@flusys/nestjs-shared 8.1.4 → 9.1.0-rc.1

package/fesm/guards/index.js

@@ -1,5 +1,3 @@
-import * as __rspack_external__flusys_nestjs_core_config_197fa0a9 from "@flusys/nestjs-core/config";
-import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
 import * as __rspack_external__nestjs_core_d7b00a1a from "@nestjs/core";
 import * as __rspack_external__nestjs_passport_18907953 from "@nestjs/passport";
 import * as __rspack_external__keyv_redis_139d03ca from "@keyv/redis";
@@ -94,400 +92,6 @@ class HybridCache {
 }
 
 
-},
-43(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _permissions_js__rspack_import_0 = __webpack_require__(975);
-/* import */ var _message_keys_js__rspack_import_1 = __webpack_require__(389);
-// Metadata keys
-const IS_PUBLIC_KEY = 'isPublic';
-const PERMISSIONS_KEY = 'permissions';
-const DOMAIN_EVENT_HANDLER_KEY = 'domainEventHandler';
-// Injection tokens
-const CACHE_INSTANCE = 'CACHE_INSTANCE';
-const PERMISSION_GUARD_CONFIG = 'PERMISSION_GUARD_CONFIG';
-const EVENT_BUS_INSTANCE = 'EVENT_BUS_INSTANCE';
-const EVENT_BUS_MODULE_OPTIONS = 'EVENT_BUS_MODULE_OPTIONS';
-// Header names
-const IDEMPOTENCY_KEY_HEADER = 'x-idempotency-key';
-const REQUEST_ID_HEADER = 'x-request-id';
-const CLIENT_TYPE_HEADER = 'x-client-type';
-// Cache key prefixes
-const PERMISSIONS_CACHE_PREFIX = 'my-permissions';
-const IDEMPOTENCY_CACHE_PREFIX = 'idempotency';
-// Event bus defaults
-const DEFAULT_EVENT_EXCHANGE = 'flusys.events';
-const DEFAULT_EVENT_TOPIC = 'flusys.domain-events';
-const DEFAULT_EVENT_SERVICE_NAME = 'flusys';
-// Permission codes
-
-// Message keys for localization
-
-
-__webpack_require__.d(__webpack_exports__, {
-  BC: () => (/* reexport safe */ _permissions_js__rspack_import_0.BC),
-  Bz: () => (/* reexport safe */ _permissions_js__rspack_import_0.Bz),
-  Em: () => (/* reexport safe */ _permissions_js__rspack_import_0.Em),
-  GT: () => (/* reexport safe */ _permissions_js__rspack_import_0.GT),
-  Jj: () => (/* reexport safe */ _permissions_js__rspack_import_0.Jj),
-  N3: () => (/* reexport safe */ _permissions_js__rspack_import_0.N3),
-  ON: () => (/* reexport safe */ _permissions_js__rspack_import_0.ON),
-  P0: () => (/* reexport safe */ _permissions_js__rspack_import_0.P0),
-  Q5: () => (/* reexport safe */ _permissions_js__rspack_import_0.Q5),
-  S6: () => (/* reexport safe */ _permissions_js__rspack_import_0.S6),
-  T: () => (/* reexport safe */ _permissions_js__rspack_import_0.T),
-  UB: () => (/* reexport safe */ _permissions_js__rspack_import_0.UB),
-  UG: () => (/* reexport safe */ _permissions_js__rspack_import_0.UG),
-  UU: () => (/* reexport safe */ _message_keys_js__rspack_import_1.UU),
-  Ub: () => (/* reexport safe */ _permissions_js__rspack_import_0.Ub),
-  V0: () => (/* reexport safe */ _permissions_js__rspack_import_0.V0),
-  Wc: () => (/* reexport safe */ _permissions_js__rspack_import_0.Wc),
-  Y3: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y3),
-  Y7: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y7),
-  _X: () => (/* reexport safe */ _permissions_js__rspack_import_0._X),
-  aO: () => (/* reexport safe */ _permissions_js__rspack_import_0.aO),
-  fS: () => (/* reexport safe */ _permissions_js__rspack_import_0.fS),
-  hg: () => (/* reexport safe */ _message_keys_js__rspack_import_1.hg),
-  l3: () => (/* reexport safe */ _permissions_js__rspack_import_0.l3),
