@uniorganization/uni-lib 4.1.4 → 4.1.5

package/dist/modules/tenant/tenant-authorization.service.js

@@ -41,38 +41,39 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
         this.userRoleRepository = userRoleRepository;
         this.logger = new common_1.Logger(TenantAuthorizationService_1.name);
     }
-    resolve(userId, clientId, expectedHomeClientId) {
+    resolve(userId, clientId, _legacyOriginClientId) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
+            var _a, _b;
             this.assertPositiveInteger(userId);
             this.assertPositiveInteger(clientId);
-            this.assertPositiveInteger(expectedHomeClientId);
             const key = (0, tenant_authorization_keys_1.tenantAuthorizationKey)(clientId, userId);
             const cached = yield this.readCache(key);
             if (cached &&
                 cached.userId === userId &&
                 cached.clientId === clientId &&
-                cached.homeClientId === expectedHomeClientId &&
                 ((_a = cached.identity) === null || _a === void 0 ? void 0 : _a.id) === userId &&
-                cached.identity.homeClientId === expectedHomeClientId &&
                 this.isFresh(cached.cachedAt) &&
-                cached.roles.length > 0) {
+                cached.roles.length > 0 &&
+                Array.isArray(cached.permissions) &&
+                ((_b = cached.accessRole) === null || _b === void 0 ? void 0 : _b.id)) {
                 return { identity: cached.identity, snapshot: cached };
             }
-            const resolved = yield this.loadFromDatabase(userId, clientId, expectedHomeClientId);
+            const resolved = yield this.loadFromDatabase(userId, clientId);
             yield this.writeCache(key, resolved.snapshot);
             return resolved;
         });
     }
-    resolveImpersonation(userId, homeClientId, targetClientId) {
+    resolveImpersonation(userId, originClientId, targetClientIdOrLegacyOriginClientId, legacyTargetClientId) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (homeClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
+            const targetClientId = legacyTargetClientId !== null && legacyTargetClientId !== void 0 ? legacyTargetClientId : targetClientIdOrLegacyOriginClientId;
+            if (originClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
                 targetClientId === tenant_constants_1.NEWTECH_CLIENT_ID) {
                 throw new common_1.UnauthorizedException();
             }
-            const origin = yield this.resolve(userId, homeClientId, homeClientId);
-            const isNewtechMaster = origin.snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
-                role.roleName.toLowerCase() === 'sysadmin');
+            const origin = yield this.resolve(userId, originClientId);
+            const isNewtechMaster = origin.snapshot.permissions.includes('master.users.read') ||
+                origin.snapshot.roles.some((role) => role.moduleName.toLowerCase() === 'root' &&
+                    role.roleName.toLowerCase() === 'sysadmin');
             const targetClient = yield this.clientRepository.findOne({
                 where: { id: targetClientId, deletedAt: (0, typeorm_2.IsNull)() },
             });
@@ -81,7 +82,6 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
             }
             const snapshot = {
                 userId,
-                homeClientId,
                 clientId: targetClientId,
                 clientName: targetClient.name,
                 clientAlias: targetClient.alias,
@@ -94,6 +94,15 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
                     },
                 ],
                 privileges: [],
+                accessRole: {
+                    id: 0,
+                    code: tenant_constants_1.TENANT_IMPERSONATOR_ROLE,
+                    name: 'Tenant impersonator',
+                    scope: 'GLOBAL',
+                    clientId: null,
+                },
+                permissions: [],
+                authzVersion: 1,
                 identity: origin.identity,
                 cachedAt: new Date().toISOString(),
             };
@@ -113,10 +122,14 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
             }
         });
     }
-    loadFromDatabase(userId, clientId, expectedHomeClientId) {
+    loadFromDatabase(userId, clientId) {
         return __awaiter(this, void 0, void 0, function* () {
-            const [user, client, assignments] = yield Promise.all([
-                this.userRepository.findOne({ where: { id: userId } }),
+            var _a, _b;
+            const [user, client, assignments, accessRows] = yield Promise.all([
+                this.userRepository.findOne({
+                    where: { id: userId },
+                    relations: ['usersLobs', 'usersLobs.lob', 'usersLobs.lob.division'],
+                }),
                 this.clientRepository.findOne({
                     where: { id: clientId, deletedAt: (0, typeorm_2.IsNull)() },
                 }),
@@ -129,23 +142,75 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
                     .where('assignment."USER_ID" = :userId', { userId })
                     .andWhere('assignment.client_id = :clientId', { clientId })
                     .getMany(),
+                this.userRoleRepository.manager.query(`SELECT
+           role.id,
+           role.code,
+           role.name,
+           role.scope,
+           role.client_id AS "roleClientId",
+           role.authz_version AS "authzVersion",
+           COALESCE(
+             jsonb_agg(permission.code ORDER BY permission.code)
+               FILTER (WHERE permission.id IS NOT NULL AND permission.is_active),
+             '[]'::jsonb
+           ) AS permissions
+         FROM stm."USER_ACCESS_ROLES" membership
+         JOIN stm."ACCESS_ROLES" role
+           ON role.id = membership.role_id
+          AND role.is_active
+         LEFT JOIN stm."ACCESS_ROLE_PERMISSIONS" definition
