@flusys/nestjs-iam 7.1.0 → 8.0.0

package/fesm/services/role.service.js

@@ -1,214 +0,0 @@
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-import { ApiService, HybridCache } from '@flusys/nestjs-shared/classes';
-import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { applyCompanyFilter } from '@flusys/nestjs-shared/utils';
-import { ForbiddenException, Inject, Injectable, Scope } from '@nestjs/common';
-import { In, IsNull } from 'typeorm';
-import { IAM_EVENT_ENTITIES, IAM_EVENT_MODULE, ROLE_MESSAGES } from '../config';
-import { UserIamPermissionWithCompany } from '../entities/permission-with-company.entity';
-import { RoleWithCompany } from '../entities/role-with-company.entity';
-import { Role } from '../entities/role.entity';
-import { UserIamPermission } from '../entities/user-iam-permission.entity';
-import { IamEntityType } from '../enums/iam-entity-type.enum';
-import { IamPermissionType } from '../enums/iam-permission-type.enum';
-import { IAMConfigService } from './iam-config.service';
-import { IAMDataSourceService } from './iam-datasource.service';
-import { PermissionCacheService } from './permission-cache.service';
-export class RoleService extends ApiService {
-    async beforeUpdateOperation(dto, _user, _queryRunner) {
-        const dtos = Array.isArray(dto) ? dto : [
-            dto
-        ];
-        const ids = dtos.map((d)=>d.id);
-        await this.ensureDataSourceRepository();
-        const readonlyRoles = await this.repository.find({
-            where: {
-                id: In(ids),
-                readOnly: true,
-                deletedAt: IsNull()
-            }
-        });
-        if (readonlyRoles.length > 0) {
-            const names = readonlyRoles.map((r)=>r.name).join(', ');
-            throw new ForbiddenException({
-                message: `Cannot modify readonly role(s): ${names}`,
-                messageKey: ROLE_MESSAGES.READONLY_UPDATE_FORBIDDEN,
-                messageVariables: {
-                    names
-                }
-            });
-        }
-    }
-    async beforeDeleteOperation(dto, user, queryRunner) {
-        await super.beforeDeleteOperation(dto, user, queryRunner);
-        const roleIds = Array.isArray(dto.id) ? dto.id : [
-            dto.id
-        ];
-        if (roleIds.length === 0) {
-            return;
-        }
-        await this.ensureDataSourceRepository();
-        const readonlyRoles = await this.repository.find({
-            where: {
-                id: In(roleIds),
-                readOnly: true,
-                deletedAt: IsNull()
-            }
-        });
-        if (readonlyRoles.length > 0) {
-            const names = readonlyRoles.map((r)=>r.name).join(', ');
-            throw new ForbiddenException({
-                message: `Cannot delete readonly role(s): ${names}`,
-                messageKey: ROLE_MESSAGES.READONLY_DELETE_FORBIDDEN,
-                messageVariables: {
-                    names
-                }
-            });
-        }
-        const enableCompanyFeature = this.iamConfigService.isCompanyFeatureEnabled();
-        const permissionEntity = enableCompanyFeature ? UserIamPermissionWithCompany : UserIamPermission;
-        const permissionRepo = queryRunner.manager.getRepository(permissionEntity);
-        const userRoleRows = await permissionRepo.find({
-            where: {
-                permissionType: IamPermissionType.USER_ROLE,
-                sourceType: IamEntityType.USER,
-                targetType: IamEntityType.ROLE,
-                targetId: In(roleIds)
-            }
-        });
-        const affectedUserIds = [
-            ...new Set(userRoleRows.map((row)=>row.sourceId))
-        ];
-        await permissionRepo.delete({
-            permissionType: IamPermissionType.ROLE_ACTION,
-            sourceType: IamEntityType.ROLE,
-            sourceId: In(roleIds)
-        });
-        await permissionRepo.delete({
-            permissionType: IamPermissionType.USER_ROLE,
-            targetType: IamEntityType.ROLE,
-            targetId: In(roleIds)
-        });
-        if (affectedUserIds.length > 0) {
-            await this.permissionCacheService.invalidateUsers(affectedUserIds);
-        }
-    }
-    // Entity Conversion
-    async convertSingleDtoToEntity(dto, user) {
-        const entity = await super.convertSingleDtoToEntity(dto, user);
-        // Handle companyId based on company feature
-        if (this.iamConfigService.isCompanyFeatureEnabled()) {
-            const isUpdate = 'id' in dto && dto.id;
-            // For create: use dto.companyId or user's companyId
