@flusys/ng-iam 1.1.1-beta → 1.2.0-rc.1

package/types/flusys-ng-iam.d.ts

@@ -1,9 +1,10 @@
-import { IBaseEntity, ILogicNode, ApiResourceService, ISingleResponse, IProfilePermissionProvider, IProfileRoleInfo, IProfileActionInfo } from '@flusys/ng-shared';
+import { IBaseEntity, ILogicNode, ApiResourceService, ISingleResponse, TranslateService, IProfilePermissionProvider, IProfileRoleInfo, IProfileActionInfo } from '@flusys/ng-shared';
 import * as _angular_core from '@angular/core';
-import { Signal, OnDestroy, Provider } from '@angular/core';
+import { Provider } from '@angular/core';
 import { Observable } from 'rxjs';
 import { BaseApiService } from '@flusys/ng-core';
-import * as primeng_api from 'primeng/api';
+export { PermissionMode } from '@flusys/ng-core';
+import * as __________flusys_ng_ui_types_flusys_ng_ui from '../../@flusys/ng-ui/types/flusys-ng-ui';
 import { Routes } from '@angular/router';
 
 /**
@@ -35,10 +36,6 @@ interface IBranch {
     companyId: string;
 }
 
-/**
- * Role Response DTO
- * Matches backend RoleResponseDto
- */
 interface IRole extends IBaseEntity {
     readOnly: boolean;
     name: string;
@@ -46,49 +43,28 @@ interface IRole extends IBaseEntity {
     companyId: string | null;
     isActive: boolean;
     serial: number | null;
-    metadata: Record<string, any> | null;
 }
-/**
- * Create Role DTO
- * Matches backend CreateRoleDto
- */
 interface ICreateRoleDto {
     name: string;
     description?: string;
     companyId?: string;
     isActive?: boolean;
     serial?: number;
-    metadata?: Record<string, any>;
 }
-/**
- * Update Role DTO
- * Matches backend UpdateRoleDto
- */
 interface IUpdateRoleDto extends Partial<ICreateRoleDto> {
     id: string;
 }
-/**
- * Role Query DTO
- * Matches backend RoleQueryDto
- */
 interface IRoleQueryDto {
     companyId?: string;
     isActive?: boolean;
 }
 
-/**
- * Action Type - determines how action is used
- * CRITICAL: Must match backend ActionType enum exactly
- */
+/** Must match backend ActionType enum */
 declare enum ActionType {
-    BACKEND = "backend",// For API endpoint permissions (cached for PermissionGuard)
-    FRONTEND = "frontend",// For frontend features (returned in my-permissions API)
+    BACKEND = "backend",
+    FRONTEND = "frontend",
     BOTH = "both"
 }
-/**
- * Action Response DTO
- * Matches backend ActionResponseDto
- */
 interface IAction extends IBaseEntity {
     readOnly: boolean;
     name: string;
@@ -99,19 +75,10 @@ interface IAction extends IBaseEntity {
     parentId: string | null;
     serial: number | null;
     isActive: boolean;
-    metadata: Record<string, any> | null;
 }
-/**
- * Action Tree DTO
- * Hierarchical action structure
- */
 interface IActionTreeDto extends IAction {
     children: IActionTreeDto[];
 }
-/**
- * Create Action DTO
- * Matches backend CreateActionDto
- */
 interface ICreateActionDto {
     name: string;
     description?: string;
@@ -121,82 +88,36 @@ interface ICreateActionDto {
     parentId?: string;
     serial?: number;
     isActive?: boolean;
-    metadata?: Record<string, any>;
 }
-/**
- * Update Action DTO
- * Matches backend UpdateActionDto
- */
 interface IUpdateActionDto extends Partial<ICreateActionDto> {
     id: string;
 }
 
-/**
- * Permission Action - 'add' or 'remove'
- */
 type PermissionAction = 'add' | 'remove';
-/**
- * Permission Mode - matches backend IAMPermissionMode
- */
-type PermissionMode = 'rbac' | 'direct' | 'full';
-/**
- * Permission Item DTO
- * Used in all assignment operations
- */
 interface IPermissionItemDto {
     id: string;
     action: PermissionAction;
 }
-/**
- * Assign User Actions DTO
- * Assign/remove actions directly to/from user (DIRECT/FULL mode)
- *
- * Permission Granularity:
- * - companyId + branchId = undefined: Global (super admin)
- * - companyId set + branchId = undefined: Company-wide (all branches)
- * - companyId set + branchId set: Branch-specific
- */
 interface IAssignUserActionsDto {
     userId: string;
     companyId?: string;
     branchId?: string;
     items: IPermissionItemDto[];
 }
-/**
- * Assign Company Actions DTO
- * Whitelist actions for company (if company feature enabled)
- */
 interface IAssignCompanyActionsDto {
     companyId: string;
     items: IPermissionItemDto[];
 }
-/**
- * Assign Role Actions DTO
- * Assign/remove actions to/from role (RBAC/FULL mode)
- */
 interface IAssignRoleActionsDto {
     roleId: string;
     items: IPermissionItemDto[];
 }
-/**
- * Assign User Roles DTO
- * Assign/remove roles to/from user (RBAC/FULL mode)
- *
- * Permission Granularity:
- * - companyId + branchId = undefined: Global (super admin)
- * - companyId set + branchId = undefined: Company-wide (all branches)
- * - companyId set + branchId set: Branch-specific
- */
 interface IAssignUserRolesDto {
     userId: string;
     companyId?: string;
     branchId?: string;
     items: IPermissionItemDto[];
 }
-/**
- * User Action Response DTO
- * Direct user → action permissions (branch-scoped if company feature enabled)
- */
 interface IUserActionResponseDto {
     id: string;
     userId: string;
@@ -206,10 +127,6 @@ interface IUserActionResponseDto {
     branchId: string | null;
     createdAt: Date;
 }
-/**
- * Role Action Response DTO
- * Role → action permissions (NOT branch-scoped)
