>p.targetId))
+        ];
+        const roles = await roleRepo.find({
+            where: {
+                id: (0,typeorm__rspack_import_3.In)(roleIds)
+            }
+        });
+        const roleMap = new Map(roles.map((r)=>[
+                r.id,
+                r
+            ]));
+        return validPermissions.filter((p)=>roleMap.has(p.targetId)).map((p)=>{
+            const role = roleMap.get(p.targetId);
+            return {
+                id: p.id,
+                userId: p.sourceId,
+                roleId: role.id,
+                roleName: role.name,
+                branchId: enableCompanyFeature ? p.branchId ?? null : null,
+                createdAt: p.createdAt
+            };
+        });
+    }
+    /** Get user's effective actions: company-wide (branchId null) merged with branch-specific */ async getUserEffectiveActions(userId, companyId, branchId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const baseWhere = {
+            permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION,
+            sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+            sourceId: userId
+        };
+        if (enableCompanyFeature && companyId) baseWhere.companyId = companyId;
+        const permissions = enableCompanyFeature && branchId ? await permissionRepo.find({
+            where: [
+                {
+                    ...baseWhere,
+                    branchId: (0,typeorm__rspack_import_3.IsNull)()
+                },
+                {
+                    ...baseWhere,
+                    branchId
+                }
+            ]
+        }) : await permissionRepo.find({
+            where: baseWhere
+        });
+        const validPermissions = permissions.filter((p)=>p.isValid());
+        if (validPermissions.length === 0) {
+            return [];
+        }
+        const actionIds = [
+            ...new Set(validPermissions.map((p)=>p.targetId))
+        ];
+        const actionMap = await this.getActionsMap(actionIds);
+        return validPermissions.filter((p)=>actionMap.has(p.targetId)).map((p)=>{
+            const action = actionMap.get(p.targetId);
+            return {
+                id: p.id,
+                userId: p.sourceId,
+                actionId: action.id,
+                actionCode: action.code ?? '',
+                actionName: action.name,
+                companyId: ('companyId' in p ? p.companyId : null) ?? null,
+                branchId: ('branchId' in p ? p.branchId : null) ?? null,
+                createdAt: p.createdAt
+            };
+        });
+    }
+    // My Permissions
+    /** Get user's effective permissions (cache-first approach) */ async getMyPermissions(userId, branchId, companyId, parentCodes) {
+        return this.permissionCacheService.getMyPermissionsResponse(userId, branchId, companyId, parentCodes);
+    }
+    // Helper Methods
+    /** Split permission items into add and remove arrays */ splitItemsByAction(items) {
+        return {
+            toAdd: items.filter((item)=>item.action === _dtos_permission_dto_js__rspack_import_4/* .PermissionAction.ADD */.aG.ADD),
+            toRemove: items.filter((item)=>item.action === _dtos_permission_dto_js__rspack_import_4/* .PermissionAction.REMOVE */.aG.REMOVE)
+        };
+    }
+    async publishAssignmentEvent(entity, targetId, result) {
+        await (0,_flusys_nestjs_shared_classes__rspack_import_1.publishDomainEvent)({
+            module: (/* inlined export .IAM_EVENT_MODULE */"iam"),
+            entity,
+            action: _config_index_js__rspack_import_16/* .IAM_EVENT_ACTIONS.PERMISSIONS_ASSIGNED */.X.PERMISSIONS_ASSIGNED,
+            ids: [
+                targetId
+            ],
+            metadata: {
+                added: result.added,
+                removed: result.removed,
+                total: result.total
+            }
+        });
+    }
+    /** Build standard operation result DTO */ buildOperationResult(_totalItems, added, removed) {
+        return {
+            added,
+            removed,
+            total: _totalItems
+        };
+    }
+    async revokeCompanyPermissions(companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const roleRepo = await this.getRoleRepository();
+        const dataSource = await this.dataSourceProvider.getDataSource();
+        const companyRoles = await roleRepo.find({
+            where: {
+                companyId,
+                deletedAt: (0,typeorm__rspack_import_3.IsNull)()
+            },
+            select: [
+                'id'
+            ]
+        });
+        const roleIds = companyRoles.map((role)=>role.id);
+        const affectedUserRows = await permissionRepo.find({
