@team-codeme/crud-forge 0.0.0-stage → 1.0.0

package/src/templates/angular/auth/index.ts.ejs

@@ -0,0 +1,24 @@
+export { AuthService } from './services/auth.service';
+export type { SignOutReason } from './services/auth.service';
+export { AuthUtils } from './utils/auth.utils';
+export { authInterceptor } from './interceptors/auth.interceptor';
+export { AuthGuard } from './guards/auth.guard';
+export { NoAuthGuard } from './guards/no-auth.guard';
+export { LandingGuard } from './guards/landing.guard';
+export { AccessControlService } from './services/access-control.service';
+export { AccessCtrlPipe } from './pipes/access-ctrl.pipe';
+export { HasPermissionDirective } from './directives/has-permission.directive';
+export { KeycloakAdminService } from './services/keycloak-admin.service';
+export type { UserRepresentation, RoleRepresentation } from './services/keycloak-admin.service';
+export { DisabledAccountOverlayComponent } from './components/disabled-account-overlay/disabled-account-overlay.component';
+export {
+  type UserAttributes,
+  PROTECTED_USER_ATTRIBUTE_KEYS,
+  isScreenPermissionGranted,
+  isComponentPermissionGranted,
+  mergePermissionAttributes,
+  normalizeUserAttributes,
+  revokeScreenGrant,
+  screenIdsMatch,
+  getScreenBaseId,
+} from './utils/permission-attribute.util';

package/src/templates/angular/auth/keycloak-admin.service.ts.ejs

@@ -0,0 +1,670 @@
+import { HttpClient, HttpParams } from '@angular/common/http';
+import { Injectable, inject } from '@angular/core';
+import { Observable, forkJoin, of, throwError } from 'rxjs';
+import { catchError, map, switchMap } from 'rxjs/operators';
+import { environment } from '@/environments/environment';
+import {
+  UserAttributes,
+  collectParentRole,
+  mergePermissionAttributes,
+  normalizeUserAttributes,
+  PROTECTED_USER_ATTRIBUTE_KEYS,
+  revokeScreenGrant,
+} from '../utils/permission-attribute.util';
+
+export interface UserRepresentation {
+  id?: string;
+  username?: string;
+  email?: string;
+  firstName?: string;
+  lastName?: string;
+  enabled?: boolean;
+  attributes?: Record<string, string[]>;
+}
+
+export interface RoleRepresentation {
+  id?: string;
+  name?: string;
+  description?: string;
+  attributes?: Record<string, string[]>;
+}
+
+export interface CredentialRepresentation {
+  type: string;
+  value: string;
+  temporary?: boolean;
+}
+
+export interface UserPage {
+  users: UserRepresentation[];
+  totalCount: number;
+}
+
+const MOCK_STORE_KEY = 'cforge-iam-mock';
+
+const defaultMockUsers: UserRepresentation[] = [
+  {
+    id: 'mock-admin',
+    username: 'admin',
+    email: 'demo@crudforge.com',
+    firstName: 'Demo',
+    lastName: 'Admin',
+    enabled: true,
+    attributes: { screens: ['user-management', 'role-management', 'role-permissions'] },
+  },
+];
+
+const defaultMockRoles: RoleRepresentation[] = [
+  {
+    name: 'ROLE_ADMIN',
+    description: 'Administrator',
+    attributes: { screens: ['user-management', 'role-management', 'role-permissions'] },
+  },
+];
+
+function readMockStore(): { users: UserRepresentation[]; roles: RoleRepresentation[]; userRoles: Record<string, string[]> } {
+  if (typeof sessionStorage === 'undefined') {
+    return { users: [...defaultMockUsers], roles: [...defaultMockRoles], userRoles: { 'mock-admin': ['ROLE_ADMIN'] } };
+  }
+  try {
+    const raw = sessionStorage.getItem(MOCK_STORE_KEY);
+    if (raw) {
+      return JSON.parse(raw);
+    }
+  } catch {
+    // fall through to defaults
+  }
+  return { users: [...defaultMockUsers], roles: [...defaultMockRoles], userRoles: { 'mock-admin': ['ROLE_ADMIN'] } };
+}
+
+function writeMockStore(): void {
+  if (typeof sessionStorage === 'undefined') {
+    return;
+  }
+  sessionStorage.setItem(MOCK_STORE_KEY, JSON.stringify({ users: mockUsers, roles: mockRoles, userRoles: mockUserRoles }));
+}
+
+const stored = readMockStore();
+const mockUsers: UserRepresentation[] = stored.users;
+const mockRoles: RoleRepresentation[] = stored.roles;
+const mockUserRoles: Record<string, string[]> = stored.userRoles || { 'mock-admin': ['ROLE_ADMIN'] };
+
+@Injectable({ providedIn: 'root' })
+export class KeycloakAdminService {
+  private readonly http = inject(HttpClient);
+
+  /** Native Keycloak Admin REST (mock / legacy). */
+  private get realmUrl(): string {
