@flusys/nestjs-iam 7.1.0 → 8.0.0

package/fesm/services/permission.service.spec.js

@@ -1,914 +0,0 @@
-import { Test } from '@nestjs/testing';
-import { EventBusRegistry } from '@flusys/nestjs-shared/classes';
-import { createMockRepository } from '@test-utils/mocks/repository.mock';
-import { IAM_MODE_MESSAGES, PERMISSION_OPERATION_MESSAGES } from '../config';
-import { PermissionAction } from '../dtos/permission.dto';
-import { Action } from '../entities/action.entity';
-import { Role } from '../entities/role.entity';
-import { RoleWithCompany } from '../entities/role-with-company.entity';
-import { ActionType } from '../enums/action-type.enum';
-import { IamEntityType } from '../enums/iam-entity-type.enum';
-import { IamPermissionType } from '../enums/iam-permission-type.enum';
-import { IAMPermissionMode } from '../enums/permission-type.enum';
-import { IAMConfigService } from './iam-config.service';
-import { IAMDataSourceService } from './iam-datasource.service';
-import { PermissionCacheService } from './permission-cache.service';
-import { PermissionService } from './permission.service';
-function buildPermissionRow(overrides = {}) {
-    const row = {
-        id: 'perm-uuid-1',
-        permissionType: IamPermissionType.USER_ACTION,
-        sourceType: IamEntityType.USER,
-        sourceId: 'user-1',
-        targetType: IamEntityType.ACTION,
-        targetId: 'action-1',
-        companyId: null,
-        branchId: null,
-        validFrom: null,
-        validUntil: null,
-        reason: null,
-        createdAt: new Date(),
-        ...overrides
-    };
-    row.isValid = (now = new Date())=>{
-        if (row.validFrom && now < row.validFrom) return false;
-        if (row.validUntil && now > row.validUntil) return false;
-        return true;
-    };
-    return row;
-}
-function buildDeleteResult(affected) {
-    return {
-        affected,
-        raw: []
-    };
-}
-function mockRawMany(repo, rows) {
-    const builder = {
-        select: jest.fn().mockReturnThis(),
-        addSelect: jest.fn().mockReturnThis(),
-        where: jest.fn().mockReturnThis(),
-        andWhere: jest.fn().mockReturnThis(),
-        getRawMany: jest.fn().mockResolvedValue(rows)
-    };
-    repo.createQueryBuilder.mockReturnValue(builder);
-    return builder;
-}
-function buildAction(overrides = {}) {
-    return {
-        id: 'action-1',
-        name: 'View Users',
-        code: 'user.view',
-        description: null,
-        actionType: ActionType.BACKEND,
-        parentId: null,
-        isActive: true,
-        ...overrides
-    };
-}
-describe('PermissionService', ()=>{
-    let service;
-    let mockPermissionRepo;
-    let mockActionRepo;
-    let mockRoleRepo;
-    let mockIamConfigService;
-    let mockPermissionCacheService;
-    let mockDataSourceProvider;
-    beforeEach(async ()=>{
-        mockPermissionRepo = createMockRepository();
-        mockActionRepo = createMockRepository();
-        mockRoleRepo = createMockRepository();
-        mockDataSourceProvider = {
-            getRepository: jest.fn((entity)=>{
-                if (entity === Action) return Promise.resolve(mockActionRepo);
-                if (entity === Role || entity === RoleWithCompany) return Promise.resolve(mockRoleRepo);
-                return Promise.resolve(mockPermissionRepo);
-            }),
-            getDataSource: jest.fn()
-        };
-        mockIamConfigService = {
-            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false),
-            isDirectPermissionEnabled: jest.fn().mockReturnValue(true),
-            isRbacEnabled: jest.fn().mockReturnValue(true),
-            getPermissionMode: jest.fn().mockReturnValue(IAMPermissionMode.FULL)
-        };
-        mockPermissionCacheService = {
-            invalidateUser: jest.fn(),
-            invalidateUsers: jest.fn(),
-            invalidateRoleMembersCache: jest.fn(),
-            invalidateCompanyMembersCache: jest.fn(),
-            getMyPermissionsResponse: jest.fn()
-        };
-        const module = await Test.createTestingModule({
-            providers: [
-                PermissionService,
-                {
-                    provide: PermissionCacheService,
-                    useValue: mockPermissionCacheService
-                },
-                {
-                    provide: IAMConfigService,
-                    useValue: mockIamConfigService
-                },
-                {
-                    provide: IAMDataSourceService,
-                    useValue: mockDataSourceProvider
-                }
-            ]
-        }).compile();
-        service = await module.resolve(PermissionService);
-    });
-    // ==================== User-Action Permissions ====================
-    describe('assignUserActions', ()=>{
-        const dto = {
-            userId: 'user-1',
-            items: [
-                {
-                    id: 'action-1',
-                    action: PermissionAction.ADD
-                },
-                {
-                    id: 'action-2',
-                    action: PermissionAction.ADD
-                },
-                {
-                    id: 'action-3',
-                    action: PermissionAction.REMOVE
-                }
-            ]
-        };