-  mK: () => (/* reexport safe */ _message_keys_js__rspack_import_1.mK),
-  mV: () => (/* reexport safe */ _permissions_js__rspack_import_0.mV),
-  rH: () => (/* reexport safe */ _permissions_js__rspack_import_0.rH),
-  t$: () => (/* reexport safe */ _permissions_js__rspack_import_0.t$),
-  w7: () => (/* reexport safe */ _permissions_js__rspack_import_0.w7),
-  wA: () => (/* reexport safe */ _permissions_js__rspack_import_0.wA),
-  wM: () => (/* reexport safe */ _permissions_js__rspack_import_0.wM),
-  z$: () => (/* reexport safe */ _permissions_js__rspack_import_0.z$),
-  zd: () => (/* reexport safe */ _permissions_js__rspack_import_0.zd)
-}, {
-  Hq: DEFAULT_EVENT_EXCHANGE,
-  Lw: PERMISSION_GUARD_CONFIG,
-  N7: PERMISSIONS_KEY,
-  PT: DOMAIN_EVENT_HANDLER_KEY,
-  Qj: EVENT_BUS_INSTANCE,
-  SL: EVENT_BUS_MODULE_OPTIONS,
-  fG: PERMISSIONS_CACHE_PREFIX,
-  iH: IDEMPOTENCY_KEY_HEADER,
-  jA: IS_PUBLIC_KEY,
-  kC: REQUEST_ID_HEADER,
-  mg: IDEMPOTENCY_CACHE_PREFIX,
-  nx: DEFAULT_EVENT_TOPIC,
-  xw: CLIENT_TYPE_HEADER,
-  zl: CACHE_INSTANCE
-});
-
-
-},
-389(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-// ==================== AUTH (Shared across guards/interceptors) ====================
-// These are duplicated in nestjs-auth but needed here to avoid circular dependencies
-const AUTH_MESSAGES = {
-    TOKEN_REQUIRED: 'auth.token.required',
-    TOKEN_INVALID: 'auth.token.invalid',
-    ENTITY_BELOG_ANOTHER_COMPANY: 'entity.belongs.another.company',
-    COMPANY_NO_ACCESS: 'auth.company.no.access'
-};
-// ==================== ERROR (HTTP Exceptions) ====================
-const ERROR_MESSAGES = {
-    NOT_FOUND: 'error.not.found',
-    VALIDATION: 'error.validation',
-    UNAUTHORIZED: 'error.unauthorized',
-    FORBIDDEN: 'error.forbidden',
-    CONFLICT: 'error.conflict',
-    DB_FOREIGN_KEY: 'error.db.foreign.key',
-    DB_NOT_NULL: 'error.db.not.null',
-    DB_INVALID_INPUT: 'error.db.invalid.input',
-    DB_VALUE_TOO_LONG: 'error.db.value.too.long',
-    DB_CHECK_CONSTRAINT: 'error.db.check.constraint',
-    DB_DEADLOCK: 'error.db.deadlock',
-    INTERNAL: 'error.internal',
-    SERVICE_UNAVAILABLE: 'error.service.unavailable',
-    UNKNOWN: 'error.unknown',
-    HTTP: 'error.http',
-    GENERIC: 'error.generic',
-    PERMISSION_SYSTEM_UNAVAILABLE: 'error.permission.system.unavailable',
-    INSUFFICIENT_PERMISSIONS: 'error.insufficient.permissions',
-    INSUFFICIENT_PERMISSIONS_OR: 'error.insufficient.permissions.or',
-    NO_PERMISSIONS_FOUND: 'error.no.permissions.found',
-    ENDPOINT_DISABLED: 'error.endpoint.disabled'
-};
-// ==================== SYSTEM (Infrastructure) ====================
-const SYSTEM_MESSAGES = {
-    REPOSITORY_NOT_AVAILABLE: 'system.repository.not.available',
-    DATASOURCE_NOT_AVAILABLE: 'system.datasource.not.available',
-    DATABASE_CONFIG_NOT_AVAILABLE: 'system.database.config.not.available',
-    SERVICE_NOT_AVAILABLE: 'system.service.not.available',
-    CONFIG_REQUIRED: 'system.config.required',
-    INTERNAL_ERROR: 'system.internal.error',
-    DUPLICATE_REQUEST: 'system.duplicate.request',
-    INVALID_TENANT_ID: 'system.invalid.tenant.id',
-    TENANT_NOT_FOUND: 'system.tenant.not.found',
-    TENANT_HEADER_REQUIRED: 'system.tenant.header.required',
-    MISSING_PARAMETER: 'system.missing.parameter',
-    SDK_NOT_INSTALLED: 'system.sdk.not.installed',
-    PATH_TRAVERSAL_DETECTED: 'system.path.traversal.detected',
