@flusys/nestjs-shared 8.1.5 → 9.1.0-rc.1

package/fesm/pipes/index.js

@@ -0,0 +1,196 @@
+import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
+import * as __rspack_external_class_validator_7b99ef4d from "class-validator";
+export const __rspack_esm_id = 360;
+export const __rspack_esm_ids = [360];
+export const __webpack_modules__ = {
+389(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+// ==================== AUTH (Shared across guards/interceptors) ====================
+// These are duplicated in nestjs-auth but needed here to avoid circular dependencies
+const AUTH_MESSAGES = {
+    TOKEN_REQUIRED: 'auth.token.required',
+    TOKEN_INVALID: 'auth.token.invalid',
+    ENTITY_BELOG_ANOTHER_COMPANY: 'entity.belongs.another.company',
+    COMPANY_NO_ACCESS: 'auth.company.no.access'
+};
+// ==================== ERROR (HTTP Exceptions) ====================
+const ERROR_MESSAGES = {
+    NOT_FOUND: 'error.not.found',
+    VALIDATION: 'error.validation',
+    UNAUTHORIZED: 'error.unauthorized',
+    FORBIDDEN: 'error.forbidden',
+    CONFLICT: 'error.conflict',
+    DB_FOREIGN_KEY: 'error.db.foreign.key',
+    DB_NOT_NULL: 'error.db.not.null',
+    DB_INVALID_INPUT: 'error.db.invalid.input',
+    DB_VALUE_TOO_LONG: 'error.db.value.too.long',
+    DB_CHECK_CONSTRAINT: 'error.db.check.constraint',
+    DB_DEADLOCK: 'error.db.deadlock',
+    INTERNAL: 'error.internal',
+    SERVICE_UNAVAILABLE: 'error.service.unavailable',
+    UNKNOWN: 'error.unknown',
+    HTTP: 'error.http',
+    GENERIC: 'error.generic',
+    PERMISSION_SYSTEM_UNAVAILABLE: 'error.permission.system.unavailable',
+    INSUFFICIENT_PERMISSIONS: 'error.insufficient.permissions',
+    INSUFFICIENT_PERMISSIONS_OR: 'error.insufficient.permissions.or',
+    NO_PERMISSIONS_FOUND: 'error.no.permissions.found',
+    ENDPOINT_DISABLED: 'error.endpoint.disabled'
+};
+// ==================== SYSTEM (Infrastructure) ====================
+const SYSTEM_MESSAGES = {
+    REPOSITORY_NOT_AVAILABLE: 'system.repository.not.available',
+    DATASOURCE_NOT_AVAILABLE: 'system.datasource.not.available',
+    DATABASE_CONFIG_NOT_AVAILABLE: 'system.database.config.not.available',
+    SERVICE_NOT_AVAILABLE: 'system.service.not.available',
+    CONFIG_REQUIRED: 'system.config.required',
+    INTERNAL_ERROR: 'system.internal.error',
+    DUPLICATE_REQUEST: 'system.duplicate.request',
+    INVALID_TENANT_ID: 'system.invalid.tenant.id',
+    TENANT_NOT_FOUND: 'system.tenant.not.found',
+    TENANT_HEADER_REQUIRED: 'system.tenant.header.required',
+    MISSING_PARAMETER: 'system.missing.parameter',
+    SDK_NOT_INSTALLED: 'system.sdk.not.installed',
+    PATH_TRAVERSAL_DETECTED: 'system.path.traversal.detected',
+    INVALID_FILE_KEY: 'system.invalid.file.key'
+};
+
+__webpack_require__.d(__webpack_exports__, {
+}, {
+  UU: ERROR_MESSAGES,
+  hg: SYSTEM_MESSAGES,
+  mK: AUTH_MESSAGES
+});
+
+
+},
+928(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  gG: () => (/* reexport */ AUDIT_BODY_KEYS),
+  d0: () => (/* reexport */ DEFAULT_VALIDATION_OPTIONS),
+  zT: () => (/* reexport */ DtoBodyValidationPipe)
+});
+
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+// EXTERNAL MODULE: external "class-validator"
+var external_class_validator_ = __webpack_require__(421);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
+var message_keys = __webpack_require__(389);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/pipes/dto-body-validation.pipe.ts
+
+
+
+const DEFAULT_VALIDATION_OPTIONS = {
+    transform: true,
+    whitelist: true,
+    forbidNonWhitelisted: true,
+    transformOptions: {
+        enableImplicitConversion: false
+    }
+};
+const AUDIT_BODY_KEYS = [
+    'createdById',
+    'updatedById',
+    'deletedById'
+];
+/**
+ * Validates a generic controller body against its concrete DTO class: a generic