-            // For update: only override if explicitly provided
-            if (!isUpdate || dto.companyId !== undefined) {
-                entity.companyId = dto.companyId ?? user?.companyId ?? null;
-            }
-        }
-        return entity;
-    }
-    // Query Customization
-    async getSelectQuery(query, _user, select) {
-        if (!select?.length) {
-            select = [
-                'id',
-                'name',
-                'description',
-                'isActive',
-                'readOnly',
-                'serial',
-                'createdAt'
-            ];
-            if (this.iamConfigService.isCompanyFeatureEnabled()) {
-                select.push('companyId');
-            }
-        }
-        query.select(select.map((f)=>`${this.entityName}.${f}`));
-        return {
-            query,
-            isRaw: false
-        };
-    }
-    async getGlobalSearchQuery(query, search) {
-        query.andWhere('(role.name LIKE :search OR role.description LIKE :search)', {
-            search: `%${search}%`
-        });
-        return {
-            query,
-            isRaw: false
-        };
-    }
-    async getExtraManipulateQuery(query, filterDto, user) {
-        const result = await super.getExtraManipulateQuery(query, filterDto, user);
-        applyCompanyFilter(query, {
-            isCompanyFeatureEnabled: this.iamConfigService.isCompanyFeatureEnabled(),
-            entityAlias: 'role'
-        }, user);
-        return result;
-    }
-    // Response Conversion
-    convertEntityToResponseDto(entity, _isRaw) {
-        return {
-            id: entity.id,
-            readOnly: entity.readOnly,
-            name: entity.name,
-            description: entity.description,
-            isActive: entity.isActive,
-            serial: entity.serial,
-            companyId: ('companyId' in entity ? entity.companyId : null) ?? null,
-            createdAt: entity.createdAt,
-            updatedAt: entity.updatedAt,
-            deletedAt: entity.deletedAt,
-            createdById: entity.createdById,
-            updatedById: entity.updatedById,
-            deletedById: entity.deletedById
-        };
-    }
-    constructor(cacheManager, utilsService, iamConfigService, dataSourceProvider, permissionCacheService){
-        super(IAM_EVENT_ENTITIES.ROLE, cacheManager, utilsService, RoleService.name, true, IAM_EVENT_MODULE, dataSourceProvider, iamConfigService.isCompanyFeatureEnabled() ? RoleWithCompany : Role), _define_property(this, "cacheManager", void 0), _define_property(this, "utilsService", void 0), _define_property(this, "iamConfigService", void 0), _define_property(this, "permissionCacheService", void 0), this.cacheManager = cacheManager, this.utilsService = utilsService, this.iamConfigService = iamConfigService, this.permissionCacheService = permissionCacheService;
-    }
-}
-RoleService = _ts_decorate([
-    Injectable({
-        scope: Scope.REQUEST
-    }),
-    _ts_param(0, Inject('CACHE_INSTANCE')),
-    _ts_param(1, Inject(UtilsService)),
-    _ts_param(2, Inject(IAMConfigService)),
-    _ts_param(3, Inject(IAMDataSourceService)),
-    _ts_param(4, Inject(PermissionCacheService)),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof HybridCache === "undefined" ? Object : HybridCache,
-        typeof UtilsService === "undefined" ? Object : UtilsService,
-        typeof IAMConfigService === "undefined" ? Object : IAMConfigService,
-        typeof IAMDataSourceService === "undefined" ? Object : IAMDataSourceService,
-        typeof PermissionCacheService === "undefined" ? Object : PermissionCacheService
-    ])
-], RoleService);

package/fesm/services/role.service.spec.js

@@ -1,343 +0,0 @@
-import { Test } from '@nestjs/testing';
-import { UtilsService } from '@flusys/nestjs-shared/modules';
-import { createMockDataSourceProvider, createMockRepository } from '@test-utils/mocks/repository.mock';
-import { buildMockUser } from '@test-utils/mocks/logged-user.mock';
-import { Role } from '../entities/role.entity';
-import { RoleWithCompany } from '../entities/role-with-company.entity';
-import { IAMConfigService } from './iam-config.service';
-import { IAMDataSourceService } from './iam-datasource.service';
-import { PermissionCacheService } from './permission-cache.service';
-import { RoleService } from './role.service';
-function buildRole(overrides = {}) {
-    return {
-        id: 'role-uuid-1',
-        readOnly: false,
-        name: 'Manager',
-        description: null,
-        isActive: true,
-        serial: 1,
-        createdAt: new Date(),
-        updatedAt: new Date(),