- */
 interface IRoleActionResponseDto {
     id: string;
     roleId: string;
@@ -218,10 +135,6 @@ interface IRoleActionResponseDto {
     actionName: string;
     createdAt: Date;
 }
-/**
- * Company Action Response DTO
- * Company → action whitelist
- */
 interface ICompanyActionResponseDto {
     id: string;
     companyId: string;
@@ -230,37 +143,14 @@ interface ICompanyActionResponseDto {
     actionName: string;
     createdAt: Date;
 }
-/**
- * User Role Response DTO
- * User → role assignments (NOT branch-scoped)
- */
 interface IUserRoleResponseDto {
     id: string;
     userId: string;
     roleId: string;
-    roleCode: string;
     roleName: string;
     branchId: string | null;
     createdAt: Date;
 }
-/**
- * Menu item from IAM permissions (menu-type actions)
- */
-interface IMenuAction {
-    id: string;
-    code: string;
-    name: string;
-    route: string | null;
-    icon: string | null;
-    iconType: number | null;
-    serial: number | null;
-    parentId: string | null;
-    children?: IMenuAction[];
-}
-/**
- * My Permissions Response DTO
- * Complete user permissions (frontend actions, cached endpoints, menus)
- */
 interface IMyPermissionsResponseDto {
     frontendActions: Array<{
         id: string;
@@ -270,248 +160,83 @@ interface IMyPermissionsResponseDto {
     }>;
     cachedEndpoints: number;
 }
-/**
- * Prerequisite Action DTO
- * Action required as a prerequisite
- */
 interface IPrerequisiteActionDto {
     actionId: string;
     actionCode: string;
     actionName: string;
 }
-/**
- * Prerequisite Validation Error
- * Describes an action that failed prerequisite validation
- */
 interface IPrerequisiteValidationError {
     actionId: string;
     actionCode: string;
     actionName: string;
     requiredActions: IPrerequisiteActionDto[];
 }
-/**
- * Permission Operation Result DTO
- * Result of assignment operations
- */
 interface IPermissionOperationResultDto {
     success: boolean;
     added: number;
     removed: number;
     message: string;
+    messageKey?: string;
     prerequisiteErrors?: IPrerequisiteValidationError[];
 }
-/**
- * Get User Actions DTO
- * Optional branchId filter
- */
 interface IGetUserActionsDto {
     branchId?: string;
 }
-/**
- * Get Role Actions DTO
- * No parameters
- */
 interface IGetRoleActionsDto {
 }
-/**
- * Get User Roles DTO
- * Optional branchId filter (ignored - roles are NOT branch-scoped)
- */
 interface IGetUserRolesDto {
     branchId?: string;
 }
-/**
- * Get My Permissions DTO
- * Optional parentCodes filter for frontend actions
- */
 interface IGetMyPermissionsDto {
     parentCodes?: string[];
 }
 
-/**
- * Pagination Constants
- *
- * Standard pagination limits for IAM components.
- * Prevents excessive data loading and potential DoS.
- */
-/**
- * Maximum items to fetch for dropdown lists
- * Used for: companies, roles, users, branches
- *
- * Security: Prevents memory exhaustion from loading excessive records
- */
+/** Maximum items for dropdown lists (companies, roles, users, branches) */
 declare const MAX_DROPDOWN_ITEMS = 100;
 
-/**
- * Role API Service
- * Handles role CRUD operations
- * Endpoint: POST /iam/roles/*
- * Conditional: Only available in RBAC/FULL mode
- */
+declare const IAM_MESSAGES: Record<string, string>;
+
 declare class RoleApiService extends ApiResourceService<IUpdateRoleDto, IRole> {
     constructor();
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<RoleApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<RoleApiService>;
 }
 
-/**
- * Action API Service
- * Handles action CRUD operations
- * Endpoint: POST /iam/actions/*
- */
 declare class ActionApiService extends ApiResourceService<IUpdateActionDto, IAction> {
     private readonly appConfig;
     constructor();
-    /**
-     * Get actions for permission assignment
-     * GET /iam/actions/tree-for-permission
-     * Returns actions filtered by company whitelist if enabled
-     */
+    /** Get actions filtered by company whitelist for permission assignment */
     getActionsForPermission(): Observable<ISingleResponse<IActionTreeDto[]>>;
-    /**
-     * Get actions in hierarchical tree structure
-     * POST /iam/actions/tree
-     * Returns all actions organized in parent-child tree
-     *
-     * @param search - Optional search term (name or code)
-     * @param isActive - Optional filter by active status
-     * @param withDeleted - Include deleted actions (default: false)
-     * @returns Observable of action tree response
-     */
+    /** Get actions in hierarchical tree structure */
     getTree(search?: string, isActive?: boolean, withDeleted?: boolean): Observable<ISingleResponse<IActionTreeDto[]>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<ActionApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<ActionApiService>;
 }
 
-/**
- * Action Permission Logic Service
- *
- * Shared service for handling smart dependency management across all action selectors:
- * - Company-Action Selector
- * - Role-Action Selector
- * - User-Action Selector
- *
- * **Core Features:**
- * - Smart auto-selection (AND/OR optimization)
- * - Dependency detection and management
- * - Alternative suggestion for OR logic
- * - Visual formatting of permission logic trees
- * - Prerequisite validation
- *
- * @example