+ * `@Body() dto: T` reflects as `Object`, so the global ValidationPipe skips it.
+ * Audit keys are never taken from the client: `stampedKeys` (written by the endpoint's
+ * SetCreatedByOnBody / SetUpdateByOnBody interceptors, which run first) are kept, any other
+ * audit key is dropped. A `slug` the DTO does not declare is the Slug interceptor's and is kept.
+ */ class DtoBodyValidationPipe {
+    resolveDto;
+    stampedKeys;
+    isArray;
+    options;
+    pipes = new Map();
+    constructor(resolveDto, stampedKeys, isArray = false, options = DEFAULT_VALIDATION_OPTIONS){
+        this.resolveDto = resolveDto;
+        this.stampedKeys = stampedKeys;
+        this.isArray = isArray;
+        this.options = options;
+    }
+    static for(dto, stampedKeys, isArray = false) {
+        return new DtoBodyValidationPipe(()=>dto, stampedKeys, isArray);
+    }
+    async transform(value, metadata) {
+        if (!this.isArray) return this.validateItem(value, metadata);
+        if (!Array.isArray(value)) throw new common_.BadRequestException({
+            message: 'Request body must be an array',
+            messageKey: message_keys/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+        });
+        return Promise.all(value.map((item)=>this.validateItem(item, metadata)));
+    }
+    async validateItem(item, metadata) {
+        if (item === null || typeof item !== 'object' || Array.isArray(item)) {
+            throw new common_.BadRequestException({
+                message: 'Request body item must be an object',
+                messageKey: message_keys/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+            });
+        }
+        const dto = this.resolveDto(item);
+        const rest = {
+            ...item
+        };
+        const injected = {};
+        for (const key of AUDIT_BODY_KEYS){
+            if (!(key in rest)) continue;
+            if (this.stampedKeys.includes(key)) injected[key] = rest[key];
+            delete rest[key];
+        }
+        if ('slug' in rest && !declaresProperty(dto, 'slug')) {
+            injected['slug'] = rest['slug'];
+            delete rest['slug'];
+        }
+        const validated = await this.pipeFor(dto).transform(rest, {
+            ...metadata,
+            metatype: dto
+        });
+        return Object.assign(validated, injected);
+    }
+    pipeFor(dto) {
+        let pipe = this.pipes.get(dto);
+        if (!pipe) {
+            pipe = new common_.ValidationPipe({
+                ...this.options,
+                expectedType: dto
+            });
+            this.pipes.set(dto, pipe);
+        }
+        return pipe;
+    }
+}
+function declaresProperty(dto, key) {
+    return (0,external_class_validator_.getMetadataStorage)().getTargetValidationMetadatas(dto, '', true, false).some((m)=>m.propertyName === key);
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/pipes/index.ts
+
+
+
+},
+157(module) {
+
+module.exports = __rspack_external__nestjs_common_a04939da;
+
+
+},
+421(module) {
+
+module.exports = __rspack_external_class_validator_7b99ef4d;
+
+
+},
+
+};
+import { __webpack_require__ } from '../runtime.js';
+var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
+import * as __rspack_chunk_1 from './index.js';
+__webpack_require__.C(__rspack_chunk_1);
+var __webpack_exports__ = __webpack_exec__(928);var __webpack_exports__AUDIT_BODY_KEYS = __webpack_exports__.gG;
+var __webpack_exports__DEFAULT_VALIDATION_OPTIONS = __webpack_exports__.d0;
+var __webpack_exports__DtoBodyValidationPipe = __webpack_exports__.zT;
+export { __webpack_exports__AUDIT_BODY_KEYS as AUDIT_BODY_KEYS, __webpack_exports__DEFAULT_VALIDATION_OPTIONS as DEFAULT_VALIDATION_OPTIONS, __webpack_exports__DtoBodyValidationPipe as DtoBodyValidationPipe };

