@flusys/nestjs-iam 7.1.0 → 8.0.0

package/fesm/services/permission-cache.service.js

@@ -1,527 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { envConfig } from '@flusys/nestjs-core/config';
-import { buildPermissionCacheKey, HybridCache, LogAction, PERMISSION_GUARD_CONFIG, PermissionCacheKeyOptions, PermissionGuardConfig } from '@flusys/nestjs-shared';
-import { Inject, Injectable, Optional, Scope } from '@nestjs/common';
-import { In, IsNull } from 'typeorm';
-import { Action } from '../entities/action.entity';
-import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
-import { RoleWithCompany } from '../entities/role-with-company.entity';
-import { Role } from '../entities/role.entity';
-import { UserIamPermission } from '../entities/user-iam-permission.entity';
-import { ActionType } from '../enums/action-type.enum';
-import { IamEntityType } from '../enums/iam-entity-type.enum';
-import { IamPermissionType } from '../enums/iam-permission-type.enum';
-import { IAMPermissionMode } from '../enums/permission-type.enum';
-import { IAMConfigService } from './iam-config.service';
-import { IAMDataSourceService } from './iam-datasource.service';
-export { PermissionCacheKeyOptions } from '@flusys/nestjs-shared';
-const NO_COMPANY_SCOPE = 'none';
-export class PermissionCacheService {
-    // Repository Getters
-    async getPermissionRepository() {
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const entity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
-        return this.dataSourceProvider.getRepository(entity);
-    }
-    async getActionRepository() {
-        return this.dataSourceProvider.getRepository(Action);
-    }
-    async getRoleRepository() {
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const entity = enableCompanyFeature ? RoleWithCompany : Role;
-        return this.dataSourceProvider.getRepository(entity);
-    }
-    // Cache Key Generation
-    parseDurationMs(duration) {
-        const unitMs = {
-            ms: 1,
-            s: 1000,
-            m: 60000,
-            h: 3600000,
-            d: 86400000,
-            w: 604800000
-        };
-        const match = /^(\d+)\s*(ms|s|m|h|d|w)?$/i.exec(duration.trim());
-        if (!match) {
-            return unitMs.h; // fallback: 1 hour
-        }
-        const unit = (match[2] || 'ms').toLowerCase();
-        return Number(match[1]) * unitMs[unit];
-    }
-    buildCacheKey(options) {
-        return buildPermissionCacheKey(options, this.guardConfig);
-    }
-    scopeToken(companyId) {
-        return companyId || NO_COMPANY_SCOPE;
-    }
-    buildTrackedKeysKey(userId, companyId) {
-        return `${this.TRACKED_KEYS_PREFIX}:user:${userId}:company:${this.scopeToken(companyId)}`;
-    }
-    buildTrackedScopesKey(userId) {
-        return `${this.TRACKED_SCOPES_PREFIX}:user:${userId}`;
-    }
-    // Cache Operations
-    async setMyPermissions(options, data) {
-        const key = this.buildCacheKey(options);
-        await this.cacheManager.set(key, data, this.TTL);
-        await this.trackKey(options.userId, key, options.companyId);
-    }
-    async getMyPermissions(options) {
-        try {
-            const key = this.buildCacheKey(options);
-            const result = await this.cacheManager.get(key);
-            return result || null;
-        } catch  {
-            return null;
-        }
-    }
-    async trackKey(userId, key, companyId) {
-        try {
-            let scopeKey = key;
-            if (companyId) {
-                scopeKey = this.buildTrackedKeysKey(userId, companyId);
-                const keys = await this.cacheManager.get(scopeKey) || [];
-                if (!keys.includes(key)) {
-                    keys.push(key);
-                    await this.cacheManager.set(scopeKey, keys, this.TTL);
-                }
-            }
-            const scopesKey = this.buildTrackedScopesKey(userId);
-            const scopes = await this.cacheManager.get(scopesKey) || [];
-            if (!scopes.includes(scopeKey)) {
-                scopes.push(scopeKey);
-                await this.cacheManager.set(scopesKey, scopes, this.TTL);
-            }
-        } catch  {
-        // tracking is best-effort; a missed entry only widens invalidation, never narrows it
-        }
-    }
-    // My Permissions (cache-first read, DB-backed rebuild)
-    /** Get user's effective permissions (cache-first approach) */ async getMyPermissionsResponse(userId, branchId, companyId, parentCodes) {
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const cacheOptions = {
-            userId,
-            companyId: enableCompanyFeature ? companyId : null,
-            branchId: enableCompanyFeature ? branchId : null
-        };
-        const cachedData = await this.getMyPermissions(cacheOptions);
-        if (cachedData) {
-            return this.buildResponseFromCache(cachedData, parentCodes);
-        }
-        const freshData = await this.fetchAndCachePermissions(userId, branchId, companyId);
-        return this.buildResponseFromCache(freshData, parentCodes);
-    }
-    /** Build response from cached data, applying optional parentCodes filter */ async buildResponseFromCache(cachedData, parentCodes) {
-        let frontendActions = cachedData.frontendActions;
-        if (parentCodes?.length) {
