@flusys/nestjs-shared 1.1.0-beta → 1.2.0-rc.1

package/fesm/guards/permission.guard.js

@@ -25,216 +25,159 @@ function _ts_param(paramIndex, decorator) {
         decorator(target, key, paramIndex);
     };
 }
-import { Inject, Injectable, Logger, Optional, UnauthorizedException } from '@nestjs/common';
+import { Inject, Injectable, Optional, UnauthorizedException } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { HybridCache } from '../classes/hybrid-cache.class';
-import { NestLoggerAdapter } from '../classes/winston-logger-adapter.class';
-import { CACHE_INSTANCE, IS_PUBLIC_KEY, LOGGER_INSTANCE, PERMISSION_GUARD_CONFIG, PERMISSIONS_CACHE_PREFIX, PERMISSIONS_KEY } from '../constants';
+import { AUTH_MESSAGES, CACHE_INSTANCE, IS_PUBLIC_KEY, PERMISSION_GUARD_CONFIG, PERMISSIONS_CACHE_PREFIX, PERMISSIONS_KEY } from '../constants';
 import { InsufficientPermissionsException, NoPermissionsFoundException, PermissionSystemUnavailableException } from '../exceptions/permission.exception';
-import { ILogger } from '../interfaces/logger.interface';
 import { PermissionGuardConfig } from '../interfaces/permission.interface';
 export class PermissionGuard {
     async canActivate(context) {
-        // Check if route is marked as public
         const isPublic = this.reflector.getAllAndOverride(IS_PUBLIC_KEY, [
             context.getHandler(),
             context.getClass()
         ]);
         if (isPublic) return true;
-        // Get required permissions from decorator
         const permissionConfig = this.reflector.getAllAndOverride(PERMISSIONS_KEY, [
             context.getHandler(),
             context.getClass()
         ]);
-        // If no permissions required, allow access
-        if (!permissionConfig) {
-            return true;
-        }
-        // Normalize permission config (support old format: string[])
-        const { permissions: requiredPermissions, operator } = this.normalizePermissionConfig(permissionConfig);
-        // If no permissions required, allow access
-        if (!requiredPermissions || requiredPermissions.length === 0) {
-            return true;
-        }
+        if (!permissionConfig) return true;
         const request = context.switchToHttp().getRequest();
         const user = request.user;
-        // User must be authenticated
-        if (!user) {
-            throw new UnauthorizedException('Authentication required');
-        }
-        // Cache is required for permission checks - fail securely if unavailable
+        if (!user) throw new UnauthorizedException({
+            message: 'Authentication required',
+            messageKey: AUTH_MESSAGES.TOKEN_REQUIRED
+        });
         if (!this.cache) {
-            // Log error (in production, this should be monitored)
-            this.logger.error(`Cache not available - permission system unavailable (userId: ${user.id})`, undefined, 'PermissionGuard');
-            // Fail securely - deny access rather than allowing without permission check
             throw new PermissionSystemUnavailableException();
         }
-        // Get user's permissions from cache
         const userPermissions = await this.getUserPermissions(user);
-        // If no permissions found in cache, deny access
         if (!userPermissions || userPermissions.length === 0) {
-            this.logger.warn(`No permissions found for user (userId: ${user.id})`, 'PermissionGuard');
             throw new NoPermissionsFoundException();
         }
-        // Check if this is a nested condition or simple permission list
-        if (this.isNestedCondition(permissionConfig)) {
-            // Complex nested permission check
-            const result = this.evaluateCondition(permissionConfig, userPermissions);
-            if (!result.passed) {
-                this.logger.warn(`Permission check failed (userId: ${user.id}, missing: ${result.missingPermissions.join(', ')})`, 'PermissionGuard');
-                throw new InsufficientPermissionsException(result.missingPermissions, result.operator);
-            }
-        } else {
-            // Simple permission check (backward compatible)
-            let hasRequiredPermissions;
-            if (operator === 'or') {
-                // OR: User must have at least ONE permission
-                hasRequiredPermissions = requiredPermissions.some((permission)=>this.hasPermission(userPermissions, permission));
-                if (!hasRequiredPermissions) {
-                    throw new InsufficientPermissionsException(requiredPermissions, 'or');
-                }
-            } else {
-                // AND (default): User must have ALL permissions
-                hasRequiredPermissions = requiredPermissions.every((permission)=>this.hasPermission(userPermissions, permission));
-                if (!hasRequiredPermissions) {
-                    const missing = requiredPermissions.filter((permission)=>!this.hasPermission(userPermissions, permission));
-                    throw new InsufficientPermissionsException(missing, 'and');
-                }
-            }