+    return `${environment.adminBaseUrl}/admin/realms/${environment.kcRealm}`;
+  }
+
+  /** Custom Keycloak Admin Service middleware (`/api/v1/*`). */
+  private get adminServiceApi(): string {
+    return `${(environment as { kcAdminServiceUrl?: string }).kcAdminServiceUrl || '/services/keycloak-admin'}/api/v1`;
+  }
+
+  private get useAdminService(): boolean {
+    return !!(environment as { useKeycloakAdminService?: boolean }).useKeycloakAdminService;
+  }
+
+  searchUsers(searchTerm = '', page = 0, size = 20): Observable<UserPage> {
+    if (environment.useMockAuth) {
+      const query = searchTerm.toLowerCase();
+      const users = mockUsers.filter((user) =>
+        !query || [user.username, user.email, user.firstName, user.lastName].some((value) =>
+          String(value || '').toLowerCase().includes(query)
+        )
+      );
+      return of({
+        users: users.slice(page * size, page * size + size),
+        totalCount: users.length,
+      });
+    }
+
+    if (this.useAdminService) {
+      let params = new HttpParams().set('page', String(page)).set('size', String(size));
+      if (searchTerm) {
+        params = params.set('search', searchTerm);
+      }
+      return this.http.get<UserRepresentation[]>(`${this.adminServiceApi}/users`, { params }).pipe(
+        map((users) => ({ users: users || [], totalCount: users?.length || 0 })),
+        catchError(() => of({ users: [], totalCount: 0 }))
+      );
+    }
+
+    let params = new HttpParams()
+      .set('first', String(page * size))
+      .set('max', String(size));
+    if (searchTerm) {
+      params = params.set('search', searchTerm);
+    }
+
+    return this.http.get<UserRepresentation[]>(`${this.realmUrl}/users`, { params }).pipe(
+      map((users) => ({ users: users || [], totalCount: users?.length || 0 })),
+      catchError(() => of({ users: [], totalCount: 0 }))
+    );
+  }
+
+  getUserById(id: string): Observable<UserRepresentation | null> {
+    if (environment.useMockAuth) {
+      return of(mockUsers.find((user) => user.id === id) || mockUsers[0] || null);
+    }
+    const url = this.useAdminService
+      ? `${this.adminServiceApi}/users/${id}`
+      : `${this.realmUrl}/users/${id}`;
+    return this.http.get<UserRepresentation>(url).pipe(catchError(() => of(null)));
+  }
+
+  getUserByUsername(username: string): Observable<UserRepresentation | null> {
+    const term = username.trim();
+    if (!term) {
+      return of(null);
+    }
+    return this.searchUsers(term, 0, 50).pipe(
+      map((page) => {
+        const normalized = term.toLowerCase();
+        return (
+          page.users.find((user) => (user.username || '').trim().toLowerCase() === normalized) || null
+        );
+      }),
+      catchError(() => of(null))
+    );
+  }
+
+  createUser(user: UserRepresentation): Observable<UserRepresentation> {
+    if (environment.useMockAuth) {
+      const created = { ...user, id: user.id || `mock-${Date.now()}` };
+      mockUsers.push(created);
+      writeMockStore();
+      return of(created);
+    }
+    if (this.useAdminService) {
+      return throwError(
+        () => new Error('Create user is not in the Keycloak Admin Service contract (GET /api/v1/*).')
+      );
+    }
+    return this.http.post<UserRepresentation>(`${this.realmUrl}/users`, user);
+  }
+
+  updateUser(user: Partial<UserRepresentation> & { id: string }): Observable<void> {
+    if (environment.useMockAuth) {
+      const index = mockUsers.findIndex((item) => item.id === user.id);
+      if (index >= 0) {
+        mockUsers[index] = { ...mockUsers[index], ...user };
+        writeMockStore();
+      }
+      return of(void 0);
+    }
+    const url = this.useAdminService
+      ? `${this.adminServiceApi}/users/${user.id}`
+      : `${this.realmUrl}/users/${user.id}`;
+    return this.http.put<void>(url, user);
+  }
+
+  deleteUser(userId: string): Observable<void> {
+    if (environment.useMockAuth) {
+      const index = mockUsers.findIndex((item) => item.id === userId);
+      if (index >= 0) {
+        mockUsers.splice(index, 1);
+        delete mockUserRoles[userId];
+        writeMockStore();
+      }
+      return of(void 0);
+    }
+    if (this.useAdminService) {
+      return throwError(
+        () => new Error('Delete user is not in the Keycloak Admin Service contract.')