-            const parentIds = await this.getParentIdsByCodesWithCache(parentCodes);
-            if (parentIds.size > 0) {
-                frontendActions = frontendActions.filter((a)=>a.parentId && parentIds.has(a.parentId));
-            } else {
-                frontendActions = [];
-            }
-        }
-        return {
-            frontendActions: frontendActions.map((a)=>({
-                    code: a.code,
-                    name: a.name,
-                    description: a.description
-                })),
-            cachedEndpoints: cachedData.backendCodes.length
-        };
-    }
-    /** Resolve action IDs for the given codes */ async getParentIdsByCodesWithCache(codes) {
-        const actionRepo = await this.getActionRepository();
-        const actions = await actionRepo.find({
-            where: {
-                code: In(codes)
-            },
-            select: [
-                'id',
-                'code'
-            ]
-        });
-        return new Set(actions.map((action)=>action.id));
-    }
-    /** Fetch permissions from DB and cache them (empty permissions are also cached) */ async fetchAndCachePermissions(userId, branchId, companyId) {
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const cacheOptions = {
-            userId,
-            companyId: enableCompanyFeature ? companyId : null,
-            branchId
-        };
-        const emptyData = {
-            frontendActions: [],
-            backendCodes: []
-        };
-        const allActionIds = await this.collectAllActionIds(userId, branchId, companyId);
-        if (allActionIds.size === 0) {
-            await this.setMyPermissions(cacheOptions, emptyData);
-            return emptyData;
-        }
-        return this.buildAndCachePermissionData(allActionIds, cacheOptions);
-    }
-    /** Collect all action IDs based on permission mode (RBAC, DIRECT, or FULL) */ async collectAllActionIds(userId, branchId, companyId) {
-        const permissionMode = this.iamConfigService.getPermissionMode();
-        const allActionIds = new Set();
-        if (permissionMode === IAMPermissionMode.RBAC || permissionMode === IAMPermissionMode.FULL) {
-            const userRoleIds = await this.getUserRoleIds(userId, branchId, companyId);
-            if (userRoleIds.length > 0) {
-                const roleActionIds = await this.getRoleActionIds(userRoleIds);
-                roleActionIds.forEach((id)=>allActionIds.add(id));
-            }
-        }
-        if (permissionMode === IAMPermissionMode.DIRECT || permissionMode === IAMPermissionMode.FULL) {
-            const userActionIds = await this.getUserActionIds(userId, branchId, companyId);
-            userActionIds.forEach((id)=>allActionIds.add(id));
-        }
-        return allActionIds;
-    }
-    /** Fetch actions from DB, separate by type, build cache data, and cache it */ async buildAndCachePermissionData(actionIds, cacheOptions) {
-        const actionRepo = await this.getActionRepository();
-        const actions = await actionRepo.find({
-            where: {
-                id: In(Array.from(actionIds)),
-                isActive: true
-            }
-        });
-        const backendActions = actions.filter((a)=>a.actionType === ActionType.BACKEND || a.actionType === ActionType.BOTH);
-        const frontendActions = actions.filter((a)=>a.actionType === ActionType.FRONTEND || a.actionType === ActionType.BOTH);
-        const backendCodes = backendActions.map((a)=>a.code).filter((c)=>!!c);
-        const cacheData = {
-            frontendActions: frontendActions.map((a)=>({
-                    id: a.id,
-                    code: a.code ?? '',
-                    name: a.name,
-                    description: a.description,
-                    parentId: a.parentId
-                })),
-            backendCodes
-        };
-        await this.setMyPermissions(cacheOptions, cacheData);
-        return cacheData;
-    }
-    /** Get role IDs assigned to a user (merges company-wide + branch-specific roles) */ async getUserRoleIds(userId, branchId, companyId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        if (!enableCompanyFeature) {
-            const permissions = await permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.USER_ROLE,
-                    sourceType: IamEntityType.USER,
-                    sourceId: userId
-                }
-            });
-            return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
-        }
-        const roleIds = new Set();
-        const baseWhere = {
-            permissionType: IamPermissionType.USER_ROLE,
-            sourceType: IamEntityType.USER,
-            sourceId: userId
-        };
-        if (companyId) {
-            baseWhere.companyId = companyId;
-        }
-        if (branchId) {
-            // Get company-wide + branch-specific roles
-            const companyWidePermissions = await permissionRepo.find({
-                where: {
-                    ...baseWhere,
-                    branchId: IsNull()
-                }
-            });
-            companyWidePermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
-            const branchPermissions = await permissionRepo.find({
-                where: {