+            where: {
+                permissionType: (0,typeorm__rspack_import_3.In)([
+                    _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                    _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION
+                ]),
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+                companyId
+            },
+            select: [
+                'sourceId'
+            ]
+        });
+        const affectedUserIds = [
+            ...new Set(affectedUserRows.map((row)=>row.sourceId))
+        ];
+        await dataSource.transaction(async (manager)=>{
+            const txRepo = manager.getRepository(permissionRepo.target);
+            await txRepo.delete({
+                permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.COMPANY_ACTION */.V.COMPANY_ACTION,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.COMPANY */.n.COMPANY,
+                sourceId: companyId
+            });
+            if (roleIds.length > 0) {
+                await txRepo.delete({
+                    permissionType: _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+                    sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.ROLE */.n.ROLE,
+                    sourceId: (0,typeorm__rspack_import_3.In)(roleIds)
+                });
+            }
+            await txRepo.delete({
+                permissionType: (0,typeorm__rspack_import_3.In)([
+                    _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                    _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION
+                ]),
+                companyId
+            });
+            if (roleIds.length > 0) {
+                const txRoleRepo = manager.getRepository(roleRepo.target);
+                await txRoleRepo.delete(roleIds);
+            }
+        });
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId);
+        }
+    }
+    async revokeBranchPermissions(branchId, companyId) {
+        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
+            return;
+        }
+        const permissionRepo = await this.getPermissionRepository();
+        const where = {
+            permissionType: (0,typeorm__rspack_import_3.In)([
+                _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION
+            ]),
+            companyId,
+            branchId
+        };
+        const affectedUserRows = await permissionRepo.find({
+            where: {
+                ...where,
+                sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER
+            },
+            select: [
+                'sourceId'
+            ]
+        });
+        const affectedUserIds = [
+            ...new Set(affectedUserRows.map((row)=>row.sourceId))
+        ];
+        await permissionRepo.delete(where);
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds, companyId, [
+                branchId
+            ]);
+        }
+    }
+    async revokeUserCompanyAccess(userId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        await permissionRepo.delete({
+            permissionType: (0,typeorm__rspack_import_3.In)([
+                _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION
+            ]),
+            sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+            sourceId: userId,
+            companyId
+        });
+        await this.permissionCacheService.invalidateUser(userId, companyId);
+    }
+    async revokeUserBranchAccess(userId, branchId, companyId) {
+        const permissionRepo = await this.getPermissionRepository();
+        const where = {
+            permissionType: (0,typeorm__rspack_import_3.In)([
+                _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                _enums_iam_permission_type_enum_js__rspack_import_14/* .IamPermissionType.USER_ACTION */.V.USER_ACTION
+            ]),
+            sourceType: _enums_iam_entity_type_enum_js__rspack_import_15/* .IamEntityType.USER */.n.USER,
+            sourceId: userId,
+            branchId,
+            companyId
+        };
+        await permissionRepo.delete(where);
+        await this.permissionCacheService.invalidateUser(userId, companyId, [
+            branchId
+        ]);
+    }
+}
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'iam.assignUserActions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _dtos_permission_dto_js__rspack_import_4/* .AssignUserActionsDto */.zs === "undefined" ? Object : _dtos_permission_dto_js__rspack_import_4/* .AssignUserActionsDto */.zs