- * constructor() {
- *   this.permissionLogic = inject(ActionPermissionLogicService);
- * }
- *
- * onActionToggle(action: IAction, newValue: boolean) {
- *   if (!newValue) {
- *     this.permissionLogic.handleUncheck(
- *       action,
- *       this.selectionMap(),
- *       this.actions(),
- *       (newMap) => this.selectionMap.set(newMap)
- *     );
- *   } else {
- *     this.permissionLogic.handleCheck(
- *       action,
- *       this.selectionMap(),
- *       this.actions(),
- *       (newMap) => this.selectionMap.set(newMap),
- *       (previousState) => this.selectionMap.set(previousState)
- *     );
- *   }
- * }
- */
+/** Shared service for smart dependency management across action selectors */
 declare class ActionPermissionLogicService {
     private readonly confirmationService;
     private readonly messageService;
-    /**
-     * Handle checking an action with prerequisite validation
-     *
-     * Uses recursive deep scan to find ALL missing prerequisites at all levels,
-     * not just direct dependencies. This ensures cascading dependencies are
-     * resolved in a single step.
-     *
-     * @param action - Action being checked
-     * @param currentSelection - Current selection map
-     * @param allActions - All available actions
-     * @param onUpdate - Callback to update selection
-     * @param onCancel - Callback when user cancels
-     */
+    private readonly translateAdapter;
+    private t;
+    /** Handle checking an action with prerequisite validation (recursive deep scan) */
     handleCheck(action: IAction, currentSelection: Record<string, boolean>, allActions: IAction[], onUpdate: (newSelection: Record<string, boolean>) => void, onCancel: (previousState: Record<string, boolean>) => void): void;
-    /**
-     * Handle unchecking an action with dependency detection
-     *
-     * @param action - Action being unchecked
-     * @param currentSelection - Current selection map
-     * @param allActions - All available actions
-     * @param onUpdate - Callback to update selection
-     */
+    /** Handle unchecking an action with dependency detection */
     handleUncheck(action: IAction, currentSelection: Record<string, boolean>, allActions: IAction[], onUpdate: (newSelection: Record<string, boolean>) => void): void;
-    /**
-     * Check if an action has unmet prerequisites
-     *
-     * @param action - Action to check
-     * @param currentSelection - Current selection map
-     * @param allActions - All available actions
-     * @returns True if action has unmet prerequisites
-     */
+    /** Check if an action has unmet prerequisites */
     hasUnmetPrerequisites(action: IAction, currentSelection: Record<string, boolean>, allActions: IAction[]): boolean;
-    /**
-     * Get all selected actions that have unmet prerequisites
-     *
-     * @param currentSelection - Current selection map
-     * @param allActions - All available actions
-     * @returns Array of actions with unmet prerequisites
-     */
+    /** Get all selected actions that have unmet prerequisites */
     getActionsWithUnmetPrerequisites(currentSelection: Record<string, boolean>, allActions: IAction[]): IAction[];
-    /**
-     * Show validation error dialog with auto-fix options
-     *
-     * @param invalidActions - Actions with unmet prerequisites
-     * @param currentSelection - Current selection map
-     * @param allActions - All available actions
-     * @param onUpdate - Callback to update selection
-     */
+    /** Show validation error dialog with auto-fix options */
     showValidationErrorDialog(invalidActions: IAction[], currentSelection: Record<string, boolean>, allActions: IAction[], onUpdate: (newSelection: Record<string, boolean>) => void): void;
-    /**
-     * Get prerequisite description for tooltip display
-     *
-     * @param action - Action to get prerequisites for
-     * @param currentSelection - Current selection map
-     * @param allActions - All available actions
-     * @returns Plain text prerequisite description
-     */
+    /** Get prerequisite description for tooltip display */
     getPrerequisiteTooltip(action: IAction, currentSelection: Record<string, boolean>, allActions: IAction[]): string;
-    /**
-     * Build dynamic logic tree message with AND/OR operators and nesting
-     *
-     * @param logic - Permission logic tree
-     * @param missingActions - Actions that are missing
-     * @param allActions - All available actions
-     * @param currentSelection - Current selection map for accurate status
-     * @returns HTML formatted logic tree
-     */
-    buildLogicMessage(logic: ILogicNode, missingActions: IAction[], allActions: IAction[], currentSelection?: Record<string, boolean>): string;
+    /** Build dynamic logic tree message with AND/OR operators and nesting */
+    buildLogicMessage(logic: ILogicNode, _missingActions: IAction[], allActions: IAction[], currentSelection?: Record<string, boolean>): string;
+    /** Extract selected action IDs from selection map */
+    private getSelectedIds;
     private sanitizeHtml;
-    /**
-     * Recursively collect ALL missing prerequisites at all dependency levels
-     *
-     * This prevents cascading prerequisite dialogs by finding the complete
-     * dependency chain upfront.