-                    ...baseWhere,
-                    branchId
-                }
-            });
-            branchPermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
-        } else {
-            // No branch context: get all roles for this company
-            const allPermissions = await permissionRepo.find({
-                where: baseWhere
-            });
-            allPermissions.filter((p)=>p.isValid()).forEach((p)=>roleIds.add(p.targetId));
-        }
-        return Array.from(roleIds);
-    }
-    async getRoleActionIds(roleIds) {
-        const permissionRepo = await this.getPermissionRepository();
-        const permissions = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.ROLE_ACTION,
-                sourceType: IamEntityType.ROLE,
-                sourceId: In(roleIds)
-            }
-        });
-        return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
-    }
-    /** Get action IDs directly assigned to a user (merges company-wide + branch-specific actions) */ async getUserActionIds(userId, branchId, companyId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        if (!enableCompanyFeature) {
-            const permissions = await permissionRepo.find({
-                where: {
-                    permissionType: IamPermissionType.USER_ACTION,
-                    sourceType: IamEntityType.USER,
-                    sourceId: userId
-                }
-            });
-            return permissions.filter((p)=>p.isValid()).map((p)=>p.targetId);
-        }
-        const actionIds = new Set();
-        const baseWhere = {
-            permissionType: IamPermissionType.USER_ACTION,
-            sourceType: IamEntityType.USER,
-            sourceId: userId
-        };
-        if (companyId) {
-            baseWhere.companyId = companyId;
-        }
-        if (branchId) {
-            // Get company-wide + branch-specific actions
-            const companyWidePermissions = await permissionRepo.find({
-                where: {
-                    ...baseWhere,
-                    branchId: IsNull()
-                }
-            });
-            companyWidePermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
-            const branchPermissions = await permissionRepo.find({
-                where: {
-                    ...baseWhere,
-                    branchId
-                }
-            });
-            branchPermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
-        } else {
-            // No branch context: get all actions for this company
-            const allPermissions = await permissionRepo.find({
-                where: baseWhere
-            });
-            allPermissions.filter((p)=>p.isValid()).forEach((p)=>actionIds.add(p.targetId));
-        }
-        return Array.from(actionIds);
-    }
-    // Cache Invalidation
-    async invalidateUser(userId, companyId, branchIds) {
-        const keysToDelete = new Set();
-        /** Drop a scope entry from the tracked-scopes index, or queue the whole index for deletion once nothing remains */ const untrackScope = async (scopeKey)=>{
-            const scopesKeysKey = this.buildTrackedScopesKey(userId);
-            let scopesKeys = [];
-            try {
-                scopesKeys = await this.cacheManager.get(scopesKeysKey) || [];
-            } catch  {
-                scopesKeys = [];
-            }
-            if (scopeKey) {
-                const remainingScopes = scopesKeys.filter((scope)=>scope !== scopeKey);
-                if (remainingScopes.length > 0) {
-                    await this.cacheManager.set(scopesKeysKey, remainingScopes, this.TTL);
-                } else {
-                    keysToDelete.add(scopesKeysKey);
-                }
-            } else {
-                for (const scope of scopesKeys){
-                    if (scope.startsWith(this.TRACKED_KEYS_PREFIX)) {
-                        let nestedKeys = [];
-                        try {
-                            nestedKeys = await this.cacheManager.get(scope) || [];
-                        } catch  {
-                            nestedKeys = [];
-                        }
-                        nestedKeys.forEach((key)=>keysToDelete.add(key));
-                    }
-                    keysToDelete.add(scope);
-                }
-                keysToDelete.add(scopesKeysKey);
-            }
-        };
-        if (companyId) {
-            const trackedKeysKey = this.buildTrackedKeysKey(userId, companyId);
-            let trackedKeys = [];
-            try {
-                trackedKeys = await this.cacheManager.get(trackedKeysKey) || [];
-            } catch  {
-                trackedKeys = [];
-            }
-            const hasCompanyWideScope = branchIds?.some((branchId)=>!branchId);
-            if (!branchIds?.length || hasCompanyWideScope) {
-                trackedKeys.forEach((key)=>keysToDelete.add(key));
-                keysToDelete.add(trackedKeysKey);
-                await untrackScope(trackedKeysKey);
-            } else {
-                // Branch scope given: only invalidate those branches, keep the rest tracked
-                branchIds.forEach((branchId)=>keysToDelete.add(this.buildCacheKey({
-                        userId,
-                        companyId,