package/fesm/utils/index.js

@@ -35,7 +35,10 @@ const DEFAULT_EVENT_SERVICE_NAME = 'flusys';
 __webpack_require__.d(__webpack_exports__, {
   BC: () => (/* reexport safe */ _permissions_js__rspack_import_0.BC),
   Bz: () => (/* reexport safe */ _permissions_js__rspack_import_0.Bz),
+  DP: () => (/* reexport safe */ _permissions_js__rspack_import_0.DP),
   Em: () => (/* reexport safe */ _permissions_js__rspack_import_0.Em),
+  G0: () => (/* reexport safe */ _permissions_js__rspack_import_0.G0),
+  GH: () => (/* reexport safe */ _permissions_js__rspack_import_0.GH),
   GT: () => (/* reexport safe */ _permissions_js__rspack_import_0.GT),
   Jj: () => (/* reexport safe */ _permissions_js__rspack_import_0.Jj),
   N3: () => (/* reexport safe */ _permissions_js__rspack_import_0.N3),
@@ -54,8 +57,11 @@ __webpack_require__.d(__webpack_exports__, {
   Y7: () => (/* reexport safe */ _permissions_js__rspack_import_0.Y7),
   _X: () => (/* reexport safe */ _permissions_js__rspack_import_0._X),
   aO: () => (/* reexport safe */ _permissions_js__rspack_import_0.aO),
+  aT: () => (/* reexport safe */ _permissions_js__rspack_import_0.aT),
   fS: () => (/* reexport safe */ _permissions_js__rspack_import_0.fS),
   hg: () => (/* reexport safe */ _message_keys_js__rspack_import_1.hg),
+  kA: () => (/* reexport safe */ _permissions_js__rspack_import_0.kA),
+  kd: () => (/* reexport safe */ _permissions_js__rspack_import_0.kd),
   l3: () => (/* reexport safe */ _permissions_js__rspack_import_0.l3),
   mK: () => (/* reexport safe */ _message_keys_js__rspack_import_1.mK),
   mV: () => (/* reexport safe */ _permissions_js__rspack_import_0.mV),
@@ -250,6 +256,35 @@ const FORM_RESULT_PERMISSIONS = {
     UPDATE: 'form-result.update',
     DELETE: 'form-result.delete'
 };
+// ==================== ENTITY BUILDER MODULE ====================
+// Static metadata permissions only. Per-dynamic-entity record permissions
+// (`entity_builder.entity.<entityCode>.<action>`) are checked by flows running as the caller;
+// ENTITY_BUILDER_ALL_DYNAMIC is the wildcard that grants all of them (and nothing else).
+const ENTITY_DEFINITION_PERMISSIONS = {
+    CREATE: 'entity_builder.entity_definition.create',
+    READ: 'entity_builder.entity_definition.read',
+    UPDATE: 'entity_builder.entity_definition.update',
+    DELETE: 'entity_builder.entity_definition.delete'
+};
+const FIELD_DEFINITION_PERMISSIONS = {
+    READ: 'entity_builder.field_definition.read',
+    UPDATE: 'entity_builder.field_definition.update'
+};
+const FLOW_DEFINITION_PERMISSIONS = {
+    CREATE: 'entity_builder.flow_definition.create',
+    READ: 'entity_builder.flow_definition.read',
+    UPDATE: 'entity_builder.flow_definition.update',
+    DELETE: 'entity_builder.flow_definition.delete',
+    TEST: 'entity_builder.flow_definition.test',
+    /** Needed to save a flow that runs as the system (bypassing per-entity permissions). */ SYSTEM: 'entity_builder.flow_definition.system',
+    /** Needed to save a flow containing a code node (sandboxed JavaScript). */ CODE: 'entity_builder.flow_definition.code'
+};
+const ENTITY_BUILDER_DYNAMIC_PREFIX = 'entity_builder.entity';
+const ENTITY_BUILDER_ALL_DYNAMIC = {
+    ALL: `${ENTITY_BUILDER_DYNAMIC_PREFIX}.*`
+};
+const dynamicEntityPermissionParent = (entityCode)=>`${ENTITY_BUILDER_DYNAMIC_PREFIX}.${entityCode}`;
+const dynamicEntityPermission = (entityCode, action)=>`${dynamicEntityPermissionParent(entityCode)}.${action}`;