-    INVALID_FILE_KEY: 'system.invalid.file.key'
-};
-
-__webpack_require__.d(__webpack_exports__, {
-}, {
-  UU: ERROR_MESSAGES,
-  hg: SYSTEM_MESSAGES,
-  mK: AUTH_MESSAGES
-});
-
-
-},
-975(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-// ==================== AUTH MODULE ====================
-const USER_PERMISSIONS = {
-    CREATE: 'user.create',
-    READ: 'user.read',
-    UPDATE: 'user.update',
-    DELETE: 'user.delete',
-    LOOKUP: 'user.lookup'
-};
-const COMPANY_PERMISSIONS = {
-    CREATE: 'company.create',
-    READ: 'company.read',
-    UPDATE: 'company.update',
-    DELETE: 'company.delete'
-};
-const BRANCH_PERMISSIONS = {
-    CREATE: 'branch.create',
-    READ: 'branch.read',
-    UPDATE: 'branch.update',
-    DELETE: 'branch.delete'
-};
-const SOCIAL_AUTH_CONFIG_PERMISSIONS = {
-    CREATE: 'social-config.create',
-    READ: 'social-config.read',
-    UPDATE: 'social-config.update',
-    DELETE: 'social-config.delete'
-};
-// ==================== IAM MODULE ====================
-const ACTION_PERMISSIONS = {
-    CREATE: 'action.create',
-    READ: 'action.read',
-    UPDATE: 'action.update',
-    DELETE: 'action.delete'
-};
-const ROLE_PERMISSIONS = {
-    CREATE: 'role.create',
-    READ: 'role.read',
-    UPDATE: 'role.update',
-    DELETE: 'role.delete'
-};
-const ROLE_ACTION_PERMISSIONS = {
-    READ: 'role-action.read',
-    ASSIGN: 'role-action.assign'
-};
-const USER_ROLE_PERMISSIONS = {
-    READ: 'user-role.read',
-    ASSIGN: 'user-role.assign'
-};
-const USER_ACTION_PERMISSIONS = {
-    READ: 'user-action.read',
-    ASSIGN: 'user-action.assign'
-};
-const COMPANY_ACTION_PERMISSIONS = {
-    READ: 'company-action.read',
-    ASSIGN: 'company-action.assign'
-};
-// ==================== STORAGE MODULE ====================
-const FILE_PERMISSIONS = {
-    CREATE: 'file.create',
-    READ: 'file.read',
-    UPDATE: 'file.update',
-    DELETE: 'file.delete',
-    VIEW_PRIVATE_ACTION: 'file.view.private'
-};
-const FOLDER_PERMISSIONS = {
-    CREATE: 'folder.create',
-    READ: 'folder.read',
-    UPDATE: 'folder.update',
-    DELETE: 'folder.delete'
-};
-const STORAGE_CONFIG_PERMISSIONS = {
-    CREATE: 'storage-config.create',
-    READ: 'storage-config.read',
-    UPDATE: 'storage-config.update',
-    DELETE: 'storage-config.delete'
-};
-const UPLOAD_CONFIG_PERMISSIONS = {
-    DELETE: 'upload-config.delete'
-};
-// ==================== EMAIL MODULE ====================
-const EMAIL_CONFIG_PERMISSIONS = {
-    CREATE: 'email-config.create',
-    READ: 'email-config.read',
-    UPDATE: 'email-config.update',
-    DELETE: 'email-config.delete'
-};
-const EMAIL_TEMPLATE_PERMISSIONS = {
-    CREATE: 'email-template.create',
-    READ: 'email-template.read',
-    UPDATE: 'email-template.update',
-    DELETE: 'email-template.delete'
-};
-// ==================== FORM BUILDER MODULE ====================
-const FORM_PERMISSIONS = {
-    CREATE: 'form.create',
-    READ: 'form.read',
-    UPDATE: 'form.update',
-    DELETE: 'form.delete'
-};
-const FORM_RESULT_PERMISSIONS = {
-    CREATE: 'form-result.create',
-    READ: 'form-result.read',
-    UPDATE: 'form-result.update',
-    DELETE: 'form-result.delete'
-};
-// ==================== EVENT MANAGER MODULE ====================
-const EVENT_PERMISSIONS = {
-    CREATE: 'event.create',
-    READ: 'event.read',
-    UPDATE: 'event.update',
-    DELETE: 'event.delete'
