@flusys/nestjs-shared 7.0.2 → 8.0.0-beta.1

package/fesm/guards/index.js

@@ -1,3 +1,1003 @@
-export * from './jwt-auth.guard';
-export * from './optional-jwt-auth.guard';
-export * from './permission.guard';
+import * as __rspack_external__flusys_nestjs_core_config_197fa0a9 from "@flusys/nestjs-core/config";
+import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
+import * as __rspack_external__nestjs_core_d7b00a1a from "@nestjs/core";
+import * as __rspack_external__nestjs_passport_18907953 from "@nestjs/passport";
+import * as __rspack_external__keyv_redis_139d03ca from "@keyv/redis";
+import * as __rspack_external_cacheable from "cacheable";
+import * as __rspack_external_keyv from "keyv";
+export const __rspack_esm_id = 333;
+export const __rspack_esm_ids = [333];
+export const __webpack_modules__ = {
+375(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  l: () => (/* binding */ HybridCache)
+});
+
+// EXTERNAL MODULE: external "@flusys/nestjs-core/config"
+var config_ = __webpack_require__(307);
+;// CONCATENATED MODULE: external "@keyv/redis"
+
+;// CONCATENATED MODULE: external "cacheable"
+
+;// CONCATENATED MODULE: external "keyv"
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/hybrid-cache.class.ts
+
+
+
+
+class HybridCache {
+    memory;
+    redis;
+    constructor(memoryTtl = 60 * 1000, memorySize = 5000){
+        // Default to 'memory' if not specified
+        const useCacheLabel = config_.envConfig.tryGetValue('USE_CACHE_LABEL', false) || 'memory';
+        if (useCacheLabel === 'memory' || useCacheLabel === 'hybrid') {
+            this.memory = new __rspack_external_keyv["default"]({
+                store: new __rspack_external_cacheable.CacheableMemory({
+                    ttl: memoryTtl,
+                    lruSize: memorySize
+                })
+            });
+        }
+        if (useCacheLabel === 'redis' || useCacheLabel === 'hybrid') {
+            this.redis = new __rspack_external_keyv["default"]({
+                store: new __rspack_external__keyv_redis_139d03ca["default"](config_.envConfig.getRedisUrl())
+            });
+        }
+    }
+    async get(key) {
+        // Prefer memory first if available
+        if (this.memory) {
+            const value = await this.memory.get(key);
+            if (value !== undefined) return value;
+        }
+        // Fallback to redis
+        if (this.redis) {
+            const value = await this.redis.get(key);
+            if (value !== undefined && this.memory) {
+                // backfill L1 memory cache
+                await this.memory.set(key, value);
+            }
+            return value;
+        }
+        return undefined;
+    }
+    async set(key, value, ttl) {
+        if (this.memory) {
+            await this.memory.set(key, value, ttl);
+        }
+        if (this.redis) {
+            await this.redis.set(key, value, ttl);
+        }
+    }
+    async del(key) {
+        if (this.memory) {
+            await this.memory.delete(key);
+        }
+        if (this.redis) {
+            await this.redis.delete(key);
+        }
+    }
+    async reset() {
+        if (this.memory) {
+            await this.memory.clear();
+        }
+    }
+    async resetL2() {
+        if (this.redis) {
+            await this.redis.clear();
+        }
+    }
+}
+
+
+},
+43(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _permissions_js__rspack_import_0 = __webpack_require__(975);
+/* import */ var _message_keys_js__rspack_import_1 = __webpack_require__(389);
+// Metadata keys
+const IS_PUBLIC_KEY = 'isPublic';
+const PERMISSIONS_KEY = 'permissions';
+const DOMAIN_EVENT_HANDLER_KEY = 'domainEventHandler';
+// Injection tokens
+const CACHE_INSTANCE = 'CACHE_INSTANCE';
+const PERMISSION_GUARD_CONFIG = 'PERMISSION_GUARD_CONFIG';
+const EVENT_BUS_INSTANCE = 'EVENT_BUS_INSTANCE';
+const EVENT_BUS_MODULE_OPTIONS = 'EVENT_BUS_MODULE_OPTIONS';
+// Header names
+const IDEMPOTENCY_KEY_HEADER = 'x-idempotency-key';
+const REQUEST_ID_HEADER = 'x-request-id';
+const CLIENT_TYPE_HEADER = 'x-client-type';
+// Cache key prefixes
+const PERMISSIONS_CACHE_PREFIX = 'my-permissions';
+const IDEMPOTENCY_CACHE_PREFIX = 'idempotency';
+// Event bus defaults
+const DEFAULT_EVENT_EXCHANGE = 'flusys.events';
+const DEFAULT_EVENT_TOPIC = 'flusys.domain-events';
+const DEFAULT_EVENT_SERVICE_NAME = 'flusys';
+// Permission codes
+