-     *
-     * **Example:**
-     * - Action 4 requires Action 3
-     * - Action 3 requires Action 2
-     * - Action 2 requires Action 1
-     *
-     * Instead of showing 3 separate dialogs, this returns: [Action 3, Action 2, Action 1]
-     *
-     * @param action - Starting action to check
-     * @param currentSelection - Current selection map
-     * @param allActions - All available actions
-     * @returns Complete set of missing prerequisites across all levels
-     */
+    /** Recursively collect ALL missing prerequisites at all dependency levels */
     private getAllMissingPrerequisitesRecursive;
     private showPrerequisiteDialog;
     private showDependencyDialog;
@@ -523,66 +248,21 @@ declare class ActionPermissionLogicService {
     private findRequiredActionIds;
     private buildSimpleMessage;
     private formatLogicNode;
-    /**
-     * Build clean text-based logic tree for tooltips
-     */
+    /** Build clean text-based logic tree for tooltips */
     private buildTooltipLogicTree;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<ActionPermissionLogicService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<ActionPermissionLogicService>;
 }
 
-/**
- * Consolidated Permission API Service
- * Handles all permission-related operations in one service
- * Supports:
- * - User → Action (direct permissions)
- * - User → Role (role assignments)
- * - Role → Action (role permissions)
- * - Company → Action (company whitelisting)
- *
- * Endpoint: POST /permissions/*
- */
 declare class PermissionApiService extends BaseApiService {
     constructor();
-    /**
-     * Assign/remove actions directly to/from user
-     * POST /permissions/user-actions/assign
-     */
     assignUserActions(data: IAssignUserActionsDto): Observable<ISingleResponse<IPermissionOperationResultDto>>;
-    /**
-     * Get user's direct action permissions
-     * GET /permissions/user-actions/:userId
-     */
     getUserActions(userId: string, query?: IGetUserActionsDto): Observable<ISingleResponse<IUserActionResponseDto[]>>;
-    /**
-     * Assign/remove roles to/from user
-     * POST /permissions/user-roles/assign
-     */
     assignUserRoles(data: IAssignUserRolesDto): Observable<ISingleResponse<IPermissionOperationResultDto>>;
-    /**
-     * Get user's role assignments
-     * GET /permissions/user-roles/:userId
-     */
     getUserRoles(userId: string, query?: IGetUserRolesDto): Observable<ISingleResponse<IUserRoleResponseDto[]>>;
-    /**
-     * Assign/remove actions to/from role
-     * POST /permissions/role-actions/assign
-     */
     assignRoleActions(data: IAssignRoleActionsDto): Observable<ISingleResponse<IPermissionOperationResultDto>>;
-    /**
-     * Get role's action permissions
-     * GET /permissions/role-actions/:roleId
-     */
-    getRoleActions(roleId: string, query?: IGetRoleActionsDto): Observable<ISingleResponse<IRoleActionResponseDto[]>>;
-    /**
-     * Assign/remove actions to/from company (whitelisting)
-     * POST /permissions/company-actions/assign
-     */
+    getRoleActions(roleId: string): Observable<ISingleResponse<IRoleActionResponseDto[]>>;
     assignCompanyActions(data: IAssignCompanyActionsDto): Observable<ISingleResponse<IPermissionOperationResultDto>>;
-    /**
-     * Get company's whitelisted actions
-     * GET /permissions/company-actions/:companyId
-     */
     getCompanyActions(companyId: string): Observable<ISingleResponse<ICompanyActionResponseDto[]>>;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<PermissionApiService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<PermissionApiService>;
@@ -598,7 +278,6 @@ declare class MyPermissionsApiService {
     private readonly http;
     private readonly appConfig;
     private readonly baseUrl;
-    constructor();
     /**
      * Get current user's complete permissions
      * POST /iam/permissions/my-permissions
@@ -610,45 +289,14 @@ declare class MyPermissionsApiService {
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<MyPermissionsApiService>;
 }
 
-/**
- * Permission State Service
- * Manages user permissions state and provides permission checking methods
- *
- * Uses shared PermissionValidatorService for centralized permission checking.