 // ==================== EVENT MANAGER MODULE ====================
 const EVENT_PERMISSIONS = {
     CREATE: 'event.create',
@@ -344,6 +379,11 @@ const PERMISSIONS = {
     // Form Builder
     FORM: FORM_PERMISSIONS,
     FORM_RESULT: FORM_RESULT_PERMISSIONS,
+    // Entity Builder
+    ENTITY_DEFINITION: ENTITY_DEFINITION_PERMISSIONS,
+    FIELD_DEFINITION: FIELD_DEFINITION_PERMISSIONS,
+    FLOW_DEFINITION: FLOW_DEFINITION_PERMISSIONS,
+    ENTITY_BUILDER_ALL_DYNAMIC: ENTITY_BUILDER_ALL_DYNAMIC,
     // Event Manager
     EVENT: EVENT_PERMISSIONS,
     // Notification
@@ -366,7 +406,10 @@ __webpack_require__.d(__webpack_exports__, {
 }, {
   BC: USER_PERMISSIONS,
   Bz: AI_ASSISTANT_PERMISSIONS,
+  DP: ENTITY_DEFINITION_PERMISSIONS,
   Em: STORAGE_CONFIG_PERMISSIONS,
+  G0: ENTITY_BUILDER_ALL_DYNAMIC,
+  GH: dynamicEntityPermissionParent,
   GT: FORM_RESULT_PERMISSIONS,
   Jj: PERMISSIONS,
   N3: TRANSLATION_KEY_PERMISSIONS,
@@ -384,7 +427,10 @@ __webpack_require__.d(__webpack_exports__, {
   Y7: ACTION_PERMISSIONS,
   _X: USER_ACTION_PERMISSIONS,
   aO: COMPANY_ACTION_PERMISSIONS,
+  aT: dynamicEntityPermission,
   fS: TRANSLATION_PERMISSIONS,
+  kA: FIELD_DEFINITION_PERMISSIONS,
+  kd: FLOW_DEFINITION_PERMISSIONS,
   l3: SOCIAL_AUTH_CONFIG_PERMISSIONS,
   mV: ROLE_PERMISSIONS,
   rH: NOTIFICATION_PERMISSIONS,
@@ -397,6 +443,21 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+154(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * The tenant a cache key belongs to: the provider's current tenant in multi-tenant mode, else
+ * undefined. A single database never prefixes, so a stray tenant header cannot split its cache.
+ */ function cacheTenantId(provider) {
+    if (!provider?.isMultiTenant?.()) return undefined;
+    return provider.getCurrentTenantId?.() ?? undefined;
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  q: () => (cacheTenantId)
+});
+
+
 },
 456(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 const SENSITIVE_KEYS = [
@@ -499,7 +560,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-712(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+528(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -510,6 +571,7 @@ __webpack_require__.d(__webpack_exports__, {
   fJ: () => (/* reexport */ buildCookieOptions),
   oV: () => (/* reexport */ buildFrontendUrl),
   nt: () => (/* reexport */ permission_cache_key_util/* .buildPermissionCacheKey */.nt),
+  qW: () => (/* reexport */ cache_tenant_util/* .cacheTenantId */.q),
   ZD: () => (/* reexport */ escapeHtml),
   qo: () => (/* reexport */ escapeHtmlVariables),
   hX: () => (/* reexport */ extractFrontendUrl),
@@ -526,12 +588,17 @@ __webpack_require__.d(__webpack_exports__, {
   lk: () => (/* reexport */ optional_module_util/* .loadOptionalModule */.l),
   vf: () => (/* reexport */ localToUtc),
   qe: () => (/* reexport */ event_pattern_util/* .matchEventPattern */.qe),
+  xY: () => (/* reexport */ permission_match_util/* .matchesPermission */.x),
+  RG: () => (/* reexport */ messageRef),
   Ju: () => (/* reexport */ parseDurationToMs),
   IN: () => (/* reexport */ event_pattern_util/* .sanitizeEventPayload */.IN),
   v4: () => (/* reexport */ utcToLocal),
-  bE: () => (/* reexport */ validateCompanyOwnership)
+  bE: () => (/* reexport */ validateCompanyOwnership),
+  o0: () => (/* reexport */ withSavepoint)
 });
 
