Overview
RolesService.createRole() and RolesService.updateRole() both call this.permissionRepository.findByIds(permissionIds). findByIds is deprecated in TypeORM 0.3 (the project is on ^0.3.28) and scheduled for removal; the supported form is find({ where: { id: In(ids) } }). Beyond the deprecation, neither call verifies that the returned set matches the requested ids — passing a non-existent permission id silently yields a role with fewer permissions than the caller asked for, and the API returns 200 as though the full set were applied.
Specifications
Features:
- Permission lookups use the supported
In() operator.
- A request naming an unknown permission id fails rather than partially applying.
Tasks:
- Replace both
findByIds calls with find({ where: { id: In(permissionIds) } }).
- Compare the returned count against the requested count and throw
BadRequestException naming the missing ids when they differ.
- Sweep the codebase for other
findByIds usages and migrate them.
- Add tests covering a valid id set and a set containing an unknown id.
Impacted Files:
src/rbac/roles/roles.service.ts
Acceptance Criteria
- No
findByIds call remains in the codebase.
- A request with an unknown permission id returns 400 identifying it.
- Role permission assignment is all-or-nothing.
Overview
RolesService.createRole()andRolesService.updateRole()both callthis.permissionRepository.findByIds(permissionIds).findByIdsis deprecated in TypeORM 0.3 (the project is on^0.3.28) and scheduled for removal; the supported form isfind({ where: { id: In(ids) } }). Beyond the deprecation, neither call verifies that the returned set matches the requested ids — passing a non-existent permission id silently yields a role with fewer permissions than the caller asked for, and the API returns 200 as though the full set were applied.Specifications
Features:
In()operator.Tasks:
findByIdscalls withfind({ where: { id: In(permissionIds) } }).BadRequestExceptionnaming the missing ids when they differ.findByIdsusages and migrate them.Impacted Files:
src/rbac/roles/roles.service.tsAcceptance Criteria
findByIdscall remains in the codebase.