-};
-// ==================== NOTIFICATION MODULE ====================
-const NOTIFICATION_PERMISSIONS = {
-    CREATE: 'notification.create',
-    READ: 'notification.read',
-    UPDATE: 'notification.update',
-    DELETE: 'notification.delete'
-};
-// ==================== LOCALIZATION MODULE ====================
-const LANGUAGE_PERMISSIONS = {
-    CREATE: 'language.create',
-    READ: 'language.read',
-    UPDATE: 'language.update',
-    DELETE: 'language.delete'
-};
-const TRANSLATION_KEY_PERMISSIONS = {
-    CREATE: 'translation-key.create',
-    READ: 'translation-key.read',
-    UPDATE: 'translation-key.update',
-    DELETE: 'translation-key.delete'
-};
-const TRANSLATION_PERMISSIONS = {
-    CREATE: 'translation.create',
-    READ: 'translation.read',
-    UPDATE: 'translation.update',
-    DELETE: 'translation.delete'
-};
-// ==================== TASK MANAGER MODULE ====================
-const TASK_BOARD_PERMISSIONS = {
-    CREATE: 'task-board.create',
-    READ: 'task-board.read',
-    UPDATE: 'task-board.update',
-    DELETE: 'task-board.delete',
-    MANAGE_MEMBERS: 'task-board.manage-members'
-};
-const TASK_LIST_PERMISSIONS = {
-    CREATE: 'task-list.create',
-    READ: 'task-list.read',
-    UPDATE: 'task-list.update',
-    DELETE: 'task-list.delete'
-};
-const TASK_PERMISSIONS = {
-    CREATE: 'task.create',
-    READ: 'task.read',
-    UPDATE: 'task.update',
-    DELETE: 'task.delete',
-    MOVE: 'task.move',
-    ASSIGN: 'task.assign'
-};
-const TASK_LABEL_PERMISSIONS = {
-    CREATE: 'task-label.create',
-    READ: 'task-label.read',
-    UPDATE: 'task-label.update',
-    DELETE: 'task-label.delete'
-};
-const TASK_COMMENT_PERMISSIONS = {
-    CREATE: 'task-comment.create',
-    READ: 'task-comment.read',
-    DELETE: 'task-comment.delete'
-};
-// ==================== AI ASSISTANT MODULE ====================
-const AI_ASSISTANT_PERMISSIONS = {
-    VIEW_ALL_HISTORY: 'ai-assistant.view-all-history'
-};
-// ==================== AGGREGATED EXPORTS ====================
-const PERMISSIONS = {
-    // Auth
-    USER: USER_PERMISSIONS,
-    COMPANY: COMPANY_PERMISSIONS,
-    BRANCH: BRANCH_PERMISSIONS,
-    SOCIAL_AUTH_CONFIG: SOCIAL_AUTH_CONFIG_PERMISSIONS,
-    // IAM
-    ACTION: ACTION_PERMISSIONS,
-    ROLE: ROLE_PERMISSIONS,
-    ROLE_ACTION: ROLE_ACTION_PERMISSIONS,
-    USER_ROLE: USER_ROLE_PERMISSIONS,
-    USER_ACTION: USER_ACTION_PERMISSIONS,
-    COMPANY_ACTION: COMPANY_ACTION_PERMISSIONS,
-    // Storage
-    FILE: FILE_PERMISSIONS,
-    FOLDER: FOLDER_PERMISSIONS,
-    STORAGE_CONFIG: STORAGE_CONFIG_PERMISSIONS,
-    // Email
-    EMAIL_CONFIG: EMAIL_CONFIG_PERMISSIONS,
-    EMAIL_TEMPLATE: EMAIL_TEMPLATE_PERMISSIONS,
-    // Form Builder
-    FORM: FORM_PERMISSIONS,
-    FORM_RESULT: FORM_RESULT_PERMISSIONS,
-    // Event Manager
-    EVENT: EVENT_PERMISSIONS,
-    // Notification
-    NOTIFICATION: NOTIFICATION_PERMISSIONS,
-    // Localization
-    LANGUAGE: LANGUAGE_PERMISSIONS,
-    TRANSLATION_KEY: TRANSLATION_KEY_PERMISSIONS,
-    TRANSLATION: TRANSLATION_PERMISSIONS,
-    // Task Manager
-    TASK_BOARD: TASK_BOARD_PERMISSIONS,
-    TASK_LIST: TASK_LIST_PERMISSIONS,
-    TASK: TASK_PERMISSIONS,
-    TASK_LABEL: TASK_LABEL_PERMISSIONS,
-    TASK_COMMENT: TASK_COMMENT_PERMISSIONS,
-    // AI Assistant
-    AI_ASSISTANT: AI_ASSISTANT_PERMISSIONS
-};
-
-__webpack_require__.d(__webpack_exports__, {
-}, {