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/cache-tenant.util.ts
+var cache_tenant_util = __webpack_require__(154);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/date-time.util.ts
 function getOffsetMinutes(utcDate, timezone) {
     const extract = (tz)=>{
@@ -677,14 +744,26 @@ var event_pattern_util = __webpack_require__(456);
     return escaped;
 }
 
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/message-ref.util.ts
+function messageRef(messageKey, messageVariables) {
+    return messageVariables ? {
+        messageKey,
+        messageVariables
+    } : {
+        messageKey
+    };
+}
+
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/optional-module.util.ts
 var optional_module_util = __webpack_require__(368);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-cache-key.util.ts
 var permission_cache_key_util = __webpack_require__(199);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/permission-match.util.ts
+var permission_match_util = __webpack_require__(788);
 // EXTERNAL MODULE: external "@nestjs/common"
 var common_ = __webpack_require__(157);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
-var message_keys = __webpack_require__(389);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
+var constants = __webpack_require__(43);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/query-helpers.util.ts
 
 
@@ -763,7 +842,7 @@ var message_keys = __webpack_require__(389);
         if (entity.companyId && entity.companyId !== user.companyId) {
             throw new common_.BadRequestException({
                 message: `${entityName} belongs to another company`,
-                messageKey: message_keys/* .AUTH_MESSAGES.ENTITY_BELOG_ANOTHER_COMPANY */.mK.ENTITY_BELOG_ANOTHER_COMPANY,
+                messageKey: constants/* .AUTH_MESSAGES.ENTITY_BELOG_ANOTHER_COMPANY */.mK.ENTITY_BELOG_ANOTHER_COMPANY,
                 messageVariables: {
                     entity: entityName
                 }
@@ -771,11 +850,24 @@ var message_keys = __webpack_require__(389);
         }
     }
 }
+/**
+ * Runs `fn` inside a savepoint of an already-open transaction. A failure rolls back only what
+ * `fn` did, so the caller can swallow the error and keep using the transaction - without it,
+ * PostgreSQL aborts the whole transaction after any failed statement.
+ */ async function withSavepoint(queryRunner, fn) {
+    await queryRunner.startTransaction();
+    try {
+        const result = await fn();
+        await queryRunner.commitTransaction();
+        return result;
+    } catch (error) {
+        await queryRunner.rollbackTransaction();
+        throw error;
+    }
+}
 
 // EXTERNAL MODULE: external "@flusys/nestjs-core/config"
 var config_ = __webpack_require__(307);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
-var constants = __webpack_require__(43);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/utils/request.util.ts
 
 
@@ -856,7 +948,7 @@ var constants = __webpack_require__(43);
     }
     throw new common_.BadRequestException({
         message: 'Unable to determine frontend URL from request',
-        messageKey: message_keys/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+        messageKey: constants/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
     });
 }
 function buildFrontendUrl(req, path) {
@@ -963,6 +1055,9 @@ function isExpired(expiresAt) {
 
 
 
+
+
+
 },
 368(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
@@ -1018,6 +1113,22 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
+},
+788(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/** Whether `granted` covers `required`, honoring `*` (everything) and `prefix.*` (everything under prefix) wildcards */ function matchesPermission(granted, required) {
+    if (granted.includes(required)) return true;
+    for (const permission of granted){
+        if (permission === '*') return true;
+        if (permission.endsWith('.*') && required.startsWith(permission.slice(0, -1))) return true;
+    }
+    return false;
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  x: () => (matchesPermission)
+});
+
+
 },
 307(module) {
 