+      );
+    }
+    return this.http.delete<void>(`${this.realmUrl}/users/${userId}`);
+  }
+
+  resetPassword(userId: string, body: CredentialRepresentation): Observable<void> {
+    if (environment.useMockAuth) {
+      return of(void 0);
+    }
+    if (this.useAdminService) {
+      return this.http.post<void>(`${this.adminServiceApi}/users/${userId}/password`, {
+        value: body.value,
+        temporary: body.temporary ?? false,
+      });
+    }
+    return this.http.put<void>(`${this.realmUrl}/users/${userId}/reset-password`, body);
+  }
+
+  getRealmRoles(): Observable<RoleRepresentation[]> {
+    if (environment.useMockAuth) {
+      return of([...mockRoles]);
+    }
+    const url = this.useAdminService ? `${this.adminServiceApi}/roles` : `${this.realmUrl}/roles`;
+    return this.http.get<RoleRepresentation[]>(url).pipe(catchError(() => of([])));
+  }
+
+  createRealmRole(role: RoleRepresentation): Observable<void> {
+    if (environment.useMockAuth) {
+      mockRoles.push({ ...role, attributes: role.attributes || {} });
+      writeMockStore();
+      return of(void 0);
+    }
+    if (this.useAdminService) {
+      return throwError(
+        () => new Error('Create role is not in the Keycloak Admin Service contract.')
+      );
+    }
+    return this.http.post<void>(`${this.realmUrl}/roles`, role);
+  }
+
+  /** Create a realm role only (no ghost user). */
+  createRealmRoleOnly(roleName: string, description?: string): Observable<void> {
+    return this.createRealmRole({
+      name: roleName,
+      description: description || `Role for ${roleName}`,
+    });
+  }
+
+  /**
+   * Duplicate an existing role — create the target and copy source permission attributes.
+   */
+  duplicateRole(sourceRoleName: string, targetRoleName: string, description?: string): Observable<void> {
+    return this.createRealmRoleOnly(targetRoleName, description).pipe(
+      switchMap(() => this.getRealmRolePermissionAttributes(sourceRoleName)),
+      switchMap((attrs) => this.updateRoleAttributes(targetRoleName, { ...attrs })),
+      map(() => void 0),
+      catchError((err) => throwError(() => err))
+    );
+  }
+
+  getUsersByRealmRole(role: string, page = 0, size = 20): Observable<UserPage> {
+    const roleName = String(role ?? '').trim();
+    if (!roleName) {
+      return of({ users: [], totalCount: 0 });
+    }
+
+    if (environment.useMockAuth) {
+      const users = mockUsers.filter((user) => (mockUserRoles[user.id || ''] || []).includes(roleName));
+      return of({
+        users: users.slice(page * size, page * size + size),
+        totalCount: users.length,
+      });
+    }
+
+    const holdersUrl = this.useAdminService
+      ? `${this.adminServiceApi}/roles/${encodeURIComponent(roleName)}/users`
+      : `${this.realmUrl}/roles/${encodeURIComponent(roleName)}/users`;
+    const params = this.useAdminService
+      ? new HttpParams().set('page', String(page)).set('size', String(size))
+      : new HttpParams().set('first', String(page * size)).set('max', String(size));
+
+    return this.http.get<UserRepresentation[] | { users?: UserRepresentation[]; data?: UserRepresentation[]; totalCount?: number; total?: number }>(holdersUrl, { params }).pipe(
+      map((response) => {
+        const rawUsers: UserRepresentation[] = Array.isArray(response)
+          ? response
+          : response.users || response.data || [];
+        return {
+          users: rawUsers,
+          totalCount: Array.isArray(response)
+            ? rawUsers.length
+            : response.totalCount || response.total || rawUsers.length,
+        };
+      }),
+      catchError(() => of({ users: [], totalCount: 0 }))
+    );
+  }
+
+  deleteRealmRole(roleName: string): Observable<void> {
+    if (environment.useMockAuth) {
+      const index = mockRoles.findIndex((role) => role.name === roleName);
+      if (index >= 0) {
+        mockRoles.splice(index, 1);
+        writeMockStore();
+      }
+      return of(void 0);
+    }
+    if (this.useAdminService) {
+      return throwError(
+        () => new Error('Delete role is not in the Keycloak Admin Service contract.')