+// Message keys for localization
+
+
+__webpack_require__.d(__webpack_exports__, {
+  BC: () => (/* reexport safe */ _permissions_js__rspack_import_0.BC),
+  Bz: () => (/* reexport safe */ _permissions_js__rspack_import_0.Bz),
+  Em: () => (/* reexport safe */ _permissions_js__rspack_import_0.Em),
+  GT: () => (/* reexport safe */ _permissions_js__rspack_import_0.GT),
+  Jj: () => (/* reexport safe */ _permissions_js__rspack_import_0.Jj),
+  N3: () => (/* reexport safe */ _permissions_js__rspack_import_0.N3),
+  ON: () => (/* reexport safe */ _permissions_js__rspack_import_0.ON),
+  P0: () => (/* reexport safe */ _permissions_js__rspack_import_0.P0),
+  Q5: () => (/* reexport safe */ _permissions_js__rspack_import_0.Q5),
+  S6: () => (/* reexport safe */ _permissions_js__rspack_import_0.S6),
+  T: () => (/* reexport safe */ _permissions_js__rspack_import_0.T),
+  UB: () => (/* reexport safe */ _permissions_js__rspack_import_0.UB),
+  UG: () => (/* reexport safe */ _permissions_js__rspack_import_0.UG),
+  UU: () => (/* reexport safe */ _message_keys_js__rspack_import_1.UU),
+  Ub: () => (/* reexport safe */ _permissions_js__rspack_import_0.Ub),
+  V0: () => (/* reexport safe */ _permissions_js__rspack_import_0.V0),
+  Wc: () => (/* reexport safe */ _permissions_js__rspack_import_0.Wc),
+  Y3: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y3),
+  Y7: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y7),
+  _X: () => (/* reexport safe */ _permissions_js__rspack_import_0._X),
+  aO: () => (/* reexport safe */ _permissions_js__rspack_import_0.aO),
+  fS: () => (/* reexport safe */ _permissions_js__rspack_import_0.fS),
+  hg: () => (/* reexport safe */ _message_keys_js__rspack_import_1.hg),
+  l3: () => (/* reexport safe */ _permissions_js__rspack_import_0.l3),
+  mK: () => (/* reexport safe */ _message_keys_js__rspack_import_1.mK),
+  mV: () => (/* reexport safe */ _permissions_js__rspack_import_0.mV),
+  rH: () => (/* reexport safe */ _permissions_js__rspack_import_0.rH),
+  t$: () => (/* reexport safe */ _permissions_js__rspack_import_0.t$),
+  w7: () => (/* reexport safe */ _permissions_js__rspack_import_0.w7),
+  wA: () => (/* reexport safe */ _permissions_js__rspack_import_0.wA),
+  wM: () => (/* reexport safe */ _permissions_js__rspack_import_0.wM),
+  z$: () => (/* reexport safe */ _permissions_js__rspack_import_0.z$),
+  zd: () => (/* reexport safe */ _permissions_js__rspack_import_0.zd)
+}, {
+  Hq: DEFAULT_EVENT_EXCHANGE,
+  Lw: PERMISSION_GUARD_CONFIG,
+  N7: PERMISSIONS_KEY,
+  PT: DOMAIN_EVENT_HANDLER_KEY,
+  Qj: EVENT_BUS_INSTANCE,
+  SL: EVENT_BUS_MODULE_OPTIONS,
+  fG: PERMISSIONS_CACHE_PREFIX,
+  iH: IDEMPOTENCY_KEY_HEADER,
+  jA: IS_PUBLIC_KEY,
+  kC: REQUEST_ID_HEADER,
+  mg: IDEMPOTENCY_CACHE_PREFIX,
+  nx: DEFAULT_EVENT_TOPIC,
+  xw: CLIENT_TYPE_HEADER,
+  zl: CACHE_INSTANCE
+});
+
+
+},
+389(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+// ==================== AUTH (Shared across guards/interceptors) ====================
+// These are duplicated in nestjs-auth but needed here to avoid circular dependencies
+const AUTH_MESSAGES = {
+    TOKEN_REQUIRED: 'auth.token.required',
+    TOKEN_INVALID: 'auth.token.invalid',
+    ENTITY_BELOG_ANOTHER_COMPANY: 'entity.belongs.another.company',
+    COMPANY_NO_ACCESS: 'auth.company.no.access'
+};
+// ==================== ERROR (HTTP Exceptions) ====================
+const ERROR_MESSAGES = {
+    NOT_FOUND: 'error.not.found',
+    VALIDATION: 'error.validation',
+    UNAUTHORIZED: 'error.unauthorized',
+    FORBIDDEN: 'error.forbidden',
+    CONFLICT: 'error.conflict',
+    DB_FOREIGN_KEY: 'error.db.foreign.key',
+    DB_NOT_NULL: 'error.db.not.null',
+    DB_INVALID_INPUT: 'error.db.invalid.input',
+    DB_VALUE_TOO_LONG: 'error.db.value.too.long',
+    DB_CHECK_CONSTRAINT: 'error.db.check.constraint',
+    DB_DEADLOCK: 'error.db.deadlock',
+    INTERNAL: 'error.internal',
+    SERVICE_UNAVAILABLE: 'error.service.unavailable',
+    UNKNOWN: 'error.unknown',
+    HTTP: 'error.http',
+    GENERIC: 'error.generic',
+    PERMISSION_SYSTEM_UNAVAILABLE: 'error.permission.system.unavailable',
+    INSUFFICIENT_PERMISSIONS: 'error.insufficient.permissions',
+    INSUFFICIENT_PERMISSIONS_OR: 'error.insufficient.permissions.or',
+    NO_PERMISSIONS_FOUND: 'error.no.permissions.found',
+    ENDPOINT_DISABLED: 'error.endpoint.disabled'
+};
+// ==================== SYSTEM (Infrastructure) ====================