+           ON definition.role_id = role.id
+         LEFT JOIN stm."ACCESS_PERMISSIONS" permission
+           ON permission.id = definition.permission_id
+         WHERE membership.user_id = $1
+           AND membership.client_id = $2
+         GROUP BY role.id`, [userId, clientId]),
             ]);
             if (!user ||
                 !Number(user.is_active) ||
-                user.clientId !== expectedHomeClientId ||
                 !client ||
-                assignments.length === 0) {
+                accessRows.length > 1 ||
+                (accessRows.length === 0 && assignments.length === 0)) {
                 throw new common_1.UnauthorizedException();
             }
-            const roles = assignments.map((assignment) => {
-                var _a, _b, _c, _d, _e, _f;
-                return ({
-                    roleId: Number(assignment.roleId || ((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.id)),
-                    roleName: (_b = assignment.role) === null || _b === void 0 ? void 0 : _b.roleName,
-                    moduleId: Number((_d = (_c = assignment.role) === null || _c === void 0 ? void 0 : _c.module) === null || _d === void 0 ? void 0 : _d.id),
-                    moduleName: (_f = (_e = assignment.role) === null || _e === void 0 ? void 0 : _e.module) === null || _f === void 0 ? void 0 : _f.moduleName,
-                });
-            });
+            const accessRow = accessRows[0];
+            const usingLegacyCompatibility = accessRows.length === 0 || accessRow.code.startsWith('migrated-');
+            const legacyRole = (_a = assignments[0]) === null || _a === void 0 ? void 0 : _a.role;
+            const accessRole = accessRow
+                ? {
+                    id: Number(accessRow.id),
+                    code: accessRow.code,
+                    name: accessRow.name,
+                    scope: accessRow.scope,
+                    clientId: accessRow.roleClientId == null
+                        ? null
+                        : Number(accessRow.roleClientId),
+                }
+                : {
+                    id: Number(legacyRole === null || legacyRole === void 0 ? void 0 : legacyRole.id),
+                    code: `legacy-${Number(legacyRole === null || legacyRole === void 0 ? void 0 : legacyRole.id)}`,
+                    name: (_b = legacyRole === null || legacyRole === void 0 ? void 0 : legacyRole.roleName) !== null && _b !== void 0 ? _b : 'Legacy access',
+                    scope: 'CLIENT',
+                    clientId,
+                };
+            const roles = usingLegacyCompatibility && assignments.length
+                ? assignments.map((assignment) => {
+                    var _a, _b, _c, _d, _e, _f;
+                    return ({
+                        roleId: Number(assignment.roleId || ((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.id)),
+                        roleName: (_b = assignment.role) === null || _b === void 0 ? void 0 : _b.roleName,
+                        moduleId: Number((_d = (_c = assignment.role) === null || _c === void 0 ? void 0 : _c.module) === null || _d === void 0 ? void 0 : _d.id),
+                        moduleName: (_f = (_e = assignment.role) === null || _e === void 0 ? void 0 : _e.module) === null || _f === void 0 ? void 0 : _f.moduleName,
+                    });
+                })
+                : [
+                    {
+                        roleId: accessRole.id,
+                        roleName: accessRole.name,
+                        moduleId: accessRole.id,
+                        moduleName: 'access-control',
+                    },
+                ];
             if (roles.some((role) => !Number.isInteger(role.roleId) ||
                 role.roleId <= 0 ||
                 !role.roleName ||
@@ -154,15 +219,16 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
                 !role.moduleName)) {
                 throw new common_1.UnauthorizedException();
             }
-            const privileges = Array.from(new Set(assignments.flatMap((assignment) => {
-                var _a;
-                return (((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.privileges) || [])
-                    .map((definition) => { var _a; return (_a = definition.privilege) === null || _a === void 0 ? void 0 : _a.privilege; })
-                    .filter((privilege) => Boolean(privilege));
-            }))).sort();
+            const privileges = usingLegacyCompatibility
+                ? Array.from(new Set(assignments.flatMap((assignment) => {
+                    var _a;
+                    return (((_a = assignment.role) === null || _a === void 0 ? void 0 : _a.privileges) || [])
+                        .map((definition) => { var _a; return (_a = definition.privilege) === null || _a === void 0 ? void 0 : _a.privilege; })
+                        .filter((privilege) => Boolean(privilege));
+                }))).sort()
+                : [];
             const identity = {
                 id: user.id,
-                homeClientId: user.clientId,
                 firstName: user.first_name,
                 username: user.username,
                 lastName: user.last_name,
@@ -177,12 +243,16 @@ let TenantAuthorizationService = TenantAuthorizationService_1 = class TenantAuth
             };
             const snapshot = {
                 userId,
-                homeClientId: user.clientId,
                 clientId,
                 clientName: client.name,
                 clientAlias: client.alias,
                 roles,
                 privileges,
+                accessRole,
+                permissions: Array.isArray(accessRow.permissions)
+                    ? accessRow.permissions
+                    : [],
+                authzVersion: accessRow ? Number(accessRow.authzVersion) : 1,
                 identity,
                 cachedAt: new Date().toISOString(),
             };