- *
- * @example
- * ```typescript
- * // In component
- * readonly permissionState = inject(PermissionStateService);
- *
- * ngOnInit() {
- *   this.permissionState.loadPermissions();
- * }
- *
- * // Check permission
- * if (this.permissionState.hasAction('user.create')) {
- *   // Show create button
- * }
- * ```
- */
 declare class PermissionStateService {
     private readonly permissionApi;
     private readonly permissionValidator;
     private readonly _permissions;
-    readonly permissions: Signal<IMyPermissionsResponseDto | null>;
+    readonly permissions: _angular_core.Signal<IMyPermissionsResponseDto | null>;
     private readonly _isLoading;
-    readonly isLoading: Signal<boolean>;
-    /**
-     * Load current user's permissions from API
-     * Call this on app initialization or after login
-     * Returns Observable for reactive composition
-     */
+    readonly isLoading: _angular_core.Signal<boolean>;
     loadPermissions(dto?: IGetMyPermissionsDto): Observable<void>;
-    /**
-     * Check if permissions are loaded
-     *
-     * @returns true if permissions are loaded
-     */
     isLoaded(): boolean;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<PermissionStateService, never>;
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<PermissionStateService>;
@@ -670,78 +318,40 @@ declare class LogicBuilderComponent {
         name: string;
     }[]>;
     readonly logicChange: _angular_core.OutputEmitterRef<ILogicNode | null>;
-    readonly availableActions: _angular_core.Signal<{
-        id: string;
-        name: string;
-    }[]>;
-    private builderTree;
+    /** Internal builder tree state (private writable + public readonly pattern) */
+    private readonly _builderTree;
     readonly builderLogic: _angular_core.Signal<IBuilderNode | null>;
+    constructor();
     initializeLogic(): void;
     clearLogic(): void;
     toggleOperator(nodeId: string): void;
     addChildNode(parentId: string, type: 'group' | 'action'): void;
     removeNode(nodeId: string): void;
     updateActionId(nodeId: string, actionId: string): void;
-    private emitChange;
+    /** Updates a node in the tree and emits the change */
+    private updateNode;
+    /** Sets the tree and emits the change */
+    private updateTreeAndEmit;
     private updateNodeInTree;
     private removeNodeFromTree;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<LogicBuilderComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<LogicBuilderComponent, "lib-logic-builder", never, { "logic": { "alias": "logic"; "required": false; "isSignal": true; }; "actions": { "alias": "actions"; "required": false; "isSignal": true; }; }, { "logicChange": "logicChange"; }, never, never, true, never>;
 }
 
-/**
- * Role-Action Selector Component
- *
- * Manages role action permissions with hierarchical tree view and intelligent dependency management.
- *
- * **Architecture:**
- * - Presentation: TreeTable for hierarchical display
- * - Business Logic: Flat action list for selection/validation
- * - State: Signals with computed dependencies
- *
- * **Core Features:**
- * - Role dropdown with async loading
- * - Hierarchical TreeTable with expand/collapse
- * - Action permission assignment (add/remove)
- * - Real-time change tracking
- *
- * **Dependency Management:**
- * - Auto-selection with AND/OR logic
- * - Dependency detection on uncheck
- * - Cascade remove for AND dependencies
- * - Visual warnings for unmet prerequisites
- * - Pre-save validation with auto-fix
- *
- * **Performance:**
- * - OnPush change detection
- * - Computed signals for reactive updates
- * - Memoized prerequisite validation
- * - AbortController for request cancellation
- *
- * @example
- * ```html
- * <flusys-role-action-selector />
- * ```
- */
-declare class RoleActionSelectorComponent implements OnDestroy {
-    private readonly roleApi;
-    private readonly actionApi;
-    private readonly permissionApi;
-    private readonly messageService;
-    private readonly permissionLogic;
-    readonly selectedRoleId: _angular_core.WritableSignal<string | undefined>;
-    readonly roles: _angular_core.WritableSignal<IRole[]>;
+declare abstract class BaseActionSelectorComponent {
+    protected readonly permissionLogic: ActionPermissionLogicService;
+    protected readonly translateAdapter: TranslateService | null;
     readonly loading: _angular_core.WritableSignal<boolean>;
     readonly saving: _angular_core.WritableSignal<boolean>;
-    private readonly _actions;
+    protected readonly _actions: _angular_core.WritableSignal<IAction[]>;
     readonly actions: _angular_core.Signal<IAction[]>;
-    private readonly _actionsTree;
-    private readonly actionsTree;
-    private readonly _selectionMap;
+    protected readonly _actionsTree: _angular_core.WritableSignal<IActionTreeDto[]>;
+    protected readonly actionsTree: _angular_core.Signal<IActionTreeDto[]>;
+    protected readonly _selectionMap: _angular_core.WritableSignal<Record<string, boolean>>;
     readonly selectionMap: _angular_core.Signal<Record<string, boolean>>;
-    private readonly _initialSelection;
-    private readonly initialSelection;
-    readonly treeNodes: _angular_core.Signal<primeng_api.TreeNode<IAction>[]>;
+    protected readonly _initialSelection: _angular_core.WritableSignal<Record<string, boolean>>;
+    protected readonly initialSelection: _angular_core.Signal<Record<string, boolean>>;