+const SYSTEM_MESSAGES = {
+    REPOSITORY_NOT_AVAILABLE: 'system.repository.not.available',
+    DATASOURCE_NOT_AVAILABLE: 'system.datasource.not.available',
+    DATABASE_CONFIG_NOT_AVAILABLE: 'system.database.config.not.available',
+    SERVICE_NOT_AVAILABLE: 'system.service.not.available',
+    CONFIG_REQUIRED: 'system.config.required',
+    INTERNAL_ERROR: 'system.internal.error',
+    DUPLICATE_REQUEST: 'system.duplicate.request',
+    INVALID_TENANT_ID: 'system.invalid.tenant.id',
+    TENANT_NOT_FOUND: 'system.tenant.not.found',
+    TENANT_HEADER_REQUIRED: 'system.tenant.header.required',
+    MISSING_PARAMETER: 'system.missing.parameter',
+    SDK_NOT_INSTALLED: 'system.sdk.not.installed',
+    PATH_TRAVERSAL_DETECTED: 'system.path.traversal.detected',
+    INVALID_FILE_KEY: 'system.invalid.file.key'
+};
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  UU: ERROR_MESSAGES,
+  hg: SYSTEM_MESSAGES,
+  mK: AUTH_MESSAGES
+});
+
+
+},
+975(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+// ==================== AUTH MODULE ====================
+const USER_PERMISSIONS = {
+    CREATE: 'user.create',
+    READ: 'user.read',
+    UPDATE: 'user.update',
+    DELETE: 'user.delete',
+    LOOKUP: 'user.lookup'
+};
+const COMPANY_PERMISSIONS = {
+    CREATE: 'company.create',
+    READ: 'company.read',
+    UPDATE: 'company.update',
+    DELETE: 'company.delete'
+};
+const BRANCH_PERMISSIONS = {
+    CREATE: 'branch.create',
+    READ: 'branch.read',
+    UPDATE: 'branch.update',
+    DELETE: 'branch.delete'
+};
+const SOCIAL_AUTH_CONFIG_PERMISSIONS = {
+    CREATE: 'social-config.create',
+    READ: 'social-config.read',
+    UPDATE: 'social-config.update',
+    DELETE: 'social-config.delete'
+};
+// ==================== IAM MODULE ====================
+const ACTION_PERMISSIONS = {
+    CREATE: 'action.create',
+    READ: 'action.read',
+    UPDATE: 'action.update',
+    DELETE: 'action.delete'
+};
+const ROLE_PERMISSIONS = {
+    CREATE: 'role.create',
+    READ: 'role.read',
+    UPDATE: 'role.update',
+    DELETE: 'role.delete'
+};
+const ROLE_ACTION_PERMISSIONS = {
+    READ: 'role-action.read',
+    ASSIGN: 'role-action.assign'
+};
+const USER_ROLE_PERMISSIONS = {
+    READ: 'user-role.read',
+    ASSIGN: 'user-role.assign'
+};
+const USER_ACTION_PERMISSIONS = {
+    READ: 'user-action.read',
+    ASSIGN: 'user-action.assign'
+};
+const COMPANY_ACTION_PERMISSIONS = {
+    READ: 'company-action.read',
+    ASSIGN: 'company-action.assign'
+};
+// ==================== STORAGE MODULE ====================
+const FILE_PERMISSIONS = {
+    CREATE: 'file.create',
+    READ: 'file.read',
+    UPDATE: 'file.update',
+    DELETE: 'file.delete',
+    VIEW_PRIVATE_ACTION: 'file.view.private'
+};
+const FOLDER_PERMISSIONS = {
+    CREATE: 'folder.create',
+    READ: 'folder.read',
+    UPDATE: 'folder.update',
+    DELETE: 'folder.delete'
+};
+const STORAGE_CONFIG_PERMISSIONS = {
+    CREATE: 'storage-config.create',
+    READ: 'storage-config.read',
+    UPDATE: 'storage-config.update',
+    DELETE: 'storage-config.delete'
+};
+const UPLOAD_CONFIG_PERMISSIONS = {
+    DELETE: 'upload-config.delete'
+};
+// ==================== EMAIL MODULE ====================
+const EMAIL_CONFIG_PERMISSIONS = {
+    CREATE: 'email-config.create',
+    READ: 'email-config.read',
+    UPDATE: 'email-config.update',
+    DELETE: 'email-config.delete'
+};
+const EMAIL_TEMPLATE_PERMISSIONS = {
+    CREATE: 'email-template.create',
+    READ: 'email-template.read',
+    UPDATE: 'email-template.update',
+    DELETE: 'email-template.delete'
+};
+// ==================== FORM BUILDER MODULE ====================
+const FORM_PERMISSIONS = {
+    CREATE: 'form.create',
+    READ: 'form.read',
+    UPDATE: 'form.update',
+    DELETE: 'form.delete'
+};
+const FORM_RESULT_PERMISSIONS = {
+    CREATE: 'form-result.create',
+    READ: 'form-result.read',
+    UPDATE: 'form-result.update',
+    DELETE: 'form-result.delete'
+};
+// ==================== EVENT MANAGER MODULE ====================
+const EVENT_PERMISSIONS = {
+    CREATE: 'event.create',
+    READ: 'event.read',
+    UPDATE: 'event.update',
+    DELETE: 'event.delete'
+};
+// ==================== NOTIFICATION MODULE ====================
+const NOTIFICATION_PERMISSIONS = {
+    CREATE: 'notification.create',
+    READ: 'notification.read',
+    UPDATE: 'notification.update',