package/dist/modules/tenant/tenant-authorization.service.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/tenant/tenant-authorization.service.spec.js

@@ -0,0 +1,101 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@nestjs/common");
+const tenant_constants_1 = require("./tenant.constants");
+const tenant_authorization_service_1 = require("./tenant-authorization.service");
+describe('TenantAuthorizationService impersonation', () => {
+    const store = {
+        get: jest.fn(),
+        set: jest.fn(),
+        delete: jest.fn(),
+        deleteMany: jest.fn(),
+    };
+    const userRepository = {};
+    const clientRepository = { findOne: jest.fn() };
+    const userRoleRepository = {};
+    const service = new tenant_authorization_service_1.TenantAuthorizationService(store, userRepository, clientRepository, userRoleRepository);
+    const origin = (permissions) => ({
+        identity: {
+            id: 1,
+            homeClientId: 2,
+            firstName: 'Root',
+            lastName: 'User',
+        },
+        snapshot: {
+            userId: 1,
+            homeClientId: 2,
+            clientId: tenant_constants_1.NEWTECH_CLIENT_ID,
+            clientName: 'Newtech',
+            clientAlias: 'newtech',
+            roles: [
+                {
+                    roleId: 8,
+                    roleName: 'Master Root',
+                    moduleId: 8,
+                    moduleName: 'access-control',
+                },
+            ],
+            privileges: [],
+            accessRole: {
+                id: 8,
+                code: 'master-root',
+                name: 'Master Root',
+                scope: 'CLIENT',
+                clientId: tenant_constants_1.NEWTECH_CLIENT_ID,
+            },
+            permissions,
+            authzVersion: 3,
+            identity: {
+                id: 1,
+                homeClientId: 2,
+                firstName: 'Root',
+                lastName: 'User',
+            },
+            cachedAt: new Date().toISOString(),
+        },
+    });
+    beforeEach(() => {
+        jest.clearAllMocks();
+        clientRepository.findOne.mockResolvedValue({
+            id: 2,
+            name: 'Altera',
+            alias: 'altera',
+        });
+    });
+    it('resolves support from active Newtech when the permanent home is Altera', () => __awaiter(void 0, void 0, void 0, function* () {
+        jest
+            .spyOn(service, 'resolve')
+            .mockResolvedValue(origin(['master.users.read']));
+        const resolved = yield service.resolveImpersonation(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2, 2);
+        expect(service.resolve).toHaveBeenCalledWith(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2);
+        expect(resolved.snapshot.clientId).toBe(2);
+        expect(resolved.snapshot.homeClientId).toBe(2);
+        expect(resolved.snapshot.clientName).toBe('Altera');
+    }));
+    it('rejects an origin outside Newtech', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield expect(service.resolveImpersonation(1, 2, 2, 2)).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    }));
+    it('rejects Newtech as the target', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield expect(service.resolveImpersonation(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2, tenant_constants_1.NEWTECH_CLIENT_ID)).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    }));
+    it('rejects an origin without master access', () => __awaiter(void 0, void 0, void 0, function* () {
+        jest.spyOn(service, 'resolve').mockResolvedValue(origin([]));
+        yield expect(service.resolveImpersonation(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2, 2)).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    }));
+    it('rejects an inactive or missing target client', () => __awaiter(void 0, void 0, void 0, function* () {
+        jest
+            .spyOn(service, 'resolve')
+            .mockResolvedValue(origin(['master.users.read']));
+        clientRepository.findOne.mockResolvedValue(null);
+        yield expect(service.resolveImpersonation(1, tenant_constants_1.NEWTECH_CLIENT_ID, 2, 2)).rejects.toBeInstanceOf(common_1.UnauthorizedException);
+    }));
+});