-        it('throws BadRequestException when direct permissions are disabled (RBAC-only mode)', async ()=>{
-            mockIamConfigService.isDirectPermissionEnabled.mockReturnValue(false);
-            await expect(service.assignUserActions(dto)).rejects.toMatchObject({
-                response: expect.objectContaining({
-                    messageKey: IAM_MODE_MESSAGES.DIRECT_MODE_UNAVAILABLE
-                })
-            });
-            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
-        });
-        it('adds only actions not already assigned, removes requested actions, and invalidates the user cache', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([
-                {
-                    targetId: 'action-1'
-                }
-            ]);
-            mockPermissionRepo.save.mockResolvedValue([
-                {}
-            ]);
-            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
-            const result = await service.assignUserActions(dto);
-            expect(mockPermissionRepo.save).toHaveBeenCalledWith([
-                expect.objectContaining({
-                    targetId: 'action-2',
-                    companyId: null,
-                    branchId: null
-                })
-            ]);
-            expect(result).toEqual({
-                added: 1,
-                removed: 1,
-                total: 3
-            });
-            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', null, []);
-        });
-        it('scopes new permissions and cache invalidation to the company/branch when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionRepo.find.mockResolvedValue([]);
-            mockPermissionRepo.save.mockResolvedValue([
-                {},
-                {}
-            ]);
-            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
-            await service.assignUserActions({
-                userId: 'user-1',
-                companyId: 'company-1',
-                branchId: 'branch-1',
-                items: dto.items
-            });
-            expect(mockPermissionRepo.find).toHaveBeenCalledWith(expect.objectContaining({
-                where: expect.objectContaining({
-                    companyId: 'company-1',
-                    branchId: 'branch-1'
-                })
-            }));
-            expect(mockPermissionRepo.save).toHaveBeenCalledWith([
-                expect.objectContaining({
-                    companyId: 'company-1',
-                    branchId: 'branch-1'
-                }),
-                expect.objectContaining({
-                    companyId: 'company-1',
-                    branchId: 'branch-1'
-                })
-            ]);
-            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', 'company-1', [
-                'branch-1'
-            ]);
-        });
-        it('translates a duplicate-entry DB error into ConflictException', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            mockPermissionRepo.save.mockRejectedValue({
-                code: 'ER_DUP_ENTRY'
-            });
-            await expect(service.assignUserActions(dto)).rejects.toMatchObject({
-                response: expect.objectContaining({
-                    messageKey: PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
-                })
-            });
-        });
-        it('rethrows unknown errors from save as-is', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            const unexpected = new Error('connection lost');
-            mockPermissionRepo.save.mockRejectedValue(unexpected);
-            await expect(service.assignUserActions(dto)).rejects.toBe(unexpected);
-        });
-        it('does nothing but still invalidates the cache when items is empty', async ()=>{
-            const result = await service.assignUserActions({
-                userId: 'user-1',
-                items: []
-            });
-            expect(result).toEqual({
-                added: 0,
-                removed: 0,
-                total: 0
-            });
-            expect(mockPermissionRepo.save).not.toHaveBeenCalled();
-            expect(mockPermissionRepo.delete).not.toHaveBeenCalled();
-            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalled();
-        });
-    });
-    describe('getUserActions', ()=>{
-        it('returns an empty array without querying actions when the user has no permissions', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            const result = await service.getUserActions('user-1', undefined, undefined);
-            expect(result).toEqual([]);
-            expect(mockActionRepo.find).not.toHaveBeenCalled();
-        });
-        it('joins permissions with their actions and filters out permissions for deleted actions', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([
-                buildPermissionRow({
-                    targetId: 'action-1'
-                }),
-                buildPermissionRow({
-                    id: 'perm-2',
-                    targetId: 'action-missing'
-                })
-            ]);
-            mockActionRepo.find.mockResolvedValue([
-                buildAction({
-                    id: 'action-1'
-                })
-            ]);
-            const result = await service.getUserActions('user-1', undefined, undefined);