-        deletedAt: null,
-        createdById: null,
-        updatedById: null,
-        deletedById: null,
-        ...overrides
-    };
-}
-describe('RoleService', ()=>{
-    let service;
-    let module;
-    let mockRepo;
-    let mockIamConfigService;
-    let mockPermissionCacheService;
-    beforeEach(async ()=>{
-        mockRepo = createMockRepository();
-        mockRepo.find.mockResolvedValue([]);
-        const mockDataSourceProvider = createMockDataSourceProvider(mockRepo);
-        mockIamConfigService = {
-            isCompanyFeatureEnabled: jest.fn().mockReturnValue(false)
-        };
-        mockPermissionCacheService = {
-            invalidateUsers: jest.fn()
-        };
-        module = await Test.createTestingModule({
-            providers: [
-                RoleService,
-                {
-                    provide: 'CACHE_INSTANCE',
-                    useValue: {}
-                },
-                {
-                    provide: UtilsService,
-                    useValue: {}
-                },
-                {
-                    provide: IAMConfigService,
-                    useValue: mockIamConfigService
-                },
-                {
-                    provide: IAMDataSourceService,
-                    useValue: mockDataSourceProvider
-                },
-                {
-                    provide: PermissionCacheService,
-                    useValue: mockPermissionCacheService
-                }
-            ]
-        }).compile();
-        service = await module.resolve(RoleService);
-    });
-    describe('entity selection', ()=>{
-        it('uses Role when the company feature is disabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
-            const built = await module.resolve(RoleService);
-            expect(built['_entity']).toBe(Role);
-        });
-        it('uses RoleWithCompany when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            const built = await module.resolve(RoleService);
-            expect(built['_entity']).toBe(RoleWithCompany);
-        });
-    });
-    describe('convertSingleDtoToEntity', ()=>{
-        it('creates a plain entity without companyId when the company feature is disabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
-            await service.ensureDataSourceRepository();
-            mockRepo.create.mockReturnValue({});
-            const entity = await service.convertSingleDtoToEntity({
-                name: 'Manager'
-            }, buildMockUser());
-            expect(entity.companyId).toBeUndefined();
-        });
-        it('stamps companyId from the DTO on create when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            await service.ensureDataSourceRepository();
-            mockRepo.create.mockReturnValue({});
-            const entity = await service.convertSingleDtoToEntity({
-                name: 'Manager',
-                companyId: 'company-explicit'
-            }, buildMockUser({
-                companyId: 'company-from-user'
-            }));
-            expect(entity.companyId).toBe('company-explicit');
-        });
-        it('falls back to the user companyId on create when the DTO omits it', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            await service.ensureDataSourceRepository();
-            mockRepo.create.mockReturnValue({});
-            const entity = await service.convertSingleDtoToEntity({
-                name: 'Manager'
-            }, buildMockUser({
-                companyId: 'company-from-user'
-            }));
-            expect(entity.companyId).toBe('company-from-user');
-        });
-        it('does not override companyId on update when the DTO omits it', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            await service.ensureDataSourceRepository();
-            const existing = buildRole({
-                id: 'role-uuid-1',
-                companyId: 'existing-company'
-            });
-            mockRepo.findOne.mockResolvedValue(existing);
-            const entity = await service.convertSingleDtoToEntity({
-                id: 'role-uuid-1',
-                name: 'Manager Updated'
-            }, buildMockUser({
-                companyId: 'company-from-user'
-            }));
-            expect(entity.companyId).toBe('existing-company');
-        });
-        it('overrides companyId on update when explicitly provided in the DTO', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            await service.ensureDataSourceRepository();
-            const existing = buildRole({
-                id: 'role-uuid-1',