+        const logicNode = this.normalizeToLogicNode(permissionConfig);
+        if (!logicNode) return true;
+        const result = this.evaluateLogicNode(logicNode, userPermissions);
+        if (!result.passed) {
+            throw new InsufficientPermissionsException(result.missingPermissions, result.operator);
         }
         return true;
     }
-    /**
-   * Normalize permission config to handle both old and new formats
-   */ normalizePermissionConfig(config) {
-        // Old format: string[]
+    normalizeToLogicNode(config) {
+        // string - single permission
+        if (typeof config === 'string') {
+            return config ? {
+                type: 'action',
+                actionId: config
+            } : null;
+        }
+        // string[] - treat as AND of multiple permissions
         if (Array.isArray(config)) {
+            if (config.length === 0) return null;
+            if (config.length === 1) return {
+                type: 'action',
+                actionId: config[0]
+            };
             return {
-                permissions: config,
-                operator: 'and'
+                type: 'group',
+                operator: 'AND',
+                children: config.map((p)=>({
+                        type: 'action',
+                        actionId: p
+                    }))
             };
         }
-        // New format: PermissionConfig
-        return {
-            permissions: config.permissions || [],
-            operator: config.operator || 'and'
-        };
-    }
-    /**
-   * Check if config is a nested condition (has children)
-   */ isNestedCondition(config) {
-        if (Array.isArray(config)) return false;
-        return 'children' in config && Array.isArray(config.children) && config.children.length > 0;
+        // SimplePermissionConfig - { permissions: string[], operator: 'AND'|'OR' }
+        if ('permissions' in config && Array.isArray(config.permissions)) {
+            const simple = config;
+            if (simple.permissions.length === 0) return null;
+            if (simple.permissions.length === 1) return {
+                type: 'action',
+                actionId: simple.permissions[0]
+            };
+            return {
+                type: 'group',
+                operator: simple.operator || 'AND',
+                children: simple.permissions.map((p)=>({
+                        type: 'action',
+                        actionId: p
+                    }))
+            };
+        }
+        // ILogicNode
+        return config;
     }
-    /**
-   * Evaluate a nested permission condition recursively
-   */ evaluateCondition(condition, userPermissions) {
-        const { permissions = [], operator, children = [] } = condition;
-        // Results for this level
+    evaluateLogicNode(node, userPermissions) {
+        if (node.type === 'action') {
+            const passed = this.hasPermission(userPermissions, node.actionId);
+            return {
+                passed,
+                missingPermissions: passed ? [] : [
+                    node.actionId
+                ],
+                operator: 'AND'
+            };
+        }
+        // Group node
+        const { operator, children } = node;
+        // SECURITY: Fail-closed - deny access when no children configured
+        if (!children || children.length === 0) {
+            return {
+                passed: false,
+                missingPermissions: [],
+                operator
+            };
+        }
         const results = [];
-        const failureDetails = [];
         const missingPermissions = [];
-        // Check permissions at this level
-        if (permissions.length > 0) {
-            if (operator === 'or') {
-                const hasAny = permissions.some((p)=>this.hasPermission(userPermissions, p));
-                results.push(hasAny);
-                if (!hasAny) {
-                    failureDetails.push(`needs one of: [${permissions.join(', ')}]`);
-                    missingPermissions.push(...permissions);
-                }
-            } else {
-                const hasAll = permissions.every((p)=>this.hasPermission(userPermissions, p));
-                results.push(hasAll);
-                if (!hasAll) {
-                    const missing = permissions.filter((p)=>!this.hasPermission(userPermissions, p));
-                    failureDetails.push(`missing: [${missing.join(', ')}]`);
-                    missingPermissions.push(...missing);
-                }
-            }
-        }
-        // Evaluate children recursively
         for (const child of children){
-            const childResult = this.evaluateCondition(child, userPermissions);
+            const childResult = this.evaluateLogicNode(child, userPermissions);
             results.push(childResult.passed);
             if (!childResult.passed) {
-                failureDetails.push(`(${childResult.message})`);
                 missingPermissions.push(...childResult.missingPermissions);
             }
         }
-        // Combine results based on operator