+    DELETE: 'notification.delete'
+};
+// ==================== LOCALIZATION MODULE ====================
+const LANGUAGE_PERMISSIONS = {
+    CREATE: 'language.create',
+    READ: 'language.read',
+    UPDATE: 'language.update',
+    DELETE: 'language.delete'
+};
+const TRANSLATION_KEY_PERMISSIONS = {
+    CREATE: 'translation-key.create',
+    READ: 'translation-key.read',
+    UPDATE: 'translation-key.update',
+    DELETE: 'translation-key.delete'
+};
+const TRANSLATION_PERMISSIONS = {
+    CREATE: 'translation.create',
+    READ: 'translation.read',
+    UPDATE: 'translation.update',
+    DELETE: 'translation.delete'
+};
+// ==================== TASK MANAGER MODULE ====================
+const TASK_BOARD_PERMISSIONS = {
+    CREATE: 'task-board.create',
+    READ: 'task-board.read',
+    UPDATE: 'task-board.update',
+    DELETE: 'task-board.delete',
+    MANAGE_MEMBERS: 'task-board.manage-members'
+};
+const TASK_LIST_PERMISSIONS = {
+    CREATE: 'task-list.create',
+    READ: 'task-list.read',
+    UPDATE: 'task-list.update',
+    DELETE: 'task-list.delete'
+};
+const TASK_PERMISSIONS = {
+    CREATE: 'task.create',
+    READ: 'task.read',
+    UPDATE: 'task.update',
+    DELETE: 'task.delete',
+    MOVE: 'task.move',
+    ASSIGN: 'task.assign'
+};
+const TASK_LABEL_PERMISSIONS = {
+    CREATE: 'task-label.create',
+    READ: 'task-label.read',
+    UPDATE: 'task-label.update',
+    DELETE: 'task-label.delete'
+};
+const TASK_COMMENT_PERMISSIONS = {
+    CREATE: 'task-comment.create',
+    READ: 'task-comment.read',
+    DELETE: 'task-comment.delete'
+};
+// ==================== AI ASSISTANT MODULE ====================
+const AI_ASSISTANT_PERMISSIONS = {
+    VIEW_ALL_HISTORY: 'ai-assistant.view-all-history'
+};
+// ==================== AGGREGATED EXPORTS ====================
+const PERMISSIONS = {
+    // Auth
+    USER: USER_PERMISSIONS,
+    COMPANY: COMPANY_PERMISSIONS,
+    BRANCH: BRANCH_PERMISSIONS,
+    SOCIAL_AUTH_CONFIG: SOCIAL_AUTH_CONFIG_PERMISSIONS,
+    // IAM
+    ACTION: ACTION_PERMISSIONS,
+    ROLE: ROLE_PERMISSIONS,
+    ROLE_ACTION: ROLE_ACTION_PERMISSIONS,
+    USER_ROLE: USER_ROLE_PERMISSIONS,
+    USER_ACTION: USER_ACTION_PERMISSIONS,
+    COMPANY_ACTION: COMPANY_ACTION_PERMISSIONS,
+    // Storage
+    FILE: FILE_PERMISSIONS,
+    FOLDER: FOLDER_PERMISSIONS,
+    STORAGE_CONFIG: STORAGE_CONFIG_PERMISSIONS,
+    // Email
+    EMAIL_CONFIG: EMAIL_CONFIG_PERMISSIONS,
+    EMAIL_TEMPLATE: EMAIL_TEMPLATE_PERMISSIONS,
+    // Form Builder
+    FORM: FORM_PERMISSIONS,
+    FORM_RESULT: FORM_RESULT_PERMISSIONS,
+    // Event Manager
+    EVENT: EVENT_PERMISSIONS,
+    // Notification
+    NOTIFICATION: NOTIFICATION_PERMISSIONS,
+    // Localization
+    LANGUAGE: LANGUAGE_PERMISSIONS,
+    TRANSLATION_KEY: TRANSLATION_KEY_PERMISSIONS,
+    TRANSLATION: TRANSLATION_PERMISSIONS,
+    // Task Manager
+    TASK_BOARD: TASK_BOARD_PERMISSIONS,
+    TASK_LIST: TASK_LIST_PERMISSIONS,
+    TASK: TASK_PERMISSIONS,
+    TASK_LABEL: TASK_LABEL_PERMISSIONS,
+    TASK_COMMENT: TASK_COMMENT_PERMISSIONS,
+    // AI Assistant
+    AI_ASSISTANT: AI_ASSISTANT_PERMISSIONS
+};
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  BC: USER_PERMISSIONS,
+  Bz: AI_ASSISTANT_PERMISSIONS,
+  Em: STORAGE_CONFIG_PERMISSIONS,
+  GT: FORM_RESULT_PERMISSIONS,
+  Jj: PERMISSIONS,
+  N3: TRANSLATION_KEY_PERMISSIONS,
+  ON: TASK_LIST_PERMISSIONS,
+  P0: ROLE_ACTION_PERMISSIONS,
+  Q5: LANGUAGE_PERMISSIONS,
+  S6: FILE_PERMISSIONS,
+  T: TASK_PERMISSIONS,
+  UB: UPLOAD_CONFIG_PERMISSIONS,
+  UG: TASK_LABEL_PERMISSIONS,
+  Ub: EVENT_PERMISSIONS,
+  V0: EMAIL_CONFIG_PERMISSIONS,
+  Wc: FORM_PERMISSIONS,
+  Y3: TASK_BOARD_PERMISSIONS,
+  Y7: ACTION_PERMISSIONS,
+  _X: USER_ACTION_PERMISSIONS,
+  aO: COMPANY_ACTION_PERMISSIONS,
+  fS: TRANSLATION_PERMISSIONS,
+  l3: SOCIAL_AUTH_CONFIG_PERMISSIONS,
+  mV: ROLE_PERMISSIONS,
+  rH: NOTIFICATION_PERMISSIONS,
+  t$: COMPANY_PERMISSIONS,
+  w7: USER_ROLE_PERMISSIONS,
+  wA: BRANCH_PERMISSIONS,
+  wM: FOLDER_PERMISSIONS,
+  z$: EMAIL_TEMPLATE_PERMISSIONS,
+  zd: TASK_COMMENT_PERMISSIONS
+});
+
+
+},
+374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(389);
+
+
+class PermissionSystemUnavailableException extends _nestjs_common__rspack_import_0.InternalServerErrorException {
+    constructor(){
+        super({
+            success: false,
+            message: 'Permission system temporarily unavailable',