-                companyId: 'existing-company'
-            });
-            mockRepo.findOne.mockResolvedValue(existing);
-            const entity = await service.convertSingleDtoToEntity({
-                id: 'role-uuid-1',
-                name: 'Manager Updated',
-                companyId: 'new-company'
-            }, buildMockUser());
-            expect(entity.companyId).toBe('new-company');
-        });
-        it('throws NotFoundException when updating a role that does not exist', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
-            await service.ensureDataSourceRepository();
-            mockRepo.findOne.mockResolvedValue(null);
-            await expect(service.convertSingleDtoToEntity({
-                id: 'missing-role'
-            }, buildMockUser())).rejects.toThrow();
-        });
-    });
-    describe('getSelectQuery', ()=>{
-        it('selects the default field set without companyId when the company feature is disabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
-            const query = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(query, buildMockUser());
-            expect(query.select).toHaveBeenCalledWith(expect.not.arrayContaining([
-                'role.companyId'
-            ]));
-        });
-        it('includes companyId in the default field set when the company feature is enabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            const query = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(query, buildMockUser());
-            expect(query.select).toHaveBeenCalledWith(expect.arrayContaining([
-                'role.companyId'
-            ]));
-        });
-        it('uses the explicitly provided select list as-is', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            await service.getSelectQuery(query, buildMockUser(), [
-                'id',
-                'name'
-            ]);
-            expect(query.select).toHaveBeenCalledWith([
-                'role.id',
-                'role.name'
-            ]);
-        });
-    });
-    describe('getGlobalSearchQuery', ()=>{
-        it('filters by name or description', async ()=>{
-            const query = mockRepo.createQueryBuilder();
-            await service.getGlobalSearchQuery(query, 'manager');
-            expect(query.andWhere).toHaveBeenCalledWith('(role.name LIKE :search OR role.description LIKE :search)', {
-                search: '%manager%'
-            });
-        });
-    });
-    describe('getExtraManipulateQuery', ()=>{
-        it('applies a company filter clause when the company feature is enabled and the user has a company', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(true);
-            const query = mockRepo.createQueryBuilder();
-            await service.getExtraManipulateQuery(query, {}, buildMockUser({
-                companyId: 'company-1'
-            }));
-            expect(query.andWhere).toHaveBeenCalledWith('role.companyId = :companyId', {
-                companyId: 'company-1'
-            });
-        });
-        it('does not apply a company filter when the company feature is disabled', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
-            const query = mockRepo.createQueryBuilder();
-            await service.getExtraManipulateQuery(query, {}, buildMockUser({
-                companyId: 'company-1'
-            }));
-            expect(query.andWhere).not.toHaveBeenCalled();
-        });
-    });
-    describe('convertEntityToResponseDto', ()=>{
-        it('defaults companyId to null when the entity has no companyId field', ()=>{
-            const entity = buildRole();
-            const dto = service.convertEntityToResponseDto(entity, false);
-            expect(dto.companyId).toBeNull();
-        });
-        it('surfaces companyId when present on the entity', ()=>{
-            const entity = buildRole({
-                companyId: 'company-1'
-            });
-            const dto = service.convertEntityToResponseDto(entity, false);
-            expect(dto.companyId).toBe('company-1');
-        });
-    });
-    describe('beforeDeleteOperation', ()=>{
-        function buildQueryRunner(permissionRepo) {
-            return {
-                manager: {
-                    getRepository: jest.fn().mockReturnValue(permissionRepo)
-                }
-            };
-        }
-        it('does nothing when the delete DTO has no ids', async ()=>{
-            const permissionRepo = createMockRepository();
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [],
-                type: 'delete'
-            }, buildMockUser(), queryRunner);