@@ -1043,13 +1154,14 @@ import { __webpack_require__ } from '../runtime.js';
 var __webpack_exec__ = function(moduleId) { return __webpack_require__(__webpack_require__.s = moduleId); }
 import * as __rspack_chunk_1 from './index.js';
 __webpack_require__.C(__rspack_chunk_1);
-var __webpack_exports__ = __webpack_exec__(712);var __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = __webpack_exports__.s8;
+var __webpack_exports__ = __webpack_exec__(528);var __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT = __webpack_exports__.s8;
 var __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT = __webpack_exports__.q6;
 var __webpack_exports__applyCompanyFilter = __webpack_exports__.wf;
 var __webpack_exports__buildCompanyWhereCondition = __webpack_exports__.kQ;
 var __webpack_exports__buildCookieOptions = __webpack_exports__.fJ;
 var __webpack_exports__buildFrontendUrl = __webpack_exports__.oV;
 var __webpack_exports__buildPermissionCacheKey = __webpack_exports__.nt;
+var __webpack_exports__cacheTenantId = __webpack_exports__.qW;
 var __webpack_exports__escapeHtml = __webpack_exports__.ZD;
 var __webpack_exports__escapeHtmlVariables = __webpack_exports__.qo;
 var __webpack_exports__extractFrontendUrl = __webpack_exports__.hX;
@@ -1066,8 +1178,11 @@ var __webpack_exports__isMultiWildcard = __webpack_exports__._c;
 var __webpack_exports__loadOptionalModule = __webpack_exports__.lk;
 var __webpack_exports__localToUtc = __webpack_exports__.vf;
 var __webpack_exports__matchEventPattern = __webpack_exports__.qe;
+var __webpack_exports__matchesPermission = __webpack_exports__.xY;
+var __webpack_exports__messageRef = __webpack_exports__.RG;
 var __webpack_exports__parseDurationToMs = __webpack_exports__.Ju;
 var __webpack_exports__sanitizeEventPayload = __webpack_exports__.IN;
 var __webpack_exports__utcToLocal = __webpack_exports__.v4;
 var __webpack_exports__validateCompanyOwnership = __webpack_exports__.bE;
-export { __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT as DEFAULT_COMPANY_PERMISSION_KEY_FORMAT, __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT as DEFAULT_USER_PERMISSION_KEY_FORMAT, __webpack_exports__applyCompanyFilter as applyCompanyFilter, __webpack_exports__buildCompanyWhereCondition as buildCompanyWhereCondition, __webpack_exports__buildCookieOptions as buildCookieOptions, __webpack_exports__buildFrontendUrl as buildFrontendUrl, __webpack_exports__buildPermissionCacheKey as buildPermissionCacheKey, __webpack_exports__escapeHtml as escapeHtml, __webpack_exports__escapeHtmlVariables as escapeHtmlVariables, __webpack_exports__extractFrontendUrl as extractFrontendUrl, __webpack_exports__formatInTimezone as formatInTimezone, __webpack_exports__generateSecureToken as generateSecureToken, __webpack_exports__generateSlug as generateSlug, __webpack_exports__generateUniqueSlug as generateUniqueSlug, __webpack_exports__getTodayInTimezone as getTodayInTimezone, __webpack_exports__hasCompanyId as hasCompanyId, __webpack_exports__hashToken as hashToken, __webpack_exports__isBrowserRequest as isBrowserRequest, __webpack_exports__isExpired as isExpired, __webpack_exports__isMultiWildcard as isMultiWildcard, __webpack_exports__loadOptionalModule as loadOptionalModule, __webpack_exports__localToUtc as localToUtc, __webpack_exports__matchEventPattern as matchEventPattern, __webpack_exports__parseDurationToMs as parseDurationToMs, __webpack_exports__sanitizeEventPayload as sanitizeEventPayload, __webpack_exports__utcToLocal as utcToLocal, __webpack_exports__validateCompanyOwnership as validateCompanyOwnership };
+var __webpack_exports__withSavepoint = __webpack_exports__.o0;
+export { __webpack_exports__DEFAULT_COMPANY_PERMISSION_KEY_FORMAT as DEFAULT_COMPANY_PERMISSION_KEY_FORMAT, __webpack_exports__DEFAULT_USER_PERMISSION_KEY_FORMAT as DEFAULT_USER_PERMISSION_KEY_FORMAT, __webpack_exports__applyCompanyFilter as applyCompanyFilter, __webpack_exports__buildCompanyWhereCondition as buildCompanyWhereCondition, __webpack_exports__buildCookieOptions as buildCookieOptions, __webpack_exports__buildFrontendUrl as buildFrontendUrl, __webpack_exports__buildPermissionCacheKey as buildPermissionCacheKey, __webpack_exports__cacheTenantId as cacheTenantId, __webpack_exports__escapeHtml as escapeHtml, __webpack_exports__escapeHtmlVariables as escapeHtmlVariables, __webpack_exports__extractFrontendUrl as extractFrontendUrl, __webpack_exports__formatInTimezone as formatInTimezone, __webpack_exports__generateSecureToken as generateSecureToken, __webpack_exports__generateSlug as generateSlug, __webpack_exports__generateUniqueSlug as generateUniqueSlug, __webpack_exports__getTodayInTimezone as getTodayInTimezone, __webpack_exports__hasCompanyId as hasCompanyId, __webpack_exports__hashToken as hashToken, __webpack_exports__isBrowserRequest as isBrowserRequest, __webpack_exports__isExpired as isExpired, __webpack_exports__isMultiWildcard as isMultiWildcard, __webpack_exports__loadOptionalModule as loadOptionalModule, __webpack_exports__localToUtc as localToUtc, __webpack_exports__matchEventPattern as matchEventPattern, __webpack_exports__matchesPermission as matchesPermission, __webpack_exports__messageRef as messageRef, __webpack_exports__parseDurationToMs as parseDurationToMs, __webpack_exports__sanitizeEventPayload as sanitizeEventPayload, __webpack_exports__utcToLocal as utcToLocal, __webpack_exports__validateCompanyOwnership as validateCompanyOwnership, __webpack_exports__withSavepoint as withSavepoint };