-            expect(result).toHaveLength(1);
-            expect(result[0]).toEqual(expect.objectContaining({
-                actionId: 'action-1',
-                actionCode: 'user.view'
-            }));
-        });
-        it('filters by companyId/branchId when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionRepo.find.mockResolvedValue([]);
-            await service.getUserActions('user-1', 'company-1', 'branch-1');
-            expect(mockPermissionRepo.find).toHaveBeenCalledWith({
-                where: expect.objectContaining({
-                    companyId: 'company-1',
-                    branchId: 'branch-1'
-                })
-            });
-        });
-    });
-    // ==================== Role-Action Permissions ====================
-    describe('assignRoleActions', ()=>{
-        const dto = {
-            roleId: 'role-1',
-            items: [
-                {
-                    id: 'action-1',
-                    action: PermissionAction.ADD
-                },
-                {
-                    id: 'action-2',
-                    action: PermissionAction.REMOVE
-                }
-            ]
-        };
-        it('throws BadRequestException when RBAC is disabled (DIRECT-only mode)', async ()=>{
-            mockIamConfigService.isRbacEnabled.mockReturnValue(false);
-            await expect(service.assignRoleActions(dto)).rejects.toMatchObject({
-                response: expect.objectContaining({
-                    messageKey: IAM_MODE_MESSAGES.RBAC_MODE_UNAVAILABLE
-                })
-            });
-        });
-        it('resolves the role company scope from the role repository when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockRoleRepo.findOne.mockResolvedValue({
-                id: 'role-1',
-                companyId: 'company-9'
-            });
-            mockPermissionRepo.find.mockResolvedValue([]);
-            mockPermissionRepo.save.mockResolvedValue([
-                {}
-            ]);
-            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
-            await service.assignRoleActions(dto);
-            expect(mockPermissionRepo.save).toHaveBeenCalledWith([
-                expect.objectContaining({
-                    companyId: 'company-9'
-                })
-            ]);
-        });
-        it('translates duplicate role-action entries into ConflictException', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            mockPermissionRepo.save.mockRejectedValue({
-                message: 'Duplicate entry for key'
-            });
-            await expect(service.assignRoleActions(dto)).rejects.toMatchObject({
-                response: expect.objectContaining({
-                    messageKey: PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
-                })
-            });
-        });
-        it('removes role actions and reports counts and invalidates role member caches', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]); // existing check for add
-            mockPermissionRepo.save.mockResolvedValue([
-                {}
-            ]);
-            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
-            const result = await service.assignRoleActions(dto);
-            expect(result).toEqual({
-                added: 1,
-                removed: 1,
-                total: 2
-            });
-            expect(mockPermissionCacheService.invalidateRoleMembersCache).toHaveBeenCalledWith('role-1');
-        });
-    });
-    describe('getRoleActions', ()=>{
-        it('returns an empty array when the role has no actions assigned', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            const result = await service.getRoleActions('role-1');
-            expect(result).toEqual([]);
-        });
-        it('maps role-action permissions to their action details', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([
-                buildPermissionRow({
-                    sourceId: 'role-1',
-                    targetId: 'action-1'
-                })
-            ]);
-            mockActionRepo.find.mockResolvedValue([
-                buildAction({
-                    id: 'action-1'
-                })
-            ]);
-            const result = await service.getRoleActions('role-1');
-            expect(result).toEqual([
-                expect.objectContaining({
-                    roleId: 'role-1',
-                    actionCode: 'user.view'
-                })
-            ]);
-        });
-    });
-    // ==================== Company-Action Permissions ====================
-    describe('assignCompanyActions', ()=>{
-        function mockTransaction() {
-            const fakeManager = {
-                getRepository: jest.fn((entity)=>{
-                    if (entity === Role || entity === RoleWithCompany) return mockRoleRepo;
-                    return mockPermissionRepo;
-                })
-            };
-            mockDataSourceProvider.getDataSource.mockResolvedValue({
-                transaction: jest.fn().mockImplementation((cb)=>cb(fakeManager))
-            });
-            return fakeManager;
-        }
-        it('adds new company-whitelisted actions inside a transaction, skipping duplicates', async ()=>{