+            messageKey: _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.PERMISSION_SYSTEM_UNAVAILABLE */.UU.PERMISSION_SYSTEM_UNAVAILABLE
+        });
+    }
+}
+class InsufficientPermissionsException extends _nestjs_common__rspack_import_0.ForbiddenException {
+    constructor(missingPermissions, operator = 'AND'){
+        const messageKey = operator === 'OR' ? _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS_OR */.UU.INSUFFICIENT_PERMISSIONS_OR : _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS */.UU.INSUFFICIENT_PERMISSIONS;
+        super({
+            success: false,
+            message: 'Insufficient permissions',
+            messageKey,
+            messageVariables: {
+                permissions: missingPermissions.join(', ')
+            },
+            missingPermissions,
+            operator
+        });
+    }
+}
+class NoPermissionsFoundException extends _nestjs_common__rspack_import_0.ForbiddenException {
+    constructor(){
+        super({
+            success: false,
+            message: 'No permissions found',
+            messageKey: _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.NO_PERMISSIONS_FOUND */.UU.NO_PERMISSIONS_FOUND
+        });
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  GS: () => (PermissionSystemUnavailableException),
+  d$: () => (NoPermissionsFoundException),
+  z8: () => (InsufficientPermissionsException)
+});
+
+
+},
+510(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  TD: () => (/* reexport */ JwtAuthGuard),
+  Zb: () => (/* reexport */ OptionalJwtGuard),
+  LQ: () => (/* reexport */ PermissionGuard)
+});
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
+var constants = __webpack_require__(43);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
+var message_keys = __webpack_require__(389);
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+// EXTERNAL MODULE: external "@nestjs/core"
+var core_ = __webpack_require__(75);
+;// CONCATENATED MODULE: external "@nestjs/passport"
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/jwt-auth.guard.ts
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+class JwtAuthGuard extends (0,__rspack_external__nestjs_passport_18907953.AuthGuard)('jwt') {
+    reflector;
+    // NOTE: @Inject(Reflector) required for bundled code - external classes need explicit injection
+    constructor(reflector){
+        super(), this.reflector = reflector;
+    }
+    canActivate(context) {
+        // Check if route is marked as public
+        const isPublic = this.reflector.getAllAndOverride(constants/* .IS_PUBLIC_KEY */.jA, [
+            context.getHandler(),
+            context.getClass()
+        ]);
+        if (isPublic) {
+            return true;
+        }
+        return super.canActivate(context);
+    }
+    handleRequest(err, user) {
+        if (err || !user) {
+            throw err || new common_.UnauthorizedException({
+                message: 'Invalid or expired token',
+                messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
+            });
+        }
+        return user;
+    }
+}
+JwtAuthGuard = _ts_decorate([
+    (0,common_.Injectable)(),
+    _ts_param(0, (0,common_.Inject)(core_.Reflector)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof core_.Reflector === "undefined" ? Object : core_.Reflector
+    ])
+], JwtAuthGuard);
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/optional-jwt-auth.guard.ts
+function optional_jwt_auth_guard_ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function optional_jwt_auth_guard_ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function optional_jwt_auth_guard_ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+class OptionalJwtGuard extends (0,__rspack_external__nestjs_passport_18907953.AuthGuard)('jwt') {
+    reflector;
+    constructor(reflector){
+        super(), this.reflector = reflector;
+    }
+    canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(constants/* .IS_PUBLIC_KEY */.jA, [
+            context.getHandler(),
+            context.getClass()
+        ]);
+        if (isPublic) {
+            return true;
+        }
+        return super.canActivate(context);
+    }
+    handleRequest(_err, user) {
+        return user || undefined;
+    }
+}
+OptionalJwtGuard = optional_jwt_auth_guard_ts_decorate([
+    (0,common_.Injectable)(),
+    optional_jwt_auth_guard_ts_param(0, (0,common_.Inject)(core_.Reflector)),