package/index.d.ts

@@ -12,3 +12,4 @@ export * from './interfaces/index.js';
 export * from './middlewares/index.js';
 export * from './modules/index.js';
 export * from './utils/index.js';
+export * from './pipes/index.js';

package/interfaces/datasource.interface.d.ts

@@ -2,4 +2,6 @@ import { DataSource, type EntityTarget, type ObjectLiteral, Repository } from 't
 export interface IDataSourceProvider {
     getRepository<T extends ObjectLiteral>(entity: EntityTarget<T>): Promise<Repository<T>>;
     getDataSource(): Promise<DataSource>;
+    isMultiTenant?(): boolean;
+    getCurrentTenantId?(): string | null;
 }

package/interfaces/index.d.ts

@@ -5,7 +5,10 @@ export * from './event-bus.interface.js';
 export * from './event-manager-adapter.interface.js';
 export * from './identity.interface.js';
 export * from './logged-user-info.interface.js';
+export * from './message-ref.interface.js';
 export * from './module-config.interface.js';
 export * from './notification-adapter.interface.js';
+export * from './permission-action-registry.interface.js';
+export * from './permission-resolver.interface.js';
 export * from './permission.interface.js';
 export * from './permission-sync-adapter.interface.js';

package/interfaces/message-ref.interface.d.ts

@@ -0,0 +1,4 @@
+export interface IMessageRef {
+    messageKey: string;
+    messageVariables?: Record<string, unknown>;
+}

package/interfaces/permission-action-registry.interface.d.ts

@@ -0,0 +1,12 @@
+export declare const PERMISSION_ACTION_REGISTRY = "PERMISSION_ACTION_REGISTRY";
+export interface IPermissionActionInput {
+    code: string;
+    name: string;
+    description?: string | null;
+    parentCode?: string | null;
+    actionType?: 'BACKEND' | 'FRONTEND' | 'BOTH';
+}
+export interface IPermissionActionRegistry {
+    registerActions(actions: IPermissionActionInput[]): Promise<void>;
+    removeActionsByCodes(codes: string[]): Promise<void>;
+}

package/interfaces/permission-resolver.interface.d.ts

@@ -0,0 +1,9 @@
+export declare const PERMISSION_RESOLVER = "PERMISSION_RESOLVER";
+export interface IPermissionScope {
+    userId: string;
+    companyId?: string | null;
+    branchId?: string | null;
+}
+export interface IPermissionResolver {
+    getPermissionCodes(scope: IPermissionScope): Promise<string[]>;
+}

package/middlewares/logger.middleware.d.ts

@@ -13,6 +13,10 @@ export declare const getRequestId: () => string | undefined;
 export declare const getTenantId: () => string | undefined;
 export declare const getUserId: () => string | undefined;
 export declare const getCompanyId: () => string | undefined;
+export declare function setRequestUser(user: {
+    id?: string;
+    companyId?: string;
+} | undefined): void;
 export declare class LoggerMiddleware implements NestMiddleware {
     private readonly logger;
     use(req: Request, res: Response, next: NextFunction): void;

package/modules/shared-permission-cache/shared-permission-cache.service.d.ts

@@ -9,6 +9,11 @@ export declare class SharedPermissionCacheService {
     setPermissions(options: PermissionCacheKeyOptions, permissions: string[], ttl?: number): Promise<void>;
     clearPermissions(options: PermissionCacheKeyOptions): Promise<void>;
     hasPermission(options: PermissionCacheKeyOptions, requiredPermission: string): Promise<boolean>;
+    assertPermission(user: {
+        id?: string | null;
+        companyId?: string | null;
+        branchId?: string | null;
+    } | null | undefined, requiredPermission: string): Promise<void>;
     isCacheConfigured(): boolean;
     matchPermission(userPermissions: string[], requiredPermission: string): boolean;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flusys/nestjs-shared",
-  "version": "8.1.5",
+  "version": "9.1.0-rc.1",
   "description": "Common shared utilities for Flusys NestJS applications",
   "type": "module",
   "main": "./fesm/index.js",
@@ -69,6 +69,10 @@
       "types": "./modules/index.d.ts",
       "import": "./fesm/modules/index.js"
     },
+    "./pipes": {
+      "types": "./pipes/index.d.ts",
+      "import": "./fesm/pipes/index.js"
+    },
     "./utils": {
       "types": "./utils/index.d.ts",
       "import": "./fesm/utils/index.js"
@@ -92,12 +96,14 @@
     "class-validator": "^0.15.0",
     "keyv": "^5.0.0",
     "typeorm": "^0.3.0",
+    "typeorm-naming-strategies": "^4.1.0",
     "winston": "^3.0.0",
+    "winston-transport": "^4.9.0",
     "winston-daily-rotate-file": "^5.0.0",
     "express": "^5.0.0",
     "rxjs": "^7.8.0"
   },
   "dependencies": {
-    "@flusys/nestjs-core": "8.1.5"
+    "@flusys/nestjs-core": "9.1.0-rc.1"
   }
 }