-            mockTransaction();
-            mockPermissionRepo.find.mockResolvedValue([
-                {
-                    targetId: 'action-1'
-                }
-            ]);
-            mockPermissionRepo.create.mockImplementation((data)=>data);
-            mockPermissionRepo.save.mockResolvedValue([
-                {}
-            ]);
-            const result = await service.assignCompanyActions({
-                companyId: 'company-1',
-                items: [
-                    {
-                        id: 'action-1',
-                        action: PermissionAction.ADD
-                    },
-                    {
-                        id: 'action-2',
-                        action: PermissionAction.ADD
-                    }
-                ]
-            });
-            expect(mockPermissionRepo.save).toHaveBeenCalledWith([
-                expect.objectContaining({
-                    targetId: 'action-2',
-                    sourceId: 'company-1'
-                })
-            ]);
-            expect(result.added).toBe(1);
-            expect(mockPermissionCacheService.invalidateCompanyMembersCache).toHaveBeenCalledWith('company-1');
-        });
-        it('cascades removal to role-action and user-action permissions for the company', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockTransaction();
-            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(2));
-            mockRoleRepo.find.mockResolvedValue([
-                {
-                    id: 'role-1'
-                }
-            ]);
-            mockRawMany(mockPermissionRepo, []);
-            const result = await service.assignCompanyActions({
-                companyId: 'company-1',
-                items: [
-                    {
-                        id: 'action-1',
-                        action: PermissionAction.REMOVE
-                    }
-                ]
-            });
-            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: IamPermissionType.COMPANY_ACTION
-            }));
-            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: IamPermissionType.ROLE_ACTION
-            }));
-            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: IamPermissionType.USER_ACTION
-            }));
-            expect(result.removed).toBe(2);
-        });
-    });
-    describe('getCompanyActions / getCompanyActionIds', ()=>{
-        it('getCompanyActions returns an empty array when the company has no whitelist entries', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            expect(await service.getCompanyActions('company-1')).toEqual([]);
-        });
-        it('getCompanyActions maps whitelist entries to action details', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([
-                buildPermissionRow({
-                    sourceType: IamEntityType.COMPANY,
-                    sourceId: 'company-1',
-                    targetId: 'action-1'
-                })
-            ]);
-            mockActionRepo.find.mockResolvedValue([
-                buildAction({
-                    id: 'action-1'
-                })
-            ]);
-            const result = await service.getCompanyActions('company-1');
-            expect(result).toEqual([
-                expect.objectContaining({
-                    companyId: 'company-1',
-                    actionCode: 'user.view'
-                })
-            ]);
-        });
-        it('getCompanyActionIds returns just the whitelisted action ids', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([
-                {
-                    targetId: 'action-1'
-                },
-                {
-                    targetId: 'action-2'
-                }
-            ]);
-            const result = await service.getCompanyActions('company-1', true);
-            expect(result).toEqual([
-                'action-1',
-                'action-2'
-            ]);
-        });
-    });
-    // ==================== User-Role Permissions ====================
-    describe('assignUserRoles', ()=>{
-        const dto = {
-            userId: 'user-1',
-            items: [
-                {
-                    id: 'role-1',
-                    action: PermissionAction.ADD
-                }
-            ]
-        };
-        it('throws BadRequestException when RBAC is disabled (DIRECT-only mode)', async ()=>{
-            mockIamConfigService.isRbacEnabled.mockReturnValue(false);
-            await expect(service.assignUserRoles(dto)).rejects.toMatchObject({
-                response: expect.objectContaining({
-                    messageKey: IAM_MODE_MESSAGES.ROLE_ASSIGNMENT_UNAVAILABLE
-                })
-            });
-        });
-        it('adds new role assignments and invalidates the user cache', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            mockPermissionRepo.save.mockResolvedValue([
-                {}
-            ]);
-            const result = await service.assignUserRoles(dto);
-            expect(result).toEqual({
-                added: 1,
-                removed: 0,
-                total: 1
-            });
-            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', null, [
-                null
-            ]);
-        });