+    optional_jwt_auth_guard_ts_metadata("design:type", Function),
+    optional_jwt_auth_guard_ts_metadata("design:paramtypes", [
+        typeof core_.Reflector === "undefined" ? Object : core_.Reflector
+    ])
+], OptionalJwtGuard);
+
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/exceptions/permission.exception.ts
+var permission_exception = __webpack_require__(374);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/shared-permission-cache/shared-permission-cache.service.ts
+var shared_permission_cache_service = __webpack_require__(657);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/permission.guard.ts
+function permission_guard_ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function permission_guard_ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function permission_guard_ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+
+class PermissionGuard {
+    reflector;
+    permissionCacheService;
+    constructor(reflector, permissionCacheService){
+        this.reflector = reflector;
+        this.permissionCacheService = permissionCacheService;
+    }
+    async canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(constants/* .IS_PUBLIC_KEY */.jA, [
+            context.getHandler(),
+            context.getClass()
+        ]);
+        if (isPublic) return true;
+        const permissionConfig = this.reflector.getAllAndOverride(constants/* .PERMISSIONS_KEY */.N7, [
+            context.getHandler(),
+            context.getClass()
+        ]);
+        if (!permissionConfig) return true;
+        const request = context.switchToHttp().getRequest();
+        const user = request.user;
+        if (!user) throw new common_.UnauthorizedException({
+            message: 'Authentication required',
+            messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_REQUIRED */.mK.TOKEN_REQUIRED
+        });
+        if (!this.permissionCacheService?.isCacheConfigured()) {
+            throw new permission_exception/* .PermissionSystemUnavailableException */.GS();
+        }
+        const permissionService = this.permissionCacheService;
+        const userPermissions = await permissionService.getPermissions({
+            userId: user.id,
+            companyId: user.companyId,
+            branchId: user.branchId
+        });
+        if (!userPermissions || userPermissions.length === 0) {
+            throw new permission_exception/* .NoPermissionsFoundException */.d$();
+        }
+        const logicNode = this.normalizeToLogicNode(permissionConfig);
+        if (!logicNode) return true;
+        const result = this.evaluateLogicNode(logicNode, userPermissions, permissionService);
+        if (!result.passed) {
+            throw new permission_exception/* .InsufficientPermissionsException */.z8(result.missingPermissions, result.operator);
+        }
+        return true;
+    }
+    normalizeToLogicNode(config) {
+        // string - single permission
+        if (typeof config === 'string') {
+            return config ? {
+                type: 'action',
+                actionId: config
+            } : null;
+        }
+        // string[] - treat as AND of multiple permissions
+        if (Array.isArray(config)) {
+            if (config.length === 0) return null;
+            if (config.length === 1) return {
+                type: 'action',
+                actionId: config[0]
+            };
+            return {
+                type: 'group',
+                operator: 'AND',
+                children: config.map((p)=>({
+                        type: 'action',
+                        actionId: p
+                    }))
+            };
+        }
+        // SimplePermissionConfig - { permissions: string[], operator: 'AND'|'OR' }
+        if ('permissions' in config && Array.isArray(config.permissions)) {
+            const simple = config;
+            if (simple.permissions.length === 0) return null;
+            if (simple.permissions.length === 1) return {
+                type: 'action',
+                actionId: simple.permissions[0]
+            };
+            return {
+                type: 'group',
+                operator: simple.operator || 'AND',
+                children: simple.permissions.map((p)=>({
+                        type: 'action',
+                        actionId: p
+                    }))
+            };