-  BC: USER_PERMISSIONS,
-  Bz: AI_ASSISTANT_PERMISSIONS,
-  Em: STORAGE_CONFIG_PERMISSIONS,
-  GT: FORM_RESULT_PERMISSIONS,
-  Jj: PERMISSIONS,
-  N3: TRANSLATION_KEY_PERMISSIONS,
-  ON: TASK_LIST_PERMISSIONS,
-  P0: ROLE_ACTION_PERMISSIONS,
-  Q5: LANGUAGE_PERMISSIONS,
-  S6: FILE_PERMISSIONS,
-  T: TASK_PERMISSIONS,
-  UB: UPLOAD_CONFIG_PERMISSIONS,
-  UG: TASK_LABEL_PERMISSIONS,
-  Ub: EVENT_PERMISSIONS,
-  V0: EMAIL_CONFIG_PERMISSIONS,
-  Wc: FORM_PERMISSIONS,
-  Y3: TASK_BOARD_PERMISSIONS,
-  Y7: ACTION_PERMISSIONS,
-  _X: USER_ACTION_PERMISSIONS,
-  aO: COMPANY_ACTION_PERMISSIONS,
-  fS: TRANSLATION_PERMISSIONS,
-  l3: SOCIAL_AUTH_CONFIG_PERMISSIONS,
-  mV: ROLE_PERMISSIONS,
-  rH: NOTIFICATION_PERMISSIONS,
-  t$: COMPANY_PERMISSIONS,
-  w7: USER_ROLE_PERMISSIONS,
-  wA: BRANCH_PERMISSIONS,
-  wM: FOLDER_PERMISSIONS,
-  z$: EMAIL_TEMPLATE_PERMISSIONS,
-  zd: TASK_COMMENT_PERMISSIONS
-});
-
-
 },
 374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
@@ -547,8 +151,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
 var constants = __webpack_require__(43);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
-var message_keys = __webpack_require__(389);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 2 modules
+var logger_middleware = __webpack_require__(591);
 // EXTERNAL MODULE: external "@nestjs/common"
 var common_ = __webpack_require__(157);
 // EXTERNAL MODULE: external "@nestjs/core"
@@ -583,6 +187,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class JwtAuthGuard extends (0,__rspack_external__nestjs_passport_18907953.AuthGuard)('jwt') {
     reflector;
     // NOTE: @Inject(Reflector) required for bundled code - external classes need explicit injection
@@ -604,9 +209,10 @@ class JwtAuthGuard extends (0,__rspack_external__nestjs_passport_18907953.AuthGu
         if (err || !user) {
             throw err || new common_.UnauthorizedException({
                 message: 'Invalid or expired token',
-                messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
+                messageKey: constants/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
             });
         }
+        (0,logger_middleware/* .setRequestUser */.ZV)(user);
         return user;
     }
 }
@@ -647,6 +253,7 @@ function optional_jwt_auth_guard_ts_param(paramIndex, decorator) {
 
 
 
+
 class OptionalJwtGuard extends (0,__rspack_external__nestjs_passport_18907953.AuthGuard)('jwt') {
     reflector;
     constructor(reflector){
@@ -663,6 +270,7 @@ class OptionalJwtGuard extends (0,__rspack_external__nestjs_passport_18907953.Au
         return super.canActivate(context);
     }
     handleRequest(_err, user) {
+        (0,logger_middleware/* .setRequestUser */.ZV)(user);
         return user || undefined;
     }
 }
@@ -730,7 +338,7 @@ class PermissionGuard {
         const user = request.user;
         if (!user) throw new common_.UnauthorizedException({
             message: 'Authentication required',
-            messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_REQUIRED */.mK.TOKEN_REQUIRED
+            messageKey: constants/* .AUTH_MESSAGES.TOKEN_REQUIRED */.mK.TOKEN_REQUIRED
         });
         if (!this.permissionCacheService?.isCacheConfigured()) {
             throw new permission_exception/* .PermissionSystemUnavailableException */.GS();
@@ -856,8 +464,10 @@ PermissionGuard = permission_guard_ts_decorate([