-            expect(permissionRepo.find).not.toHaveBeenCalled();
-        });
-        it('cascades ROLE_ACTION and USER_ROLE cleanup and invalidates affected users cache', async ()=>{
-            mockIamConfigService.isCompanyFeatureEnabled.mockReturnValue(false);
-            const permissionRepo = createMockRepository();
-            permissionRepo.find.mockResolvedValue([
-                {
-                    sourceId: 'user-1'
-                },
-                {
-                    sourceId: 'user-2'
-                }
-            ]);
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: 'role-uuid-1',
-                type: 'delete'
-            }, buildMockUser(), queryRunner);
-            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: 'role_action',
-                sourceType: 'role'
-            }));
-            expect(permissionRepo.delete).toHaveBeenCalledWith(expect.objectContaining({
-                permissionType: 'user_role',
-                targetType: 'role'
-            }));
-            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
-                'user-1',
-                'user-2'
-            ]);
-        });
-        it('does not invalidate any cache when no users are affected', async ()=>{
-            const permissionRepo = createMockRepository();
-            permissionRepo.find.mockResolvedValue([]);
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [
-                    'role-uuid-1'
-                ],
-                type: 'delete'
-            }, buildMockUser(), queryRunner);
-            expect(mockPermissionCacheService.invalidateUsers).not.toHaveBeenCalled();
-        });
-        it('supports array ids and dedupes affected user ids', async ()=>{
-            const permissionRepo = createMockRepository();
-            permissionRepo.find.mockResolvedValue([
-                {
-                    sourceId: 'user-1'
-                },
-                {
-                    sourceId: 'user-1'
-                }
-            ]);
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await service.beforeDeleteOperation({
-                id: [
-                    'role-uuid-1',
-                    'role-uuid-2'
-                ],
-                type: 'delete'
-            }, buildMockUser(), queryRunner);
-            expect(mockPermissionCacheService.invalidateUsers).toHaveBeenCalledWith([
-                'user-1'
-            ]);
-        });
-        it('rejects deleting a readonly role', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildRole({
-                    readOnly: true
-                })
-            ]);
-            const permissionRepo = createMockRepository();
-            const queryRunner = buildQueryRunner(permissionRepo);
-            await expect(service.beforeDeleteOperation({
-                id: 'role-uuid-1',
-                type: 'delete'
-            }, buildMockUser(), queryRunner)).rejects.toThrow('Cannot delete readonly role');
-            expect(permissionRepo.find).not.toHaveBeenCalled();
-        });
-    });
-    describe('beforeUpdateOperation', ()=>{
-        it('rejects updating a readonly role', async ()=>{
-            mockRepo.find.mockResolvedValue([
-                buildRole({
-                    readOnly: true
-                })
-            ]);
-            await expect(service.beforeUpdateOperation({
-                id: 'role-uuid-1',
-                name: 'Renamed'
-            }, buildMockUser(), {})).rejects.toThrow('Cannot modify readonly role');
-        });
-        it('allows updating a non-readonly role', async ()=>{
-            mockRepo.find.mockResolvedValue([]);
-            await expect(service.beforeUpdateOperation({
-                id: 'role-uuid-1',
-                name: 'Renamed'
-            }, buildMockUser(), {})).resolves.toBeUndefined();
-        });
-    });
-});

package/fesm/types/logic-node.type.js

@@ -1,27 +0,0 @@
-/**
- * LogicNode - Represents a node in a permission logic tree
- *
- * Used for complex permission evaluation with AND/OR logic.
- * Supports hierarchical permission structures.
- *
- * Example:
- * ```typescript
- * const logic: LogicNode = {
- *   id: 'root',
- *   type: 'group',
- *   operator: 'AND',
- *   children: [
- *     { id: '1', type: 'action', actionId: 'create-user' },
- *     {
- *       id: '2',
- *       type: 'group',
- *       operator: 'OR',
- *       children: [
- *         { id: '2-1', type: 'action', actionId: 'view-reports' },
- *         { id: '2-2', type: 'action', actionId: 'view-dashboard' }
- *       ]
- *     }
- *   ]
- * };
- * ```
- */ export { };