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "assignUserActions", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'iam.assignRoleActions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _dtos_permission_dto_js__rspack_import_4/* .AssignRoleActionsDto */.cv === "undefined" ? Object : _dtos_permission_dto_js__rspack_import_4/* .AssignRoleActionsDto */.cv
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "assignRoleActions", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'iam.assignCompanyActions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _dtos_permission_dto_js__rspack_import_4/* .AssignCompanyActionsDto */.Nx === "undefined" ? Object : _dtos_permission_dto_js__rspack_import_4/* .AssignCompanyActionsDto */.Nx
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "assignCompanyActions", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'iam.assignUserRoles',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _dtos_permission_dto_js__rspack_import_4/* .AssignUserRolesDto */.Xz === "undefined" ? Object : _dtos_permission_dto_js__rspack_import_4/* .AssignUserRolesDto */.Xz
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "assignUserRoles", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'iam.revokeCompanyPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeCompanyPermissions", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'iam.revokeBranchPermissions',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeBranchPermissions", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'iam.revokeUserCompanyAccess',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeUserCompanyAccess", null);
+_ts_decorate([
+    (0,_flusys_nestjs_shared__rspack_import_0.LogAction)({
+        action: 'iam.revokeUserBranchAccess',
+        module: 'iam'
+    }),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        String,
+        String,
+        String
+    ]),
+    _ts_metadata("design:returntype", Promise)
+], PermissionService.prototype, "revokeUserBranchAccess", null);
+PermissionService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_2.Injectable)({
+        scope: _nestjs_common__rspack_import_2.Scope.REQUEST
+    }),
+    _ts_param(0, (0,_nestjs_common__rspack_import_2.Inject)(_permission_cache_service_js__rspack_import_12/* .PermissionCacheService */.D)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_2.Inject)(_iam_config_service_js__rspack_import_10/* .IAMConfigService */.N)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_2.Inject)(_iam_datasource_service_js__rspack_import_11/* .IAMDataSourceService */.U)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _permission_cache_service_js__rspack_import_12/* .PermissionCacheService */.D === "undefined" ? Object : _permission_cache_service_js__rspack_import_12/* .PermissionCacheService */.D,
+        typeof _iam_config_service_js__rspack_import_10/* .IAMConfigService */.N === "undefined" ? Object : _iam_config_service_js__rspack_import_10/* .IAMConfigService */.N,
+        typeof _iam_datasource_service_js__rspack_import_11/* .IAMDataSourceService */.U === "undefined" ? Object : _iam_datasource_service_js__rspack_import_11/* .IAMDataSourceService */.U
+    ])
+], PermissionService);
+
+__webpack_require__.d(__webpack_exports__, {
+  n: () => (PermissionService)
+});
+
+
+},
+446(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  W: () => (/* binding */ RoleService)
+});
+
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/classes"
+var classes_ = __webpack_require__(937);
+// EXTERNAL MODULE: external "@flusys/nestjs-shared/modules"
+var modules_ = __webpack_require__(236);
+;// CONCATENATED MODULE: external "@flusys/nestjs-shared/utils"
+
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+// EXTERNAL MODULE: external "typeorm"
+var external_typeorm_ = __webpack_require__(158);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/config/event-actions.ts
+var event_actions = __webpack_require__(916);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/config/message-keys.ts
+var message_keys = __webpack_require__(490);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/permission-with-company.entity.ts
+var permission_with_company_entity = __webpack_require__(746);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/role-with-company.entity.ts
+var role_with_company_entity = __webpack_require__(353);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/role.entity.ts
+var role_entity = __webpack_require__(326);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/entities/user-iam-permission.entity.ts
+var user_iam_permission_entity = __webpack_require__(489);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/enums/iam-entity-type.enum.ts