 657(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
 /* import */ var _classes_hybrid_cache_class_js__rspack_import_1 = __webpack_require__(375);
-/* import */ var _constants_index_js__rspack_import_3 = __webpack_require__(43);
-/* import */ var _utils_permission_cache_key_util_js__rspack_import_2 = __webpack_require__(199);
+/* import */ var _constants_index_js__rspack_import_2 = __webpack_require__(43);
+/* import */ var _exceptions_permission_exception_js__rspack_import_3 = __webpack_require__(374);
+/* import */ var _utils_permission_cache_key_util_js__rspack_import_4 = __webpack_require__(199);
+/* import */ var _utils_permission_match_util_js__rspack_import_5 = __webpack_require__(788);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -885,6 +495,8 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
 class SharedPermissionCacheService {
     cache;
     config;
@@ -892,52 +504,56 @@ class SharedPermissionCacheService {
         this.cache = cache;
         this.config = {
             enableCompanyFeature: false,
-            userPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_2/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6,
-            companyPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_2/* .DEFAULT_COMPANY_PERMISSION_KEY_FORMAT */.s8,
+            userPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_4/* .DEFAULT_USER_PERMISSION_KEY_FORMAT */.q6,
+            companyPermissionKeyFormat: _utils_permission_cache_key_util_js__rspack_import_4/* .DEFAULT_COMPANY_PERMISSION_KEY_FORMAT */.s8,
             ...config
         };
     }
     /** Read the cached permission codes for a user; empty array when cache is unavailable or unset */ async getPermissions(options) {
         if (!this.cache) return [];
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
         const cached = await this.cache.get(cacheKey);
         if (!cached) return [];
         return Array.isArray(cached) ? cached : cached.backendCodes || [];
     }
     /** Overwrite the cached permission codes for a user with a fixed list */ async setPermissions(options, permissions, ttl) {
         if (!this.cache) return;
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
         await this.cache.set(cacheKey, permissions, ttl);
     }
     /** Clear the cached permission codes for a user */ async clearPermissions(options) {
         if (!this.cache) return;
-        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_2/* .buildPermissionCacheKey */.nt)(options, this.config);
+        const cacheKey = (0,_utils_permission_cache_key_util_js__rspack_import_4/* .buildPermissionCacheKey */.nt)(options, this.config);
         await this.cache.del(cacheKey);
     }
     /** Check a single permission against the cached list, honoring `*` and `prefix.*` wildcards */ async hasPermission(options, requiredPermission) {
         const permissions = await this.getPermissions(options);
         return this.matchPermission(permissions, requiredPermission);
     }
+    /** Throws 403 unless `user` holds `requiredPermission`; fails closed (500) when no cache is wired up. */ async assertPermission(user, requiredPermission) {
+        if (!this.isCacheConfigured()) throw new _exceptions_permission_exception_js__rspack_import_3/* .PermissionSystemUnavailableException */.GS();
+        const allowed = !!user?.id && await this.hasPermission({
+            userId: user.id,