-        let passed;
-        if (operator === 'or') {
-            passed = results.length === 0 || results.some((r)=>r);
-        } else {
-            passed = results.length === 0 || results.every((r)=>r);
-        }
-        const message = passed ? 'Permission granted' : `Permission denied: ${failureDetails.join(` ${operator.toUpperCase()} `)}`;
+        const passed = operator === 'OR' ? results.some((r)=>r) : results.every((r)=>r);
         return {
             passed,
-            message,
-            missingPermissions,
+            missingPermissions: passed ? [] : missingPermissions,
             operator
         };
     }
-    /**
-   * Get user's permissions from cache
-   */ async getUserPermissions(user) {
-        if (!this.cache) {
-            throw new PermissionSystemUnavailableException();
-        }
-        let cacheKey;
+    async getUserPermissions(user) {
+        if (!this.cache) throw new PermissionSystemUnavailableException();
+        const cacheKey = this.buildPermissionCacheKey(user);
+        return await this.cache.get(cacheKey) || [];
+    }
+    buildPermissionCacheKey(user) {
         if (this.config.enableCompanyFeature && user.companyId) {
-            // Company-based permissions (includes branchId for branch-scoped DIRECT permissions)
-            const format = this.config.companyPermissionKeyFormat || `${PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`;
-            cacheKey = format.replace('{userId}', user.id).replace('{companyId}', user.companyId).replace('{branchId}', user.branchId || 'null');
-        } else {
-            // User-based permissions
-            const format = this.config.userPermissionKeyFormat || `${PERMISSIONS_CACHE_PREFIX}:user:{userId}`;
-            cacheKey = format.replace('{userId}', user.id);
+            return (this.config.companyPermissionKeyFormat || `${PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`).replace('{userId}', user.id).replace('{companyId}', user.companyId).replace('{branchId}', user.branchId || 'null');
         }
-        const permissions = await this.cache.get(cacheKey);
-        return permissions || [];
+        return (this.config.userPermissionKeyFormat || `${PERMISSIONS_CACHE_PREFIX}:user:{userId}`).replace('{userId}', user.id);
     }
-    /**
-   * Check if user has a specific permission
-   * Supports wildcard matching (e.g., 'admin.*' matches 'admin.users.read')
-   */ hasPermission(userPermissions, requiredPermission) {
-        // Direct match
-        if (userPermissions.includes(requiredPermission)) {
-            return true;
-        }
-        // Wildcard match (e.g., '*' or 'admin.*')
+    hasPermission(userPermissions, requiredPermission) {
+        if (userPermissions.includes(requiredPermission)) return true;
         for (const permission of userPermissions){
-            if (permission === '*') {
-                return true; // Super admin
-            }
-            if (permission.endsWith('.*')) {
-                const prefix = permission.slice(0, -1); // Remove '*'
-                if (requiredPermission.startsWith(prefix)) {
-                    return true;
-                }
+            if (permission === '*') return true;
+            if (permission.endsWith('.*') && requiredPermission.startsWith(permission.slice(0, -1))) {
+                return true;
             }
         }
         return false;
     }
-    // NOTE: @Inject(Reflector) required for bundled code - external classes need explicit injection
-    constructor(reflector, cache, config, logger){
+    constructor(reflector, cache, config){
         _define_property(this, "reflector", void 0);
         _define_property(this, "cache", void 0);
         _define_property(this, "config", void 0);
-        _define_property(this, "logger", void 0);
         this.reflector = reflector;
         this.cache = cache;
         this.config = {
             enableCompanyFeature: false,
-            cacheKeyPrefix: PERMISSIONS_CACHE_PREFIX,
             userPermissionKeyFormat: `${PERMISSIONS_CACHE_PREFIX}:user:{userId}`,
             companyPermissionKeyFormat: `${PERMISSIONS_CACHE_PREFIX}:company:{companyId}:branch:{branchId}:user:{userId}`,
             ...config
         };
-        // Use provided logger or fallback to NestJS Logger wrapped in adapter
-        this.logger = logger || new NestLoggerAdapter(new Logger(PermissionGuard.name));
     }
 }
 PermissionGuard = _ts_decorate([
@@ -244,13 +187,10 @@ PermissionGuard = _ts_decorate([
     _ts_param(1, Inject(CACHE_INSTANCE)),
     _ts_param(2, Optional()),
     _ts_param(2, Inject(PERMISSION_GUARD_CONFIG)),
-    _ts_param(3, Optional()),
-    _ts_param(3, Inject(LOGGER_INSTANCE)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof Reflector === "undefined" ? Object : Reflector,
         typeof HybridCache === "undefined" ? Object : HybridCache,
-        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig,
-        typeof ILogger === "undefined" ? Object : ILogger
+        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
     ])
 ], PermissionGuard);