+    readonly treeNodes: _angular_core.Signal<__________flusys_ng_ui_types_flusys_ng_ui.TreeNode<IAction>[]>;
     readonly allSelected: _angular_core.Signal<boolean>;
     readonly hasChanges: _angular_core.Signal<boolean>;
     readonly actionsWithUnmetPrerequisites: _angular_core.Signal<Set<string>>;
@@ -749,162 +359,65 @@ declare class RoleActionSelectorComponent implements OnDestroy {
     readonly pendingAdd: _angular_core.Signal<IAction[]>;
     readonly pendingRemove: _angular_core.Signal<IAction[]>;
     readonly canSave: _angular_core.Signal<boolean>;
-    private loadDataAbortController;
-    constructor();
-    ngOnDestroy(): void;
-    /**
-     * Load roles from API
-     */
-    private loadRoles;
-    /**
-     * Load actions and assignments for selected role
-     */
-    private onRoleChange;
-    /**
-     * Get tooltip for action checkbox
-     */
-    getTooltip(action: IAction): string;
-    /**
-     * Check if action has unmet prerequisites
-     */
+    protected translate(key: string, vars?: Record<string, string | number>): string;
     hasUnmetPrerequisites(action: IAction): boolean;
-    /**
-     * Handle action toggle with dependency management
-     */
+    getTooltip(action: IAction): string;
+    protected abstract getDefaultTooltip(isSelected: boolean): string;
     onActionToggle(action: IAction, newValue: boolean): void;
-    /**
-     * Toggle all actions
-     */
     toggleAll(): void;
-    /**
-     * Select all actions
-     */
     selectAll(): void;
-    /**
-     * Deselect all actions
-     */
     deselectAll(): void;
-    /**
-     * Save changes to backend
-     */
+    protected setAllSelection(value: boolean): void;
+    protected buildSelectionMap(actions: IAction[], predicate: (action: IAction) => boolean): Record<string, boolean>;
+    protected buildPayloadItems(): Array<{
+        id: string;
+        action: PermissionAction;
+    }>;
+    protected resetState(): void;
+}
+
+declare class RoleActionSelectorComponent extends BaseActionSelectorComponent {
+    readonly ROLE_ACTION_PERMISSIONS: {
+        readonly READ: "role-action.read";
+        readonly ASSIGN: "role-action.assign";
+    };
+    private readonly destroyRef;
+    private readonly roleApi;
+    private readonly actionApi;
+    private readonly permissionApi;
+    private readonly messageService;
+    readonly selectedRoleId: _angular_core.WritableSignal<string | undefined>;
+    readonly roles: _angular_core.WritableSignal<IRole[]>;
+    private loadDataAbortController;
+    constructor();
+    protected getDefaultTooltip(isSelected: boolean): string;
+    private loadRoles;
+    private onRoleChange;
     saveChanges(): Promise<void>;
-    /**
-     * Reset component state
-     */
-    private resetState;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<RoleActionSelectorComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<RoleActionSelectorComponent, "flusys-role-action-selector", never, {}, {}, never, never, true, never>;
 }
 
-/**
- * Company-Action Selector Component
- *
- * Manages company action whitelisting with hierarchical tree view and intelligent dependency management.
- *
- * **Architecture:**
- * - Presentation: TreeTable for hierarchical display
- * - Business Logic: Flat action list for selection/validation
- * - State: Signals with computed dependencies
- *
- * **Core Features:**
- * - Company dropdown with async loading
- * - Hierarchical TreeTable with expand/collapse
- * - Action whitelist management (add/remove)
- * - Real-time change tracking
- *
- * **Dependency Management:**
- * - Auto-selection with AND/OR logic
- * - Dependency detection on uncheck
- * - Cascade remove for AND dependencies
- * - Visual warnings for unmet prerequisites
- * - Pre-save validation with auto-fix
- *
- * **Performance:**
- * - OnPush change detection
- * - Computed signals for reactive updates
- * - Memoized prerequisite validation
- * - AbortController for request cancellation
- *
- * @example
- * ```html
- * <flusys-company-action-selector />
- * ```
- */
-declare class CompanyActionSelectorComponent implements OnDestroy {
+declare class CompanyActionSelectorComponent extends BaseActionSelectorComponent {
+    readonly COMPANY_ACTION_PERMISSIONS: {
+        readonly READ: "company-action.read";
+        readonly ASSIGN: "company-action.assign";
+    };
     private readonly companyApiProvider;
     private readonly actionApi;
     private readonly permissionApi;
     private readonly messageService;
     private readonly confirmationService;
-    private readonly permissionLogic;
+    private readonly destroyRef;
     readonly selectedCompanyId: _angular_core.WritableSignal<string | undefined>;
     readonly companies: _angular_core.WritableSignal<ICompany[]>;
-    readonly loading: _angular_core.WritableSignal<boolean>;
-    readonly saving: _angular_core.WritableSignal<boolean>;
-    private readonly _actions;
-    readonly actions: _angular_core.Signal<IAction[]>;
-    private readonly _actionsTree;
-    private readonly actionsTree;
-    private readonly _selectionMap;
-    readonly selectionMap: _angular_core.Signal<Record<string, boolean>>;
-    private readonly _initialSelection;
-    private readonly initialSelection;
-    readonly treeNodes: _angular_core.Signal<primeng_api.TreeNode<IAction>[]>;
-    readonly allSelected: _angular_core.Signal<boolean>;