package/dist/modules/tenant/tenant-authorization.types.d.ts

@@ -6,18 +6,27 @@ export interface TenantRoleAuthorization {
 }
 export interface TenantAuthorizationSnapshot {
     userId: number;
-    homeClientId: number;
     clientId: number;
     clientName: string;
     clientAlias: string;
     roles: TenantRoleAuthorization[];
     privileges: string[];
+    accessRole: TenantAccessRoleAuthorization;
+    permissions: string[];
+    authzVersion: number;
     identity: TenantAuthorizationIdentity;
     cachedAt: string;
+    [key: string]: unknown;
+}
+export interface TenantAccessRoleAuthorization {
+    id: number;
+    code: string;
+    name: string;
+    scope: 'GLOBAL' | 'CLIENT';
+    clientId: number | null;
 }
 export interface TenantAuthorizationIdentity {
     id: number;
-    homeClientId: number;
     firstName?: string;
     username?: string;
     lastName?: string;
@@ -29,6 +38,7 @@ export interface TenantAuthorizationIdentity {
     passwordExpired?: number;
     viewEvaluations?: boolean;
     ern?: string;
+    [key: string]: unknown;
 }
 export interface ResolvedTenantAuthorization {
     identity: TenantAuthorizationIdentity;

package/dist/modules/tenant/tenant.types.d.ts

@@ -12,7 +12,6 @@ export interface TenantContextState {
 }
 export interface AuthenticatedTenantUser {
     id: number;
-    homeClientId: number;
     clientId: number;
     clientAlias?: string;
     clientName?: string;
@@ -23,6 +22,15 @@ export interface AuthenticatedTenantUser {
     impersonationReason: string | null;
     roles: string[];
     privileges: string[];
+    role: {
+        id: number;
+        code: string;
+        name: string;
+        scope: 'GLOBAL' | 'CLIENT';
+        clientId: number | null;
+    };
+    permissions: string[];
+    authzVersion: number;
     isMasterTenantAdmin: boolean;
     first_name?: string;
     username?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniorganization/uni-lib",
-  "version": "4.1.4",
+  "version": "4.1.5",
   "description": "UNI Library",
   "author": "Jhomiguel",
   "main": "dist/index.js",
@@ -9,6 +9,17 @@
     "dist/**/*",
     "*.md"
   ],
+  "scripts": {
+    "start:dev": "tsc -w",
+    "build": "tsc",
+    "prepublishOnly": "pnpm run build",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "lint": "tslint -p tsconfig.json -c tslint.json",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "test:e2e": "jest --config ./test/jest-e2e.json"
+  },
   "dependencies": {
     "@googlemaps/google-maps-services-js": "^3.4.2",
     "@aws-sdk/client-s3": "^3.833.0",
@@ -71,15 +82,5 @@
     },
     "coverageDirectory": "../coverage",
     "testEnvironment": "node"
-  },
-  "scripts": {
-    "start:dev": "tsc -w",
-    "build": "tsc",
-    "format": "prettier --write \"src/**/*.ts\"",
-    "lint": "tslint -p tsconfig.json -c tslint.json",
-    "test": "jest",
-    "test:watch": "jest --watch",
-    "test:cov": "jest --coverage",
-    "test:e2e": "jest --config ./test/jest-e2e.json"
   }
-}
+}