-        it('translates duplicate user-role entries into ConflictException', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            mockPermissionRepo.save.mockRejectedValue({
-                code: 'ER_DUP_ENTRY'
-            });
-            await expect(service.assignUserRoles(dto)).rejects.toMatchObject({
-                response: expect.objectContaining({
-                    messageKey: PERMISSION_OPERATION_MESSAGES.ALREADY_EXISTS
-                })
-            });
-        });
-    });
-    describe('getUserRoles', ()=>{
-        it('returns an empty array when the user has no role assignments', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            expect(await service.getUserRoles('user-1')).toEqual([]);
-            expect(mockRoleRepo.find).not.toHaveBeenCalled();
-        });
-        it('joins role permissions with role details and filters out permissions for deleted roles', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([
-                buildPermissionRow({
-                    targetId: 'role-1',
-                    targetType: IamEntityType.ROLE
-                }),
-                buildPermissionRow({
-                    id: 'perm-2',
-                    targetId: 'role-missing',
-                    targetType: IamEntityType.ROLE
-                })
-            ]);
-            mockRoleRepo.find.mockResolvedValue([
-                {
-                    id: 'role-1',
-                    name: 'Manager'
-                }
-            ]);
-            const result = await service.getUserRoles('user-1');
-            expect(result).toHaveLength(1);
-            expect(result[0]).toEqual(expect.objectContaining({
-                roleId: 'role-1',
-                roleName: 'Manager'
-            }));
-        });
-    });
-    // ==================== Effective (Merged) Permissions ====================
-    describe('getUserEffectiveRoles', ()=>{
-        it('returns an empty array when the user has no role assignments', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            expect(await service.getUserEffectiveRoles('user-1')).toEqual([]);
-            expect(mockRoleRepo.find).not.toHaveBeenCalled();
-        });
-        it('queries only by userId when the company feature is disabled, ignoring companyId/branchId', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            await service.getUserEffectiveRoles('user-1', 'company-1', 'branch-1');
-            expect(mockPermissionRepo.find).toHaveBeenCalledWith({
-                where: {
-                    permissionType: IamPermissionType.USER_ROLE,
-                    sourceType: IamEntityType.USER,
-                    sourceId: 'user-1'
-                }
-            });
-        });
-        it('merges company-wide (branchId null) and branch-specific role assignments via an OR query', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionRepo.find.mockResolvedValue([
-                buildPermissionRow({
-                    id: 'perm-1',
-                    permissionType: IamPermissionType.USER_ROLE,
-                    targetType: IamEntityType.ROLE,
-                    targetId: 'role-1',
-                    companyId: 'company-1',
-                    branchId: null
-                }),
-                buildPermissionRow({
-                    id: 'perm-2',
-                    permissionType: IamPermissionType.USER_ROLE,
-                    targetType: IamEntityType.ROLE,
-                    targetId: 'role-2',
-                    companyId: 'company-1',
-                    branchId: 'branch-1'
-                })
-            ]);
-            mockRoleRepo.find.mockResolvedValue([
-                {
-                    id: 'role-1',
-                    name: 'Company Admin'
-                },
-                {
-                    id: 'role-2',
-                    name: 'Branch Manager'
-                }
-            ]);
-            const result = await service.getUserEffectiveRoles('user-1', 'company-1', 'branch-1');
-            expect(mockPermissionRepo.find).toHaveBeenCalledWith({
-                where: [
-                    expect.objectContaining({
-                        sourceId: 'user-1',
-                        companyId: 'company-1',
-                        branchId: expect.anything()
-                    }),
-                    expect.objectContaining({
-                        sourceId: 'user-1',
-                        companyId: 'company-1',
-                        branchId: 'branch-1'
-                    })
-                ]
-            });
-            expect(result.map((r)=>r.roleId).sort()).toEqual([
-                'role-1',
-                'role-2'
-            ]);
-        });
-        it('excludes expired/not-yet-valid permission rows', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([
-                buildPermissionRow({
-                    permissionType: IamPermissionType.USER_ROLE,
-                    targetType: IamEntityType.ROLE,
-                    targetId: 'role-1',
-                    validUntil: new Date('2000-01-01')
-                })
-            ]);
-            const result = await service.getUserEffectiveRoles('user-1');
-            expect(result).toEqual([]);
-            expect(mockRoleRepo.find).not.toHaveBeenCalled();
-        });
-    });