-    readonly hasChanges: _angular_core.Signal<boolean>;
-    readonly actionsWithUnmetPrerequisites: _angular_core.Signal<Set<string>>;
-    readonly invalidActionsCount: _angular_core.Signal<number>;
-    readonly pendingAdd: _angular_core.Signal<IAction[]>;
-    readonly pendingRemove: _angular_core.Signal<IAction[]>;
-    readonly canSave: _angular_core.Signal<boolean>;
     private loadDataAbortController;
     constructor();
-    ngOnDestroy(): void;
-    /**
-     * Load companies from API
-     */
+    protected getDefaultTooltip(isSelected: boolean): string;
     private loadCompanies;
-    /**
-     * Load actions and assignments for selected company
-     */
     private loadData;
-    /**
-     * Check if action has unmet prerequisites
-     */
-    hasUnmetPrerequisites(action: IAction): boolean;
-    /**
-     * Get tooltip for action checkbox
-     */
-    getTooltip(action: IAction): string;
-    /**
-     * Handle action checkbox toggle
-     */
-    onActionToggle(action: IAction, newValue: boolean): void;
-    /**
-     * Toggle all actions
-     */
-    toggleAll(): void;
-    /**
-     * Select all actions
-     */
-    selectAll(): void;
-    /**
-     * Deselect all actions
-     */
-    deselectAll(): void;
-    /**
-     * Save changes to backend
-     */
     saveChanges(): Promise<void>;
-    /**
-     * Handle backend prerequisite validation errors
-     * Shows confirmation dialog with auto-fix option
-     */
     private handleBackendPrerequisiteErrors;
-    /**
-     * Reset component state
-     */
-    private resetState;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<CompanyActionSelectorComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<CompanyActionSelectorComponent, "flusys-company-action-selector", never, {}, {}, never, never, true, never>;
 }
@@ -930,7 +443,6 @@ declare class CompanyActionSelectorComponent implements OnDestroy {
  * - Branch-specific: branchId = selected value
  *
  * **Performance:**
- * - OnPush change detection
  * - Computed signals for reactive updates
  * - Branch filtering on company context change
  *
@@ -940,12 +452,18 @@ declare class CompanyActionSelectorComponent implements OnDestroy {
  * ```
  */
 declare class UserRoleSelectorComponent {
+    readonly USER_ROLE_PERMISSIONS: {
+        readonly READ: "user-role.read";
+        readonly ASSIGN: "user-role.assign";
+    };
     private readonly appConfig;
     private readonly companyContext;
     private readonly userPermissionProvider;
     private readonly roleApi;
     private readonly permissionApi;
     private readonly messageService;
+    private readonly translateAdapter;
+    private translate;
     readonly selectedUserId: _angular_core.WritableSignal<string | null>;
     readonly selectedBranchId: _angular_core.WritableSignal<string | undefined>;
     readonly branches: _angular_core.WritableSignal<IBranch[]>;
@@ -993,6 +511,10 @@ declare class UserRoleSelectorComponent {
      * Deselect all roles
      */
     deselectAll(): void;
+    /**
+     * Set all role selections to a given value
+     */
+    private setAllSelections;
     /**
      * Save changes to backend
      */
@@ -1005,109 +527,28 @@ declare class UserRoleSelectorComponent {
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserRoleSelectorComponent, "flusys-user-role-selector", never, {}, {}, never, never, true, never>;
 }
 
-/**
- * User-Action Selector Component
- *
- * Manages direct user action permissions with hierarchical tree view.
- *
- * **Architecture:**
- * - Presentation: TreeTable for hierarchical display
- * - Business Logic: Flat action list for selection/validation
- * - State: Signals with computed dependencies
- *
- * **Core Features:**
- * - User dropdown with async loading
- * - Branch selector (if company feature enabled)
- * - Hierarchical TreeTable with expand/collapse
- * - Direct user-action permission assignment (bypassing roles)
- * - Real-time change tracking
- *
- * **Granularity:**
- * - Company-wide: branchId = undefined
- * - Branch-specific: branchId = selected value
- *
- * **Performance:**
- * - OnPush change detection
- * - Computed signals for reactive updates
- * - Branch filtering on company context change
- *
- * @example
- * ```html
- * <flusys-user-action-selector />
- * ```
- */
-declare class UserActionSelectorComponent {
+declare class UserActionSelectorComponent extends BaseActionSelectorComponent {
+    readonly USER_ACTION_PERMISSIONS: {
+        readonly READ: "user-action.read";
+        readonly ASSIGN: "user-action.assign";
+    };
     private readonly appConfig;
     private readonly companyContext;
     private readonly userPermissionProvider;
     private readonly actionApi;
     private readonly permissionApi;
-    private readonly permissionLogic;
     private readonly messageService;
     readonly selectedUserId: _angular_core.WritableSignal<string | null>;
     readonly selectedBranchId: _angular_core.WritableSignal<string | undefined>;
     readonly branches: _angular_core.WritableSignal<IBranch[]>;
-    readonly loading: _angular_core.WritableSignal<boolean>;
-    readonly saving: _angular_core.WritableSignal<boolean>;
-    private readonly _actions;
-    readonly actions: _angular_core.Signal<IAction[]>;
-    private readonly _actionsTree;
-    private readonly actionsTree;
-    private readonly _selectionMap;