package/fesm/index.js

@@ -3,7 +3,9 @@ export * from './constants';
 export * from './decorators';
 export * from './dtos';
 export * from './entities';
+export * from './enums';
 export * from './exceptions';
+export * from './filters';
 export * from './guards';
 export * from './interceptors';
 export * from './interfaces';

package/fesm/interceptors/idempotency.interceptor.js

@@ -29,7 +29,7 @@ import { ConflictException, Inject, Injectable, Optional } from '@nestjs/common'
 import { of } from 'rxjs';
 import { tap } from 'rxjs/operators';
 import { HybridCache } from '../classes/hybrid-cache.class';
-import { CACHE_INSTANCE, IDEMPOTENCY_CACHE_PREFIX, IDEMPOTENCY_KEY_HEADER } from '../constants';
+import { CACHE_INSTANCE, IDEMPOTENCY_CACHE_PREFIX, IDEMPOTENCY_KEY_HEADER, SYSTEM_MESSAGES } from '../constants';
 export class IdempotencyInterceptor {
     async intercept(context, next) {
         // Skip if no cache available
@@ -51,7 +51,7 @@ export class IdempotencyInterceptor {
                 throw new ConflictException({
                     success: false,
                     message: 'Request is already being processed',
-                    code: 'DUPLICATE_REQUEST_IN_PROGRESS'
+                    messageKey: SYSTEM_MESSAGES.DUPLICATE_REQUEST
                 });
             }
             // Return cached response

package/fesm/interceptors/index.js

@@ -1,8 +1,5 @@
 export * from './delete-empty-id-from-body.interceptor';
 export * from './idempotency.interceptor';
-export * from './query-performance.interceptor';
 export * from './response-meta.interceptor';
-export * from './set-create-by-on-body.interceptor';
-export * from './set-delete-by-on-body.interceptor';
-export * from './set-update-by-on-body.interceptor';
+export * from './set-user-field-on-body.interceptor';
 export * from './slug.interceptor';