+        }
+        // ILogicNode
+        return config;
+    }
+    evaluateLogicNode(node, userPermissions, permissionService) {
+        if (node.type === 'action') {
+            const passed = permissionService.matchPermission(userPermissions, node.actionId);
+            return {
+                passed,
+                missingPermissions: passed ? [] : [
+                    node.actionId
+                ],
+                operator: 'AND'
+            };
+        }
+        // Group node
+        const { operator, children } = node;
+        // SECURITY: Fail-closed - deny access when no children configured
+        if (!children || children.length === 0) {
+            return {
+                passed: false,
+                missingPermissions: [],
+                operator
+            };
+        }
+        const results = [];
+        const missingPermissions = [];
+        for (const child of children){
+            const childResult = this.evaluateLogicNode(child, userPermissions, permissionService);
+            results.push(childResult.passed);
+            if (!childResult.passed) {
+                missingPermissions.push(...childResult.missingPermissions);
+            }
+        }
+        const passed = operator === 'OR' ? results.some((r)=>r) : results.every((r)=>r);
+        return {
+            passed,
+            missingPermissions: passed ? [] : missingPermissions,
+            operator
+        };
+    }
+}
+PermissionGuard = permission_guard_ts_decorate([
+    (0,common_.Injectable)(),
+    permission_guard_ts_param(0, (0,common_.Inject)(core_.Reflector)),
+    permission_guard_ts_param(1, (0,common_.Optional)()),
+    permission_guard_ts_param(1, (0,common_.Inject)(shared_permission_cache_service/* .SharedPermissionCacheService */.U)),
+    permission_guard_ts_metadata("design:type", Function),
+    permission_guard_ts_metadata("design:paramtypes", [
+        typeof core_.Reflector === "undefined" ? Object : core_.Reflector,
+        typeof shared_permission_cache_service/* .SharedPermissionCacheService */.U === "undefined" ? Object : shared_permission_cache_service/* .SharedPermissionCacheService */.U
+    ])
+], PermissionGuard);
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/guards/index.ts
+
+
+
+
+
+},
+657(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
+/* import */ var _classes_hybrid_cache_class_js__rspack_import_1 = __webpack_require__(375);
+/* import */ var _constants_index_js__rspack_import_3 = __webpack_require__(43);
+/* import */ var _utils_permission_cache_key_util_js__rspack_import_2 = __webpack_require__(199);
+function _ts_decorate(decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
+        r = Reflect.decorate(decorators, target, key, desc);
+    } else {
+        for(var i = decorators.length - 1; i >= 0; i--){
+            if (d = decorators[i]) {
+                r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+            }
+        }
+    }
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+function _ts_metadata(metadataKey, metadataValue) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") {
+        return Reflect.metadata(metadataKey, metadataValue);
+    }
+}
+function _ts_param(paramIndex, decorator) {
+    return function(target, key) {
+        decorator(target, key, paramIndex);
+    };
+}
+
+
+
+
+class SharedPermissionCacheService {
+    cache;
+    config;
+    constructor(cache, config){
+        this.cache = cache;
+        this.config = {
+            enableCompanyFeature: false,
+            userPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_2/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6,
+            companyPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_2/* .DEFAULT_COMPANY_PERMISSION_KEY_FORMAT */.s8,
+            ...config
+        };
+    }
+    /** Read the cached permission codes for a user; empty array when cache is unavailable or unset */ async getPermissions(options) {
+        if (!this.cache) return [];
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cached = await this.cache.get(cacheKey);
+        if (!cached) return [];
+        return Array.isArray(cached) ? cached : cached.backendCodes || [];
+    }
+    /** Overwrite the cached permission codes for a user with a fixed list */ async setPermissions(options, permissions, ttl) {
+        if (!this.cache) return;