-    describe('getUserEffectiveActions', ()=>{
-        it('returns an empty array when the user has no action assignments', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([]);
-            expect(await service.getUserEffectiveActions('user-1')).toEqual([]);
-            expect(mockActionRepo.find).not.toHaveBeenCalled();
-        });
-        it('merges company-wide (branchId null) and branch-specific action assignments via an OR query', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionRepo.find.mockResolvedValue([
-                buildPermissionRow({
-                    id: 'perm-1',
-                    targetId: 'action-1',
-                    companyId: 'company-1',
-                    branchId: null
-                }),
-                buildPermissionRow({
-                    id: 'perm-2',
-                    targetId: 'action-2',
-                    companyId: 'company-1',
-                    branchId: 'branch-1'
-                })
-            ]);
-            mockActionRepo.find.mockResolvedValue([
-                buildAction({
-                    id: 'action-1',
-                    code: 'user.view'
-                }),
-                buildAction({
-                    id: 'action-2',
-                    code: 'user.create'
-                })
-            ]);
-            const result = await service.getUserEffectiveActions('user-1', 'company-1', 'branch-1');
-            expect(mockPermissionRepo.find).toHaveBeenCalledWith({
-                where: [
-                    expect.objectContaining({
-                        sourceId: 'user-1',
-                        companyId: 'company-1',
-                        branchId: expect.anything()
-                    }),
-                    expect.objectContaining({
-                        sourceId: 'user-1',
-                        companyId: 'company-1',
-                        branchId: 'branch-1'
-                    })
-                ]
-            });
-            expect(result.map((a)=>a.actionId).sort()).toEqual([
-                'action-1',
-                'action-2'
-            ]);
-        });
-        it('excludes expired/not-yet-valid permission rows', async ()=>{
-            mockPermissionRepo.find.mockResolvedValue([
-                buildPermissionRow({
-                    targetId: 'action-1',
-                    validUntil: new Date('2000-01-01')
-                })
-            ]);
-            const result = await service.getUserEffectiveActions('user-1');
-            expect(result).toEqual([]);
-            expect(mockActionRepo.find).not.toHaveBeenCalled();
-        });
-    });
-    // ==================== My Permissions / permission-mode branching ====================
-    describe('getMyPermissions', ()=>{
-        it('delegates to the cache service and returns its response', async ()=>{
-            const response = {
-                frontendActions: [
-                    {
-                        code: 'user.view',
-                        name: 'View',
-                        description: null
-                    }
-                ],
-                cachedEndpoints: 1
-            };
-            mockPermissionCacheService.getMyPermissionsResponse.mockResolvedValue(response);
-            const result = await service.getMyPermissions('user-1', null, 'company-1', [
-                'parent-code'
-            ]);
-            expect(mockPermissionCacheService.getMyPermissionsResponse).toHaveBeenCalledWith('user-1', null, 'company-1', [
-                'parent-code'
-            ]);
-            expect(result).toBe(response);
-        });
-    });
-    describe('revokeCompanyPermissions', ()=>{
-        it('does nothing when the company feature is disabled', async ()=>{
-            await service.revokeCompanyPermissions('company-1');
-            expect(mockPermissionRepo.find).not.toHaveBeenCalled();
-            expect(mockRoleRepo.find).not.toHaveBeenCalled();
-        });
-        it('deletes company/role/user permissions transactionally and invalidates affected users', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockRoleRepo.find.mockResolvedValue([
-                {
-                    id: 'role-1'
-                }
-            ]);
-            mockPermissionRepo.find.mockResolvedValue([
-                {
-                    sourceId: 'user-1'
-                }
-            ]);
-            const fakeTxRepo = {
-                delete: jest.fn().mockResolvedValue(buildDeleteResult(1))
-            };
-            const fakeTxRoleRepo = {
-                delete: jest.fn().mockResolvedValue(buildDeleteResult(1))
-            };
-            mockDataSourceProvider.getDataSource.mockResolvedValue({
-                transaction: jest.fn().mockImplementation((cb)=>cb({
-                        getRepository: jest.fn((target)=>{
-                            if (target === mockRoleRepo.target) return fakeTxRoleRepo;
-                            return fakeTxRepo;
-                        })
-                    }))
-            });
-            await service.revokeCompanyPermissions('company-1');
-            expect(fakeTxRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: IamPermissionType.COMPANY_ACTION
-            }));
-            expect(fakeTxRoleRepo.delete).toHaveBeenCalledWith([