+      );
+    }
+    return this.http.delete<void>(`${this.realmUrl}/roles/${encodeURIComponent(roleName)}`);
+  }
+
+  getRealmRolePermissionAttributes(roleName: string): Observable<UserAttributes> {
+    if (environment.useMockAuth) {
+      const role = mockRoles.find((item) => item.name?.toUpperCase() === roleName.toUpperCase());
+      return of(normalizeUserAttributes(role?.attributes || {}));
+    }
+    if (this.useAdminService) {
+      // Middleware lists roles but does not expose role attribute GET; return empty attrs.
+      return this.getRealmRoles().pipe(
+        map((roles) => {
+          const role = roles.find((item) => item.name?.toUpperCase() === roleName.toUpperCase());
+          return normalizeUserAttributes(role?.attributes || {});
+        }),
+        catchError(() => of({} as UserAttributes))
+      );
+    }
+    return this.http.get<RoleRepresentation>(`${this.realmUrl}/roles/${encodeURIComponent(roleName)}`).pipe(
+      map((role) => normalizeUserAttributes(role?.attributes || {})),
+      catchError(() => of({} as UserAttributes))
+    );
+  }
+
+  resolveRoleAttributesRecursive(roleName: string, visited = new Set<string>()): Observable<UserAttributes> {
+    const key = roleName.toUpperCase();
+    if (!roleName || visited.has(key)) {
+      return of({});
+    }
+    visited.add(key);
+
+    return this.getRealmRolePermissionAttributes(roleName).pipe(
+      switchMap((attrs) => {
+        const parent = <%= iam.inheritance !== false ? 'collectParentRole(attrs)' : 'null' %>;
+        if (!parent) {
+          return of(attrs);
+        }
+        return this.resolveRoleAttributesRecursive(parent, visited).pipe(
+          map((parentAttrs) => mergePermissionAttributes(parentAttrs, attrs))
+        );
+      })
+    );
+  }
+
+  setRoleScreenPermission(
+    roleName: string,
+    screenId: string,
+    granted: boolean,
+    componentIds: string[] = [],
+    syncUsers = true,
+    relatedScreenIds: string[] = []
+  ): Observable<{ synced: number; failed: number; total: number }> {
+    const screenIds = Array.from(new Set([screenId, ...relatedScreenIds].filter(Boolean)));
+    return this.getRealmRolePermissionAttributes(roleName).pipe(
+      switchMap((attrs) => {
+        let next = { ...attrs };
+        if (granted) {
+          const screens = new Set((next['screens'] || []).map(String));
+          screens.add(screenId);
+          next['screens'] = Array.from(screens);
+          const existing = Array.isArray(next[screenId]) ? next[screenId] : [];
+          next[screenId] = Array.from(new Set([...existing, 'true', ...componentIds.filter(Boolean)]));
+          componentIds.forEach((id) => {
+            if (id) next[id] = ['true'];
+          });
+        } else {
+          next = revokeScreenGrant(next, screenIds, componentIds);
+        }
+        return this.updateRoleAttributes(roleName, next);
+      }),
+      switchMap(() =>
+        syncUsers
+          ? this.syncAllRoleHoldersPermissions(roleName)
+          : of({ synced: 0, failed: 0, total: 0 })
+      )
+    );
+  }
+
+  setRoleComponentPermission(
+    roleName: string,
+    componentId: string,
+    screenId: string,
+    granted: boolean,
+    syncUsers = true,
+    relatedScreenIds: string[] = []
+  ): Observable<{ synced: number; failed: number; total: number }> {
+    return this.getRealmRolePermissionAttributes(roleName).pipe(
+      switchMap((attrs) => {
+        const next = { ...attrs };
+        const screenKeys = Array.from(new Set([screenId, ...relatedScreenIds].filter(Boolean)));
+        if (granted) {
+          next[componentId] = ['true'];
+          screenKeys.forEach((key) => {
+            const existing = Array.isArray(next[key]) ? next[key] : [];
+            next[key] = Array.from(new Set([...(existing.includes('true') ? ['true'] : []), ...existing.filter((v) => v !== 'true'), componentId]));
+          });
+        } else {
+          delete next[componentId];
+          screenKeys.forEach((key) => {
+            if (next[key]) {
+              next[key] = (next[key] || []).filter((entry) => entry !== componentId);
+              if (next[key].length === 0) delete next[key];
+            }
+          });
+        }
+        return this.updateRoleAttributes(roleName, next);
+      }),
+      switchMap(() =>
+        syncUsers
+          ? this.syncAllRoleHoldersPermissions(roleName)
+          : of({ synced: 0, failed: 0, total: 0 })
+      )
+    );
+  }
+
+  updateRoleAttributes(roleName: string, attributes: UserAttributes): Observable<void> {
+    if (environment.useMockAuth) {
+      const role = mockRoles.find((item) => item.name === roleName);
+      if (role) {
+        role.attributes = attributes;
+        writeMockStore();
+      }
+      return of(void 0);
+    }
+    if (this.useAdminService) {
+      return throwError(
+        () => new Error('Update role attributes is not in the Keycloak Admin Service contract.')