+var iam_entity_type_enum = __webpack_require__(85);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/enums/iam-permission-type.enum.ts
+var iam_permission_type_enum = __webpack_require__(517);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/services/iam-config.service.ts
+var iam_config_service = __webpack_require__(645);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/services/iam-datasource.service.ts + 1 modules
+var iam_datasource_service = __webpack_require__(831);
+// EXTERNAL MODULE: ./projects/nestjs-iam/src/services/permission-cache.service.ts + 1 modules
+var permission_cache_service = __webpack_require__(99);
+;// CONCATENATED MODULE: ./projects/nestjs-iam/src/services/role.service.ts
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+class RoleService extends classes_.ApiService {
+    cacheManager;
+    utilsService;
+    iamConfigService;
+    permissionCacheService;
+    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionCacheService){
+        super(event_actions/* .IAM_EVENT_ENTITIES.ROLE */.H.ROLE, cacheManager, utilsService, RoleService.name, true, (/* inlined export .IAM_EVENT_MODULE */"iam"), dataSourceProvider, iamConfigService.isCompanyFeatureEnabled() ? role_with_company_entity/* .RoleWithCompany */.g : role_entity/* .Role */.X), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionCacheService = permissionCacheService;
+    }
+    async beforeUpdateOperation(dto, _user, _queryRunner) {
+        const dtos = Array.isArray(dto) ? dto : [
+            dto
+        ];
+        const ids = dtos.map((d)=>d.id);
+        await this.ensureDataSourceRepository();
+        const readonlyRoles = await this.repository.find({
+            where: {
+                id: (0,external_typeorm_.In)(ids),
+                readOnly: true,
+                deletedAt: (0,external_typeorm_.IsNull)()
+            }
+        });
+        if (readonlyRoles.length > 0) {
+            const names = readonlyRoles.map((r)=>r.name).join(', ');
+            throw new common_.ForbiddenException({
+                message: `Cannot modify readonly role(s): ${names}`,
+                messageKey: message_keys/* .ROLE_MESSAGES.READONLY_UPDATE_FORBIDDEN */.QW.READONLY_UPDATE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+    }
+    async beforeDeleteOperation(dto, user, queryRunner) {
+        await super.beforeDeleteOperation(dto, user, queryRunner);
+        const roleIds = Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ];
+        if (roleIds.length === 0) {
+            return;
+        }
+        await this.ensureDataSourceRepository();
+        const readonlyRoles = await this.repository.find({
+            where: {
+                id: (0,external_typeorm_.In)(roleIds),
+                readOnly: true,
+                deletedAt: (0,external_typeorm_.IsNull)()
+            }
+        });
+        if (readonlyRoles.length > 0) {
+            const names = readonlyRoles.map((r)=>r.name).join(', ');
+            throw new common_.ForbiddenException({
+                message: `Cannot delete readonly role(s): ${names}`,
+                messageKey: message_keys/* .ROLE_MESSAGES.READONLY_DELETE_FORBIDDEN */.QW.READONLY_DELETE_FORBIDDEN,
+                messageVariables: {
+                    names
+                }
+            });
+        }
+        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
+        const permissionEntity = enableCompanyFeature ? permission_with_company_entity/* .UserIamPermissionWithCompany */.t : user_iam_permission_entity/* .UserIamPermission */.y;
+        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
+        const userRoleRows = await permissionRepo.find({
+            where: {
+                permissionType: iam_permission_type_enum/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+                sourceType: iam_entity_type_enum/* .IamEntityType.USER */.n.USER,
+                targetType: iam_entity_type_enum/* .IamEntityType.ROLE */.n.ROLE,
+                targetId: (0,external_typeorm_.In)(roleIds)
+            }
+        });
+        const affectedUserIds = [
+            ...new Set(userRoleRows.map((row)=>row.sourceId))
+        ];
+        await permissionRepo.delete({
+            permissionType: iam_permission_type_enum/* .IamPermissionType.ROLE_ACTION */.V.ROLE_ACTION,
+            sourceType: iam_entity_type_enum/* .IamEntityType.ROLE */.n.ROLE,
+            sourceId: (0,external_typeorm_.In)(roleIds)
+        });
+        await permissionRepo.delete({
+            permissionType: iam_permission_type_enum/* .IamPermissionType.USER_ROLE */.V.USER_ROLE,
+            targetType: iam_entity_type_enum/* .IamEntityType.ROLE */.n.ROLE,