package/pipes/dto-body-validation.pipe.d.ts

@@ -0,0 +1,18 @@
+import { type ArgumentMetadata, type PipeTransform, type Type, type ValidationPipeOptions } from '@nestjs/common';
+export declare const DEFAULT_VALIDATION_OPTIONS: ValidationPipeOptions;
+export declare const AUDIT_BODY_KEYS: readonly ["createdById", "updatedById", "deletedById"];
+export type AuditBodyKey = (typeof AUDIT_BODY_KEYS)[number];
+type BodyItem = Record<string, unknown>;
+export declare class DtoBodyValidationPipe implements PipeTransform {
+    private readonly resolveDto;
+    private readonly stampedKeys;
+    private readonly isArray;
+    private readonly options;
+    private readonly pipes;
+    constructor(resolveDto: (item: BodyItem) => Type<unknown>, stampedKeys: readonly AuditBodyKey[], isArray?: boolean, options?: ValidationPipeOptions);
+    static for(dto: Type<unknown>, stampedKeys: readonly AuditBodyKey[], isArray?: boolean): DtoBodyValidationPipe;
+    transform(value: unknown, metadata: ArgumentMetadata): Promise<unknown>;
+    private validateItem;
+    private pipeFor;
+}
+export {};

package/pipes/index.d.ts

@@ -0,0 +1 @@
+export * from './dto-body-validation.pipe.js';

package/utils/cache-tenant.util.d.ts

@@ -0,0 +1,2 @@
+import { type IDataSourceProvider } from '../interfaces/datasource.interface.js';
+export declare function cacheTenantId(provider: Pick<IDataSourceProvider, 'isMultiTenant' | 'getCurrentTenantId'> | null | undefined): string | undefined;

package/utils/index.d.ts

@@ -1,8 +1,11 @@
+export * from './cache-tenant.util.js';
 export * from './date-time.util.js';
 export * from './event-pattern.util.js';
 export * from './html-sanitizer.util.js';
+export * from './message-ref.util.js';
 export * from './optional-module.util.js';
 export * from './permission-cache-key.util.js';
+export * from './permission-match.util.js';
 export * from './query-helpers.util.js';
 export * from './request.util.js';
 export * from './string.util.js';

package/utils/message-ref.util.d.ts

@@ -0,0 +1,2 @@
+import { type IMessageRef } from '../interfaces/message-ref.interface.js';
+export declare function messageRef(messageKey: string, messageVariables?: Record<string, unknown>): IMessageRef;

package/utils/permission-match.util.d.ts

@@ -0,0 +1 @@
+export declare function matchesPermission(granted: readonly string[], required: string): boolean;

package/utils/query-helpers.util.d.ts

@@ -1,4 +1,4 @@
-import { type ObjectLiteral, SelectQueryBuilder } from 'typeorm';
+import { type ObjectLiteral, type QueryRunner, SelectQueryBuilder } from 'typeorm';
 import { type ILoggedUserInfo } from '../interfaces/index.js';
 export interface ICompanyFilterConfig {
     isCompanyFeatureEnabled: boolean;
@@ -14,3 +14,4 @@ export interface ICompanyEnabled {
 }
 export declare function hasCompanyId<T>(entity: T): entity is T & ICompanyEnabled;
 export declare function validateCompanyOwnership<T>(entity: T, user: ILoggedUserInfo | null | undefined, isCompanyFeatureEnabled: boolean, entityName: string): void;
+export declare function withSavepoint<T>(queryRunner: QueryRunner, fn: () => Promise<T>): Promise<T>;