+      );
+    }
+    return this.http.get<RoleRepresentation>(`${this.realmUrl}/roles/${encodeURIComponent(roleName)}`).pipe(
+      switchMap((role) =>
+        this.http.put<void>(`${this.realmUrl}/roles/${encodeURIComponent(roleName)}`, {
+          ...role,
+          attributes,
+        })
+      )
+    );
+  }
+
+  getUserRealmRoles(userId: string): Observable<RoleRepresentation[]> {
+    if (environment.useMockAuth) {
+      const names = new Set(mockUserRoles[userId] || []);
+      return of(mockRoles.filter((role) => role.name && names.has(role.name)));
+    }
+    if (this.useAdminService) {
+      return this.http.get<RoleRepresentation[]>(`${this.adminServiceApi}/users/${userId}/roles`).pipe(
+        catchError(() => of([]))
+      );
+    }
+    return this.http.get<RoleRepresentation[]>(`${this.realmUrl}/users/${userId}/role-mappings/realm`).pipe(
+      catchError(() => of([]))
+    );
+  }
+
+  assignRealmRoleToUser(userId: string, roleName: string): Observable<void> {
+    return forkJoin({
+      role: this.getRealmRoles().pipe(map((roles) => roles.find((role) => role.name === roleName) || { name: roleName })),
+      attrs: this.resolveRoleAttributesRecursive(roleName),
+      user: this.getUserById(userId),
+    }).pipe(
+      switchMap(({ role, attrs, user }) => {
+        if (!environment.useMockAuth && this.useAdminService) {
+          return throwError(
+            () => new Error('Assign realm role is not in the Keycloak Admin Service contract.')
+          );
+        }
+        const assign$ = environment.useMockAuth
+          ? of((() => {
+              const current = new Set(mockUserRoles[userId] || []);
+              current.add(roleName);
+              mockUserRoles[userId] = Array.from(current);
+              writeMockStore();
+              return void 0;
+            })())
+          : this.http.post<void>(`${this.realmUrl}/users/${userId}/role-mappings/realm`, [role]);
+        return assign$.pipe(
+          switchMap(() => this.mergeUserAttributes(userId, user?.attributes || {}, attrs)),
+          map(() => void 0)
+        );
+      })
+    );
+  }
+
+  removeRealmRoleFromUser(userId: string, roleName: string): Observable<void> {
+    if (!environment.useMockAuth && this.useAdminService) {
+      return throwError(
+        () => new Error('Remove realm role is not in the Keycloak Admin Service contract.')