-                        branchId
-                    })));
-                const remainingKeys = trackedKeys.filter((key)=>!keysToDelete.has(key));
-                if (remainingKeys.length) {
-                    await this.cacheManager.set(trackedKeysKey, remainingKeys, this.TTL);
-                } else {
-                    keysToDelete.add(trackedKeysKey);
-                    await untrackScope(trackedKeysKey);
-                }
-            }
-        } else {
-            await untrackScope();
-        }
-        await Promise.all(Array.from(keysToDelete).map(async (key)=>{
-            try {
-                await this.cacheManager.del(key);
-            } catch  {}
-        }));
-    }
-    async invalidateUsers(userIds, companyId, branchIds) {
-        if (userIds.length === 0) {
-            return 0;
-        }
-        const results = await Promise.allSettled(userIds.map((userId)=>this.invalidateUser(userId, companyId, branchIds)));
-        return results.filter((r)=>r.status === 'fulfilled').length;
-    }
-    /** Invalidate permission cache for all users holding a given role */ async invalidateRoleMembersCache(roleId) {
-        const permissionRepo = await this.getPermissionRepository();
-        const roleRepo = await this.getRoleRepository();
-        const userRoles = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.USER_ROLE,
-                sourceType: IamEntityType.USER,
-                targetType: IamEntityType.ROLE,
-                targetId: roleId
-            }
-        });
-        const userIds = [
-            ...new Set(userRoles.map((ur)=>ur.sourceId))
-        ];
-        if (userIds.length === 0) {
-            return 0;
-        }
-        const role = await roleRepo.findOne({
-            where: {
-                id: roleId
-            }
-        });
-        const companyId = role?.companyId || null;
-        return this.invalidateUsers(userIds, companyId);
-    }
-    /** Invalidate permission cache for all users in a company */ async invalidateCompanyMembersCache(companyId) {
-        if (!this.iamConfigService.isCompanyFeatureEnabled()) {
-            return 0;
-        }
-        const permissionRepo = await this.getPermissionRepository();
-        const userPermissions = await permissionRepo.createQueryBuilder('p').select('DISTINCT p.source_id', 'userId').where('p.company_id = :companyId', {
-            companyId
-        }).andWhere('p.source_type = :sourceType', {
-            sourceType: IamEntityType.USER
-        }).getRawMany();
-        const userIds = [
-            ...new Set(userPermissions.map((p)=>p.userId).filter(Boolean))
-        ];
-        if (userIds.length === 0) {
-            return 0;
-        }
-        return this.invalidateUsers(userIds, companyId);
-    }
-    constructor(cacheManager, iamConfigService, dataSourceProvider, guardConfig){
-        _define_property(this, "cacheManager", void 0);
-        _define_property(this, "iamConfigService", void 0);
-        _define_property(this, "dataSourceProvider", void 0);
-        _define_property(this, "guardConfig", void 0);
-        _define_property(this, "TRACKED_KEYS_PREFIX", void 0);
-        _define_property(this, "TRACKED_SCOPES_PREFIX", void 0);
-        _define_property(this, "TTL", void 0);
-        this.cacheManager = cacheManager;
-        this.iamConfigService = iamConfigService;
-        this.dataSourceProvider = dataSourceProvider;
-        this.guardConfig = guardConfig;
-        this.TRACKED_KEYS_PREFIX = 'permission-tracked-keys';
-        this.TRACKED_SCOPES_PREFIX = 'permission-tracked-scopes';
-        this.TTL = this.parseDurationMs(envConfig.getJwtConfig().refreshExpiration);
-    }
-}
-_ts_decorate([
-    LogAction({
-        action: 'permissionCache.setMyPermissions',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof PermissionCacheKeyOptions === "undefined" ? Object : PermissionCacheKeyOptions,
-        typeof CachedMyPermissions === "undefined" ? Object : CachedMyPermissions
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "setMyPermissions", null);
-_ts_decorate([
-    LogAction({
-        action: 'permissionCache.invalidateUser',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        String,
-        Object,
-        Array
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "invalidateUser", null);
-_ts_decorate([
-    LogAction({
-        action: 'permissionCache.invalidateUsers',
-        module: 'iam'
-    }),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        Array,
-        Object,
-        Array
-    ]),
-    _ts_metadata("design:returntype", Promise)
-], PermissionCacheService.prototype, "invalidateUsers", null);
-PermissionCacheService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Inject('CACHE_INSTANCE')),
-    _ts_param(1, Inject(IAMConfigService)),
-    _ts_param(2, Inject(IAMDataSourceService)),
-    _ts_param(3, Optional()),
-    _ts_param(3, Inject(PERMISSION_GUARD_CONFIG)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof HybridCache === "undefined" ? Object : HybridCache,
-        typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
-        typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService,
-        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
-    ])
-], PermissionCacheService);