package/dist/entities/user-client-context.entity.d.ts

@@ -1,10 +0,0 @@
-export declare class UserClientContext {
-    userId: number;
-    clientId: number;
-    profile: string;
-    division: string;
-    lob: string;
-    reportsToId: number | null;
-    createdAt: Date;
-    updatedAt: Date;
-}

package/dist/entities/user-client-context.entity.js

@@ -1,59 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserClientContext = void 0;
-const typeorm_1 = require("typeorm");
-let UserClientContext = class UserClientContext {
-};
-exports.UserClientContext = UserClientContext;
-__decorate([
-    (0, typeorm_1.PrimaryColumn)({ name: 'USER_ID', type: 'numeric' }),
-    __metadata("design:type", Number)
-], UserClientContext.prototype, "userId", void 0);
-__decorate([
-    (0, typeorm_1.PrimaryColumn)({ name: 'client_id', type: 'integer' }),
-    __metadata("design:type", Number)
-], UserClientContext.prototype, "clientId", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: 'varchar', length: 250, default: '' }),
-    __metadata("design:type", String)
-], UserClientContext.prototype, "profile", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: 'varchar', length: 250, default: '' }),
-    __metadata("design:type", String)
-], UserClientContext.prototype, "division", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ type: 'varchar', length: 250, default: '' }),
-    __metadata("design:type", String)
-], UserClientContext.prototype, "lob", void 0);
-__decorate([
-    (0, typeorm_1.Column)({ name: 'REPORTS_TO', type: 'numeric', nullable: true }),
-    __metadata("design:type", Number)
-], UserClientContext.prototype, "reportsToId", void 0);
-__decorate([
-    (0, typeorm_1.CreateDateColumn)({
-        name: 'created_at',
-        type: 'timestamptz',
-        default: () => 'CURRENT_TIMESTAMP',
-    }),
-    __metadata("design:type", Date)
-], UserClientContext.prototype, "createdAt", void 0);
-__decorate([
-    (0, typeorm_1.UpdateDateColumn)({
-        name: 'updated_at',
-        type: 'timestamptz',
-        default: () => 'CURRENT_TIMESTAMP',
-    }),
-    __metadata("design:type", Date)
-], UserClientContext.prototype, "updatedAt", void 0);
-exports.UserClientContext = UserClientContext = __decorate([
-    (0, typeorm_1.Entity)('USER_CLIENT_CONTEXT', { schema: 'stm' })
-], UserClientContext);

package/dist/modules/tenant/master-users.guard.d.ts

@@ -1,4 +0,0 @@
-import { CanActivate, ExecutionContext } from '@nestjs/common';
-export declare class MasterUsersGuard implements CanActivate {
-    canActivate(context: ExecutionContext): boolean;
-}

package/dist/modules/tenant/master-users.guard.js

@@ -1,35 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.MasterUsersGuard = void 0;
-const common_1 = require("@nestjs/common");
-const tenant_constants_1 = require("./tenant.constants");
-let MasterUsersGuard = class MasterUsersGuard {
-    canActivate(context) {
-        var _a, _b, _c, _d, _e;
-        const request = context.switchToHttp().getRequest();
-        const user = request.user;
-        if (!user || user === true) {
-            throw new common_1.UnauthorizedException();
-        }
-        const effectiveClientId = (_b = (_a = request.tenantContext) === null || _a === void 0 ? void 0 : _a.clientId) !== null && _b !== void 0 ? _b : user.clientId;
-        const originalClientId = (_e = (_d = (_c = request.tenantContext) === null || _c === void 0 ? void 0 : _c.originalClientId) !== null && _d !== void 0 ? _d : user.originalClientId) !== null && _e !== void 0 ? _e : null;
-        const hasCapability = (user.privileges || []).some((privilege) => privilege.trim().toUpperCase() === tenant_constants_1.MASTER_USERS_ADMIN_PRIVILEGE);
-        if (effectiveClientId !== tenant_constants_1.NEWTECH_CLIENT_ID ||
-            originalClientId !== null ||
-            !user.isMasterTenantAdmin ||
-            !hasCapability) {
-            throw new common_1.ForbiddenException();
-        }
-        return true;
-    }
-};
-exports.MasterUsersGuard = MasterUsersGuard;
-exports.MasterUsersGuard = MasterUsersGuard = __decorate([
-    (0, common_1.Injectable)()
-], MasterUsersGuard);