+      );
+    }
+    const remove$ = environment.useMockAuth
+      ? of((() => {
+          mockUserRoles[userId] = (mockUserRoles[userId] || []).filter((name) => name !== roleName);
+          writeMockStore();
+          return void 0;
+        })())
+      : this.getRealmRoles().pipe(
+          switchMap((roles) => {
+            const role = roles.find((item) => item.name === roleName) || { name: roleName };
+            return this.http.delete<void>(`${this.realmUrl}/users/${userId}/role-mappings/realm`, {
+              body: [role],
+            });
+          })
+        );
+
+    return remove$.pipe(switchMap(() => this.reconcileUserPermissionsFromAssignedRoles(userId)));
+  }
+
+  addUserAttributes(
+    userId: string,
+    attributes: UserAttributes,
+    removedKeys: string[] = []
+  ): Observable<UserRepresentation> {
+    return this.getUserById(userId).pipe(
+      switchMap((user) => {
+        const current = normalizeUserAttributes(user?.attributes || {});
+        const next: UserAttributes = { ...current, ...normalizeUserAttributes(attributes) };
+        removedKeys.forEach((key) => {
+          if (key && !PROTECTED_USER_ATTRIBUTE_KEYS.has(key.toLowerCase())) {
+            delete next[key];
+          }
+        });
+        return this.writeUserAttributes(userId, next);
+      })
+    );
+  }
+
+  getRealmRoleByName(roleName: string): Observable<RoleRepresentation | null> {
+    return this.getRealmRoles().pipe(
+      map((roles) => roles.find((role) => role.name === roleName) || null),
+      catchError(() => of(null))
+    );
+  }
+
+  reconcileUserPermissionsFromAssignedRoles(userId: string): Observable<void> {
+    return forkJoin({
+      user: this.getUserById(userId),
+      roles: this.getUserRealmRoles(userId),
+    }).pipe(
+      switchMap(({ user, roles }) => {
+        if (!roles.length) {
+          return this.replacePermissionAttributes(userId, user?.attributes || {}, {});
+        }
+        return forkJoin(roles.map((role) => this.resolveRoleAttributesRecursive(role.name || ''))).pipe(
+          switchMap((groups) => {
+            const union = mergePermissionAttributes(...groups);
+            return this.replacePermissionAttributes(userId, user?.attributes || {}, union);
+          })
+        );
+      }),
+      map(() => void 0)
+    );
+  }
+
+  syncAllRoleHoldersPermissions(
+    roleName: string
+  ): Observable<{ synced: number; failed: number; total: number }> {
+    if (environment.useMockAuth) {
+      return of({ synced: mockUsers.length, failed: 0, total: mockUsers.length });
+    }
+    const holdersUrl = this.useAdminService
+      ? `${this.adminServiceApi}/roles/${encodeURIComponent(roleName)}/users`
+      : `${this.realmUrl}/roles/${encodeURIComponent(roleName)}/users`;
+    return this.http.get<UserRepresentation[]>(holdersUrl).pipe(
+      catchError(() => of([] as UserRepresentation[])),
+      switchMap((users) => {
+        const total = users.length;
+        if (!total) {
+          return of({ synced: 0, failed: 0, total: 0 });
+        }
+        return forkJoin(
+          users.map((user) =>
+            this.reconcileUserPermissionsFromAssignedRoles(user.id || '').pipe(
+              map(() => true),
+              catchError(() => of(false))
+            )
+          )
+        ).pipe(
+          map((results) => {
+            const synced = results.filter(Boolean).length;
+            return { synced, failed: total - synced, total };
+          })
+        );
+      })
+    );
+  }
+
+  private mergeUserAttributes(
+    userId: string,
+    current: Record<string, string[]>,
+    incoming: UserAttributes
+  ): Observable<UserRepresentation> {
+    const merged = mergePermissionAttributes(normalizeUserAttributes(current), incoming);
+    return this.writeUserAttributes(userId, merged);
+  }
+
+  private replacePermissionAttributes(
+    userId: string,
+    current: Record<string, string[]>,
+    nextPermissions: UserAttributes
+  ): Observable<UserRepresentation> {
+    const preserved: UserAttributes = {};
+    Object.entries(normalizeUserAttributes(current)).forEach(([key, values]) => {
+      if (PROTECTED_USER_ATTRIBUTE_KEYS.has(key.toLowerCase())) {
+        preserved[key] = values;
+      }
+    });
+    return this.writeUserAttributes(userId, { ...nextPermissions, ...preserved });
+  }
+
+  private writeUserAttributes(userId: string, attributes: UserAttributes): Observable<UserRepresentation> {
+    if (environment.useMockAuth) {
+      const user = mockUsers.find((item) => item.id === userId);
+      if (user) {
+        user.attributes = attributes;
+        writeMockStore();
+        return of(user);
+      }
+      return of({ id: userId, attributes });
+    }
+
+    if (this.useAdminService) {
+      return this.http
+        .patch<{ message?: string }>(`${this.adminServiceApi}/users/${userId}/attributes`, {
+          set: attributes,
+          remove: [],
+        })
+        .pipe(
+          switchMap(() => this.getUserById(userId)),
+          map((user) => user || { id: userId, attributes })
+        );
+    }
+
+    return this.getUserById(userId).pipe(
+      switchMap((user) => {
+        if (!user) {
+          return throwError(() => new Error(`User ${userId} was not found`));
+        }
+        const updated = { ...user, attributes };
+        return this.updateUser({ id: userId, ...updated }).pipe(map(() => updated));
+      })
+    );
+  }
+}