-    readonly selectionMap: _angular_core.Signal<Record<string, boolean>>;
-    private readonly _initialSelection;
-    private readonly initialSelection;
+    private readonly isCompanyFeatureActive;
     readonly showBranchSelector: _angular_core.Signal<boolean>;
     readonly filteredBranches: _angular_core.Signal<IBranch[]>;
-    readonly treeNodes: _angular_core.Signal<primeng_api.TreeNode<IAction>[]>;
-    readonly allSelected: _angular_core.Signal<boolean>;
-    readonly hasChanges: _angular_core.Signal<boolean>;
-    readonly actionsWithUnmetPrerequisites: _angular_core.Signal<Set<string>>;
-    readonly invalidActionsCount: _angular_core.Signal<number>;
-    readonly pendingAdd: _angular_core.Signal<IAction[]>;
-    readonly pendingRemove: _angular_core.Signal<IAction[]>;
-    readonly canSave: _angular_core.Signal<boolean>;
     constructor();
-    /**
-     * Load user's permitted branches
-     */
+    protected getDefaultTooltip(isSelected: boolean): string;
     private loadUserBranches;
-    /**
-     * Load actions and assignments for selected user
-     */
     private loadData;
-    /**
-     * Get tooltip for action checkbox
-     */
-    getTooltip(action: IAction): string;
-    /**
-     * Check if action has unmet prerequisites
-     */
-    hasUnmetPrerequisites(action: IAction): boolean;
-    /**
-     * Handle action checkbox toggle
-     */
-    onActionToggle(action: IAction, newValue: boolean): void;
-    /**
-     * Toggle all actions
-     */
-    toggleAll(): void;
-    /**
-     * Select all actions
-     */
-    selectAll(): void;
-    /**
-     * Deselect all actions
-     */
-    deselectAll(): void;
-    /**
-     * Save changes to backend
-     */
     saveChanges(): Promise<void>;
-    /**
-     * Reset component state
-     */
-    private resetState;
     static ɵfac: _angular_core.ɵɵFactoryDeclaration<UserActionSelectorComponent, never>;
     static ɵcmp: _angular_core.ɵɵComponentDeclaration<UserActionSelectorComponent, "flusys-user-action-selector", never, {}, {}, never, never, true, never>;
 }
@@ -1136,38 +577,18 @@ declare class ProfilePermissionProviderAdapter implements IProfilePermissionProv
     static ɵprov: _angular_core.ɵɵInjectableDeclaration<ProfilePermissionProviderAdapter>;
 }
 
-/**
- * Provide IAM Provider Adapters
- *
- * Registers IAM implementations for provider interfaces from ng-shared.
- * This allows ng-auth profile page to display permissions without direct dependencies.
- *
- * @example
- * // In app.config.ts
- * import { provideIamProviders } from '@flusys/ng-iam';
- *
- * export const appConfig: ApplicationConfig = {
- *   providers: [
- *     ...provideIamProviders(),
- *     // ... other providers
- *   ]
- * };
- *
- * @returns Array of Angular providers
- */
+/** Registers IAM provider adapters for ng-shared interfaces */
 declare function provideIamProviders(): Provider[];
 
 /**
  * IAM Routes Configuration
  *
- * Identity and Access Management routing
- * - Actions: Permission actions (always visible)
+ * Identity and Access Management routing with permission guards.
+ * - Actions: Permission actions management
  * - Roles: Role management (conditional on RBAC/FULL mode)
- * - Permissions: User permission assignments (always visible)
- *
- * All routes are protected by permission guards to prevent direct URL access.
+ * - Permissions: User permission assignments
  */
 declare const IAM_ROUTES: Routes;
 
-export { ActionApiService, ActionPermissionLogicService, ActionType, CompanyActionSelectorComponent, IAM_ROUTES, LogicBuilderComponent, MAX_DROPDOWN_ITEMS, MyPermissionsApiService, PermissionApiService, PermissionStateService, ProfilePermissionProviderAdapter, RoleActionSelectorComponent, RoleApiService, UserActionSelectorComponent, UserRoleSelectorComponent, provideIamProviders };
-export type { IAction, IActionTreeDto, IAssignCompanyActionsDto, IAssignRoleActionsDto, IAssignUserActionsDto, IAssignUserRolesDto, IBranch, ICompany, ICompanyActionResponseDto, ICreateActionDto, ICreateRoleDto, IGetMyPermissionsDto, IGetRoleActionsDto, IGetUserActionsDto, IGetUserRolesDto, IMenuAction, IMyPermissionsResponseDto, IPermissionItemDto, IPermissionOperationResultDto, IPrerequisiteActionDto, IPrerequisiteValidationError, IRole, IRoleActionResponseDto, IRoleQueryDto, IUpdateActionDto, IUpdateRoleDto, IUser, IUserActionResponseDto, IUserRoleResponseDto, PermissionAction, PermissionMode };
+export { ActionApiService, ActionPermissionLogicService, ActionType, CompanyActionSelectorComponent, IAM_MESSAGES, IAM_ROUTES, LogicBuilderComponent, MAX_DROPDOWN_ITEMS, MyPermissionsApiService, PermissionApiService, PermissionStateService, ProfilePermissionProviderAdapter, RoleActionSelectorComponent, RoleApiService, UserActionSelectorComponent, UserRoleSelectorComponent, provideIamProviders };
+export type { IAction, IActionTreeDto, IAssignCompanyActionsDto, IAssignRoleActionsDto, IAssignUserActionsDto, IAssignUserRolesDto, IBranch, ICompany, ICompanyActionResponseDto, ICreateActionDto, ICreateRoleDto, IGetMyPermissionsDto, IGetRoleActionsDto, IGetUserActionsDto, IGetUserRolesDto, IMyPermissionsResponseDto, IPermissionItemDto, IPermissionOperationResultDto, IPrerequisiteActionDto, IPrerequisiteValidationError, IRole, IRoleActionResponseDto, IRoleQueryDto, IUpdateActionDto, IUpdateRoleDto, IUser, IUserActionResponseDto, IUserRoleResponseDto, PermissionAction };