+            companyId: user.companyId,
+            branchId: user.branchId
+        }, requiredPermission);
+        if (!allowed) throw new _exceptions_permission_exception_js__rspack_import_3/* .InsufficientPermissionsException */.z8([
+            requiredPermission
+        ], 'AND');
+    }
     /** Whether a cache instance is wired up; false means permission checks can't be served at all */ isCacheConfigured() {
         return !!this.cache;
     }
     /** Match an already-fetched permission list against a required permission, honoring `*` and `prefix.*` wildcards */ matchPermission(userPermissions, requiredPermission) {
-        if (userPermissions.includes(requiredPermission)) return true;
-        for (const permission of userPermissions){
-            if (permission === '*') return true;
-            if (permission.endsWith('.*') && requiredPermission.startsWith(permission.slice(0, -1))) {
-                return true;
-            }
-        }
-        return false;
+        return (0,_utils_permission_match_util_js__rspack_import_5/* .matchesPermission */.x)(userPermissions, requiredPermission);
     }
 }
 SharedPermissionCacheService = _ts_decorate([
     (0,_nestjs_common__rspack_import_0.Injectable)(),
     _ts_param(0, (0,_nestjs_common__rspack_import_0.Optional)()),
-    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_3/* .CACHE_INSTANCE */.zl)),
+    _ts_param(0, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_2/* .CACHE_INSTANCE */.zl)),
     _ts_param(1, (0,_nestjs_common__rspack_import_0.Optional)()),
-    _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_3/* .PERMISSION_GUARD_CONFIG */.Lw)),
+    _ts_param(1, (0,_nestjs_common__rspack_import_0.Inject)(_constants_index_js__rspack_import_2/* .PERMISSION_GUARD_CONFIG */.Lw)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l === "undefined" ? Object : _classes_hybrid_cache_class_js__rspack_import_1/* .HybridCache */.l,
@@ -973,15 +589,19 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-307(module) {
-
-module.exports = __rspack_external__flusys_nestjs_core_config_197fa0a9;
-
-
-},
-157(module) {
+788(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/** Whether `granted` covers `required`, honoring `*` (everything) and `prefix.*` (everything under prefix) wildcards */ function matchesPermission(granted, required) {
+    if (granted.includes(required)) return true;
+    for (const permission of granted){
+        if (permission === '*') return true;
+        if (permission.endsWith('.*') && required.startsWith(permission.slice(0, -1))) return true;
+    }
+    return false;
+}
 
-module.exports = __rspack_external__nestjs_common_a04939da;
+__webpack_require__.d(__webpack_exports__, {
+  x: () => (matchesPermission)
+});
 
 
 },
@@ -995,8 +615,10 @@ module.exports = __rspack_external__nestjs_core_d7b00a1a;
 };
 import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
-import * as __rspack_chunk_1 from './index.js';
+import * as __rspack_chunk_1 from '../948.js';
 __webpack_require__.C(__rspack_chunk_1);
+import * as __rspack_chunk_2 from './index.js';
+__webpack_require__.C(__rspack_chunk_2);
 var __webpack_exports__ = __webpack_exec__(510);var __webpack_exports__JwtAuthGuard = __webpack_exports__.TD;
 var __webpack_exports__OptionalJwtGuard = __webpack_exports__.Zb;
 var __webpack_exports__PermissionGuard = __webpack_exports__.LQ;