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        await this.cache.set(cacheKey, permissions, ttl);
+    }
+    /** Clear the cached permission codes for a user */ async clearPermissions(options) {
+        if (!this.cache) return;
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        await this.cache.del(cacheKey);
+    }
+    /** Check a single permission against the cached list, honoring `*` and `prefix.*` wildcards */ async hasPermission(options, requiredPermission) {
+        const permissions = await this.getPermissions(options);
+        return this.matchPermission(permissions, requiredPermission);
+    }
+    /** Whether a cache instance is wired up; false means permission checks can't be served at all */ isCacheConfigured() {
+        return !!this.cache;
+    }
+    /** Match an already-fetched permission list against a required permission, honoring `*` and `prefix.*` wildcards */ matchPermission(userPermissions, requiredPermission) {
+        if (userPermissions.includes(requiredPermission)) return true;
+        for (const permission of userPermissions){
+            if (permission === '*') return true;
+            if (permission.endsWith('.*') && requiredPermission.startsWith(permission.slice(0, -1))) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
+SharedPermissionCacheService = _ts_decorate([
+    (0,_nestjs_common__rspack_import_0.Injectable)(),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Optional)()),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_3/* .CACHE_INSTANCE */.zl)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_0.Optional)()),
+    _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_3/* .PERMISSION_GUARD_CONFIG */.Lw)),
+    _ts_metadata("design:type", Function),
+    _ts_metadata("design:paramtypes", [
+        typeof _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l === "undefined" ? Object : _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l,
+        typeof PermissionGuardConfig === "undefined" ? Object : PermissionGuardConfig
+    ])
+], SharedPermissionCacheService);
+
+__webpack_require__.d(__webpack_exports__, {
+  U: () => (SharedPermissionCacheService)
+});
+
+
+},
+199(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _constants_index_js__rspack_import_0 = __webpack_require__(43);
+
+const DEFAULT_USER_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:user:{userId}`;
+const DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = `${_constants_index_js__rspack_import_0/* .PERMISSIONS_CACHE_PREFIX */.fG}:company:{companyId}:branch:{branchId}:user:{userId}`;
+/** Single source of truth for permission cache keys, shared by the guard (reader) and cache service (writer) so a config override can't desync them; company scope requires enableCompanyFeature, not just a companyId */ function buildPermissionCacheKey(options, config) {
+    const isCompanyScope = Boolean(config?.enableCompanyFeature && options.companyId);
+    if (isCompanyScope) {
+        return (config?.companyPermissionKeyFormat || DEFAULT_COMPANY_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId).replace('{companyId}', options.companyId).replace('{branchId}', options.branchId || 'null');
+    }
+    return (config?.userPermissionKeyFormat || DEFAULT_USER_PERMISSION_KEY_FORMAT).replace('{userId}', options.userId);
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  nt: () => (buildPermissionCacheKey)
+}, {
+  q6: DEFAULT_USER_PERMISSION_KEY_FORMAT,
+  s8: DEFAULT_COMPANY_PERMISSION_KEY_FORMAT
+});
+
+
+},
+307(module) {
+
+module.exports = __rspack_external__flusys_nestjs_core_config_197fa0a9;
+
+
+},
+157(module) {
+
+module.exports = __rspack_external__nestjs_common_a04939da;
+
+
+},
+75(module) {
+
+module.exports = __rspack_external__nestjs_core_d7b00a1a;
+
+
+},
+
+};
+import { __webpack_require__ } from '../runtime.js';
+var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
+import * as __rspack_chunk_1 from './index.js';
+__webpack_require__.C(__rspack_chunk_1);
+var __webpack_exports__ = __webpack_exec__(510);var __webpack_exports__JwtAuthGuard = __webpack_exports__.TD;
+var __webpack_exports__OptionalJwtGuard = __webpack_exports__.Zb;
+var __webpack_exports__PermissionGuard = __webpack_exports__.LQ;
+export { __webpack_exports__JwtAuthGuard as JwtAuthGuard, __webpack_exports__OptionalJwtGuard as OptionalJwtGuard, __webpack_exports__PermissionGuard as PermissionGuard };