package/fesm/interceptors/set-user-field-on-body.interceptor.js

@@ -0,0 +1,39 @@
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+import { Injectable } from '@nestjs/common';
+/**
+ * Factory function to create interceptors that set user ID fields on request body
+ * @param fieldName - The field name to set (e.g., 'createdById', 'updatedById', 'deletedById')
+ */ export function createSetUserFieldInterceptor(fieldName) {
+    let SetUserFieldOnBody = class SetUserFieldOnBody {
+        intercept(context, next) {
+            const request = context.switchToHttp().getRequest();
+            const user = request?.user;
+            if (user) {
+                if (Array.isArray(request.body)) {
+                    request.body = request.body.map((item)=>({
+                            ...item,
+                            [fieldName]: user.id
+                        }));
+                } else if (typeof request.body === 'object' && request.body !== null) {
+                    request.body = {
+                        ...request.body,
+                        [fieldName]: user.id
+                    };
+                }
+            }
+            return next.handle();
+        }
+    };
+    SetUserFieldOnBody = _ts_decorate([
+        Injectable()
+    ], SetUserFieldOnBody);
+    return SetUserFieldOnBody;
+}
+/** Sets createdById field on request body from authenticated user */ export const SetCreatedByOnBody = createSetUserFieldInterceptor('createdById');
+/** Sets updatedById field on request body from authenticated user */ export const SetUpdateByOnBody = createSetUserFieldInterceptor('updatedById');
+/** Sets deletedById field on request body from authenticated user */ export const SetDeletedByOnBody = createSetUserFieldInterceptor('deletedById');

package/fesm/interceptors/slug.interceptor.js

@@ -17,28 +17,49 @@ function _ts_decorate(decorators, target, key, desc) {
     else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-import { Injectable } from '@nestjs/common';
+function _ts_metadata(k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+import { Inject, Injectable } from '@nestjs/common';
 import { UtilsService } from '../modules/utils/utils.service';
 export class Slug {
     intercept(context, next) {
         const request = context.switchToHttp().getRequest();
         if (Array.isArray(request.body)) {
-            request.body = request.body.map((item)=>({
-                    ...item,
-                    slug: item.slug || (item?.name ? this.utilsService.transformToSlug(item.name) : null)
-                }));
-        } else if (!request.body.slug) {
+            request.body = request.body.map((item)=>{
+                // Only generate slug if not provided and name exists
+                if (!item.slug && item?.name) {
+                    return {
+                        ...item,
+                        slug: this.utilsService.transformToSlug(item.name)
+                    };
+                }
+                return item;
+            });
+        } else if (!request.body?.slug && request.body?.name) {
+            // Only generate slug if not provided and name exists
             request.body = {
                 ...request.body,
-                slug: request.body?.name ? this.utilsService.transformToSlug(request.body?.name) : null
+                slug: this.utilsService.transformToSlug(request.body.name)
             };
         }
         return next.handle();
     }
-    constructor(){
-        _define_property(this, "utilsService", new UtilsService());
+    constructor(utilsService){
+        _define_property(this, "utilsService", void 0);
+        this.utilsService = utilsService;
     }
 }
 Slug = _ts_decorate([
-    Injectable()
+    Injectable(),
+    _ts_param(0, Inject(UtilsService)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof UtilsService === "undefined" ? Object : UtilsService
+    ])
 ], Slug);

package/fesm/interfaces/datasource.interface.js

@@ -0,0 +1 @@
+export { };

package/fesm/interfaces/event-manager-adapter.interface.js

@@ -0,0 +1 @@
+export const EVENT_MANAGER_ADAPTER = 'EVENT_MANAGER_ADAPTER';

package/fesm/interfaces/index.js

@@ -1,6 +1,8 @@
 export * from './api.interface';
-export * from './base-query.interface';
+export * from './datasource.interface';
+export * from './event-manager-adapter.interface';
 export * from './identity.interface';
 export * from './logged-user-info.interface';
-export * from './logger.interface';
+export * from './module-config.interface';
+export * from './notification-adapter.interface';
 export * from './permission.interface';

package/fesm/interfaces/module-config.interface.js

@@ -0,0 +1,5 @@
+/**
+ * Common interface for module configuration services.
+ * All feature module config services should implement this interface
+ * to ensure consistent access to bootstrap configuration.
+ */ export { };

package/fesm/interfaces/notification-adapter.interface.js

@@ -0,0 +1 @@
+export const NOTIFICATION_ADAPTER = 'NOTIFICATION_ADAPTER';

package/fesm/interfaces/permission.interface.js

@@ -1,3 +1 @@
-/**
- * Configuration for the permission guard
- */ export { };
+/** Action node - checks a single permission/action code */ /** Configuration for the permission guard */ export { };