-                'role-1'
-            ]);
-            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
-                'user-1'
-            ], 'company-1');
-        });
-    });
-    describe('revokeBranchPermissions', ()=>{
-        it('does nothing when the company feature is disabled', async ()=>{
-            await service.revokeBranchPermissions('branch-1', 'company-1');
-            expect(mockPermissionRepo.delete).not.toHaveBeenCalled();
-        });
-        it('deletes matching branch permissions and invalidates affected users', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            mockPermissionRepo.find.mockResolvedValue([
-                {
-                    sourceId: 'user-1'
-                }
-            ]);
-            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
-            await service.revokeBranchPermissions('branch-1', 'company-1');
-            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                branchId: 'branch-1',
-                companyId: 'company-1'
-            }));
-            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
-                'user-1'
-            ], 'company-1', [
-                'branch-1'
-            ]);
-        });
-    });
-    describe('revokeUserCompanyAccess', ()=>{
-        it('deletes user-role and user-action permissions for the company and invalidates the user cache', async ()=>{
-            await service.revokeUserCompanyAccess('user-1', 'company-1');
-            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                sourceId: 'user-1',
-                companyId: 'company-1'
-            }));
-            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', 'company-1');
-        });
-    });
-    describe('revokeUserBranchAccess', ()=>{
-        it('deletes branch-scoped permissions for the user and invalidates the user+branch cache', async ()=>{
-            await service.revokeUserBranchAccess('user-1', 'branch-1', 'company-1');
-            expect(mockPermissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                sourceId: 'user-1',
-                branchId: 'branch-1',
-                companyId: 'company-1'
-            }));
-            expect(mockPermissionCacheService.invalidateUser).toHaveBeenCalledWith('user-1', 'company-1', [
-                'branch-1'
-            ]);
-        });
-    });
-    describe('domain events', ()=>{
-        let publish;
-        beforeEach(()=>{
-            publish = jest.fn().mockResolvedValue(undefined);
-            EventBusRegistry.reset();
-            EventBusRegistry.setBus({
-                publish,
-                subscribe: jest.fn(),
-                close: jest.fn()
-            });
-            EventBusRegistry.configureModule('iam', {
-                enabled: true
-            });
-            mockIamConfigService.isDirectPermissionEnabled.mockReturnValue(true);
-            mockPermissionRepo.find.mockResolvedValue([]);
-            mockPermissionRepo.save.mockResolvedValue([
-                {}
-            ]);
-            mockPermissionRepo.delete.mockResolvedValue(buildDeleteResult(1));
-        });
-        afterEach(()=>{
-            EventBusRegistry.reset();
-        });
-        it('publishes iam.user_action.permissions-assigned with the operation counts', async ()=>{
-            await service.assignUserActions({
-                userId: 'user-1',
-                items: [
-                    {
-                        id: 'action-1',
-                        action: PermissionAction.ADD
-                    }
-                ]
-            });
-            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
-                name: 'iam.user_action.permissions-assigned',
-                payload: expect.objectContaining({
-                    ids: [
-                        'user-1'
-                    ],
-                    metadata: expect.objectContaining({
-                        total: 1
-                    })
-                })
-            }));
-        });
-        it('publishes iam.user_role.permissions-assigned when roles are assigned', async ()=>{
-            mockRoleRepo.find.mockResolvedValue([
-                {
-                    id: 'role-1'
-                }
-            ]);
-            await service.assignUserRoles({
-                userId: 'user-1',
-                items: [
-                    {
-                        id: 'role-1',
-                        action: PermissionAction.ADD
-                    }
-                ]
-            });
-            expect(publish).toHaveBeenCalledWith(expect.objectContaining({
-                name: 'iam.user_role.permissions-assigned'
-            }));
-        });
-        it('does not publish when the iam module has events disabled', async ()=>{
-            EventBusRegistry.configureModule('iam', {
-                enabled: false
-            });
-            await service.assignUserActions({
-                userId: 'user-1',
-                items: [
-                    {
-                        id: 'action-1',
-                        action: PermissionAction.ADD
-                    }
-                ]
-            });
-            expect(publish).not.toHaveBeenCalled();
-        });
-    });
-});