+            targetId: (0,external_typeorm_.In)(roleIds)
+        });
+        if (affectedUserIds.length > 0) {
+            await this.permissionCacheService.invalidateUsers(affectedUserIds);
+        }
+    }
+    // Entity Conversion
+    async convertSingleDtoToEntity(dto, user) {
+        const entity = await super.convertSingleDtoToEntity(dto, user);
+        // Handle companyId based on company feature
+        if (this.iamConfigService.isCompanyFeatureEnabled()) {
+            const isUpdate = 'id' in dto && dto.id;
+            // For create: use dto.companyId or user's companyId
+            // For update: only override if explicitly provided
+            if (!isUpdate || dto.companyId !== undefined) {
+                entity.companyId = dto.companyId ?? user?.companyId ?? null;
+            }
+        }
+        return entity;
+    }
+    // Query Customization
+    async getSelectQuery(query, _user, select) {
+        if (!select?.length) {
+            select = [
+                'id',
+                'name',
+                'description',
+                'isActive',
+                'readOnly',
+                'serial',
+                'createdAt'
+            ];
+            if (this.iamConfigService.isCompanyFeatureEnabled()) {
+                select.push('companyId');
+            }
+        }
+        query.select(select.map((f)=>`${this.entityName}.${f}`));
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getGlobalSearchQuery(query, search) {
+        query.andWhere('(role.name LIKE :search OR role.description LIKE :search)', {
+            search: `%${search}%`
+        });
+        return {
+            query,
+            isRaw: false
+        };
+    }
+    async getExtraManipulateQuery(query, filterDto, user) {
+        const result = await super.getExtraManipulateQuery(query, filterDto, user);
+        (0,__rspack_external__flusys_nestjs_shared_utils_9125c1f1.applyCompanyFilter)(query, {
+            isCompanyFeatureEnabled: this.iamConfigService.isCompanyFeatureEnabled(),
+            entityAlias: 'role'
+        }, user);
+        return result;
+    }
+    // Response Conversion
+    convertEntityToResponseDto(entity, _isRaw) {
+        return {
+            id: entity.id,
+            readOnly: entity.readOnly,
+            name: entity.name,
+            description: entity.description,
+            isActive: entity.isActive,
+            serial: entity.serial,
+            companyId: ('companyId' in entity ? entity.companyId : null) ?? null,
+            createdAt: entity.createdAt,
+            updatedAt: entity.updatedAt,
+            deletedAt: entity.deletedAt,
+            createdById: entity.createdById,
+            updatedById: entity.updatedById,
+            deletedById: entity.deletedById
+        };
+    }
+}
+RoleService = _ts_decorate([
+    (0,common_.Injectable)({
+        scope: common_.Scope.REQUEST
+    }),
+    _ts_param(0, (0,common_.Inject)('CACHE_INSTANCE')),
+    _ts_param(1, (0,common_.Inject)(modules_.UtilsService)),
+    _ts_param(2, (0,common_.Inject)(iam_config_service/* .IAMConfigService */.N)),
+    _ts_param(3, (0,common_.Inject)(iam_datasource_service/* .IAMDataSourceService */.U)),
+    _ts_param(4, (0,common_.Inject)(permission_cache_service/* .PermissionCacheService */.D)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof classes_.HybridCache === "undefined" ? Object : classes_.HybridCache,
+        typeof modules_.UtilsService === "undefined" ? Object : modules_.UtilsService,
+        typeof iam_config_service/* .IAMConfigService */.N === "undefined" ? Object : iam_config_service/* .IAMConfigService */.N,
+        typeof iam_datasource_service/* .IAMDataSourceService */.U === "undefined" ? Object : iam_datasource_service/* .IAMDataSourceService */.U,
+        typeof permission_cache_service/* .PermissionCacheService */.D === "undefined" ? Object : permission_cache_service/* .PermissionCacheService */.D
+    ])
+], RoleService);
+
+
+},
+422(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_393d2cae;
+
+
+},
+937(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_classes_6076a329;
+
+
+},
+236(module) {
+
+module.exports = __rspack_external__flusys_nestjs_shared_modules_24702bee;
+
+
+},
+157(module) {
+
+module.exports = __rspack_external__nestjs_common_a04939da;
+
+
+},
+176(module) {
+
+module.exports = __rspack_external__nestjs_swagger_7cd450b5;
+
+
+},
+812(module) {
+
+module.exports = __rspack_external_class_transformer_c5a479fb;
+
+
+},
+421(module) {
+
+module.exports = __rspack_external_class_validator_7b99ef4d;
+
+
+},
+158(module) {
+
+module.exports = __rspack_external_typeorm;
+
+
+},
+
+};